Release 0.13.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.cargo/mutants.toml

@@ -1,9 +0,0 @@
-# cargo-mutants (docs/mutation-testing.md). Mutants are judged by the black-box suites that will
-# outlive the kernel backend: the reference tests (tests/oracle, through the oracle_cases test).
-# The kernel's own unit tests are left out on purpose: a mutant only they catch is a behaviour the
-# backend-neutral suites would miss when the kernel is swapped.
-profile = "mutants"
-additional_cargo_test_args = [
-    "--test", "oracle_cases", "--", "--include-ignored",
-    "oracle_suite",
-]

.coderabbit.yaml

@@ -1,181 +0,0 @@
-# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
-reviews:
-  auto_review:
-    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
-    ignore_usernames:
-      - "dependabot[bot]"
-  path_instructions:
-    - path: "**"
-      instructions: |
-        Project rule: don't change anyone's existing defaults unless the change is purely additive and belongs in the application.
-        Flag any change to something a user already relies on: a default setting or preference value, what a command or tool does when used the usual way, the UI's default layout or behaviour, a keyboard or mouse shortcut, or the result an existing saved design rebuilds to.
-        Don't flag purely additive changes: a new command, a new setting whose default keeps today's behaviour, or a new option that appears only when someone chooses it. Don't flag bug fixes that only turn a crash or an error into the result the feature always promised.
-        When you flag one, start the comment with "Changes a default:", say what a user sees before and after, whether a setting keeps the old behaviour, and whether the PR description's `Changes a default:` line says so.
-
-    # Where code goes, SolidCraft or SolidCore: solidcore/docs/layers.md.
-    - path: "{apps,crates}/**"
-      instructions: |
-        Layers (solidcore/docs/layers.md): SolidCraft is a consumer of solidcore. It holds state,
-        selection, commands, settings, history and UI, and computes no geometry.
-        - Flag any new geometric computation here: a dot or cross product, normalising, sqrt or trig
-          on coordinates, a solve, a derivative, an intersection, a fit, a distance or area. Say which
-          layer it belongs in: a kernel primitive in solidcore/crates/solidcore if it computes
-          geometry, or a recipe in solidcore/crates/solidcore-ops if it only sequences kernel calls.
-        - Flag a new dependency on any solidcore crate other than solidcore-ops, solidcore-tess and
-          solidcore-record.
-        - Flag a new line in xtask/mesh-decisions.txt; that list only shrinks.
-        - Flag a second implementation of something solidcore already has (STEP, meshing, SSI,
-          tangent chains, frames).
-
-    # The vendored SolidCore kernel: its own review rules (from solidcore/.coderabbit.yaml, which
-    # CodeRabbit reads only at the repository root), with its paths under solidcore/.
-    - path: "solidcore/**"
-      instructions: |
-        The vendored SolidCore kernel (solidcore/). Paths in these instructions (AGENTS.md, docs/,
-        crates/) are under solidcore/.
-
-        Review for design quality as well as correctness. solidcore's rules are in AGENTS.md;
-        read the reference doc for the area a change touches before judging it.
-
-        - Flag code smells: logic duplicated from elsewhere in the kernel, special cases
-          bolted onto a general routine, tolerances or constants with no derivation, flags
-          or switches that keep an old path alive, fallbacks that hide a failure, and error
-          paths that lose the reason.
-        - Flag patches that make a symptom go away without fixing its cause: a widened
-          tolerance, a retry, an early return that skips the hard case, a test changed to
-          match new output. Ask what the root cause is and whether the change removes it.
-        - When a change reads like a patch, look at the other open pull requests and recent
-          changes in the same area. If several fixes keep touching the same code, say so,
-          and ask for the bigger picture: the shared cause, and the design that removes it.
-        - It is fine to recommend stopping and narrowing the scope. A smaller change that is
-          right, or an issue that states the real problem, is better than a larger change
-          that adds code which will have to be undone. Say so when that is the better path.
-        - Each fix needs a test that fails without it, and tests should check values a
-          wrong result would change. Tests gate on counts and values, never on timings.
-
-        The contract every construction keeps (docs/definitions-and-certificates.md):
-        - A face's surface is its definition S; its B-spline net B is an exact copy or a
-          certified approximation within a stored, proved epsilon. Every face of a result is
-          exact or certified. An operation that cannot build that refuses with a typed error
-          naming its cause and, where one exists, the size that builds. A correct refusal is a
-          correct result; a body built on a bare fitted face, an estimated bound or a widened
-          tolerance is not.
-        - A final answer (an intersection, a projection, a check, a continuity grade) reads S,
-          or B only inside a `NetScope` that asks for at least epsilon. A bound is enclosed,
-          never sampled or estimated, and rounding is counted.
-        - Layers (docs/layers.md): the kernel computes; ops decides and sequences and never
-          computes a geometric quantity; the applications compute nothing.
-        - No compatibility flags: a fix changes the default result, listing the cases it moves
-          and why each is right; no new `UpstreamFixes` field, no old path kept behind a switch.
-        - Show the problem first (AGENTS.md): a change to a case's result shows it before and
-          after from the same view, a VectorCraft schematic where the problem is a mechanism,
-          and the literature it follows. Ask for them when they are missing.
-        - Library code: no `unwrap`, `expect`, `panic!` or unchecked indexing; deterministic
-          results; input-dependent recursion bounded. Licence: only the upstream paths AGENTS.md
-          lists; never GPL/LGPL code.
-
-        The layer split (solidcore/docs/layers.md): solidcore is shared by every client, so flag
-        anything specific to one application: UI, command ids, application defaults or settings,
-        document state (selection, timeline, history). In solidcore/crates/solidcore-ops, also flag
-        any geometric quantity computed directly (a dot or cross product, normalizing, a square
-        root or trigonometry on coordinates, a linear solve, a derivative formula) instead of
-        through a kernel call: per solidcore/docs/layers.md it becomes a kernel primitive with its
-        own tests, and ops calls it.
-
-    - path: "solidcore/crates/solidcore/src/blend/**"
-      instructions: |
-        Fillets, chamfers, corners and setbacks: docs/generic-blend.md. They are one rolling-ball
-        construction (spine, rails, section, ends, corners, fold check, overflow); a failing case
-        means one of those parts is wrong for it, never a reason for a special case. Each blend
-        face carries its definition (`procedural_blend()`), or has an entry in the definition
-        ledger (crates/solidcore/tests/data/blend_definition_ledger/) and a test asserting which.
-        Cases are events decided from the geometry (a tangent end, a knife edge, a fold, a corner
-        type), not one construction tried and then the next. A round never ends at a seam's vertex
-        with a step: a picked edge continues across a seam into the rest of the same curve between
-        the same two faces, or the blend refuses. A size that does not fit is refused naming the
-        size that does.
-
-    - path: "solidcore/crates/solidcore/src/boolean/**"
-      instructions: |
-        Booleans: docs/booleans.md. The result is the regularized set operation decided on the
-        exact surfaces, or a typed refusal. Every decision point (a ray hit, a step-off point, an
-        imprinted vertex) is a root on S; no step reads a display mesh. A face set takes its class
-        (inside, outside, on) from a sector at a common edge, a ray or a coincident pair, and
-        nothing is kept or dropped for any other reason. A trimmed or copied face keeps its
-        surface's definition. Angle cut-offs and sampled coincidence are open work in the doc;
-        flag new ones standing in for a proof.
-
-    - path: "solidcore/crates/solidcore/src/offset/**"
-      instructions: |
-        Offset, shell and thicken: docs/offset-and-shell.md. A face's offset is the offset of its
-        definition S, never of its net B: exact for the analytic kinds, certified otherwise. Where
-        the distance reaches the least radius of curvature on the displaced side (towards the
-        centre of curvature) the offset collapses or folds; that is refused naming the largest
-        wall that builds, never built and repaired. A wall on the other side never folds from
-        curvature alone. The offset body's tolerance
-        is the input body's. The five-stage construction (face offsets, mitres with the extension
-        reach, arrangement, winding-number cavity rule, extraction) is the design; flag work that
-        extends the old executive instead of it.
-
-    - path: "solidcore/crates/solidcore/src/sweep/**"
-      instructions: |
-        Swept surfaces and threads: docs/procedural-sweep.md. A sweep is its definition (profile,
-        path, frame); its net is exact where the doc says so and certified otherwise. Check a
-        change against the doc's invariants and its exact-net cases.
-
-    - path: "solidcore/crates/solidcore/src/intersect/**"
-      instructions: &ssi |
-        Surface/surface intersection: docs/ssi.md. Curves come from closed forms where they exist
-        (line, circle, ellipse) and are traced otherwise; tangent contacts and branch points are
-        events with their own handling, not a retry with a smaller step. Every reported point is a
-        root on both definitions within its stated tolerance.
-    - path: "solidcore/crates/ssi/**"
-      instructions: *ssi
-    - path: "solidcore/crates/solidcore-ssi/**"
-      instructions: *ssi
-
-    - path: "solidcore/crates/solidcore/src/topology/**"
-      instructions: &validity |
-        B-rep validity, tolerances and healing: docs/validity-and-tolerances.md. A tolerance may
-        grow only to a bound: for imported data, to an enclosed (not sampled) gap, recorded; for a
-        construction, to its certificates' delta + max epsilon. A measured gap larger than that
-        means the construction is wrong: refuse, or recompute the curve from its surfaces'
-        intersection. No tube or ball may reach an entity it does not bound. A seam is an edge; a
-        face crossing its surface's seam carries it.
-    - path: "solidcore/crates/solidcore/src/heal/**"
-      instructions: *validity
-
-    - path: "solidcore/crates/solidcore-tess/**"
-      instructions: |
-        Tessellation is for display and export only (docs/layers.md): it decides nothing about the
-        model. Flag any model decision made from a mesh.
-
-    - path: "solidcore/crates/solidcore-ops/**"
-      instructions: |
-        Ops is the modelling API (docs/layers.md): it chooses entities, parameters and defaults and
-        sequences kernel calls; it never computes a geometric quantity itself (distances,
-        curvatures, intersections, fits). Results go through `finish`, which refuses a body that is
-        not a valid outward solid where a solid was asked for.
-
-    - path: "solidcore/docs/**"
-      instructions: |
-        A doc points to code, tests, records and the literature, never to a pull request or an
-        issue: no `#NNNN` and no PR or issue links, so a page reads the same whatever happens to the
-        tracker. A new page under docs/ needs the maintainers' agreement on its issue; one the
-        maintainers asked for in the pull request is fine. Figures are drawn in VectorCraft with
-        live text, their `.vectorcraft` source beside them, palette in docs/agent-style.md.
-
-    - path: "solidcore/crates/solidcore/tests/kernel_cases/**"
-      instructions: |
-        A kernel case's outcome changes in the case itself: its JSON expectation (and its
-        `gallery_note` if needed), its line in `known_failing.json` and its render beside it, never
-        a doc (the site's case gallery is generated from them). An expectation is graded on closed
-        forms or invariants of the geometry, not on another kernel's measured result; a refusal is
-        graded on the size it names.
-  pre_merge_checks:
-    custom_checks:
-      - name: "Existing defaults unchanged"
-        mode: "warning"
-        instructions: |
-          Pass if the pull request changes no default a user already relies on (default setting or preference values, what a command or tool does when used the usual way, the UI's default layout or behaviour, shortcuts, or the result an existing saved design rebuilds to), or if its changes are purely additive.
-          Fail otherwise, naming each changed default and what a user sees before and after. Also fail if the description says `Changes a default: no` while the code changes one.

.config/nextest.toml

@@ -1,25 +1,21 @@
 # cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
-# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml),
-# except the GPU path tracer's tests (the gpu-path group below), which run in four shards of their own.
+# PR runs build the tests once and run them in 4 shards (.github/workflows/ci.yml).
 
 [profile.ci]
-# Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
-# every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`. The
-# boolean_props property tests run only nightly (ci.yml excludes them from pushes to main).
+# Heavy tests (one to four minutes each on a CI runner) that pull requests skip. They run on
+# every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`.
 # Keep this list in sync with docs/book/src/dev/testing.md and CONTRIBUTING.md.
 default-filter = """
 not (
     (package(solidcraft-engine) & (
         test(=tests::hostile_params_never_panic)
         | test(/^tests::robustness::/)
+        | test(/^tests::robustness_goldens::/)
         | test(=pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen)
         | test(=pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs)
         | test(=cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall)
     ))
     | (package(solidcraft-kernel) & test(=tests::boolean_identity_on_tangent_primitives))
-    | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))
-    | (package(solidcraft-kernel) & binary(boolean_props))
-    | (package(solidcraft-engine) & binary(atomic_commands))
     | (package(solidcraft-ui-egui) & binary(scenarios) & test(=acceptance_sensor_enclosure))
 )
 """
@@ -33,100 +29,10 @@ slow-timeout = { period = "60s" }
 [profile.ci.junit]
 path = "junit.xml"
 
-# Bound the whole test process, including Vulkan host initialization and teardown.
-# Cold runs can warm multiple pipelines before the first image starts rendering.
+# The action matrix sample runs its designs in parallel worker processes, one per CPU. Run with
+# other tests beside it (the heavy ones on main), a pi-case hole that takes 8 s alone (#952 makes
+# it a real hole) went past the matrix's 90 s action limit. It runs on its own.
 [[profile.ci.overrides]]
-filter = "package(=solidcraft-ui-egui) & test(=render_workspace::tests::progressive_image_controls_route_to_the_registered_host)"
-slow-timeout = { period = "60s", terminate-after = 20 }
-
-# The action matrix sample runs its designs in parallel workers (ACTION_MATRIX_JOBS, set to match in
-# ci.yml). Its workers reserve that many of nextest's threads, so the cores are not oversubscribed
-# (a pi-case hole that takes 8 s alone went past the matrix's 90 s action limit when they were),
-# and it starts first, beside the other slow tests.
-[[profile.ci.overrides]]
-filter = "binary(action_matrix) & test(=action_matrix_sample)"
-threads-required = 12
-priority = 100
-
-# The slowest tests start first, so a shard does not end with one of them running alone on a
-# core while the others sit idle. Medians from the CI test timings (the junit artifacts), slowest
-# first; a test over ~100 s belongs here.
-[[profile.ci.overrides]]
-filter = """
-(package(solidcraft-engine) & (
-    test(/^tests::robustness::/)
-    | test(=tests::hostile_params_never_panic)
-    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
-    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
-    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
-    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
-    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
-    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
-))
-| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
-| (package(solidcraft-kernel) & (
-    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
-    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
-    | test(=tspline::tests::hostile_tsplines_never_panic)
-    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
-    | test(/^issue_788_tests::equal_bores_crossing_/)
-))
-"""
-priority = 100
-
-# Each nextest test has its own process/device. Concurrent cold lavapipe path
-# compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
-# Serialize this module per CI shard; other tests retain their normal parallelism.
-# CI runs these in their own job (GPU path tests in ci.yml), split into count partitions.
-[test-groups.gpu-path]
-max-threads = 1
-
-[[profile.ci.overrides]]
-filter = "package(=solidcraft-gpu) & test(/^path::/)"
-test-group = "gpu-path"
-
-# Full local validation opts into its own scheduling policy. Keep GitHub CI's
-# worker reservation and slow-test priorities above independent of this runner.
-[profile.local-ci]
-inherits = "ci"
-
-[[profile.local-ci.overrides]]
 filter = "binary(action_matrix) & test(=action_matrix_sample)"
 threads-required = "num-cpus"
-priority = 100
 
-[[profile.local-ci.overrides]]
-filter = "package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic)"
-priority = 99
-
-[[profile.local-ci.overrides]]
-filter = """
-(package(solidcraft-engine) & (
-    test(/^tests::robustness::/)
-    | test(=tests::hostile_params_never_panic)
-    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
-    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
-    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
-    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
-    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
-    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
-))
-| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
-| (package(solidcraft-kernel) & (
-    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
-    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
-    | test(=tspline::tests::hostile_tsplines_never_panic)
-    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
-    | test(/^issue_788_tests::equal_bores_crossing_/)
-))
-"""
-priority = 98
-
-# Native Windows shader/device creation must not overlap within the local run.
-[test-groups.windows-gpu]
-max-threads = 1
-
-[[profile.local-ci.overrides]]
-platform = "cfg(windows)"
-filter = "package(solidcraft-gpu) | package(solidcraft) | (package(solidcraft-ui-egui) & test(/(offscreen|gpu)/))"
-test-group = "windows-gpu"

.gitattributes

@@ -1,12 +0,0 @@
-# Preserve canonical source receipts and the runtime icon-discovery snapshot.
-.gitattributes text eol=lf
-/assets/icons/ui/design/requested_icons.txt text eol=lf
-# Shaders reach the code through include_str!, and tests match multi-line WGSL excerpts
-# written as Rust strings (always LF), so a CRLF checkout must not change them (#13138).
-*.wgsl text eol=lf
-# SolidCraft designs (.sc): a JSON document or a ZIP container, never Scala source, so they
-# stay out of GitHub's language statistics. Git's own text/binary detection handles both kinds.
-*.sc -linguist-detectable
-# The kernel is vendored with git subtree, keeping its own history and licence: it must not look
-# like SolidCraft source in GitHub's language statistics.
-solidcore/** linguist-vendored

.github/CODEOWNERS

@@ -1,7 +0,0 @@
-# Code owners: a pull request that changes these paths needs an approving review from an owner
-# listed here when the branch ruleset requires review from Code Owners. Later lines take
-# precedence over earlier ones.
-
-# The vendored SolidCore kernel, owned as in SolidCore's own CODEOWNERS
-# (solidcore/.github/CODEOWNERS, which GitHub reads only at a repository's root).
-/solidcore/ @jyviko @bherbruck

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,43 +0,0 @@
-name: Bug report
-description: Something in SolidCraft does the wrong thing
-labels: [bug]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to report this! Inside the app, **Report an Issue** fills most of this in for you, with the command, its settings and your environment.
-        Before reporting a boolean or modelling failure, please try to reproduce it on the latest nightly or a build from current `main`, and say which build you used.
-  - type: textarea
-    id: what
-    attributes:
-      label: What happened
-      description: What did you expect, and what happened instead?
-    validations:
-      required: true
-  - type: textarea
-    id: steps
-    attributes:
-      label: Steps to reproduce
-      description: |
-        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.sc --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
-        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
-      placeholder: |
-        1. Sketch a circle on the XY plane
-        2. Extrude it 10 mm
-        3. Fillet the top edge with 6 mm
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: SolidCraft version and OS
-      description: Help → About shows the version.
-      placeholder: 0.15.0, Windows 11
-    validations:
-      required: true
-  - type: textarea
-    id: media
-    attributes:
-      label: Screenshots or recording
-      description: |
-        For anything you can see in the app, a screenshot or short recording of a small example helps the most. Please leave out private designs and personal details.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Help reproduce and fix a SolidCraft problem
+title: ''
+labels: ''
+assignees: ''
+---
+
+## Behavior
+
+What did you expect, and what happened instead?
+
+## Reproduction
+
+Include steps, SolidCraft version/commit and relevant environment details. Prefer a small example without private design data.
+
+When the problem shows on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+
+## Screenshots of the behavior (when observable)
+
+For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
+
+Flowcharts and Mermaid diagrams cannot substitute for evidence of visible behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate the point. Changes with no useful observable behavior may omit screenshot/video evidence. Exclude private designs and sensitive details; attach media or link to an accessible recording rather than committing generated review artifacts.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +0,0 @@
-# Blank issues stay on: the app's Report an Issue opens issues/new?title=…&body=… with the report
-# filled in (crates/ui-egui/src/issue_report.rs), which GitHub drops when blank issues are off.
-blank_issues_enabled: true
-contact_links:
-  - name: Questions and chat
-    url: https://discord.gg/FtU4NQNVDH
-    about: Ask questions and talk with users and contributors on the SolidCraft Discord.

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,16 +0,0 @@
-name: Feature request
-description: Something SolidCraft should do
-labels: [enhancement]
-body:
-  - type: textarea
-    id: goal
-    attributes:
-      label: What are you trying to do
-      description: The part or workflow you have in mind, and where SolidCraft gets in the way today.
-    validations:
-      required: true
-  - type: textarea
-    id: idea
-    attributes:
-      label: How you imagine it working
-      description: Optional. Describe the behaviour in your own words; please don't paste another product's documentation.

.github/actionlint.yaml

@@ -1,11 +0,0 @@
-self-hosted-runner:
-  labels:
-    - self-hosted-fast
-    - self-hosted-light
-    # Blacksmith (see the top of workflows/ci.yml).
-    - blacksmith-2vcpu-ubuntu-2404
-    - blacksmith-4vcpu-ubuntu-2404
-    - blacksmith-8vcpu-ubuntu-2404
-    - blacksmith-16vcpu-ubuntu-2404
-    - blacksmith-32vcpu-ubuntu-2404
-    - blacksmith-8vcpu-windows-2025

.github/pull_request_template.md

@@ -1,14 +1,6 @@
-<!-- Title: which part of the app changes and what a user now sees or can do, clear to someone who hasn't seen your chat, the issue or the code. -->
-
 ## Change
 
-Start with what this is, in plain words someone new to the project would understand: what it does and who it's for. Don't assume anyone knows the name of your tool, project or feature. Then describe the problem and resulting behavior. Link the issue when applicable.
-
-Changes a default: no
-
-<!-- Required line, replace "no" if this changes what a user gets out of the box (a default value, key binding, setting, tool behaviour):
-Changes a default: yes — <what>, old behaviour kept behind preference <name>
-Docs-only and bot PRs are exempt. -->
+Describe the problem and resulting behavior. Link the issue when applicable.
 
 ## Validation
 
@@ -16,8 +8,6 @@ What did you run, and what were the results? Include expected and measured value
 
 ## Screenshots of the behavior (when observable)
 
-Put the picture or video here in the description. A file in the diff doesn't count: a maintainer has to be able to see what this is without opening the changed files.
-
 For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
 
 Flowcharts and Mermaid diagrams cannot substitute for evidence of visible behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate the point. Changes with no useful observable behavior may omit screenshot/video evidence. Exclude private designs and sensitive details; attach media or link to an accessible recording rather than committing generated review artifacts.

.github/release-notes.md

@@ -1,18 +1,17 @@
 SolidCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
-parameter to watch the timeline rebuild. [Documentation](https://docs.solidcraft.io/)
-· [try it in the browser](https://solidcraft.io/app) ·
+parameter to watch the timeline rebuild. [Documentation](https://bherbruck.github.io/solidcraft/)
+· [try it in the browser](https://bherbruck.github.io/solidcraft/app/) ·
 [contributing](https://github.com/bherbruck/solidcraft/blob/main/CONTRIBUTING.md) ·
 [issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
-`solidcraft-cli mcp` ([how](https://docs.solidcraft.io/guide/mcp.html)).
+`solidcraft-cli mcp` ([how](https://bherbruck.github.io/solidcraft/guide/mcp.html)).
 
 **What's new** in SolidCraft {version} is listed below, and the
 [ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
 the known limitations. Designs from every earlier version open in this one.
 
-**New app ID.** The app ID is now `io.tangencylabs.solidcraft` (it was `ai.storyteller.solidcraft`,
-and `ai.storyteller.solvecraft` up to 0.7): `flatpak update` offers to replace the old app, the
-`.deb`, `.rpm` and AppImage remove the old menu entry, and settings stay. On macOS the bundle ID
-changed too, so macOS asks once more for the permissions it had granted.
+**Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
+`flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
+menu entry.
 
 **Upgrading from 0.5 or earlier.** 0.6 renamed SolveCraft to SolidCraft and made the zip
 container the default save format. `.solvecraft` designs, old settings folders and
@@ -42,20 +41,16 @@ installing SolidCraft; keep both remotes in the same user installation:
 
 ```sh
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
-flatpak remote-add --user --if-not-exists solidcraft https://docs.solidcraft.io/flatpak/solidcraft.flatpakrepo
-flatpak install --user solidcraft io.tangencylabs.solidcraft
-flatpak run io.tangencylabs.solidcraft
+flatpak remote-add --user --if-not-exists solidcraft https://bherbruck.github.io/solidcraft/flatpak/solidcraft.flatpakrepo
+flatpak install --user solidcraft ai.storyteller.solidcraft
+flatpak run ai.storyteller.solidcraft
 ```
 
-A remote added from the old `bherbruck.github.io` address no longer finds updates: run
-`flatpak remote-modify --user --url=https://docs.solidcraft.io/flatpak/repo/ solidcraft`, then
-`flatpak update --user`.
-
-Flatpak installs under an old ID (`ai.storyteller.solidcraft`, or `ai.storyteller.solvecraft` from 0.7 or
-earlier): `flatpak update --user` offers to replace it with `io.tangencylabs.solidcraft`, and settings move along.
+Flatpak installs from 0.7 or earlier use the old ID `ai.storyteller.solvecraft`: `flatpak update --user`
+offers to replace it with `ai.storyteller.solidcraft`, and settings move along.
 
 Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
-still need an internet connection. [Linux installation details](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).
+still need an internet connection. [Linux installation details](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
 
 The builds aren't signed yet. On macOS, right-click `SolidCraft.app` in Applications and choose
 **Open** the first time (or run `xattr -dr com.apple.quarantine /Applications/SolidCraft.app`).

.github/workflows/claim.yml

@@ -1,52 +0,0 @@
-# `/claim` and `/unclaim` on issues (CONTRIBUTING.md, "Sending a change"), and a daily sweep that
-# frees claims nobody is working on. A pull request that references an issue (`<summary> (#N)`,
-# `Fixes #N`) claims it too. The logic is in scripts/claim/claim.js (tested in ci.yml).
-name: Claim
-
-on:
-  issue_comment:
-    types: [created]
-  # pull_request_target so PRs from forks can label and assign. It runs the base branch's
-  # scripts/claim and only reads the PR's title, body and author; the PR's code is never checked out.
-  pull_request_target:
-    types: [opened, reopened]
-  schedule:
-    - cron: '17 5 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read # to check out scripts/claim
-  issues: write
-  pull-requests: read
-
-# One run at a time per issue, so two simultaneous /claim comments can't both win.
-concurrency:
-  group: claim-${{ github.event.issue.number || github.event.pull_request.number || 'sweep' }}
-  cancel-in-progress: false
-
-jobs:
-  claim:
-    name: Claim bot
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    if: >-
-      github.event_name != 'issue_comment' ||
-      (!github.event.issue.pull_request && github.event.comment.user.type != 'Bot' &&
-      (startsWith(github.event.comment.body, '/claim') || startsWith(github.event.comment.body, '/unclaim')))
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/claim
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const claim = require('./scripts/claim/claim.js');
-            if (context.eventName === 'issue_comment') {
-              await claim.handleComment({ github, context });
-            } else if (context.eventName === 'pull_request_target') {
-              const claimed = await claim.handlePull({ github, context });
-              core.info(`Claimed: ${claimed.join(', ') || 'none'}`);
-            } else {
-              const released = await claim.sweep({ github, context });
-              core.info(`Released: ${released.join(', ') || 'none'}`);
-            }

.github/workflows/docker.yml

@@ -1,110 +0,0 @@
-# The web app as a container image on GitHub's container registry, for self-hosting
-# (packaging/docker; the book's "Self-hosting with Docker"):
-#
-#   ghcr.io/<owner>/solidcraft-web:latest   the latest published release
-#   ghcr.io/<owner>/solidcraft-web:0.14.0   a release (also 0.14); pre-releases get only their version
-#   ghcr.io/<owner>/solidcraft-web:edge     main
-#
-# For linux/amd64 and linux/arm64. The site is built here, as Pages and Release build it, and
-# passed to the Dockerfile as its `site` stage. Pull requests that touch the image build and
-# smoke-test it without publishing. Releases published by an agent or maintainer trigger this;
-# the nightly pre-releases (made with GITHUB_TOKEN) do not.
-name: Docker
-
-on:
-  push:
-    branches: [main]
-    # The image holds the web app only: documentation, test data and the GitHub bots' scripts can't
-    # change it, so a push touching only those builds nothing (edge stays at the last code change).
-    # ATTRIBUTION.md is the exception among the Markdown files: the app embeds it (Help, About).
-    # The last matching pattern wins.
-    paths: ["**", "!docs/**", "!**/*.md", "ATTRIBUTION.md", "!tests/**", "!scripts/claim/**", "!scripts/triage/**"]
-  release:
-    types: [published]
-  pull_request:
-    paths: ["packaging/docker/**", ".github/workflows/docker.yml"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: docker-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  CARGO_TERM_COLOR: always
-  TRUNK_VERSION: v0.21.14
-
-jobs:
-  image:
-    if: ${{ !github.event.repository.private }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: docker-web
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-      - name: Install trunk
-        run: |
-          mkdir -p "$HOME/.local/bin"
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-      - name: Build the web app
-        working-directory: apps/solidcraft-web
-        run: trunk build --release
-      - name: Image name
-        id: image
-        # Registry names are lower case; a fork's owner may not be.
-        run: echo "name=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/solidcraft-web" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: meta
-        with:
-          images: ${{ steps.image.outputs.name }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=edge,branch=main
-            type=ref,event=pr
-          labels: |
-            org.opencontainers.image.title=SolidCraft (web)
-            org.opencontainers.image.description=SolidCraft, open-source parametric CAD, in the browser: the web app served by nginx on port 8080
-            org.opencontainers.image.licenses=MIT OR Apache-2.0
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - name: Build for the smoke test
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          file: packaging/docker/Dockerfile
-          build-contexts: site=dist/web
-          platforms: linux/amd64
-          load: true
-          tags: solidcraft-web:test
-      - name: Smoke test
-        run: bash packaging/docker/smoke-test.sh solidcraft-web:test
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and publish
-        if: github.event_name != 'pull_request'
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          file: packaging/docker/Dockerfile
-          build-contexts: site=dist/web
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          annotations: ${{ steps.meta.outputs.annotations }}

.github/workflows/external-corpus.yml

@@ -1,42 +0,0 @@
-# Nightly import checks on real-world STEP files (#1397): the external corpus in
-# tests/external-corpus.toml is downloaded (hash-verified), imported headless, and checked
-# against tolerance-based expectations — body counts, total volume and area, time and memory
-# budgets. It is not part of `cargo xtask ci`: it downloads from the internet.
-#
-# Import results should improve over time (healing, edge merging, meshing). When a check fails
-# because the numbers moved for the better (or the source changed upstream), re-record with
-# `cargo xtask external-corpus --bless "why"` in a pull request, never by editing numbers.
-name: External corpus
-
-on:
-  schedule:
-    - cron: '40 3 * * *'
-  workflow_dispatch:
-    inputs:
-      only:
-        description: "Run only this corpus entry name (empty = every entry)"
-        type: string
-        default: ""
-
-permissions:
-  contents: read
-
-jobs:
-  corpus:
-    name: Import the external STEP corpus
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Build the CLI
-        run: cargo build --profile ci -p solidcraft-cli
-      - name: Import and check every entry
-        env:
-          ONLY: ${{ inputs.only }}
-        run: |
-          if [ -z "$ONLY" ]; then
-            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli
-          else
-            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli --only "$ONLY"
-          fi

.github/workflows/fillet-rig.yml

@@ -1,110 +0,0 @@
-# The fillet rig as a regression gate: a pull request that touches fillet code (the paths below)
-# runs every case in tests/kernel-cases/fillets/ through one release build of
-# solidcraft-cli, and fails on a regression (a case that fails and
-# tests/kernel-cases/fillets/KNOWN_FAILING does not list) or on a listed case that now passes
-# (it is fixed: remove its line, so the list only shrinks). See tests/kernel-cases/README.md.
-#
-# GitHub filters a workflow by whole files, so the fillet parts of crates/doc/src/eval*.rs and
-# crates/engine/src/cmd/features.rs select it whenever those files change. Pushes to main and
-# develop that touch the same paths run it too and save the compiler cache (a Blacksmith sticky
-# disk) that pull requests then mount read-only.
-name: Fillet rig
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    paths:
-      - "crates/kernel/src/blend*.rs"
-      - "crates/kernel/src/fillet*.rs"
-      - "crates/kernel/src/*corner*.rs"
-      - "crates/kernel/src/continuity*.rs"
-      - "crates/smlib/**"
-      - "crates/doc/src/eval*.rs"
-      - "crates/engine/src/cmd/features.rs"
-      - "tests/kernel-cases/fillets/**"
-      # The rig itself: the grading, the runner and this workflow.
-      - "apps/solidcraft-cli/src/kernel_cases.rs"
-      - "xtask/src/kernel_cases.rs"
-      - ".github/workflows/fillet-rig.yml"
-  push:
-    branches: [main, develop]
-    # The same paths as pull_request.
-    paths:
-      - "crates/kernel/src/blend*.rs"
-      - "crates/kernel/src/fillet*.rs"
-      - "crates/kernel/src/*corner*.rs"
-      - "crates/kernel/src/continuity*.rs"
-      - "crates/smlib/**"
-      - "crates/doc/src/eval*.rs"
-      - "crates/engine/src/cmd/features.rs"
-      - "tests/kernel-cases/fillets/**"
-      # The rig itself: the grading, the runner and this workflow.
-      - "apps/solidcraft-cli/src/kernel_cases.rs"
-      - "xtask/src/kernel_cases.rs"
-      - ".github/workflows/fillet-rig.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: fillet-rig-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  fillets:
-    name: Fillet rig
-    # Draft pull requests run no CI, as in ci.yml.
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 60
-    env:
-      CARGO_INCREMENTAL: "0"
-      RUSTC_WRAPPER: sccache
-      SCCACHE_DIR: /home/runner/.cache/sccache
-      SCCACHE_CACHE_SIZE: 10G
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Size parallel compiles to the job's memory
-        run: scripts/ci/build-jobs.sh
-      - uses: dtolnay/rust-toolchain@stable
-      # Only main and develop commit the cache; pull requests and forks mount a clone and never
-      # write back.
-      - name: Mount the compiler cache
-        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
-        continue-on-error: true
-        with:
-          key: ${{ github.repository }}-sccache-fillet-rig
-          path: /home/runner/.cache/sccache
-          commit: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') && 'on-change' || 'false' }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: fillet-rig
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' }}
-      - name: Set up compiler cache
-        id: sccache
-        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
-        with:
-          version: v0.16.0
-        # A failed download of sccache (GitHub release outages answer 504) must not fail the build.
-        continue-on-error: true
-      - name: Build without the compiler cache if it could not be set up
-        if: steps.sccache.outcome == 'failure'
-        run: echo "RUSTC_WRAPPER=" >> "$GITHUB_ENV"
-      - name: Build the CLI (release)
-        run: cargo build --release --locked -p solidcraft-cli
-      - name: Run the fillet cases against the known-failing list
-        run: >-
-          cargo run -q --locked -p xtask -- kernel-cases --area fillets
-          --cli target/release/solidcraft-cli --out "$RUNNER_TEMP/fillet-rig"
-          --known-failing tests/kernel-cases/fillets/KNOWN_FAILING
-      - name: Keep the results
-        if: always()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: fillet-rig-results
-          path: ${{ runner.temp }}/fillet-rig/results.json
-          if-no-files-found: ignore

.github/workflows/flatpak-pages.yml

@@ -21,8 +21,6 @@ concurrency:
 jobs:
   publish:
     name: Request the combined docs, web, and Flatpak deployment
-    # A pre-release stays off the Flatpak feed: the feed's one branch is what `flatpak update` offers.
-    if: github.event_name == 'workflow_dispatch' || !github.event.release.prerelease
     runs-on: ubuntu-24.04
     env:
       GH_TOKEN: ${{ github.token }}

.github/workflows/generated.yml

@@ -1,72 +0,0 @@
-# Files generated from the code are rewritten here, on main, after each merge, so pull requests
-# never edit them (two pull requests that each regenerated one would always conflict):
-# THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
-# Pending files (assets/locales/pending, attribution/pending) are folded into the catalogs and
-# ATTRIBUTION.md by `cargo xtask fold-pending`.
-name: Generated files
-
-on:
-  push:
-    branches: [main]
-    # THIRD-PARTY-LICENSES.txt follows the manifests, the lockfile, the vendored crates' licence
-    # files and the fonts' licences; docs/features.md follows the command registry (crates/engine),
-    # read through solidcraft-cli. Other pushes regenerate nothing.
-    paths:
-      - "Cargo.lock"
-      - "**/Cargo.toml"
-      - "vendor/**"
-      # solidcore's licence files are embedded in THIRD-PARTY-LICENSES.txt.
-      - "solidcore/LICENSE"
-      - "solidcore/NOTICE"
-      - "solidcore/ATTRIBUTION.md"
-      - "assets/fonts/**"
-      - "crates/engine/**"
-      - "apps/solidcraft-cli/**"
-      - "xtask/**"
-      - "assets/locales/pending/*.json"
-      - "attribution/pending/*.md"
-      - ".github/workflows/generated.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-# One run at a time; a burst of merges leaves one run waiting, which sees all of them.
-concurrency:
-  group: generated-files
-  cancel-in-progress: false
-
-jobs:
-  regenerate:
-    name: Regenerate and commit
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    steps:
-      # Always main itself, never pull request code, since this job can push.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          # main goes through the merge queue; this deploy key may push past it.
-          ssh-key: ${{ secrets.GENERATED_FILES_DEPLOY_KEY }}
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: generated-files
-      - name: THIRD-PARTY-LICENSES.txt
-        run: cargo xtask licences
-      - name: docs/features.md
-        run: cargo xtask features
-      - name: Pending locale strings and attribution rows
-        run: cargo xtask fold-pending
-      - name: Commit if changed
-        run: |
-          if [ -z "$(git status --porcelain)" ]; then echo "unchanged"; exit 0; fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add -A THIRD-PARTY-LICENSES.txt docs/features.md assets/locales ATTRIBUTION.md attribution
-          git commit -m "Regenerate generated files and fold pending files [skip ci]"
-          for _ in 1 2 3; do
-            git pull --rebase origin main && git push origin HEAD:main && exit 0
-            sleep 10
-          done
-          exit 1

.github/workflows/kernel-paused.yml

@@ -1,43 +0,0 @@
-# While a new geometry kernel is evaluated, new issues and discussions about kernel work, and new
-# pull requests that change the kernel directories, are labelled `kernel-paused` for a maintainer to
-# answer (CONTRIBUTING.md, "Kernel work is paused"). The logic is in scripts/kernel-paused/ (tested
-# in ci.yml).
-name: Kernel paused
-
-on:
-  issues:
-    types: [opened]
-  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
-  # scripts/kernel-paused and only lists the PR's changed paths; the PR's code is never checked out.
-  pull_request_target:
-    types: [opened]
-  discussion:
-    types: [created]
-
-permissions:
-  contents: read # to check out scripts/kernel-paused
-  issues: write
-  pull-requests: write # to list a PR's changed paths and add its label
-  discussions: write
-
-concurrency:
-  group: kernel-paused-${{ github.event.issue.number || github.event.pull_request.number || github.event.discussion.number }}
-  cancel-in-progress: false
-
-jobs:
-  paused:
-    name: Kernel paused bot
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/kernel-paused
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const paused = require('./scripts/kernel-paused/kernel-paused.js');
-            const done = context.eventName === 'discussion'
-              ? await paused.handleDiscussion({ github, context })
-              : await paused.handleOpened({ github, context });
-            core.info(done);

.github/workflows/kernel-rig.yml

@@ -1,241 +0,0 @@
-# The kernel rig and the complexity ladder as a regression gate. A plan job maps a pull request's
-# changed files to the rig areas they can affect (scripts/ci/kernel_rig_plan.py): an area runs
-# when a file its tests/kernel-cases/<area>/PATHS lists changes, or one of its cases; every area
-# runs when the shared core in tests/kernel-cases/PATHS-ALL changes, including the vendored
-# SolidCore source in solidcore; the ladder runs whenever any
-# area does. One job then builds solidcraft-cli once (release), checks that every
-# registry command has a case or an exemption (tests/kernel-cases/EXEMPT), and hands the CLI to a
-# matrix of shards as an artifact, one per selected area plus the ladder, in parallel, so the
-# wall time is the build plus the slowest shard. See tests/kernel-cases/README.md.
-#
-# - An area fails on a regression (a case that fails and its tests/kernel-cases/<area>/KNOWN_FAILING
-#   does not list) or on a listed case that passes (it is fixed: remove its line in the same pull
-#   request, so the list only shrinks).
-# - The ladder fails on any case whose status or counts differ from
-#   tests/kernel-cases/ladder/golden.json; a right change is re-recorded (`--record "why"`).
-#
-# The trigger paths are whole folders that hold every area's PATHS (a self-test,
-# scripts/ci/test_kernel_rig_plan.py, checks they do), so a pull request that touches none of
-# them (the UI, docs, packaging) starts no runner at all, and a new area needs no edit here: the
-# plan finds the areas from the folders. Pushes to main and develop on the same paths, merge groups
-# (once the queue is on), the release gate (release-gate.yml, workflow_call) and a run by hand run
-# every area; those pushes also commit the compiler cache (a Blacksmith sticky disk) that every
-# other run mounts read-only.
-name: Kernel rig
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    paths:
-      - "crates/kernel/**"
-      - "crates/geom/**"
-      - "crates/smlib/**"
-      - "crates/step/**"
-      - "crates/io/src/**"
-      - "crates/doc/src/**"
-      - "crates/engine/src/**"
-      - "tests/kernel-cases/**"
-      # The vendored kernel: a change here runs every area (tests/kernel-cases/PATHS-ALL).
-      - "solidcore/**"
-      # The rig itself: the grading, the runner, the selection and this workflow.
-      - "apps/solidcraft-cli/src/kernel_cases.rs"
-      - "xtask/src/kernel_cases.rs"
-      - "xtask/src/kernel_ladder.rs"
-      - "scripts/ci/kernel_rig_plan.py"
-      - "scripts/ci/test_kernel_rig_plan.py"
-      - ".github/workflows/kernel-rig.yml"
-  push:
-    branches: [main, develop]
-    # The same paths as pull_request.
-    paths:
-      - "crates/kernel/**"
-      - "crates/geom/**"
-      - "crates/smlib/**"
-      - "crates/step/**"
-      - "crates/io/src/**"
-      - "crates/doc/src/**"
-      - "crates/engine/src/**"
-      - "tests/kernel-cases/**"
-      # The vendored kernel: a change here runs every area (tests/kernel-cases/PATHS-ALL).
-      - "solidcore/**"
-      # The rig itself: the grading, the runner, the selection and this workflow.
-      - "apps/solidcraft-cli/src/kernel_cases.rs"
-      - "xtask/src/kernel_cases.rs"
-      - "xtask/src/kernel_ladder.rs"
-      - "scripts/ci/kernel_rig_plan.py"
-      - "scripts/ci/test_kernel_rig_plan.py"
-      - ".github/workflows/kernel-rig.yml"
-  merge_group:
-  workflow_call:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  # A new push to a pull request replaces its old run.
-  group: kernel-rig-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  plan:
-    name: Select the rig areas
-    # Draft pull requests run no CI, as in ci.yml.
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 5
-    outputs:
-      # The shard matrix (JSON list of areas and the ladder; [] when nothing is selected).
-      shards: ${{ steps.plan.outputs.shards }}
-      # Whether the build job, and with it the coverage check, runs.
-      build: ${{ steps.plan.outputs.build }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # A pull request's diff needs its base's history.
-          fetch-depth: ${{ github.event_name == 'pull_request' && '0' || '1' }}
-      - name: Selection self-test
-        run: python3 -I scripts/ci/test_kernel_rig_plan.py
-      - id: plan
-        name: Map the changed files to areas
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          # Pull requests run the areas their diff reaches; pushes, merge groups, the release
-          # gate and a run by hand run every area.
-          if [ "$EVENT_NAME" = pull_request ]; then
-            git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/rig-paths"
-            python3 -I scripts/ci/kernel_rig_plan.py --paths "$RUNNER_TEMP/rig-paths" \
-              --github-output "$GITHUB_OUTPUT"
-          else
-            python3 -I scripts/ci/kernel_rig_plan.py --all --github-output "$GITHUB_OUTPUT"
-          fi
-
-  build:
-    name: Build the CLI
-    needs: plan
-    if: needs.plan.outputs.build == 'true'
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 60
-    env:
-      CARGO_INCREMENTAL: "0"
-      RUSTC_WRAPPER: sccache
-      SCCACHE_DIR: /home/runner/.cache/sccache
-      SCCACHE_CACHE_SIZE: 10G
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Size parallel compiles to the job's memory
-        run: scripts/ci/build-jobs.sh
-      - uses: dtolnay/rust-toolchain@stable
-      # Only pushes to main and develop commit the cache; pull requests, merge groups and forks
-      # mount a clone and never write back.
-      - name: Mount the compiler cache
-        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
-        continue-on-error: true
-        with:
-          key: ${{ github.repository }}-sccache-kernel-rig
-          path: /home/runner/.cache/sccache
-          commit: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') && 'on-change' || 'false' }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: kernel-rig
-          save-if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}
-      - name: Set up compiler cache
-        id: sccache
-        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
-        with:
-          version: v0.16.0
-        # A failed download of sccache (GitHub release outages answer 504) must not fail the build.
-        continue-on-error: true
-      - name: Build without the compiler cache if it could not be set up
-        if: steps.sccache.outcome == 'failure'
-        run: echo "RUSTC_WRAPPER=" >> "$GITHUB_ENV"
-      - name: Build the CLI (release) and the rig's runner
-        run: |
-          cargo build --release --locked -p solidcraft-cli
-          cargo build --locked -p xtask
-      # A tar keeps the executable bits, which an artifact drops. xtask finds the repository from
-      # the path it was built in (CARGO_MANIFEST_DIR), which is the same checkout path in every
-      # job of this workflow.
-      # Every registry command is used by a case or listed in tests/kernel-cases/EXEMPT.
-      - name: Every command has a case
-        run: target/debug/xtask kernel-cases --coverage --cli target/release/solidcraft-cli
-      # A coverage-only run (the registry or the cases changed, no area selected) runs no shard.
-      - name: Pack the binaries
-        if: needs.plan.outputs.shards != '[]'
-        run: tar -cf "$RUNNER_TEMP/kernel-rig-bin.tar" -C target release/solidcraft-cli debug/xtask
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        if: needs.plan.outputs.shards != '[]'
-        with:
-          name: kernel-rig-bin
-          path: ${{ runner.temp }}/kernel-rig-bin.tar
-          retention-days: 1
-      - name: Compiler cache statistics
-        if: always()
-        run: if command -v sccache >/dev/null; then sccache --show-stats; else echo "sccache was not set up; built without it"; fi
-
-  shard:
-    name: Kernel rig (${{ matrix.shard }})
-    needs: [plan, build]
-    if: needs.plan.outputs.shards != '[]'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        # The areas of tests/kernel-cases/ the plan selected, and the ladder. On the build box
-        # (aarch64, 4 cases at a time) the slowest areas took about 1 minute (booleans, 212 s of
-        # cases with one of 84 s; threads, 161 s) and the ladder, one case at a time, 92 s: no area
-        # needs splitting.
-        shard: ${{ fromJSON(needs.plan.outputs.shards) }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: kernel-rig-bin
-          path: ${{ runner.temp }}
-      - name: Unpack the binaries
-        run: mkdir -p target && tar -xf "$RUNNER_TEMP/kernel-rig-bin.tar" -C target
-      - name: Run the cases against the known-failing list (the ladder against its golden)
-        env:
-          SHARD: ${{ matrix.shard }}
-        run: |
-          if [ "$SHARD" = ladder ]; then
-            set -- --ladder --gate
-          else
-            set -- --area "$SHARD" --known-failing "tests/kernel-cases/$SHARD/KNOWN_FAILING"
-          fi
-          target/debug/xtask kernel-cases "$@" --cli target/release/solidcraft-cli --out "$RUNNER_TEMP/kernel-rig"
-      - name: Keep the results
-        if: always()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: kernel-rig-results-${{ matrix.shard }}
-          path: ${{ runner.temp }}/kernel-rig/**/results.json
-          if-no-files-found: ignore
-
-  # One check for the whole gate, for branch protection and the merge queue.
-  kernel-rig:
-    name: kernel-rig
-    needs: [plan, build, shard]
-    if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      # A skipped build or shard counts as passed only when the plan selected none.
-      - name: Every selected job passed
-        env:
-          PLAN: ${{ needs.plan.result }}
-          WANT_BUILD: ${{ needs.plan.outputs.build }}
-          WANT_SHARDS: ${{ needs.plan.outputs.shards }}
-          BUILD: ${{ needs.build.result }}
-          SHARDS: ${{ needs.shard.result }}
-        run: |
-          echo "plan=$PLAN build=$BUILD shards=$SHARDS selected=$WANT_SHARDS"
-          test "$PLAN" = success
-          if [ "$WANT_BUILD" = true ]; then test "$BUILD" = success; else test "$BUILD" = skipped; fi
-          if [ "$WANT_SHARDS" != '[]' ]; then test "$SHARDS" = success; else test "$SHARDS" = skipped; fi

.github/workflows/lists.yml

@@ -1,33 +0,0 @@
-# Files many pull requests add to are kept so that additions don't conflict: one file per change
-# or one sorted line per item (CONTRIBUTING.md, "Lists many changes add to"). Fast, no build.
-# Pull requests get the same checks in CI's "Format and repository checks" job (one runner slot
-# per PR instead of three); this copy keeps main honest.
-name: Lists
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  format-changes:
-    name: Design format changes merge cleanly
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: bash scripts/test-format-pending.sh
-
-  sorted:
-    name: Lists are sorted one item per line
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: lists
-      - run: cargo xtask lists

.github/workflows/packaging-lint.yml

@@ -8,7 +8,7 @@ on:
     branches: [main]
     paths: [".github/workflows/**", "packaging/**", "assets/**"]
   pull_request:
-    paths: [".github/workflows/**", "packaging/**", "assets/platforms/**"]
+    paths: [".github/workflows/**", "packaging/**", "assets/**"]
   workflow_dispatch:
 
 permissions:
@@ -39,8 +39,6 @@ jobs:
         run: python3 packaging/tests/nightly_test.py
       - name: Windows executable icon validation regression
         run: python3 packaging/tests/windows_icon_test.py
-      - name: AppImage CLI wrapper regression
-        run: python3 packaging/tests/apprun_test.py
       - name: Flatpak desktop smoke validation regression
         run: python3 packaging/tests/flatpak_test.py
       - name: PowerShell
@@ -55,15 +53,13 @@ jobs:
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
           xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
-          desktop-file-validate assets/platforms/linux/io.tangencylabs.solidcraft.desktop
-          # The window's X11 class is its app id; the old ids stay only as the rename shims.
-          grep -qx 'StartupWMClass=io.tangencylabs.solidcraft' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
-          grep -q '<id>ai.storyteller.solidcraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
-          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
-          grep -qx 'X-Flatpak-RenamedFrom=ai.storyteller.solidcraft.desktop;ai.storyteller.solvecraft.desktop;' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
+          # The window's X11 class is its app id; the old id stays only as the rename shims.
+          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
           grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/io.tangencylabs.solidcraft.bundle.yml')); assert m['id'] == 'io.tangencylabs.solidcraft' and m['command'] == 'solidcraft'"
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
           python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"
           python3 -m py_compile packaging/linux/snap-smoke.py

.github/workflows/pages.yml

@@ -1,14 +1,11 @@
-# The documentation site on GitHub Pages: the book (docs/book) at https://docs.solidcraft.io/
-# and the web app at /app/ (the latest release), /app-rc/ (the newest release candidate) and
-# /app-edge/ (this commit). Needs Settings → Pages → Source = GitHub Actions; skipped while the
+# The documentation site on GitHub Pages: the book (docs/book) at /solidcraft/ and the web app
+# at /solidcraft/app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
 # repository is private.
 name: Pages
 
 on:
   push:
     branches: [main]
-    # The site is the book and the web app: test data and the GitHub bots' scripts change neither.
-    paths-ignore: ["tests/**", "scripts/claim/**", "scripts/triage/**"]
   workflow_dispatch:
     inputs:
       release_tag:
@@ -48,29 +45,18 @@ jobs:
           curl -sSL "https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
           curl -sSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-      - name: Install a software Vulkan driver (lavapipe)
-        # The book's pictures are `solidcraft-cli snapshot`s, drawn on the GPU; the runner has none.
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
       - name: Build the book
-        env:
-          SOLIDCRAFT_GPU: software
         run: cargo xtask book
       - name: Build the web app
         working-directory: apps/solidcraft-web
-        run: trunk build --release --public-url ./
+        run: trunk build --release --public-url /solidcraft/app/
       - name: Test the web app offline and across an update (headless Chrome)
         run: cargo xtask web-offline-test --site dist/web
       - name: Assemble the site
         run: |
           mkdir -p site
           cp -r target/book/. site/
-          bash docs/book/seo.sh site  # canonical links, robots.txt, sitemap.xml
-      - name: Add the web app channels (stable and release candidate from their releases, edge from this build)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: bash packaging/web-channels.sh site dist/web
+          cp -r dist/web site/app
       - uses: actions/configure-pages@v5
         id: pages
       - name: Install Flatpak repository tools

.github/workflows/pr-checks.yml

@@ -1,85 +0,0 @@
-# Three quick checks on every pull request (CONTRIBUTING.md, "Sending a change"): no second open PR
-# for an issue a lower-numbered one already closes, the "Changes a default:" line is filled in, and
-# a PR adding to the showcase shows a picture. None is a required status check. The logic is in scripts/pr-checks/pr-checks.js (tested in ci.yml).
-name: PR checks
-
-on:
-  # pull_request, never pull_request_target: nothing here checks out or runs the PR's code, and the
-  # token is read-only for fork PRs. Only scripts/pr-checks from the PR's own merge commit is run.
-  pull_request:
-    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: pr-checks-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  duplicate:
-    name: Duplicate PR check
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/pr-checks
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const checks = require('./scripts/pr-checks/pr-checks.js');
-            const r = await checks.checkDuplicate({ github, context, core });
-            core.info(JSON.stringify(r));
-
-  defaults:
-    name: Defaults line check
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/pr-checks
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const checks = require('./scripts/pr-checks/pr-checks.js');
-            const r = await checks.checkDefaults({ github, context, core });
-            core.info(JSON.stringify(r));
-
-  picture:
-    name: Picture check
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/pr-checks
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const checks = require('./scripts/pr-checks/pr-checks.js');
-            const r = await checks.checkPicture({ github, context, core });
-            core.info(JSON.stringify(r));
-
-  # Labelling needs write access, which a fork PR's token never has, so it is its own job and best
-  # effort: a fork PR just doesn't get the `changes-default` label from here.
-  label:
-    name: Label changes-default
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    continue-on-error: true
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/pr-checks
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const checks = require('./scripts/pr-checks/pr-checks.js');
-            await checks.syncDefaultLabel({ github, context, core });

.github/workflows/release-gate.yml

@@ -1,74 +0,0 @@
-# The release gate: everything, in full and in parallel, on one branch's head, before that branch
-# replaces main as a release (develop, rebased onto main). Run it by hand:
-#   gh workflow run release-gate.yml --ref develop
-# It calls the workflows that own each check instead of copying their jobs:
-# - ci.yml as Run workflow with cross-compilation: every native suite in full (not scoped), the
-#   reference tests, the doc tests, the GPU path tests, the action matrix (all 16 shards) and its
-#   determinism check, the property tests, the repository checks (web-offline among them),
-#   WebAssembly and RISC-V, Windows D3D12 FXC and Windows app startup;
-# - kernel-rig.yml: every rig area against its KNOWN_FAILING and the ladder against its golden;
-# - release.yml as a dry run (draft false, packages_only): the Linux, Flatpak, Snap, FreeBSD,
-#   macOS, Windows and web packages with their smoke tests and package checks, unsigned (no
-#   secrets are passed, so no signing secret or SignPath quota is used) and without the release
-#   job (checksums, update signing, publishing).
-# The gate passes only when all three pass. Before main is replaced, tag the old main
-# (main-before-develop-<date>) and push the tag.
-name: Release gate
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: release-gate-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  ci:
-    name: CI
-    uses: ./.github/workflows/ci.yml
-    permissions:
-      contents: read
-      # Select checks reads this commit's other runs.
-      actions: read
-    with:
-      cross_compile: true
-
-  kernel-rig:
-    name: Kernel rig
-    uses: ./.github/workflows/kernel-rig.yml
-    permissions:
-      contents: read
-
-  packages:
-    name: Packages
-    uses: ./.github/workflows/release.yml
-    # No secrets: the signing steps skip without them. GitHub checks a called workflow's job
-    # permissions before the run, skipped jobs included, so the release job's contents: write must
-    # be granted here; packages_only skips that job, and no step that runs writes to the
-    # repository. actions: read is the Windows job's.
-    permissions:
-      contents: write
-      actions: read
-    with:
-      draft: false
-      packages_only: true
-
-  release-gate:
-    name: release-gate
-    needs: [ci, kernel-rig, packages]
-    if: always()
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Every part passed
-        env:
-          CI: ${{ needs.ci.result }}
-          KERNEL_RIG: ${{ needs.kernel-rig.result }}
-          PACKAGES: ${{ needs.packages.result }}
-        run: |
-          echo "ci=$CI kernel-rig=$KERNEL_RIG packages=$PACKAGES"
-          test "$CI" = success
-          test "$KERNEL_RIG" = success
-          test "$PACKAGES" = success

.github/workflows/release.yml

@@ -4,15 +4,11 @@
 # comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
-# A version with a suffix (0.2.0-rc.1) is a pre-release.
-# The macOS app is signed and notarized when the APPLE_* secrets exist. The Windows binaries and
-# MSI are Authenticode-signed through SignPath Foundation when the SIGNPATH_API_TOKEN secret exists
-# (see the windows job). Nothing else is signed yet.
+# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
 #
 #   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
-#   Arch Linux x86_64, aarch64  .pkg.tar.zst, repackaged from the .tar.gz         the arch job
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
-#   macOS universal         .dmg, and the CLI as a .zip (both archs built in parallel)  packaging/macos
+#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
 #   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
 #   Web                     a .zip of the static site                              packaging/web
 #
@@ -21,10 +17,6 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
-# The release gate (release-gate.yml) calls it as such a dry run, without secrets (unsigned) and
-# without the release job (packages_only).
-# A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
-#   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release
 
 on:
@@ -39,29 +31,6 @@ on:
         description: "Create/update a draft (release branch only; off: build artifacts only)"
         type: boolean
         default: false
-      signpath_signing_policy:
-        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
-        type: string
-        default: ""
-  # The release gate (release-gate.yml): a dry run (draft false) of every package and its checks.
-  # The event stays the caller's (workflow_dispatch), so a call runs as a dispatched dry run does.
-  # The gate passes no secrets, so nothing is signed (the signing steps skip without their
-  # secrets, as on a fork), and packages_only skips the release job (checksums, update signing,
-  # publishing).
-  workflow_call:
-    inputs:
-      packages_only:
-        description: "Build and check every package only: no release job"
-        type: boolean
-        default: false
-      draft:
-        description: "Create/update a draft (release branch only; off: build artifacts only)"
-        type: boolean
-        default: false
-      signpath_signing_policy:
-        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
-        type: string
-        default: ""
 
 permissions:
   contents: read
@@ -228,74 +197,12 @@ jobs:
           path: dist/release/*.flatpak
           if-no-files-found: error
 
-  arch:
-    name: Arch Linux ${{ matrix.arch }}
-    needs: [version, linux]
-    if: needs.version.outputs.build == 'true'
-    # makepkg only repackages the tarball's prebuilt binaries, so both architectures build here.
-    runs-on: ubuntu-24.04
-    # A pre-release or nightly without an Arch package is still worth having; a stable release isn't.
-    continue-on-error: ${{ contains(needs.version.outputs.version, '-') }}
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [x86_64, aarch64]
-    env:
-      VERSION: ${{ needs.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/linux
-      # The Craft apps' shared Arch packaging (storytold/craft-common-actions, MIT OR Apache-2.0):
-      # makepkg in an archlinux:base-devel container. The package is named after the tarball's
-      # .desktop file (io.tangencylabs.solidcraft) and written as
-      # dist/release/solidcraft-<version>-linux-<arch>.pkg.tar.zst.
-      # An Arch version can't hold a hyphen, and the action reads the version from the tarball's name
-      # (a hyphenated one comes out as 0.0.0): 0.40.0-rc.1 goes in as 0.40.0rc.1, which pacman sorts
-      # before 0.40.0, and the package keeps the release's name.
-      - id: pkgver
-        name: Arch version
-        run: |
-          pkgver="${VERSION//-/}"
-          echo "pkgver=$pkgver" >>"$GITHUB_OUTPUT"
-          if [ "$pkgver" != "$VERSION" ]; then
-            cp "dist/linux/solidcraft-$VERSION-linux-$ARCH.tar.gz" "dist/linux/solidcraft-$pkgver-linux-$ARCH.tar.gz"
-          fi
-        env:
-          ARCH: ${{ matrix.arch }}
-      - uses: storytold/craft-common-actions/actions/arch-package@fa5ef18780cf5e7d5d3b8de068de56cffc83cac5 # main
-        with:
-          tarball: dist/linux/solidcraft-${{ steps.pkgver.outputs.pkgver }}-linux-${{ matrix.arch }}.tar.gz
-          arch: ${{ matrix.arch }}
-      - name: The package under the release's version
-        if: steps.pkgver.outputs.pkgver != env.VERSION
-        env:
-          ARCH: ${{ matrix.arch }}
-          PKGVER: ${{ steps.pkgver.outputs.pkgver }}
-        run: sudo mv "dist/release/solidcraft-$PKGVER-linux-$ARCH.pkg.tar.zst" "dist/release/solidcraft-$VERSION-linux-$ARCH.pkg.tar.zst"
-      - name: Check the package
-        env:
-          PKG: dist/release/solidcraft-${{ env.VERSION }}-linux-${{ matrix.arch }}.pkg.tar.zst
-        run: |
-          tar --zstd -tf "$PKG" | grep -E '^usr/bin/solidcraft$|^usr/bin/solidcraft-cli$|^usr/share/applications/io\.tangencylabs\.solidcraft\.desktop$'
-          tar --zstd -xOf "$PKG" .PKGINFO | grep -E '^(pkgname|pkgver|arch) = '
-          tar --zstd -xOf "$PKG" .PKGINFO | grep -qx 'pkgname = io.tangencylabs.solidcraft'
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: release-arch-${{ matrix.arch }}
-          path: dist/release/*.pkg.tar.zst
-          if-no-files-found: error
-
 
 
   snap:
     name: Snap ${{ matrix.arch }}
     needs: [version, linux]
     if: needs.version.outputs.build == 'true'
-    # The Snap Store hasn't accepted SolidCraft yet, so a snap failure never holds up a release.
-    continue-on-error: true
     # Repackages the Linux job's tarball, like the Flatpak. On 24.04 because the core24 base is
     # Ubuntu 24.04, which lets snapcraft build on the runner itself (--destructive-mode).
     runs-on: ${{ matrix.runner }}
@@ -379,26 +286,18 @@ jobs:
             export CARGO_TARGET_DIR=/var/tmp/solidcraft-target CARGO_BUILD_JOBS=4
             bash packaging/freebsd/package.sh
             tar -tzf dist/release/solidcraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/io\.tangencylabs\.solidcraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
+              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-freebsd-x86_64
           path: dist/release/*
           if-no-files-found: error
 
-  # The two halves of the universal binary build in parallel on their own runners (each alone
-  # took about half of the old single job's 45 minutes); `macos` below joins and packages them.
-  macos-build:
-    name: macOS build ${{ matrix.arch }}
+  macos:
+    name: macOS universal
     needs: version
     if: needs.version.outputs.build == 'true'
-    runs-on: macos-15
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: aarch64, target: aarch64-apple-darwin }
-          - { arch: x86_64, target: x86_64-apple-darwin }
+    runs-on: macos-14
     env:
       SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
       SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -406,58 +305,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: ${{ matrix.target }}
+          targets: aarch64-apple-darwin, x86_64-apple-darwin
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: release-macos-${{ matrix.arch }}
-      - name: Build
-        run: packaging/macos/package.sh --build-only ${{ matrix.target }}
-      # Not named release-*: the release job collects every release-* artifact as an asset.
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: macos-bin-${{ matrix.arch }}
-          path: |
-            target/${{ matrix.target }}/release/solidcraft
-            target/${{ matrix.target }}/release/solidcraft-cli
-            target/${{ matrix.target }}/release/solvecraft-cli
-          if-no-files-found: error
-
-  macos:
-    name: macOS universal
-    needs: [version, macos-build]
-    if: needs.version.outputs.build == 'true'
-    runs-on: macos-15
-    env:
-      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: macos-bin-aarch64
-          path: target/aarch64-apple-darwin/release
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: macos-bin-x86_64
-          path: target/x86_64-apple-darwin/release
-      - name: Set up Developer ID signing and notarization
-        # Optional until the APPLE_* secrets exist (docs/releasing.md, "macOS signing"). Without
-        # them (forks, dry runs) the app keeps its ad-hoc signature and is not notarized.
-        env:
-          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-        run: packaging/macos/signing.sh --setup
-      - name: Join, sign, package and check (dmg, CLI zip; the dmg is mounted and checked)
-        run: |
-          # Artifacts don't keep the executable bit.
-          chmod +x target/*-apple-darwin/release/solidcraft target/*-apple-darwin/release/solidcraft-cli target/*-apple-darwin/release/solvecraft-cli
-          packaging/macos/package.sh --arch universal --skip-build ${MACOS_SIGN_IDENTITY:+--sign}
-      - name: Remove the signing keychain and API key
-        if: always()
-        run: packaging/macos/signing.sh --cleanup
+          key: release-macos-universal
+      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
+        run: packaging/macos/package.sh --arch universal
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos
@@ -468,14 +321,7 @@ jobs:
     name: Windows ${{ matrix.arch }}
     needs: [version, icons]
     if: needs.version.outputs.build == 'true'
-    # Must stay a GitHub-hosted runner, like every job before it: SignPath's open-source policy
-    # only signs builds whose jobs all ran on GitHub-hosted runners.
     runs-on: windows-latest
-    # actions: read lets the SignPath action read this job's details and fetch the uploaded
-    # artifact with GITHUB_TOKEN (the workflow default above grants contents: read only).
-    permissions:
-      contents: read
-      actions: read
     strategy:
       fail-fast: false
       matrix:
@@ -486,16 +332,6 @@ jobs:
           - { arch: arm64, target: aarch64-pc-windows-msvc }
     env:
       SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      # Authenticode signing through SignPath Foundation (docs/releasing.md, "Windows signing").
-      # Only when the API token secret exists: forks and repositories without it build unsigned,
-      # exactly as before. `if:` can't read secrets, so the check goes through this variable.
-      SIGN_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
-      # The one switch between the self-signed test certificate (test-signing) and the real one
-      # (release-signing): a dispatch input, else the SIGNPATH_SIGNING_POLICY repository variable,
-      # else test-signing.
-      SIGNPATH_SIGNING_POLICY: ${{ inputs.signpath_signing_policy || vars.SIGNPATH_SIGNING_POLICY || 'test-signing' }}
-      SIGNPATH_ORGANIZATION_ID: fa603ff4-c702-404b-8588-a524371c7a4e
-      SIGNPATH_PROJECT_SLUG: solidcraft
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -514,109 +350,10 @@ jobs:
           dotnet tool install --global wix --version 5.0.2
           wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build and package (msi, portable zip)
-        if: env.SIGN_WINDOWS != 'true'
         shell: pwsh
         env:
           SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
         run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-
-      # ---- signed path ---------------------------------------------------------------------------
-      # SignPath's GitHub integration (docs.signpath.io/trusted-build-systems/github): the files go
-      # up as a workflow artifact, SignPath fetches that artifact itself (so it can verify it came
-      # from this workflow run), signs it, and the action downloads the signed copy. GitHub stores
-      # artifacts as zips, so packaging/windows/signpath-artifact-configuration.xml (pasted into the
-      # SignPath project) describes a zip holding the files at its top level.
-      # Two rounds: the .exe files first, so the MSI, the portable zip and the plain .exe all carry
-      # signed binaries; then the MSI built from them.
-      - name: Build and stage the binaries for signing
-        if: env.SIGN_WINDOWS == 'true'
-        shell: pwsh
-        env:
-          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
-        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase stage
-      - name: Upload the unsigned binaries
-        id: unsigned-exes
-        if: env.SIGN_WINDOWS == 'true'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: signpath-unsigned-exes-windows-${{ matrix.arch }}
-          path: target/windows-package/${{ matrix.arch }}/*.exe
-          if-no-files-found: error
-          retention-days: 3
-      - name: Sign the binaries (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
-        if: env.SIGN_WINDOWS == 'true'
-        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
-        with:
-          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
-          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
-          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
-          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
-          github-artifact-id: ${{ steps.unsigned-exes.outputs.artifact-id }}
-          wait-for-completion: true
-          # release-signing requests wait for a person to approve them in SignPath; give that an
-          # hour instead of the default 10 minutes. test-signing requests finish in seconds.
-          wait-for-completion-timeout-in-seconds: 3600
-          output-artifact-directory: target/windows-package/signed-exes-${{ matrix.arch }}
-      - name: Put the signed binaries in place
-        if: env.SIGN_WINDOWS == 'true'
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $stage = "target/windows-package/${{ matrix.arch }}"
-          foreach ($exe in 'solidcraft.exe', 'solidcraft-cli.exe', 'solvecraft-cli.exe') {
-            $signed = "target/windows-package/signed-exes-${{ matrix.arch }}/$exe"
-            # The artifact configuration matches each file optionally, so check that every file
-            # actually came back signed rather than trusting the request's success.
-            $sig = Get-AuthenticodeSignature $signed
-            if (-not $sig.SignerCertificate) { throw "$exe came back from SignPath without a signature ($($sig.Status))" }
-            # The test certificate is self-signed, so Status is not Valid until release-signing.
-            Write-Output "$exe signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
-            Copy-Item -Force $signed "$stage/$exe"
-          }
-      - name: Package the signed binaries (msi, portable zip)
-        if: env.SIGN_WINDOWS == 'true'
-        shell: pwsh
-        env:
-          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
-        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase package
-      - name: Upload the unsigned MSI
-        id: unsigned-msi
-        if: env.SIGN_WINDOWS == 'true'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: signpath-unsigned-msi-windows-${{ matrix.arch }}
-          path: dist/release/*.msi
-          if-no-files-found: error
-          retention-days: 3
-      - name: Sign the MSI (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
-        if: env.SIGN_WINDOWS == 'true'
-        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
-        with:
-          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
-          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
-          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
-          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
-          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
-          wait-for-completion: true
-          wait-for-completion-timeout-in-seconds: 3600
-          output-artifact-directory: target/windows-package/signed-msi-${{ matrix.arch }}
-      - name: Put the signed MSI in place
-        if: env.SIGN_WINDOWS == 'true'
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $msi = Get-Item "dist/release/*.msi"
-          $signed = "target/windows-package/signed-msi-${{ matrix.arch }}/$($msi.Name)"
-          $sig = Get-AuthenticodeSignature $signed
-          if (-not $sig.SignerCertificate) { throw "$($msi.Name) came back from SignPath without a signature ($($sig.Status))" }
-          Write-Output "$($msi.Name) signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
-          Copy-Item -Force $signed $msi.FullName
-          "Windows ${{ matrix.arch }}: Authenticode-signed through SignPath (policy $env:SIGNPATH_SIGNING_POLICY, $($sig.SignerCertificate.Subject))." >> $env:GITHUB_STEP_SUMMARY
-      - name: Note the unsigned build
-        if: env.SIGN_WINDOWS != 'true'
-        shell: pwsh
-        run: '"Windows ${{ matrix.arch }}: unsigned (no SIGNPATH_API_TOKEN secret)." >> $env:GITHUB_STEP_SUMMARY'
-
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-windows-${{ matrix.arch }}
@@ -653,9 +390,8 @@ jobs:
 
   release:
     name: GitHub Release or dry-run artifacts
-    needs: [version, linux, flatpak, arch, snap, freebsd, macos, windows, web]
-    # Not for the release gate (packages_only): it builds and checks the packages, nothing more.
-    if: needs.version.outputs.build == 'true' && !inputs.packages_only
+    needs: [version, linux, flatpak, snap, freebsd, macos, windows, web]
+    if: needs.version.outputs.build == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -680,7 +416,7 @@ jobs:
           shopt -s nullglob
           for f in "solidcraft-$VERSION-"*; do
             case "$f" in
-              *.msi | *-portable.zip | *.dmg | *.AppImage | *.deb | *.rpm | *.flatpak | *.snap | *.pkg.tar.zst)
+              *.msi | *-portable.zip | *.dmg | *.AppImage | *.deb | *.rpm | *.flatpak | *.snap)
                 cp -- "$f" "solidcraft-${f#"solidcraft-$VERSION-"}" ;;
             esac
           done
@@ -725,16 +461,10 @@ jobs:
         run: |
           tag="v$VERSION"
           sha256sum --check SHA256SUMS.txt
-          # Generated notes start at the newest published release, pre-releases included. Left
-          # to GitHub they start at the Latest stable one, and the list outgrows the 125,000
-          # characters a release body may have.
-          start=()
-          prev="$(gh release list --exclude-drafts --limit 30 --json tagName,publishedAt --jq 'sort_by(.publishedAt) | last | .tagName // empty')"
-          if [ -n "$prev" ]; then start=(--notes-start-tag "$prev"); fi
           # Stage all packages before publishing. Published tags are never replaced.
           gh release create "$tag" --draft --prerelease --latest=false \
             --title "SolidCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
-            --notes-file ../notes.md --generate-notes "${start[@]}" -- *
+            --notes-file ../notes.md --generate-notes -- *
           gh release edit "$tag" --draft=false --prerelease --latest=false
           echo "### Published nightly: $tag (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
       - name: Create or update the draft release
@@ -766,13 +496,8 @@ jobs:
               --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
             gh release upload "$tag" --clobber -- *
           else
-            # As for nightlies: start the generated notes at the newest published release.
-            start=()
-            prev="$(gh release list --exclude-drafts --limit 30 --json tagName,publishedAt --jq 'sort_by(.publishedAt) | last | .tagName // empty')"
-            if [ -n "$prev" ]; then start=(--notes-start-tag "$prev"); fi
             gh release create "$tag" --draft --title "SolidCraft v$VERSION" \
-              --target "$GITHUB_SHA" --notes-file ../notes.md --generate-notes "${start[@]}" \
-              "${pre[@]}" -- *
+              --target "$GITHUB_SHA" --notes-file ../notes.md --generate-notes "${pre[@]}" -- *
           fi
           {
             echo "Draft **SolidCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"

.github/workflows/solidcore-mirror.yml

@@ -1,142 +0,0 @@
-# Mirror SolidCraft's vendored kernel to its own repository.
-#
-# `solidcore` is the SolidCore kernel, vendored with `git subtree`, so `main` keeps
-# SolidCore's history. This workflow pushes the commits under `solidcore` back to
-# tangency-labs/solidcore, so the same history can be read from either repository.
-#
-# It mirrors incrementally (scripts/ci/solidcore-mirror.sh): one mirror commit per new main
-# commit that changes solidcore/, a merged branch's commits included, each with exactly that
-# commit's solidcore/ tree, its author, dates and message, and a `solidcraft: <sha>` trailer. The
-# last one records the main commit it reached (`solidcraft-main:`), where the next run starts; the
-# first run starts from the vendoring merge. Never `git subtree split`: it replays main's whole
-# history (about 100 minutes) and overflows dash's recursion limit.
-#
-# The push is always a fast-forward. A force push would rewrite SolidCore's history, so the
-# workflow stops instead when the two have diverged, or when a mirror commit would not be the
-# kernel alone.
-#
-# SolidCore's `main` is protected. The deploy key must have write access to that repository and
-# must bypass its `protect-main` ruleset (see the pull request that added this file).
-name: Mirror to SolidCore
-
-on:
-  push:
-    branches: [main]
-    # Only a change to the vendored kernel can move SolidCore. Editing this file rehearses it.
-    paths:
-      - "solidcore/**"
-      - ".github/workflows/solidcore-mirror.yml"
-      - "scripts/ci/solidcore-mirror.sh"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-# One run at a time, never cancelled: two pushes to SolidCore must not race.
-concurrency:
-  group: solidcore-mirror
-  cancel-in-progress: false
-
-env:
-  # The directory in SolidCraft that is the whole of SolidCore.
-  PREFIX: solidcore
-  SOLIDCORE_URL: git@github.com:tangency-labs/solidcore.git
-  SOLIDCORE_BRANCH: main
-
-jobs:
-  mirror:
-    name: Mirror main's kernel commits
-    runs-on: ubuntu-24.04
-    # Incremental: seconds per run.
-    timeout-minutes: 15
-    defaults:
-      run:
-        shell: bash
-    steps:
-      # Always the real main, and its whole history: the mirror walks main's ancestry since the
-      # last mirrored commit, which a shallow clone would not have.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          fetch-depth: 0
-          persist-credentials: false
-
-      # The private half of a deploy key with write access to tangency-labs/solidcore. Fail here,
-      # with a readable message, instead of somewhere inside git.
-      - name: Set up the SolidCore deploy key
-        env:
-          SOLIDCORE_DEPLOY_KEY: ${{ secrets.SOLIDCORE_DEPLOY_KEY }}
-        run: |
-          if [ -z "$SOLIDCORE_DEPLOY_KEY" ]; then
-            echo "::error::The SOLIDCORE_DEPLOY_KEY secret is not set. Add the private half of a deploy key that has write access to tangency-labs/solidcore under Settings > Secrets and variables > Actions."
-            exit 1
-          fi
-          install -d -m 700 "$RUNNER_TEMP/ssh"
-          (umask 077 && printf '%s\n' "$SOLIDCORE_DEPLOY_KEY" > "$RUNNER_TEMP/ssh/solidcore")
-          # The fetch and the push inherit this, so both use the same key.
-          printf '%s\n' "GIT_SSH_COMMAND=ssh -i $RUNNER_TEMP/ssh/solidcore -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new" >> "$GITHUB_ENV"
-
-      # Decide, before touching SolidCore, whether there is anything to mirror and whether it is a
-      # fast-forward. There are three states: in sync, SolidCore behind (push), diverged (fail).
-      - name: Check what needs mirroring
-        id: check
-        run: |
-          set -euo pipefail
-
-          # The remote tip, so the ancestry tests below compare against what SolidCore has.
-          if ! git fetch --no-tags "$SOLIDCORE_URL" "$SOLIDCORE_BRANCH"; then
-            echo "::error::Could not fetch $SOLIDCORE_URL $SOLIDCORE_BRANCH. Check that SOLIDCORE_DEPLOY_KEY is the private half of a solidcore deploy key with write access, and that the branch exists."
-            exit 1
-          fi
-          REMOTE=$(git rev-parse FETCH_HEAD)
-
-          # Mirror commits for main's solidcore/ commits since the last run, built incrementally on
-          # SolidCore's tip (never `git subtree split`, which replays main's whole history). The
-          # script fails on divergence or anything that is not a fast-forward of SolidCore's tip.
-          bash scripts/ci/solidcore-mirror.sh "$REMOTE" HEAD > "$RUNNER_TEMP/mirror.out"
-          cat "$RUNNER_TEMP/mirror.out"
-          STATE=$(sed -n 's/^state=//p' "$RUNNER_TEMP/mirror.out")
-          SPLIT=$(sed -n 's/^tip=//p' "$RUNNER_TEMP/mirror.out")
-          COUNT=$(sed -n 's/^count=//p' "$RUNNER_TEMP/mirror.out")
-          {
-            echo "state=$STATE"
-            echo "split=$SPLIT"
-            echo "remote=$REMOTE"
-          } >> "$GITHUB_OUTPUT"
-
-          {
-            echo "### Mirror to SolidCore"
-            echo
-            echo "| | commit |"
-            echo "| --- | --- |"
-            echo "| SolidCraft \`$PREFIX\` mirror ($COUNT new) | \`$SPLIT\` |"
-            echo "| solidcore \`$SOLIDCORE_BRANCH\` | \`$REMOTE\` |"
-            echo
-            case "$STATE" in
-              in-sync) echo "**In sync.** Nothing to mirror." ;;
-              fast-forward) echo "**Fast-forward push needed.** SolidCore is behind." ;;
-            esac
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # Push the checked commit itself. A plain push is also the safety net: git refuses a
-      # non-fast-forward.
-      - name: Push the mirror commit
-        if: steps.check.outputs.state == 'fast-forward'
-        env:
-          SPLIT: ${{ steps.check.outputs.split }}
-        run: |
-          set -euo pipefail
-
-          if ! git push "$SOLIDCORE_URL" "$SPLIT:refs/heads/$SOLIDCORE_BRANCH"; then
-            echo "::error::Push to solidcore failed. If git names a protected branch or GH006, SOLIDCORE_DEPLOY_KEY has no write access or does not bypass solidcore's protect-main ruleset. If git names a non-fast-forward, solidcore moved during this run; re-run."
-            exit 1
-          fi
-
-          # Confirm SolidCore now has exactly the commit this run checked.
-          PUSHED=$(git ls-remote "$SOLIDCORE_URL" "refs/heads/$SOLIDCORE_BRANCH" | cut -f1)
-          if [ "$PUSHED" != "$SPLIT" ]; then
-            echo "::error::solidcore $SOLIDCORE_BRANCH is $PUSHED after the push, expected $SPLIT."
-            exit 1
-          fi
-
-          { echo; echo "**Mirrored.** solidcore \`$SOLIDCORE_BRANCH\` is now \`$SPLIT\`."; } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/solidcore-nightly.yml

@@ -1,69 +0,0 @@
-# SolidCore's slow checks, too expensive for every pull request: SolidCore's own nightly
-# (solidcore/.github/workflows/nightly.yml), run from solidcore/, since GitHub does not run a
-# subfolder's workflows.
-name: SolidCore nightly
-
-on:
-  schedule:
-    - cron: "41 3 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: solidcore-nightly
-  cancel-in-progress: false
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-
-jobs:
-  slow:
-    name: SolidCore slow checks
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 240
-    defaults:
-      run:
-        working-directory: solidcore
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Toolchain (solidcore/rust-toolchain.toml)
-        run: rustup show active-toolchain || rustup toolchain install
-
-      # solidcore/.github/actions/upstream, run from solidcore/ (a composite action's steps would
-      # run from the repository root): usd-brep at the pin in scripts/upstream-pin.env.
-      - name: Upstream sources (TestFiles)
-        run: |
-          while IFS='=' read -r k v; do
-            case "$k" in
-              UPSTREAM_REPO|UPSTREAM_VERSION|UPSTREAM_COMMIT) export "$k=$v" ;;
-            esac
-          done < scripts/upstream-pin.env
-          git init upstream
-          git -C upstream remote add origin "$UPSTREAM_REPO"
-          git -C upstream fetch --depth 1 origin "$UPSTREAM_COMMIT" \
-            || git -C upstream fetch origin
-          git -C upstream checkout --detach "$UPSTREAM_COMMIT"
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: "solidcore -> bin"
-          key: solidcore-nightly
-
-      # Owner-approved (2026-10-26): a regression too slow for every PR (~3 min): the
-      # tiny-scale torus booleans finish under MAX_SOLVE_BRANCHES (geom::global_solver).
-      - name: Slow regressions
-        if: ${{ !cancelled() }}
-        run: cargo test -p solidcore --release --test max_solve_branches_tiny_torus -- --ignored
-
-      # Owner-approved (2026-10-27): the SolidCraft whole-corpus harness checks (every
-      # case reaches a verdict; every deferral names a plan unit) take minutes even
-      # optimised, so they run here instead of on every pull request.
-      - name: SolidCraft corpus harness checks
-        if: ${{ !cancelled() }}
-        run: >-
-          cargo test --profile goldens -p goldens --lib -- --ignored --exact
-          solidcraft::tests::every_case_reaches_a_verdict_without_a_harness_error
-          solidcraft::tests::deferrals_name_a_plan_unit

.github/workflows/solidcore-pages.yml

@@ -1,88 +0,0 @@
-# SolidCore's progress site (solidcore/site/build.py) and unit checklist
-# (solidcore/harness/plan/progress.py, published as PROGRESS.md), at the same address as before:
-# https://tangency-labs.github.io/solidcore/. SolidCore's own Pages workflow
-# (solidcore/.github/workflows/pages.yml), ported: GitHub does not run a subfolder's workflows.
-#
-# This repository's Pages site is SolidCraft's book and web app (pages.yml), and a repository has
-# one Pages site, so this one is pushed to tangency-labs/solidcore's gh-pages branch with the
-# mirror's deploy key (SOLIDCORE_DEPLOY_KEY, solidcore-mirror.yml). That repository's Settings ->
-# Pages -> Source must be "Deploy from a branch", gh-pages, / (root).
-#
-# The site reads SolidCore's history (its progress timeline) and paths from its repository root,
-# so it is built from a checkout of the mirror, tangency-labs/solidcore, whose main is exactly
-# this repository's solidcore/ once the mirror has run.
-#
-# Triggers:
-# - workflow_run of "Mirror to SolidCore" on main: every mirrored change.
-# - schedule (hourly): claims from open "port: <unit id>" pull requests (now in this repository),
-#   and main's newest solids report (SolidCore checks upload it). Not after every CI run on main,
-#   as SolidCore's did: SolidCraft's main runs CI far more often.
-# - workflow_dispatch: manual rebuild.
-name: SolidCore pages
-
-on:
-  workflow_run:
-    workflows: ["Mirror to SolidCore"]
-    types: [completed]
-    branches: [main]
-  schedule:
-    - cron: "17 * * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read  # download main's solids report
-  pull-requests: read  # open "port:" PRs for the checklist's claims
-
-concurrency:
-  group: solidcore-pages
-  cancel-in-progress: false
-
-jobs:
-  build:
-    name: Build and publish SolidCore's site
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: tangency-labs/solidcore
-          ref: main
-          fetch-depth: 0 # full history for the progress timeline
-          persist-credentials: false
-      # Main's solids report comes from this repository's CI now (SolidCore checks, tests).
-      - name: Fetch main's solids report
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-        run: scripts/fetch-solids.sh || echo "no solids report; the Solids page will say so"
-      - name: Test checklist generator
-        run: python3 -m unittest discover -s harness/plan -p 'test_*.py'
-      - name: Generate checklist
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: python3 harness/plan/progress.py --prs
-      # The site links and its own address are SolidCore's.
-      - name: Build site
-        run: GITHUB_REPOSITORY=tangency-labs/solidcore python3 site/build.py --out _site
-      - name: Publish to tangency-labs/solidcore's gh-pages
-        env:
-          SOLIDCORE_DEPLOY_KEY: ${{ secrets.SOLIDCORE_DEPLOY_KEY }}
-          SHA: ${{ github.sha }}
-        run: |
-          if [ -z "$SOLIDCORE_DEPLOY_KEY" ]; then
-            echo "::error::The SOLIDCORE_DEPLOY_KEY secret is not set (see solidcore-mirror.yml)."
-            exit 1
-          fi
-          install -d -m 700 "$RUNNER_TEMP/ssh"
-          (umask 077 && printf '%s\n' "$SOLIDCORE_DEPLOY_KEY" > "$RUNNER_TEMP/ssh/solidcore")
-          export GIT_SSH_COMMAND="ssh -i $RUNNER_TEMP/ssh/solidcore -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
-          touch _site/.nojekyll
-          cd _site
-          git init -q -b gh-pages
-          git add -A
-          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
-            commit -q -m "Site for solidcore $(git -C .. rev-parse --short HEAD) (SolidCraft $SHA)"
-          # The branch holds only the latest site: replacing it is the deploy.
-          git push -q --force git@github.com:tangency-labs/solidcore.git gh-pages

.github/workflows/solidcore-release.yml

@@ -1,54 +0,0 @@
-# Publishes the vendored SolidCore kernel's `solidcore` crate to crates.io when a tag
-# "solidcore-v<version>" is pushed, e.g. `git tag solidcore-v0.0.1 && git push origin solidcore-v0.0.1`.
-# SolidCore's own release workflow (solidcore/.github/workflows/release.yml), run from solidcore/:
-# GitHub does not run a subfolder's workflows. SolidCraft's releases use no tag trigger, so the
-# solidcore- prefix keeps the two apart.
-# Needs the repository secret CRATES_IO_TOKEN (crates.io token, scope publish-update), in the
-# crates-io environment.
-name: Release SolidCore
-
-on:
-  push:
-    tags: ["solidcore-v*"]
-
-permissions:
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    environment: crates-io
-    defaults:
-      run:
-        working-directory: solidcore
-    steps:
-      # Pinned by SHA and no third-party actions: this job holds the crates.io token.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          fetch-depth: 0 # full history, for the on-main check below
-      - name: Tagged commit is on main
-        run: |
-          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
-            echo "::error::$GITHUB_REF_NAME ($GITHUB_SHA) is not an ancestor of origin/main"
-            exit 1
-          fi
-      - name: Toolchain (solidcore/rust-toolchain.toml)
-        run: rustup show active-toolchain || rustup toolchain install
-      - name: Tag matches crate version
-        run: |
-          want="${GITHUB_REF_NAME#solidcore-v}"
-          have="$(cargo metadata --no-deps --format-version 1 \
-            | python3 -c 'import json,sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"]=="solidcore"))')"
-          echo "tag $want, solidcore/crates/solidcore/Cargo.toml $have"
-          test "$want" = "$have"
-      - run: cargo test -p solidcore --locked
-      - run: rustup target add wasm32-unknown-unknown && cargo check -p solidcore --locked --target wasm32-unknown-unknown
-      # Package and verify without the token first; only the real publish sees it.
-      - name: Publish (dry run)
-        run: cargo publish -p solidcore --locked --dry-run
-      - name: Publish
-        run: cargo publish -p solidcore --locked
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}

.github/workflows/triage.yml

@@ -1,86 +0,0 @@
-# Labels new issues and PRs from fixed rules, `/triage` for maintainers, asks short bug reports
-# for reproduction steps (`needs-info`, closed after 14 days unanswered), and a manual backfill
-# (CONTRIBUTING.md, "Labels and triage"). The logic is in scripts/triage/ (tested in ci.yml).
-name: Triage
-
-on:
-  issues:
-    types: [opened, labeled, edited]
-  issue_comment:
-    types: [created]
-  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
-  # scripts/triage and only lists the PR's changed paths; the PR's code is never checked out.
-  pull_request_target:
-    types: [opened]
-  schedule:
-    - cron: '41 5 * * *'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Only report what would be labelled'
-        type: boolean
-        default: true
-
-permissions:
-  contents: read # to check out scripts/triage
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: triage-${{ github.event.issue.number || github.event.pull_request.number || 'repo' }}
-  cancel-in-progress: false
-
-jobs:
-  triage:
-    name: Triage bot
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    # Filtered here so the common events (every comment, every label) start no runner.
-    if: >-
-      (github.event_name == 'issue_comment' &&
-      github.event.comment.user.type != 'Bot' && startsWith(github.event.comment.body, '/triage')) ||
-      ((github.event_name == 'issue_comment' || github.event.action == 'edited') &&
-      contains(github.event.issue.labels.*.name, 'needs-info') &&
-      github.event.sender.login == github.event.issue.user.login) ||
-      (github.event.action == 'labeled' && startsWith(github.event.label.name, 'priority:') &&
-      contains(github.event.issue.labels.*.name, 'needs-triage')) ||
-      (github.event_name != 'issue_comment' && github.event.action != 'labeled' && github.event.action != 'edited')
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: scripts/triage
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          DRY_RUN: ${{ inputs.dry_run }}
-        with:
-          script: |
-            const triage = require('./scripts/triage/triage.js');
-            const info = require('./scripts/triage/needs-info.js');
-            const event = context.eventName;
-            const action = context.payload.action;
-            const esc = (t) => String(t).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]);
-            const th = (...names) => names.map((data) => ({ data, header: true }));
-            if (event === 'issue_comment') {
-              core.info(await triage.handleComment({ github, context }));
-              await info.handleReply({ github, context });
-            } else if (event === 'issues' && action === 'labeled') {
-              await triage.handleLabeled({ github, context });
-            } else if (event === 'issues' && action === 'edited') {
-              await info.handleReply({ github, context });
-            } else if (event === 'schedule') {
-              const closed = await info.sweep({ github, context });
-              core.info(`Closed for missing information: ${closed.join(', ') || 'none'}`);
-            } else if (event === 'workflow_dispatch') {
-              const dryRun = process.env.DRY_RUN !== 'false';
-              const plan = await triage.backfill({ github, context, dryRun });
-              const asks = await info.backfill({ github, context, dryRun });
-              await core.summary
-                .addHeading(dryRun ? `Backfill dry run: ${plan.length} unlabelled` : `Backfill: ${plan.length} labelled`)
-                .addTable([th('Item', 'Kind', 'Labels', 'Title'), ...plan.map((p) => [`#${p.number}`, p.pull ? 'PR' : 'issue', esc(p.labels.join(', ') || '—'), esc(p.title)])])
-                .addHeading(dryRun ? `needs-info dry run: ${asks.length} would be asked` : `needs-info: ${asks.length} asked`)
-                .addTable([th('Issue', 'Asks', 'Title'), ...asks.map((p) => [`#${p.number}`, esc(p.asks.join(', ')), esc(p.title)])])
-                .write();
-            } else {
-              core.info(`Labelled: ${(await triage.handleOpened({ github, context })).join(', ') || 'nothing'}`);
-              if (event === 'issues') await info.handleOpened({ github, context });
-            }

.gitignore

@@ -7,11 +7,3 @@
 /.claude/worktrees/
 /target-snapshot
 __pycache__/
-.vscode/
-
-# cargo-mutants output (docs/mutation-testing.md)
-mutants.out*/
-
-# external corpus downloads (cargo xtask external-corpus, #1397): fetched at test time,
-# hash-pinned in tests/external-corpus.toml; never commit case data
-/corpus/

AGENTS.md

@@ -1,51 +1,157 @@
-# SolidCraft: instructions for agents
+# SolidCraft — instructions for agents
 
-SolidCraft is a clean-room, pure-Rust parametric 3D CAD app (sketch solver, feature timeline, B-rep kernel, an egui UI that agents drive). This file is a router: the hard rules, then the skill to read for your task. Humans: CONTRIBUTING.md.
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
+kernel, and a desktop UI that agents can drive. Projects published by
+[storytold](https://github.com/storytold) can serve as references for implementation conventions.
+Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
 
-## Start here
-Work: ROADMAP.md, "Where help is wanted most" in CONTRIBUTING.md, issues labelled `help wanted`, `good first issue`, `needs-triage`; architecture in `docs/architecture.md`. Local `plan/` notes are optional.
+## Product name
+SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
+`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
+settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
+survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
+new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
+`/solidcraft/`; do not add permanent old-name Pages aliases.
 
-## Hard rules (what enforces each)
-- Independent: never copy another product's code, icons, text or templates; never drive or take data from commercial CAD. `skills/solidcraft-ground-rules/SKILL.md`.
-- No GPL/LGPL/AGPL code, not even reading it (OpenCASCADE, FreeCAD, SolveSpace, CadQuery, LibreCAD, QCAD): `cargo xtask licences --check`.
-- Every asset is original or openly licensed with a row in ATTRIBUTION.md; read `assets/AGENTS.md` before icon work: `cargo xtask assets`, `cargo xtask icons`.
-- Never crash: no unwrap/expect/panic/unsafe in non-test code, errors are `Result`, input is hostile: clippy `-D warnings`, `hostile_params_never_panic`.
-- Model decisions (what an operation does, which bodies it touches, which face or edge a point or name means, depths, nearness) use exact geometry; a mesh is for display, export, previews and mesh bodies (`xtask/mesh-decisions.txt` only shrinks): `cargo xtask mesh-decisions`.
-- Everything is a command and programmatic calls never open dialogs: `skills/solidcraft-commands/SKILL.md`.
-- Layering; only `crates/kernel` uses truck; solidcore only via `solidcore-ops`/`-tess`/`-record` (`xtask/solidcore-seam.txt`): `cargo xtask layers`; see `solidcore/docs/layers.md`.
-- One outer UI container, one camera path (`navigation::handle`), colours from theme tokens: `cargo xtask ui-containers`.
-- Application code is Rust only and builds for wasm: `cargo xtask wasm`, `cargo xtask web-offline-test`.
-- The product name is SolidCraft; the old name lives only in `docs/compatibility.md`.
-- Sorted lists (message catalogs, `mod` lines, languages) stay sorted: `cargo xtask lists`. Never edit generated files (`docs/features.md`, `THIRD-PARTY-LICENSES.txt`) in a PR.
-- A design-format change is ONE new file in `crates/doc/src/format/pending/`: `scripts/test-format-pending.sh`.
-- A command has input and output schemas (will become required; `schema/unconverted.txt` only shrinks): `skills/solidcraft-commands/SKILL.md`.
-- New UI strings go in `assets/locales/pending/<slug>.json`, ATTRIBUTION rows in `attribution/pending/<slug>.md`: `cargo xtask lists`.
-- A changed default keeps the old behaviour behind a preference and fills the PR's `Changes a default:` line: `pr-checks.yml`.
-- A regression test goes in the area's existing test file, never a per-bug file (#3226).
-- Look at open PRs first, claim with a draft PR (lowest number wins), one topic per PR: `skills/solidcraft-contributing/SKILL.md`.
-- A PR's title and first sentence make sense to someone who never saw your chat or the issue: `skills/solidcraft-contributing/SKILL.md`.
-- Code, comments, commit messages and docs are in English; independent work runs in parallel, dependent work stays sequential: `skills/solidcraft-contributing/SKILL.md` ("Working as an agent").
-- Show observable changes with real screenshots or a recording, captured yourself.
-- Run `cargo xtask ci` before every commit. `cargo xtask skills` keeps this file and `skills/` honest.
+## Start every session here
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
+   and the relevant `plan/architecture.md` section.
+2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
+   is rejected for licence reasons).
+3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
+   unless it lists the decision as the owner's.
 
-## Working on X: read the skill first
-| Working on | Read |
-|---|---|
-| A PR, a claim, review, CI or evidence | `skills/solidcraft-contributing/SKILL.md` |
-| Licences, assets, clean-room, the name | `skills/solidcraft-ground-rules/SKILL.md` |
-| Non-test Rust, hostile input, a crash report | `skills/solidcraft-crash-safety/SKILL.md` |
-| A command, a crate boundary | `skills/solidcraft-commands/SKILL.md` |
-| SolidCraft or solidcore, kernel, geometry | `skills/solidcraft-layers/SKILL.md` |
-| A dialog, panel, camera, icon, colour | `skills/solidcraft-ui/SKILL.md` |
-| Labels, messages, translations | `skills/solidcraft-ui-text/SKILL.md` |
-| Saving something new in a design, import, export | `skills/solidcraft-file-formats/SKILL.md` |
-| Preferences, a changed default | `skills/solidcraft-preferences/SKILL.md` |
-| Writing or running tests | `skills/solidcraft-tests/SKILL.md` |
-| Slow work, the window thread, wasm | `skills/solidcraft-performance/SKILL.md` |
-| Releases, installers, packages | `skills/solidcraft-packaging/SKILL.md` |
-| Running the app, control channel, MCP tools | `skills/solidcraft-agent-tools/SKILL.md` |
-| Building a part over MCP | `skills/solidcraft-modeling/SKILL.md` |
-| Changing an existing design | `skills/solidcraft-editing/SKILL.md` |
-| A bug report, a crash, a wrong result | `skills/solidcraft-reporting/SKILL.md` |
-| Checking, porting, designs in git | `skills/solidcraft-checking/SKILL.md` |
-| Assemblies, joints, motion | `skills/solidcraft-mechanisms/SKILL.md` |
+`plan/` is gitignored (local only).
+
+## Never crash
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
+- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
+- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
+  returns an error ("not supported yet: …"); it never panics.
+- **Input-derived numbers are hostile** (command parameters, design files, control-channel
+  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
+- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
+  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
+- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
+  panic restores the design and reports `EngineError::Internal`.
+- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
+  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
+  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
+  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
+- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
+  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
+- Every production crate root carries
+  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
+
+## Non-negotiables
+- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
+  general CAD conventions and user feedback. Reference tests use analytic values and open-source
+  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
+  materials. File formats come from public specifications.
+- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
+  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
+  measurements, command lists, ids or files produced with them.
+- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
+  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
+  runs FreeCAD as a separate program through its public scripting API to compute reference values;
+  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
+  operations are our own.
+- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
+  artwork from commercial CAD products — ever.** Every UI icon is drawn in collected code
+  (`assets/icons/ui/source/`, compiled through `crates/ui-egui/src/icons.rs`). Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
+  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
+  Breaking this rule is the most serious mistake you can make in this repo.
+- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
+  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
+  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
+  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
+  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
+- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
+  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
+- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
+  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
+  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
+- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
+  `app.start(id)`. Colours come from `theme::Tokens`.
+- **One set of camera controls**: every page or canvas with a camera (viewport, Render
+  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
+  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
+  camera input (a test rejects it).
+- **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
+  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
+  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
+  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
+- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
+  assets, layers). Commit after every feature arc that builds.
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
+  push a branch, open a PR, and let GitHub CI run. Maintainers (and agents working for them) may
+  merge their own PR as soon as CI is green (`gh pr merge --squash`); a trivial fix (docs, typos)
+  may be merged right away. Keep each PR to one topic, rebase or merge `main` into it when it
+  conflicts, and never force-push `main`. Never commit `plan/`, build dirs (`target*/`) or
+  generated reference data; check `git ls-files` before pushing.
+- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
+  (`cargo xtask wasm`, part of `cargo xtask ci`).
+
+## Showing and following through on changes
+
+- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
+  issues and PRs must include actual descriptive screenshots or a short recording from a
+  small reproduction. This includes kernel, geometry, assembly and backend changes whose
+  effects can be shown in the app. Coding agents should run the app and capture this evidence
+  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
+  or result, preferably before and after, with brief reproduction steps, expected/actual
+  behavior and annotations that point out the relevant detail.
+- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
+  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
+  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
+- Use a small public-safe example and check for private designs, paths, account details or
+  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
+  recording; do not commit generated screenshots or videos just to provide review evidence.
+- Throughout the work and before handoff, check current upstream commits and the relevant
+  PR's merge status. Keep your branch current with upstream merges, resolve conflicts without
+  discarding others' work, and re-run validation when integration changes the result. Use
+  `git pull --rebase origin main` before pushing as above; never force-push. Report the checked
+  upstream/PR state, any conflicts resolved and the validation performed. If a PR remains open,
+  keep monitoring it while the task is active and make its pending status clear at handoff;
+  do not claim it merged without checking.
+
+## Application releases
+Development pushes are not application releases. Follow `docs/releasing.md` when asked to
+prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
+Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
+resulting draft and its artifacts. When shipping is authorized, publish that verified draft
+and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
+version bumps solely from commit prefixes, overwrite published versions, or push release tags
+before the draft is verified.
+
+## Running and looking at the app
+- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
+  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
+- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
+  request on a connection carries the launch's token as `"token"`: read it from
+  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
+  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
+  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
+  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
+  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
+- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
+  `ui.render` or `solidcraft-cli snapshot`.
+- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
+  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
+- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
+  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
+  values never come from a commercial CAD product.
+- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
+
+## Roadmap
+`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
+milestone task lands. `cargo xtask features` regenerates `docs/features.md` (SolidCraft's
+commands by area, from the registry) when commands are added or renamed.

CLAUDE.md

@@ -1,3 +1,130 @@
-@AGENTS.md
+# SolidCraft — instructions for agents
 
-The agent instructions for this repo live in AGENTS.md; edit that file only.
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
+kernel, and a desktop UI that agents can drive. Projects published by
+[storytold](https://github.com/storytold) can serve as references for implementation conventions.
+Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+
+## Product name
+SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
+`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
+settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
+survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
+new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
+`/solidcraft/`; do not add permanent old-name Pages aliases.
+
+## Start every session here
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
+   and the relevant `plan/architecture.md` section.
+2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
+   is rejected for licence reasons).
+3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
+   unless it lists the decision as the owner's.
+
+`plan/` is gitignored (local only).
+
+## Never crash
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
+- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
+- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
+  returns an error ("not supported yet: …"); it never panics.
+- **Input-derived numbers are hostile** (command parameters, design files, control-channel
+  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
+- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
+  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
+- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
+  panic restores the design and reports `EngineError::Internal`.
+- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
+  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
+  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
+  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
+- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
+  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
+- Every production crate root carries
+  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
+
+## Non-negotiables
+- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
+  general CAD conventions and user feedback. Reference tests use analytic values and open-source
+  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
+  materials. File formats come from public specifications.
+- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
+  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
+  measurements, command lists, ids or files produced with them.
+- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
+  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
+  runs FreeCAD as a separate program through its public scripting API to compute reference values;
+  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
+  operations are our own.
+- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
+  artwork from commercial CAD products — ever.** Every icon is drawn in code
+  (`crates/ui-egui/src/icons.rs`). Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
+  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
+  Breaking this rule is the most serious mistake you can make in this repo.
+- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
+  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
+  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
+  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
+  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
+- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
+  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
+- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
+  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
+  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
+- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
+  `app.start(id)`. Colours come from `theme::Tokens`.
+- **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
+  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
+  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
+  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
+- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
+  assets, layers). Commit after every feature arc that builds.
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
+  push a branch, open a PR, and let GitHub CI run. Maintainers (and agents working for them) may
+  merge their own PR as soon as CI is green (`gh pr merge --squash`); a trivial fix (docs, typos)
+  may be merged right away. Keep each PR to one topic, rebase or merge `main` into it when it
+  conflicts, and never force-push `main`. Never commit `plan/`, build dirs (`target*/`) or
+  generated reference data; check `git ls-files` before pushing.
+- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
+  (`cargo xtask wasm`, part of `cargo xtask ci`).
+
+## Application releases
+Development pushes are not application releases. Follow `docs/releasing.md` when asked to
+prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
+Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
+resulting draft and its artifacts. When shipping is authorized, publish that verified draft
+and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
+version bumps solely from commit prefixes, overwrite published versions, or push release tags
+before the draft is verified.
+
+## Running and looking at the app
+- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
+  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
+- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
+  request on a connection carries the launch's token as `"token"`: read it from
+  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
+  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
+  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
+  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
+  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
+- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
+  `ui.render` or `solidcraft-cli snapshot`.
+- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
+  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
+- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
+  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
+  values never come from a commercial CAD product.
+- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
+
+## Roadmap
+`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
+milestone task lands. `cargo xtask features` regenerates `docs/features.md` (SolidCraft's
+commands by area, from the registry) when commands are added or renamed.

CONTRIBUTING.md

@@ -1,10 +1,8 @@
 # Contributing to SolidCraft
 
-Agents: start from the router in [AGENTS.md](AGENTS.md), which points to a short skill in [`skills/`](skills/README.md) for each kind of work. This page stays the full human guide.
-
 SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
 You sketch on a plane, constrain the sketch, turn profiles into solids, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, macOS, Linux), in
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.
 
@@ -12,29 +10,13 @@ Help is welcome, whether that's a one-line fix or owning a whole area. This page
 build it, how the code is laid out, the few rules that aren't negotiable, and where help is
 needed most.
 
-Before choosing a task, check the [command inventory](docs/features.md) and
-[roadmap](docs/roadmap-detail.md) for implemented capabilities and current priorities.
-
-Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).
-
-## Kernel work is paused
-
-We're moving to a new geometry kernel. Until that's done, please don't open pull requests that
-change `crates/kernel/`, `crates/geom/` or the vendored kernel in `solidcore/`, or issues and discussions about kernel
-work: booleans, fillets, chamfers, shell, offsets, sweeps and lofts, threads and holes, STEP/IGES
-import and export, or tessellation. The pinned issue on the tracker explains it. New ones get the
-`kernel-paused` label (`.github/workflows/kernel-paused.yml`) and a maintainer answers them. Crashes
-and data loss are still taken as issues. Pull requests outside those directories carry on as normal,
-including the dialogs and tools for these features.
-
 ## Get it running (about 10 minutes on a fast machine)
 
 You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
-build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://github.com/trunk-rs/trunk)
-([documentation](https://trunk-rs.github.io/trunk/)).
+build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://trunkrs.dev).
 
 ```sh
-git clone https://github.com/tangency-labs/solidcraft && cd solidcraft
+git clone https://github.com/bherbruck/solidcraft && cd solidcraft
 cargo run --release -p solidcraft -- --sample      # desktop app with a sample part
 cargo xtask test                                   # unit, engine and UI-scenario tests
 cargo xtask ci                                     # everything a PR must pass (see below)
@@ -84,17 +66,14 @@ desktop integration and how to distinguish an old executable on `PATH`.
 
 ## How the code is laid out
 
-The [architecture page](docs/architecture.md) has the layer table. The short version:
+The [README](README.md#architecture) has the layer table. The short version:
 
 - `crates/geom`: vectors, planes, meshes, measures.
 - `crates/sketch`: our own constraint solver, plus profile finding.
-- `crates/dynamics`: multibody dynamics: rigid bodies, joint constraints, gravity and springs,
-  integrated in time (RFC #9719). It depends only on `geom`.
-- `crates/kernel`: the B-rep kernel boundary: solids, extrude/revolve, booleans, fillets,
-  meshes, measures and STEP, behind our own API (implemented with `solidcore`). `crates/smlib` is
-  the safe wrapper around `solidcore`, and `solidcore` is vendored in this repository at
-  `solidcore/`; `.github/workflows/solidcore-mirror.yml` mirrors changes to it back to
-  [tangency-labs/solidcore](https://github.com/tangency-labs/solidcore).
+- `crates/kernel`: the B-rep kernel boundary. It wraps [truck](https://github.com/ricosjp/truck),
+  and it's the only crate allowed to touch truck. Fillets, chamfers, shell/offset, Delete Face,
+  Split Face, STEP/IGES read and write, and face provenance are our own code here. Patched
+  copies of three truck crates live in `vendor/` and are excluded from our fmt/clippy rules.
 - `crates/doc`: the document. It holds parameters and expressions, the feature timeline and its
   incremental rebuild, components and occurrences, joints, appearances, and persistent naming.
 - `crates/io`: design files and mesh formats (3MF, STL, OBJ).
@@ -107,12 +86,6 @@ The [architecture page](docs/architecture.md) has the layer table. The short ver
 
 `cargo xtask layers` fails the build if a lower layer depends on a higher one.
 
-Whether a change belongs in SolidCraft or in SolidCore is decided by
-[`solidcore/docs/layers.md`](solidcore/docs/layers.md). Its tests: the **kernel** (`solidcore`)
-computes geometry any client could use; **ops** (`solidcore-ops`) is a recipe of kernel calls for a
-workflow, with no geometric quantity of its own; the **app** (SolidCraft) holds state and maps input
-to commands, with no geometry math.
-
 ## Rules that aren't negotiable
 
 1. **Independent.** SolidCraft is independent. Behaviour is designed from public
@@ -125,29 +98,24 @@ to commands, with no geometry math.
    MIT OR Apache-2.0, and its solver and blends are written from the maths. (Running an
    open-source application to get reference values for a test is fine; reading its source is
    not.) Permissive
-   dependencies are fine. Note which one you're adding and why in the PR. THIRD-PARTY-LICENSES.txt
-   lists it once the change lands: the Generated files workflow rewrites it on `main`.
-   Nightly/manual CI also scans advisories, bans and sources with cargo-deny, and a PR that
-   changes Cargo.lock or a Cargo.toml checks the advisories; see
+   dependencies are fine. Note which one you're adding and why in the PR, and run
+   `cargo xtask licences` so THIRD-PARTY-LICENSES.txt lists it (CI checks that it is current).
+   Nightly/manual CI also scans advisories, bans and sources with cargo-deny; see
    [the local command and coverage limits](docs/book/src/dev/testing.md#dependency-advisories).
 3. **Every asset is original or openly licensed and has a row in
    [ATTRIBUTION.md](ATTRIBUTION.md).** Icons are drawn in code (`crates/ui-egui/src/icons.rs`).
    `cargo xtask assets` enforces this.
 4. **Never crash.** People trust a CAD app with their work.
    - Non-test code never uses `unwrap`, `expect`, `panic!` or indexing on input-derived data.
-     There's no `unsafe` outside `apps/solidcraft/src/open_documents.rs` (macOS file-open events),
-     `apps/solidcraft/src/native_crash.rs` (Windows native crash capture) and
-     `crates/threedx-client/src/macos.rs` (the 3Dconnexion driver's client API on macOS), and the
-     compiler denies it.
+     There's no `unsafe` outside `apps/solidcraft/src/open_documents.rs` (macOS file-open events)
+     and `apps/solidcraft/src/native_crash.rs` (Windows native crash capture), and the compiler
+     denies it.
    - An unsupported case returns an error ("not supported yet: …"); it never panics.
-   - Every call into the vendored kernel goes through `solidcraft_kernel::guard`.
+   - Every call into truck goes through `solidcraft_kernel::guard`.
    - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
-   `crates/engine/src/cmd/` with input and output schemas (see
-   [Adding a command](docs/book/src/dev/commands.md#adding-a-command); a test warns about a
-   command without them, and will fail it once required), engine tests that measure the result (volume, area,
+   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
    face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
-   A command on the toolbar also ships with its help tooltip (step 6 of Adding a command).
 6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
    viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
    `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
@@ -155,10 +123,6 @@ to commands, with no geometry math.
    `navigation::handle`; never read drags, the wheel or pinch to move the camera yourself. The
    `hand_rolled_camera_input_is_rejected` test fails if a page does.
 
-Labels, parameter docs, messages and docs use the terms in the
-[glossary](https://docs.solidcraft.io/reference/glossary.html): one term for each idea. A change that adds a new
-idea adds its term there.
-
 [AGENTS.md](AGENTS.md) has the long form of these rules. It's written for AI agents, but it's
 the most complete description of the house style.
 
@@ -170,27 +134,6 @@ the most complete description of the house style.
 | UI scenarios | `crates/ui-egui/tests/scenarios/*.json` | part of `cargo test` |
 | Reference tests | `cargo xtask oracle` | `tests/oracle/` (see below) |
 
-The reference for what the kernel builds is the kernel-cases ladder (`tests/kernel-cases/ladder/`,
-`cargo xtask kernel-cases --ladder`, [docs/kernel-ladder.md](docs/kernel-ladder.md)).
-
-**Kernel cases go to solidcore.** A case that checks a kernel operation (a boolean, a blend, a
-shell, a sweep, an import's geometry) is a new entry in solidcore's corpus,
-`solidcore/crates/solidcore/tests/kernel_cases/<area>/` in this repository, with an answer
-in closed form or exact. Draft it as a rig case here, export it with
-`cargo xtask kernel-cases --area <area> --export DIR`, add `DIR/<area>/<case>.json` and its
-`.bodies.json.gz` under `solidcore`, and delete the draft; or write the entry by hand as
-that folder's README describes. The mirror workflow pushes the change to
-[tangency-labs/solidcore](https://github.com/tangency-labs/solidcore). `tests/kernel-cases/` takes
-no new cases: its `CASES` list only shrinks (`cargo xtask lists`). App-level cases (what a command
-does, the UI, product rules) stay in SolidCraft, as tests in their area's existing test file or UI
-scenarios.
-
-The naming corpus checks persistent names: every name a corpus design stores still finds a face or
-an edge, and two builds name its faces and edges alike
-(`cargo test --profile ci -p solidcraft-cli --test naming_corpus`).
-[docs/mutation-testing.md](docs/mutation-testing.md) shows how to find kernel behaviour these
-black-box suites miss.
-
 **UI scenarios** drive the real app headless: start a tool, click a plane or a sketch point,
 press keys, then assert on the result.
 
@@ -213,45 +156,25 @@ Either include the fix in the same PR, or mark the test `#[ignore = "fails until
 (it can then merge right away), and remove that line in the PR that fixes the bug.
 
 **Use the `ci` profile.** CI runs the tests with `--profile ci`: light optimisation, line tables,
-no LTO, and debug assertions off. It
+no LTO, and debug assertions off (truck has debug-only assertions that reject valid geometry). It
 builds several times faster than `--release`. If a test fails only in a plain debug build, say so
 in the PR. `cargo xtask test` builds the tests with it and then runs every test binary at once
 (`cargo test` runs them one after another); arguments after `--` go to each binary, e.g.
-`cargo xtask test -- shell`. Set `SOLIDCRAFT_TEST_JOBS` to a positive integer to opt into a
-shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
-For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
-worker consumes one of those slots. Every binary and side check still runs after failures.
-Without the variable the existing concurrency is unchanged. With it set, each test binary
-inherits `RUST_TEST_THREADS` and `ACTION_MATRIX_JOBS` of `max(1, cpus / jobs)` — the machine's
-parallelism shared between the binaries in flight — unless you set either one explicitly;
-explicit caller overrides always win. Cargo's build-job setting remains an independent caller
-override; this limit does not change test filters, timeouts or baselines.
-Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.
+`cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
+depend on wall-clock timing.
 
-**Ready pull requests test what they touch.** CI maps changed files to workspace packages and
-runs Clippy, the test build and tests for those and their dependents. The
-[package selector](scripts/ci/affected.py) and [CI workflow](.github/workflows/ci.yml) define
-which changes require native checks; documentation, packaging, other-workflow and bot-script-only
-changes run the repository checks only, on pull requests and on `main`. Workspace-wide changes,
-merge-queue groups, nightly runs and Run workflow select the full workspace. A push to `main`
-reuses a successful merge-queue run for the same commit, and runs only the repository checks
-when no code changed since the last push to `main` that passed; otherwise it runs the full
-suite. Doc tests, reference tests and the Windows jobs run on `main` and nightly only.
-
-**CI shards the tests.** One job builds them into a cargo-nextest archive; two shards run on
-pull requests and four during full validation. Every test runs in its own process: don't rely
-on state left by another test.
-Pull requests skip a few heavy tests (one to twelve minutes each), which run in full validation
-(the merge queue, nightly, manual runs and pushes to `main` not already tested by the queue).
-Check that validation after merging. They are listed in
+**CI shards the tests.** One job builds them into a cargo-nextest archive and four jobs run a
+quarter each, so every test runs in its own process: don't rely on state left by another test.
+Pull requests skip a few heavy tests (one to four minutes each), which run on every push to
+`main` and nightly; check the `main` run after merging. They are listed in
 `.config/nextest.toml` and the [testing page](docs/book/src/dev/testing.md):
 
-- `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness`,
+- `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness` and
+  `tests::robustness_goldens` (pull requests that touch `crates/kernel` run its `sample_*` part),
   `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
   `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
-  `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`, the `atomic_commands` contract tests
-- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`, `tspline::tests::hostile_tsplines_never_panic`, and the `boolean_props` property tests
-  (these run only in the nightly "Property tests" job: their inputs are random, so main skips them too)
+  `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`
+- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`
 - `solidcraft-ui-egui` scenarios: `acceptance_sensor_enclosure`
 
 **The action matrix** tries every ordinary action on every face, edge, vertex and body of a
@@ -259,136 +182,27 @@ corpus of designs against a checked-in ratchet ([docs/action-matrix.md](docs/act
 A pull request that makes an action pass should record it with `cargo xtask action-matrix --bless`;
 one that makes a passing action fail fails the sample every CI run checks.
 
-**The reference tests** live in [`tests/oracle/`](tests/oracle/), each a `recipe.json`
+**The reference tests** are 76 parts in [`tests/oracle/`](tests/oracle/), each a `recipe.json`
 in our own format with an `expected.json` beside it. SolidCraft rebuilds the recipe and compares
 body count, volume, area, centre of mass and bounding box (and, where there is a `reference.stl`,
 the surface itself). Expected values are either worked out in closed form
 (`tools/oracle-analytic/`) or computed by building the same recipe in FreeCAD, run as a separate
-program (`tools/freecad-oracle/`); each file says which. The generated
-[reference test report](docs/oracle.md) has the current case count and results. The reference-test
-CI job runs `cargo xtask oracle` during full validation, and on pull requests that reach
-`solidcraft-cli`. A case that
-fails because of a known bug names its issue in `expected.json` (`"known_failure": "#123"`);
-never change an expected value to match SolidCraft's output.
-
-## Changing the design file format
-
-A design file says which format it is in (`"format": "solidcraft/N"`). If your change saves
-something new in a design (a field, a feature type, a new kind of name), or makes older designs
-mean something else, it needs a format change. **Add one file, and edit nothing shared:**
-
-1. Create `crates/doc/src/format/pending/<what-it-is>.rs` (lowercase, dashes). Start it with a
-   `//!` note: what is saved, what older designs get without it, and that the last release asks
-   for an update instead of meeting it.
-2. If older designs must be rewritten as they open, put `pub fn step(v: &mut Value) ->
-   crate::Result<()>` in the same file. Pending steps run in file-name order, after the older
-   formats' steps.
-3. Don't touch `FORMAT`, `JSON_STEPS`, the history in `crates/doc/src/format.rs`, another
-   change's file, or any `v<N>/` folder: those are fixed once released.
-
-That's all. The build counts the files: while any are pending it writes the next format number,
-which no release reads, so a release warns about a design that has your change and keeps what it can't read of it.
-A file also lists the pending changes it has (`format_pending`), so a later development build
-runs only the steps that file is missing. Two pull requests that each add a change merge without
-a conflict. `crates/doc/src/format/pending/README.md` has an example.
-
-**At release time** the maintainer runs `scripts/fold-format-pending.sh`, which moves the pending
-files into `crates/doc/src/format/v<N>/` and fixes that number for good (see
-[docs/releasing.md](docs/releasing.md)). Never add a file to a `v<N>/` folder afterwards. Drawings
-follow the same rules with their own numbers, from 1, in `crates/doc/src/drawing/format/` (see its
-`pending/README.md`), and the same script folds them.
-
-## Lists many changes add to
-
-Some files gain an item in many pull requests at once. They are kept so that two changes that
-each add an item only meet when their items are neighbours, which spares everyone a conflict
-and a fresh CI run:
-
-- **Growing Rust lists**: use slices (`const ITEMS: &[Item] = &[...];`) without a written
-  length. `cargo xtask lists` rejects non-test const/static arrays with more than ten lines
-  of entries, except fixed standard or algorithm tables listed with reasons in `xtask/src/lists.rs`.
-  Built-in themes need only a JSON file in `assets/styles/ui/themes/`, with a unique nonnegative
-  integer `order` (the picker order) and its own `provenance` line; keep existing order values.
-- **Message catalogs** (`assets/locales/*.json`): one message per line, sorted by id. Add your
-  message anywhere and run `cargo xtask lists --fix`; `cargo xtask lists` (in `cargo xtask ci`
-  and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
-- **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
-  sorted). Add a new module into the existing group, not as a new group at the end.
-- **Commands without schemas** (`crates/engine/src/schema/unconverted.txt`): sorted, one id per
-  line, and it only shrinks. Converting a command removes its line; a new command is never added
-  to it.
-- **Toolbar commands without help** (`BACKLOG` in `crates/ui-egui/src/command_help.rs`): sorted,
-  one id per line, and it only shrinks. Writing a command's help removes its line; a new command
-  is never added to it.
-- **`ui.prefs` settings** (`docs/control-protocol.md`): one line per setting, sorted by name, in
-  the list under the protocol table; add a new setting on its own line rather than editing a shared
-  row.
-- **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
-  checks it).
-- **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
-  after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
-  features`). Don't regenerate or edit them in a pull request.
-- **Design format**: one file per change, never an edit to a shared number (above).
-- **New UI strings and attribution rows**: one new file per change, `assets/locales/pending/<slug>.json`
-  and `attribution/pending/<slug>.md`, instead of editing the catalogs or the ATTRIBUTION.md table;
-  `cargo xtask fold-pending` folds them on `main` (see the README in each folder). A new English
-  message also needs every catalog delivered complete (`COMPLETE` in `crates/ui-egui/src/i18n.rs`:
-  today ar, he, ja, vi, and zh) in the same pending file; `cargo xtask i18n --check` reports any gap.
+program (`tools/freecad-oracle/`); each file says which. [docs/oracle.md](docs/oracle.md) has
+the current results, and CI runs `cargo xtask oracle` on every pull request. A case that fails
+because of a known bug names its issue in `expected.json` (`"known_failure": "#123"`); never
+change an expected value to match SolidCraft's output.
 
 ## Sending a change
 
-1. Work is tracked in [GitHub issues](https://github.com/tangency-labs/solidcraft/issues), labelled
-   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). For anything
-   bigger than a bug fix that has no issue yet, open one first. **Claim the issue with a draft
-   PR** before you start, so two people don't build the same thing:
-   - Check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
-   - Branch from the latest `main`, commit `git commit --allow-empty -m "claim: #N"`, push, and
-     open a **draft** PR titled `<summary> (#N)`, e.g. `Fillet: variable radius along a chain (#123)`.
-   - **The lowest-numbered open PR for an issue wins.** If yours lost, close it (or offer to help
-     on the other one).
-   - The bot records the claim when the PR is opened: it assigns you, adds `in progress` and
-     says so on the issue. It reads `#N` in the PR title and `Fixes #N` in the body. If someone
-     already holds the issue, or an older open PR references it, it says so on your PR instead.
-   - Want to stake a claim before you have a branch? Comment `/claim` on the issue (below).
-   - Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
-     comment on it first, then open your own claim.
-   - Mark the PR ready for review when it is done.
+1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solidcraft/issues), labelled
+   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). Before starting,
+   comment on the issue so it gets the `in progress` label and two people don't build the same
+   thing. For anything bigger than a bug fix that has no issue yet, open one first.
 2. Branch from `main` and keep the PR to one topic.
 3. Run `cargo xtask ci` before pushing. It runs fmt, the asset, licence and layer checks,
    clippy (`-D warnings`), then the tests with the wasm build check alongside. A PR has to pass it.
-   Heavy CI runs after review: a pull request gets the formatting and repository checks and a
-   quick compile (`cargo check`) when you push. Once a maintainer has reviewed it they add the
-   `approved-for-ci` label when the PR is ready to merge, which runs the full CI (build, tests,
-   goldens, Clippy); every push after that runs the full set again. Maintainers merge approved
-   PRs in groups by area, so PRs that touch the same code meet a conflict at most once. The one
-   exception is the pull request that first vendored SolidCore: it must land with a real merge
-   commit, because a squash merge drops the subtree parent and the mirror can no longer
-   fast-forward SolidCore (`.github/workflows/solidcore-mirror.yml`).
 4. Reference the issue (`Fixes #12`). In the PR, say what you tested and how. For geometry work, include the measured numbers (and
    the expected ones).
-5. Write the PR title and first sentence for someone who hasn't seen your chat, the issue or the
-   code. Maintainers pick what to review from the title, and it becomes the commit on `main`. Say
-   which part of the app changes and what a user now sees or can do, and name things rather than
-   leaning on "there", "it" or "this".
-   - Unclear: `Send to Slicer: pick one print face per body there, and show print faces only while it is open`
-   - Clear: `3D printing: choose the face each body rests on in the Send to Slicer window, not the face menu`
-
-   Use plain, literal English in PR text: one idea per sentence, active voice, and one word for one
-   thing. This helps everyone, including readers whose first language isn't English.
-
-Commenting `/claim` assigns you, adds the `in progress` label, and replies with its automatic cleanup
-deadline. It frees a claim with no linked PR after 72 hours, or a claim with a PR after 14 days
-without pushes. These automatic cleanup deadlines are separate from the daily progress and
-72-hour takeover policy above. A draft PR that references the issue claims it the same way.
-`/unclaim` releases the bot claim early (only you or a maintainer can). Issues a maintainer has
-taken are never freed automatically.
-
-**A PR has to explain itself.** Start the description with what it is, in plain words someone new
-to the project would understand: what it does and who it's for. Don't assume anyone knows the name
-of your tool, project or feature. If there's anything to look at, show it in the description: a
-picture or video has to be visible there without opening the changed files. "The GIF is the change"
-doesn't count. A PR that doesn't do this waits until it does. For a PR that adds to
-`docs/showcase.md` or `docs/screenshots/`, the Picture check fails until the description shows one.
 
 Help reviewers see what the words mean. For observable CAD, UI or model behavior, please
 include actual descriptive screenshots or a short recording in the issue or PR. This evidence
@@ -404,98 +218,39 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.
 
-To show a picture without committing it, attach the media to the PR (it goes to the PR's own
-attachment storage and renders inline in the comment). A gist is the better home for a log or
-another text file, and you link it; a gist does not render a picture inline. The review artifacts
-stay out of the diff that way, and nothing has to be pushed to a branch of its own.
-
-Attaching works in the browser for anyone who can comment: drag the file into a comment on the
-pull request. A command-line agent without a browser session usually cannot attach a file (the
-upload needs write access to this repository). Say so in the pull request, and the person running
-the agent or a maintainer can attach it.
-
-Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
-`main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
-run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
-push a change anyway, or GitHub reports a conflict, rebase onto the latest `main` (push your
-branch with `--force-with-lease`) or merge `main` in once, and resolve conflicts without losing
-others' changes. Don't re-run CI on an unchanged commit either: a real failure fails again.
-Re-run only a job that runner trouble cancelled, with "Re-run failed jobs". While a task remains
-active, follow an open PR through its status changes; at handoff, clearly identify anything
-still awaiting merge.
+Keep checking upstream commits and the relevant PR's merge status throughout the work and
+before handoff. Integrate upstream merges, resolve conflicts without losing others' changes,
+and validate the integrated result. Before pushing, run `git pull --rebase origin main`, re-run
+CI if it brought changes, and push without force. Report the upstream/PR state you checked,
+any conflicts resolved and validation results. While a task remains active, follow an open
+PR through its status changes; at handoff, clearly identify anything still awaiting merge.
 
 Much of SolidCraft so far was written by AI coding agents (Claude) working in parallel, each
 owning one area, with a human setting direction and reporting bugs. Their working notes are in
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.
 
-Two quick checks run on every pull request (`.github/workflows/pr-checks.yml`, not required): it
-fails when a lower-numbered open PR by someone else already closes the same issue (the label
-`not-a-duplicate` skips it), or when the description lacks the `Changes a default: no` / `Changes a default: yes — <what>, old behaviour kept behind preference <name>` line (docs-only and bot PRs are exempt).
-
-## Labels and triage
-
-The triage bot labels every new issue and PR (`.github/workflows/triage.yml`). It only adds labels;
-correct them freely and it won't put them back.
-
-- **PRs** get `area:*` from the paths they change (`crates/kernel` and `crates/geom` →
-  `area:kernel`, `crates/ui-egui` and the apps → `area:ui`, `.github/`, `scripts/`, `docs/` →
-  `area:infra`, and so on).
-- **Issues** get `bug` (in-app reports and the bug template), `enhancement` (feature requests),
-  `priority:P1` for crashes, and an `area:*` from the title or the reported command. Until it has
-  a priority, an issue carries `needs-triage`; setting a priority removes it.
-- **Maintainers** comment `/triage area:kernel P1` (any existing label; `P0`–`P3` for a
-  priority, which replaces the old one; `-label` removes one) to sort an issue or PR.
-- **Short bug reports without steps to reproduce** get `needs-info` and one comment asking for
-  the steps (and the version, when it's missing). An app report that arrived empty is asked to
-  paste the report the app copied to the clipboard. The reporter's reply, or an edit that adds the
-  steps, removes the label; an issue that stays in `needs-info` for 14 days is closed, and can be
-  reopened any time. Feature requests, app reports with their details, and maintainers' issues
-  are never asked.
-- `needs-triage` is the queue: [open issues with it](https://github.com/tangency-labs/solidcraft/issues?q=is%3Aopen+label%3Aneeds-triage).
-
 ## Where help is wanted most
 
-**Kernel speed (slow fillets, booleans, STEP):** report slow cases with a file under the `kernel-perf` label, and put kernel effort into the vendored kernel, [solidcore](https://github.com/tangency-labs/solidcore) ([progress](https://tangency-labs.github.io/solidcore/)). See [#1597](https://github.com/tangency-labs/solidcraft/issues/1597).
-
-See the [`help wanted`](https://github.com/tangency-labs/solidcraft/labels/help%20wanted) and
-[`good first issue`](https://github.com/tangency-labs/solidcraft/labels/good%20first%20issue) labels.
+See the [`help wanted`](https://github.com/bherbruck/solidcraft/labels/help%20wanted) and
+[`good first issue`](https://github.com/bherbruck/solidcraft/labels/good%20first%20issue) labels.
 In order of how much they'd help users:
 
-1. **Fillet and blend robustness.** Fillets are the vendored kernel's code (`solidcore`).
+1. **Fillet and blend robustness.** Fillets are our own code (truck has no fillet operation).
    Constant, variable-radius and chord fillets work, and so do corners where fillets of
    different radii meet, including three rounds meeting at a vertex. Next are setback corners, fillets along curved edges between curved
    faces, and fillets that consume neighbouring faces.
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
    through without a kernel error. Each failing seed is a reproducible bug.
-3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
-   [ROADMAP.md](docs/roadmap-detail.md)), but anyone who wants to own one is welcome.
-
-## Updating the generated feature list
-
-After adding or renaming commands, run `cargo xtask features`. The registry is the
-source of truth for `docs/features.md`; do not hand-edit the generated rows.
-The generator sorts commands by ID and omits global and per-section counters,
-so additions to unrelated areas no longer rewrite shared summary lines.
-
-If two branches still conflict in this file (for example, adjacent additions in
-the same area), first resolve the command registry and source conflicts, then run
-`cargo xtask features` again and stage the regenerated file. Do not use Git's
-`union` merge driver: it can silently retain stale or duplicate command rows.
-The generator tests cover stable ordering and additions that leave existing lines
-unchanged. The initial switch to sorted rows is a one-time larger diff.
-
-## Pictures in the user guide
-
-The user guide's screenshots and short clips (`docs/book/src/media/`) are captured from the real
-app by `examples/demo/doc_shots.py`, one function per figure. Each run starts a fresh app with its
-own settings, so your preferences never show. When a change makes a figure out of date, run
-`python3 examples/demo/doc_shots.py <page or shot>` (it needs Xvfb, ffmpeg, Pillow and a release
-build) and commit the new file. A new figure is a new function there, an ATTRIBUTION row in
-`attribution/pending/`, and a `<video>` (clips) or image link on the page. Keep a still under
-about 250 KB and a clip under about 1 MB.
+3. **Y-up / Z-up.** SolidCraft is Z-up only, so most STEP files (from SolidWorks, Onshape, or
+   Fusion's default) open lying on their backs. Fusion solves this with a "default modeling
+   orientation" preference.
+4. **Imported appearances.** Colours from STEP files are lost when a feature changes the
+   imported body. They should become design appearances on import.
+5. **Drawings, CAM and mesh tools.** These are out of scope for now (see
+   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
 
 ## Licence
 
 By contributing you agree that your contribution is licensed as MIT OR Apache-2.0, like the rest
-of SolidCraft. SolidCraft isn't affiliated with any CAD vendor; product names are trademarks of their owners (see NOTICE).
+of SolidCraft. SolidCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.

Cargo.toml

@@ -1,12 +1,11 @@
 [workspace]
 resolver = "3"
 members = ["crates/*", "apps/*", "xtask"]
-# Third-party code kept with local fixes (vendor/), and the vendored SolidCore kernel (solidcore/);
-# neither is linted as ours. See CONTRIBUTING.md, "How the code is laid out".
-exclude = ["solidcore", "vendor"]
+# Third-party code kept with local fixes (see vendor/README.md); not linted as ours.
+exclude = ["vendor"]
 
 [workspace.package]
-version = "0.40.0-rc.3"
+version = "0.13.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -14,41 +13,18 @@ authors = ["SolidCraft contributors"]
 repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
-robust = "1.2"
 # internal
 solidcraft-geom = { path = "crates/geom" }
-solidcraft-profile = { path = "crates/profile" }
 solidcraft-sketch = { path = "crates/sketch" }
 solidcraft-kernel = { path = "crates/kernel" }
-solidcraft-smlib = { path = "crates/smlib" }
-solidcraft-step = { path = "crates/step" }
 solidcraft-render = { path = "crates/render" }
-solidcraft-dynamics = { path = "crates/dynamics" }
 solidcraft-gpu = { path = "crates/gpu" }
 solidcraft-doc = { path = "crates/doc" }
 solidcraft-io = { path = "crates/io" }
 solidcraft-engine = { path = "crates/engine" }
 solidcraft-ui-egui = { path = "crates/ui-egui" }
-solidcraft-ui-registry = { path = "crates/ui-registry" }
-solidcraft-color = { path = "crates/color" }
-solidcraft-ui-text = { path = "crates/ui-text" }
-solidcraft-theme = { path = "crates/theme" }
-solidcraft-space-mouse = { path = "crates/space-mouse" }
 solidcraft-mcp = { path = "crates/mcp" }
-solidcraft-mcp-server = { path = "crates/mcp-server" }
-solidcraft-control = { path = "crates/control" }
-solidcraft-control-egui = { path = "crates/control-egui" }
 solidcraft-derive = { path = "crates/derive" }
-solidcraft-3dx-client = { path = "crates/threedx-client" }
-# The Rust port of NVIDIA's SMLib (Apache-2.0), the B-rep kernel behind crates/smlib. Vendored with
-# `git subtree` at solidcore: that tree is the source of truth, and
-# .github/workflows/solidcore-mirror.yml pushes changes in it back to its own repository (#13153).
-solidcore = { path = "solidcore/crates/solidcore" }
-# Geometry as data (solidcore's layers §1, "Record"): the B-rep record, its structural validation
-# and the native body file. Vendored with solidcore, in the same subtree.
-solidcore-record = { path = "solidcore/crates/solidcore-record" }
-# test tooling: a dev-dependency only (xtask/src/layers.rs)
-solidcraft-testkit = { path = "crates/testkit" }
 
 # foundation
 thiserror = "2"
@@ -58,64 +34,39 @@ proc-macro2 = "1"
 quote = "1"
 syn = { version = "2", features = ["full"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
-# command parameter and result schemas
-schemars = "1.2"
-serde_path_to_error = "0.1"
 log = "0.4"
 sha2 = "0.10"
 moxcms = { version = "0.8.1", default-features = false, features = ["extended_range"] }
 semver = "1"
 
-# constrained Delaunay + Ruppert refinement for trimmed faces (MIT OR Apache-2.0).
+# geometry kernel (Apache-2.0; see plan/adr/0001-geometry-kernel.md). Only crates/kernel uses it.
+truck-modeling = "0.6"
+truck-shapeops = { version = "0.4", default-features = false }
+truck-meshalgo = { version = "0.4", default-features = false, features = ["tessellation", "analyzers"] }
+truck-stepio = { version = "0.3", default-features = false }
+truck-topology = "0.6"
+# constrained Delaunay + Ruppert refinement for trimmed faces (MIT OR Apache-2.0); already in the
+# tree through truck-meshalgo.
 spade = { version = "2.15", default-features = false, features = ["std"] }
 rayon = "1.12"
 
 # packages (3MF)
-zip = { version = "9", default-features = false, features = ["deflate"] }
+zip = { version = "3", default-features = false, features = ["deflate"] }
 quick-xml = "0.41"
-# STEP text in a legacy encoding (GBK, Shift_JIS, …) instead of Part 21 escapes (#2344): detect
-# and decode it. Both MIT OR Apache-2.0 (encoding_rs adds BSD-3-Clause data); encoding_rs is
-# already in the tree through cadmpeg-codec-step.
-chardetng = "0.1"
-encoding_rs = "0.8"
-# glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
-# read by crates/io itself, so no image decoding or file access comes with it.
-gltf = { version = "1.4", default-features = false, features = ["names"] }
-# The computer's name in a design's "open elsewhere" lock file (MIT OR Apache-2.0; already in the
-# tree through x11rb).
-gethostname = "1"
-
-# FreeCAD and Rhino import (Apache-2.0, pure Rust; native and browser builds).
-# Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
-# features, so cadmpeg's codecs for commercial formats (f3d, sldprt, inventor, catia, creo, nx)
-# and its ShapeManager/ACIS `sat` codec are not compiled in. `step` is the writer we restate through.
-cadmpeg-core = "=0.6.7"
-cadmpeg-ir = "=0.6.7"
-cadmpeg-registry = { version = "=0.6.7", default-features = false, features = ["fcstd", "rhino", "step"] }
 
 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
-ttf-parser = { version = "0.25", default-features = false, features = ["std", "variable-fonts"] }
-
-# Ends a process group with the system call (MIT; already in the tree through zip).
-nix = { version = "0.31", default-features = false, features = ["signal"] }
+ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
 
 # images
 image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
 png = "0.18.1"
-# LZW for GIF animations (MIT OR Apache-2.0, pure Rust; already in the tree through image's tiff).
-weezl = "0.1.12"
-# rasterises the UI icon SVGs (BSD-3-Clause, pure Rust, builds for wasm)
-tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd"] }
-# build scripts: reads the icon palette (MIT OR Apache-2.0)
-toml = "1"
 
 # ui
-# default_fonts: the built-in Hack is the UI's symbol fallback (#2955); 0.37 no longer turns it on.
-egui = { version = "0.37", features = ["default_fonts"] }
-eframe = { version = "0.37", default-features = false, features = ["persistence"] }
+egui = "0.36"
+eframe = { version = "0.36", default-features = false, features = ["persistence"] }
 # Instant/SystemTime that also work in the browser (std panics on wasm32-unknown-unknown).
 web-time = "1"
-egui-wgpu = "0.37"
+egui-wgpu = "0.36"
 # the wgpu egui-wgpu uses, for compute (crates/gpu); backends come from the apps' features
 wgpu = { version = "30", default-features = false, features = ["std", "wgsl"] }
 naga = { version = "30", default-features = false }
@@ -140,7 +91,9 @@ opt-level = 2
 opt-level = 1
 
 # Tests and lints (`cargo xtask ci`, GitHub CI): quick to build, quick enough to run. Light
-# optimisation, line tables only (file:line in backtraces), no LTO, no debug assertions.
+# optimisation, line tables only (file:line in backtraces), no LTO. Debug assertions are off because
+# truck's debug-only checks reject valid geometry (seam edges, closed edges); that was the only
+# reason the tests used to build with --release, which cost most of CI's time.
 [profile.ci]
 inherits = "dev"
 opt-level = 1
@@ -151,9 +104,6 @@ incremental = false
 
 [profile.ci.package."*"]
 opt-level = 2
-# No line tables for dependencies: they were over a third of the test archive every CI shard
-# downloads. Our own crates keep theirs, so a backtrace still names file:line in them.
-debug = false
 
 [profile.release]
 opt-level = 3
@@ -163,18 +113,12 @@ codegen-units = 16
 # binary). See docs/crash-reports.md.
 debug = "line-tables-only"
 
-
-# Vendored crates with SolidCraft fixes (see vendor/README.md and ATTRIBUTION.md).
+# truck-shapeops with SolidCraft fixes (Apache-2.0, see vendor/truck-shapeops and ATTRIBUTION.md).
 [patch.crates-io]
+truck-shapeops = { path = "vendor/truck-shapeops" }
+truck-stepio = { path = "vendor/truck-stepio" }
+truck-meshalgo = { path = "vendor/truck-meshalgo" }
+matext4cgmath = { path = "vendor/matext4cgmath" }
+
 # Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
 egui-wgpu = { path = "vendor/egui-wgpu" }
-
-# Deliver trackpad pinch and rotation gestures on Wayland (zwp_pointer_gestures_v1), which
-# winit 0.30 never binds and eframe 0.37 still requires winit 0.30.
-winit = { path = "vendor/winit" }
-
-# Mutation testing (cargo-mutants, docs/mutation-testing.md): the ci profile with incremental
-# builds, since every mutant rebuilds the crates above the one it changes.
-[profile.mutants]
-inherits = "ci"
-incremental = true

DISCLAIMER.md

@@ -1,44 +0,0 @@
-# Disclaimer
-
-This disclaimer covers the software, models, data, documentation and every other file in this
-repository and in the releases built from it (together, "the files").
-
-## No warranty
-
-The files are provided "as is", without warranty of any kind, express or implied, including
-warranties of accuracy, merchantability, fitness for a particular purpose and non-infringement.
-Results produced with the files, such as geometry, meshes, analyses and simulations, can be
-wrong. A qualified person must check them before anyone relies on them for a design,
-manufacturing or safety decision.
-
-## No liability
-
-To the fullest extent permitted by law, Tangency Labs and the contributors are not liable for any
-claim, damage, loss or other liability arising from the files or from their use, modification or
-distribution, whether in contract, tort or otherwise.
-
-## No indemnity
-
-Neither Tangency Labs nor any contributor indemnifies, defends or holds harmless anyone who uses,
-modifies or distributes the files, including against claims that the files infringe someone
-else's rights.
-
-## Harmful or unlawful use
-
-Tangency Labs and the contributors do not authorise, endorse or accept any responsibility for use
-of the files to harm people, animals, property or the environment, or for any unlawful use.
-Whoever uses the files is solely responsible for how they use them, for what they make with them
-and for complying with the laws that apply to them. Tangency Labs and the contributors must not be
-named or held out as responsible for any such use.
-
-## No endorsement
-
-Using, modifying or distributing the files does not mean that Tangency Labs or any contributor
-endorses you, your product or your results. Do not use the name of Tangency Labs or of a
-contributor to suggest such an endorsement without written permission.
-
-## Relation to the licence
-
-This disclaimer adds to the warranty and liability terms of the licence the files are distributed
-under. It does not restrict any right that licence grants; where the two differ, the licence
-governs.

NOTICE

@@ -7,11 +7,12 @@ Third-party material
 
 Software dependencies are listed in Cargo.lock; their licences are in THIRD-PARTY-LICENSES.txt
 (`cargo xtask licences`), which the programs also carry (Help > About > Licences,
-`solidcraft-cli licences`). The geometry kernel is solidcore, a Rust port of the SMLib and SM_API components of
-USD BRep (https://github.com/NVIDIA-Omniverse/usd-brep), licensed under the Apache License 2.0.
-solidcore is vendored in `solidcore/` together with its history; its own LICENSE, NOTICE and
-ATTRIBUTION.md are there. Copyright (c) 2026 The solidcore contributors; USD BRep is
-Copyright (c) 2020-2026 NVIDIA CORPORATION & AFFILIATES.
+`solidcraft-cli licences`). The geometry kernel builds on the truck crates
+(truck-modeling, truck-shapeops, truck-meshalgo, truck-stepio, truck-topology and their
+dependencies, https://github.com/ricosjp/truck), licensed under the Apache License 2.0 and used
+as libraries. truck-shapeops 0.4.0 is vendored in vendor/truck-shapeops with SolidCraft
+modifications (listed in vendor/README.md and marked in the source); its licence is in
+vendor/truck-shapeops/LICENSE. Copyright (c) RICOS Co. Ltd.
 
 Some code is adapted from sibling projects in the storytold family (CADCraft, GridCraft), which are
 licensed MIT OR Apache-2.0; ATTRIBUTION.md lists the files.
@@ -28,8 +29,5 @@ for sketch text, BIZ UDPGothic for web Japanese display) are licensed under SIL
 per-file list is in ATTRIBUTION.md.
 
 SolidCraft is an independent project and is not affiliated with, sponsored by or endorsed by
-Autodesk, Dassault Systèmes, PTC, Siemens, Blender or any other CAD vendor. Fusion, AutoCAD,
-Inventor, Alias and Tinkercad are trademarks of Autodesk, Inc.; SolidWorks is a trademark of
-Dassault Systèmes; Onshape and Creo are trademarks of PTC; Blender is a trademark of the Blender
-Foundation. Product names appear only to describe compatibility, such as the mouse navigation
-presets in Preferences › Navigation and file formats from public specifications.
+Autodesk, Inc. Autodesk and Fusion are trademarks of Autodesk, Inc.; they are used here only to
+describe compatibility goals.

README.md

@@ -1,17 +1,16 @@
-<p align="center">
-  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" width="96" height="96" alt="SolidCraft" />
-</p>
+# SolidCraft
 
-<h1 align="center">SolidCraft</h1>
+**An open-source parametric 3D CAD application built in pure Rust.**
 
-<p align="center">
-  <strong>An open-source parametric 3D CAD application built in pure Rust.</strong><br />
-  Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
-  and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
-  model through the built-in MCP server.
-</p>
+Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
+and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
+model through the built-in MCP server.
 
-<div align="center">
+![SolidCraft 0.8: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo-0.8.gif)
+
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 9× playback. [Full video](https://github.com/bherbruck/solidcraft/raw/refs/heads/main/docs/screenshots/demo-0.8.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+
+## Download
 
 [![Download for Windows][badge-windows]][windows-msi]
 [![Download for macOS][badge-macos]][macos-dmg]
@@ -19,135 +18,240 @@
 [![Get it from the Snap Store][badge-snap]][snap-store]
 [![Try it in your browser][badge-web]][web-app]
 
-</div>
-
-<p align="center">
-  <a href="https://solidcraft.io">Website</a> ·
-  <a href="https://solidcraft.io/download">Download</a> ·
-  <a href="https://solidcraft.io/app">Try it in the browser</a> ·
-  <a href="https://docs.solidcraft.io/">Documentation</a> ·
-  <a href="https://www.blacksmith.sh"><img src="https://img.shields.io/badge/CI-Blacksmith-000000?logo=githubactions&logoColor=white" alt="CI powered by Blacksmith" /></a>
-  <a href="https://discord.gg/FtU4NQNVDH">Discord</a> ·
-  <a href="https://github.com/tangency-labs/solidcore">SolidCore</a>
-</p>
-
-<p align="center">
-  <a href="https://github.com/tangency-labs/solidcraft/actions/workflows/ci.yml?query=branch%3Amain"><img src="https://github.com/tangency-labs/solidcraft/actions/workflows/ci.yml/badge.svg?branch=main" alt="CI" /></a>
-  <a href="https://github.com/tangency-labs/solidcraft/releases/latest"><img src="https://img.shields.io/github/v/release/tangency-labs/solidcraft?label=release" alt="Latest release" /></a>
-  <a href="https://github.com/tangency-labs/solidcraft/releases"><img src="https://img.shields.io/github/downloads/tangency-labs/solidcraft/total?label=downloads" alt="Downloads" /></a>
-  <a href="LICENSE"><img src="https://img.shields.io/github/license/tangency-labs/solidcraft" alt="Licence" /></a>
-  <a href="https://discord.gg/FtU4NQNVDH"><img src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
-  <a href="https://remade.wiki/projects/solidcraft/"><img src="https://remade.wiki/badges/listed-on-remade-classic.svg" alt="Listed on Remade" /></a>
-  <a href="https://github.com/tangency-labs/solidcraft/stargazers"><img src="https://img.shields.io/github/stars/tangency-labs/solidcraft?style=flat" alt="Stars" /></a>
-</p>
-
-<p align="center">
-  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily" alt="tangency-labs%2Fsolidcraft | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
-</p>
-
-![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)
-
-*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
-
-## Download
-
-- **Windows:** the [installer][windows-msi].
-- **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
-- **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
+- **Windows:** download and run the [installer][windows-msi].
+  Also for [ARM64][windows-arm64-msi] and [32-bit][windows-x86-msi] PCs, or as a
+  [portable zip][windows-portable] that runs without installing.
+  With [WinGet](https://learn.microsoft.com/windows/package-manager/winget/):
+  `winget install bherbruck.SolidCraft`.
+- **macOS:** open the [disk image][macos-dmg] and drag SolidCraft into Applications
+  (Apple silicon and Intel).
+- **Linux:** download the [AppImage][linux-appimage], allow it to run as a program and open it.
+  Or install the [.deb][linux-deb] (Ubuntu, Debian, Mint) or [.rpm][linux-rpm] (Fedora,
+  openSUSE), or use [Flatpak](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
+  With Snap: `sudo snap install solidcraft` ([Snap Store][snap-store], or the [.snap file][linux-snap]).
+  For ARM64: [AppImage][linux-arm64-appimage], [.deb][linux-arm64-deb], [.rpm][linux-arm64-rpm].
 - **Web:** [try it in your browser][web-app], no install.
 
-ARM64 and 32-bit builds, portable zip, .deb, .rpm, Flatpak and the other packages are on the
-[downloads page](docs/downloads.md). The macOS app is signed with a Developer ID and notarized by
-Apple. The Windows downloads aren't signed yet: choose **More info**, then **Run anyway** in
-SmartScreen. On SolidCraft 0.11 to 0.14, download once by hand; see
-[updating](https://docs.solidcraft.io/guide/updates.html#updating-from-011-to-014).
+The downloads aren't signed yet. On Windows, if SmartScreen warns you, choose **More info**, then
+**Run anyway**. On macOS, the first time, right-click SolidCraft in Applications and choose **Open**.
 
-## What works
-
-Early but usable for simple parts: 75 of 76 public reference parts match their analytic or
-FreeCAD-computed volume, area, centre of mass and bounding box ([oracle](docs/oracle.md)); the
-other is a tracked bug.
-
-- **Sketches and constraints:** lines, arcs, splines, text and more, solved by our own constraint solver, with parameter-driven dimensions.
-- **Features:** extrude, revolve, sweep, loft, fillet, chamfer, shell, draft, holes, threads, patterns, mirror, split and combine on an editable parametric timeline.
-- **Parameters and configurations** with unit-aware expressions.
-- **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
-- **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
-- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.sc` designs (`.solidcraft` files from earlier releases still open).
-- **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.
-
-The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
-status and plans are in [ROADMAP.md](ROADMAP.md). See also [what people built](docs/showcase.md),
-[3D mouse support](docs/3d-mouse.md) and the [architecture](docs/architecture.md).
-
-## Build from source
-
-```sh
-cargo run --release -p solidcraft -- --sample      # desktop app with a sample part
-cargo run --release -p solidcraft-cli -- commands  # the command registry
-cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
-cargo xtask ci                                     # fmt, clippy, tests, icons, assets, layers, wasm
-```
-
-More commands, the Windows cross-build and the browser build are in [docs/building.md](docs/building.md).
-
-## AI agents (MCP)
-
-`solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
-runs its own design session, or with `--connect` it drives the running app so you can watch.
-Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. If a terminal doesn't find
-`solidcraft-cli` (older Windows installers don't put it on `PATH`), give its full path (by default
-`"C:\\Program Files\\SolidCraft\\solidcraft-cli.exe"`). Tools, access rules and an example session:
-[docs/mcp.md](docs/mcp.md).
-
-## Scripts
-
-A script is a JSON list of the same commands the UI runs, executed with `solidcraft-cli run`.
-Format and example: [docs/scripts.md](docs/scripts.md). Pages can also be driven through the
-[browser command API](docs/browser-api.md).
-
-## Contributing
-
-Help is welcome. [CONTRIBUTING.md](CONTRIBUTING.md) covers how to build and test, the code map,
-the clean-room and licence rules, and where help is wanted most. Open work is in
-[GitHub issues](https://github.com/tangency-labs/solidcraft/issues); chat is on
-[Discord](https://discord.gg/FtU4NQNVDH).
-
-## Sponsors
-
-[![CI powered by Blacksmith](docs/sponsors/blacksmith-ci-powered.png)](https://www.blacksmith.sh)
-
-SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
-sponsors its CI minutes.
-
-## Disclaimer
-
-The files in this repository are provided as is, without warranty, liability or indemnity, and
-Tangency Labs and the contributors accept no responsibility for any harmful or unlawful use of
-them: read [DISCLAIMER.md](DISCLAIMER.md).
-
-## Licence
-
-MIT OR Apache-2.0, at your option. Developed under the
-[clean-room contribution rules](AGENTS.md); third-party code and assets retain their
-documented licences and attribution.
-
-SolidCraft is independent. Behaviour is designed from public documentation, general CAD
-conventions and user feedback. Reference tests use analytic values and open-source tools.
-SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk, Dassault Systèmes, PTC,
-Siemens or any other CAD vendor. Fusion, AutoCAD, Inventor, SolidWorks, Onshape, Creo, Blender and
-Tinkercad are trademarks of their respective owners, named only to describe compatibility
-(see [NOTICE](NOTICE)).
+Older versions, checksums and other formats are on the [releases page](https://github.com/bherbruck/solidcraft/releases).
+Install details, upgrading from earlier builds and building from source are in
+[Getting started](https://bherbruck.github.io/solidcraft/guide/getting-started.html).
 
 [badge-windows]: https://img.shields.io/badge/Windows-Download-0078D6?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGUiPjxwYXRoIGQ9Ik0yIDJoOS41djkuNUgyek0xMi41IDJIMjJ2OS41aC05LjV6TTIgMTIuNWg5LjVWMjJIMnpNMTIuNSAxMi41SDIyVjIyaC05LjV6Ii8%2BPC9zdmc%2B
 [badge-macos]: https://img.shields.io/badge/macOS-Download-333333?style=for-the-badge&logo=apple&logoColor=white
 [badge-linux]: https://img.shields.io/badge/Linux-AppImage-E95420?style=for-the-badge&logo=linux&logoColor=white
 [badge-snap]: https://img.shields.io/badge/Snap-Snap_Store-82BEA0?style=for-the-badge&logo=snapcraft&logoColor=white
 [badge-web]: https://img.shields.io/badge/Web-Try_in_browser-2EA44F?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIyIj48Y2lyY2xlIGN4PSIxMiIgY3k9IjEyIiByPSIxMCIvPjxwYXRoIGQ9Ik0yIDEyaDIwTTEyIDJhMTUgMTUgMCAwIDEgMCAyME0xMiAyYTE1IDE1IDAgMCAwIDAgMjAiLz48L3N2Zz4%3D
-[windows-msi]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-x64.msi
-[macos-dmg]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-macos-universal.dmg
-[linux-appimage]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.AppImage
+[windows-msi]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-windows-x64.msi
+[windows-arm64-msi]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-windows-arm64.msi
+[windows-x86-msi]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-windows-x86.msi
+[windows-portable]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-windows-x64-portable.zip
+[macos-dmg]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-macos-universal.dmg
+[linux-appimage]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-x86_64.AppImage
+[linux-deb]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-x86_64.deb
+[linux-rpm]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-x86_64.rpm
+[linux-arm64-appimage]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-aarch64.AppImage
+[linux-arm64-deb]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-aarch64.deb
+[linux-arm64-rpm]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-aarch64.rpm
+[linux-snap]: https://github.com/bherbruck/solidcraft/releases/latest/download/solidcraft-linux-x86_64.snap
 [snap-store]: https://snapcraft.io/solidcraft
-[web-app]: https://solidcraft.io/app
+[web-app]: https://bherbruck.github.io/solidcraft/app/
 
+**Documentation:** the [SolidCraft book](https://bherbruck.github.io/solidcraft/) (user guide,
+developer guide and command reference; sources in [docs/book](docs/book)).
+
+**Status: early but usable for simple parts.** 75 of 76 public reference parts
+match their analytic or FreeCAD-computed volume, area, centre of mass and bounding box
+([docs/oracle.md](docs/oracle.md)); the other is a tracked bug.
+These checks do not establish complete geometric or workflow equivalence. The commands SolidCraft has
+are listed by area in [docs/features.md](docs/features.md); status and plans are in [ROADMAP.md](ROADMAP.md).
+Open work and known bugs are in [GitHub issues](https://github.com/bherbruck/solidcraft/issues),
+and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Built with SolidCraft
+
+<a href="https://github.com/0xlillith/solidcraft-rover"><img src="docs/screenshots/rover-build.gif" alt="SELENE, a scientific rover by 0xlillith, assembling itself as the timeline plays through its 3,323 steps in SolidCraft: tub, wheels, electronics, suspension, sampling arm, solar wings, dish and camera turret" loading="lazy"></a>
+
+*SELENE, a scientific rover built entirely through SolidCraft's MCP server by
+[@0xlillith](https://github.com/0xlillith/solidcraft-rover): 3,323 editable timeline steps that
+rebuild with no errors, replayed here at 2× speed.
+[Full video](https://github.com/bherbruck/solidcraft/raw/refs/heads/main/docs/screenshots/rover-build.mp4)
+· [download the editable model](https://github.com/0xlillith/solidcraft-rover/releases/tag/v1.0.0).*
+
+## What works
+
+- **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
+  arcs, polygons, slots, ellipses, fit/control splines, conics and text; construction geometry,
+  projection, trimming, fillets and chamfers, including corners at the origin.
+  New face attachments retain supported construction identities and chosen occurrences;
+  missing sources expose an explicit plane repair workflow. See [face attachments](docs/face-attachments.md).
+  Explicitly closed fit splines and closed associative offsets use periodic C2 interpolation.
+  Supported convex line-and-arc offsets retain their identity when an inset consumes corner
+  arcs, and linked extrusions follow the current boundary. Breaking the association freezes
+  the boundary and keeps existing extrusions usable.
+  Curve drawing and picking adapt together to zoom and display scale, including small circles
+  at Fit and sketches in placed components.
+- **Constraints and dimensions** solved by our own solver. Points the constraints fix relative
+  to known geometry are placed exactly by construction (loci intersections and rigid-cluster
+  decomposition, after Owen 1991 and Fudos–Hoffmann 1997); Levenberg–Marquardt solves the rest,
+  and the rank of its Jacobian gives the remaining degrees of freedom. Constraints: coincident,
+  point on curve, horizontal/vertical, parallel, perpendicular, tangent, curvature (G2), equal,
+  concentric, collinear, midpoint, symmetry, fix; linear, aligned, horizontal, vertical,
+  point-to-line, radius, diameter, angle, arc sweep, arc length and slot length dimensions driven
+  by parameters. Over-constraining edits are rejected; fully constrained geometry turns black.
+  Dragging solves the sketch every frame and rebuilds the model once, when the drag ends.
+  Select a line or its two endpoints, type its dimension and press Enter to commit one undo
+  step; with Sketch Dimension it's D, click, type, Enter. Fit keeps sketch geometry clear of the palette and navigation controls.
+- **Profiles** found automatically, including regions split by lines and holes inside outlines.
+  Newly captured complete adaptive boundaries retain their outer and hole source identities
+  when spline span counts change. Partial or ambiguous boundaries do not qualify.
+- **Features** on a parametric timeline: extrude, revolve, sweep, loft, fillet/chamfer,
+  shell, draft, holes, threads, patterns, mirror, split, combine, move and construction geometry.
+  The timeline rebuilds incrementally; features can be edited, suppressed, renamed, reordered
+  and deleted. Supported geometry and current limitations are described in [ROADMAP.md](ROADMAP.md).
+  New revolves preserve symmetric and two-sided angular placement across reversed axes;
+  older designs retain their saved convention when reopened or edited.
+- **Parameters and configurations** with unit-aware expressions (`2 * width + 5 mm`,
+  `angle / 2`), ordered rules, feature suppression and per-row body materials/appearances.
+- **Assemblies** with nested components and occurrences, joints, motion studies, contact sets,
+  interference and material-aware mass properties. Recorded body transfers preserve modelling
+  history and world placement; 3D sketch wires retain their coordinate frames through edits.
+- **Sheet metal** with flanges, hems, fold/unfold/refold, material cutouts, flat patterns,
+  retained shallow prismatic pockets, exact line/arc/circle DXF outlines and bend tables;
+  plastic enclosure features and rules. Pocket depth and side survive unfold/refold and appear
+  separately from through-hole outlines in the flat preview and DXF.
+- **Files**: design containers (`.solidcraft`) with lossless binary mesh payloads;
+  plain JSON remains supported for opening, Save As and export. Desktop Open can show a saved
+  provisional picture from warm geometry caches while rebuilding before editing; caches never
+  replace the parametric design. Export to STEP (AP242 with body names, colours and
+  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
+  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ, and
+  assemblies with joints as URDF for robot simulators (docs/urdf.md);
+  3MF, STL and OBJ import as mesh bodies (they render, measure, move and export; solid features
+  need B-rep bodies). The `mesh.convert` command reconstructs supported closed constant-section parts
+  as parametric solids with planar and circular cylindrical faces;
+  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
+  (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
+  that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
+  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)).
+- **Render:** opaque surfaces can use metal fraction, roughness and dielectric IOR in the
+  integrated product viewport and CPU preview PNGs. Existing simple colors remain supported.
+  Fixed direct lighting is a preview; HDRI, refraction and texture maps are not implemented.
+  See [opaque surfaces](docs/render-opaque-pbr.md).
+- **Display meshes** from our own tessellation planner: each face becomes a plan of (u, v)
+  points and triangles that shares its edge nodes with its neighbours, so the mesh is watertight.
+  Facets follow the chord tolerance, the facet angle and a longest side, with cells at most 2:1
+  along straight directions. Box-bounded and four-cornered faces mesh as structured grids.
+  Trimmed faces are cut into four-sided patches: squares around holes, butterflies in round
+  faces, motorcycle traces from concave corners (after Lyon et al. 2019). Each patch then meshes
+  as a Coons grid. Intersection edges are evaluated by Newton on both surfaces. A compute shader
+  evaluates the plans for the whole scene in one dispatch, with a CPU fallback when the GPU
+  can't build it. Planning and evaluating the 78 reference bodies takes about 65 ms, 50–65×
+  faster than the previous mesher.
+- **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
+  axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
+  control channel so agents and tests can drive it.
+  Feature errors and Help can open an editable **Create Issue** draft with relevant context
+  and an optional reviewed screenshot; opening GitHub does not submit the report.
+- **Headless CLI** `solidcraft-cli`: run command scripts, measure (volume, area, centre of mass,
+  face/edge/vertex counts), export, render PNG snapshots and replay reference recipes.
+- **MCP server** `solidcraft-cli mcp`: AI agents model, measure and look at parts headless or
+  in the running app (see below).
+
+## Build and run
+
+```sh
+cargo run --release -p solidcraft -- --sample          # desktop app with a sample part
+cargo run --release -p solidcraft-cli -- commands      # the command registry
+cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
+cargo run --release -p solidcraft-cli -- snapshot examples/bracket.json --out bracket.png
+cargo run --release -p solidcraft-cli -- render examples/render-studio.json --out product.png
+cargo run --release -p solidcraft -- part.step          # open a STEP file as a new design
+cargo run --release -p solidcraft-cli -- eval part.step # measure an imported STEP file
+cargo xtask ci                                          # fmt, clippy, tests, assets, layers, wasm
+```
+
+Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
+
+On Windows and Linux, SolidCraft detects a connected 3Dconnexion SpaceNavigator or SpaceMouse through its
+multi-axis HID interface. Move the cap to pan and zoom, and tilt or twist it to rotate the 3D view.
+While editing a sketch, the cap pans and zooms without changing the sketch view. The Navigation
+page in Preferences has an on/off switch and a speed control for the 3D mouse.
+
+On Linux SolidCraft reads `/dev/hidrawN` directly, so the logged-in user needs access to the
+device. A udev rule that adds the `uaccess` tag does that, for example
+`/etc/udev/rules.d/70-3d-mouse.rules` for devices with 3Dconnexion's vendor id:
+
+```
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="256f", TAG+="uaccess"
+```
+
+Older SpaceNavigators use Logitech's vendor id `046d`; add a rule with their product id (see `lsusb`)
+instead of matching every Logitech device. Reload with `sudo udevadm control --reload && sudo udevadm trigger`, then replug the device. The Flatpak
+sandbox does not expose hidraw devices, so the 3D mouse only works with native builds there for now.
+Devices that send all six axes in HID report 1 (some homemade ones do) are recognised from their
+report descriptor, so they work as well.
+
+In the browser: `cd apps/solidcraft-web && trunk build --release --public-url ./` (WebGPU, or
+WebGL2 with `?webgl`; `?sample` opens the sample part).
+
+## Scripts
+
+A script is a JSON list of commands, the same ones the UI runs:
+
+```json
+{"commands": [
+  {"command": "sketch.create", "params": {"plane": "XY"}},
+  {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [40, 30]}},
+  {"command": "solid.extrude", "params": {"distance": 20}},
+  {"command": "solid.fillet", "params": {"edges": [[0, 0, 10]], "radius": 3}}
+]}
+```
+
+## AI agents (MCP)
+
+`solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server on
+stdio. Headless it runs its own design session; with `--connect 127.0.0.1:PORT` it drives the app
+started with `solidcraft --control PORT`, so you can watch the agent model. Tools:
+`list_commands`, `execute`, `batch`, `inspect_design`, `measure`, `body_topology`,
+`set_parameter`, `screenshot` (returns the image), `export`, `undo`, `redo`, `new_design`, `open`,
+`save`. Tool calls reach files only in the open design's folder (when it lies inside your home
+folder, never home itself or a hidden folder), SolidCraft's recovery folder and folders given with
+`--allow-path DIR`. Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Details, client
+configuration and an example session: [docs/mcp.md](docs/mcp.md).
+
+## Architecture
+
+<!-- ANCHOR: architecture -->
+| Layer | Crates | Role |
+|---|---|---|
+| L0 | `geom` | vectors, planes, profiles, meshes and their measures |
+| L1 | `sketch`, `kernel`, `render` | constraint solver and profiles; the B-rep kernel boundary (truck); view math and CPU rasterizer |
+| L2 | `doc` | parameters, expressions, the feature timeline and its incremental evaluation |
+| L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL import features |
+| L4 | `engine` | the session and the command registry (everything is a command) |
+| L5 | `gpu`, `ui-egui`, `mcp` | compute-shader evaluation of display tessellation plans; the swappable desktop front end; the MCP server (headless or bridged to the app) |
+| apps | `solidcraft`, `solidcraft-cli` | desktop app, headless CLI |
+<!-- ANCHOR_END: architecture -->
+
+## Contributing
+
+Coming from Autodesk Fusion? SolidCraft uses familiar parametric CAD workflows: constrained
+sketches, solid features, an editable timeline, parameters and assemblies. See the
+[roadmap](ROADMAP.md) for supported operations and current limitations.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md): how to build and test, the code map, the clean-room
+and licence rules, and where help is wanted most.
+
+## Licence
+
+MIT OR Apache-2.0, at your option. Developed under the
+[clean-room contribution rules](CLAUDE.md); third-party code and assets retain their
+documented licences and attribution.
+
+SolidCraft is independent. Behaviour is designed from public documentation, general CAD
+conventions and user feedback. Reference tests use analytic values and open-source tools.
+SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk. Autodesk and
+Fusion are trademarks of Autodesk, Inc.

ROADMAP.md

@@ -1,85 +1,5 @@
 # SolidCraft roadmap
 
-The short version, for people who use SolidCraft. The detailed developer status (milestone
-tables, limitations, measurements) is in [docs/roadmap-detail.md](docs/roadmap-detail.md).
-
-## What SolidCraft is
-
-SolidCraft is open-source parametric 3D CAD written in Rust. You sketch, constrain, extrude, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app and in the browser
-([try it](https://solidcraft.io/app)), and it has a command-line tool and an MCP server so that
-scripts and AI agents can drive the same commands you use.
-
-## Works today
-
-- Sketching with a constraint solver, and the usual create and modify tools.
-- Extrude, revolve, loft, sweep, coil, fillet, chamfer, shell, draft, holes, threads,
-  patterns, mirror and split.
-- Parameters with units and expressions, and configurations.
-- Faces and edges keep their names through edits, so references survive changes.
-- Components, assemblies, joints, motion studies and exploded views.
-- Sheet metal with flat patterns and DXF export, and a plastic-enclosure subset.
-- A Render workspace with GPU rendering, studio lighting, materials and image export
-  (first release in 0.22.0).
-- Import and export of STEP, IGES, 3MF, STL, OBJ and DXF, and FreeCAD and Rhino files.
-- Autosave and crash recovery, and the browser build of the same app.
-
-The full list of commands is in [docs/features.md](docs/features.md). Release notes for each
-version are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
-
-## In progress now
-
-Each feature below is a [milestone](https://github.com/tangency-labs/solidcraft/milestones) holding
-the issues for it, so the count shows how far along it is. Counts are as of 2026-10-25, one per
-feature or request. Work merged on a feature branch (`drawings`, `render`) counts as built but
-reaches the app only when that branch merges. They are rough, not a promise.
-
-- **[Rendering & materials](https://github.com/tangency-labs/solidcraft/milestone/17)**: in progress, 9 of 34 pieces done, 3 of them built only on the `render` branch and in the app when it merges. The basic Render workspace is already in releases (0.22.0); the interface rework (#6281) and the material and light libraries are what is left.
-- **[Drawings](https://github.com/tangency-labs/solidcraft/milestone/8)**: in progress, 3 of 21 pieces built (2 in releases, 1 on the `drawings` branch), and 3 more partly built there (sheets and borders, bill-of-materials types, the paper scene). Not in the app yet: it lands when the `drawings` branch merges. Today you can export the current view as a DXF.
-- **[Sheet metal](https://github.com/tangency-labs/solidcraft/milestone/15)**: in progress, 1 of 30 requests done. Flanges, hems, unfold and flat patterns already work; the 30 are extensions, mostly the per-edge flange options (segments, miters, partial flanges, reliefs) and bend allowance.
-- **[Sketching](https://github.com/tangency-labs/solidcraft/milestone/14)**: in progress, 12 of 50 pieces done. Dimension types, selection and snapping options.
-- **[Solid modeling](https://github.com/tangency-labs/solidcraft/milestone/2)**: in progress, 9 of 50 pieces done. Blends, holes, threads and patterns.
-- **[Assemblies & joints](https://github.com/tangency-labs/solidcraft/milestone/3)**: in progress, 4 of 19 pieces done. Joints, motion studies and exploded views already work; placement rules, linked sub-assemblies, fastener stacks and weldment corners are the pieces left.
-- **[Import & export](https://github.com/tangency-labs/solidcraft/milestone/5)**: in progress, 7 of 39 pieces done. FreeCAD, SolidWorks and point-cloud import, and mesh export options.
-- **[AI agents & MCP](https://github.com/tangency-labs/solidcraft/milestone/18)**: in progress, 2 of 8 pieces done. Agent chat and the MCP server.
-- **[Interface, web app & plugins](https://github.com/tangency-labs/solidcraft/milestone/4)**: in progress, 31 of 96 pieces done. Ribbon redesign, navigation, themes, the web app and plugins.
-- **[SMLib kernel migration](https://github.com/tangency-labs/solidcraft/milestone/1)**: in progress, 1 tracking issue open. The kernel is moving from truck to NVIDIA's SMLib (usd-brep, Apache-2.0) on the `kernel-smlib` branch; it is not in releases yet. Tracked in [#4012](https://github.com/tangency-labs/solidcraft/issues/4012).
-
-## Next
-
-- **[Surfacing](https://github.com/tangency-labs/solidcraft/milestone/16)**: next, 6 of 14 pieces done. Patch, trim, blend and match exist; the rest of the surface toolset is planned.
-- **[Manufacturing / CAM](https://github.com/tangency-labs/solidcraft/milestone/9)**: next, 1 pieces tracked, none done. There is no CAM in SolidCraft yet. Send to Slicer and a first toolpath slice are in review; proposals are [#1153](https://github.com/tangency-labs/solidcraft/issues/1153) and [#1621](https://github.com/tangency-labs/solidcraft/issues/1621).
-
-Features are not tied to a release or a date. Work lands in the daily releases as it is finished.
-Anything without a milestone, such as bug fixes, is not a feature and is not listed here.
-
-## How releases work
-
-- Releases ship daily, as numbered versions (v0.22.0, v0.22.1) with nightly pre-releases in
-  between. They are delivered through the in-app updater.
-- SolidCraft tells you when a newer stable release exists and never updates without asking.
-  Where it can replace itself safely (AppImage, Windows installer and portable builds) there is
-  an **Update now** button; downloads are checked against the release's SHA-256 list. See
-  [updates and privacy](docs/book/src/guide/updates.md).
-- Design files carry a format number. A new version opens designs from older versions, but an
-  older version refuses a design saved by a newer one (0.22.0 writes format 35, and 0.21.0 and
-  earlier will not open it). Each release's notes say when the format changed. Keep a copy of
-  an important design before you move to a new version.
-
-## Licence
-
-SolidCraft is licensed MIT OR Apache-2.0, at your option; see [LICENSE-MIT](LICENSE-MIT) and
-[LICENSE-APACHE](LICENSE-APACHE). Versions already released stay available under those licences
-permanently.
-
-## How to follow along
-
-- Feature milestones: <https://github.com/tangency-labs/solidcraft/milestones>
-- Issues: <https://github.com/tangency-labs/solidcraft/issues> (area labels such as
-  `area:kernel`, `area:sketch` and `area:ui` group them)
-- Discord: <https://discord.gg/FtU4NQNVDH>
-- Releases: <https://github.com/tangency-labs/solidcraft/releases>
-- Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
 Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.
 
@@ -87,17 +7,13 @@ features → parametric timeline) as an open, pure-Rust, agent-drivable applicat
 
 | Question | Answer |
 |---|---|
-| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; FreeCAD/Rhino import; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
+| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
 | Features | Every registered command by area — [docs/features.md](docs/features.md) (`cargo xtask features`); registry breadth does not establish workflow or geometric depth |
-| Reference tests | [Current case count and results](docs/oracle.md): public cases in `tests/oracle/` with analytic or FreeCAD-computed expected values, checked by the reference-test job in [CI](.github/workflows/ci.yml). |
+| Reference tests | **82 / 82 parts match** — [docs/oracle.md](docs/oracle.md): public cases in `tests/oracle/` with analytic (61) or FreeCAD-computed (21) expected values, run by CI on every PR. |
 | Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
 | Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
 | Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
 
-Optional GPU viewport ambient occlusion is available in View settings and Graphics preferences,
-with persistent settings, Performance/Quality graphics presets (Quality combines AO, Fine tessellation and adaptive 2× supersampling; manual combinations show Custom), and the
-`view.ambient_occlusion` and `view.graphics_preset` commands. See [display settings](docs/ambient-occlusion.md).
-
 ## Scope (owner decision, 2026-10-07)
 
 The issue batch adds preservation of blind pockets in through cuts, associative projected
@@ -130,70 +46,32 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 | # | Milestone | Status | Hours left |
 |---|---|---|---|
 | M0 | Vertical slice | done | — |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
-| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces, at distances from reference edges, and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), drawing snaps to where two lines, circles or arcs cross (#4967), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
+| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks; tiny rim edges remain selected instead of nearby wall seams when filleting (#2498) | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop, browser and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import, PLY/XYZ point clouds as a modelling reference and PLY meshes (done — [docs/point-clouds.md](docs/point-clouds.md), #5151) | in progress | 6 |
+| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
+| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
 | M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; responsive feature history with width-driven icons/names/title, snapping width resize, bottom/left/browser-stack docking, shared-column collapse, rollback bar, multi-selection and persistent folders), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; Browser Expand All / Collapse All (`browser.expand_all`, `browser.collapse_all`) on the design and component menus; preferences | in progress | 6 |
+| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; optional compact named left feature history with rollback bar, multi-selection and persistent folders above the parts browser), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
 | M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0, plus `crown`), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane, a face or sketch curves swept onto the surface, keeping a side or the picked regions; mutual trim of two surfaces, extended to meet and stitched, #767), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis, Surface Extrude/Revolve/Sweep/Loft from open and closed curves, Offset, Unstitch and Reverse Normal; the continuity-driven core (`kernel/src/bridge.rs`, G0–G3 Hermite rows) with **Blend** (`surface.blend`, #764: edge chains along one or several faces, closed rims paired seam to seam or from picked seams, a dialog), **Match** (`surface.match`), **Boundary** (`surface.boundary`, #763 — two sketch curves exact with G0–G3, three or four as the flat patch of their loop, and curve networks: Coons and Gordon surfaces through sketch, 3D-sketch or edge curves, a point for a three-sided side, G1/G2 against the faces along one direction's edges, joined into their body on request; G1/G2 on two sides that meet at a corner waits for the Gregory-type corner), **Fair** (`surface.fair`, CV fairing), **continuity analysis** (`inspect.continuity`, #770; a toolbar tool with edge markers and a legend, and curvature combs along face isocurves) and a multi-section **loft** with per-end continuity and crown, and guide rails on solid and surface lofts (one or two, scaling or stretching the sections between; #201). Also in the Class-A pass: G1…G4 blend curves in the sketch, chord and variable-radius fillets on curved edges (with honest refusals where the fit cannot hold), and a G2 corner patch where filleted edges meet (kernel; the command refuses until the patch's sections can be sewn to the blends' contacts). Left: bias/form-factor fillet sections (design recorded), a Gregory-type corner, surface Fillet between separate surface bodies (#769), Ruled (#762), Untrim (#761), curved-face Extend (#760), and every remaining #757–#772 item | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), cams (`joint.cam`: a revolute cam drives a slider or revolute follower along a closed sketch profile or the cam's edges, knife, roller or flat followers, worked out again when the profile changes; drives, studies, closed loops, contact sets), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), motion analysis (joint values and a point's path charted over a study as value, velocity and acceleration; the parts that collide along a study, with the steps where they do), Exploded views (automatic or by hand, shown without changing placements, and exported as an animation coming apart and back together); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Cam and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
+| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Patch with G1/G2 and general loops (#759), Blend surface (#764), sweep guide rails and two-rail sweeps (#771; orientation, twist and end scale done; loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
 | M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
 | M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
 | M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
-| M15 | Frames and weldments (#4003): structural members along 2D and 3D sketch lines, butt and mitre corners, trim to faces and bodies, end caps, gussets, cosmetic welds and a cut list. Done: the profile library (`frame.profile.list`, `frame.profile.properties`, `frame.profile.insert`): bar, round bar, rectangular and round tube, angle, channel and I-beam, each SolidCraft's own parametric definition with exact fillet arcs and exact section properties (area, centroid, second moments), tested against hand-computed values; members (`frame.member`): one body per straight line of a 2D or 3D frame sketch, following parameter edits, with a built-in profile (its dimensions parameter expressions) or a profile sketch (its drawn material by alternating nested loops), anchor, angle and mirror; each member's name kept with its line. Left: corners, trims, end caps, gussets, welds, cut list, FRAME tab and dialogs | in progress | 60 |
 
 M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
 pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
 retain their saved two-finger scroll preference; camera motion is available through
 `view.navigate` and modifier-aware `ui.move` automation.
-With the **Fusion** preset and two-finger pan enabled, two fingers pan and Shift + two fingers
-orbit freely, with pinch zoom and mouse bindings unchanged. The shared navigation handler
-applies the same gestures to model and Render views and blocks orbit on flat pages.
-
-UI redesign (#2016): the File/start view (#2027) uses shared light/dark navigation,
-action tiles, recent rows and sample cards, with recovery review and Save As/Export
-entry points. Document loading, sample caches and recovery safety retain their
-existing command paths.
-
-M11 precursor: File → Export Current View as DXF exports shown placed bodies and sketches from the current
-camera as a 2D millimetre drawing, with hidden edges omitted or dashed. Vector occlusion splits
-partly hidden edges and includes curved silhouettes. Repeated part meshes and triangle
-hierarchies are shared; bounded desktop preparation and occlusion use up to eight workers.
-Curves are approximated; drawing sheets,
-annotations and exact projected curves remain deferred. See [view DXF](docs/view-dxf.md).
-
-Drawing foundations: [RFC #860](https://github.com/tangency-labs/solidcraft/issues/860)
-and the [foundation ledger](docs/drawing-foundations.md) track the bounded implementation
-packages. The first geometry increment defines validated section records in a plane-local
-frame; the ledger separates that contract from section producers and the Drawing workspace.
-
-Desktop view DXF export runs in the file-operation worker with five-stage progress and
-cooperative cancellation. Curve tolerance (0.0001–1 mm, default 0.01 mm) is remembered alongside
-the hidden-edge setting. Cancelled exports preserve the model and the previous destination;
-completed drawings publish atomically. The browser still exports synchronously.
 
 ## Interactive modelling
 
-- Modelled threads preview their cut before OK using the background worker on desktop.
-  Browser users apply the cut with OK to avoid blocking on every edit.
-
-- Thread resolves a suggested metric size when a cylindrical face is picked. Diameter and
-  pitch selectors expose the existing metric designation parameter; custom designations stay
-  editable, and Automatic size returns to the face's suggestion. Cosmetic/modelled and
-  full/partial-length options remain available. This does not add tolerance classes or
-  left-hand threads.
 - New Body extrusion and face-offset previews show completed intermediate geometry while a
   drag continues, then catch up to the exact final value. Changes to the selected geometry,
   operation or feature still discard obsolete results. Distance arrows and their value boxes
   follow the current frame's input.
-- Large fine modelled threads use pitch-based helix resolution and tighter faceted
-  reconstruction fallbacks, preserving thin crests and closed shells on large shafts.
 
 ## Physical material data
 
@@ -225,18 +103,6 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## Render foundation
 
-- Wood surface images (#1345): native CPU and GPU opaque rendering share physical
-  repeat frames and filtered mip chains. Imported maps retain exact bytes and
-  declared provenance in the design, reopen offline, and expose grain-angle
-  controls. Scalar face appearances suppress body maps. Planar projection and
-  CPU encoding/optical limits remain explicit; see [portable surfaces](docs/render-portable-surfaces-and-stages.md).
-
-- Original starter appearances (#1722): 34 opaque recipes through existing commands, with six explicitly unavailable glass recipes and preserved legacy looks; see [the contract](docs/render-starter-appearances.md).
-
-- Bounded linear film accumulation (#1696) supplies caller-admitted mean/variance storage and complete-pass views; actual progressive consumers remain separate. See [the film contract](docs/render-film.md).
-
-- Definition-local visual mapping (#1214) supplies a bounded numerical frame, physical repeat coordinates and a deterministic one-time grain-axis suggestion. It adds no saved record or texture consumer; see [the mapping contract](docs/render-visual-mapping.md).
-
 - Explicit texture normalization (#1218) produces completed float RGBA with
   role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
   opt-in EXIF orientation. It retains high-precision raw samples and records lossy
@@ -292,11 +158,6 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## Dimensioning and error reporting
 
-- Operation length fields share design-unit defaults and input evaluation, including secondary
-  distances, thin walls, blend controls, sheet/plastic rules, joints and motion keys. Canvas
-  handles and sketch previews use the same lengths as committed geometry. Existing stored
-  millimetre values retain their size when edited in a design using another unit (#3271).
-
 - MCP `execute` accepts `verbose: false`, sharing the compact reply helper used by
   `batch`: body changes and created sketch IDs stay, while repeated lists are omitted.
   Both tools retain full replies by default.
@@ -337,12 +198,6 @@ completed drawings publish atomically. The browser still exports synchronously.
   Type a value and press Enter to commit one undo step; rejected values remain editable and
   cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
   and navigation controls, including enlarged displays and nested pending placements.
-- Sketch Dimension takes a line and a circle or arc (#1803): it measures from the line to the
-  circle's edge (the gap, 0 when tangent, or how far the edge reaches past a line that cuts
-  it), drives it like any other dimension and keeps the circle on its side of the line.
-- Sketch Dimension takes a point and a circle or arc, or two circles or arcs (#4064): it
-  measures to the circle's edge (from the point, or between the two edges: the gap, 0 when
-  they touch, how far they overlap, or the narrowest gap between nested circles).
 - Sketch annotations, live drawing lengths and Measure use document units. Inches show
   three decimals and retain a meaningful fourth digit. Bare length dimension entry captures
   the current design unit; changing units leaves existing geometry and expressions intact.
@@ -368,13 +223,12 @@ completed drawings publish atomically. The browser still exports synchronously.
   `diagnostics.crash_reports`, the MCP `crash_reports` tool or the CLI. Nothing is sent
   anywhere. See [crash reports](docs/crash-reports.md).
 - Agent chat (off by default, desktop): a side panel that drives a coding agent the user
-  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, Grok Build, …) over the
+  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, …) over the
   Agent Client Protocol, under the user's own login; SolidCraft stores no keys. The agent works
   through SolidCraft's MCP tools on a gated endpoint of its own: file actions wait for Allow or
   Deny, crash reports are off limits, 24 changes per message, one undo step per message, and
   the agent's whole process group ends with the panel or the app. Docks left or right,
-  minimises to a strip. Grok Build discovery includes `~/.grok/bin` and reuses the user's
-  Grok login. See [agent chat](docs/agent-chat.md).
+  minimises to a strip. See [agent chat](docs/agent-chat.md).
 - Command scripts from designs (#886): `timeline.export_script` (CLI `solidcraft-cli script`)
   writes a design's history as a script that `eval` and `run` replay into the same design —
   user parameters, units, sheet metal and plastic rules and materials as their own commands,
@@ -402,25 +256,6 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 ## 0.2.1 critical fixes
 
-- Separated multi-profile Join/Cut extrusions into one solid target batch their tools using
-  conservative construction bounds, avoiding a Boolean rebuild for every profile. Live
-  extrusion previews build only their tools; confirmation validates the final Boolean.
-- Coplanar selected body faces share one linked sketch and one extrusion. Automatic Join/Cut
-  keeps the evaluator's participant scope, including parts of an empty imported component. Desktop OK/Enter
-  computes on a scratch session in the background, with atomic acceptance and cancellation.
-  Planar section stitching projects lines/arcs analytically and removes duplicate endpoints.
-- Imported rotated face groups can check all full start-face seams in one guarded
-  construction. Separated tools may batch a Join when each meets the same single body;
-  nearby uninvolved bodies retain the original contact decisions. Regression comparisons
-  cover all four extrusion operations.
-- Inward multi-face cuts retain every eligible target and subtract separated tools together.
-  Safe interior classification handles roundoff at shared imported line/arc endpoints.
-  Straight extrusion feedback caches existing face/profile triangles and updates the display
-  directly, including a newly opened STEP's single identity component placement; other
-  extents, moved or repeated components and curved sketch profiles keep the Engine preview.
-- The extrusion fixes retain tracked Boolean history and the current `solidcraft` packages.
-  Confirmation and tool previews use main's shared background calculation. Main's collapsed
-  blend-wall refusal and its tests are retained, including smaller valid radii and mirrored parts.
 - Axis view and navigation controls stay anchored to the viewport when feature dialogs or
   the command palette open, at normal and enlarged display scales. Fit still accounts for
   dialog coverage; covered controls do not receive clicks through dialogs.
@@ -440,25 +275,8 @@ completed drawings publish atomically. The browser still exports synchronously.
 - Saved projections from a removed strip retain their geometry and report the lost
   reference. Explicitly reselect the wall to repair that projection.
 
-## Workspace layouts (#2029)
-
-- General preferences save Floating or Compact using the universal UI containers.
-  Compact joins the workspace selector and ribbon, docks the content-hugging Browser
-  flush beneath them with a square join, and opens tool sheets below the compass.
-  Sheets remain draggable, rounding all corners away from their right dock; footer
-  backgrounds follow the same corners. A separate preference hides ribbon icon labels
-  for a shorter ribbon in either layout.
-  Assistant keeps the outermost edge and History keeps its chosen dock. Switching
-  retains the active tool, camera, selection and design; system windows and menus
-  keep their existing behavior.
-
 ## View navigation
 
-- Navigation has an opt-in Free orbit preference for mouse and 3D-mouse rotation through
-  both poles with roll. It defaults off, preserving existing preset snapping and pole limits.
-  The SolidWorks face menu offers Normal to Selection (`view.normal_to`), shared with Look At
-  and Ctrl+8, including repeat-to-flip, preserving scale and projection.
-
 - Desktop Ctrl/Cmd +/- and 0 change or reset the saved UI scale. The scale slider keeps
   its layout stable during a drag and applies the selected scale on release.
 
@@ -478,17 +296,12 @@ completed drawings publish atomically. The browser still exports synchronously.
 
 - Associative shell-face sketches require a unique certified planar source. Nested shell
   attachments and ambiguous coincident sources remain unsupported.
-- G2 fillets: exact quintic blends of straight edges between planar faces, with one planar
-  end face at each end, including sloped ends (#2708). The UI and `solid.fillet` expose
-  `curvature` (alias `g2`); the size is an equivalent circular setback. Curved faces/edges,
-  multi-face ends and corner junctions remain unsupported.
+- G2 fillets: exact quintic blends of straight edges between planar faces, with one perpendicular
+  planar end face at each end. The UI and `solid.fillet` expose `curvature` (alias `g2`); the size
+  is an equivalent circular setback. Curved faces/edges, sloped ends and corner junctions remain unsupported.
 - Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
   rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
-  meet (a sphere for equal radii); perpendicular corner fillets after a closed ring of earlier
-  rounds preserve the ring's radii and the enclosed planar face (#1557);
-  mitres between separate rounds of the same radius keep their endpoint tangent, so a later
-  fillet can select an upright and its adjoining bottom mitre as one chain (#2422);
-  straight edges (convex or concave) between planar faces with perpendicular
+  meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
   planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
   basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
   corners around pocket rims, with unequal wall slopes and extensions confined to the face;
@@ -497,9 +310,7 @@ completed drawings publish atomically. The browser still exports synchronously.
   bevel faces, splitting their shared seam; picks on the same tangent chain are applied once (#1303);
   whole smooth loops of a planar face, picked whole or by one edge (tangent
   chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
-  plate outlines), loops with sharp corners between straight or mixed arc/line edges (straight
-  blends meet in mitres; perpendicular curved walls use offset intersections, with D-rim removal
-  checked within 0.1% of analytic offset slices), runs of
+  plate outlines), loops with sharp corners between straight edges (the blends meet in mitres), runs of
   neighbouring edges along a planar face's loop (two top edges of a box: mitred, ending square;
   with the edge between them too, the corner becomes a sphere octant),
   rounded corners rounded again (sphere octants, tori at concave corners); every edge of a
@@ -552,9 +363,6 @@ completed drawings publish atomically. The browser still exports synchronously.
   A sweep with a twist, an end scale or a parallel or direction orientation (#771) follows its
   path that way too, even along sketch lines and arcs: B-spline walls through stations, ruled
   walls through denser stations where the path has corners or the profile has holes.
-  Guide rails (one or two, #771) do the same: each station meets every rail once, and the rail
-  turns the profile and scales it (or stretches it across to the rail) against the start; two
-  rails carry it between them. Rails along a path with sharp corners are refused for now.
 - Extend intersects exact ellipses and rational/high-degree splines without moving the line or
   circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
   certificate and refine within bounded node limits while retaining existing IDs.
@@ -596,13 +404,10 @@ completed drawings publish atomically. The browser still exports synchronously.
   and author occurrence paths retain the chosen placements; missing/split faces refuse rather
   than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
   remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
-- Shell and offset faces work on bodies of planes, cylinders, cones, spheres and tori (convex or not:
+- Shell and offset faces work on bodies of planes, cylinders, cones and spheres (convex or not:
   filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
   floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
-  sections ruled. Circular-meridian barrels retain curved inner walls through either axial
-  opening (#2421). Solid lofts preserve holes through sections with matching hole counts
-  (#2435), including inner walls and caps with openings; a hole cannot appear or disappear
-  between sections, and sections with holes cannot collapse to a point.
+  sections ruled.
 
 - Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
   its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
@@ -668,9 +473,7 @@ completed drawings publish atomically. The browser still exports synchronously.
   pieces survive unfold/refold as one logical sheet group, including split flanged sheets.
   Cut-outs made in the flat pattern cross bends at any angle or curved: their edges fold to
   helices and curves on the bend, their walls square to the sheet. Free-form bases use bounded
-  sampling. A fold crosses the sheet's own outer edges the same way, slanted or on any curve,
-  with the outline exact in the flat pattern and its DXF, and flanges and other folds still go
-  on the panels.
+  sampling.
   Parallel prismatic partial-depth cuts retain pocket side and depth through transfer and
   unfold/refold, with separate pocket contours in preview and DXF. Planar Intersect preserves
   exact holes and retained islands, including the union of multiple selected profiles, and
@@ -691,10 +494,6 @@ completed drawings publish atomically. The browser still exports synchronously.
   continuous collision detection; local thin walls and small details remain limitations.
   See [contact-set limits and recovery](docs/contact-sets.md).
 
-## Assembly dragging
-
-The design's first part is grounded when it is made, and a left-button drag repositions a free part (`occurrence.drag`: one undo step, exact occurrence paths including repeated jointed definitions, any floating-chain member carries the chain, grounded parts and joints hold where present, Escape cancels).
-
 ## 3D sketch bridges
 
 3D sketch drawing snaps to points on other visible sketch planes without flattening them onto
@@ -731,7 +530,7 @@ and reference-object placement remain separate work, as do loft rails and center
   a seekable reader defers original blobs until after provisional display.
   See [container format](docs/design-container.md) and [performance measurements](docs/perf.md).
 - Warm saves with explicit `cache: true` can include a versioned native B-rep cache through SolidCraft-owned topology
-  and geometry records, with a separate kernel adapter and bounded binary reader. Exact
+  and geometry records, with a separate truck adapter and bounded binary reader. Exact
   face-source certificates and operation history survive codec round trips. A provisional
   picture can be generated before original blobs are read; editing and measurement wait
   for authoritative reconstruction. Cached metadata binds preview and reconstruction to
@@ -780,6 +579,5 @@ and reference-object placement remain separate work, as do loft rails and center
   reported case returns from 86 to 49 faces with unchanged material and bounds; regressions
   cover stepped stock, STEP round trips and saved projections from removed pieces.
 
-solidcore (Apache-2.0), the Rust port of NVIDIA's SMLib, vendored in `solidcore` behind
-our own `kernel` crate, with our own boundary and boolean retry/validation; see
-`plan/adr/0001-geometry-kernel.md` (local) — summary in README.
+truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
+retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.

SECURITY.md

@@ -3,7 +3,7 @@
 ## Supported versions
 
 SolidCraft is young and moves quickly, so only the latest release gets security fixes. Please
-update to the [latest release](https://github.com/tangency-labs/solidcraft/releases/latest) before
+update to the [latest release](https://github.com/bherbruck/solidcraft/releases/latest) before
 reporting, and check whether the problem is still on `main`.
 
 | Version | Supported |
@@ -15,46 +15,18 @@ reporting, and check whether the problem is still on `main`.
 ## Reporting a vulnerability
 
 Please **don't open a public issue** for a security problem. Report it privately through GitHub:
-open the repository's [Security tab](https://github.com/tangency-labs/solidcraft/security) and choose
+open the repository's [Security tab](https://github.com/bherbruck/solidcraft/security) and choose
 **Report a vulnerability**
-([direct link](https://github.com/tangency-labs/solidcraft/security/advisories/new)).
+([direct link](https://github.com/bherbruck/solidcraft/security/advisories/new)).
 
-Please include what you found, the steps you ran to reproduce it (a design file, command or MCP
-request), the version and platform, and what an attacker gains. I'll acknowledge the report as soon
-as I can, keep you updated in the advisory, and credit you when the fix is published unless you'd
-rather stay anonymous.
+Please include what you found, how to reproduce it (a design file, command or MCP request), the
+version and platform, and the impact you expect. I'll acknowledge the report as soon as I can,
+keep you updated in the advisory, and credit you when the fix is published unless you'd rather
+stay anonymous.
 
-## What counts as a security issue
+Areas where reports are especially useful:
 
-Advisories are for problems where someone gets something they shouldn't, without already having
-access to your computer or your account. For example:
-
-- opening a design, STEP, STL or 3MF file from someone else runs code, or reads or overwrites files
-  it shouldn't
-- a website or another computer can reach or control SolidCraft
-- an agent gets past a prompt that promised to ask you first
-- the web app reaches beyond the page's own storage
-- a release package or an update can be tampered with
-- an API key or token gets sent somewhere it shouldn't go
-
-## What to report as a normal bug
-
-Please [open an issue](https://github.com/tangency-labs/solidcraft/issues/new) for these. They're
-still worth fixing, but they aren't security issues:
-
-- anything that needs a program already running on your computer, or the control token. A program
-  running as you can already do what you can.
-- MCP's allowed folders. They guard against accidents, they aren't a security boundary, and an agent
-  with a shell of its own can already reach those files. Getting around them isn't a vulnerability.
-- crashes, hangs, or heavy memory or CPU use, unless they also lead to something in the list above
-- anything that only happens in an unusual setup you'd have to choose on purpose
-
-## Before you send it
-
-- **Run it.** Reproduce the problem on the latest release. If you only read the code, say so, and
-  expect it to wait.
-- **Check it yourself.** If a scanner or an AI agent found it, read the code and confirm it first.
-  These tools tend to overrate what they find.
-- **Say what's gained.** Name what the attacker needs and what they get. I set the final severity.
-
-Reports that don't fit will be closed with a short note, or moved to the issue tracker.
+- opening untrusted design, STEP, STL or 3MF files (crashes, excessive memory or CPU, path tricks)
+- the MCP server and the control API (file access outside the allowed folders, command injection)
+- the web app (anything reaching beyond the page's own storage)
+- release packages and the update paths (AppImage, Flatpak, MSI, deb, rpm, snap)

apps/solidcraft-cli/Cargo.toml

@@ -19,24 +19,7 @@ path = "src/main.rs"
 name = "solvecraft-cli"
 path = "src/alias.rs"
 
-[features]
-default = ["raytrace-cpu", "profile"]
-bundled-render-library = ["solidcraft-engine/bundled-render-library"]
-raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
-# The profiler, compiled in so any build can say where its time goes (`--profile`,
-# SOLIDCRAFT_PROFILE=1); it records nothing until asked.
-profile = ["solidcraft-engine/profile"]
-
 [dependencies]
-solidcore-record = { workspace = true }
 solidcraft-engine = { workspace = true }
-solidcraft-gpu = { workspace = true }
 solidcraft-mcp = { workspace = true }
-log = { workspace = true }
 serde_json = { workspace = true }
-
-[dev-dependencies]
-# Snapshot tests decode the pictures to compare them with a tolerance.
-image = { workspace = true }
-# Tests measure meshes at their own tolerances.
-solidcraft-kernel = { workspace = true }

apps/solidcraft-cli/examples/studio_evidence.rs

@@ -1,151 +0,0 @@
-//! Reproducible evidence through the production command/job interfaces.
-//! Usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png
-//! Writes the editable design, command timings and actual adapter/job metadata beside PNG.
-//! Accepts runtime requests as well as inline or named saved render jobs.
-use serde_json::{Value, json};
-use solidcraft_engine::{
-    Session,
-    doc::render_settings::{RenderJob, RenderSetup},
-    render::job::{CpuHost, ErrorCode, JobId, Phase},
-};
-use std::{
-    io::Read,
-    path::Path,
-    time::{Duration, Instant},
-};
-
-fn read_json(path: &str) -> Result<Value, String> {
-    let mut bytes = Vec::new();
-    std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?.take(16_777_217).read_to_end(&mut bytes).map_err(|e| e.to_string())?;
-    if bytes.len() > 16_777_216 {
-        return Err("evidence input exceeds 16 MiB".into());
-    }
-    serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))
-}
-
-// Only decide which optional host must be installed. The production command
-// still validates and resolves the actual request without a second wire format.
-fn needs_gpu(session: &Session, params: &Value) -> Result<bool, String> {
-    let inline = params.get("settings").filter(|value| !value.is_null());
-    let named = params.get("setup").filter(|value| !value.is_null());
-    if inline.is_some() && named.is_some() {
-        return Err("choose either setup or settings".into());
-    }
-    let inline_setup = inline
-        .filter(|value| value.get("job").is_some_and(|job| !job.is_null()))
-        .map(|value| serde_json::from_value::<RenderSetup>(value.clone()).map_err(|e| e.to_string()))
-        .transpose()?;
-    let setup = if let Some(name) = named.and_then(Value::as_str) {
-        Some(session.doc.render.setups.get(name).ok_or("no saved render setup with that name")?)
-    } else {
-        inline_setup.as_ref()
-    };
-    if let Some(setup) = setup
-        && let Some(job) = &setup.job
-    {
-        if params.as_object().is_some_and(|object| object.keys().any(|key| !matches!(key.as_str(), "setup" | "settings" | "replace"))) {
-            return Err("saved render jobs cannot be mixed with runtime controls".into());
-        }
-        setup.validate().map_err(|e| e.to_string())?;
-        return Ok(matches!(job, RenderJob::GpuPath { .. }));
-    }
-    Ok(params.get("progressive").and_then(Value::as_bool) == Some(true))
-}
-
-fn run() -> Result<(), String> {
-    let args: Vec<String> = std::env::args().skip(1).collect();
-    let [recipe_path, params_path, output_path] = args.as_slice() else {
-        return Err("usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png".into());
-    };
-    let output = Path::new(output_path);
-    if !output.extension().is_some_and(|e| e.eq_ignore_ascii_case("png")) {
-        return Err("output must have a .png extension".into());
-    }
-    let recipe = read_json(recipe_path)?;
-    let params = read_json(params_path)?;
-    let mut session = Session::default();
-    eprintln!("Generating original CAD scene from {recipe_path}");
-    let generation_start = Instant::now();
-    let (commands, command_timings) = session.run_script_timed(&recipe, false, &mut |_, _| {}).map_err(|e| e.to_string())?;
-    let generation_seconds = generation_start.elapsed().as_secs_f64();
-    let design_path = output.with_extension(solidcraft_engine::io::DESIGN_EXT);
-    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
-    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
-    let bodies: Vec<Value> = scene
-        .meshes
-        .iter()
-        .map(|mesh| json!({"name":mesh.name,"vertices":mesh.mesh.positions.len(),"triangles":mesh.mesh.triangles.len()}))
-        .collect();
-    drop(scene);
-
-    let cpu_host_start = Instant::now();
-    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
-    let cpu_host_seconds = cpu_host_start.elapsed().as_secs_f64();
-    // Match runtime and saved-job dispatch. CPU evidence must not require a
-    // Vulkan device, parse GPU policy or initialize a GPU host.
-    let (adapter_report, gpu_host_seconds) = if needs_gpu(&session, &params)? {
-        let gpu_host_start = Instant::now();
-        let policy = solidcraft_gpu::select::Policy::from_env().map_err(|e| e.to_string())?;
-        let (adapter, report) =
-            solidcraft_gpu::select::pick_path(policy, |_| true).ok_or("no Vulkan or Metal adapter satisfies the requested GPU policy")?;
-        session.register_render_job_host(solidcraft_gpu::path::host_on_adapter(&adapter).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
-        (Some(report), Some(gpu_host_start.elapsed().as_secs_f64()))
-    } else {
-        (None, None)
-    };
-    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
-    let start = Instant::now();
-    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
-    let executor = started
-        .get("resolved")
-        .and_then(|resolved| resolved.get("executor"))
-        .and_then(Value::as_str)
-        .ok_or("started job did not report the resolved image executor")?
-        .to_owned();
-    let id: JobId = serde_json::from_value(started.get("job").cloned().ok_or("missing job id")?).map_err(|e| e.to_string())?;
-    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
-    eprintln!("Rendering through production {executor} executor");
-    if let Some(adapter) = &adapter_report {
-        eprintln!("GPU adapter: {adapter:?}");
-    }
-    let status = loop {
-        match handle.wait_timeout(Duration::from_secs(10)) {
-            Ok(status) => break status,
-            Err(error) if error.code == ErrorCode::TimedOut && start.elapsed() < Duration::from_secs(3600) => {
-                let status = handle.status().map_err(|e| e.to_string())?;
-                eprintln!(
-                    "Render progress: {:?} {}/{} after {:.1}s",
-                    status.progress.phase,
-                    status.progress.done,
-                    status.progress.total,
-                    start.elapsed().as_secs_f64()
-                );
-            }
-            Err(error) => {
-                let _ = handle.cancel();
-                return Err(error.to_string());
-            }
-        }
-    };
-    let render_and_encode_seconds = start.elapsed().as_secs_f64();
-    if status.progress.phase != Phase::Completed {
-        return Err(status.error.map_or_else(|| "render did not complete".into(), |e| e.to_string()));
-    }
-    let exported = session.execute("render.export", &json!({"job":id,"path":output_path,"overwrite":true})).map_err(|e| e.to_string())?;
-    let report = json!({
-        "recipe":recipe_path,"render_params":params,"executor":executor,"adapter":adapter_report,
-        "environment":{"SOLIDCRAFT_GPU":std::env::var("SOLIDCRAFT_GPU").ok(),"WGPU_BACKEND":std::env::var("WGPU_BACKEND").ok()},
-        "cad_generation_seconds":generation_seconds,"cpu_host_setup_seconds":cpu_host_seconds,"gpu_host_setup_seconds":gpu_host_seconds,
-        "render_and_encode_seconds":render_and_encode_seconds,
-        "timing_scope":"wall time from render.start through completed PNG encoding; includes job preparation and readback, excludes CAD generation, preflight and initial CPU/GPU host setup; GPU setup timing includes adapter selection and pipelines when requested",
-        "bodies":bodies,"commands":commands,"command_timings":command_timings,
-        "preflight":preflight,"export":exported,"editable_design":design_path
-    });
-    std::fs::write(output.with_extension("json"), serde_json::to_vec_pretty(&report).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
-    println!("{}", serde_json::to_string_pretty(&report).map_err(|e| e.to_string())?);
-    Ok(())
-}
-
-fn main() -> Result<(), String> {
-    run()
-}

apps/solidcraft-cli/src/alias.rs

@@ -11,7 +11,7 @@ use std::process::{Command, ExitCode};
 const TARGET: &str = "solidcraft-cli";
 
 fn main() -> ExitCode {
-    solidcraft_engine::note!("solvecraft-cli is deprecated and will be removed in a later release: use solidcraft-cli");
+    eprintln!("solvecraft-cli is deprecated and will be removed in a later release: use solidcraft-cli");
     let sibling = std::env::current_exe()
         .ok()
         .and_then(|exe| exe.parent().map(|dir| dir.join(format!("{TARGET}{}", std::env::consts::EXE_SUFFIX))))
@@ -23,7 +23,7 @@ fn main() -> ExitCode {
             None => ExitCode::FAILURE,
         },
         Err(e) => {
-            solidcraft_engine::note!("solvecraft-cli: could not run {}: {e}", program.to_string_lossy());
+            eprintln!("solvecraft-cli: could not run {}: {e}", program.to_string_lossy());
             ExitCode::FAILURE
         }
     }

apps/solidcraft-cli/src/bench_agent.rs

@@ -8,7 +8,7 @@
 //! no fixture.
 //!
 //! ```text
-//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.sc]
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
 //! ```
 //! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
 //! build total, then the phases `bench-open` prints for the saved design.
@@ -36,9 +36,8 @@ impl Script {
         );
     }
 
-    /// A part placed after it is built: free, even as the design's first part (#2804).
     fn component(&mut self, name: &str) {
-        self.c("component.create", json!({"name": name, "grounded": false}));
+        self.c("component.create", json!({"name": name}));
     }
 
     fn root(&mut self) {
@@ -184,7 +183,7 @@ pub fn run(args: &[String]) -> Result<(), String> {
         s.execute(id, &c["params"]).map_err(|e| format!("command {i} ({id}): {e}"))?;
         run.push(t.elapsed().as_secs_f64() * 1000.0);
         let t = std::time::Instant::now();
-        s.world_state().map_err(|e| e.to_string())?.warm_meshes(|| true);
+        s.world_state().warm_meshes(|| true);
         shown.push(t.elapsed().as_secs_f64() * 1000.0);
         if run.len() == 100 || i + 1 == commands.len() {
             let mean = |v: &[f64]| v.iter().sum::<f64>() / v.len().max(1) as f64;
@@ -198,17 +197,14 @@ pub fn run(args: &[String]) -> Result<(), String> {
             shown.clear();
         }
     }
-    let world = s.world_state().map_err(|e| e.to_string())?;
+    let world = s.world_state();
     println!(
         "{}",
         json!({"step": "built", "ms": began.elapsed().as_secs_f64() * 1000.0, "commands": commands.len(), "features": s.doc.features.len(), "bodies": world.bodies.len()})
     );
     let path = match flag("--save") {
         Some(p) => p.clone(),
-        None => std::env::temp_dir()
-            .join(format!("bench-agent-{}.{}", std::process::id(), solidcraft_engine::io::DESIGN_EXT))
-            .to_string_lossy()
-            .into_owned(),
+        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
     };
     s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
     let r = crate::cmd_bench_open(std::slice::from_ref(&path));
@@ -236,7 +232,7 @@ mod tests {
             }
         }
         assert!(s.model.results.iter().all(|r| r.error.is_none()));
-        let world = s.world_state().unwrap();
+        let world = s.world_state();
         assert!(world.bodies.len() > 40, "{} bodies", world.bodies.len());
         assert!(world.bodies.iter().any(|b| b.name.contains("spoke")));
     }

apps/solidcraft-cli/src/bench_assistant.rs

@@ -1,702 +0,0 @@
-//! `bench-assistant`: the standard Assistant model test (v1, #4851), run against a desktop app.
-//!
-//! The app is already running with `--control PORT`; everything goes through its control channel
-//! (`docs/control-protocol.md`), so the command needs no window code of its own. For each task it
-//! starts a new design, runs the task's prescribed setup (a box, for some), adds the endpoint as an
-//! API agent with All permissions, starts a new chat, sends the prompt once and waits for the turn
-//! to end. The result is checked on the design (`document.inspect` with measurements), never on
-//! what the model says, except for the one question whose answer is the reply. A failed task is
-//! put in one of the issue's failure categories from the conversation's items.
-//!
-//! ```text
-//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT --base-url URL --model NAME
-//!     [--token T] [--tasks 1,2,5] [--repeat N] [--timeout-s 300]
-//!     [--json out.json] [--markdown out.md]
-//! ```
-//! prints a table of the results; `--markdown` writes the issue's comment template filled in,
-//! `--json` every task's rules, conversation and design before and after.
-
-use std::io::{BufRead, BufReader, Write};
-use std::net::{SocketAddr, TcpStream};
-use std::time::{Duration, Instant};
-
-use serde_json::{Value, json};
-
-/// Standard test v1, as #4851 states it. Changing a prompt or a rule makes it another test.
-const TASKS: &str = r#"[
-  {"id": "01-cube", "prompt": "Make a 20 mm cube.", "check": {"bodies": 1, "volume": 8000, "bbox_size": [20, 20, 20]}},
-  {"id": "02-cylinder", "prompt": "Make a cylinder 30 mm in diameter and 50 mm tall.", "check": {"bodies": 1, "volume": 35342.92, "bbox_size": [30, 30, 50]}},
-  {"id": "03-block", "prompt": "Create a block 60 mm long, 40 mm wide and 10 mm thick.", "check": {"bodies": 1, "volume": 24000, "bbox_size": [10, 40, 60]}},
-  {"id": "04-sketch-extrude", "prompt": "Sketch a 50 by 30 mm rectangle on the XY plane and extrude it 15 mm.", "check": {"bodies": 1, "volume": 22500, "bbox_size": [15, 30, 50], "feature_kinds": ["Extrude"]}},
-  {"id": "05-plate-hole", "prompt": "Make a plate 80 x 60 x 10 mm with a 20 mm diameter hole straight through the middle.", "check": {"bodies": 1, "volume": 44858.41, "bbox_size": [10, 60, 80], "note": "80*60*10 - pi*10^2*10"}},
-  {"id": "06-fillet-box", "prompt": "Round all the edges of the box with a 3 mm radius.", "setup": [{"command": "solid.box", "params": {"length": 40, "width": 40, "height": 40}}], "check": {"bodies": 1, "volume": 63108.53, "tol": 0.003, "feature_kinds": ["Fillet"], "note": "all 12 edges of a 40 mm cube rounded r=3"}},
-  {"id": "07-move-body", "prompt": "Move the box 50 mm along the X axis.", "setup": [{"command": "solid.box", "params": {"length": 20, "width": 20, "height": 20}}], "check": {"bodies": 1, "volume": 8000, "bbox_min": [50, 0, 0]}},
-  {"id": "08-rename-body", "prompt": "Rename the body to Bracket.", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "body_name": "Bracket"}},
-  {"id": "09-volume-question", "prompt": "What is the volume of the part?", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "unchanged": true, "reply_number": "6[ ,. ]?000(?![0-9])|6(\\.0+)? ?cm"}},
-  {"id": "10-two-holes", "prompt": "Make a 100 x 50 x 5 mm plate and drill two 10 mm holes through it, each 15 mm in from the short ends and centred across the width.", "check": {"bodies": 1, "volume": 24214.6, "bbox_size": [5, 50, 100], "note": "100*50*5 - 2*pi*5^2*5"}},
-  {"id": "11-any-change", "prompt": "can you use the software to make a change to the current shape, any change at all", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"changed": true, "note": "verbatim user prompt from #4846; pass = the design changed"}}
-]"#;
-
-/// The agent the test adds. A fixed id replaces it on every run instead of adding another.
-const AGENT_ID: &str = "api-bench-assistant";
-const AGENT_NAME: &str = "bench";
-/// Longest control reply read (the channel's own request limit).
-const MAX_REPLY: usize = 16 << 20;
-/// Most result data kept for `--json`.
-const MAX_RESULTS: usize = 64 << 20;
-/// Deadline of the requests that only set up or read (each is answered at once by the app).
-const REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
-/// How often a running turn is polled.
-const POLL: Duration = Duration::from_millis(250);
-/// After this long, an idle chat with no reply yet counts as a turn that ended without one.
-const START_GRACE: Duration = Duration::from_secs(30);
-/// Absolute tolerance of the lowest corner, in millimetres.
-const MIN_CORNER_TOL: f64 = 0.05;
-
-/// A JSON-lines connection to the app. Requests are sent once; a lost reply is never retried,
-/// so nothing runs twice.
-struct Control {
-    addr: SocketAddr,
-    token: String,
-    reader: BufReader<TcpStream>,
-    id: u64,
-}
-
-impl Control {
-    fn connect(addr: &str, token: Option<&str>) -> Result<Self, String> {
-        let addr: SocketAddr = addr.parse().map_err(|_| format!("--connect: `{addr}` is not an IP address and port"))?;
-        if !addr.ip().is_loopback() || addr.port() == 0 {
-            return Err("--connect requires a loopback address and a nonzero port (the app listens on 127.0.0.1)".into());
-        }
-        let token = solidcraft_engine::control_auth::APP
-            .client_token(addr.port(), token)
-            .map(|t| t.token)
-            .ok_or("no control token: pass --token, set SOLIDCRAFT_CONTROL_TOKEN, or run on the app's computer (its token file)")?;
-        if token.len() > 4096 {
-            return Err("the control token is longer than 4096 bytes".into());
-        }
-        Self::open(addr, token)
-    }
-
-    fn open(addr: SocketAddr, token: String) -> Result<Self, String> {
-        let stream = TcpStream::connect_timeout(&addr, Duration::from_secs(5)).map_err(|e| format!("connecting to {addr}: {e}"))?;
-        Ok(Self { addr, token, reader: BufReader::new(stream), id: 0 })
-    }
-
-    /// A new connection to the same app: a request that outlived its deadline keeps the old one
-    /// busy until it is answered.
-    fn reopen(&self) -> Result<Self, String> {
-        Self::open(self.addr, self.token.clone())
-    }
-
-    fn call(&mut self, method: &str, params: Value, deadline: Instant) -> Result<Value, String> {
-        let left = || deadline.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()).ok_or_else(|| "timeout".to_string());
-        let io = |e: std::io::Error| match e.kind() {
-            std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => "timeout".to_string(),
-            _ => format!("control channel: {e}"),
-        };
-        self.reader.get_ref().set_write_timeout(Some(left()?)).map_err(io)?;
-        self.id += 1;
-        // The first request on a connection carries the token; sending it on every one is allowed.
-        let request = json!({"id": self.id, "method": method, "params": params, "token": self.token});
-        writeln!(self.reader.get_mut(), "{request}").map_err(io)?;
-        let mut line = Vec::new();
-        loop {
-            self.reader.get_ref().set_read_timeout(Some(left()?)).map_err(io)?;
-            let bytes = self.reader.fill_buf().map_err(io)?;
-            if bytes.is_empty() {
-                return Err("the app closed the control connection".into());
-            }
-            let newline = bytes.iter().position(|b| *b == b'\n');
-            let used = newline.map_or(bytes.len(), |n| n + 1);
-            if line.len() + used > MAX_REPLY {
-                return Err("a control reply is larger than 16 MiB".into());
-            }
-            line.extend_from_slice(bytes.get(..used).unwrap_or_default());
-            self.reader.consume(used);
-            if newline.is_some() {
-                break;
-            }
-        }
-        let reply: Value = serde_json::from_slice(&line).map_err(|e| format!("control reply: {e}"))?;
-        if reply["id"].as_u64() != Some(self.id) {
-            return Err("control reply for another request".into());
-        }
-        if reply["ok"] != true {
-            return Err(format!("{method}: {}", reply["error"].as_str().unwrap_or("failed")));
-        }
-        reply.get("result").cloned().ok_or_else(|| format!("{method}: reply without a result"))
-    }
-
-    fn execute(&mut self, command: &str, params: Value) -> Result<Value, String> {
-        self.call("engine.execute", json!({"command": command, "params": params, "animate": false}), Instant::now() + REQUEST_TIMEOUT)
-    }
-
-    fn chat(&mut self, params: Value) -> Result<Value, String> {
-        self.call("ui.agent_chat", params, Instant::now() + REQUEST_TIMEOUT)
-    }
-
-    fn inspect(&mut self) -> Result<Value, String> {
-        let design = self.call("document.inspect", json!({"measure": true}), Instant::now() + REQUEST_TIMEOUT)?;
-        if design.is_object() { Ok(design) } else { Err("document.inspect returned no design".into()) }
-    }
-}
-
-fn tasks() -> Result<Vec<Value>, String> {
-    serde_json::from_str(TASKS).map_err(|e| format!("embedded tasks: {e}"))
-}
-
-fn triple(value: &Value) -> Option<[f64; 3]> {
-    match value.as_array()?.as_slice() {
-        [x, y, z] => {
-            let n = |v: &Value| v.as_f64().filter(|n| n.is_finite());
-            Some([n(x)?, n(y)?, n(z)?])
-        }
-        _ => None,
-    }
-}
-
-/// What the model said (thoughts left out).
-fn reply(items: &[Value]) -> String {
-    items.iter().filter(|i| i["thought"] != true).filter_map(|i| i["agent"].as_str()).collect::<Vec<_>>().join("\n")
-}
-
-/// v1's reply pattern `6[ ,. ]?000(?![0-9])|6(\.0+)? ?cm`: "6000", "6 000", "6,000", "6.000" not
-/// followed by a digit, or "6 cm", "6.0cm", … (a narrow no-break space also separates thousands).
-fn volume_reply(text: &str) -> bool {
-    text.match_indices('6').any(|(at, _)| {
-        let tail = text.get(at + 1..).unwrap_or_default();
-        let thousands = |t: &str| t.strip_prefix("000").is_some_and(|rest| !rest.starts_with(|c: char| c.is_ascii_digit()));
-        let separated = tail.strip_prefix([' ', ',', '.', '\u{202f}']).is_some_and(thousands);
-        let cm = {
-            let t = tail.strip_prefix(".0").map_or(tail, |t| t.trim_start_matches('0'));
-            t.strip_prefix(' ').unwrap_or(t).starts_with("cm")
-        };
-        thousands(tail) || separated || cm
-    })
-}
-
-/// The design as the user sees it, without what reading or saving changes (path, saved state,
-/// revision, selection, undo depth, evaluation timings).
-fn content(design: &Value) -> Value {
-    let mut v = design.clone();
-    if let Some(o) = v.as_object_mut() {
-        for key in ["path", "dirty", "revision", "selection", "undo", "redo"] {
-            o.remove(key);
-        }
-    }
-    for feature in v.get_mut("timeline").and_then(Value::as_array_mut).into_iter().flatten() {
-        if let Some(o) = feature.as_object_mut() {
-            o.remove("ms");
-            o.remove("boolean_diagnostics");
-        }
-    }
-    v
-}
-
-/// Whether the design changed: its content, or a step on the undo stack (a colour, say, that the
-/// inspection does not list).
-fn changed(before: &Value, after: &Value) -> bool {
-    content(before) != content(after) || after["undo"].as_u64() > before["undo"].as_u64()
-}
-
-/// The rules a task's result breaks (none: it passed). `before` and `after` are
-/// `document.inspect {measure: true}` before the prompt and after the turn.
-pub(super) fn check(rule: &Value, before: &Value, after: &Value, items: &[Value]) -> Vec<String> {
-    let Some(all) = after["bodies"].as_array() else { return vec!["the design could not be read".into()] };
-    // Bodies the user sees; a hidden one (a tool body, a hidden original) is not the result.
-    let bodies: Vec<&Value> = all.iter().filter(|b| b["visible"] != false).collect();
-    let mut errors = Vec::new();
-    if let Some(n) = rule["bodies"].as_u64()
-        && bodies.len() as u64 != n
-    {
-        errors.push(format!("{} bodies, expected {n}", bodies.len()));
-    }
-    if let Some(expected) = rule["volume"].as_f64() {
-        let tol = rule["tol"].as_f64().unwrap_or(0.01);
-        let volumes: Vec<f64> = bodies.iter().filter_map(|b| b["volume_mm3"].as_f64()).filter(|v| v.is_finite()).collect();
-        let total: f64 = volumes.iter().sum();
-        if volumes.len() != bodies.len() || (total - expected).abs() > expected * tol {
-            errors.push(format!("volume {total:.1} mm³, expected {expected} mm³ ±{}%", tol * 100.0));
-        }
-    }
-    let first = bodies.first().copied().unwrap_or(&Value::Null);
-    let min = triple(&first["bbox"]["min"]);
-    if let Some(mut expected) = triple(&rule["bbox_size"]) {
-        expected.sort_by(f64::total_cmp);
-        let size = min.zip(triple(&first["bbox"]["max"])).map(|(lo, hi)| {
-            let mut size = [hi[0] - lo[0], hi[1] - lo[1], hi[2] - lo[2]];
-            size.sort_by(f64::total_cmp);
-            size
-        });
-        if !size.is_some_and(|s| s.iter().zip(expected).all(|(a, e)| (a - e).abs() <= 0.01 * e.max(1.0))) {
-            errors.push(format!("size {size:?}, expected {expected:?} in any orientation"));
-        }
-    }
-    if let Some(expected) = triple(&rule["bbox_min"])
-        && !min.is_some_and(|m| m.iter().zip(expected).all(|(a, e)| (a - e).abs() <= MIN_CORNER_TOL))
-    {
-        errors.push(format!("lowest corner {min:?}, expected {expected:?}"));
-    }
-    if let Some(name) = rule["body_name"].as_str()
-        && !bodies.iter().any(|b| b["name"] == name)
-    {
-        errors.push(format!("no body named {name}"));
-    }
-    for kind in rule["feature_kinds"].as_array().into_iter().flatten().filter_map(Value::as_str) {
-        let live = |f: &&Value| f["suppressed"] != true && f["rolled_back"] != true && f["error"].is_null();
-        if !after["timeline"].as_array().into_iter().flatten().filter(live).any(|f| f["type"].as_str().is_some_and(|t| t.contains(kind))) {
-            errors.push(format!("no {kind} in the timeline"));
-        }
-    }
-    if rule["changed"] == true || rule["unchanged"] == true {
-        let changed = before.is_object() && changed(before, after);
-        if rule["changed"] == true && !changed {
-            errors.push("the design did not change".into());
-        }
-        if rule["unchanged"] == true && (changed || !before.is_object()) {
-            errors.push("the design changed".into());
-        }
-    }
-    if rule["reply_number"].is_string() && !volume_reply(&reply(items)) {
-        errors.push("the reply does not give the volume".into());
-    }
-    errors
-}
-
-/// A tool call written into the reply as JSON: `{"name": …`, `{"command": …`, `{"function": …`,
-/// `{"tool": …`.
-fn call_as_text(text: &str) -> bool {
-    text.match_indices('{').any(|(at, _)| {
-        let rest = text.get(at + 1..).unwrap_or_default().trim_start();
-        ["\"name\"", "\"command\"", "\"function\"", "\"tool\""]
-            .iter()
-            .any(|key| rest.strip_prefix(key).is_some_and(|r| r.trim_start().starts_with(':')))
-    })
-}
-
-/// How a failed task failed, in the issue's words, from the conversation's items.
-pub(super) fn classify(items: &[Value], timed_out: bool) -> &'static str {
-    if timed_out {
-        return "timeout";
-    }
-    let tools: Vec<&Value> = items.iter().filter(|i| i.get("tool").is_some()).collect();
-    // A failed call, or a batch whose answer reports a failed step (`"ok": false`).
-    let failed: Vec<String> = tools
-        .iter()
-        .map(|t| t["output"].as_str().unwrap_or_default())
-        .zip(&tools)
-        .filter(|(output, t)| t["status"] == "Failed" || serde_json::from_str::<Value>(output).is_ok_and(|v| v["ok"] == false))
-        .map(|(output, _)| output.to_lowercase())
-        .collect();
-    let notices: Vec<String> = items.iter().filter_map(|i| i["notice"].as_str()).map(str::to_lowercase).collect();
-    let answer = reply(items);
-    if notices.iter().any(|n| n.contains("http 400")) {
-        return "the endpoint refused tools (HTTP 400)";
-    }
-    if notices.iter().any(|n| n.contains("max_turn_requests")) || answer.contains("requests for one message") {
-        return "hit the request limit";
-    }
-    if call_as_text(&answer) {
-        return "wrote the call as text";
-    }
-    if failed.iter().any(|o| o.contains("unknown command") || o.starts_with("unknown tool")) {
-        return "wrong or unknown command";
-    }
-    if failed.iter().any(|o| o.contains("invalid parameters") || o.starts_with("not run:") || o.contains("not valid json")) {
-        return "wrong arguments";
-    }
-    if !failed.is_empty() || notices.iter().any(|n| n.starts_with("http ")) || items.iter().any(|i| i["error"] == true) {
-        return "gave up after errors";
-    }
-    if tools.is_empty() {
-        return if answer.trim().is_empty() { "an empty reply" } else { "only talked" };
-    }
-    "wrong result"
-}
-
-/// One run's results in the issue's comment template (`run`: which repetition).
-pub(super) fn markdown(model: &str, version: &str, results: &[Value], run: u64) -> String {
-    let clean = |s: &str| s.replace(['\n', '\r', '|'], " ");
-    let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
-    let passed = rows.iter().filter(|r| r["passed"] == true).count();
-    let mut out = format!(
-        "### {} (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: {}\nResult: {passed}/11\n| # | pass/fail | how it failed |\n|---|---|---|\n",
-        clean(model),
-        clean(version)
-    );
-    for n in 1..=11 {
-        match rows.iter().find(|r| r["task"] == n) {
-            Some(r) if r["passed"] == true => out.push_str(&format!("| {n} | pass | |\n")),
-            Some(r) => out.push_str(&format!("| {n} | fail | {} |\n", clean(r["failure"].as_str().unwrap_or_default()))),
-            None => out.push_str(&format!("| {n} | | not run |\n")),
-        }
-    }
-    out.push_str(if rows.len() == 11 {
-        "Notes: <anything odd, e.g. very slow, needed a retry>\n"
-    } else {
-        "Notes: partial run; the tasks marked \"not run\" were left out.\n"
-    });
-    out
-}
-
-fn write(path: &str, text: &str) -> Result<(), String> {
-    solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"))
-}
-
-struct Options<'a> {
-    connect: &'a str,
-    token: Option<&'a str>,
-    base_url: &'a str,
-    model: &'a str,
-    tasks: Vec<usize>,
-    repeat: u64,
-    timeout: Duration,
-    json: Option<&'a str>,
-    markdown: Option<&'a str>,
-}
-
-fn options(args: &[String]) -> Result<Options<'_>, String> {
-    const FLAGS: [&str; 9] = ["--connect", "--token", "--base-url", "--model", "--tasks", "--repeat", "--timeout-s", "--json", "--markdown"];
-    let mut given = std::collections::BTreeMap::new();
-    let mut args = args.iter();
-    while let Some(flag) = args.next() {
-        let Some(flag) = FLAGS.iter().find(|f| **f == flag.as_str()) else { return Err(format!("unknown bench-assistant option: {flag}")) };
-        let value = args
-            .next()
-            .filter(|v| !v.starts_with("--") && !v.is_empty() && v.len() <= 4096)
-            .ok_or_else(|| format!("{flag} needs a value (at most 4096 bytes)"))?;
-        if given.insert(*flag, value.as_str()).is_some() {
-            return Err(format!("{flag} given twice"));
-        }
-    }
-    let required = |key: &str| given.get(key).copied().ok_or_else(|| format!("bench-assistant needs {key}"));
-    let number = |key: &str, default: u64, max: u64| -> Result<u64, String> {
-        given
-            .get(key)
-            .map_or(Ok(default), |s| s.parse::<u64>().ok().filter(|n| (1..=max).contains(n)).ok_or_else(|| format!("{key} must be 1 to {max}")))
-    };
-    let tasks = match given.get("--tasks") {
-        None => (1..=11).collect(),
-        Some(list) => {
-            let mut tasks = Vec::new();
-            for n in list.split(',') {
-                let n = n
-                    .trim()
-                    .parse::<usize>()
-                    .ok()
-                    .filter(|n| (1..=11).contains(n))
-                    .ok_or("--tasks takes task numbers 1 to 11, separated by commas")?;
-                if tasks.contains(&n) {
-                    return Err(format!("--tasks lists task {n} twice"));
-                }
-                tasks.push(n);
-            }
-            tasks
-        }
-    };
-    Ok(Options {
-        connect: required("--connect")?,
-        token: given.get("--token").copied(),
-        base_url: required("--base-url")?,
-        model: required("--model")?,
-        tasks,
-        repeat: number("--repeat", 1, 100)?,
-        timeout: Duration::from_secs(number("--timeout-s", 300, 3600)?),
-        json: given.get("--json").copied(),
-        markdown: given.get("--markdown").copied(),
-    })
-}
-
-/// Waits for the turn the prompt started to end. Returns the chat's last state and whether the
-/// deadline passed first.
-fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: Instant) -> Result<(Value, bool), String> {
-    let mut seen_busy = false;
-    loop {
-        let state = chat["state"].as_str().unwrap_or_default();
-        let turn = !chat["turn"].is_null();
-        let queued = chat["pending"].as_array().is_some_and(|p| !p.is_empty());
-        seen_busy |= state == "busy" || turn;
-        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
-        // A turn can start and end between two polls: then the conversation has its answer.
-        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
-        if idle && (seen_busy || answered || matches!(state, "exited" | "failed" | "auth" | "off") || began.elapsed() >= START_GRACE) {
-            return Ok((chat, false));
-        }
-        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
-        std::thread::sleep(POLL.min(left));
-        match control.call("ui.agent_chat", json!({}), end) {
-            Ok(next) => chat = next,
-            Err(e) if e == "timeout" => return Ok((chat, true)),
-            Err(e) => return Err(e),
-        }
-    }
-}
-
-pub fn run(args: &[String]) -> Result<(), String> {
-    let o = options(args)?;
-    let tasks = tasks()?;
-    let mut control = Control::connect(o.connect, o.token)?;
-    let help = control.call("ui.help", json!({}), Instant::now() + REQUEST_TIMEOUT)?;
-    let version = help["version"].as_str().filter(|s| !s.is_empty() && s.len() <= 256).ok_or("the app reported no version")?.to_string();
-    let config = control.chat(json!({
-        "features": true,
-        "add_agent": {"id": AGENT_ID, "name": AGENT_NAME, "kind": "api", "base_url": o.base_url, "model": o.model},
-    }))?;
-    if !config["agents"].as_array().into_iter().flatten().any(|a| a["id"] == AGENT_ID) {
-        return Err("the app did not add the benchmark's agent".into());
-    }
-    // Put the user's permission setting back afterwards.
-    let permissions = config["permissions"].as_str().map(str::to_string);
-    let result = run_tasks(&mut control, &o, &tasks, &version);
-    let _ = control.chat(json!({"stop": true}));
-    if let Some(p) = permissions {
-        let _ = control.chat(json!({"permissions": p}));
-    }
-    result
-}
-
-fn run_tasks(control: &mut Control, o: &Options, tasks: &[Value], version: &str) -> Result<(), String> {
-    let mut results: Vec<Value> = Vec::new();
-    let mut kept = 0;
-    let mut stdout = std::io::stdout().lock();
-    let mut say = |line: String| writeln!(stdout, "{line}").map_err(|e| format!("stdout: {e}"));
-    say(format!("bench-assistant v1: {} on SolidCraft {version}", o.model))?;
-    say("| run | # | task | pass/fail | how it failed | seconds |\n|---|---|---|---|---|---|".into())?;
-    for run in 1..=o.repeat {
-        for &n in &o.tasks {
-            let task = tasks.get(n - 1).ok_or("missing embedded task")?;
-            // A fresh design and a fresh chat, with nothing of the last task still running.
-            control.chat(json!({"stop": true}))?;
-            control.execute("file.new", json!({"name": "Benchmark"}))?;
-            for step in task["setup"].as_array().into_iter().flatten() {
-                control.execute(step["command"].as_str().ok_or("embedded setup without a command")?, step["params"].clone())?;
-            }
-            control.chat(json!({"agent": AGENT_ID, "permissions": "all", "new_chat": true, "attach_view": false}))?;
-            let before = control.inspect()?;
-            let began = Instant::now();
-            let end = began + o.timeout;
-            let (chat, timed_out) = match control.call("ui.agent_chat", json!({"send": task["prompt"]}), end) {
-                Ok(chat) => wait_for_turn(control, chat, began, end)?,
-                Err(e) if e == "timeout" => (json!({}), true),
-                Err(e) => return Err(e),
-            };
-            if timed_out {
-                // The late reply would arrive on the old connection; stop the model on a new one
-                // before reading the design.
-                *control = control.reopen()?;
-            }
-            // Stop the agent before reading the result, so nothing changes the design meanwhile.
-            let stopped = control.chat(json!({"stop": true}))?;
-            let items = stopped["items"].as_array().or(chat["items"].as_array()).cloned().unwrap_or_default();
-            let after = control.inspect()?;
-            let failed_rules = check(&task["check"], &before, &after, &items);
-            let passed = failed_rules.is_empty();
-            let failure = if passed { "" } else { classify(&items, timed_out) };
-            let seconds = began.elapsed().as_secs_f64();
-            say(format!(
-                "| {run} | {n} | {} | {} | {failure} | {seconds:.0} |",
-                task["id"].as_str().unwrap_or_default(),
-                if passed { "pass" } else { "fail" }
-            ))?;
-            let result = json!({
-                "task": n, "id": task["id"], "prompt": task["prompt"], "repeat": run, "passed": passed, "failure": failure,
-                "failed_rules": failed_rules, "timed_out": timed_out, "seconds": seconds, "check": task["check"],
-                "items": items, "before": before, "after": after,
-            });
-            kept += result.to_string().len();
-            if kept > MAX_RESULTS {
-                return Err("the results passed 64 MiB; run fewer tasks or repetitions".into());
-            }
-            results.push(result);
-            // Written after every task, so an interrupted run keeps what it measured.
-            if let Some(path) = o.json {
-                let all = json!({"test": "v1", "model": o.model, "base_url": o.base_url, "solidcraft": version, "results": results});
-                write(path, &serde_json::to_string_pretty(&all).map_err(|e| e.to_string())?)?;
-            }
-            if let Some(path) = o.markdown {
-                write(path, &(1..=run).map(|r| markdown(o.model, version, &results, r)).collect::<Vec<_>>().join("\n"))?;
-            }
-        }
-    }
-    for run in 1..=o.repeat {
-        let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
-        say(format!("run {run}: {}/{} passed", rows.iter().filter(|r| r["passed"] == true).count(), rows.len()))?;
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn design(bodies: Value, timeline: Value) -> Value {
-        json!({"name": "Benchmark", "params": [], "timeline": timeline, "bodies": bodies, "sketches": [], "undo": 1, "revision": 3, "dirty": true})
-    }
-
-    fn body(name: &str, volume: f64, min: [f64; 3], max: [f64; 3]) -> Value {
-        json!({"name": name, "volume_mm3": volume, "bbox": {"min": min, "max": max}, "visible": true})
-    }
-
-    #[test]
-    fn the_embedded_tasks_are_v1() {
-        let tasks = tasks().unwrap();
-        assert_eq!(tasks.len(), 11);
-        assert_eq!(tasks[0]["prompt"], "Make a 20 mm cube.");
-        assert_eq!(tasks[10]["prompt"], "can you use the software to make a change to the current shape, any change at all");
-        assert_eq!(tasks[5]["check"]["tol"], 0.003);
-        assert_eq!(tasks[6]["check"]["bbox_min"], json!([50, 0, 0]));
-        let boxes: Vec<_> = tasks.iter().filter(|t| t["setup"].is_array()).map(|t| t["id"].as_str().unwrap()).collect();
-        assert_eq!(boxes, ["06-fillet-box", "07-move-body", "08-rename-body", "09-volume-question", "11-any-change"]);
-    }
-
-    #[test]
-    fn pass_rules() {
-        let tasks = tasks().unwrap();
-        let rule = |n: usize| tasks[n - 1]["check"].clone();
-        let empty = design(json!([]), json!([]));
-        let pass = |n: usize, before: &Value, after: &Value, items: &[Value]| check(&rule(n), before, after, items);
-        // 3: any orientation, within 1%.
-        let block = design(json!([body("Body1", 24_100.0, [0.0; 3], [40.0, 10.0, 60.2])]), json!([{"type": "Box"}]));
-        assert!(pass(3, &empty, &block, &[]).is_empty());
-        let thick = design(json!([body("Body1", 24_000.0, [0.0; 3], [40.0, 12.0, 60.0])]), json!([]));
-        assert_eq!(pass(3, &empty, &thick, &[]).len(), 1);
-        let two = design(json!([body("A", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0]), body("B", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0])]), json!([]));
-        assert!(!pass(3, &empty, &two, &[]).is_empty());
-        // A hidden body is not part of the result.
-        let mut hidden = two.clone();
-        hidden["bodies"][1]["visible"] = json!(false);
-        hidden["bodies"][0]["volume_mm3"] = json!(24_000.0);
-        hidden["bodies"][0]["bbox"]["max"] = json!([60.0, 40.0, 10.0]);
-        assert!(pass(3, &empty, &hidden, &[]).is_empty());
-        // 4: the timeline needs a working Extrude.
-        let plate = |kind: Value| design(json!([body("Body1", 22_500.0, [0.0; 3], [50.0, 30.0, 15.0])]), kind);
-        assert!(pass(4, &empty, &plate(json!([{"type": "Sketch"}, {"type": "Extrude"}])), &[]).is_empty());
-        assert!(!pass(4, &empty, &plate(json!([{"type": "Box"}])), &[]).is_empty());
-        for flag in [json!({"suppressed": true}), json!({"rolled_back": true}), json!({"error": "failed"})] {
-            let mut feature = json!({"type": "Extrude"});
-            feature.as_object_mut().unwrap().extend(flag.as_object().unwrap().clone());
-            assert!(!pass(4, &empty, &plate(json!([feature])), &[]).is_empty(), "{flag}");
-        }
-        // 6: the fillet's tolerance is 0.3%.
-        let start = design(json!([body("Body1", 64_000.0, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}]));
-        let filleted = |v: f64| design(json!([body("Body1", v, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}, {"type": "Fillet"}]));
-        assert!(pass(6, &start, &filleted(63_108.53 * 1.002), &[]).is_empty());
-        assert!(!pass(6, &start, &filleted(63_108.53 * 1.004), &[]).is_empty());
-        // 7: the lowest corner.
-        let moved = |x: f64| design(json!([body("Body1", 8000.0, [x, 0.0, 0.0], [x + 20.0, 20.0, 20.0])]), json!([]));
-        assert!(pass(7, &empty, &moved(50.0), &[]).is_empty());
-        assert!(!pass(7, &empty, &moved(0.0), &[]).is_empty());
-        // 8: the name.
-        let named = |name: &str| design(json!([body(name, 6000.0, [0.0; 3], [30.0, 20.0, 10.0])]), json!([]));
-        assert!(pass(8, &empty, &named("Bracket"), &[]).is_empty());
-        assert!(!pass(8, &empty, &named("Body1"), &[]).is_empty());
-        // 9: unchanged, and the reply gives the volume.
-        let start = named("Body1");
-        let said = |text: &str| [json!({"user": "What is the volume of the part?"}), json!({"agent": text, "thought": false})];
-        let mut read = start.clone();
-        read["revision"] = json!(7);
-        read["dirty"] = json!(false);
-        read["selection"] = json!([{"body": "Body1"}]);
-        assert!(pass(9, &start, &read, &said("The volume is 6000 mm³.")).is_empty());
-        assert!(!pass(9, &start, &read, &said("About 60 cm³.")).is_empty());
-        assert!(!pass(9, &start, &named("Bracket"), &said("6 000 mm³")).is_empty());
-        let mut undone = start.clone();
-        undone["undo"] = json!(2);
-        assert!(!pass(9, &start, &undone, &said("6000 mm³")).is_empty());
-        // 11: any change counts; reading does not.
-        assert!(pass(11, &start, &named("Bracket"), &[]).is_empty());
-        assert!(pass(11, &start, &undone, &[]).is_empty());
-        assert!(!pass(11, &start, &read, &[]).is_empty());
-        // An unreadable design passes nothing.
-        assert!(!pass(11, &start, &json!({}), &[]).is_empty());
-    }
-
-    #[test]
-    fn the_volume_reply() {
-        for yes in ["6000", "6 000 mm³", "6,000", "6.000", "6\u{202f}000", "6 cm³", "6.00cm3", "is 6000."] {
-            assert!(volume_reply(yes), "{yes}");
-        }
-        for no in ["60000", "6,0001", "60 cm³", "600", "6.01 cm³", ""] {
-            assert!(!volume_reply(no), "{no}");
-        }
-    }
-
-    #[test]
-    fn failure_categories() {
-        for (items, expected) in [
-            (
-                json!([{"user": "Make a 20 mm cube."}, {"agent": "{\"name\": \"execute\", \"arguments\": {}}", "thought": false}]),
-                "wrote the call as text",
-            ),
-            (
-                json!([{"notice": "HTTP 400: registry.ollama.ai/library/gemma3:4b does not support tools", "error": true}]),
-                "the endpoint refused tools (HTTP 400)",
-            ),
-            (json!([{"user": "Make a 20 mm cube."}, {"agent": "", "thought": false}]), "an empty reply"),
-            (json!([{"agent": "Let me think", "thought": true}]), "an empty reply"),
-            (json!([{"agent": "Sure, here is how to make a cube.", "thought": false}]), "only talked"),
-            (
-                json!([{"tool": "1", "status": "Failed", "output": "unknown command `solid.cube` (did you mean `solid.box`?)"}]),
-                "wrong or unknown command",
-            ),
-            (json!([{"tool": "1", "status": "Failed", "output": "unknown tool `make_cube`"}]), "wrong or unknown command"),
-            (json!([{"tool": "1", "status": "Failed", "output": "invalid parameters for `solid.box`: `length` is required"}]), "wrong arguments"),
-            (json!([{"tool": "1", "status": "Failed", "output": "Not run: the tool arguments were not valid JSON"}]), "wrong arguments"),
-            (json!([{"tool": "1", "status": "Failed", "output": "no body `Box`"}]), "gave up after errors"),
-            (
-                json!([{"tool": "1", "status": "Completed", "output": "{\"ok\": false, \"failed\": {\"error\": \"unknown command `solid.delete`\"}}"}]),
-                "wrong or unknown command",
-            ),
-            (
-                json!([{"tool": "1", "status": "Completed"}, {"agent": "\n(stopped after 24 requests for one message; send another message to go on)"}]),
-                "hit the request limit",
-            ),
-            (json!([{"tool": "1", "status": "Completed", "output": "{}"}]), "wrong result"),
-        ] {
-            let items = items.as_array().unwrap();
-            assert_eq!(classify(items, false), expected, "{items:?}");
-            assert_eq!(classify(items, true), "timeout");
-        }
-    }
-
-    #[test]
-    fn markdown_is_the_comment_template() {
-        let rows: Vec<Value> =
-            (1..=11).map(|n| json!({"task": n, "repeat": 1, "passed": n != 2, "failure": if n == 2 { "an empty reply" } else { "" }})).collect();
-        let report = markdown("qwen2.5:7b", "0.19.0", &rows, 1);
-        assert!(report.starts_with(
-            "### qwen2.5:7b (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: 0.19.0\nResult: 10/11\n| # | pass/fail | how it failed |\n|---|---|---|\n| 1 | pass | |\n| 2 | fail | an empty reply |\n"
-        ));
-        assert!(report.ends_with("| 11 | pass | |\nNotes: <anything odd, e.g. very slow, needed a retry>\n"));
-        let partial = markdown("m|x", "v", &rows[..1], 1);
-        assert!(partial.starts_with("### m x ("));
-        assert!(partial.contains("Result: 1/11") && partial.contains("| 2 | | not run |") && partial.contains("partial run"));
-    }
-
-    #[test]
-    fn options_are_checked_before_connecting() {
-        for extra in [
-            &["--repeat", "0"][..],
-            &["--repeat", "101"],
-            &["--timeout-s", "3601"],
-            &["--tasks", "0"],
-            &["--tasks", "12"],
-            &["--tasks", "1,1"],
-            &["--model", "again"],
-            &["--unexpected", "1"],
-            &["--token"],
-        ] {
-            let mut args: Vec<String> =
-                ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "http://127.0.0.1:11434/v1"].iter().map(|s| s.to_string()).collect();
-            args.extend(extra.iter().map(|s| s.to_string()));
-            assert!(options(&args).is_err(), "{extra:?}");
-        }
-        let args: Vec<String> =
-            ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "u", "--tasks", "2, 5"].iter().map(|s| s.to_string()).collect();
-        let o = options(&args).unwrap();
-        assert_eq!((o.tasks, o.repeat, o.timeout), (vec![2, 5], 1, Duration::from_secs(300)));
-        assert!(Control::connect("10.0.0.1:9271", Some("t")).is_err());
-        assert!(Control::connect("localhost", Some("t")).is_err());
-    }
-}

apps/solidcraft-cli/src/crashes.rs

@@ -6,14 +6,11 @@ use std::sync::Mutex;
 use serde_json::{Value, json};
 use solidcraft_engine::crash;
 
-/// The command's usage, from the same lines the top-level usage lists.
-fn usage() -> String {
-    crate::command_usage("crashes")
-}
+const USAGE: &str = "usage: solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]";
 
 pub fn run(args: &[String]) -> Result<(), String> {
     let dir = crash::default_dir().ok_or("no crash folder on this system")?;
-    let id = || args.get(1).map(String::as_str).ok_or_else(usage);
+    let id = || args.get(1).map(String::as_str).ok_or_else(|| USAGE.to_string());
     match args.first().map(String::as_str) {
         None | Some("list") => {
             let reports = crash::list(&dir);
@@ -46,7 +43,7 @@ pub fn run(args: &[String]) -> Result<(), String> {
             println!("deleted {} report(s)", crash::clear(&dir, args.get(1).map(String::as_str)));
             Ok(())
         }
-        _ => Err(usage()),
+        _ => Err(USAGE.to_string()),
     }
 }
 

apps/solidcraft-cli/src/fuzz.rs

@@ -16,16 +16,9 @@ fn flag<T: std::str::FromStr>(args: &[String], name: &str, default: T) -> T {
     args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
-/// The options `fuzz` takes, and the ones that stand alone.
-const OPTIONS: &[&str] = &["--from", "--count", "--jobs", "--timeout", "--steps", "--out", "--report"];
-const SWITCHES: &[&str] = &["--minimise"];
-
 /// One seed: a design and a boolean case, as JSON on stdout (progress on stderr).
 pub fn one(args: &[String]) -> Result<(), String> {
     let seed: u64 = args.first().and_then(|s| s.parse().ok()).ok_or("fuzz-one <seed> [--steps N] [--minimise]")?;
-    // The seed is the first argument; the rest are options, and an option `fuzz-one` doesn't
-    // take is refused rather than ignored.
-    crate::known_args("fuzz-one", &args[1..], &["--steps"], SWITCHES, false)?;
     let steps = flag(args, "--steps", 8usize);
     let minimise = args.iter().any(|a| a == "--minimise");
     // Panics caught inside the kernel: harmless natively, fatal in the web build.
@@ -33,25 +26,27 @@ pub fn one(args: &[String]) -> Result<(), String> {
     std::panic::set_hook(Box::new(|_| {
         PANICS.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
     }));
-    solidcraft_engine::note!("design {seed}");
-    let run = fuzz::run_with(seed, steps, &mut |st| solidcraft_engine::note!("step {}", serde_json::to_string(st).unwrap_or_default()));
+    eprintln!("design {seed}");
+    let run = fuzz::run_with(seed, steps, &mut |st| eprintln!("step {}", serde_json::to_string(st).unwrap_or_default()));
     let mut design = json!({
         "outcome": run.outcome,
         "steps": run.steps.iter().map(|s| s.kind).collect::<Vec<_>>(),
         "unsupported": run.unsupported,
         "rejected": run.rejected,
+        "boolean_fallbacks": run.boolean_fallbacks,
+        "boolean_reports_truncated": run.boolean_reports_truncated,
         "panics": PANICS.swap(0, std::sync::atomic::Ordering::SeqCst),
     });
     if run.outcome.is_bug() {
         design["script"] = run.script();
         if minimise {
-            solidcraft_engine::note!("minimise");
+            eprintln!("minimise");
             let m = fuzz::minimise(&run);
             design["minimal"] = json!({"outcome": m.outcome, "steps": m.steps.iter().map(|s| s.kind).collect::<Vec<_>>(), "script": m.script()});
         }
     }
     let (a, b) = solidcraft_engine::fuzz::boolean_shapes(seed);
-    solidcraft_engine::note!("boolean {seed} {} {}", serde_json::to_string(&a).unwrap_or_default(), serde_json::to_string(&b).unwrap_or_default());
+    eprintln!("boolean {seed} {} {}", serde_json::to_string(&a).unwrap_or_default(), serde_json::to_string(&b).unwrap_or_default());
     let b = boolean_case(seed);
     let bp = PANICS.swap(0, std::sync::atomic::Ordering::SeqCst);
     println!("{}", json!({"seed": seed, "design": design, "boolean": b, "boolean_panics": bp}));
@@ -69,9 +64,6 @@ struct Job {
 /// Run seeds `--from`…`--from + --count` in `--jobs` processes, `--timeout` seconds each;
 /// write failing scripts to `--out` and a summary to `--report`.
 pub fn run(args: &[String]) -> Result<(), String> {
-    // An option `fuzz` doesn't take is refused before a seed runs: it would otherwise be
-    // ignored, and the run would go on for minutes with the wrong settings.
-    crate::known_args("fuzz", args, OPTIONS, SWITCHES, false)?;
     let from = flag(args, "--from", 0u64);
     let count = flag(args, "--count", 100u64);
     let last = from.checked_add(count.saturating_sub(1)).ok_or("seed range exceeds u64::MAX: reduce --from or --count")?;
@@ -162,14 +154,11 @@ fn record(v: &Value, out_dir: Option<&str>) {
     let d = &v["design"];
     let bug = matches!(d["outcome"]["kind"].as_str(), Some("failed" | "panic" | "invalid" | "volume"));
     if bug || v.get("timeout").is_some() || v.get("crash").is_some() {
-        solidcraft_engine::note!(
-            "seed {seed}: {}",
-            if bug { format!("{} {}", d["outcome"]["kind"], d["outcome"]["detail"]) } else { format!("{v}") }
-        );
+        eprintln!("seed {seed}: {}", if bug { format!("{} {}", d["outcome"]["kind"], d["outcome"]["detail"]) } else { format!("{v}") });
     }
     let bk = v["boolean"]["outcome"].as_str().unwrap_or("ok");
     if bk != "ok" {
-        solidcraft_engine::note!("seed {seed}: boolean {bk} {}", v["boolean"]["detail"]);
+        eprintln!("seed {seed}: boolean {bk} {}", v["boolean"]["detail"]);
     }
     if let Some(dir) = out_dir {
         use std::io::Write;
@@ -192,9 +181,23 @@ fn summarise(results: &[Value], took: Duration) -> String {
     let mut boolean: BTreeMap<String, usize> = BTreeMap::new();
     let mut at_step: BTreeMap<String, usize> = BTreeMap::new();
     let mut unsupported: BTreeMap<String, usize> = BTreeMap::new();
+    let mut fallbacks: BTreeMap<String, [u64; 2]> = BTreeMap::new();
+    let mut truncated = [0usize; 2];
     let mut steps = 0;
     let (mut dp, mut bp) = (0, 0);
     for v in results {
+        for (i, group) in ["design", "boolean"].into_iter().enumerate() {
+            if v[group]["boolean_reports_truncated"].as_bool().unwrap_or(false) {
+                truncated[i] += 1;
+            }
+            if let Some(counts) = v[group]["boolean_fallbacks"].as_object() {
+                for (strategy, count) in counts {
+                    if let Some(total) = fallbacks.entry(strategy.clone()).or_default().get_mut(i) {
+                        *total = total.saturating_add(count.as_u64().unwrap_or(0));
+                    }
+                }
+            }
+        }
         dp += usize::from(v["design"]["panics"].as_u64().unwrap_or(0) > 0);
         bp += usize::from(v["boolean_panics"].as_u64().unwrap_or(0) > 0);
         let k = if v.get("timeout").is_some() {
@@ -233,6 +236,11 @@ fn summarise(results: &[Value], took: Duration) -> String {
     for (k, c) in &boolean {
         s += &format!("- {k}: {}\n", pct(*c));
     }
+    s += "\nSuccessful Boolean retries (events, including nested operations):\n";
+    for (strategy, [designs, checks]) in &fallbacks {
+        s += &format!("- {strategy}: designs {designs}, boolean checks {checks}\n");
+    }
+    s += &format!("- Capped reports: designs {}, boolean checks {}\n", truncated[0], truncated[1]);
     s
 }
 
@@ -241,13 +249,15 @@ mod tests {
     use super::*;
 
     #[test]
-    fn report_counts_outcomes_and_timeouts() {
+    fn report_counts_retry_events_separately_and_marks_incomplete_logs() {
         let results = [
-            json!({"design":{"outcome":{"kind":"ok"}},"boolean":{"outcome":"ok"}}),
-            json!({"design":{"outcome":{"kind":"ok"}},"boolean":{"outcome":"ok"}}),
+            json!({"design":{"outcome":{"kind":"ok"},"boolean_fallbacks":{"shifted_operands":2}},"boolean":{"outcome":"ok","boolean_fallbacks":{"shifted_operands":3},"boolean_reports_truncated":true}}),
+            json!({"design":{"outcome":{"kind":"ok"},"boolean_fallbacks":{"shifted_operands":1}},"boolean":{"outcome":"ok"}}),
             json!({"timeout":90}),
         ];
         let text = summarise(&results, Duration::ZERO);
+        assert!(text.contains("shifted_operands: designs 3, boolean checks 3"), "{text}");
+        assert!(text.contains("Capped reports: designs 0, boolean checks 1"), "{text}");
         assert!(text.contains("timeout: 1 (33.3 %)"), "{text}");
     }
 }

apps/solidcraft-cli/src/kernel_cases_export.rs

@@ -1,412 +0,0 @@
-//! `kernel-cases --export=DIR`: one kernel rig case as a corpus entry for solidcore's rig. The
-//! case's commands run as the rig runs them while the kernel's operations are traced
-//! (`smlib_trace`); the entry holds every operation in execution order, including discarded
-//! tool construction and handled refusals, each operand that came in as a record (the
-//! B-rep record, solidcore-record's JSON), the fix set, the case's expected values and the rig's
-//! own result. A case whose result no kernel operation alone accounts for is written too, with
-//! the reasons, so nothing is dropped silently.
-//!
-//! An entry's operation is expressible (`operation_expressible`) when the run failed in a kernel
-//! operation (the last one traced failed), or when every body the case ends with is the record a
-//! traced operation's output was written as, or an operand some traced operation took, as its
-//! record. The entry is wholly expressible (`expressible`) when, besides, every value it grades is
-//! the kernel's: none of `continuity`, `watertight`, `files`, `results`, `construction` or
-//! `flat_pattern` (SolidCraft computes them), no face, edge or vertex count that the rig's merging
-//! across analytic surfaces (`merged_topology`) changes, and no refusal graded on SolidCraft's
-//! wording of the kernel's error. Those are listed in `ungraded`.
-
-use std::collections::{BTreeMap, BTreeSet, HashMap};
-use std::path::{Path, PathBuf};
-
-use serde_json::{Value, json};
-use solidcore_record::brep::Brep;
-use solidcraft_engine::kernel::smlib_trace::{self, Event};
-
-use crate::read_json;
-
-/// What a traced case leaves for its entry: the trace of its commands, and the bodies it ends
-/// with by name or the engine's error.
-#[derive(Default)]
-pub struct Capture {
-    pub events: Vec<Event>,
-    pub ran: Option<Result<Vec<(String, Brep)>, String>>,
-}
-
-/// The expected values SolidCraft computes, never the kernel.
-const GRADER_ONLY: [&str; 6] = ["continuity", "watertight", "files", "results", "construction", "flat_pattern"];
-
-/// The case directory's area (its path under `tests/kernel-cases/`, a ladder case's tier under
-/// `ladder/`) and its id.
-fn area_and_id(dir: &str) -> Result<(String, String), String> {
-    let p = Path::new(dir);
-    let parts: Vec<String> = p.components().map(|c| c.as_os_str().to_string_lossy().to_string()).collect();
-    let at = parts.iter().rposition(|c| c == "kernel-cases").ok_or_else(|| format!("{dir}: not under tests/kernel-cases"))?;
-    let rest = parts.get(at + 1..).unwrap_or_default();
-    match rest.split_last() {
-        Some((id, area)) if !area.is_empty() => Ok((area.join("/"), id.clone())),
-        _ => Err(format!("{dir}: no area")),
-    }
-}
-
-/// The case's line in its area's `KNOWN_FAILING`: why it fails today; `None` when not listed.
-fn known_failing(dir: &str, id: &str) -> Option<String> {
-    let list = Path::new(dir).parent()?.join("KNOWN_FAILING");
-    let text = std::fs::read_to_string(list).ok()?;
-    text.lines().filter(|l| !l.trim_start().starts_with('#')).find_map(|l| {
-        let (case, why) = l.split_once(char::is_whitespace).unwrap_or((l, ""));
-        (case == id).then(|| why.trim().to_string())
-    })
-}
-
-/// The trace read as operations and the records that went in and came out.
-struct Trace<'a> {
-    /// Each operation: its name, operands, parameters and outputs or error.
-    calls: Vec<(&'static str, &'a [u64], &'a Value, &'a Result<Vec<u64>, String>)>,
-    /// The record each body made from a record was made from.
-    imports: HashMap<u64, (&'a Brep, bool, bool)>,
-    /// The records bodies were written as, in order.
-    exports: Vec<(u64, &'a Brep)>,
-    /// The operation that made each body.
-    producer: HashMap<u64, usize>,
-}
-
-impl<'a> Trace<'a> {
-    fn of(events: &'a [Event]) -> Trace<'a> {
-        let mut t = Trace { calls: Vec::new(), imports: HashMap::new(), exports: Vec::new(), producer: HashMap::new() };
-        for e in events {
-            match e {
-                Event::Import { id, record, trusted, keeping_splines } => {
-                    t.imports.insert(*id, (record, *trusted, *keeping_splines));
-                }
-                Event::Export { id, record } => t.exports.push((*id, record)),
-                Event::Call { op, inputs, params, outputs } => {
-                    if let Ok(made) = outputs {
-                        for id in made {
-                            t.producer.insert(*id, t.calls.len());
-                        }
-                    }
-                    t.calls.push((*op, inputs, params, outputs));
-                }
-            }
-        }
-        t
-    }
-
-    /// Bodies some operation took as an operand.
-    fn operands(&self) -> BTreeSet<u64> {
-        self.calls.iter().flat_map(|c| c.1.iter().copied()).collect()
-    }
-}
-
-/// The entry of case `dir`, run with result `out`, into `root/<area>/<id>.json`, and the fix set
-/// into `root/fixes.json`.
-pub fn write(root: &Path, dir: &str, out: &Value, capture: Capture) -> Result<(), String> {
-    let (area, id) = area_and_id(dir)?;
-    let want = read_json(&format!("{dir}/expected.json"))?;
-    let t = Trace::of(&capture.events);
-    // Why the operation is not the kernel's alone, and what the entry cannot grade without
-    // SolidCraft.
-    let mut why_not: Vec<String> = Vec::new();
-    let mut ungraded: Vec<String> = Vec::new();
-    let has = |k: &str| want.get(k).is_some_and(|v| !v.is_null());
-
-    if let Some(missing) = want["missing"].as_str() {
-        why_not.push(format!("SolidCraft has no command for it yet: {missing}"));
-    }
-    for k in GRADER_ONLY.iter().filter(|k| has(k)) {
-        ungraded.push(format!("{k}: SolidCraft computes it"));
-    }
-
-    let mut result: Vec<Value> = Vec::new();
-    let mut ends: Vec<u64> = Vec::new();
-    let mut failed_call: Option<usize> = None;
-    let mut outcome = json!({"ran": true});
-    match (&capture.ran, has("missing")) {
-        (_, true) => {}
-        (None, false) => why_not.push("the case did not run".into()),
-        (Some(Err(e)), false) => {
-            // The run stopped. It stopped in the kernel when the last operation that failed is
-            // followed by no operation but copies (a copy or a tagged copy, which build nothing):
-            // nothing was built after it, so the engine's error reports that failure in its own
-            // words. An operation that ran after it means the engine went on and failed itself.
-            outcome = json!({"ran": false, "engine_error": e});
-            let last_failed = t.calls.iter().rposition(|c| c.3.is_err());
-            let built_after = |i: usize| t.calls.iter().skip(i + 1).any(|c| !matches!(c.0, "copy" | "tagged"));
-            match last_failed.filter(|&i| !built_after(i)).and_then(|i| t.calls.get(i).map(|c| (i, c))) {
-                Some((i, c)) => {
-                    failed_call = Some(i);
-                    ends.extend(c.1.iter().copied());
-                    if let Err(k) = c.3 {
-                        outcome["kernel_error"] = json!(k);
-                        if let Some(why) = want["refusal"].as_str().filter(|w| !k.contains(*w)) {
-                            ungraded.push(format!("refusal {why:?}: SolidCraft's wording of the kernel's error"));
-                        }
-                    }
-                }
-                None if t.calls.is_empty() => why_not.push(format!("no kernel operation ran before the failure: {e}")),
-                None => why_not.push(format!("the failure is SolidCraft's, not a kernel operation's: {e}")),
-            }
-        }
-        (Some(Ok(world)), false) => {
-            let operands = t.operands();
-            let mut made = 0;
-            for (name, record) in world {
-                let from_op = t.exports.iter().rev().find(|(id, r)| *r == record && t.producer.contains_key(id)).map(|(id, _)| *id);
-                let operand = t.imports.iter().filter(|(i, (r, _, _))| *r == record && operands.contains(i)).map(|(i, _)| *i).min();
-                match (from_op, operand) {
-                    (Some(id), _) => {
-                        made += 1;
-                        ends.push(id);
-                        result.push(json!({"body": name, "made": format!("b{id}")}));
-                    }
-                    (None, Some(id)) => {
-                        ends.push(id);
-                        result.push(json!({"body": name, "operand": format!("b{id}")}));
-                    }
-                    (None, None) => why_not.push(format!(
-                        "body {name:?} is no kernel operation's output nor an operand: SolidCraft built it or changed the kernel's record"
-                    )),
-                }
-            }
-            if world.is_empty() {
-                why_not.push("the case ends with no body".into());
-            } else if made == 0 && why_not.is_empty() {
-                why_not.push("no kernel operation made a body the case ends with".into());
-            }
-            // Counts graded as SolidCraft merges them, where that differs from the records'.
-            let raw = |k: &str| -> u64 {
-                world
-                    .iter()
-                    .map(|(_, r)| match k {
-                        "faces" => r.faces.len(),
-                        "edges" => r.edges.len(),
-                        _ => r.vertices.len(),
-                    } as u64)
-                    .sum()
-            };
-            for k in ["faces", "edges", "vertices"] {
-                if let Some(merged) = out["measured"][k].as_u64().filter(|&m| has(k) && m != raw(k)) {
-                    ungraded.push(format!("{k}: graded merged across analytic surfaces ({merged}), the records have {}", raw(k)));
-                }
-            }
-            outcome["raw_counts"] = json!({"faces": raw("faces"), "edges": raw("edges"), "vertices": raw("vertices")});
-        }
-    }
-
-    let mut unknown = BTreeSet::new();
-    let mut available: BTreeSet<u64> = t.imports.keys().copied().collect();
-    for (_, inputs, _, outputs) in &t.calls {
-        unknown.extend(inputs.iter().filter(|id| !available.contains(id)).copied());
-        if let Ok(made) = outputs {
-            available.extend(made.iter().copied());
-        }
-    }
-    unknown.extend(ends.iter().filter(|id| !available.contains(id)).copied());
-    if !unknown.is_empty() {
-        why_not.push(format!("operands made by nothing traced: {unknown:?}"));
-    }
-    // Operand records: every body a call takes, or the case ends with, that came in as a record.
-    let mut bodies = BTreeMap::new();
-    let given = |id: u64, bodies: &mut BTreeMap<String, Value>| {
-        if let Some((record, trusted, splines)) = t.imports.get(&id) {
-            bodies.insert(format!("b{id}"), json!({"trusted": trusted, "keeping_splines": splines, "record": record}));
-        }
-    };
-    let mut calls: Vec<Value> = Vec::new();
-    for (i, (op, inputs, params, outputs)) in t.calls.iter().enumerate() {
-        for &id in inputs.iter() {
-            given(id, &mut bodies);
-        }
-        let mut c = json!({"op": op, "inputs": inputs.iter().map(|i| format!("b{i}")).collect::<Vec<_>>(), "params": params});
-        match outputs {
-            Ok(made) => c["outputs"] = json!(made.iter().map(|i| format!("b{i}")).collect::<Vec<_>>()),
-            Err(e) => {
-                c["error"] = json!(e);
-                // The application handled this refusal. Replay must continue to any later
-                // calls and grade the final bodies, even when this was the last attempt.
-                if failed_call != Some(i) {
-                    c["continued"] = json!(true);
-                }
-            }
-        }
-        calls.push(c);
-    }
-    for r in &result {
-        if let Some(id) = r["operand"].as_str().and_then(|b| b.strip_prefix('b')).and_then(|n| n.parse().ok()) {
-            given(id, &mut bodies);
-        }
-    }
-    let rig = json!({
-        "status": out["status"], "error": out["error"], "refused_with": out["refused_with"], "measured": out["measured"],
-        "known_failing": known_failing(dir, &id),
-    });
-    let operation_expressible = why_not.is_empty();
-    let entry = json!({
-        "case": id,
-        "area": area,
-        "sources": want["sources"],
-        "what": want["what"],
-        "expressible": operation_expressible && ungraded.is_empty(),
-        "operation_expressible": operation_expressible,
-        "why_not": why_not,
-        "ungraded": ungraded,
-        "expected": want,
-        "rig": rig,
-        "outcome": outcome,
-        "calls": calls,
-        "bodies": bodies,
-        "result": result,
-        "traced_ops": t.calls.iter().map(|c| c.0).collect::<Vec<_>>(),
-    });
-    let folder: PathBuf = root.join(&area);
-    std::fs::create_dir_all(&folder).map_err(|e| format!("{}: {e}", folder.display()))?;
-    let path = folder.join(format!("{id}.json"));
-    let text = serde_json::to_string(&entry).map_err(|e| e.to_string())?;
-    std::fs::write(&path, text).map_err(|e| format!("{}: {e}", path.display()))?;
-    // Cases run in parallel processes: each writes its own file and renames it over the shared
-    // one, so no reader sees a torn file (every process writes the same fix set).
-    let fixes = serde_json::to_string_pretty(&smlib_trace::fixes()).map_err(|e| e.to_string())?;
-    let own = root.join(format!("fixes.json.{}", std::process::id()));
-    std::fs::write(&own, fixes).map_err(|e| format!("{}: {e}", own.display()))?;
-    std::fs::rename(&own, root.join("fixes.json")).map_err(|e| format!("{}: {e}", root.display()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn empty_record() -> Brep {
-        Brep { version: 4, tolerance: 1e-6, regions: Vec::new(), shells: Vec::new(), faces: Vec::new(), edges: Vec::new(), vertices: Vec::new() }
-    }
-
-    fn call(op: &'static str, inputs: &[u64], outputs: Result<Vec<u64>, String>) -> Event {
-        Event::Call { op, inputs: inputs.to_vec(), params: json!({}), outputs }
-    }
-
-    fn exported_case(name: &str, events: Vec<Event>, ran: Result<Vec<(String, Brep)>, String>) -> Value {
-        let root = std::env::temp_dir().join(format!("solidcraft-export-{}-{name}", std::process::id()));
-        let dir = root.join("tests/kernel-cases/traces").join(name);
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(dir.join("expected.json"), "{}").unwrap();
-        let output = root.join("export");
-        write(&output, dir.to_str().unwrap(), &json!({"status": "pass"}), Capture { events, ran: Some(ran) }).unwrap();
-        let entry = output.join("traces").join(format!("{name}.json"));
-        serde_json::from_str(&std::fs::read_to_string(entry).unwrap()).unwrap()
-    }
-
-    #[test]
-    fn discarded_tool_construction_is_exported_in_execution_order() {
-        let record = empty_record();
-        let e = exported_case(
-            "discarded-tool",
-            vec![call("extrude", &[], Ok(vec![1])), call("extrude", &[], Ok(vec![2])), Event::Export { id: 1, record: Box::new(record.clone()) }],
-            Ok(vec![("Part".into(), record)]),
-        );
-        assert_eq!(e["calls"].as_array().unwrap().len(), 2);
-        assert_eq!(e["calls"][0]["outputs"], json!(["b1"]));
-        assert_eq!(e["calls"][1]["outputs"], json!(["b2"]));
-        assert_eq!(e["traced_ops"], json!(["extrude", "extrude"]));
-    }
-
-    #[test]
-    fn handled_refusals_are_exported_without_becoming_terminal() {
-        let record = empty_record();
-        let e = exported_case(
-            "handled-refusal",
-            vec![
-                call("extrude", &[], Ok(vec![1])),
-                call("fillet", &[1], Err("too large".into())),
-                call("fillet", &[1], Ok(vec![2])),
-                Event::Export { id: 2, record: Box::new(record.clone()) },
-            ],
-            Ok(vec![("Part".into(), record)]),
-        );
-        assert_eq!(e["calls"].as_array().unwrap().len(), 3);
-        assert_eq!(e["calls"][1]["error"], "too large");
-        assert_eq!(e["calls"][1]["continued"], true);
-    }
-
-    #[test]
-    fn a_handled_last_attempt_keeps_the_retained_body_as_the_result() {
-        let record = empty_record();
-        let e = exported_case(
-            "handled-last-attempt",
-            vec![
-                call("extrude", &[], Ok(vec![1])),
-                call("fillet", &[1], Err("too large".into())),
-                Event::Export { id: 1, record: Box::new(record.clone()) },
-            ],
-            Ok(vec![("Part".into(), record)]),
-        );
-        assert_eq!(e["calls"][1]["continued"], true);
-        assert_eq!(e["result"], json!([{"body": "Part", "made": "b1"}]));
-        assert_eq!(e["operation_expressible"], true);
-    }
-
-    #[test]
-    fn the_final_refusal_still_ends_replay() {
-        let e = exported_case(
-            "terminal-refusal",
-            vec![
-                call("extrude", &[], Ok(vec![1])),
-                call("fillet", &[1], Err("too large".into())),
-                call("fillet", &[1], Err("no room".into())),
-                call("copy", &[1], Ok(vec![2])),
-            ],
-            Err("no room".into()),
-        );
-        assert_eq!(e["calls"].as_array().unwrap().len(), 4);
-        assert_eq!(e["calls"][1]["continued"], true);
-        assert!(e["calls"][2].get("continued").is_none());
-        assert_eq!(e["outcome"]["kernel_error"], "no room");
-    }
-
-    #[test]
-    fn discarded_operations_still_require_their_operand_records() {
-        let record = empty_record();
-        let e = exported_case(
-            "missing-tool-operand",
-            vec![call("extrude", &[], Ok(vec![1])), call("copy", &[99], Ok(vec![2])), Event::Export { id: 1, record: Box::new(record.clone()) }],
-            Ok(vec![("Part".into(), record)]),
-        );
-        assert_eq!(e["operation_expressible"], false);
-        assert!(e["why_not"].as_array().unwrap().iter().any(|why| why.as_str().unwrap().contains("99")));
-    }
-
-    #[test]
-    fn discarded_operations_keep_their_imported_operands() {
-        let record = empty_record();
-        let e = exported_case(
-            "imported-tool-operand",
-            vec![
-                call("extrude", &[], Ok(vec![1])),
-                Event::Import { id: 9, record: Box::new(record.clone()), trusted: false, keeping_splines: true },
-                call("copy", &[9], Ok(vec![2])),
-                Event::Export { id: 1, record: Box::new(record.clone()) },
-            ],
-            Ok(vec![("Part".into(), record.clone())]),
-        );
-        assert_eq!(e["bodies"]["b9"], json!({"record": record, "trusted": false, "keeping_splines": true}));
-        assert_eq!(e["calls"][1]["inputs"], json!(["b9"]));
-        assert_eq!(e["operation_expressible"], true);
-    }
-
-    #[test]
-    fn a_later_output_cannot_supply_an_earlier_discarded_operation() {
-        let record = empty_record();
-        let e = exported_case(
-            "future-tool-operand",
-            vec![call("copy", &[9], Ok(vec![2])), call("extrude", &[], Ok(vec![9])), Event::Export { id: 9, record: Box::new(record.clone()) }],
-            Ok(vec![("Part".into(), record)]),
-        );
-        assert_eq!(e["operation_expressible"], false);
-        assert!(e["why_not"].as_array().unwrap().iter().any(|why| why.as_str().unwrap().contains("9")));
-    }
-
-    #[test]
-    fn the_area_is_the_path_under_kernel_cases() {
-        assert_eq!(area_and_id("tests/kernel-cases/booleans/1894-x").unwrap(), ("booleans".into(), "1894-x".into()));
-        assert_eq!(area_and_id("/r/tests/kernel-cases/ladder/07-fillets/003-y").unwrap(), ("ladder/07-fillets".into(), "003-y".into()));
-        assert!(area_and_id("/r/other/x").is_err());
-    }
-}

apps/solidcraft-cli/src/logger.rs

@@ -1,49 +0,0 @@
-//! What the engine logs (`log::info!`, `log::debug!`: why a body has no display plan, why a save
-//! left its model cache out), written to stderr. Off unless asked for, so the CLI's output and
-//! the scripts reading it stay as they are: `--debug` shows SolidCraft's own debug messages (and
-//! other crates' warnings, whose debug output is large), `RUST_LOG=error|warn|info|debug|trace`
-//! sets one level for every crate.
-
-use log::{LevelFilter, Log, Metadata, Record};
-
-struct Stderr {
-    /// The level for SolidCraft's crates.
-    ours: LevelFilter,
-    /// The level for every other crate.
-    others: LevelFilter,
-}
-
-impl Log for Stderr {
-    fn enabled(&self, m: &Metadata) -> bool {
-        m.level() <= if m.target().starts_with("solidcraft") { self.ours } else { self.others }
-    }
-
-    fn log(&self, r: &Record) {
-        if self.enabled(r.metadata()) {
-            use std::io::Write as _;
-            // A closed stderr is no reason to stop.
-            let _ = writeln!(std::io::stderr().lock(), "[{} {}] {}", r.level().as_str().to_ascii_lowercase(), r.target(), r.args());
-        }
-    }
-
-    fn flush(&self) {}
-}
-
-/// Removes `--debug` from `args`, wherever it is (every subcommand takes it), and installs the
-/// logger when it or `RUST_LOG` asks for one.
-pub fn init(args: &mut Vec<String>) {
-    let before = args.len();
-    args.retain(|a| a != "--debug");
-    let debug = args.len() != before;
-    let env = std::env::var("RUST_LOG").ok().and_then(|v| v.trim().parse::<LevelFilter>().ok());
-    let (ours, others) = match (debug, env) {
-        (false, Some(all)) => (all, all),
-        (true, Some(all)) => (all.max(LevelFilter::Debug), all),
-        (true, None) => (LevelFilter::Debug, LevelFilter::Warn),
-        (false, None) => return,
-    };
-    // Installed once, for the life of the process.
-    if log::set_logger(Box::leak(Box::new(Stderr { ours, others }))).is_ok() {
-        log::set_max_level(ours.max(others));
-    }
-}

apps/solidcraft-cli/src/oracle.rs

@@ -5,7 +5,7 @@
 #![allow(clippy::needless_range_loop)]
 
 use serde_json::{Value, json};
-use solidcore_record::Vec3;
+use solidcraft_engine::geom::Vec3;
 
 use crate::spatial::{self, Tri};
 use crate::{read_json, recipe};
@@ -13,28 +13,28 @@ use crate::{read_json, recipe};
 /// Default relative tolerance for volume and area (our curved-face tessellation is within ~2e-4).
 pub const REL_TOL: f64 = 1e-3;
 /// Default tolerance for centre of mass and bounding box, as a fraction of the bbox diagonal.
-pub(crate) const ABS_FRAC: f64 = 1e-3;
+const ABS_FRAC: f64 = 1e-3;
 /// Chord tolerance used to triangulate our part for the surface-distance check (mm).
 const MESH_TOL: f64 = 0.01;
 /// Relative tolerance on the principal second moments of the two triangulations.
 const INERTIA_REL: f64 = 2e-3;
 
 /// What SolidCraft built: totals over every body.
-pub(crate) struct Got {
-    pub(crate) body_count: usize,
-    pub(crate) volume: f64,
-    pub(crate) area: f64,
-    pub(crate) com: [f64; 3],
-    pub(crate) bbox: ([f64; 3], [f64; 3]),
-    pub(crate) faces: u64,
+struct Got {
+    body_count: usize,
+    volume: f64,
+    area: f64,
+    com: [f64; 3],
+    bbox: ([f64; 3], [f64; 3]),
+    faces: u64,
 }
 
-pub(crate) fn v3(v: &Value) -> Option<[f64; 3]> {
+fn v3(v: &Value) -> Option<[f64; 3]> {
     let a = v.as_array()?;
     Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?, a.get(2)?.as_f64()?])
 }
 
-pub(crate) fn totals(m: &Value) -> Got {
+fn totals(m: &Value) -> Got {
     let bodies = m["bodies"].as_array().cloned().unwrap_or_default();
     let (mut volume, mut area, mut faces) = (0.0, 0.0, 0);
     let mut moment = [0.0; 3];
@@ -57,21 +57,21 @@ pub(crate) fn totals(m: &Value) -> Got {
     Got { body_count: bodies.len(), volume, area, com, bbox: (lo, hi), faces }
 }
 
-pub(crate) struct Checks {
-    pub(crate) list: Vec<Value>,
-    pub(crate) pass: bool,
+struct Checks {
+    list: Vec<Value>,
+    pass: bool,
 }
 
 impl Checks {
-    pub(crate) fn push(&mut self, what: &str, got: Value, want: Value, ok: bool) {
+    fn push(&mut self, what: &str, got: Value, want: Value, ok: bool) {
         self.pass &= ok;
         self.list.push(json!({"check": what, "got": got, "want": want, "ok": ok}));
     }
-    pub(crate) fn rel(&mut self, what: &str, g: f64, w: Option<f64>, rel: f64) {
+    fn rel(&mut self, what: &str, g: f64, w: Option<f64>, rel: f64) {
         let ok = w.is_some_and(|w| g.is_finite() && (g - w).abs() <= rel * w.abs().max(1.0));
         self.push(what, json!(g), json!(w), ok);
     }
-    pub(crate) fn vec(&mut self, what: &str, g: [f64; 3], w: Option<[f64; 3]>, tol: f64) {
+    fn vec(&mut self, what: &str, g: [f64; 3], w: Option<[f64; 3]>, tol: f64) {
         let ok = w.is_some_and(|w| g.iter().zip(w).all(|(g, w)| g.is_finite() && (g - w).abs() <= tol));
         self.push(what, json!(g), json!(w), ok);
     }
@@ -186,8 +186,8 @@ fn step_export_check(s: &solidcraft_engine::Session, volume: f64) -> (bool, Stri
 /// Our part as a triangle soup (curved faces refined onto the surface).
 fn our_mesh(s: &solidcraft_engine::Session) -> Result<Vec<Tri>, String> {
     let mut ours: Vec<Tri> = Vec::new();
-    for b in &s.world_state().map_err(|e| e.to_string())?.bodies {
-        let m = b.body.mesh(&solidcraft_engine::kernel::MeshTolerance::chord(MESH_TOL)).map_err(|e| e.to_string())?;
+    for b in &s.world_state().bodies {
+        let m = b.body.tessellate_with(MESH_TOL, true).map_err(|e| e.to_string())?;
         let p = |i: u32| m.positions.get(i as usize).map(|v: &Vec3| [v.x, v.y, v.z]);
         for t in &m.triangles {
             if let (Some(a), Some(b), Some(c)) = (p(t[0]), p(t[1]), p(t[2])) {

apps/solidcraft-cli/src/preview.rs

@@ -1,286 +0,0 @@
-//! What a `snapshot` draws see-through, what it draws in a colour of its own, and where it cuts
-//! the model: the `--body`, `--tool` and `--section` options.
-//!
-//! None of this is a renderer of its own. Each option turns into the command the app itself runs
-//! — `appearance.assign` for the Appearance dialog, `inspect.section` for Section Analysis — so
-//! a picture of a tool body inside a translucent target is the picture the window would show
-//! with the same appearances assigned, and a script can do the same thing without the options.
-
-use serde_json::{Value, json};
-use solidcraft_engine::Session;
-
-/// How see-through the bodies around a `--tool` are drawn: enough to read the tool through them,
-/// solid enough to keep the shape of the material it meets.
-pub const TARGET_OPACITY: f64 = 0.3;
-
-/// A `--tool` body's colour: the hue the viewport's feature preview uses for removed material,
-/// so a cut's tool looks in a picture the way the preview looks in the window.
-pub const TOOL_COLOR: &str = "#e8542c";
-
-/// The colour of a body with no appearance of its own ([`solidcraft_engine::view::colors::BODY`]),
-/// as `appearance.assign` takes it. Giving a body an opacity means giving it a look, and a look
-/// carries a colour: this keeps the one it is already drawn in.
-fn default_body_hex() -> String {
-    let c = solidcraft_engine::view::colors::BODY;
-    format!("#{:02x}{:02x}{:02x}", c.0, c.1, c.2)
-}
-
-/// How one body is drawn: `--body NAME:opacity=0.3,color=#cc3333`. Either key alone is enough;
-/// the other keeps what the design already says.
-#[derive(Debug, PartialEq)]
-pub struct BodyLook {
-    pub name: String,
-    pub opacity: Option<f64>,
-    pub color: Option<String>,
-}
-
-/// `NAME:key=value[,key=value]`, or `NAME` on its own (which says nothing and is an error:
-/// a body is named here to change how it is drawn).
-pub fn parse_body(spec: &str) -> Result<BodyLook, String> {
-    let (name, rest) = spec
-        .split_once(':')
-        .ok_or_else(|| format!("--body `{spec}` must be NAME:key=value (`Target:opacity=0.3`, `Tool:color=#cc3333`, keys separated by commas)"))?;
-    let name = name.trim();
-    if name.is_empty() {
-        return Err(format!("--body `{spec}` names no body"));
-    }
-    let mut look = BodyLook { name: name.to_owned(), opacity: None, color: None };
-    for part in rest.split(',') {
-        let part = part.trim();
-        if part.is_empty() {
-            continue;
-        }
-        let (key, value) = part.split_once('=').ok_or_else(|| format!("--body {name}: `{part}` must be key=value (opacity, color)"))?;
-        let value = value.trim();
-        match key.trim().to_ascii_lowercase().as_str() {
-            "opacity" => {
-                let o: f64 = value.parse().map_err(|_| format!("--body {name}: opacity must be a number 0 to 1, not `{value}`"))?;
-                if !o.is_finite() || !(0.0..=1.0).contains(&o) {
-                    return Err(format!("--body {name}: opacity must be 0 to 1, not `{value}`"));
-                }
-                look.opacity = Some(o);
-            }
-            "color" => {
-                let digits = value.strip_prefix('#').filter(|h| h.len() == 6 && h.chars().all(|c| c.is_ascii_hexdigit()));
-                let digits = digits.ok_or_else(|| format!("--body {name}: color must be #rrggbb, not `{value}`"))?;
-                look.color = Some(format!("#{}", digits.to_ascii_lowercase()));
-            }
-            other => return Err(format!("--body {name}: unknown key `{other}` (opacity, color)")),
-        }
-    }
-    if look.opacity.is_none() && look.color.is_none() {
-        return Err(format!("--body `{spec}` asks for nothing: give opacity, color, or both"));
-    }
-    Ok(look)
-}
-
-/// The `inspect.section` parameters a `--section` spec asks for: `z=27` (the plane through that
-/// world coordinate, its normal along +Z), `XY` (a named plane through the origin), either with
-/// `,flip` to keep the other side, or the command's own JSON object.
-pub fn parse_section(spec: &str) -> Result<Value, String> {
-    let spec = spec.trim();
-    if spec.starts_with('{') {
-        return serde_json::from_str(spec).map_err(|e| format!("--section: not JSON: {e}"));
-    }
-    let mut parts = spec.split(',').map(str::trim);
-    let plane = parts.next().unwrap_or_default();
-    let mut flip = false;
-    for p in parts {
-        match p.to_ascii_lowercase().as_str() {
-            "" => {}
-            "flip" => flip = true,
-            other => return Err(format!("--section: unknown `{other}` (only `flip` follows the plane)")),
-        }
-    }
-    // A named plane through the world origin, as `inspect.section` takes it.
-    let mut params = match plane.to_ascii_uppercase().as_str() {
-        p @ ("XY" | "XZ" | "YZ") => json!({"plane": p}),
-        _ => {
-            // AXIS=VALUE: the plane whose normal is that axis, cutting at that world coordinate.
-            let (axis, at) = plane.split_once('=').ok_or_else(|| {
-                format!("--section `{spec}` must be z=27 (a world coordinate on an axis), XY, XZ, YZ, or the JSON inspect.section takes")
-            })?;
-            let at: f64 = at.trim().parse().map_err(|_| format!("--section {axis}: `{}` is not a number", at.trim()))?;
-            if !at.is_finite() {
-                return Err(format!("--section {axis}: `{at}` is not a finite coordinate"));
-            }
-            // The plane normal to each axis: Z is XY, Y is XZ, X is YZ.
-            let named = match axis.trim().to_ascii_lowercase().as_str() {
-                "x" => "YZ",
-                "y" => "XZ",
-                "z" => "XY",
-                other => return Err(format!("--section: unknown axis `{other}` (x, y or z)")),
-            };
-            json!({"plane": named, "at": at})
-        }
-    };
-    if flip {
-        params["flip"] = json!(true);
-    }
-    Ok(params)
-}
-
-/// The design's body names, for an error that says which ones there are.
-fn body_names(s: &Session) -> Vec<String> {
-    s.model.state().bodies.iter().map(|b| b.name.clone()).collect()
-}
-
-/// The colour and opacity a body is drawn with now, as `appearance.assign` takes them: its own
-/// appearance, else its component's or material's, else the default body colour.
-fn current_look(s: &mut Session, name: &str) -> Result<(String, f64), String> {
-    let reply = s.execute("appearance.list", &json!({"body": name})).map_err(|e| e.to_string())?;
-    let body = reply.get("body");
-    let look = body.and_then(|b| b.get("appearance")).filter(|a| !a.is_null());
-    let hex = look
-        .and_then(|a| a.get("color"))
-        .and_then(Value::as_str)
-        .map(str::to_owned)
-        // No appearance, but an imported colour: `body.color` is that colour, 0..1 per channel.
-        .or_else(|| {
-            let c = body?.get("color")?.as_array()?;
-            let ch = |i: usize| -> Option<u8> { Some((c.get(i)?.as_f64()?.clamp(0.0, 1.0) * 255.0).round() as u8) };
-            Some(format!("#{:02x}{:02x}{:02x}", ch(0)?, ch(1)?, ch(2)?))
-        })
-        .unwrap_or_else(default_body_hex);
-    let opacity = look.and_then(|a| a.get("opacity")).and_then(Value::as_f64).filter(|o| o.is_finite()).unwrap_or(1.0);
-    Ok((hex, opacity))
-}
-
-/// Draw `name` with `look`, keeping whichever of colour and opacity it does not give.
-fn assign(s: &mut Session, look: &BodyLook) -> Result<(), String> {
-    let name = &look.name;
-    if !body_names(s).iter().any(|b| b == name) {
-        return Err(format!("no body `{name}` in the design (it has {})", body_list(s)));
-    }
-    let (hex, opacity) = current_look(s, name)?;
-    let params = json!({
-        "bodies": [name],
-        "color": look.color.clone().unwrap_or(hex),
-        "opacity": look.opacity.unwrap_or(opacity),
-    });
-    s.execute("appearance.assign", &params).map(|_| ()).map_err(|e| format!("drawing `{name}`: {e}"))
-}
-
-/// The design's bodies, named, for an error message.
-fn body_list(s: &Session) -> String {
-    let names = body_names(s);
-    if names.is_empty() { "no bodies".to_owned() } else { names.join(", ") }
-}
-
-/// Apply the options to the session, in the order a later one overrides an earlier: the `--tool`
-/// preview first (it speaks for every body), then each `--body`, then the section.
-pub fn apply(s: &mut Session, bodies: &[&str], tools: &[&str], section: Option<&str>) -> Result<(), String> {
-    // Everything is read before anything is drawn, so a misspelt option is an error rather than
-    // half a picture.
-    let looks: Vec<BodyLook> = bodies.iter().map(|spec| parse_body(spec)).collect::<Result<_, _>>()?;
-    let section = section.map(parse_section).transpose()?;
-    if !tools.is_empty() {
-        let names = body_names(s);
-        for t in tools {
-            if !names.iter().any(|b| b == t) {
-                return Err(format!("--tool: no body `{t}` in the design (it has {})", body_list(s)));
-            }
-        }
-        // Everything but the tool see-through, in the colour it already has, so the tool reads
-        // against the material it meets. Bodies that share a colour are assigned together: a
-        // design of many bodies then costs a command or two rather than one for each.
-        let mut around: std::collections::BTreeMap<String, Vec<String>> = std::collections::BTreeMap::new();
-        for name in names.iter().filter(|n| !tools.contains(&n.as_str())) {
-            around.entry(current_look(s, name)?.0).or_default().push(name.clone());
-        }
-        for (hex, sharing_it) in around {
-            let params = json!({"bodies": sharing_it, "color": hex, "opacity": TARGET_OPACITY});
-            s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
-        }
-        // Then the tool itself, solid in the tool colour.
-        let params = json!({"bodies": tools, "color": TOOL_COLOR, "opacity": 1.0});
-        s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
-    }
-    for look in &looks {
-        assign(s, look)?;
-    }
-    if let Some(params) = section {
-        s.execute("inspect.section", &params).map_err(|e| format!("--section: {e}"))?;
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// `--body` names a body and says how it is drawn. Either key alone is enough.
-    #[test]
-    fn a_body_spec_is_a_name_and_the_keys_appearance_assign_takes() {
-        let look = |s: &str| parse_body(s).unwrap();
-        assert_eq!(look("Target:opacity=0.3"), BodyLook { name: "Target".into(), opacity: Some(0.3), color: None });
-        assert_eq!(look("Tool:color=#CC3333"), BodyLook { name: "Tool".into(), opacity: None, color: Some("#cc3333".into()) });
-        assert_eq!(look("Tool: opacity = 1 , color = #00ff00 "), BodyLook { name: "Tool".into(), opacity: Some(1.0), color: Some("#00ff00".into()) });
-        // A body name with a space in it, as the browser shows them.
-        assert_eq!(look("Bracket arm:opacity=0").name, "Bracket arm");
-        assert_eq!(look("A:opacity=0").opacity, Some(0.0));
-    }
-
-    /// Every way of getting `--body` wrong is an error that says what it takes, never a panic
-    /// and never a silently ignored option.
-    #[test]
-    fn a_bad_body_spec_says_what_it_takes() {
-        for (spec, expect) in [
-            ("Target", "NAME:key=value"),
-            (":opacity=0.3", "names no body"),
-            ("Target:", "asks for nothing"),
-            ("Target:opacity", "key=value"),
-            ("Target:opacity=high", "0 to 1"),
-            ("Target:opacity=1.5", "0 to 1"),
-            ("Target:opacity=-0.2", "0 to 1"),
-            ("Target:opacity=NaN", "0 to 1"),
-            ("Target:opacity=inf", "0 to 1"),
-            ("Target:color=red", "#rrggbb"),
-            ("Target:color=#ccc", "#rrggbb"),
-            ("Target:color=#gggggg", "#rrggbb"),
-            ("Target:alpha=0.3", "unknown key `alpha`"),
-        ] {
-            let e = parse_body(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
-            assert!(e.contains(expect), "{spec}: {e}");
-        }
-    }
-
-    /// A `--section` spec is the plane `inspect.section` cuts with: an axis and a world
-    /// coordinate, a named plane, `flip` for the other side, or the command's own JSON.
-    #[test]
-    fn a_section_spec_is_the_plane_inspect_section_takes() {
-        let p = |s: &str| parse_section(s).unwrap();
-        // The plane normal to each axis, cutting at that coordinate.
-        assert_eq!(p("z=27"), json!({"plane": "XY", "at": 27.0}));
-        assert_eq!(p("y=-5.5"), json!({"plane": "XZ", "at": -5.5}));
-        assert_eq!(p("X=0"), json!({"plane": "YZ", "at": 0.0}));
-        assert_eq!(p("z=27,flip"), json!({"plane": "XY", "at": 27.0, "flip": true}));
-        // A named plane through the origin, and the command's own parameters.
-        assert_eq!(p("XY"), json!({"plane": "XY"}));
-        assert_eq!(p("yz,flip"), json!({"plane": "YZ", "flip": true}));
-        assert_eq!(p("{\"plane\": \"XY\", \"offset\": 4}"), json!({"plane": "XY", "offset": 4}));
-    }
-
-    #[test]
-    fn a_bad_section_spec_says_what_it_takes() {
-        for (spec, expect) in [
-            ("27", "z=27"),
-            ("w=4", "unknown axis `w`"),
-            ("z=high", "is not a number"),
-            ("z=inf", "not a finite coordinate"),
-            ("z=27,upside-down", "unknown `upside-down`"),
-            ("{\"plane\":", "not JSON"),
-        ] {
-            let e = parse_section(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
-            assert!(e.contains(expect), "{spec}: {e}");
-        }
-    }
-
-    /// The tool colour is the one the options document, in the form `appearance.assign` takes.
-    #[test]
-    fn the_tool_colour_is_a_hex_colour_the_command_takes() {
-        assert_eq!(parse_body(&format!("Tool:color={TOOL_COLOR}")).unwrap().color, Some(TOOL_COLOR.to_owned()));
-        assert!((0.0..1.0).contains(&TARGET_OPACITY), "a target must be see-through: {TARGET_OPACITY}");
-        assert_eq!(default_body_hex(), "#b0bac6");
-    }
-}

apps/solidcraft-cli/src/profiling.rs

@@ -1,50 +0,0 @@
-//! `--profile` and `--profile-out FILE` for `run`, `eval` and `bench-open` (and
-//! `SOLIDCRAFT_PROFILE=1` for any command): record where the time goes, the kernel's calls to the
-//! commands, print the table to stderr when the command ends (stdout stays the command's JSON)
-//! and write the spans as a Chrome trace for chrome://tracing or Perfetto.
-
-use solidcraft_engine::profile;
-
-/// Rows the table prints.
-const TOP: usize = 30;
-
-/// A recording that prints its table when finished.
-pub struct Profiling {
-    trace: Option<String>,
-}
-
-/// Start recording when `args` (after the command) ask for it, or `SOLIDCRAFT_PROFILE` does.
-pub fn start(args: &[String]) -> Result<Option<Profiling>, String> {
-    let trace = match args.iter().position(|a| a == "--profile-out") {
-        Some(i) => match args.get(i + 1) {
-            Some(f) if !f.starts_with("--") => Some(f.clone()),
-            _ => return Err("--profile-out needs a FILE".into()),
-        },
-        None => None,
-    };
-    let asked = trace.is_some() || args.iter().any(|a| a == "--profile");
-    if !asked && !solidcraft_engine::timing::profile_from_env() {
-        return Ok(None);
-    }
-    if !profile::COMPILED {
-        return Err("this solidcraft-cli was built without the profiler (its `profile` feature)".into());
-    }
-    profile::reset();
-    profile::set_enabled(true);
-    Ok(Some(Profiling { trace }))
-}
-
-impl Profiling {
-    /// Stop recording, print the table on stderr and write the trace.
-    pub fn finish(self) -> Result<(), String> {
-        profile::set_enabled(false);
-        eprint!("{}", profile::report().table(TOP));
-        if let Some(path) = self.trace {
-            let mut bytes = Vec::new();
-            profile::write_chrome_trace(&mut bytes).map_err(|e| format!("{path}: {e}"))?;
-            std::fs::write(&path, bytes).map_err(|e| format!("{path}: {e}"))?;
-            eprintln!("profile: trace written to {path} (open it in chrome://tracing or ui.perfetto.dev)");
-        }
-        Ok(())
-    }
-}

apps/solidcraft-cli/src/recipe.rs

@@ -423,24 +423,6 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                     "sketch": profile_sketch(f), "profiles": profiles_of(f), "path_sketch": path.get("sketch"), "path": path.get("curves"),
                     "operation": op(f), "name": name, "body_names": bodies}}));
             }
-            // A boundary surface: a loop of one sketch's curves (`sketch`, `curves`), or a network
-            // (`u`, `v`), as `surface.boundary` takes them.
-            Some("boundary_surface") => {
-                let mut p = json!({"name": name});
-                for k in ["sketch", "curves", "continuity", "u", "v", "operation"] {
-                    if let Some(v) = f.get(k) {
-                        p[k] = v.clone();
-                    }
-                }
-                if let Some(b) = bodies.as_array().and_then(|a| a.first()) {
-                    p["body_name"] = b.clone();
-                }
-                out.push(json!({"command": "surface.boundary", "params": p}));
-            }
-            Some("thicken") => out.push(json!({"command": "surface.thicken", "params": {
-                "bodies": f.get("bodies"), "thickness": f.get("thickness"), "symmetric": f.get("symmetric").cloned().unwrap_or(json!(false)),
-                "operation": op(f), "name": name}})),
-            Some("remove") => out.push(json!({"command": "solid.remove", "params": {"bodies": f.get("bodies"), "name": name}})),
             Some("shell") => {
                 let faces: Vec<Value> = f.get("faces_removed").and_then(Value::as_array).into_iter().flatten().filter_map(|x| x.get("point").cloned()).collect();
                 out.push(json!({"command": "solid.shell", "params": {"faces": faces, "thickness": f.get("inside_thickness"), "name": name}}));

apps/solidcraft-cli/src/render.rs

@@ -1,89 +1,25 @@
 //! Complete headless image-job workflow through the same engine commands as the UI/MCP.
-use serde_json::{Value, json};
+use serde_json::json;
 use solidcraft_engine::{
-    Session,
-    doc::render_settings::{RenderJob, RenderSetup},
-    render::job::{CpuHost, JobId, Phase, ToneMap},
+    doc::render_settings::RenderSetup,
+    render::job::{CpuHost, JobId, Phase},
 };
 
-/// Only explicit runtime CLI flags are stored here. A typed setup owns these
-/// values even when a supplied flag happens to match the saved value.
-#[derive(Default)]
-struct RuntimeOptions {
-    progressive: bool,
-    transparent: bool,
-    samples: Option<u32>,
-    max_depth: Option<u32>,
-    seed: Option<u32>,
-    lighting: Option<String>,
-    tone_map: Option<ToneMap>,
-    environment: Option<String>,
-}
-
-impl RuntimeOptions {
-    fn explicit_flag(&self) -> Option<&'static str> {
-        [
-            (self.progressive, "--progressive"),
-            (self.transparent, "--transparent"),
-            (self.samples.is_some(), "--samples"),
-            (self.max_depth.is_some(), "--max-depth"),
-            (self.seed.is_some(), "--seed"),
-            (self.lighting.is_some(), "--lighting"),
-            (self.tone_map.is_some(), "--tone-map"),
-            (self.environment.is_some(), "--environment"),
-        ]
-        .into_iter()
-        .find_map(|(present, flag)| present.then_some(flag))
-    }
-
-    fn request(&self, session: &Session, settings: RenderSetup) -> Result<(Value, bool), String> {
-        if let Some(job) = &settings.job {
-            if let Some(flag) = self.explicit_flag() {
-                return Err(format!("{flag} cannot accompany a typed saved render setup; change the saved job options instead"));
-            }
-            settings.validate().map_err(|e| e.to_string())?;
-            session.doc.render.validate_resources(&settings).map_err(|e| e.to_string())?;
-            let needs_gpu = matches!(job, RenderJob::GpuPath { .. });
-            return Ok((json!({"settings":settings}), needs_gpu));
-        }
-        // Legacy setups and unnamed requests retain their runtime wire contract.
-        settings.validate().map_err(|e| e.to_string())?;
-        let mut params = json!({"settings":settings,"transparent_background":self.transparent,
-            "progressive":self.progressive,"samples":self.samples,"max_depth":self.max_depth,"seed":self.seed});
-        if let Some(path) = &self.lighting {
-            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read lighting: {e}"))?;
-            let lighting: solidcraft_engine::render::job::StudioLighting = serde_json::from_str(&text).map_err(|e| e.to_string())?;
-            params["lighting"] = json!(lighting);
-        }
-        if let Some(tone_map) = self.tone_map {
-            params["tone_map"] = json!(tone_map);
-        }
-        if let Some(path) = &self.environment {
-            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read environment: {e}"))?;
-            params["environment"] = serde_json::from_str(&text).map_err(|e| e.to_string())?;
-        }
-        Ok((params, self.progressive))
-    }
-}
-
 pub fn run(args: &[String]) -> Result<(), String> {
     let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
     let mut out = None;
     let mut setup = None;
     let mut width = None;
     let mut height = None;
-    let mut exposure = None;
-    let mut runtime = RuntimeOptions::default();
+    let mut transparent = false;
     let mut overwrite = false;
     let mut timeout = 120u64;
     let mut i = 1;
     while let Some(arg) = args.get(i) {
         match arg.as_str() {
-            "--progressive" => runtime.progressive = true,
-            "--transparent" => runtime.transparent = true,
+            "--transparent" => transparent = true,
             "--overwrite" => overwrite = true,
-            "--out" | "--setup" | "--width" | "--height" | "--timeout" | "--samples" | "--max-depth" | "--seed" | "--exposure" | "--lighting"
-            | "--tone-map" | "--environment" => {
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" => {
                 i += 1;
                 let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
                 match arg.as_str() {
@@ -91,20 +27,6 @@ pub fn run(args: &[String]) -> Result<(), String> {
                     "--setup" => setup = Some(value.clone()),
                     "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
                     "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
-                    "--samples" => runtime.samples = Some(value.parse::<u32>().map_err(|_| "invalid samples")?),
-                    "--max-depth" => runtime.max_depth = Some(value.parse::<u32>().map_err(|_| "invalid depth")?),
-                    "--seed" => runtime.seed = Some(value.parse::<u32>().map_err(|_| "invalid seed")?),
-                    "--exposure" => exposure = Some(value.parse::<f64>().map_err(|_| "invalid exposure")?),
-                    // Defer file reads until a saved job has rejected conflicting controls.
-                    "--environment" => runtime.environment = Some(value.clone()),
-                    "--lighting" => runtime.lighting = Some(value.clone()),
-                    "--tone-map" => {
-                        runtime.tone_map = Some(match value.as_str() {
-                            "reinhard" => ToneMap::Reinhard,
-                            "aces_fitted" => ToneMap::AcesFitted,
-                            _ => return Err("tone-map must be reinhard or aces_fitted".into()),
-                        })
-                    }
                     _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
                 }
             }
@@ -117,10 +39,18 @@ pub fn run(args: &[String]) -> Result<(), String> {
     }
     let out = out.ok_or("render requires --out FILE.png")?;
     let mut session = crate::load(input)?;
-    let mut settings = if let Some(name) = setup.as_deref() {
-        session.doc.render.setups.get(name).cloned().ok_or("no saved render setup with that name")?
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    let mut settings = if let Some(name) = setup {
+        session.doc.render.setups.get(&name).cloned().ok_or("no saved render setup with that name")?
     } else {
-        RenderSetup::default()
+        let mut settings = RenderSetup::default();
+        if let Some(camera) = session.camera {
+            settings.camera = camera;
+        } else {
+            settings.camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+        }
+        settings
     };
     if let Some(width) = width {
         settings.width = width;
@@ -128,27 +58,7 @@ pub fn run(args: &[String]) -> Result<(), String> {
     if let Some(height) = height {
         settings.height = height;
     }
-    if let Some(exposure) = exposure {
-        settings.exposure_ev = exposure;
-    }
-    // Resolve saved intent before opening a GPU or explicitly settling geometry.
-    // Width/height/exposure only change this validated inline settings clone.
-    let (mut params, needs_gpu) = runtime.request(&session, settings)?;
-    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
-    if needs_gpu {
-        session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
-    }
-    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
-    if setup.is_none() {
-        let camera = if let Some(camera) = session.camera {
-            camera
-        } else {
-            let mut camera = RenderSetup::default().camera;
-            camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
-            camera
-        };
-        params["settings"]["camera"] = json!(camera);
-    }
+    let params = json!({"settings":settings,"transparent_background":transparent});
     let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
     let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
     let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;

apps/solidcraft-cli/tests/action_matrix.rs

@@ -21,7 +21,6 @@
 //! Each design runs in a child process (this test binary, [`action_matrix_worker`]) so an action
 //! that hangs or aborts is recorded as such and the rest of the design still runs.
 
-use solidcraft_engine::geom::prelude::*;
 use std::collections::{BTreeMap, BTreeSet};
 use std::io::{BufRead, Write};
 use std::path::{Path, PathBuf};
@@ -29,10 +28,10 @@ use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
 use serde_json::{Value, json};
-use solidcore_record::Vec3;
 use solidcraft_engine::Session;
 use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
 use solidcraft_engine::doc::{FaceAttachmentStatus, ModelBody, naming};
+use solidcraft_engine::geom::Vec3;
 
 /// One in this many actions runs on pull requests (by a stable hash of its key).
 const PR_SAMPLE: u64 = 40;
@@ -93,7 +92,7 @@ fn designs() -> Vec<(String, PathBuf)> {
     add("regressions", root.join("examples/regressions"), "json");
     add("demo", root.join("examples/demo"), "json");
     add("typical", root.join("tests/action_matrix/designs"), "json");
-    add("demo", root.join("tests/action_matrix/designs"), solidcraft_engine::io::DESIGN_EXT);
+    add("demo", root.join("tests/action_matrix/designs"), "solidcraft");
     let mut cases: Vec<PathBuf> =
         std::fs::read_dir(root.join("tests/oracle")).unwrap().flatten().map(|e| e.path()).filter(|p| p.join("recipe.json").is_file()).collect();
     cases.sort();
@@ -106,7 +105,7 @@ fn designs() -> Vec<(String, PathBuf)> {
 /// Build a design from its file.
 fn load(path: &Path) -> Result<Session, String> {
     let mut s = Session::default();
-    if solidcraft_engine::io::is_design_container_path(path) {
+    if path.extension().is_some_and(|x| x == "solidcraft") {
         s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
         return Ok(s);
     }
@@ -197,7 +196,7 @@ fn round3(x: f64) -> f64 {
 
 /// Every action on every entity of the design's final bodies, in a fixed order.
 fn actions(s: &Session) -> Vec<Action> {
-    let st = s.world_state().unwrap();
+    let st = s.world_state();
     let placed = s.placed_document();
     let paths: BTreeMap<String, Vec<u64>> =
         placed.body_frames_with_source(&s.model.state()).into_iter().map(|(world, _, _, path, _)| (world, path)).collect();
@@ -351,7 +350,7 @@ fn actions(s: &Session) -> Vec<Action> {
         // The surface's normal at `p` (either way round): exact on analytic faces.
         let normal_at = |f: u32, p: Vec3| -> Option<Vec3> {
             match face_surface(&b.body, f as usize) {
-                Some(FaceSurface::Plane { normal, .. }) => Some(*normal),
+                Some(FaceSurface::Plane { normal, .. }) => Some(normal),
                 Some(FaceSurface::Cylinder { origin, axis, .. }) => {
                     let v = p - origin;
                     (v - axis * v.dot(axis)).normalized()
@@ -396,10 +395,8 @@ fn actions(s: &Session) -> Vec<Action> {
             let r = round3((shortest * 0.1).max(0.01));
             let mut add = |action, act| out.push(Action { entity: entity.clone(), action, act });
             if !smooth(e, mid) {
-                // The midpoint is interior to this edge, but other bodies (including component
-                // copies in their local frames) can have coincident edges. Retain the picked body.
-                add("edge.fillet", Act::Run("solid.fillet", json!({"body": world, "edges": [pt(mid)], "radius": r})));
-                add("edge.chamfer", Act::Run("solid.chamfer", json!({"body": world, "edges": [pt(mid)], "distance": r})));
+                add("edge.fillet", Act::Run("solid.fillet", json!({"edges": [pt(mid)], "radius": r})));
+                add("edge.chamfer", Act::Run("solid.chamfer", json!({"edges": [pt(mid)], "distance": r})));
             }
             let dir = straight(pts);
             if dir.is_some() {
@@ -1281,41 +1278,6 @@ fn rectangle(plane: Value, p0: [f64; 2], p1: [f64; 2]) -> [Value; 3] {
     ]
 }
 
-#[test]
-fn edge_round_actions_keep_the_picked_body() {
-    for (corner, length) in [([10, 0, 20], 4), ([0, 0, 0], 20)] {
-        let mut s = Session::default();
-        s.execute("solid.box", &json!({"length": 20, "width": 20, "height": 20, "body_name": "Plate"})).unwrap();
-        s.execute(
-            "solid.box",
-            &json!({"corner": corner, "length": length, "width": length, "height": length, "body_name": "Block", "operation": "new"}),
-        )
-        .unwrap();
-        let mut tried = 0;
-        for a in actions(&s) {
-            if !a.entity.starts_with("Plate/") || !matches!(a.action, "edge.chamfer" | "edge.fillet") {
-                continue;
-            }
-            let Act::Run(id, ref p) = a.act else { continue };
-            let q = &p["edges"][0];
-            let x = q[0].as_f64().unwrap();
-            if q[1] != 0.0 || q[2] != 20.0 || !(0.0..20.0).contains(&x) {
-                continue;
-            }
-            // Block either meets this midpoint or coincides with the whole edge.
-            assert_eq!(p["body"], "Plate", "{}: {p}", a.action);
-            assert_eq!(q, &json!([10.0, 0.0, 20.0]));
-            let mut unscoped = p.clone();
-            unscoped.as_object_mut().unwrap().remove("body");
-            let err = s.scratch().execute(id, &unscoped).unwrap_err().to_string();
-            assert!(err.contains("[10, 0, 20] lies on edges of 2 bodies, Plate and Block"), "{err}");
-            perform(&mut s.scratch(), &a.act, &errors(&s)).unwrap();
-            tried += 1;
-        }
-        assert_eq!(tried, 2);
-    }
-}
-
 #[test]
 fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
     for (cmd, size) in [("solid.fillet", "radius"), ("solid.chamfer", "distance")] {
@@ -1339,9 +1301,7 @@ fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
 fn a_round_on_a_knuckle_cap_circle() {
     for (cmd, size, removed) in [("solid.fillet", "radius", (2.4, 2.8)), ("solid.chamfer", "distance", (5.6, 6.3))] {
         let mut s = load(&root().join("tests/oracle/63-hinge-knuckle/recipe.json")).unwrap();
-        let volume = |s: &Session| {
-            s.model.state().bodies.iter().map(|b| b.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.001)).unwrap().measure().volume).sum::<f64>()
-        };
+        let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate(0.001).unwrap().measure().volume).sum::<f64>();
         let before = volume(&s);
         s.execute(cmd, &json!({"edges": [[40.0, 29.837_722, 6.449_490]], size: 0.728})).unwrap_or_else(|e| panic!("{cmd}: {e}"));
         check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{cmd}: {kind}: {e}"));
@@ -1361,9 +1321,7 @@ fn a_round_on_a_knuckle_cap_circle() {
 #[test]
 fn a_hair_thin_hole_on_a_ledge_beside_a_loft_cut() {
     let mut s = load(&root().join("examples/regressions/loft_cut_beside_round_hole.json")).unwrap();
-    let volume = |s: &Session| {
-        s.model.state().bodies.iter().map(|b| b.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.005)).unwrap().measure().volume).sum::<f64>()
-    };
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.005, true).unwrap().measure().volume).sum::<f64>();
     let before = volume(&s);
     s.execute("solid.hole", &json!({"diameter": 0.133, "position": [357.22, -150.993_333, 730.0]})).unwrap();
     check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
@@ -1380,9 +1338,7 @@ fn a_hair_thin_hole_on_a_ledge_beside_a_loft_cut() {
 #[test]
 fn a_small_hole_through_the_wall_of_a_plastic_rest() {
     let mut s = load(&root().join("apps/solidcraft-cli/tests/corpus/modern-plastic.solidcraft")).unwrap();
-    let volume = |s: &Session| {
-        s.model.state().bodies.iter().map(|b| b.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.002)).unwrap().measure().volume).sum::<f64>()
-    };
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
     let before = volume(&s);
     s.execute("solid.hole", &json!({"diameter": 0.8, "position": [63.069_841_5, 28.333_333, 4.0]})).unwrap();
     check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
@@ -1397,9 +1353,7 @@ fn a_small_hole_through_the_wall_of_a_plastic_rest() {
 #[test]
 fn a_hole_square_to_a_45_degree_flange() {
     let mut s = load(&root().join("tests/oracle/70-sm-flange-45/recipe.json")).unwrap();
-    let volume = |s: &Session| {
-        s.model.state().bodies.iter().map(|b| b.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.002)).unwrap().measure().volume).sum::<f64>()
-    };
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
     let before = volume(&s);
     s.execute("solid.hole", &json!({"diameter": 3.448, "position": [66.666_667, -4.511_845, 4.511_845]})).unwrap();
     check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
@@ -1458,7 +1412,7 @@ fn a_sketch_on_a_patterned_boss_top() {
 fn construction_geometry_and_holes_on_a_moved_component() {
     let moved = || {
         vec![
-            json!({"command": "component.create", "params": {"name": "Arm", "grounded": false}}),
+            json!({"command": "component.create", "params": {"name": "Arm"}}),
             json!({"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}}),
             json!({"command": "component.activate", "params": {"component": 0}}),
             json!({"command": "occurrence.move", "params": {"occurrence": "Arm:1", "translate": [0, 50, 0]}}),
@@ -1565,9 +1519,10 @@ fn sketches_on_loft_and_sweep_faces() {
 }
 
 #[test]
+#[ignore = "fails until #562 is fixed"]
 fn press_pull_on_the_pi_case_floor() {
     reproduces(
-        Some("tests/action_matrix/designs/pi-case.sc"),
+        Some("tests/action_matrix/designs/pi-case.solidcraft"),
         json!([{"command": "solid.press_pull", "params": {"face": [30, 20, 0], "distance": 1}}]),
     );
 }
@@ -1605,6 +1560,7 @@ fn a_sketch_on_the_rim_a_shell_leaves() {
 }
 
 #[test]
+#[ignore = "fails until #565 is fixed"]
 fn sketches_after_split_body_and_intersect() {
     reproduces(
         None,
@@ -1657,7 +1613,7 @@ impl TipConstruction {
             other => panic!("expected an axis, got {other:?}"),
         }
     }
-    fn plane(&self) -> solidcore_record::Plane {
+    fn plane(&self) -> solidcraft_engine::geom::Plane {
         match &self.0 {
             solidcraft_engine::doc::construct::ConstructGeom::Plane(p) => *p,
             other => panic!("expected a plane, got {other:?}"),
@@ -1711,6 +1667,7 @@ fn a_tangent_plane_on_a_drill_tip() {
 }
 
 #[test]
+#[ignore = "fails until #568 is fixed"]
 fn a_plane_on_a_patterned_counterbore_after_a_thickness_change() {
     let mut c = vec![json!({"command": "parameters.change", "params": {"name": "thick", "expression": "10 mm"}})];
     c.extend(rectangle(json!("XY"), [0., 0.], [80., 30.]));
@@ -1737,7 +1694,7 @@ fn the_ribbed_lid_builds_the_same_body_every_time() {
         st.bodies
             .iter()
             .map(|b| {
-                let mesh = b.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.1)).unwrap();
+                let mesh = b.body.tessellate(0.1).unwrap();
                 let bits = mesh.positions.iter().fold(0u64, |acc, p| {
                     acc.rotate_left(7).wrapping_add(p.x.to_bits() ^ p.y.to_bits().rotate_left(21) ^ p.z.to_bits().rotate_left(42))
                 });

apps/solidcraft-cli/tests/bracket_example.rs

@@ -1,62 +0,0 @@
-//! The bracket example must cut two through holes, rather than successfully cutting empty
-//! space beside the body. Check the shipped script and rebuild its saved design from scratch.
-
-use std::f64::consts::PI;
-
-use serde_json::Value;
-use solidcore_record::Vec3;
-use solidcraft_engine::{Session, io, kernel};
-
-fn assert_two_through_holes(session: &Session, stage: &str) {
-    let errors: Vec<_> = session.model.results.iter().filter_map(|r| r.error.as_ref().map(|e| (&r.name, e))).collect();
-    assert!(errors.is_empty(), "{stage}: every example feature evaluates: {errors:?}");
-
-    let cut = session.doc.features.last().expect("the example ends with the hole cut");
-    let before = session.model.state_before(cut.id);
-    let after = session.model.state();
-    assert_eq!(before.bodies.len(), 1, "{stage}: one bracket before cutting the holes");
-    assert_eq!(after.bodies.len(), 1, "{stage}: the holes leave one bracket");
-    let uncut = &before.body("Bracket").expect("the uncut bracket").body;
-    let bracket = &after.body("Bracket").expect("the finished bracket").body;
-
-    // Measure the actual state before the final cut so the existing edge fillet cancels out.
-    // Both holes have diameter 8 mm and pass through the 6 mm base. Kernel measurements are
-    // tessellated, so the relative tolerance applies to the removed material, not the body.
-    let removed = kernel::measure(uncut).unwrap().volume - kernel::measure(bracket).unwrap().volume;
-    let expected = 2.0 * PI * 4.0_f64.powi(2) * 6.0;
-    assert!((removed - expected).abs() < expected * 1e-3, "{stage}: the two holes remove {removed} mm³, expected {expected} mm³");
-
-    let before_mesh = uncut.mesh(&solidcraft_kernel::MeshTolerance::chord(0.01)).unwrap();
-    let after_mesh = bracket.mesh(&solidcraft_kernel::MeshTolerance::chord(0.01)).unwrap();
-    let down = Vec3::new(0.0, 0.0, -1.0);
-    for y in [-15.0, -45.0] {
-        let center = Vec3::new(25.0, y, 1.0);
-        assert_eq!(before_mesh.ray_crossings(center, down), 2, "{stage}: hole at y={y} starts over the solid base");
-        // Rays through each opening must miss the entire bracket, including its top and
-        // bottom caps. Points away from the centre guard against a narrow slit or shifted cut.
-        for (dx, dy) in [(0.0, 0.0), (3.0, 0.0), (-3.0, 0.0), (0.0, 3.0), (0.0, -3.0)] {
-            let ray = center + Vec3::new(dx, dy, 0.0);
-            assert_eq!(after_mesh.ray_crossings(ray, down), 0, "{stage}: the hole at y={y} is open through both caps at ({dx}, {dy})");
-        }
-        // Material just outside each radius remains, so neither opening is an edge notch.
-        for (dx, dy) in [(5.0, 0.0), (-5.0, 0.0), (0.0, 5.0), (0.0, -5.0)] {
-            let ray = center + Vec3::new(dx, dy, 0.0);
-            assert_eq!(after_mesh.ray_crossings(ray, down), 2, "{stage}: material remains around the hole at y={y}, offset ({dx}, {dy})");
-        }
-    }
-}
-
-#[test]
-fn bracket_example_cuts_two_through_holes_and_reopens() {
-    let script: Value = serde_json::from_str(include_str!("../../../examples/bracket.json")).unwrap();
-    let mut session = Session::default();
-    session.run_script(&script).unwrap();
-    assert_two_through_holes(&session, "script");
-
-    // No geometry cache is supplied: reopening the container re-evaluates the saved timeline.
-    let saved = io::write_design_container(&session.doc).unwrap();
-    let document = io::read_design(&saved).unwrap();
-    assert_eq!(document.features, session.doc.features, "saving preserves the example's feature parameters");
-    let reopened = Session::new(document);
-    assert_two_through_holes(&reopened, "reopened");
-}

apps/solidcraft-cli/tests/corpus/README.md

@@ -1,12 +1,10 @@
 # Design file corpus
 
 Designs saved by older SolidCraft builds. `tests/design_corpus.rs` opens each one with the
-current build and checks that it is upgraded to the current file format, that it evaluates
-(a feature may fail only by asking for a reference it lost to be picked again; what it rebuilds
-to is today's), and that damaged and hostile variants of it never panic. The `.expected.json`
-next to each is `solidcraft-cli eval` of that file by the build that saved it (bodies, volumes,
-areas, world bounding boxes), kept as a record of what that build made; no test compares with
-it.
+current build and checks that it evaluates as it did when saved (the `.expected.json` next to
+it is `solidcraft-cli eval` of that file by the build that saved it: bodies, volumes, areas,
+world bounding boxes), that it is upgraded to the current file format, and that damaged and
+hostile variants of it never panic.
 
 | File | Saved by | Era |
 |---|---|---|

apps/solidcraft-cli/tests/corpus/issue-489-stacked-join.expected.json

@@ -90,6 +90,10 @@
   ],
   "timeline": [
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 1,
       "ms": 0.131943,
@@ -100,6 +104,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 2,
       "ms": 1.0812709999999999,
@@ -110,6 +118,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 3,
       "ms": 0.450002,
@@ -120,6 +132,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 4,
       "ms": 5.191514000000001,

apps/solidcraft-cli/tests/corpus/issue-616-lid-ribs.expected.json

@@ -54,6 +54,10 @@
   ],
   "timeline": [
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 1,
       "ms": 1.178957,
@@ -64,6 +68,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 2,
       "ms": 83.24342399999999,
@@ -74,6 +82,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 3,
       "ms": 0.150889,
@@ -84,6 +96,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 4,
       "ms": 94.465481,
@@ -94,6 +110,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 5,
       "ms": 50.426736,
@@ -104,6 +124,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 6,
       "ms": 40.383005,
@@ -114,6 +138,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 7,
       "ms": 59.041461000000005,
@@ -124,6 +152,18 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [
+          {
+            "face_shift_mm": 0.0,
+            "rotation_rad": 0.0,
+            "strategy": "planar_fallback",
+            "tolerance_mm": 0.0,
+            "translation_mm": 0.0
+          }
+        ],
+        "truncated": false
+      },
       "error": null,
       "id": 8,
       "ms": 562.5477970000001,
@@ -131,9 +171,13 @@
       "rolled_back": false,
       "suppressed": false,
       "type": "BoxFeature",
-      "warning": null
+      "warning": "Boolean retry: exact planar fallback (no displacement)"
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 9,
       "ms": 89.56076,
@@ -144,6 +188,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 10,
       "ms": 65.330634,
@@ -154,6 +202,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 11,
       "ms": 97.229403,

apps/solidcraft-cli/tests/corpus/move-bodies.expected.json

@@ -99,6 +99,10 @@
   ],
   "timeline": [
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 1,
       "ms": 0.204585,
@@ -109,6 +113,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 2,
       "ms": 2.318662,
@@ -119,6 +127,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 3,
       "ms": 0.109196,
@@ -129,6 +141,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 4,
       "ms": 0.338859,
@@ -139,6 +155,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 5,
       "ms": 0.312259,
@@ -149,6 +169,10 @@
       "warning": null
     },
     {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
       "error": null,
       "id": 6,
       "ms": 0.23144699999999999,

apps/solidcraft-cli/tests/corpus/scripts/components-arm.json

@@ -1,6 +1,6 @@
 {"commands": [
  {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
- {"command": "component.create", "params": {"name": "Arm", "grounded": false}},
+ {"command": "component.create", "params": {"name": "Arm"}},
  {"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
  {"command": "solid.fillet", "params": {"edges": [[25, 4, 4]], "radius": 1}},
  {"command": "component.activate", "params": {"component": 0}},

apps/solidcraft-cli/tests/design_corpus.rs

@@ -1,8 +1,6 @@
-//! Designs saved by older SolidCraft builds (tests/corpus, see its README) open, are upgraded to
-//! the current format and evaluate (what they rebuild to today is today's, not what the build
-//! that saved them made); damaged and hostile design files never panic.
+//! Designs saved by older SolidCraft builds (tests/corpus, see its README) open and evaluate as
+//! they did when they were saved; damaged and hostile design files never panic.
 
-use solidcraft_engine::geom::prelude::*;
 use std::path::{Path, PathBuf};
 
 use serde_json::{Value, json};
@@ -23,24 +21,67 @@ fn open(path: &Path) -> Session {
     s
 }
 
-/// Every corpus design opens, is upgraded to the current format, evaluates, and saves and reads
-/// back the same. A feature may fail only by asking for a reference it lost to be picked again
-/// (a name saved before format 14 finds nothing today).
+/// Differences that are deliberate behaviour changes made before the file format had versions
+/// (no migration can tell those files apart): (file, check, why).
+const KNOWN: [(&str, &str, &str); 2] = [
+    (
+        "m0-revolve-primitives",
+        "Body1 bbox",
+        "partial revolves turn toward the sketch normal since ac43365 (as Fusion's do); M0 turned them the other way",
+    ),
+    ("components-arm", "body_count", "Measure counted only the root component's bodies then; it measures every placed body now"),
+];
+
+fn known(file: &str, check: &str) -> bool {
+    KNOWN.iter().any(|(f, c, _)| *f == file && *c == check)
+}
+
+/// Volumes and areas then came from coarser tessellation (and curved booleans and fillets have
+/// become exact since): the same part within this relative tolerance (the oracle's).
+const REL: f64 = 1e-3;
+
+fn close(a: f64, b: f64, rel: f64) -> bool {
+    (a - b).abs() <= rel * b.abs().max(1.0)
+}
+
 #[test]
-fn old_designs_open_upgrade_and_evaluate() {
+fn old_designs_open_and_evaluate_as_saved() {
     let mut problems = Vec::new();
     for p in corpus() {
         let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let want: Value = serde_json::from_slice(&std::fs::read(p.with_extension("expected.json")).unwrap()).unwrap();
         let mut s = open(&p);
         for r in &s.model.results {
-            if let Some(e) = r.error.as_deref().filter(|e| solidcraft_engine::doc::reselect_parts(e).is_none()) {
+            if let Some(e) = &r.error {
                 problems.push(format!("{name}: feature {}: {e}", r.id));
             }
         }
         assert_eq!(s.doc.format, solidcraft_engine::doc::format::format_string(solidcraft_engine::doc::format::FORMAT), "{name}: upgraded");
         let got = s.execute("inspect.measure", &json!({})).unwrap();
-        if got["body_count"].as_u64().unwrap_or(0) == 0 {
-            problems.push(format!("{name}: no bodies"));
+        if got["body_count"] != want["body_count"] && !known(&name, "body_count") {
+            problems.push(format!("{name}: {} bodies, saved with {}", got["body_count"], want["body_count"]));
+        }
+        for w in want["bodies"].as_array().into_iter().flatten() {
+            let bname = w["name"].as_str().unwrap_or_default();
+            let Some(g) = got["bodies"].as_array().into_iter().flatten().find(|g| g["name"] == w["name"]) else {
+                problems.push(format!("{name}: body {bname} missing"));
+                continue;
+            };
+            for k in ["volume_mm3", "area_mm2"] {
+                let (a, b) = (g[k].as_f64().unwrap_or(f64::NAN), w[k].as_f64().unwrap_or(f64::NAN));
+                if !close(a, b, REL) {
+                    problems.push(format!("{name}: {bname} {k} {a} (saved {b})"));
+                }
+            }
+            if known(&name, &format!("{bname} bbox")) {
+                continue;
+            }
+            for (end, i) in [("min", 0), ("min", 1), ("min", 2), ("max", 0), ("max", 1), ("max", 2)] {
+                let (a, b) = (g["bbox"][end][i].as_f64().unwrap_or(f64::NAN), w["bbox"][end][i].as_f64().unwrap_or(f64::NAN));
+                if (a - b).abs() > 1e-3 * b.abs().max(1.0) {
+                    problems.push(format!("{name}: {bname} bbox {end}[{i}] {a} (saved {b})"));
+                }
+            }
         }
         // Saved again, it reads back the same.
         let again = solidcraft_engine::doc::Document::from_json(&s.doc.to_json()).unwrap();
@@ -53,48 +94,40 @@ fn old_designs_open_upgrade_and_evaluate() {
 }
 
 /// Names saved before format 14 were worked out from geometry, pieces of a split face numbered by
-/// where their centres lay (`F2:top#2`). They open marked as such and find no face or edge today:
-/// each feature holding one fails, asking for its reference to be picked again, and the rest of
-/// the design builds.
+/// where their centres lay (`F2:top#2`). They keep naming the faces they named: marked as such,
+/// they are found as the build that saved them found them, without new notes.
 #[test]
-fn names_saved_before_exact_history_ask_for_their_faces_again() {
+fn names_saved_before_exact_history_find_the_faces_they_named() {
     let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/naming-split-pieces.solidcraft");
     let s = open(&path);
     let feature = |name: &str| s.doc.features.iter().find(|f| f.name == name).unwrap_or_else(|| panic!("{name}"));
     assert_eq!(feature("Round").edge_names, vec!["?F2:side:l2|F2:top#2".to_string()]);
     assert_eq!(feature("Bevel").edge_names, vec!["?F2:side:l4|F2:top#1".to_string()]);
     assert_eq!(feature("Raise").face_names, vec!["?F2:top#1".to_string()]);
-    let asked = |name: &str| {
-        let r = s.model.result(feature(name).id).unwrap_or_else(|| panic!("{name}"));
-        r.error.as_deref().and_then(solidcraft_engine::doc::reselect_parts).map(|(f, reference)| (f.to_string(), reference.to_string()))
-    };
-    assert_eq!(asked("Round"), Some(("Round".into(), "?F2:side:l2|F2:top#2".into())));
-    assert_eq!(asked("Bevel"), Some(("Bevel".into(), "?F2:side:l4|F2:top#1".into())));
-    assert_eq!(asked("Raise"), Some(("Raise".into(), "?F2:top#1".into())));
-    for r in s.model.results.iter().filter(|r| !["Round", "Bevel", "Raise"].contains(&r.name.as_str())) {
-        assert!(r.error.is_none(), "{}: {:?}", r.name, r.error);
+    for r in &s.model.results {
+        assert!(r.error.is_none() && r.warning.is_none(), "{}: {:?} {:?}", r.name, r.error, r.warning);
     }
-    assert!(!s.model.state().bodies.is_empty());
+    // The raised piece is the left one, as saved (the stored point is on it).
+    let state = s.model.state();
+    let solid = |p: [f64; 3]| state.bodies.iter().any(|b| b.body.contains(solidcraft_engine::geom::Vec3::new(p[0], p[1], p[2])));
+    assert!(solid([7.0, 15.0, 11.0]) && !solid([32.0, 15.0, 11.0]));
 }
 
-/// Body names saved before format 14 named the pieces of a split body in the kernel's shell
-/// order: such a design opens with every feature marked `shell_piece_order` and evaluates, each
-/// body name it stores naming a piece. (Which piece takes which name is not promised to be as it
-/// was saved.) Its fillet and chamfer hold edge names saved then, which find nothing today: they
-/// ask for their edges to be picked again.
+/// Body names saved before format 14 name the pieces of a split body in the kernel's shell order.
+/// The features after the split that refer to a piece by its body name still find that piece:
+/// the far one stays `Body1` (chamfered), the near one `Body1 (1)` (filleted, coloured).
 #[test]
-fn body_names_saved_before_exact_history_open_marked_and_evaluate() {
+fn body_names_saved_before_exact_history_keep_their_pieces() {
     let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/split-body-pieces.solidcraft");
     let s = open(&path);
     assert!(s.doc.features.iter().all(|f| f.shell_piece_order), "every saved feature keeps the shell order");
     for r in &s.model.results {
-        let asked = r.error.as_deref().and_then(solidcraft_engine::doc::reselect_parts);
-        assert!(r.error.is_none() || asked.is_some_and(|(_, reference)| reference.starts_with('?')), "{}: {:?}", r.name, r.error);
+        assert!(r.error.is_none() && r.warning.is_none(), "{}: {:?} {:?}", r.name, r.error, r.warning);
     }
     let state = s.model.state();
-    for name in ["Body1", "Body1 (1)"] {
-        assert!(state.bodies.iter().any(|b| b.name == name), "{name}");
-    }
+    let piece = |name: &str| state.bodies.iter().find(|b| b.name == name).unwrap_or_else(|| panic!("{name}"));
+    let solid = |name: &str, p: [f64; 3]| piece(name).body.contains(solidcraft_engine::geom::Vec3::new(p[0], p[1], p[2]));
+    assert!(solid("Body1", [20.0, 24.0, 5.0]) && solid("Body1 (1)", [20.0, 6.0, 5.0]));
     assert!(s.doc.appearances.bodies.contains_key("Body1 (1)"));
 }
 
@@ -140,7 +173,6 @@ fn flat_face_attachments() -> Vec<(String, String, usize, Option<(u32, bool)>, O
     for p in corpus() {
         let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
         let mut s = open(&p);
-        let failed_on_open: Vec<u64> = s.model.results.iter().filter(|r| r.error.is_some()).map(|r| r.id).collect();
         let state = s.model.state();
         let placed = s.placed_document();
         let mut picks = Vec::new();
@@ -148,7 +180,7 @@ fn flat_face_attachments() -> Vec<(String, String, usize, Option<(u32, bool)>, O
             let Some(body) = state.bodies.iter().find(|b| b.definition_name() == definition && placed.model_body_component(b) == component) else {
                 continue;
             };
-            let mesh = body.body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.01)).unwrap();
+            let mesh = body.body.tessellate(0.01).unwrap();
             for index in 0..body.body.face_count() {
                 if body.body.planar_face(index).is_none() {
                     continue;
@@ -192,8 +224,7 @@ fn flat_face_attachments() -> Vec<(String, String, usize, Option<(u32, bool)>, O
             let known = known_without_attachment(&name, &body, normal, distance);
             out.push((name.clone(), body, index, known, problem));
         }
-        let failed: Vec<u64> = s.model.results.iter().filter(|r| r.error.is_some()).map(|r| r.id).collect();
-        assert_eq!(failed, failed_on_open, "{name}: undo leaves the features that failed on opening, and only those, failed");
+        assert!(s.model.results.iter().all(|r| r.error.is_none()), "{name}: left with errors after undo");
     }
     out
 }

apps/solidcraft-cli/tests/help_output.rs

@@ -1,213 +0,0 @@
-//! An explicit help request prints usage to stdout and succeeds; an unknown command still fails.
-
-use std::process::{Command, Stdio};
-use std::time::{Duration, Instant};
-
-/// Every command the CLI takes, with the name its own usage names: `inspect` is `eval`, and
-/// `licenses` is `licences`.
-const COMMANDS: &[(&str, &str)] = &[
-    ("run", "run"),
-    ("eval", "eval"),
-    ("inspect", "eval"),
-    ("script", "script"),
-    ("bench-open", "bench-open"),
-    ("bench-agent", "bench-agent"),
-    ("snapshot", "snapshot"),
-    ("render", "render"),
-    ("exec", "exec"),
-    ("commands", "commands"),
-    ("recipe", "recipe"),
-    ("oracle", "oracle"),
-    ("fuzz", "fuzz"),
-    ("fuzz-one", "fuzz-one"),
-    ("mcp", "mcp"),
-    ("crashes", "crashes"),
-    ("licences", "licences"),
-    ("licenses", "licences"),
-    ("gpu", "gpu"),
-    ("icon", "icon"),
-    ("bench-edit", "bench-edit"),
-    ("save-stress", "save-stress"),
-];
-
-/// The commands the usage lists: the aliases answer to another command's name.
-const LISTED: &[&str] = &[
-    "run",
-    "eval",
-    "script",
-    "bench-open",
-    "bench-agent",
-    "snapshot",
-    "render",
-    "exec",
-    "commands",
-    "recipe",
-    "oracle",
-    "fuzz",
-    "mcp",
-    "crashes",
-    "licences",
-    "gpu",
-    "icon",
-];
-
-/// The command names a text mentions after `solidcraft-cli `, each one only once.
-fn mentioned(text: &str) -> Vec<&str> {
-    let mut names: Vec<&str> = text.split("solidcraft-cli ").skip(1).filter_map(|rest| rest.split_whitespace().next()).collect();
-    names.sort_unstable();
-    names.dedup();
-    names
-}
-
-/// Runs the binary and waits at most `limit` for it to finish. `None` means it was still
-/// running and was killed: the fuzz run `fuzz --help` used to start goes on for minutes.
-fn run_within(limit: Duration, args: &[&str]) -> Option<(Option<i32>, String, String)> {
-    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
-    let started = Instant::now();
-    loop {
-        match child.try_wait().unwrap() {
-            Some(status) => {
-                let out = child.wait_with_output().unwrap();
-                return Some((status.code(), String::from_utf8_lossy(&out.stdout).into_owned(), String::from_utf8_lossy(&out.stderr).into_owned()));
-            }
-            None if started.elapsed() >= limit => {
-                let _ = child.kill();
-                let _ = child.wait();
-                return None;
-            }
-            None => std::thread::sleep(Duration::from_millis(25)),
-        }
-    }
-}
-
-#[test]
-fn help_prints_usage_and_succeeds() {
-    for arg in ["--help", "-h", "help"] {
-        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg(arg).output().unwrap();
-        assert!(output.status.success(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        assert!(stdout.starts_with("usage:"), "{arg}: {stdout}");
-        assert!(stdout.contains("solidcraft-cli run"), "{arg}: {stdout}");
-        assert!(output.stderr.is_empty(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
-    }
-}
-
-#[test]
-fn unknown_command_still_fails_with_usage() {
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--not-a-command").output().unwrap();
-    assert!(!output.status.success());
-    assert!(output.stdout.is_empty());
-    assert!(String::from_utf8_lossy(&output.stderr).starts_with("error: usage:"));
-}
-
-#[test]
-fn every_command_prints_its_own_usage() {
-    for (cmd, named) in COMMANDS {
-        for flag in ["--help", "-h"] {
-            let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args([*cmd, flag]).output().unwrap();
-            assert!(output.status.success(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
-            let stdout = String::from_utf8_lossy(&output.stdout);
-            assert!(stdout.starts_with("usage:"), "{cmd} {flag}: {stdout}");
-            assert_eq!(mentioned(&stdout), vec![*named], "{cmd} {flag} printed another command's usage: {stdout}");
-            assert!(output.stderr.is_empty(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
-        }
-    }
-}
-
-#[test]
-fn the_top_level_usage_still_lists_every_command() {
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    for cmd in LISTED {
-        assert!(stdout.contains(&format!("solidcraft-cli {cmd}")), "{cmd}: {stdout}");
-    }
-}
-
-#[test]
-fn fuzz_help_does_not_start_a_fuzz_run() {
-    let Some((code, stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", "--help"]) else {
-        panic!("`fuzz --help` kept running: it started a fuzz run instead of printing the usage");
-    };
-    assert_eq!(code, Some(0), "{stderr}");
-    assert!(stdout.starts_with("usage:"), "{stdout}");
-    assert_eq!(mentioned(&stdout), vec!["fuzz"], "{stdout}");
-    assert!(stderr.is_empty(), "{stderr}");
-}
-
-#[test]
-fn fuzz_refuses_an_argument_it_does_not_take() {
-    for arg in ["--not-a-flag", "stray"] {
-        let Some((code, _stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", arg]) else {
-            panic!("`fuzz {arg}` kept running: it started a fuzz run instead of refusing the argument");
-        };
-        assert_ne!(code, Some(0), "`fuzz {arg}` succeeded");
-        assert!(stderr.contains(arg), "`fuzz {arg}`: {stderr}");
-    }
-}
-
-#[test]
-fn render_help_keeps_the_registered_gpu_request_controls() {
-    for args in [vec!["--help"], vec!["render", "--help"]] {
-        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(&args).output().unwrap();
-        assert!(output.status.success(), "{args:?}: {}", String::from_utf8_lossy(&output.stderr));
-        assert!(output.stderr.is_empty());
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        for flag in ["--progressive", "--samples", "--max-depth", "--seed", "--exposure", "--lighting", "--environment", "--tone-map"] {
-            assert!(stdout.contains(flag), "{args:?} lost {flag}: {stdout}");
-        }
-    }
-}
-
-/// `--max-file-size` (#4086), with any command: the usage names it, a bad size stops the run
-/// with the reason, and a design over the default limit opens once the flag raises it.
-#[test]
-fn max_file_size_raises_the_limit_and_refuses_bad_sizes() {
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
-    assert!(String::from_utf8_lossy(&output.stdout).contains("--max-file-size"));
-    for size in ["17GB", "2", "lots"] {
-        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["--max-file-size", size, "exec", "file.new"]).output().unwrap();
-        assert!(!output.status.success(), "{size} was accepted");
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert!(stderr.starts_with("error: --max-file-size"), "{size}: {stderr}");
-    }
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["exec", "file.new", "--max-file-size=2GB"]).output().unwrap();
-    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
-
-    // A sparse design file just over the default 256 MB: refused unread, then read with the flag
-    // (and refused for what it holds, which is no design).
-    let dir = std::env::temp_dir().join(format!("solidcraft-cli-4086-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("big.solidcraft");
-    std::fs::File::create(&path).unwrap().set_len((256 << 20) + 1).unwrap();
-    let path = path.to_string_lossy().to_string();
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["eval", &path]).output().unwrap();
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(!output.status.success() && stderr.contains("too large") && stderr.contains("--max-file-size"), "{stderr}");
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["--max-file-size", "1GB", "eval", &path]).output().unwrap();
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(!output.status.success() && !stderr.contains("too large"), "{stderr}");
-    let _ = std::fs::remove_dir_all(&dir);
-}
-
-/// #10111: a line for a stderr whose reader has gone (the pipe closed before it, as an agent may
-/// leave the MCP server's, and the app that one starts) is dropped, and the command ends as it
-/// would with stderr open: here a script that isn't there fails with 1, where `eprintln!`
-/// panicked with "failed printing to stderr" (101).
-#[test]
-fn a_closed_stderr_does_not_stop_the_cli() {
-    for _ in 0..5 {
-        let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-            .args(["run", "no-such-script.json"])
-            .stdout(Stdio::null())
-            .stderr(Stdio::piped())
-            .spawn()
-            .unwrap();
-        drop(child.stderr.take());
-        assert_eq!(child.wait().unwrap().code(), Some(1));
-    }
-    // The old name's alias writes its deprecation notice first: an agent still configured with
-    // `solvecraft-cli mcp` must get the server, not that panic.
-    let mut child = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("--help").stdout(Stdio::null()).stderr(Stdio::piped()).spawn().unwrap();
-    drop(child.stderr.take());
-    assert_eq!(child.wait().unwrap().code(), Some(0));
-}

apps/solidcraft-cli/tests/json_out.rs

@@ -139,13 +139,11 @@ fn eval_json_out_holds_what_stdout_would() {
 fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
     let dir = Scratch::new();
     let script = dir.script();
-    for cmd in ["run", "eval", "inspect"] {
-        for trailing in [&[][..], &["--in"][..]] {
-            let output = cli().arg(cmd).arg(&script).arg("--json-out").args(trailing).output().unwrap();
-            assert_eq!(output.status.code(), Some(1), "{cmd}");
-            assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
-            assert!(output.stdout.is_empty(), "{cmd}");
-        }
+    for cmd in ["run", "eval"] {
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
 
         let missing = dir.0.join("missing").join("out.json");
         let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();

apps/solidcraft-cli/tests/mcp_compact.rs

@@ -1,48 +0,0 @@
-//! `mcp --compact` and `SOLIDCRAFT_MCP_COMPACT` turn on compact tool output; without them the
-//! server's tools are as they always were.
-
-use std::io::Write;
-use std::process::{Command, Stdio};
-
-use serde_json::{Value, json};
-
-/// `inspect_design`'s input schema as `solidcraft-cli mcp` with `args` and `env` lists it, or
-/// the server's stderr when it does not start.
-fn inspect_schema(args: &[&str], env: Option<&str>) -> Result<Value, String> {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"));
-    // --headless: never bridge to (and read the preference of) an app the developer has running.
-    cmd.args(["mcp", "--headless", "--allow-any-path"]).args(args).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped());
-    match env {
-        Some(v) => cmd.env("SOLIDCRAFT_MCP_COMPACT", v),
-        None => cmd.env_remove("SOLIDCRAFT_MCP_COMPACT"),
-    };
-    let mut child = cmd.spawn().unwrap();
-    {
-        let mut stdin = child.stdin.take().unwrap();
-        // The server may refuse to start and close stdin first.
-        let _ = writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": 1, "method": "tools/list"}));
-    }
-    let out = child.wait_with_output().unwrap();
-    if !out.status.success() {
-        return Err(String::from_utf8_lossy(&out.stderr).into_owned());
-    }
-    let reply: Value = serde_json::from_slice(&out.stdout).unwrap();
-    let tools = reply["result"]["tools"].as_array().cloned().unwrap_or_default();
-    Ok(tools.into_iter().find(|t| t["name"] == "inspect_design").map(|t| t["inputSchema"].clone()).unwrap_or(Value::Null))
-}
-
-#[test]
-fn compact_output_is_off_unless_asked() {
-    let plain = inspect_schema(&[], None).unwrap();
-    assert_eq!(plain["properties"]["sketches"]["type"], "boolean", "{plain}");
-    assert!(plain["properties"].get("bodies").is_none(), "{plain}");
-    assert_eq!(inspect_schema(&[], Some("0")).unwrap(), plain);
-
-    for (args, env) in [(&["--compact"][..], None), (&[][..], Some("1")), (&[][..], Some("true"))] {
-        let compact = inspect_schema(args, env).unwrap();
-        assert!(compact["properties"]["bodies"].is_object(), "{args:?} {env:?}: {compact}");
-    }
-
-    let e = inspect_schema(&[], Some("maybe")).unwrap_err();
-    assert!(e.contains("SOLIDCRAFT_MCP_COMPACT"), "{e}");
-}

apps/solidcraft-cli/tests/mcp_connect.rs

@@ -9,16 +9,8 @@ use serde_json::{Value, json};
 
 #[test]
 fn mcp_connect_serves_before_the_app_runs_and_reaches_it_once_it_does() {
-    // This test needs the port closed until its second phase. A port obtained
-    // with bind(:0) and released can immediately be reused by another parallel
-    // test's mock server. Stay below the usual ephemeral ranges,
-    // with a process-specific starting point, and skip any occupied ports.
-    let port = (0..512u32)
-        .find_map(|offset| {
-            let port = 16000 + (std::process::id() + offset) % 16000;
-            TcpListener::bind(("127.0.0.1", port as u16)).ok().map(|listener| listener.local_addr().unwrap().port())
-        })
-        .expect("an unused non-ephemeral test port");
+    // A port that was free a moment ago: nothing listens on it.
+    let port = TcpListener::bind("127.0.0.1:0").unwrap().local_addr().unwrap().port();
     let addr = format!("127.0.0.1:{port}");
     let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-connect-{}-{port}", std::process::id()));
     std::fs::create_dir_all(&control_dir).unwrap();
@@ -60,25 +52,15 @@ fn mcp_connect_serves_before_the_app_runs_and_reaches_it_once_it_does() {
     let listener = TcpListener::bind(&addr).unwrap();
     let app = std::thread::spawn(move || {
         let (stream, _) = listener.accept().unwrap();
-        let mut lines = BufReader::new(stream.try_clone().unwrap());
-        loop {
-            let mut line = String::new();
-            lines.read_line(&mut line).unwrap();
-            let req: Value = serde_json::from_str(&line).unwrap();
-            // The server first asks for the agents' output options (the compact preference: off).
-            let options = req["method"] == "mcp.options";
-            let reply = if req["token"] != json!(token) {
-                json!({"id": req["id"], "ok": false, "error": format!("unauthorized: token {}", req["token"])})
-            } else if options {
-                json!({"id": req["id"], "ok": true, "result": {"compact": false}})
-            } else {
-                json!({"id": req["id"], "ok": true, "result": {"bodies": [], "method": req["method"]}})
-            };
-            writeln!(&stream, "{reply}").unwrap();
-            if !options {
-                break;
-            }
-        }
+        let mut line = String::new();
+        BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let reply = if req["token"] == json!(token) {
+            json!({"id": req["id"], "ok": true, "result": {"bodies": [], "method": req["method"]}})
+        } else {
+            json!({"id": req["id"], "ok": false, "error": format!("unauthorized: token {}", req["token"])})
+        };
+        writeln!(&stream, "{reply}").unwrap();
     });
     let r = ask(4, "tools/call", measure);
     assert_ne!(r["result"]["isError"], true, "{r}");
@@ -99,295 +81,3 @@ fn mcp_connect_without_a_port_is_refused_at_start() {
         assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
     }
 }
-
-/// `mcp` with no arguments finds the running app through the discovery file and uses that
-/// launch's token; with no app behind the file it stays a headless session.
-#[test]
-fn mcp_without_arguments_finds_the_running_app() {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-    let port = listener.local_addr().unwrap().port();
-    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-discover-{}-{port}", std::process::id()));
-    std::fs::create_dir_all(&control_dir).unwrap();
-    let token = "fedcba9876543210".repeat(4);
-    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
-    std::fs::write(control_dir.join("current.port"), format!("{port}\n")).unwrap();
-    let app = std::thread::spawn(move || {
-        // The discovery probe connects and leaves without a request; the tool call follows.
-        let (stream, line) = loop {
-            let (stream, _) = listener.accept().unwrap();
-            let mut line = String::new();
-            BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
-            if !line.is_empty() {
-                break (stream, line);
-            }
-        };
-        let mut lines = BufReader::new(stream.try_clone().unwrap());
-        let mut line = line;
-        // The server first asks for the agents' output options (the compact preference: off).
-        loop {
-            let req: Value = serde_json::from_str(&line).unwrap();
-            let ok = req["token"] == json!(token);
-            let options = req["method"] == "mcp.options";
-            let result = if options { json!({"compact": false}) } else { json!({"bodies": [], "method": req["method"]}) };
-            writeln!(&stream, "{}", json!({"id": req["id"], "ok": ok, "result": result, "error": "unauthorized"})).unwrap();
-            if !options {
-                break;
-            }
-            line.clear();
-            lines.read_line(&mut line).unwrap();
-        }
-    });
-    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .args(["mcp", "--allow-any-path"])
-        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
-        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .unwrap();
-    let mut stdin = child.stdin.take().unwrap();
-    let mut stdout = BufReader::new(child.stdout.take().unwrap());
-    writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "measure", "arguments": {}}})).unwrap();
-    let mut line = String::new();
-    stdout.read_line(&mut line).unwrap();
-    let r: Value = serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"));
-    assert_ne!(r["result"]["isError"], true, "{r}");
-    assert!(r["result"]["content"][0]["text"].as_str().unwrap_or_default().contains("engine.execute"), "{r}");
-    app.join().unwrap();
-    drop(stdin);
-    assert!(child.wait().unwrap().success());
-
-    // The file names a port nothing listens on (the app crashed): a headless session instead.
-    let closed = TcpListener::bind("127.0.0.1:0").unwrap();
-    let dead = closed.local_addr().unwrap().port();
-    drop(closed);
-    std::fs::write(control_dir.join("current.port"), format!("{dead}\n")).unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .args(["mcp", "--allow-any-path"])
-        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
-        .stdin(Stdio::null())
-        .output()
-        .unwrap();
-    assert!(!String::from_utf8_lossy(&out.stderr).contains("bridged to the running app"), "{}", String::from_utf8_lossy(&out.stderr));
-    std::fs::remove_dir_all(&control_dir).ok();
-}
-
-/// `mcp setup` against a temporary home: the client folders it finds are the only ones it writes.
-mod setup {
-    use serde_json::{Value, json};
-    use std::path::{Path, PathBuf};
-    use std::process::Command;
-
-    fn home(name: &str) -> PathBuf {
-        let h = std::env::temp_dir().join(format!("solidcraft-mcp-setup-{name}-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&h);
-        std::fs::create_dir_all(&h).unwrap();
-        h
-    }
-
-    fn run(home: &Path, args: &[&str]) -> std::process::Output {
-        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-            .args(["mcp", "setup"])
-            .args(args)
-            .env_clear()
-            .env("HOME", home)
-            .env("USERPROFILE", home)
-            .env("APPDATA", home.join("AppData/Roaming"))
-            .env("LOCALAPPDATA", home.join("AppData/Local"))
-            .env("XDG_CONFIG_HOME", home.join(".config"))
-            .env("PATH", "")
-            .output()
-            .unwrap()
-    }
-
-    fn json_of(p: &Path) -> Value {
-        serde_json::from_str(&std::fs::read_to_string(p).unwrap()).unwrap()
-    }
-
-    fn exe() -> String {
-        let p = Path::new(env!("CARGO_BIN_EXE_solidcraft-cli")).canonicalize().unwrap();
-        p.to_string_lossy().trim_start_matches(r"\\?\").to_owned()
-    }
-
-    #[test]
-    fn merges_into_opencode_and_cursor_keeping_other_servers() {
-        let h = home("merge");
-        let oc = h.join(".config/opencode");
-        std::fs::create_dir_all(&oc).unwrap();
-        let old = json!({"$schema": "https://opencode.ai/config.json", "theme": "x", "mcp": {"other": {"type": "local", "command": ["o"]}}});
-        std::fs::write(oc.join("opencode.json"), old.to_string()).unwrap();
-        std::fs::create_dir_all(h.join(".cursor")).unwrap();
-        std::fs::write(h.join(".cursor/mcp.json"), r#"{"mcpServers": {"other": {"command": "o"}}}"#).unwrap();
-
-        let out = run(&h, &["--live"]);
-        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-        let v = json_of(&oc.join("opencode.json"));
-        assert_eq!(v["theme"], "x");
-        assert_eq!(v["mcp"]["other"], old["mcp"]["other"]);
-        assert_eq!(v["mcp"]["solidcraft"], json!({"type": "local", "command": [exe(), "mcp"], "enabled": true}));
-        assert_eq!(v["mcp"]["solidcraft-live"]["command"], json!([exe(), "mcp", "--connect", "127.0.0.1:7878"]));
-        assert_eq!(json_of(&oc.join("opencode.json.bak")), old);
-        let c = json_of(&h.join(".cursor/mcp.json"));
-        assert_eq!(c["mcpServers"]["other"], json!({"command": "o"}));
-        assert_eq!(c["mcpServers"]["solidcraft"], json!({"command": exe(), "args": ["mcp"]}));
-
-        // Codex (TOML) and Claude Code (a big file the CLI owns) are edited in place too.
-        std::fs::create_dir_all(h.join(".codex")).unwrap();
-        std::fs::write(h.join(".codex/config.toml"), "# mine\nmodel = \"x\"\n").unwrap();
-        let cc = "{\n  \"numStartups\": 3,\n  \"projects\": {}\n}\n";
-        std::fs::write(h.join(".claude.json"), cc).unwrap();
-        assert!(run(&h, &[]).status.success());
-        let toml = std::fs::read_to_string(h.join(".codex/config.toml")).unwrap();
-        assert!(toml.starts_with("# mine\nmodel = \"x\"\n") && toml.contains("[mcp_servers.solidcraft]"), "{toml}");
-        let c = json_of(&h.join(".claude.json"));
-        assert_eq!(c["numStartups"], 3);
-        assert_eq!(c["mcpServers"]["solidcraft"], json!({"type": "stdio", "command": exe(), "args": ["mcp"]}));
-        assert_eq!(std::fs::read_to_string(h.join(".claude.json.bak")).unwrap(), cc);
-
-        // Running again updates the same entries and leaves one of each.
-        assert!(run(&h, &[]).status.success());
-        assert_eq!(json_of(&h.join(".cursor/mcp.json"))["mcpServers"].as_object().unwrap().len(), 3);
-    }
-
-    #[test]
-    fn dry_run_writes_nothing_and_missing_clients_are_skipped() {
-        let h = home("dry");
-        std::fs::create_dir_all(h.join(".cursor")).unwrap();
-        let out = run(&h, &["--dry-run"]);
-        assert!(out.status.success());
-        let text = String::from_utf8_lossy(&out.stdout);
-        assert!(text.contains("would write") && text.contains("solidcraft"), "{text}");
-        assert!(!h.join(".cursor/mcp.json").exists());
-        assert!(!h.join(".config/opencode").exists(), "OpenCode was not installed, so nothing is created for it");
-        let out = run(&h, &["--client", "claude-desktop"]);
-        assert!(String::from_utf8_lossy(&out.stdout).contains("not found"));
-    }
-
-    #[test]
-    fn a_file_that_is_not_json_is_left_alone() {
-        let h = home("bad");
-        std::fs::create_dir_all(h.join(".cursor")).unwrap();
-        std::fs::write(h.join(".cursor/mcp.json"), "{ // comment").unwrap();
-        let out = run(&h, &[]);
-        assert!(!out.status.success());
-        assert_eq!(std::fs::read_to_string(h.join(".cursor/mcp.json")).unwrap(), "{ // comment");
-    }
-
-    #[test]
-    fn claude_desktop_msix_folder_is_found() {
-        let h = home("msix");
-        let pkg = h.join("AppData/Local/Packages/Claude_abc/LocalCache/Roaming/Claude");
-        std::fs::create_dir_all(&pkg).unwrap();
-        // The MSIX folder is only read through LOCALAPPDATA, set for every platform here.
-        assert!(run(&h, &["--client", "claude-desktop"]).status.success());
-        assert!(json_of(&pkg.join("claude_desktop_config.json"))["mcpServers"]["solidcraft"].is_object());
-    }
-}
-
-/// Scratch files belong to the CLI process; exercise real startup, requests and shutdown.
-mod scratch_cleanup {
-    use super::*;
-    use std::path::{Path, PathBuf};
-
-    fn command(case: &str) -> (PathBuf, Command) {
-        let dir = std::env::temp_dir().join(format!("solidcraft-mcp-lifecycle-{case}-{}", std::process::id()));
-        std::fs::create_dir(&dir).unwrap();
-        let mut command = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"));
-        command
-            .args(["mcp", "--headless"])
-            .env("TMPDIR", &dir)
-            .env("TMP", &dir)
-            .env("TEMP", &dir)
-            .env("SOLIDCRAFT_RECOVERY_DIR", dir.join("recovery"))
-            .stdin(Stdio::piped())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
-        (dir, command)
-    }
-
-    fn scratch_folders(dir: &Path) -> Vec<PathBuf> {
-        std::fs::read_dir(dir)
-            .unwrap()
-            .map(|entry| entry.unwrap().path())
-            .filter(|path| path.file_name().unwrap().to_string_lossy().starts_with("solidcraft-mcp-"))
-            .collect()
-    }
-
-    fn initialize() -> Value {
-        json!({"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {"protocolVersion": "2025-06-18"}})
-    }
-
-    fn run(mut command: Command, request: Value) -> std::process::Output {
-        let mut child = command.spawn().unwrap();
-        writeln!(child.stdin.take().unwrap(), "{request}").unwrap();
-        child.wait_with_output().unwrap()
-    }
-
-    #[test]
-    fn eof_removes_only_the_process_scratch_folder() {
-        let (dir, command) = command("eof");
-        let unrelated = dir.join("solidcraft-mcp-unrelated");
-        std::fs::create_dir(&unrelated).unwrap();
-        let out = run(command, initialize());
-        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-        let reply: Value = serde_json::from_slice(&out.stdout).unwrap();
-        assert!(reply.get("result").is_some(), "{reply}");
-        assert_eq!(scratch_folders(&dir), vec![unrelated]);
-        assert!(dir.join("recovery").is_dir(), "cleanup must leave the recovery folder alone");
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[test]
-    fn startup_error_removes_the_process_scratch_folder() {
-        let (dir, mut command) = command("startup-error");
-        let out = command.args(["--param-check", "invalid"]).stdin(Stdio::null()).output().unwrap();
-        let stderr = String::from_utf8_lossy(&out.stderr);
-        assert!(!out.status.success());
-        assert!(stderr.contains("--param-check wants off, warn or strict"), "{stderr}");
-        assert!(scratch_folders(&dir).is_empty(), "startup error left a scratch folder in {dir:?}");
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[test]
-    fn shutdown_preserves_nonempty_scratch_folder() {
-        let (dir, mut command) = command("nonempty");
-        let mut child = command.spawn().unwrap();
-        let mut input = child.stdin.take().unwrap();
-        writeln!(input, "{}", initialize()).unwrap();
-        let mut reply = String::new();
-        BufReader::new(child.stdout.take().unwrap()).read_line(&mut reply).unwrap();
-        let reply: Value = serde_json::from_str(&reply).unwrap();
-        assert!(reply.get("result").is_some(), "{reply}");
-        let scratch = scratch_folders(&dir);
-        assert_eq!(scratch.len(), 1);
-        let saved = scratch[0].join("keep.txt");
-        std::fs::write(&saved, "saved output").unwrap();
-        drop(input);
-        let out = child.wait_with_output().unwrap();
-        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-        assert_eq!(std::fs::read_to_string(saved).unwrap(), "saved output");
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-
-    #[test]
-    fn failed_screenshot_scratch_folder_is_removed_without_a_path_scope() {
-        let (dir, mut command) = command("screenshot");
-        command.arg("--allow-any-path");
-        // A headless server cannot capture a window. The request still allocates a scratch
-        // path before the backend refuses it, without relying on a GPU or installed renderer.
-        let out = run(
-            command,
-            json!({
-                "jsonrpc": "2.0", "id": 1, "method": "tools/call",
-                "params": {"name": "screenshot", "arguments": {"source": "window"}},
-            }),
-        );
-        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
-        let reply: Value = serde_json::from_slice(&out.stdout).unwrap();
-        assert_eq!(reply["result"]["isError"], true, "{reply}");
-        assert!(reply["result"]["content"][0]["text"].as_str().unwrap().contains("the window gave no picture"), "{reply}");
-        assert!(scratch_folders(&dir).is_empty(), "failed screenshot left a scratch folder in {dir:?}");
-        std::fs::remove_dir_all(dir).unwrap();
-    }
-}

apps/solidcraft-cli/tests/mcp_param_check.rs

@@ -1,50 +0,0 @@
-//! `mcp --in script --param-check <level>`: the level applies to the script the session starts
-//! from too, so a misspelled key in it is refused (strict) or reported on stderr (warn) instead of
-//! silently ignored.
-
-use std::process::{Command, Stdio};
-
-#[test]
-fn param_check_applies_to_the_starting_script() {
-    let dir = std::env::temp_dir().join(format!("solidcraft-mcp-param-check-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let script = dir.join("typo.json");
-    let box_ = r#"{"command": "solid.box", "params": {"length": 5, "width": 5, "height": 5, "operaton": "cut"}}"#;
-    std::fs::write(&script, format!(r#"{{"commands": [{box_}]}}"#)).unwrap();
-    let run = |level: &str| {
-        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-            .args(["mcp", "--in", script.to_str().unwrap(), "--param-check", level])
-            .stdin(Stdio::null())
-            .output()
-            .unwrap()
-    };
-    let strict = run("strict");
-    let stderr = String::from_utf8_lossy(&strict.stderr);
-    assert!(!strict.status.success(), "{stderr}");
-    assert!(stderr.contains("unknown key `operaton`; did you mean `operation`?"), "{stderr}");
-    // Warn: the script runs, and its warnings go to stderr.
-    let warn = run("warn");
-    let stderr = String::from_utf8_lossy(&warn.stderr);
-    assert!(warn.status.success(), "{stderr}");
-    assert!(stderr.contains("step 1: unknown key `operaton`; did you mean `operation`?"), "{stderr}");
-    // A warned step's warning is printed even when a later step fails.
-    let failing = dir.join("typo_then_failure.json");
-    std::fs::write(&failing, format!(r#"{{"commands": [{box_}, {{"command": "no.such_command"}}]}}"#)).unwrap();
-    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .args(["mcp", "--in", failing.to_str().unwrap(), "--param-check", "warn"])
-        .stdin(Stdio::null())
-        .output()
-        .unwrap();
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert!(!out.status.success(), "{stderr}");
-    assert!(stderr.contains("step 1: unknown key `operaton`") && stderr.contains("step 2"), "{stderr}");
-    // Off: the script runs as before, and the server ends with its input.
-    let off = run("off");
-    assert!(off.status.success(), "{}", String::from_utf8_lossy(&off.stderr));
-    assert!(!String::from_utf8_lossy(&off.stderr).contains("operaton"));
-    // A bare flag is an error, not off.
-    let bare = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--param-check"]).stdin(Stdio::null()).output().unwrap();
-    assert!(!bare.status.success());
-    assert!(String::from_utf8_lossy(&bare.stderr).contains("--param-check wants off, warn or strict"));
-    std::fs::remove_dir_all(&dir).ok();
-}

apps/solidcraft-cli/tests/mcp_render_host.rs

@@ -1,9 +0,0 @@
-//! Explicit native GPU registration must not change bridged MCP ownership.
-use std::process::Command;
-#[test]
-fn connected_application_rejects_headless_gpu_installation_before_connecting() {
-    let result = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--render-gpu", "--connect", "127.0.0.1:1"]).output().unwrap();
-    assert!(!result.status.success());
-    let message = String::from_utf8_lossy(&result.stderr);
-    assert!(message.contains("connected application owns its own device"), "{message}");
-}

apps/solidcraft-cli/tests/model_cache.rs

@@ -1,388 +0,0 @@
-//! A design opened from the model its file keeps is the design evaluated again: the same
-//! results, the same bodies (to the bit), the same face names and volumes after every feature,
-//! and the same after an edit made to both.
-
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-use serde_json::{Value, json};
-use solidcraft_engine::Session;
-use solidcraft_engine::doc::{ModelBody, ModelState, SavedModel};
-
-fn corpus() -> Vec<PathBuf> {
-    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
-    let mut v: Vec<PathBuf> =
-        std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "solidcraft")).collect();
-    v.sort();
-    v
-}
-
-fn temp(name: &str) -> PathBuf {
-    std::env::temp_dir().join(format!("solidcraft-model-cache-{}-{name}.solidcraft", std::process::id()))
-}
-
-fn open(path: &Path) -> Session {
-    let mut s = Session::default();
-    s.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
-    s
-}
-
-fn body(name: &str, b: &ModelBody) -> Value {
-    let measured = solidcraft_engine::kernel::measure(&b.body).ok();
-    json!({
-        "name": b.name, "feature": b.feature, "component": b.component, "source": b.source_name, "transferred": b.transferred,
-        "brep": solidcraft_engine::kernel::encode_native_body(&b.body).map(|bytes| format!("{:x}", sha(&bytes))).unwrap_or_else(|e| format!("{name}: {e}")),
-        "faces": *solidcraft_engine::doc::naming::face_names(b),
-        "volume": measured.as_ref().map(|m| m.volume.to_bits()), "area": measured.as_ref().map(|m| m.area.to_bits()),
-        "look": b.imported.as_ref().map(|l| format!("{l:?}")),
-    })
-}
-
-fn sha(bytes: &[u8]) -> u128 {
-    use std::hash::{Hash, Hasher};
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    bytes.hash(&mut h);
-    let a = h.finish();
-    bytes.len().hash(&mut h);
-    (u128::from(a) << 64) | u128::from(h.finish())
-}
-
-fn state(name: &str, st: &Arc<ModelState>) -> Value {
-    json!({
-        "bodies": st.bodies.iter().map(|b| body(name, b)).collect::<Vec<_>>(),
-        "sketches": st.sketches.iter().map(|s| json!([s.feature, s.name, s.plane, s.sketch, s.report, s.profiles.len()])).collect::<Vec<_>>(),
-        "counter": st.body_counter, "sheets": st.sheets, "threads": st.threads, "construct": format!("{:?}", st.construct),
-    })
-}
-
-/// Everything a model holds that the rest of the app reads.
-fn model(name: &str, s: &Session) -> Value {
-    let results: Vec<Value> = s
-        .model
-        .results
-        .iter()
-        .map(|r| json!({"id": r.id, "name": r.name, "error": r.error, "warning": r.warning, "skipped": r.skipped, "state": state(name, &r.state)}))
-        .collect();
-    json!({"results": results, "world": state(name, &s.world_state().unwrap())})
-}
-
-/// The same edit on both: a parameter's value when the design has one, else a new body.
-fn edit(s: &mut Session) {
-    let param = s.doc.params.first().map(|p| (p.name.clone(), p.expr.clone()));
-    match param {
-        Some((name, expr)) => {
-            s.execute("parameters.change", &json!({"name": name, "expression": format!("({expr}) * 1.05")})).unwrap();
-        }
-        None => {
-            s.execute("solid.box", &json!({"length": 7, "width": 8, "height": 9, "operation": "new"})).unwrap();
-        }
-    }
-}
-
-fn check(name: &str, mut built: Session) {
-    let path = temp(name);
-    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-    let bytes = std::fs::read(&path).unwrap();
-    assert!(solidcraft_engine::io::read_design_geometry(&bytes).is_some(), "{name}: the save keeps the model");
-    let mut cached = open(&path);
-    assert_eq!(cached.model.last_recomputed, 0, "{name}: opened without evaluating");
-    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
-    assert!(rebuilt.model.last_recomputed > 0);
-    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: opened from the file's model");
-    edit(&mut cached);
-    edit(&mut rebuilt);
-    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: after the same edit");
-    cached.execute("edit.undo", &json!({})).unwrap();
-    rebuilt.execute("edit.undo", &json!({})).unwrap();
-    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: after undoing it");
-    let _ = std::fs::remove_file(&path);
-    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-}
-
-#[test]
-fn corpus_designs_open_from_their_model_as_evaluated() {
-    for p in corpus() {
-        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-        let s = open(&p);
-        // Names saved before format 14 are found again through names worked out from geometry on
-        // demand, which a saved model does not keep.
-        let legacy = s.doc.to_json().contains(&format!("\"{}", solidcraft_engine::doc::naming::LEGACY_MARK));
-        if s.model.results.iter().any(|r| r.error.is_some()) || legacy {
-            // Not kept: a model with errors, or names saved before format 14.
-            let path = temp(&name);
-            let mut s = s;
-            s.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-            assert!(solidcraft_engine::io::read_design_geometry(&std::fs::read(&path).unwrap()).is_none(), "{name}");
-            let _ = std::fs::remove_file(&path);
-            let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-            continue;
-        }
-        check(&name, s);
-    }
-}
-
-#[test]
-fn sample_designs_open_from_their_model_as_evaluated() {
-    for sample in solidcraft_engine::sample::samples() {
-        let mut s = Session::default();
-        for c in (sample.script)()["commands"].as_array().unwrap() {
-            s.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap_or_else(|e| panic!("{}: {e}", sample.name));
-        }
-        check(sample.name, s);
-    }
-}
-
-#[test]
-fn imported_assemblies_open_from_their_model_as_evaluated() {
-    // A STEP assembly of the hinge sample: parts placed several times.
-    let mut source = Session::default();
-    let hinge = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Hinge Assembly").unwrap();
-    for c in (hinge.script)()["commands"].as_array().unwrap() {
-        source.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-    }
-    let step = std::env::temp_dir().join(format!("solidcraft-model-cache-{}-hinge.step", std::process::id()));
-    source.execute("file.export", &json!({"path": step.to_string_lossy()})).unwrap();
-    let mut s = Session::default();
-    s.execute("file.insert_step", &json!({"path": step.to_string_lossy()})).unwrap();
-    s.execute("file.insert_step", &json!({"path": step.to_string_lossy(), "matrix": [1, 0, 0, 200, 0, 1, 0, 0, 0, 0, 1, 0]})).unwrap();
-    let _ = std::fs::remove_file(&step);
-    check("imported hinge", s);
-}
-
-/// `built` saved with `saved`, a model of it that keeps only some states (as a file without room
-/// for all of them does, #3220), opens as the design evaluated again: evaluating just the
-/// features whose state the file left out, then after suppressing a feature at, before or after
-/// each state it kept, after undoing that, and with the marker moved there and back.
-fn check_thinned(name: &str, built: &Session, saved: &SavedModel) {
-    let design = built.design();
-    let bytes =
-        solidcraft_engine::io::write_design_container_with_cache(&design, solidcraft_engine::io::DesignCompression::Fast, None, Some(saved)).unwrap();
-    assert!(solidcraft_engine::io::read_design_geometry(&bytes).is_some(), "{name}: the file keeps the final state");
-    let path = temp(&name.replace(' ', "-"));
-    std::fs::write(&path, &bytes).unwrap();
-    let mut cached = open(&path);
-    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
-    let features = saved.records["features"].as_array().unwrap();
-    let unkept = features.iter().filter(|f| f["skipped"] == false && f.get("state").is_none()).count();
-    assert!(unkept > 0, "{name}: some states left out");
-    assert_eq!(cached.model.recomputed, unkept, "{name}: evaluated just the features whose state the file left out");
-    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: opened from the file's model");
-    let n = cached.doc.features.len();
-    let mut at: Vec<usize> = features
-        .iter()
-        .enumerate()
-        .filter(|(_, f)| f["skipped"] == false && f.get("state").is_some())
-        .flat_map(|(k, _)| [k.saturating_sub(1), k, k + 1])
-        .filter(|i| *i < n)
-        .collect();
-    at.dedup();
-    for i in at {
-        let edit = json!({"feature": cached.doc.features[i].id, "suppressed": true});
-        let (a, b) = (cached.execute("timeline.suppress", &edit), rebuilt.execute("timeline.suppress", &edit));
-        assert_eq!(a.is_ok(), b.is_ok(), "{name}: suppressing feature {i}");
-        assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: feature {i} suppressed");
-        if a.is_ok() {
-            cached.execute("edit.undo", &json!({})).unwrap();
-            rebuilt.execute("edit.undo", &json!({})).unwrap();
-            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: suppressing feature {i} undone");
-        }
-        for marker in [json!({"position": i}), json!({})] {
-            cached.execute("timeline.rollback", &marker).unwrap();
-            rebuilt.execute("timeline.rollback", &marker).unwrap();
-            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: the marker at {marker}, from feature {i}");
-        }
-    }
-    let _ = std::fs::remove_file(&path);
-}
-
-/// A model too big for its file keeps the final state, then the slowest features' states as fit
-/// (#3220). Both the smallest such model (the final state, and states that add no body to it)
-/// and one that keeps more open as the design evaluated again. The placed components' design has
-/// a cut whose fingerprint reads where the bodies before it lie, which a state left out does not
-/// say until it is evaluated.
-#[test]
-fn thinned_models_open_as_evaluated() {
-    let corpus = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/components-arm.solidcraft");
-    for sample in ["Sample Plate", "Plastic Enclosure", "components-arm"] {
-        let built = match solidcraft_engine::sample::samples().into_iter().find(|s| s.name == sample) {
-            Some(s) => {
-                let mut built = Session::default();
-                for c in (s.script)()["commands"].as_array().unwrap() {
-                    built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-                }
-                built
-            }
-            None => open(&corpus),
-        };
-        let saved = built.model.saved(&built.design()).unwrap();
-        // Every body a megabyte (the records fit in the room left over): each budget keeps one more
-        // body's worth of states.
-        let body = 1 << 20;
-        let pieces: Vec<Vec<(usize, usize)>> = (0..saved.bodies.len()).map(|i| vec![(i, body)]).collect();
-        let thinned: Vec<SavedModel> =
-            (0..=saved.bodies.len()).filter_map(|n| saved.thinned(&pieces, n * body + body - 1).map(|(m, _, _)| m)).collect();
-        let kept = |m: &SavedModel| m.records["features"].as_array().unwrap().iter().filter(|f| f.get("state").is_some()).count();
-        let smallest = thinned.first().unwrap();
-        assert!(smallest.records["states"].as_array().unwrap().len() < saved.records["states"].as_array().unwrap().len(), "{sample}");
-        let more = thinned.iter().find(|m| kept(m) > kept(smallest) && kept(m) < built.doc.features.len()).unwrap();
-        check_thinned(&format!("{sample} smallest"), &built, smallest);
-        check_thinned(&format!("{sample} thinned"), &built, more);
-    }
-}
-
-/// Opened from its model, a design evaluates only from the first feature an edit changes: the
-/// saved states before it are kept as they were read (the same states, not evaluated again).
-#[test]
-fn an_edit_after_opening_evaluates_from_the_feature_it_changes() {
-    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
-    let mut built = Session::default();
-    for c in (plate.script)()["commands"].as_array().unwrap() {
-        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-    }
-    let path = temp("incremental");
-    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-    let n = built.doc.features.len();
-    assert!(n >= 4);
-    let mut s = open(&path);
-    assert_eq!(s.model.last_recomputed, 0);
-    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
-    // How many of the first features still have the states read from the file.
-    let kept = |s: &Session| s.model.results.iter().zip(&read).take_while(|(r, st)| Arc::ptr_eq(&r.state, st)).count();
-    // The marker moved back and forth: the features before it are as read.
-    s.execute("timeline.rollback", &json!({"position": n - 2})).unwrap();
-    assert_eq!(kept(&s), n - 2, "rolled back");
-    s.execute("timeline.rollback", &json!({})).unwrap();
-    assert_eq!(kept(&s), n, "rolled forward: the features after the marker take their saved results again");
-    // Suppressing the second-to-last feature keeps every state before it.
-    let k = s.doc.features[n - 2].id;
-    s.execute("timeline.suppress", &json!({"feature": k, "suppressed": true})).unwrap();
-    assert_eq!(kept(&s), n - 2, "evaluated from the suppressed feature on");
-    s.execute("edit.undo", &json!({})).unwrap();
-    // A new feature at the end starts from the final state read from the file.
-    let mut s = open(&path);
-    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
-    s.execute("solid.box", &json!({"length": 3, "width": 3, "height": 3, "operation": "new"})).unwrap();
-    assert_eq!(s.model.results.len(), n + 1);
-    assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "only the new feature evaluated");
-    let _ = std::fs::remove_file(&path);
-    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-}
-
-/// An edit made after opening and undone finds the saved results again: undo evaluates nothing.
-#[test]
-fn undoing_an_edit_after_opening_reuses_the_saved_results() {
-    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
-    let mut built = Session::default();
-    for c in (plate.script)()["commands"].as_array().unwrap() {
-        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-    }
-    let path = temp("undo");
-    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-    let mut s = open(&path);
-    let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
-    let first = s.doc.features[1].id;
-    s.execute("timeline.suppress", &json!({"feature": first, "suppressed": true})).unwrap();
-    s.execute("edit.undo", &json!({})).unwrap();
-    assert_eq!(s.model.last_recomputed, 0, "taken from the saved results");
-    assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "the very states read from the file");
-    let _ = std::fs::remove_file(&path);
-    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-}
-
-/// A saved model holds the results of the body check mode it was evaluated under: opened under
-/// the same mode it is taken as it is, under another the design is evaluated again.
-#[test]
-fn a_model_saved_under_another_check_mode_is_evaluated_again() {
-    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
-    let mut built = Session::default();
-    for c in (plate.script)()["commands"].as_array().unwrap() {
-        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-    }
-    let path = temp("mode");
-    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-    let same = open(&path);
-    assert_eq!(same.model.validation(), built.model.validation());
-    assert_eq!(same.model.recomputed, 0, "taken from the file");
-    let mut other = Session::default();
-    other.set_validation(solidcraft_engine::kernel::Validation::EachStep);
-    assert_ne!(other.validation(), built.model.validation());
-    other.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap();
-    assert_eq!(other.validation(), solidcraft_engine::kernel::Validation::EachStep);
-    assert!(other.model.recomputed > 0, "evaluated again under its own mode");
-    let _ = std::fs::remove_file(&path);
-    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-}
-
-/// A body made by rounds keeps, in the saved model, the rounds and the body they were made on: a
-/// later round at the corner where they meet blends them again with it whether the design was
-/// opened from its model or evaluated anew. Two edges of a 20 mm box rounded r2 (a mitre at the
-/// corner (20, 0, 20)), saved; opened, the upright edge there rounded r3: the corner all three
-/// rounded at once make (SMLib's setback corner, kernel `three_rounds_at_a_corner`), 15 faces and
-/// 7927.72428251348 mm³, the same body as the design evaluated anew.
-#[test]
-fn a_later_round_after_opening_blends_the_saved_rounds_again() {
-    let mut built = Session::default();
-    built.execute("solid.box", &json!({"length": 20, "width": 20, "height": 20, "body_name": "Box"})).unwrap();
-    built.execute("solid.fillet", &json!({"edges": [[20, 10, 20], [10, 0, 20]], "radius": 2})).unwrap();
-    let path = temp("later-round");
-    built.execute("file.save_as", &json!({"path": path.to_string_lossy()})).unwrap();
-    let bytes = std::fs::read(&path).unwrap();
-    let mut cached = open(&path);
-    assert_eq!(cached.model.last_recomputed, 0, "opened without evaluating");
-    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
-    for s in [&mut cached, &mut rebuilt] {
-        s.execute("solid.fillet", &json!({"edges": [[20, 0, 10]], "radius": 3})).unwrap();
-        let st = s.model.state();
-        let b = &st.body("Box").unwrap().body;
-        let v = solidcraft_engine::kernel::measure(b).unwrap().volume;
-        assert_eq!(b.face_count(), 15);
-        assert!((v - 7927.72428251348).abs() < 1e-6, "{v}"); // solidcore#2382's setback corner
-    }
-    assert_eq!(model("later round", &cached), model("later round", &rebuilt));
-    let _ = std::fs::remove_file(&path);
-    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
-}
-
-/// A design saved before body names were pinned (#6403) pins them as it opens, as its first
-/// command would, and opening it is no change. That command pinned them as part of itself, so
-/// undoing it went back to the unpinned design, which no evaluated result matched: the first
-/// undo after opening from the command line evaluated every feature again (82-93 s in a
-/// 5,484-feature design); `doc.open` pinned them after opening, which marked the design changed.
-#[test]
-fn a_design_saved_before_names_were_pinned_opens_pinned_and_unchanged() {
-    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
-    let mut built = Session::default();
-    for c in (plate.script)()["commands"].as_array().unwrap() {
-        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
-    }
-    let mut doc = built.design().into_owned();
-    for f in &mut doc.features {
-        f.body_names.clear();
-    }
-    doc.reserved_body_names.clear();
-    let unpinned = Session::new(doc);
-    let design = unpinned.design();
-    let saved = unpinned.model.saved(&design).unwrap();
-    let bytes = solidcraft_engine::io::write_design_container_with_cache(&design, solidcraft_engine::io::DesignCompression::Fast, None, Some(&saved))
-        .unwrap();
-    let path = temp("unpinned");
-    std::fs::write(&path, &bytes).unwrap();
-    let file = path.to_string_lossy().to_string();
-    // As the command line opens a design (`load`), and as the app does (`doc.open`).
-    let (doc, saved) = solidcraft_engine::io::read_design_file(&file, None::<fn(solidcraft_engine::io::DesignPreview)>).unwrap();
-    for (how, mut s) in [("opened_at", Session::opened_at(doc, saved.as_ref(), Some(&file))), ("doc.open", open(&path))] {
-        assert_eq!(s.model.last_recomputed, 0, "{how}: taken from the file");
-        assert!(s.doc.features.iter().any(|f| !f.body_names.is_empty()), "{how}: the names are pinned");
-        assert!(!s.is_dirty(), "{how}: opening is no change");
-        let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
-        s.execute("solid.box", &json!({"length": 3, "width": 3, "height": 3, "operation": "new"})).unwrap();
-        // As in a large design, whose evaluation cache keeps only a few results: undo finds the
-        // results in the model itself or evaluates them again.
-        *s.model.cache.lock().unwrap() = Default::default();
-        s.execute("edit.undo", &json!({})).unwrap();
-        assert_eq!(s.model.last_recomputed, 0, "{how}: the first undo evaluates nothing");
-        assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "{how}: the states read from the file");
-        assert!(!s.is_dirty(), "{how}: undone to the design as opened");
-    }
-    let _ = std::fs::remove_file(&path);
-}

apps/solidcraft-cli/tests/naming_corpus.rs

@@ -1,404 +0,0 @@
-//! Every design of the corpus loads, two builds of it name its faces and edges alike, and a
-//! name it stores that no longer finds its face or edge fails its feature. The stored names are
-//! the fillet and chamfer edges, the faces a feature picks, the face a sketch sits on and the
-//! sheet metal edges; one that finds nothing (`gone`, a sketch's face `lost`) must leave its
-//! feature failed (it asks for the reference to be picked again, never takes another face or
-//! edge), and a design that no longer loads fails the test. A build's names are each face's and
-//! edge's name with where it is (its area and centre, its length and middle); the second build
-//! must give the same, and its stored names must find the same faces and edges.
-//!
-//! Face and edge indices are left out: they are the kernel's order, which a rebuild need not
-//! keep (a fillet's or a boolean's faces come out in another order from one build to the next).
-//! How many faces a body has and what each is called is the kernel's business, not this test's.
-//!
-//! The corpus is the action matrix's (the old design files in `tests/corpus`, the examples, the
-//! demo and typical designs in `tests/action_matrix/designs`, the reference recipes), the sample
-//! designs, the engine's design fixtures and the older designs kept by the hole matrix, taper
-//! and projection tests.
-
-use solidcraft_engine::geom::prelude::*;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-use serde_json::{Value, json};
-use solidcore_record::Vec3;
-use solidcraft_engine::Session;
-use solidcraft_engine::doc::{FaceAttachmentStatus, Feature, FeatureKind, ModelBody, ModelState, PlaneRef, naming};
-
-fn root() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("../..").canonicalize().unwrap()
-}
-
-/// Where a design comes from.
-enum Source {
-    File(PathBuf),
-    Sample(fn() -> Value),
-}
-
-/// Every design of the corpus: (`<group>/<design>`, where it comes from).
-fn designs() -> Vec<(String, Source)> {
-    let root = root();
-    let mut out = Vec::new();
-    let mut add = |prefix: &str, dir: PathBuf, ext: &str| {
-        let Ok(rd) = std::fs::read_dir(&dir) else { return };
-        let mut v: Vec<PathBuf> = rd.flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == ext)).collect();
-        v.sort();
-        for p in v {
-            let stem = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-            out.push((format!("{prefix}/{stem}"), Source::File(p)));
-        }
-    };
-    add("corpus", root.join("apps/solidcraft-cli/tests/corpus"), "solidcraft");
-    add("examples", root.join("examples"), "json");
-    add("examples", root.join("examples/acceptance"), "json");
-    add("regressions", root.join("examples/regressions"), "json");
-    add("demo", root.join("examples/demo"), "json");
-    add("typical", root.join("tests/action_matrix/designs"), "json");
-    add("demo", root.join("tests/action_matrix/designs"), "solidcraft");
-    add("fixtures", root.join("crates/engine/src/tests/fixtures"), "solidcraft");
-    add("hole_matrix", root.join("tests/hole_matrix/old-0.9"), "json");
-    add("taper", root.join("tests/taper/before-1014"), "json");
-    add("projection", root.join("tests/projection/before-1508"), "json");
-    let mut cases: Vec<PathBuf> =
-        std::fs::read_dir(root.join("tests/oracle")).unwrap().flatten().map(|e| e.path()).filter(|p| p.join("recipe.json").is_file()).collect();
-    cases.sort();
-    for c in cases {
-        out.push((format!("oracle/{}", c.file_name().unwrap_or_default().to_string_lossy()), Source::File(c.join("recipe.json"))));
-    }
-    for sample in solidcraft_engine::sample::samples() {
-        let stem: String = sample.name.to_lowercase().split_whitespace().collect::<Vec<_>>().join("-");
-        out.push((format!("samples/{stem}"), Source::Sample(sample.script)));
-    }
-    out
-}
-
-/// Build a design: a design file (also a design saved as JSON) is opened, a script is run.
-fn load(source: &Source) -> Result<Session, String> {
-    let mut s = Session::default();
-    let script = match source {
-        Source::Sample(script) => script(),
-        Source::File(path) if path.extension().is_some_and(|x| x == "solidcraft") => {
-            s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
-            return Ok(s);
-        }
-        Source::File(path) if path.file_name().is_some_and(|n| n == "recipe.json") => {
-            let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("recipe").arg(path).output().map_err(|e| e.to_string())?;
-            if !out.status.success() {
-                return Err(format!("recipe: {}", String::from_utf8_lossy(&out.stderr).trim()));
-            }
-            serde_json::from_slice(&out.stdout).map_err(|e| e.to_string())?
-        }
-        Source::File(path) => {
-            let v: Value = serde_json::from_slice(&std::fs::read(path).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
-            if v.get("features").is_some() {
-                s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
-                return Ok(s);
-            }
-            match v.get("steps").and_then(Value::as_array) {
-                // The demo's steps: an MCP `execute` each.
-                Some(steps) => {
-                    json!({"commands": steps.iter().map(|st| json!({"command": st["command"], "params": st["params"]})).collect::<Vec<_>>()})
-                }
-                None => v,
-            }
-        }
-    };
-    s.run_script(&script).map_err(|e| e.to_string())?;
-    if s.active_sketch.is_some() {
-        let _ = s.execute("sketch.finish", &json!({}));
-    }
-    Ok(s)
-}
-
-/// What decides a name beyond its text: `[geometric]` when it was worked out from geometry, not
-/// exact history.
-fn flags(list: &[(bool, &str)]) -> String {
-    let set: Vec<&str> = list.iter().filter(|(on, _)| *on).map(|(_, f)| *f).collect();
-    if set.is_empty() { String::new() } else { format!(" [{}]", set.join(", ")) }
-}
-
-/// Where each named face and edge of a body is, by name, sorted: a face's area and centre, an
-/// edge's length and middle, from the body's mesh. Two builds that name their faces alike give
-/// the same list.
-fn placed_names(b: &ModelBody) -> Vec<(String, [f64; 4])> {
-    if b.body.is_mesh() {
-        return Vec::new();
-    }
-    let m = b.mesh();
-    let faces = naming::face_names(b);
-    let mut sums = vec![[0.0f64; 4]; faces.len()];
-    for (t, f) in m.triangles.iter().zip(&m.tri_face) {
-        let [p, q, r] = t.map(|i| m.positions.get(i as usize).copied().unwrap_or(Vec3::ZERO));
-        let area = (q - p).cross(r - p).len() / 2.0;
-        let c = (p + q + r) / 3.0;
-        if let Some(s) = sums.get_mut(*f as usize) {
-            *s = [s[0] + area, s[1] + area * c.x, s[2] + area * c.y, s[3] + area * c.z];
-        }
-    }
-    let mut out: Vec<(String, [f64; 4])> = faces
-        .iter()
-        .zip(&sums)
-        .map(|(n, s)| {
-            let a = s[0].max(1e-300);
-            (format!("{} face {n}", b.name), [s[0], s[1] / a, s[2] / a, s[3] / a])
-        })
-        .collect();
-    for (n, line) in naming::edge_names(b).iter().zip(&m.edges) {
-        let length: f64 = line.windows(2).map(|w| w[1].dist(w[0])).sum();
-        let mid = line.iter().fold(Vec3::ZERO, |acc, p| acc + *p) / (line.len().max(1) as f64);
-        out.push((format!("{} edge {n}", b.name), [length, mid.x, mid.y, mid.z]));
-    }
-    out.sort_by(|x, y| x.0.cmp(&y.0).then(x.1.partial_cmp(&y.1).unwrap_or(std::cmp::Ordering::Equal)));
-    out
-}
-
-fn face_label(st: &ModelState, body: usize, face: usize) -> String {
-    match st.bodies.get(body) {
-        Some(b) => format!("{} face {}", b.name, naming::face_names(b).get(face).map(String::as_str).unwrap_or("?")),
-        None => format!("body #{body} face #{face}"),
-    }
-}
-
-/// Every name feature `f` stores, with what it finds in the model before it, as a feature
-/// rebuilding finds it, and whether it finds anything.
-fn record_refs(out: &mut Vec<(String, bool)>, s: &Session, f: &Feature) {
-    let doc = &*s.doc;
-    let who = format!("ref {} ({})", f.name, f.id);
-    let before = s.model.state_before(f.id);
-    // Faces a feature picks by point and stores by name (shell, draft, hole, …).
-    let explicit_emboss = matches!(&f.kind, FeatureKind::Emboss { face: Some(_), .. });
-    if f.face_names.iter().any(|n| !n.is_empty()) {
-        let fst = solidcraft_engine::doc::face_point_state(doc, &before, &f.kind, f.component).unwrap();
-        for (k, (p, n)) in f.kind.face_points().into_iter().zip(&f.face_names).enumerate() {
-            if n.is_empty() {
-                continue;
-            }
-            let (found, ok) = if explicit_emboss {
-                ("not checked (a cylindrical emboss finds its face on its own body)".to_string(), true)
-            } else {
-                match naming::locate_face_on_body(&fst, f.kind.face_body(), n, p) {
-                    Some(hit) => (format!("{}{}", face_label(&fst, hit.body, hit.face), flags(&[(!hit.verified, "geometric")])), true),
-                    None => ("gone".into(), false),
-                }
-            };
-            out.push((format!("{who} face {k} `{n}` -> {found}"), ok));
-        }
-    }
-    // Edges a feature picks by point and stores by name.
-    if f.edge_names.iter().any(|n| !n.is_empty()) {
-        let edge = |out: &mut Vec<(String, bool)>, b: &ModelBody, k: usize, n: &str, p: Vec3| {
-            let (found, ok) = match naming::locate_edge(b, n, p) {
-                Ok(hit) => (
-                    format!(
-                        "{} edge {}{}",
-                        b.name,
-                        naming::edge_names(b).get(hit.edge).map(String::as_str).unwrap_or("?"),
-                        flags(&[(!hit.verified, "geometric")])
-                    ),
-                    true,
-                ),
-                Err(e) => (format!("gone ({e})"), false),
-            };
-            out.push((format!("{who} edge {k} `{n}` -> {found}"), ok));
-        };
-        let named = |k: usize| f.edge_names.get(k).filter(|n| !n.is_empty());
-        match &f.kind {
-            FeatureKind::Fillet { edges, body, .. } | FeatureKind::Chamfer { edges, body, .. } => {
-                let pts: Vec<Vec3> = solidcraft_engine::doc::plain(edges);
-                match solidcraft_engine::doc::blend_target(&before, body, &pts).ok().and_then(|i| before.bodies.get(i)) {
-                    Some(b) => {
-                        for (k, p) in pts.iter().enumerate() {
-                            if let Some(n) = named(k) {
-                                edge(out, b, k, n, *p);
-                            }
-                        }
-                    }
-                    None => out.push((format!("{who} edges: no body to round"), false)),
-                }
-            }
-            FeatureKind::SheetConvert { body, bends, .. } => match before.body(body) {
-                Some(b) => {
-                    for (k, p) in solidcraft_engine::doc::plain::<Vec3, _>(bends).iter().enumerate() {
-                        if let Some(n) = named(k) {
-                            edge(out, b, k, n, *p);
-                        }
-                    }
-                }
-                None => out.push((format!("{who} bends: body `{body}` gone"), false)),
-            },
-            // Sheet metal edges are named by the sheet's panels, and found on its sheets.
-            FeatureKind::SheetFlange { .. } | FeatureKind::SheetHem { .. } => {
-                let pts: Vec<Vec3> = match &f.kind {
-                    FeatureKind::SheetFlange { edges, .. } => edges.iter().map(|e| e.point.0).collect(),
-                    FeatureKind::SheetHem { edges, .. } => solidcraft_engine::doc::plain(edges),
-                    _ => Vec::new(),
-                };
-                for (k, p) in pts.iter().enumerate() {
-                    let Some(n) = named(k) else { continue };
-                    let on: Vec<&str> = before.sheets.iter().filter(|sh| sh.edge_by_name(n, *p).is_some()).map(|sh| sh.body.as_str()).collect();
-                    let found = if on.is_empty() { "gone".to_string() } else { format!("sheet edge on {}", on.join(", ")) };
-                    out.push((format!("{who} sheet edge {k} `{n}` -> {found}"), !on.is_empty()));
-                }
-            }
-            other => {
-                for (k, n) in f.edge_names.iter().enumerate().filter(|(_, n)| !n.is_empty()) {
-                    out.push((format!("{who} edge {k} `{n}` -> not checked ({})", other.type_name()), true));
-                }
-            }
-        }
-    }
-    // The face a sketch sits on.
-    if let FeatureKind::Sketch { plane: PlaneRef::Face { name, anchor, at, .. }, .. } = &f.kind {
-        let mut ok = true;
-        let status = match doc.sketch_face_attachment(f.id, &s.model) {
-            FaceAttachmentStatus::Healthy { target, .. } => {
-                let faces = match before.body(&target.body) {
-                    Some(b) => match doc.anchored_face_indices(&before, b, &target) {
-                        Ok((indices, note)) => {
-                            let names = naming::face_names(b);
-                            let mut list: Vec<&str> = indices.iter().map(|i| names.get(*i).map(String::as_str).unwrap_or("?")).collect();
-                            list.sort();
-                            format!("{} faces {}{}", b.name, list.join(", "), flags(&[(note.is_some(), "changed cap")]))
-                        }
-                        Err(e) => {
-                            ok = false;
-                            format!("no faces ({e})")
-                        }
-                    },
-                    None => {
-                        ok = false;
-                        format!("body `{}` gone", target.body)
-                    }
-                };
-                format!("healthy: {faces}")
-            }
-            FaceAttachmentStatus::Lost { message, .. } => {
-                ok = false;
-                format!("lost: {message}")
-            }
-            FaceAttachmentStatus::Legacy { .. } => match name {
-                // The face its name finds, as the sketch finds it.
-                Some(n) => {
-                    let fst = solidcraft_engine::doc::state_in_frame(doc, &before, f.component).unwrap();
-                    match naming::locate_face(&fst, n, *at) {
-                        Some(hit) => format!("by name: {}{}", face_label(&fst, hit.body, hit.face), flags(&[(!hit.verified, "geometric")])),
-                        None => {
-                            ok = false;
-                            "by name: gone".into()
-                        }
-                    }
-                }
-                None => "by its pick".into(),
-            },
-            FaceAttachmentStatus::Sheet { .. } => "sheet face".into(),
-            FaceAttachmentStatus::Fixed { .. } => "fixed".into(),
-        };
-        let stored = match (anchor, name) {
-            (Some(a), _) => {
-                let kind =
-                    a.target.certificate.as_ref().and_then(|c| serde_json::to_value(c).ok()).and_then(|v| v["kind"].as_str().map(String::from));
-                format!("`{}` on {} ({})", a.target.name, a.target.body, kind.unwrap_or_else(|| "no certificate".into()))
-            }
-            (None, Some(n)) => format!("`{n}`"),
-            (None, None) => "by its pick".into(),
-        };
-        out.push((format!("{who} plane {stored} -> {status}"), ok));
-    }
-}
-
-/// A build of a design: where its faces and edges are by name, and what every name it stores
-/// finds.
-struct Build {
-    names: Vec<(String, [f64; 4])>,
-    refs: Vec<(String, bool)>,
-}
-
-fn build(s: &Session) -> Build {
-    let names = s.model.state().bodies.iter().flat_map(placed_names).collect();
-    let mut refs = Vec::new();
-    for f in s.doc.features.iter().filter(|f| !f.suppressed) {
-        let from = refs.len();
-        record_refs(&mut refs, s, f);
-        // A name that finds nothing is sound when its feature fails: it asks for the reference
-        // to be picked again.
-        if s.model.result(f.id).is_some_and(|r| r.error.is_some()) {
-            refs.iter_mut().skip(from).for_each(|(_, ok)| *ok = true);
-        }
-    }
-    Build { names, refs }
-}
-
-/// Where two builds name their faces and edges apart (at most `cap` of them): a name only one
-/// has, or a face or edge of that name somewhere else (1e-6 of its size, to the mesh's rounding).
-fn differences(a: &Build, b: &Build, cap: usize) -> Vec<String> {
-    let mut out = Vec::new();
-    if a.names.len() != b.names.len() {
-        out.push(format!("{} named faces and edges, then {}", a.names.len(), b.names.len()));
-    }
-    for ((n, x), (m, y)) in a.names.iter().zip(&b.names) {
-        let scale = x.iter().chain(y).fold(1.0f64, |s, v| s.max(v.abs()));
-        if n != m || x.iter().zip(y).any(|(p, q)| (p - q).abs() > 1e-6 * scale) {
-            out.push(format!("{n} at {x:?}, then {m} at {y:?}"));
-        }
-    }
-    for ((r, _), (q, _)) in a.refs.iter().zip(&b.refs) {
-        if r != q {
-            out.push(format!("{r}, then {q}"));
-        }
-    }
-    if a.refs.len() != b.refs.len() {
-        out.push(format!("{} stored names, then {}", a.refs.len(), b.refs.len()));
-    }
-    out.truncate(cap);
-    out
-}
-
-/// Designs whose names differ from one build to the next today: (design, why). Their
-/// differences are printed, not failed on, until the cause is fixed; a stored name that finds
-/// nothing still fails.
-const UNSTABLE: [(&str, &str); 1] = [(
-    "regressions/closed_sweep_torus_cut",
-    "the halves of each swept wall lie level along every axis, so which is `#1` and which `#2` follows the order the kernel gives the faces in, which changes from one build to the next",
-)];
-
-#[test]
-fn corpus_designs_name_alike_every_build_and_fail_where_a_reference_is_gone() {
-    let designs = designs();
-    let next = std::sync::atomic::AtomicUsize::new(0);
-    let results = std::sync::Mutex::new(Vec::new());
-    let workers = std::thread::available_parallelism().map_or(4, |n| n.get()).min(designs.len().max(1));
-    std::thread::scope(|scope| {
-        for _ in 0..workers {
-            scope.spawn(|| {
-                while let Some((name, source)) = designs.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
-                    let got = load(source).and_then(|first| Ok((build(&first), build(&load(source)?))));
-                    results.lock().unwrap_or_else(|e| e.into_inner()).push((name.clone(), got));
-                }
-            });
-        }
-    });
-    let mut results = results.into_inner().unwrap_or_else(|e| e.into_inner());
-    results.sort_by(|a, b| a.0.cmp(&b.0));
-    let mut problems = Vec::new();
-    for (name, got) in &results {
-        let (first, second) = match got {
-            Ok(builds) => builds,
-            Err(e) => {
-                problems.push(format!("{name}: does not load: {e}"));
-                continue;
-            }
-        };
-        let lost: Vec<&str> = first.refs.iter().filter(|(_, ok)| !ok).map(|(r, _)| r.as_str()).collect();
-        if !lost.is_empty() {
-            problems.push(format!("{name}: stored names that find nothing, in features that build:\n  {}", lost.join("\n  ")));
-        }
-        let apart = differences(first, second, 40);
-        if !apart.is_empty() {
-            match UNSTABLE.iter().find(|(design, _)| design == name) {
-                Some((_, why)) => eprintln!("{name} (not checked: {why}):\n  {}", apart.join("\n  ")),
-                None => problems.push(format!("{name}: two builds name it apart (first, then second):\n  {}", apart.join("\n  "))),
-            }
-        }
-    }
-    assert!(problems.is_empty(), "{} of {} design(s) of the corpus:\n{}", problems.len(), results.len(), problems.join("\n"));
-}

apps/solidcraft-cli/tests/oracle_cases.rs

@@ -1,66 +0,0 @@
-//! The reference tests (tests/oracle, docs/oracle.md) as a `cargo test`, so tools that drive
-//! `cargo test` (cargo-mutants) can use them: every case with expected values and no
-//! `known_failure` mark must pass, as `cargo xtask oracle` requires.
-
-use std::path::Path;
-use std::process::Command;
-
-use serde_json::Value;
-
-#[test]
-#[ignore = "run by cargo-mutants (.cargo/mutants.toml); CI replays the oracle through cargo xtask oracle"]
-fn oracle_suite() {
-    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
-    let dir = root.join("tests/oracle");
-    let mut cases: Vec<String> = std::fs::read_dir(&dir)
-        .unwrap()
-        .flatten()
-        .map(|e| e.path())
-        .filter(|p| p.join("recipe.json").is_file())
-        .map(|p| format!("tests/oracle/{}", p.file_name().unwrap().to_string_lossy()))
-        .collect();
-    cases.sort();
-    assert!(cases.len() >= 50, "oracle cases in {}", dir.display());
-    // One process per core, cases dealt round-robin so the slow ones spread out.
-    let n = std::thread::available_parallelism().map_or(4, |n| n.get()).min(cases.len());
-    let children: Vec<_> = (0..n)
-        .map(|i| {
-            let chunk: Vec<&String> = cases.iter().skip(i).step_by(n).collect();
-            Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-                .current_dir(&root)
-                .arg("oracle")
-                .arg("--json")
-                .args(chunk)
-                .stdout(std::process::Stdio::piped())
-                .stderr(std::process::Stdio::piped())
-                .spawn()
-                .unwrap()
-        })
-        .collect();
-    let mut results: Vec<Value> = Vec::new();
-    for child in children {
-        let out = child.wait_with_output().unwrap();
-        let part: Vec<Value> =
-            serde_json::from_slice(&out.stdout).unwrap_or_else(|e| panic!("oracle JSON: {e}\n{}", String::from_utf8_lossy(&out.stderr)));
-        results.extend(part);
-    }
-    assert_eq!(results.len(), cases.len());
-    let mut failed = Vec::new();
-    for r in &results {
-        let case = r["case"].as_str().unwrap_or("");
-        let want: Value =
-            std::fs::read_to_string(dir.join(case).join("expected.json")).ok().and_then(|t| serde_json::from_str(&t).ok()).unwrap_or_default();
-        if want.is_null() || want["known_failure"].is_string() || r["pass"].as_bool().unwrap_or(false) {
-            continue;
-        }
-        let checks: Vec<String> = r["checks"]
-            .as_array()
-            .into_iter()
-            .flatten()
-            .filter(|c| !c["ok"].as_bool().unwrap_or(false))
-            .map(|c| format!("{} got {} want {}", c["check"].as_str().unwrap_or(""), c["got"], c["want"]))
-            .collect();
-        failed.push(format!("{case}: {} {}", r["error"].as_str().unwrap_or(""), checks.join("; ")));
-    }
-    assert!(failed.is_empty(), "oracle cases failed:\n{}", failed.join("\n"));
-}

apps/solidcraft-cli/tests/rebuild_topology.rs

@@ -9,7 +9,6 @@ use std::path::{Path, PathBuf};
 use serde_json::{Value, json};
 use solidcraft_engine::Session;
 use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
-use solidcraft_engine::geom::prelude::*;
 
 fn root() -> PathBuf {
     Path::new(env!("CARGO_MANIFEST_DIR")).join("../..").canonicalize().unwrap()
@@ -32,7 +31,7 @@ struct Topology {
 
 /// Every solid body's topology, by name.
 fn topology(s: &Session) -> BTreeMap<String, Topology> {
-    let st = s.world_state().unwrap();
+    let st = s.world_state();
     st.bodies
         .iter()
         .filter(|b| !b.body.is_mesh())
@@ -76,15 +75,12 @@ fn designs() -> Vec<(String, Session)> {
             .unwrap()
             .flatten()
             .map(|e| e.path())
-            .filter(|p| {
-                (solidcraft_engine::io::is_design_container_path(p) || p.extension().is_some_and(|x| x == "json"))
-                    && !p.to_string_lossy().ends_with(".expected.json")
-            })
+            .filter(|p| p.extension().is_some_and(|x| x == "solidcraft" || x == "json") && !p.to_string_lossy().ends_with(".expected.json"))
             .collect();
         files.sort();
         for p in files {
             let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-            let s = if solidcraft_engine::io::is_design_container_path(&p) {
+            let s = if p.extension().is_some_and(|x| x == "solidcraft") {
                 open(&p)
             } else {
                 let mut s = Session::default();
@@ -143,16 +139,18 @@ fn a_parameter_edit_rebuilds_like_a_fresh_build_and_reverts_exactly() {
     assert!(problems.is_empty(), "{}", problems.join("\n"));
 }
 
-/// The README demo's Raspberry Pi case (`examples/demo/enclosure_ui_mcp.py --story pi`): after
-/// each feature, each outer side (the four walls and the bottom) is one face and the case is as
-/// tall as its height, and a height changed in Parameters rebuilds the same topology as one
-/// built at that height: (a) built at height 24, (b) built at 24 and changed to 32, (c) built at
-/// 32. The port cut-outs and the floor vents used to split the long wall (or the end wall at 24)
-/// into strips along the openings' tops and bottoms.
+/// The README demo's Raspberry Pi case (`examples/demo/enclosure_ui_mcp.py --story pi`): its
+/// face count after each feature, and each outer side (the four walls and the bottom) one face
+/// throughout: (a) built at height 24, (b) built at 24 and changed to 32 in Parameters, (c)
+/// built at 32. The port cut-outs and the floor vents used to split the long wall (or the end
+/// wall at 24) into strips along the openings' tops and bottoms.
 #[test]
-fn pi_case_sides_stay_whole_at_both_heights() {
+fn pi_case_faces_per_step_at_both_heights() {
+    // Sketch1 (1) .. RectangularPattern2 (14): the faces once features 1..=k are built.
+    const FACES: [(usize, usize); 13] =
+        [(2, 6), (3, 10), (4, 19), (5, 19), (6, 25), (7, 43), (8, 43), (9, 55), (10, 55), (11, 59), (12, 59), (13, 63), (14, 79)];
     let dir = scratch_dir("pi");
-    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.sc")).unwrap()).unwrap();
+    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.solidcraft")).unwrap()).unwrap();
     let at = |height: &str, file: &str| {
         let mut d = design.clone();
         for p in d["params"].as_array_mut().unwrap() {
@@ -173,13 +171,12 @@ fn pi_case_sides_stay_whole_at_both_heights() {
     for (case, s, h) in [("(a) at 24", a, 24.), ("(b) 24 changed to 32", b, 32.), ("(c) at 32", c, 32.)] {
         assert!(errors(&s).is_empty(), "{case}: features fail: {:?}", errors(&s));
         let mut steps = Vec::new();
-        // Sketch1 (1) is no body; the box (2) .. RectangularPattern2 (14).
-        for k in 2..=14 {
+        for (k, want) in FACES {
             let mut t = s.scratch();
             t.execute("timeline.rollback", &json!({"position": k})).unwrap();
-            let st = t.world_state().unwrap();
+            let st = t.world_state();
             let body = st.bodies.iter().find(|b| b.name == "Body1").unwrap();
-            assert!(body.body.validity().is_empty(), "{case}: after feature {k}: {:?}", body.body.validity());
+            assert_eq!(body.body.face_count(), want, "{case}: faces after feature {k}");
             // Each outer side: the faces in its plane.
             for (n, d) in [([0., -1., 0.], 33.), ([0., 1., 0.], 33.), ([-1., 0., 0.], 47.5), ([1., 0., 0.], 47.5), ([0., 0., -1.], 0.)] {
                 let on = (0..body.body.face_count())

apps/solidcraft-cli/tests/run_results.rs

@@ -22,19 +22,6 @@ impl Scratch {
         std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
         path
     }
-
-    fn saving_script(&self) -> (PathBuf, PathBuf) {
-        let path = self.0.join("saving.json");
-        let saved = self.0.join("script-ran.solidcraft");
-        std::fs::write(
-            &path,
-            json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
-                {"command": "file.save_as", "params": {"path": saved}}]})
-            .to_string(),
-        )
-        .unwrap();
-        (path, saved)
-    }
 }
 
 impl Drop for Scratch {
@@ -56,99 +43,10 @@ fn body_count(path: &Path) -> Value {
     json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
 }
 
-#[test]
-fn run_rejects_invalid_options_before_script_execution_or_output_writes() {
-    let dir = Scratch::new();
-    let (script, script_saved) = dir.saving_script();
-    let cases = [
-        (&["--out"][..], "--out needs a value"),
-        (&["--save"][..], "--save needs a value"),
-        (&["--in"][..], "--in needs a value"),
-        (&["--out", "--quiet"][..], "--out needs a value"),
-        (&["--ouut", "part.step"][..], "doesn't take --ouut"),
-        (&["--unknown"][..], "doesn't take --unknown"),
-        (&["--quality"][..], "--quality needs a value"),
-        (&["--quality", "best"][..], "--quality must be standard, fine or finest, not `best`"),
-        (&["--quality", "standard", "--quality", "best"][..], "--quality is given more than once"),
-    ];
-    for existing in [false, true] {
-        let saved = dir.0.join(format!("{existing}.solidcraft"));
-        let exported = dir.0.join(format!("{existing}.step"));
-        let report = dir.0.join(format!("{existing}.json"));
-        let outputs = [&saved, &exported, &report];
-        if existing {
-            for path in outputs {
-                std::fs::write(path, b"existing output").unwrap();
-            }
-        }
-        for (extra, message) in cases {
-            let output = cli()
-                .arg("run")
-                .arg(&script)
-                .arg("--save")
-                .arg(&saved)
-                .arg("--out")
-                .arg(&exported)
-                .arg("--json-out")
-                .arg(&report)
-                .args(extra)
-                .output()
-                .unwrap();
-            assert_eq!(output.status.code(), Some(1), "{extra:?}");
-            assert!(String::from_utf8_lossy(&output.stderr).contains(message), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
-            assert!(output.stdout.is_empty());
-            assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
-            for path in outputs {
-                if existing {
-                    assert_eq!(std::fs::read(path).unwrap(), b"existing output");
-                } else {
-                    assert!(!path.exists());
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn eval_and_inspect_reject_invalid_options_before_script_execution_or_reporting() {
-    let dir = Scratch::new();
-    let (script, script_saved) = dir.saving_script();
-    let cases = [
-        (&["--in"][..], "--in needs a value"),
-        (&["--in", "--quiet"][..], "--in needs a value"),
-        (&["--out", "part.step"][..], "doesn't take --out"),
-        (&["--unknown"][..], "doesn't take --unknown"),
-    ];
-    for command in ["eval", "inspect"] {
-        for existing in [false, true] {
-            let report = dir.0.join(format!("{command}-{existing}.json"));
-            if existing {
-                std::fs::write(&report, b"existing report").unwrap();
-            }
-            for (extra, message) in cases {
-                let output = cli().arg(command).arg(&script).arg("--json-out").arg(&report).args(extra).output().unwrap();
-                assert_eq!(output.status.code(), Some(1), "{command} {extra:?}");
-                assert!(
-                    String::from_utf8_lossy(&output.stderr).contains(message),
-                    "{command} {extra:?}: {}",
-                    String::from_utf8_lossy(&output.stderr)
-                );
-                assert!(output.stdout.is_empty());
-                assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
-                if existing {
-                    assert_eq!(std::fs::read(&report).unwrap(), b"existing report");
-                } else {
-                    assert!(!report.exists());
-                }
-            }
-        }
-    }
-}
-
 #[test]
 fn cli_loads_both_design_encodings_by_contents() {
     let dir = Scratch::new();
-    for extension in ["sc", "solidcraft", "solvecraft", "json"] {
+    for extension in ["solidcraft", "solvecraft", "json"] {
         let saved = dir.0.join(format!("box.{extension}"));
         json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&saved).output().unwrap());
         let bytes = std::fs::read(&saved).unwrap();
@@ -161,118 +59,6 @@ fn cli_loads_both_design_encodings_by_contents() {
     }
 }
 
-/// #1369: a pending concept that did not land in the numbered release must not be silently
-/// dropped on open/resave, in either encoding: it opens with a warning, and saving keeps it.
-#[test]
-fn unknown_pending_concepts_preserve_the_open_design_and_output_files() {
-    use solidcraft_engine::{Session, doc, io};
-
-    let dir = Scratch::new();
-    for version in [33, doc::format::FORMAT] {
-        let mut experimental = doc::Document::new("Experimental");
-        experimental.format = doc::format::format_string(version);
-        experimental.format_pending.push("experimental-card".into());
-        for (extension, bytes) in [("json", io::write_design(&experimental)), ("solidcraft", io::write_design_container(&experimental).unwrap())] {
-            let source = dir.0.join(format!("experimental-{version}.{extension}"));
-            std::fs::write(&source, &bytes).unwrap();
-            let mut session = Session::default();
-            // It opens, and the reply says what it is.
-            let reply = session.execute("doc.open", &json!({"path": source})).unwrap();
-            let notice = reply["newer_file"]["notice"].as_str().unwrap().to_string();
-            assert!(notice.contains("experimental-card") && notice.starts_with("Saved by a newer SolidCraft"), "{notice}");
-            assert_eq!(reply["warnings"][0], notice.as_str());
-            assert_eq!(session.doc.name, "Experimental");
-
-            for existing in [false, true] {
-                let destination = dir.0.join(format!("output-{version}-{extension}-{existing}.{extension}"));
-                let backup = io::backup_path(&destination);
-                if existing {
-                    std::fs::write(&destination, b"existing design").unwrap();
-                }
-                let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
-                let error = String::from_utf8_lossy(&output.stderr);
-                assert_eq!(output.status.code(), Some(0), "{error}");
-                assert!(error.contains("warning: Saved by a newer SolidCraft") && error.contains("experimental-card"), "{error}");
-                // Saved, it still says it has the change, and opens the same way.
-                let saved = io::read_design(&std::fs::read(&destination).unwrap()).unwrap();
-                assert!(saved.format_pending.iter().any(|name| name == "experimental-card"));
-                assert!(saved.newer_file.is_some());
-                if existing {
-                    assert_eq!(std::fs::read(&backup).unwrap(), b"existing design");
-                }
-                assert_eq!(std::fs::read(&source).unwrap(), bytes);
-            }
-        }
-    }
-}
-
-/// `eval` and `run` on a design one format newer, with a feature kind this version doesn't have:
-/// the rest builds, the reply names it, and the saved file still holds it, under the file's number.
-#[test]
-fn the_cli_opens_a_newer_design_and_saving_keeps_what_it_cant_read() {
-    use solidcraft_engine::{Session, doc, io};
-
-    let dir = Scratch::new();
-    let mut session = Session::default();
-    session.execute("solid.box", &json!({"length": 2, "width": 3, "height": 4})).unwrap();
-    let mut file: Value = serde_json::from_slice(&io::write_design(&session.doc)).unwrap();
-    let newer = doc::format::format_string(doc::format::FORMAT + 1);
-    file["format"] = json!(newer);
-    let future = json!({"id": 900, "name": "Lattice1", "type": "gyroid_lattice", "cell": 2.5});
-    file["features"].as_array_mut().unwrap().push(future.clone());
-    let source = dir.0.join("newer.json");
-    std::fs::write(&source, file.to_string()).unwrap();
-
-    let output = cli().args(["eval"]).arg(&source).output().unwrap();
-    let error = String::from_utf8_lossy(&output.stderr);
-    assert_eq!(output.status.code(), Some(0), "{error}");
-    assert!(error.contains("warning: Saved by a newer SolidCraft") && error.contains("Lattice1"), "{error}");
-    let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
-    assert_eq!(reply["body_count"], 1);
-    assert!(reply["newer_file"]["not_understood"][0].as_str().unwrap().contains("gyroid_lattice"), "{reply}");
-    assert!(reply["warnings"][0].as_str().unwrap().starts_with("Saved by a newer SolidCraft"), "{reply}");
-
-    for extension in ["json", "sc"] {
-        let destination = dir.0.join(format!("saved.{extension}"));
-        let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
-        assert_eq!(output.status.code(), Some(0), "{}", String::from_utf8_lossy(&output.stderr));
-        let saved = io::read_design(&std::fs::read(&destination).unwrap()).unwrap();
-        assert_eq!(saved.format, newer, "never a lower number");
-        let again: Value = serde_json::from_slice(&io::write_design(&saved)).unwrap();
-        assert_eq!(again["features"].as_array().unwrap().last().unwrap(), &future);
-    }
-}
-
-#[test]
-fn known_pending_concepts_and_released_files_round_trip_with_inert_metadata() {
-    use solidcraft_engine::{doc, io};
-
-    let dir = Scratch::new();
-    let current = doc::Document::new("Supported");
-    let mut released = current.clone();
-    released.format = doc::format::format_string(33);
-    released.format_pending.clear();
-    let mut experimental = released.clone();
-    experimental.format_pending.push("reserved-body-names".into());
-    for (index, mut document) in [current, released, experimental].into_iter().enumerate() {
-        document.metadata.0.insert("com.example.tool".into(), json!({"format_pending": ["experimental-card"], "physical_card": {"density": 700}}));
-        for (extension, bytes) in [("json", io::write_design(&document)), ("solidcraft", io::write_design_container(&document).unwrap())] {
-            let source = dir.0.join(format!("supported-{index}.{extension}"));
-            let destination = dir.0.join(format!("resaved-{index}.{extension}"));
-            std::fs::write(&source, &bytes).unwrap();
-            let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
-            assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
-            let reopened = io::read_design(&std::fs::read(&destination).unwrap()).unwrap();
-            assert_eq!(reopened.metadata, document.metadata);
-            // #4907: `run --save` maps to Save As, and a borrowed design name
-            // follows the destination file's stem instead of keeping the old name.
-            assert_eq!(reopened.name, format!("resaved-{index}"));
-            assert_eq!(reopened.features, document.features);
-            assert_eq!(std::fs::read(&source).unwrap(), bytes);
-        }
-    }
-}
-
 #[test]
 fn results_still_save_and_export_the_script_once() {
     let dir = Scratch::new();
@@ -291,38 +77,6 @@ fn results_still_save_and_export_the_script_once() {
     }
 }
 
-/// The triangles of a binary STL: the count after its 80-byte header.
-fn stl_triangles(path: &Path) -> u32 {
-    let bytes = std::fs::read(path).unwrap();
-    u32::from_le_bytes(bytes[80..84].try_into().unwrap())
-}
-
-/// #12270: `run --out part.stl --quality fine` writes the mesh at that quality, as
-/// `file.export`'s `quality` does, without a script to say so.
-#[test]
-fn run_exports_meshes_at_the_quality_asked_for() {
-    let dir = Scratch::new();
-    let script = dir.0.join("cylinder.json");
-    std::fs::write(&script, json!({"commands": [{"command": "solid.cylinder", "params": {"diameter": 40, "height": 10}}]}).to_string()).unwrap();
-    let export = |name: &str, quality: Option<&str>| {
-        let stl = dir.0.join(name);
-        let mut command = cli();
-        command.arg("run").arg(&script).arg("--quiet").arg("--out").arg(&stl);
-        if let Some(q) = quality {
-            command.args(["--quality", q]);
-        }
-        let output = command.output().unwrap();
-        assert!(output.status.success(), "{quality:?}: {}", String::from_utf8_lossy(&output.stderr));
-        stl_triangles(&stl)
-    };
-    let default = export("default.stl", None);
-    let standard = export("standard.stl", Some("standard"));
-    let fine = export("fine.stl", Some("fine"));
-    let finest = export("finest.stl", Some("finest"));
-    assert_eq!(default, standard);
-    assert!(standard < fine && fine < finest, "standard {standard}, fine {fine}, finest {finest}");
-}
-
 #[test]
 fn results_with_base_design_and_quiet_still_report_and_save() {
     let dir = Scratch::new();
@@ -336,110 +90,6 @@ fn results_with_base_design_and_quiet_still_report_and_save() {
     assert_eq!(body_count(&base), 1);
 }
 
-/// `eval` and its alias must measure the script applied to the input design, rather than
-/// silently reporting the input alone (#6861).
-#[test]
-fn eval_runs_its_script_on_the_in_design() {
-    let dir = Scratch::new();
-    let base = dir.0.join("base.solidcraft");
-    let script = dir.0.join("add.json");
-    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
-    let original = std::fs::read(&base).unwrap();
-    std::fs::write(
-        &script,
-        json!({"commands": [{"command": "solid.box", "params": {"length": 5, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
-    )
-    .unwrap();
-    for command in ["eval", "inspect"] {
-        // Both existing one-input forms still measure just the original body.
-        for input in [&base, &dir.script()] {
-            for named_input in [false, true] {
-                let mut c = cli();
-                c.arg(command);
-                if named_input {
-                    c.arg("--in");
-                }
-                let measured = json_output(c.arg(input).output().unwrap());
-                assert_eq!(measured["body_count"], 1);
-                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 24.0).abs() < 1e-6);
-            }
-        }
-        for input_first in [false, true] {
-            for to_file in [false, true] {
-                let mut c = cli();
-                c.arg(command);
-                if input_first {
-                    c.arg("--in").arg(&base).arg(&script);
-                } else {
-                    c.arg(&script).arg("--in").arg(&base);
-                }
-                let report = dir.0.join("measurement.json");
-                if to_file {
-                    c.arg("--json-out").arg(&report);
-                }
-                let output = c.output().unwrap();
-                let measured = if to_file {
-                    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
-                    assert!(output.stdout.is_empty());
-                    serde_json::from_slice(&std::fs::read(&report).unwrap()).unwrap()
-                } else {
-                    json_output(output)
-                };
-                assert_eq!(measured["body_count"], 2, "{command}, input_first={input_first}, to_file={to_file}");
-                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 84.0).abs() < 1e-6);
-                assert_eq!(measured["timeline"].as_array().unwrap().len(), 2, "the script runs exactly once");
-                assert_eq!(std::fs::read(&base).unwrap(), original, "evaluation never saves its changes to the input");
-            }
-        }
-    }
-}
-
-#[test]
-fn eval_propagates_script_errors_before_writing_a_report() {
-    let dir = Scratch::new();
-    let base = dir.script();
-    let script = dir.0.join("bad.json");
-    for command in ["eval", "inspect"] {
-        for contents in ["{", r#"{"commands":[{"command":"missing.command","params":{}}]}"#] {
-            std::fs::write(&script, contents).unwrap();
-            let report = dir.0.join("report.json");
-            let output = cli().arg(command).arg(&script).arg("--in").arg(&base).arg("--json-out").arg(&report).output().unwrap();
-            assert_eq!(output.status.code(), Some(1));
-            assert!(!output.stderr.is_empty());
-            assert!(output.stdout.is_empty());
-            assert!(!report.exists());
-        }
-    }
-}
-
-#[test]
-fn eval_rejects_unknown_options_and_missing_input_values_before_writing_a_report() {
-    let dir = Scratch::new();
-    let script = dir.script();
-    let report = dir.0.join("report.json");
-    for command in ["eval", "inspect"] {
-        for (options, message) in [(&["--frobnicate", "1"][..], "doesn't take --frobnicate"), (&["--in"][..], "--in needs a value")] {
-            for options_first in [false, true] {
-                std::fs::write(&report, b"previous report").unwrap();
-                let mut c = cli();
-                c.arg(command);
-                if options_first {
-                    c.args(options).arg("--json-out").arg(&report).arg(&script);
-                } else {
-                    c.arg(&script).args(options).arg("--json-out").arg(&report);
-                }
-                // A following option also proves that --in cannot consume a flag as its value.
-                let output = c.output().unwrap();
-                assert_eq!(output.status.code(), Some(1), "{command}, {options:?}");
-                let error = String::from_utf8_lossy(&output.stderr);
-                assert!(error.contains(message), "{command}: {error}");
-                assert!(output.stdout.is_empty());
-                assert_eq!(std::fs::read(&report).unwrap(), b"previous report");
-            }
-        }
-    }
-}
-
 #[test]
 fn results_propagate_output_errors() {
     let dir = Scratch::new();
@@ -481,11 +131,6 @@ fn legacy_extension_and_format_tag_still_open() {
     assert_eq!(body_count(&resaved), 2);
     let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
     assert!(reopened.to_json().contains("\"solidcraft/"));
-    // `.solidcraft` (before `.sc`) opens as `--in` and as the design to evaluate; `.sc` too.
-    let current = dir.0.join("current.sc");
-    json_output(cli().args(["run", "--in"]).arg(&resaved).arg(dir.script()).arg("--save").arg(&current).output().unwrap());
-    assert_eq!(body_count(&current), 3);
-    assert!(solidcraft_engine::io::is_design_container(&std::fs::read(&current).unwrap()), "a .sc file is a design container");
 }
 
 /// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
@@ -506,20 +151,11 @@ fn snapshot_runs_its_script_on_the_in_design() {
         json_output(cli().arg("snapshot").args(args).arg("--out").arg(&png).args(["--width", "64", "--height", "48"]).output().unwrap());
         std::fs::read(&png).unwrap()
     };
-    // Pictures are drawn on the GPU: without an adapter only the option checks below run.
-    match solidcraft_gpu::capture::shared() {
-        Ok(_) => {
-            let alone = shot("alone.png", &[shifted.as_os_str()]);
-            let on_base = shot("on_base.png", &[shifted.as_os_str(), "--in".as_ref(), base.as_os_str()]);
-            let base_only = shot("base.png", &["--in".as_ref(), base.as_os_str()]);
-            assert_ne!(alone, on_base, "the script ran on the --in design");
-            assert_ne!(base_only, on_base);
-        }
-        Err(e @ solidcraft_gpu::GpuError::NoAdapter(_)) if std::env::var_os("SOLIDCRAFT_REQUIRE_GPU").is_none() => {
-            eprintln!("pictures left out: {e}")
-        }
-        Err(e) => panic!("{e}"),
-    }
+    let alone = shot("alone.png", &[shifted.as_os_str()]);
+    let on_base = shot("on_base.png", &[shifted.as_os_str(), "--in".as_ref(), base.as_os_str()]);
+    let base_only = shot("base.png", &["--in".as_ref(), base.as_os_str()]);
+    assert_ne!(alone, on_base, "the script ran on the --in design");
+    assert_ne!(base_only, on_base);
     for (bad, says) in [(["--frobnicate", "1"], "doesn't take --frobnicate"), (["--width", "wide"], "--width must be 16 to 8192")] {
         let output = cli().arg("snapshot").arg(&base).arg("--out").arg(dir.0.join("x.png")).args(bad).output().unwrap();
         assert_eq!(output.status.code(), Some(1));
@@ -532,283 +168,5 @@ fn snapshot_runs_its_script_on_the_in_design() {
 fn unknown_command_suggests_the_closest_id() {
     let output = cli().args(["exec", "file.open"]).output().unwrap();
     assert_eq!(output.status.code(), Some(1));
-    assert!(
-        String::from_utf8_lossy(&output.stderr).contains("did you mean `doc.open` or `panel.open`?"),
-        "{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-}
-
-/// #1833: `--timings` reports each command's time instead of the measurement, `--profile` adds
-/// the kernel's share, `--results` puts the results beside them, and files are still written.
-#[test]
-fn timings_and_profile_report_each_command() {
-    let dir = Scratch::new();
-    let saved = dir.0.join("timed.solidcraft");
-    let t = json_output(cli().arg("run").arg(dir.script()).arg("--timings").arg("--save").arg(&saved).output().unwrap());
-    let rows = t["timings"].as_array().unwrap();
-    assert_eq!(rows.len(), 1);
-    assert_eq!((rows[0]["index"].as_u64(), rows[0]["command"].as_str()), (Some(0), Some("solid.box")));
-    assert!(rows[0]["ms"].as_f64().is_some() && t["total_ms"].as_f64().is_some(), "{t}");
-    assert!(rows[0].get("profile").is_none() && t.get("results").is_none(), "{t}");
-    assert_eq!(body_count(&saved), 1);
-
-    // --profile alone implies --timings; a flag before the script doesn't eat it.
-    let t = json_output(cli().arg("run").arg("--profile").arg(dir.script()).arg("--results").output().unwrap());
-    let p = &t["timings"][0]["profile"];
-    for k in ["boolean_ms", "tessellate_ms", "other_ms"] {
-        assert!(p[k].as_f64().is_some_and(|ms| ms >= 0.0), "{k}: {t}");
-    }
-    assert_eq!(t["results"].as_array().map(Vec::len), Some(1), "{t}");
-
-    // --results alone stays a plain array.
-    assert!(json_output(cli().arg("run").arg(dir.script()).arg("--results").output().unwrap()).is_array());
-
-    let output = cli().arg("run").arg("--in").arg(&saved).arg("--timings").output().unwrap();
-    assert!(!output.status.success());
-    assert!(String::from_utf8_lossy(&output.stderr).contains("--timings needs a script"));
-}
-
-/// #6921: `--param-check` checks a script's steps against their contracts on every path `run`
-/// takes (a script alone, on an `--in` design or script, with `--results`, `--timings` or
-/// `--profile`), and a warning reaches stderr even when a later step fails.
-#[test]
-fn param_check_reaches_every_script_run_takes() {
-    let dir = Scratch::new();
-    let typo = dir.0.join("typo.json");
-    let step = json!({"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4, "operaton": "new"}});
-    std::fs::write(&typo, json!({"commands": [step.clone()]}).to_string()).unwrap();
-    let base = dir.0.join("base.solidcraft");
-    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
-    let saved = dir.0.join("saved.solidcraft");
-    let start = dir.script();
-    let (typo, base, saved_arg, start) = (typo.to_str().unwrap(), base.to_str().unwrap(), saved.to_str().unwrap(), start.to_str().unwrap());
-    let paths = [&[][..], &["--in", base], &["--in", start], &["--results"], &["--timings"], &["--timings", "--profile"]];
-    let run = |level: Option<&str>, extra: &[&str]| {
-        std::fs::remove_file(&saved).ok();
-        let check = level.map(|l| ["--param-check", l]).into_iter().flatten();
-        cli().args(["run", typo, "--save", saved_arg]).args(check).args(extra).output().unwrap()
-    };
-
-    // Off, the default: the step runs as it always has, without a word.
-    let off = run(None, &[]);
-    assert!(off.status.success() && !String::from_utf8_lossy(&off.stderr).contains("operaton"), "{off:?}");
-    assert_eq!(body_count(&saved), 1);
-
-    // Warn: each path runs the step, saves, and reports it on stderr; `--results` keeps it too.
-    for extra in paths {
-        let output = run(Some("warn"), extra);
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert!(output.status.success(), "{extra:?}: {stderr}");
-        assert!(stderr.contains("step 1: unknown key `operaton`; did you mean `operation`?"), "{extra:?}: {stderr}");
-        assert!(saved.exists(), "{extra:?}");
-        if extra == ["--results"] {
-            let results: Value = serde_json::from_slice(&output.stdout).unwrap();
-            assert!(results[0]["param_warnings"][0].as_str().is_some_and(|w| w.contains("operaton")), "{results}");
-        }
-    }
-
-    // Strict: on each path the run stops at the step, and nothing is written.
-    for extra in paths {
-        let output = run(Some("strict"), extra);
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
-        assert!(stderr.contains("unknown key `operaton`"), "{extra:?}: {stderr}");
-        assert!(!saved.exists(), "{extra:?}");
-    }
-
-    // Warn, with a later step that fails: the run fails, and the first step's warning is still
-    // reported, timed or not.
-    let failing = dir.0.join("failing.json");
-    let fail = json!({"command": "solid.extrude", "params": {"sketch": "Nope"}});
-    std::fs::write(&failing, json!({"commands": [step, fail]}).to_string()).unwrap();
-    for extra in [&[][..], &["--timings"]] {
-        let output = cli().arg("run").arg(&failing).args(["--param-check", "warn"]).args(extra).output().unwrap();
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
-        assert!(stderr.contains("step 1: unknown key `operaton`") && stderr.contains("no sketch `Nope`"), "{extra:?}: {stderr}");
-    }
-
-    // A level it doesn't know and a missing value fail.
-    for (bad, says) in [
-        (&["--param-check", "loud"][..], "--param-check wants off, warn or strict, not `loud`"),
-        (&["--param-check"], "run: --param-check wants off, warn or strict"),
-    ] {
-        let output = cli().args(["run", typo]).args(bad).output().unwrap();
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert_eq!(output.status.code(), Some(1), "{bad:?}: {stderr}");
-        assert!(stderr.contains(says), "{bad:?}: {stderr}");
-    }
-}
-
-fn render_setup_script(dir: &Scratch, job: Value) -> PathBuf {
-    let path = dir.0.join("render.json");
-    std::fs::write(
-        &path,
-        json!({"commands":[
-            {"command":"solid.box","params":{"length":10,"width":10,"height":10}},
-            {"command":"render.settings.set","params":{"name":"Portable setup","set":{"width":16,"height":16,"job":job}}}
-        ]})
-        .to_string(),
-    )
-    .unwrap();
-    path
-}
-
-#[cfg(feature = "raytrace-cpu")]
-#[test]
-fn render_uses_typed_cpu_setups_from_scripts_and_saved_designs() {
-    for options in [json!({}), json!({"progressive":{"samples_per_pixel":3,"seed":81},"lights":[]})] {
-        let dir = Scratch::new();
-        let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":options}));
-        let image = dir.0.join("script.png");
-        let result = json_output(
-            cli()
-                .arg("render")
-                .arg(&script)
-                .args(["--setup", "Portable setup", "--out"])
-                .arg(&image)
-                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
-                .output()
-                .unwrap(),
-        );
-        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-raytrace");
-        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
-        assert_eq!(result["preflight"]["request"]["integrator"], "raytrace");
-        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
-        let png = image::load_from_memory(&std::fs::read(&image).unwrap()).unwrap();
-        assert_eq!((png.width(), png.height()), (16, 16));
-
-        let saved = dir.0.join("portable.solidcraft");
-        json_output(cli().arg("run").arg(&script).arg("--save").arg(&saved).output().unwrap());
-        let original = std::fs::read(&saved).unwrap();
-        let overridden = dir.0.join("overridden.png");
-        let result = json_output(
-            cli()
-                .arg("render")
-                .arg(&saved)
-                .args(["--setup", "Portable setup", "--out"])
-                .arg(&overridden)
-                .args(["--width", "12", "--height", "8", "--exposure", "1.25"])
-                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
-                .output()
-                .unwrap(),
-        );
-        assert_eq!(result["preflight"]["request"]["width"], 12);
-        assert_eq!(result["preflight"]["request"]["height"], 8);
-        assert_eq!(result["preflight"]["request"]["raytrace"]["exposure_ev"], 1.25);
-        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
-        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
-        let png = image::load_from_memory(&std::fs::read(overridden).unwrap()).unwrap();
-        assert_eq!((png.width(), png.height()), (12, 8));
-        assert_eq!(std::fs::read(saved).unwrap(), original, "CLI overrides must not rewrite saved intent");
-    }
-}
-
-#[test]
-fn render_preserves_typed_raster_and_legacy_runtime_controls() {
-    for job in [Value::Null, json!({"method":"raster","transparent_background":true})] {
-        let dir = Scratch::new();
-        let script = render_setup_script(&dir, job.clone());
-        let out = dir.0.join("raster.png");
-        let mut command = cli();
-        command
-            .arg("render")
-            .arg(&script)
-            .args(["--setup", "Portable setup", "--out"])
-            .arg(&out)
-            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-raster");
-        if job.is_null() {
-            command.arg("--transparent");
-        }
-        let result = json_output(command.output().unwrap());
-        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-product");
-        assert_eq!(result["export"]["frame"]["executor"], "cpu-product");
-        assert_eq!(result["preflight"]["request"]["transparent_background"], true);
-        assert!(std::fs::read(out).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"));
-    }
-}
-
-#[test]
-fn typed_render_rejects_explicit_runtime_flags_before_gpu_or_option_file_reads() {
-    let dir = Scratch::new();
-    let script = render_setup_script(&dir, json!({"method":"gpu_path","options":{"samples":64,"seed":0}}));
-    let out = dir.0.join("existing.png");
-    std::fs::write(&out, b"previous completed image").unwrap();
-    for flags in [
-        &["--progressive"][..],
-        &["--transparent"][..],
-        &["--samples", "64"][..],
-        &["--max-depth", "8"][..],
-        &["--seed", "0"][..],
-        &["--lighting", "deliberately-missing-lighting.json"][..],
-        &["--tone-map", "reinhard"][..],
-        &["--environment", "deliberately-missing-environment.json"][..],
-    ] {
-        let output = cli()
-            .arg("render")
-            .arg(&script)
-            .args(["--setup", "Portable setup", "--out"])
-            .arg(&out)
-            .arg("--overwrite")
-            .args(flags)
-            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-conflicts")
-            .output()
-            .unwrap();
-        assert_eq!(output.status.code(), Some(1));
-        let error = String::from_utf8_lossy(&output.stderr);
-        assert!(error.contains(&format!("{} cannot accompany a typed saved render setup", flags[0])), "{error}");
-        assert!(output.stdout.is_empty());
-        assert_eq!(std::fs::read(&out).unwrap(), b"previous completed image");
-    }
-}
-
-#[test]
-fn typed_gpu_render_selects_its_host_without_a_progressive_runtime_flag() {
-    // A deliberately invalid policy proves that dispatch reached the GPU host
-    // without depending on an adapter or accepting a CPU fallback. The legacy
-    // --progressive path must still reach that same host-selection boundary.
-    for job in [json!({"method":"gpu_path","options":{"samples":2}}), Value::Null] {
-        let dir = Scratch::new();
-        let script = render_setup_script(&dir, job.clone());
-        let out = dir.0.join("gpu.png");
-        let mut command = cli();
-        command.arg("render").arg(&script).args(["--setup", "Portable setup", "--out"]).arg(&out).env("SOLIDCRAFT_GPU", "not-a-gpu-policy");
-        if job.is_null() {
-            command.arg("--progressive");
-        }
-        let output = command.output().unwrap();
-        assert_eq!(output.status.code(), Some(1));
-        let error = String::from_utf8_lossy(&output.stderr);
-        assert!(error.contains("SOLIDCRAFT_GPU must be auto, hardware, software or cpu"), "{error}");
-        assert!(!out.exists());
-    }
-}
-
-#[test]
-fn render_setup_overrides_obey_shared_validation_before_host_initialization() {
-    let dir = Scratch::new();
-    let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":{"progressive":{"samples_per_pixel":64}}}));
-    let out = dir.0.join("invalid.png");
-    // 1024 * 1024 * 64 exceeds the unchanged default Compact camera-sample
-    // budget. Admission must name that envelope before initializing any host.
-    for (flags, message) in [
-        (&["--width", "1024", "--height", "1024"][..], "CPU Compact exceeds its 16777216 camera-sample admission"),
-        (&["--width", "0"][..], "render output must be at least"),
-        (&["--exposure", "NaN"][..], "render exposure must be finite"),
-    ] {
-        let output = cli()
-            .arg("render")
-            .arg(&script)
-            .args(["--setup", "Portable setup", "--out"])
-            .arg(&out)
-            .args(flags)
-            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-invalid-settings")
-            .output()
-            .unwrap();
-        assert_eq!(output.status.code(), Some(1));
-        let error = String::from_utf8_lossy(&output.stderr);
-        assert!(error.contains(message), "{error}");
-        assert!(!out.exists());
-    }
+    assert!(String::from_utf8_lossy(&output.stderr).contains("did you mean `doc.open`?"), "{}", String::from_utf8_lossy(&output.stderr));
 }

apps/solidcraft-cli/tests/run_strict.rs

@@ -65,10 +65,7 @@ fn allow_errors_writes_anyway_and_a_saved_design_keeps_failing() {
     let output = cli().arg("run").arg(dir.broken_script()).arg("--allow-errors").arg("--out").arg(&step).arg("--save").arg(&saved).output().unwrap();
     assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
     let measured: Value = serde_json::from_slice(&output.stdout).unwrap();
-    // SMLib integrates the volume (a relative accuracy of 1e-4 asked for; a box comes out within
-    // a few units in the last place), so the box's 4000 mm³ is checked to 1e-9, not to the bit.
-    let volume = measured["total"]["volume_mm3"].as_f64().unwrap();
-    assert!((volume - 4000.0).abs() < 4000.0 * 1e-9, "the box without its fillet: {volume}");
+    assert_eq!(measured["total"]["volume_mm3"], json!(4000.0), "the box without its fillet");
     assert!(std::fs::metadata(&step).unwrap().len() > 0);
     // The saved design still holds the failing feature: running it fails too, `eval` reports it.
     let again = dir.0.join("again.step");

apps/solidcraft-cli/tests/script_roundtrip.rs

@@ -84,81 +84,3 @@ fn corpus_designs_replay_from_their_scripts() {
     }
     assert!(replayed >= 7, "replayed {replayed} corpus designs");
 }
-
-/// #1990: a sketch and its extrude may share a name, and the design's script still replays,
-/// keeping the names: the replayed design's own script has the same steps.
-#[test]
-fn a_design_naming_a_sketch_and_its_extrude_alike_replays_from_its_script() {
-    let dir = std::env::temp_dir().join(format!("solidcraft-shared-names-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let cli = |args: &[&std::ffi::OsStr]| {
-        let out = std::process::Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).output().unwrap();
-        assert!(
-            out.status.success(),
-            "{}: {}",
-            args.iter().map(|a| a.to_string_lossy()).collect::<Vec<_>>().join(" "),
-            String::from_utf8_lossy(&out.stderr)
-        );
-    };
-    let script = dir.join("mini.json");
-    let saved = dir.join("mini.solidcraft");
-    let exported = dir.join("rt.json");
-    let replayed = dir.join("rt.solidcraft");
-    let again = dir.join("rt2.json");
-    let commands = json!({"commands": [
-        {"command": "sketch.create", "params": {"plane": "XY", "name": "Block"}},
-        {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [20, 10]}},
-        {"command": "sketch.finish", "params": {}},
-        {"command": "solid.extrude", "params": {"distance": "5", "name": "Block"}},
-    ]});
-    std::fs::write(&script, commands.to_string()).unwrap();
-    cli(&["run".as_ref(), script.as_ref(), "--save".as_ref(), saved.as_ref()]);
-    cli(&["script".as_ref(), saved.as_ref(), "--out".as_ref(), exported.as_ref()]);
-    cli(&["run".as_ref(), exported.as_ref(), "--save".as_ref(), replayed.as_ref()]);
-    cli(&["script".as_ref(), replayed.as_ref(), "--out".as_ref(), again.as_ref()]);
-    let first: Value = serde_json::from_str(&std::fs::read_to_string(&exported).unwrap()).unwrap();
-    let second: Value = serde_json::from_str(&std::fs::read_to_string(&again).unwrap()).unwrap();
-    let _ = std::fs::remove_dir_all(&dir);
-    let names: Vec<&str> = first["commands"].as_array().unwrap().iter().filter_map(|c| c["params"]["feature"]["name"].as_str()).collect();
-    assert_eq!(names, ["Block", "Block"], "{first:#}");
-    assert_eq!(second["commands"], first["commands"], "the replayed design's script has the same steps");
-}
-
-/// #10230: script export must disclose the print-face state that replay leaves out.
-#[test]
-fn script_export_warns_about_omitted_print_faces_on_stderr() {
-    let dir = std::env::temp_dir().join(format!("solidcraft-print-face-script-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let saved = dir.join("block.sc");
-    let exported = dir.join("block.json");
-    let mut s = Session::default();
-    s.execute("solid.box", &json!({"length": 20, "width": 10, "height": 5, "body_name": "Block"})).unwrap();
-    s.execute("body.print_face", &json!({"body": "Block", "point": [10, 5, 0]})).unwrap();
-    s.execute("file.save", &json!({"path": saved})).unwrap();
-    let native = std::fs::read(&saved).unwrap();
-
-    for to_file in [false, true] {
-        let mut cmd = std::process::Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"));
-        cmd.arg("script").arg(&saved);
-        if to_file {
-            cmd.arg("--out").arg(&exported);
-        }
-        let out = cmd.output().unwrap();
-        let stderr = String::from_utf8_lossy(&out.stderr);
-        assert!(out.status.success(), "{stderr}");
-        assert!(stderr.contains("note: the script leaves out print-face assignments (body.print_face)"), "{stderr}");
-        let script = if to_file {
-            assert!(out.stdout.is_empty(), "--out must keep stdout empty");
-            std::fs::read(&exported).unwrap()
-        } else {
-            out.stdout
-        };
-        let script: Value = serde_json::from_slice(&script).unwrap();
-        let mut replayed = Session::default();
-        replayed.run_script(&script).unwrap();
-        assert!(replayed.doc.print_faces.is_empty());
-        assert_eq!(replayed.doc.features, s.doc.features);
-        assert_eq!(std::fs::read(&saved).unwrap(), native, "export must not change the source design");
-    }
-    std::fs::remove_dir_all(dir).unwrap();
-}

apps/solidcraft-cli/tests/snapshot_appearance.rs

@@ -1,221 +0,0 @@
-//! `snapshot --body`, `--tool` and `--section`: a picture of a tool body inside the material it
-//! meets, which is the one picture that says whether a cut reaches through.
-//!
-//! Each option is a shortcut for the command the app itself runs (`appearance.assign`,
-//! `inspect.section`), so every test here asserts that the option's picture is the picture of a
-//! script that runs those commands — not that the pixels match a stored image. Pictures are
-//! compared with a tolerance, and the tests run on whatever renderer the machine has (a GPU, a
-//! software adapter, or the CPU rasterizer), because they only ever compare two pictures this
-//! same CLI drew.
-
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
-use std::sync::atomic::{AtomicUsize, Ordering};
-
-use serde_json::{Value, json};
-
-static NEXT: AtomicUsize = AtomicUsize::new(0);
-
-const SIZE: (u32, u32) = (200, 140);
-
-/// A PNG's size and RGBA pixels.
-fn decode(png: &[u8]) -> (u32, u32, Vec<u8>) {
-    let img = image::load_from_memory_with_format(png, image::ImageFormat::Png).unwrap().to_rgba8();
-    (img.width(), img.height(), img.into_raw())
-}
-
-/// Pixels of two same-sized pictures that differ by more than a little in some channel.
-fn differing(a: &[u8], b: &[u8]) -> usize {
-    let ((wa, ha, a), (wb, hb, b)) = (decode(a), decode(b));
-    assert_eq!((wa, ha), (wb, hb), "pictures of different sizes");
-    a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0).filter(|(p, q)| p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 16)).count()
-}
-
-/// The same picture: a renderer's output may differ by a few levels or a stray edge pixel.
-#[track_caller]
-fn assert_same(a: &[u8], b: &[u8], what: &str) {
-    let (n, total) = (differing(a, b), (SIZE.0 * SIZE.1) as usize);
-    assert!(n * 500 <= total, "{what}: {n} of {total} pixels differ");
-}
-
-/// Different pictures: more than stray pixels differ.
-#[track_caller]
-fn assert_differs(a: &[u8], b: &[u8], what: &str) {
-    let n = differing(a, b);
-    assert!(n >= 100, "{what}: only {n} pixels differ");
-}
-
-/// How much of a picture is the tool colour (`preview::TOOL_COLOR`, #e8542c): a red neither
-/// the default body grey nor the background has, still recognisable once a see-through body in
-/// front of it has tinted it (measured on this machine: (200, 108, 85) through a target at
-/// opacity 0.3, against (164, 173, 184) for the plain grey).
-fn tool_pixels(png: &[u8]) -> usize {
-    let (_, _, px) = decode(png);
-    px.as_chunks::<4>().0.iter().filter(|p| p[0] > 140 && p[0] > p[1].saturating_add(50) && p[0] > p[2].saturating_add(50)).count()
-}
-
-struct Scratch(PathBuf);
-
-impl Scratch {
-    fn new() -> Self {
-        let dir =
-            std::env::temp_dir().join(format!("solidcraft-snapshot-appearance-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
-        std::fs::create_dir(&dir).unwrap();
-        Self(dir)
-    }
-
-    /// A plate with a pin standing in it: the tool body a cut would remove, reaching 6 mm short
-    /// of the far face, which is exactly what a picture is supposed to show and a volume is not.
-    /// `more` runs on top.
-    fn script(&self, name: &str, more: &[Value]) -> PathBuf {
-        let mut steps = vec![
-            json!({"command": "solid.box", "params": {"length": 50, "width": 34, "height": 20, "center": [0, 0, 10], "body_name": "Target"}}),
-            json!({"command": "solid.cylinder", "params": {"diameter": 12, "height": 14, "base": [0, 0, 0], "operation": "new_body", "body_name": "Tool"}}),
-        ];
-        steps.extend(more.iter().cloned());
-        let path = self.0.join(name);
-        std::fs::write(&path, json!({"commands": steps}).to_string()).unwrap();
-        path
-    }
-
-    fn run(&self, script: &Path, out: &str, extra: &[&str]) -> Output {
-        let (w, h) = (SIZE.0.to_string(), SIZE.1.to_string());
-        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-            .arg("snapshot")
-            .arg(script)
-            .arg("--out")
-            .arg(self.0.join(out))
-            .args(["--width", &w, "--height", &h, "--no-grid", "--no-axes"])
-            .args(extra)
-            .output()
-            .unwrap()
-    }
-
-    /// The PNG `snapshot` writes.
-    fn snapshot(&self, script: &Path, out: &str, extra: &[&str]) -> Vec<u8> {
-        let output = self.run(script, out, extra);
-        assert!(output.status.success(), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
-        let png = std::fs::read(self.0.join(out)).unwrap();
-        assert!(png.starts_with(b"\x89PNG"), "{extra:?}");
-        png
-    }
-}
-
-impl Drop for Scratch {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-/// `--body NAME:opacity=…` draws that body see-through, and the picture is the one a script
-/// gets by assigning the same appearance itself: the option is the command, not a second way
-/// of drawing.
-#[test]
-fn a_body_drawn_see_through_is_the_picture_of_the_same_appearance_assigned() {
-    let dir = Scratch::new();
-    let plain = dir.script("plain.json", &[]);
-    let assigned =
-        dir.script("assigned.json", &[json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#b0bac6", "opacity": 0.3}})]);
-    let solid = dir.snapshot(&plain, "solid.png", &[]);
-    let see_through = dir.snapshot(&plain, "see-through.png", &["--body", "Target:opacity=0.3"]);
-    assert_differs(&see_through, &solid, "--body opacity was ignored");
-    assert_same(&see_through, &dir.snapshot(&assigned, "by-script.png", &[]), "the same appearance assigned by a script");
-
-    // The option's colour is the design's too. It names the target, not the tool: the tool is
-    // inside the target, so a solid target hides whatever colour the tool is given.
-    let painted =
-        dir.script("painted.json", &[json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#00aa33", "opacity": 1.0}})]);
-    let by_option = dir.snapshot(&plain, "painted.png", &["--body", "Target:color=#00aa33"]);
-    assert_differs(&by_option, &solid, "--body color was ignored");
-    assert_same(&by_option, &dir.snapshot(&painted, "painted-script.png", &[]), "the same colour assigned by a script");
-}
-
-/// `--tool NAME` is the whole point: the tool solid in the tool colour, every other body
-/// see-through, so the tool shows inside the material it meets. The tool's colour covers more
-/// of the picture than it does without the option, because the target no longer hides it.
-#[test]
-fn a_tool_shows_through_the_bodies_around_it() {
-    let dir = Scratch::new();
-    let script = dir.script("part.json", &[]);
-    let plain = dir.snapshot(&script, "plain.png", &["--view", "front"]);
-    let preview = dir.snapshot(&script, "preview.png", &["--view", "front", "--tool", "Tool"]);
-    assert_differs(&preview, &plain, "--tool was ignored");
-    // Seen from the front the plate hides the pin completely; the preview shows all of it.
-    assert_eq!(tool_pixels(&plain), 0, "nothing is the tool colour before the option");
-    assert!(tool_pixels(&preview) > 200, "the tool shows through the target: {} pixels", tool_pixels(&preview));
-
-    // It is the two commands it stands for, run in that order.
-    let by_script = dir.script(
-        "by-script.json",
-        &[
-            json!({"command": "appearance.assign", "params": {"bodies": ["Target"], "color": "#b0bac6", "opacity": 0.3}}),
-            json!({"command": "appearance.assign", "params": {"bodies": ["Tool"], "color": "#e8542c", "opacity": 1.0}}),
-        ],
-    );
-    assert_same(&preview, &dir.snapshot(&by_script, "script.png", &["--view", "front"]), "the appearances --tool assigns");
-
-    // A later --body overrides what --tool said.
-    let overridden = dir.snapshot(&script, "override.png", &["--view", "front", "--tool", "Tool", "--body", "Tool:color=#2255cc"]);
-    assert!(tool_pixels(&overridden) < 50, "--body after --tool decides the tool's colour");
-}
-
-/// `--section` cuts the model where `inspect.section` would, and the same spec written as the
-/// command's own JSON, or as the command in a script, gives the same picture.
-#[test]
-fn a_section_cuts_the_model_as_inspect_section_does() {
-    let dir = Scratch::new();
-    let script = dir.script("part.json", &[]);
-    let whole = dir.snapshot(&script, "whole.png", &[]);
-    let cut = dir.snapshot(&script, "cut.png", &["--section", "z=12"]);
-    assert_differs(&cut, &whole, "--section was ignored");
-    assert_same(&cut, &dir.snapshot(&script, "cut-json.png", &["--section", r#"{"plane": "XY", "at": 12}"#]), "the command's own JSON");
-    let by_script = dir.script("sectioned.json", &[json!({"command": "inspect.section", "params": {"plane": "XY", "at": 12}})]);
-    assert_same(&cut, &dir.snapshot(&by_script, "by-script.png", &[]), "inspect.section in a script");
-
-    // The other side of the same plane is a different picture.
-    let flipped = dir.snapshot(&script, "flipped.png", &["--section", "z=12,flip"]);
-    assert_differs(&flipped, &cut, "flip keeps the other side");
-
-    // A section through a see-through target still shows the tool inside it.
-    let both = dir.snapshot(&script, "both.png", &["--section", "z=12", "--tool", "Tool"]);
-    assert_differs(&both, &cut, "--tool and --section together");
-    assert!(tool_pixels(&both) > 100, "the tool is in the cut picture");
-}
-
-/// Every way of getting the options wrong is an error that says what it takes, and writes no
-/// picture: a snapshot that quietly ignored an option would be a lie about the design.
-#[test]
-fn a_body_tool_or_section_that_cannot_be_used_is_an_error_and_writes_nothing() {
-    let dir = Scratch::new();
-    let script = dir.script("part.json", &[]);
-    let cases: [(&[&str], &str); 8] = [
-        (&["--body", "Nowhere:opacity=0.3"], "no body `Nowhere`"),
-        (&["--body", "Target"], "NAME:key=value"),
-        (&["--body", "Target:opacity=3"], "0 to 1"),
-        (&["--body", "Target:alpha=0.3"], "unknown key `alpha`"),
-        (&["--body", "Target:color=red"], "#rrggbb"),
-        (&["--tool", "Nowhere"], "no body `Nowhere`"),
-        (&["--section", "q=1"], "unknown axis `q`"),
-        (&["--section", "nonsense"], "z=27"),
-    ];
-    for (extra, expect) in cases {
-        let output = dir.run(&script, "never.png", extra);
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
-        assert!(stderr.contains(expect), "{extra:?}: {stderr}");
-        assert!(output.stdout.is_empty() && !dir.0.join("never.png").exists(), "{extra:?}");
-    }
-    // An error naming a body says which bodies the design has.
-    let stderr = String::from_utf8_lossy(&dir.run(&script, "never.png", &["--tool", "Nowhere"]).stderr).to_string();
-    assert!(stderr.contains("Target") && stderr.contains("Tool"), "{stderr}");
-}
-
-/// The usage text says what the options do.
-#[test]
-fn the_usage_names_the_body_tool_and_section_options() {
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("snapshot").output().unwrap();
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    for word in ["--body", "--tool", "--section", "appearance.assign", "inspect.section", "see-through"] {
-        assert!(stderr.contains(word), "usage lacks {word}: {stderr}");
-    }
-}

apps/solidcraft-cli/tests/snapshot_camera.rs

@@ -1,8 +1,6 @@
 //! `snapshot` frames its picture like the MCP `screenshot`: from a camera, a view saved in the
 //! design or one the script applies itself, and without the ground grid and the origin's axes
-//! when asked (the grid lies on Z 0 and cuts through a part that straddles it). Pictures are drawn
-//! on the GPU and compared with a tolerance; without a GPU adapter the tests that draw are skipped
-//! with the reason printed (`SOLIDCRAFT_REQUIRE_GPU=1` makes that a failure).
+//! when asked (the grid lies on Z 0 and cuts through a part that straddles it).
 
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output};
@@ -14,52 +12,7 @@ use solidcraft_mcp::{Headless, Server};
 
 static NEXT: AtomicUsize = AtomicUsize::new(0);
 
-/// Whether pictures can be drawn here; installs the renderer the CLI installs, so the MCP
-/// `screenshot` in this process draws as `solidcraft-cli mcp` does.
-fn gpu() -> bool {
-    match solidcraft_gpu::capture::shared() {
-        Ok(c) => {
-            solidcraft_engine::capture::install(std::sync::Arc::new(move |scene, cam, w, h| {
-                c.rgba(scene, cam, w, h).map(|rgba| solidcraft_engine::capture::Picture { rgba, renderer: c.renderer() }).map_err(|e| e.to_string())
-            }));
-            true
-        }
-        Err(e @ solidcraft_gpu::GpuError::NoAdapter(_)) if std::env::var_os("SOLIDCRAFT_REQUIRE_GPU").is_none() => {
-            eprintln!("skipping: {e}");
-            false
-        }
-        Err(e) => panic!("{e}"),
-    }
-}
-
-/// A PNG's size and RGBA pixels.
-fn decode(png: &[u8]) -> (u32, u32, Vec<u8>) {
-    let img = image::load_from_memory_with_format(png, image::ImageFormat::Png).unwrap().to_rgba8();
-    (img.width(), img.height(), img.into_raw())
-}
-
-/// Pixels of two same-sized pictures that differ by more than a little in some channel.
-fn differing(a: &[u8], b: &[u8]) -> usize {
-    let ((wa, ha, a), (wb, hb, b)) = (decode(a), decode(b));
-    assert_eq!((wa, ha), (wb, hb), "pictures of different sizes");
-    a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0).filter(|(p, q)| p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 16)).count()
-}
-
-/// The same picture: GPU output may differ by a few levels or a stray edge pixel between drivers.
-#[track_caller]
-fn assert_same(a: &[u8], b: &[u8], what: &str) {
-    let (n, total) = (differing(a, b), (SIZE.0 * SIZE.1) as usize);
-    assert!(n * 500 <= total, "{what}: {n} of {total} pixels differ");
-}
-
-/// Different pictures: more than stray pixels differ.
-#[track_caller]
-fn assert_differs(a: &[u8], b: &[u8], what: &str) {
-    let n = differing(a, b);
-    assert!(n >= 20, "{what}: only {n} pixels differ");
-}
-
-const SIZE: (u32, u32) = (160, 100);
+const SIZE: (usize, usize) = (160, 100);
 
 fn camera() -> Value {
     json!({"target": [20, 0, 0], "yaw": 0.6, "pitch": 0.25, "distance": 100})
@@ -135,77 +88,65 @@ impl Drop for Scratch {
 /// not the home view the option used to be ignored for.
 #[test]
 fn a_camera_frames_the_picture_as_the_mcp_screenshot_does() {
-    if !gpu() {
-        return;
-    }
     let dir = Scratch::new();
     let script = dir.script("part.json", &[]);
     let home = dir.snapshot(&script, "home.png", &[]);
     let json = camera().to_string();
     let shot = dir.snapshot(&script, "camera.png", &["--camera", &json]);
-    assert_differs(&shot, &home, "--camera was ignored");
-    assert_same(&shot, &dir.mcp(&script, "mcp-camera.png", json!({"camera": camera()})), "the MCP screenshot");
+    assert_ne!(shot, home, "--camera was ignored");
+    assert_eq!(shot, dir.mcp(&script, "mcp-camera.png", json!({"camera": camera()})));
     // A perspective camera too, and a different eye gives a different picture.
     let mut near = camera();
     near["fov"] = json!(0.6);
     let perspective = dir.snapshot(&script, "perspective.png", &["--camera", &near.to_string()]);
-    assert_differs(&perspective, &shot, "perspective");
-    assert_same(&perspective, &dir.mcp(&script, "mcp-perspective.png", json!({"camera": near})), "the MCP perspective screenshot");
+    assert_ne!(perspective, shot);
+    assert_eq!(perspective, dir.mcp(&script, "mcp-perspective.png", json!({"camera": near})));
 }
 
 /// `--view` also takes a view saved in the design, which is the camera it was saved with; a
 /// standard view still looks as it did.
 #[test]
 fn a_saved_view_is_its_camera_and_a_standard_view_is_unchanged() {
-    if !gpu() {
-        return;
-    }
     let dir = Scratch::new();
     let script = dir.script("part.json", &[]);
     let json = camera().to_string();
     let by_camera = dir.snapshot(&script, "camera.png", &["--camera", &json]);
     let saved = dir.snapshot(&script, "saved.png", &["--view", "Detail"]);
-    assert_same(&saved, &by_camera, "the saved view");
-    assert_same(&saved, &dir.mcp(&script, "mcp-saved.png", json!({"view": "Detail"})), "the MCP saved view");
+    assert_eq!(saved, by_camera);
+    assert_eq!(saved, dir.mcp(&script, "mcp-saved.png", json!({"view": "Detail"})));
     // A standard view frames the model from its direction, as before: the home camera turned.
     let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
     let mut s = Session::default();
     s.run_script(&serde_json::from_slice(&std::fs::read(&script).unwrap()).unwrap()).unwrap();
-    let mut cam = solidcraft_engine::view::home_camera(&s).unwrap();
+    let mut cam = solidcraft_engine::view::home_camera(&s);
     cam.set_view(solidcraft_engine::render::StandardView::Top);
-    let scene = solidcraft_engine::view::scene(&s, &cam).unwrap();
-    assert_same(&top, &solidcraft_engine::capture::png(&scene, &cam, SIZE.0, SIZE.1).unwrap().bytes, "the home camera turned to the top");
-    assert_same(&top, &dir.mcp(&script, "mcp-top.png", json!({"view": "top"})), "the MCP top view");
-    assert_differs(&top, &saved, "top and the saved view");
+    let scene = solidcraft_engine::view::scene(&s, &cam);
+    assert_eq!(top, solidcraft_engine::render::render_png(&scene, &cam, SIZE.0, SIZE.1).unwrap());
+    assert_eq!(top, dir.mcp(&script, "mcp-top.png", json!({"view": "top"})));
+    assert_ne!(top, saved);
     let iso = dir.snapshot(&script, "iso.png", &["--view", "iso"]);
-    assert_same(&iso, &dir.snapshot(&script, "home.png", &[]), "iso is home");
-    assert_differs(&iso, &top, "iso and top");
+    assert_eq!(iso, dir.snapshot(&script, "home.png", &[]));
+    assert_ne!(iso, top);
 }
 
 /// A script that applies a view itself (as an MCP `execute` of `view.apply` does) sets the camera
 /// of its snapshot; `--view` and `--camera` still decide when given.
 #[test]
 fn a_script_can_carry_its_camera() {
-    if !gpu() {
-        return;
-    }
     let dir = Scratch::new();
     let script = dir.script("carried.json", &[json!({"command": "view.apply", "params": {"camera": camera()}})]);
     let plain = dir.script("plain.json", &[]);
     let carried = dir.snapshot(&script, "carried.png", &[]);
-    assert_same(&carried, &dir.snapshot(&plain, "by-camera.png", &["--camera", &camera().to_string()]), "the carried camera");
-    assert_differs(&carried, &dir.snapshot(&plain, "home.png", &[]), "the carried camera and home");
+    assert_eq!(carried, dir.snapshot(&plain, "by-camera.png", &["--camera", &camera().to_string()]));
+    assert_ne!(carried, dir.snapshot(&plain, "home.png", &[]));
     let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
-    assert_same(&top, &dir.snapshot(&plain, "plain-top.png", &["--view", "top"]), "--view decides");
+    assert_eq!(top, dir.snapshot(&plain, "plain-top.png", &["--view", "top"]));
 }
 
 /// The grid and the axes each go when asked, and a render without both from any side shows the
 /// model alone: an empty design is then the same blank picture from every camera.
 #[test]
 fn the_grid_and_the_axes_can_be_left_out() {
-    if !gpu() {
-        return;
-    }
     let dir = Scratch::new();
     let script = dir.script("part.json", &[]);
     let json = camera().to_string();
@@ -220,7 +161,7 @@ fn the_grid_and_the_axes_can_be_left_out() {
         let different = [&all, &no_grid, &no_axes, &bare];
         for (i, a) in different.iter().enumerate() {
             for b in &different[i + 1..] {
-                assert_differs(a, b, &format!("{view:?}: two of the pictures"));
+                assert_ne!(a, b, "{view:?}: two pictures are the same");
             }
         }
         // The same as the MCP's `grid` and `axes`.
@@ -232,151 +173,15 @@ fn the_grid_and_the_axes_can_be_left_out() {
             a.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
             dir.mcp(&script, out, a)
         };
-        assert_same(&no_grid, &mcp(json!({"grid": false}), "mcp-no-grid.png"), "the MCP's grid: false");
-        assert_same(&no_axes, &mcp(json!({"axes": false}), "mcp-no-axes.png"), "the MCP's axes: false");
-        assert_same(&bare, &mcp(json!({"grid": false, "axes": false}), "mcp-bare.png"), "the MCP's bare picture");
+        assert_eq!(no_grid, mcp(json!({"grid": false}), "mcp-no-grid.png"));
+        assert_eq!(no_axes, mcp(json!({"axes": false}), "mcp-no-axes.png"));
+        assert_eq!(bare, mcp(json!({"grid": false, "axes": false}), "mcp-bare.png"));
     }
     let empty = dir.0.join("empty.json");
     std::fs::write(&empty, json!({"commands": []}).to_string()).unwrap();
     let blank = |view: &str, out: &str| dir.snapshot(&empty, out, &["--view", view, "--no-grid", "--no-axes"]);
-    assert_same(&blank("top", "blank-top.png"), &blank("front", "blank-front.png"), "blank from every side");
-    assert_differs(&blank("top", "blank-top.png"), &dir.snapshot(&empty, "top.png", &["--view", "top"]), "blank and the grid");
-}
-
-/// A snapshot of a box shows its silhouette where the camera puts it: the pixels that differ
-/// from an empty design's picture (same camera, no grid or axes) span the box's corners projected
-/// to pixels, within the edge and silhouette lines' width.
-#[test]
-fn a_snapshot_shows_the_part_where_the_camera_puts_it() {
-    if !gpu() {
-        return;
-    }
-    let dir = Scratch::new();
-    let part = dir.0.join("box.json");
-    let empty = dir.0.join("empty.json");
-    let corner = [10.0, -20.0, -15.0];
-    let size = [60.0, 40.0, 30.0];
-    std::fs::write(
-        &part,
-        json!({"commands": [{"command": "solid.box", "params": {"length": size[0], "width": size[1], "height": size[2], "corner": corner}}]})
-            .to_string(),
-    )
-    .unwrap();
-    std::fs::write(&empty, json!({"commands": []}).to_string()).unwrap();
-    for cam in [
-        camera(),
-        json!({"target": [40, 0, 0], "yaw": 0.0, "pitch": 0.0, "distance": 160}),
-        json!({"target": [40, 0, 0], "yaw": -0.4, "pitch": 0.5, "distance": 150, "fov": 0.6}),
-    ] {
-        let args = ["--camera", &cam.to_string(), "--no-grid", "--no-axes"];
-        let (_, _, with) = decode(&dir.snapshot(&part, "part.png", &args));
-        let (_, _, without) = decode(&dir.snapshot(&empty, "empty.png", &args));
-        // The part's pixels: where the picture differs from the empty one.
-        let (mut lo, mut hi) = ([u32::MAX; 2], [0u32; 2]);
-        for (i, (p, q)) in with.as_chunks::<4>().0.iter().zip(without.as_chunks::<4>().0).enumerate() {
-            if p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 24) {
-                let (x, y) = (i as u32 % SIZE.0, i as u32 / SIZE.0);
-                lo = [lo[0].min(x), lo[1].min(y)];
-                hi = [hi[0].max(x), hi[1].max(y)];
-            }
-        }
-        assert!(lo[0] <= hi[0], "{cam}: the part is not in the picture");
-        // Where the camera puts the corners.
-        let mut s = solidcraft_engine::Session::default();
-        s.execute("view.apply", &json!({"camera": cam})).unwrap();
-        let c = s.camera.unwrap();
-        let vp = c.view_proj(f64::from(SIZE.0) / f64::from(SIZE.1), 1000.0);
-        let (mut elo, mut ehi) = ([f64::MAX; 2], [f64::MIN; 2]);
-        for k in 0..8 {
-            let p = solidcore_record::Vec3::new(
-                corner[0] + size[0] * f64::from(k & 1),
-                corner[1] + size[1] * f64::from((k >> 1) & 1),
-                corner[2] + size[2] * f64::from((k >> 2) & 1),
-            );
-            let q = vp.apply(p);
-            let (x, y) = ((q[0] / q[3] + 1.0) * 0.5 * f64::from(SIZE.0), (1.0 - q[1] / q[3]) * 0.5 * f64::from(SIZE.1));
-            elo = [elo[0].min(x), elo[1].min(y)];
-            ehi = [ehi[0].max(x), ehi[1].max(y)];
-        }
-        let near = |got: u32, want: f64| (f64::from(got) - want).abs() <= 2.5;
-        assert!(
-            near(lo[0], elo[0]) && near(lo[1], elo[1]) && near(hi[0] + 1, ehi[0]) && near(hi[1] + 1, ehi[1]),
-            "{cam}: the part spans pixels {lo:?}..={hi:?}, its corners project to {elo:?}..{ehi:?}"
-        );
-    }
-}
-
-/// `snapshot` under a `SOLIDCRAFT_GPU` policy: its reply and stderr.
-fn snapshot_under(dir: &Scratch, script: &Path, out: &str, policy: &str) -> Output {
-    Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .env("SOLIDCRAFT_GPU", policy)
-        .arg("snapshot")
-        .arg(script)
-        .arg("--out")
-        .arg(dir.0.join(out))
-        .args(["--width", &SIZE.0.to_string(), "--height", &SIZE.1.to_string(), "--view", "top"])
-        .output()
-        .unwrap()
-}
-
-/// The last tier: `SOLIDCRAFT_GPU=cpu` draws with the CPU rasterizer whatever adapters there are,
-/// says so (`renderer: cpu` and a warning that overlays are not drawn), and the picture is the
-/// rasterizer's own.
-#[test]
-fn a_forced_cpu_snapshot_is_the_cpu_rasterizers_and_says_so() {
-    let dir = Scratch::new();
-    let script = dir.script("part.json", &[]);
-    let output = snapshot_under(&dir, &script, "cpu.png", "cpu");
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(output.status.success(), "{stderr}");
-    let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
-    assert_eq!(reply["renderer"], "cpu", "{reply}");
-    assert!(reply["warning"].as_str().is_some_and(|w| w.contains("not drawn")), "{reply}");
-    assert!(stderr.contains("CPU rasterizer"), "{stderr}");
-    let mut s = Session::default();
-    s.run_script(&serde_json::from_slice(&std::fs::read(&script).unwrap()).unwrap()).unwrap();
-    let mut cam = solidcraft_engine::view::home_camera(&s).unwrap();
-    cam.set_view(solidcraft_engine::render::StandardView::Top);
-    let scene = solidcraft_engine::view::scene(&s, &cam).unwrap();
-    let cpu = solidcraft_engine::render::render_png(&scene, &cam, SIZE.0 as usize, SIZE.1 as usize).unwrap();
-    assert_eq!(std::fs::read(dir.0.join("cpu.png")).unwrap(), cpu);
-}
-
-/// `hardware` (and `software`) never fall to the CPU rasterizer: without such an adapter the
-/// snapshot fails, naming the policy, and writes nothing; with one it says it was drawn on the GPU.
-/// `auto` lands where `solidcraft-cli gpu` says it does.
-#[test]
-fn a_strict_policy_never_falls_to_the_cpu() {
-    let dir = Scratch::new();
-    let script = dir.script("part.json", &[]);
-    let survey = |policy: &str| {
-        let o = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["gpu", "--policy", policy]).output().unwrap();
-        (o.status.success(), serde_json::from_slice::<Value>(&o.stdout).unwrap_or(Value::Null))
-    };
-    for policy in ["hardware", "software"] {
-        let (found, report) = survey(policy);
-        let output = snapshot_under(&dir, &script, &format!("{policy}.png"), policy);
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        if found {
-            assert!(output.status.success(), "{policy}: {stderr}");
-            let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
-            assert_eq!(reply["renderer"], report["renderer"], "{policy}: {reply}");
-            assert_ne!(reply["renderer"], "cpu");
-        } else {
-            assert_eq!(report["lands_on"], Value::Null, "{policy}: {report}");
-            assert_eq!(output.status.code(), Some(1), "{policy}: {stderr}");
-            assert!(stderr.contains(&format!("`{policy}` policy")) && stderr.contains("solidcraft-cli gpu"), "{policy}: {stderr}");
-            assert!(!dir.0.join(format!("{policy}.png")).exists());
-        }
-    }
-    let (found, report) = survey("auto");
-    assert!(found, "auto always lands somewhere: {report}");
-    let output = snapshot_under(&dir, &script, "auto.png", "auto");
-    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
-    let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
-    assert_eq!(reply["renderer"], report["renderer"], "{reply} vs {report}");
-    let (_, cpu) = survey("cpu");
-    assert_eq!((cpu["lands_on"].clone(), cpu["renderer"].clone()), (json!("cpu"), json!("cpu")), "{cpu}");
+    assert_eq!(blank("top", "blank-top.png"), blank("front", "blank-front.png"));
+    assert_ne!(blank("top", "blank-top.png"), dir.snapshot(&empty, "top.png", &["--view", "top"]));
 }
 
 #[test]

apps/solidcraft-cli/tests/straight_edges_after_cuts.rs

@@ -1,21 +1,20 @@
 //! Straight edges stay one edge after many cuts (#1049). The owner's design
-//! (`tests/action_matrix/designs/crazy-geom-cuts.sc`, saved by 0.10.0): five extrudes,
+//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
 //! joins and cuts, over four sketches, three of them on faces of the body with the faces'
 //! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
 //! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
 //! as many pieces, and a sketch on such a face projected every piece.
 
-use solidcraft_engine::geom::prelude::*;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
 use serde_json::json;
-use solidcore_record::Vec3;
 use solidcraft_engine::Session;
 use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
+use solidcraft_engine::geom::Vec3;
 
 fn design() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.sc")
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
 }
 
 fn open(path: &Path) -> Session {
@@ -49,11 +48,11 @@ fn key(v: Vec3) -> [i64; 3] {
 fn straight_edges_are_one_edge_after_many_cuts() {
     for (what, s) in [("as saved", open(&design())), ("built from scratch", rebuilt())] {
         assert_eq!(errors(&s), vec![], "{what}: every feature evaluates");
-        let st = s.world_state().unwrap();
+        let st = s.world_state();
         let bodies: Vec<_> = st.bodies.iter().filter(|b| !b.body.is_mesh()).collect();
         assert_eq!(bodies.len(), 1, "{what}: one body");
         let body = &bodies[0].body;
-        let mesh = body.mesh(&solidcraft_kernel::MeshTolerance::chord(0.01)).unwrap();
+        let mesh = body.tessellate(0.01).unwrap();
         // Every edge is drawn as one polyline; a straight one as one segment.
         let mut at: HashMap<[i64; 3], Vec<usize>> = HashMap::new();
         for (i, e) in mesh.edges.iter().enumerate() {

apps/solidcraft-web/Cargo.toml

@@ -13,34 +13,21 @@ workspace = true
 name = "solidcraft-web"
 path = "src/main.rs"
 
-[features]
-default = ["profile"]
-bundled-render-library = ["solidcraft-engine/bundled-render-library"]
-# The profiler, compiled in so any build can say where its time goes (the Profile operations
-# preference, SOLIDCRAFT_PROFILE=1, diagnostics.profile); it records nothing until asked.
-profile = ["solidcraft-engine/profile"]
-
 [dependencies]
 solidcraft-engine = { workspace = true }
-solidcraft-control = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
-solidcraft-ui-text = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
-serde_json = { workspace = true }
-url = "2"
-percent-encoding = "2"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
+serde_json = { workspace = true }
 web-sys = { version = "0.3", features = [
     "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
-    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemGetDirectoryOptions", "FileSystemWritableFileStream",
-    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage", "StorageEvent",
-    "IdbFactory", "IdbDatabase", "IdbObjectStore", "IdbOpenDbRequest", "IdbRequest", "IdbTransaction", "IdbTransactionMode",
-    "Headers", "ReadableStream", "ReadableStreamDefaultReader",
-    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "FormData", "RequestInit", "MediaQueryList", "Gamepad", "Performance",
+    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
+    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
+    "BeforeUnloadEvent", "Event", "EventTarget", "Response", "MediaQueryList",
 ] }

apps/solidcraft-web/build.rs

@@ -1,9 +0,0 @@
-//! Links the browser build with an 8 MiB stack: solidcore's kernel algorithms (subdivision,
-//! intersection, filleting) recurse legitimately, and wasm has no guard page to catch an
-//! overflow (solidcore's README recommends 8 MiB).
-
-fn main() {
-    if std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32") {
-        println!("cargo:rustc-link-arg=-zstack-size=8388608");
-    }
-}

apps/solidcraft-web/channel-storage.txt

@@ -1,2 +0,0 @@
-This build keeps its designs and settings apart per release channel (src/channel.rs).
-packaging/web-channels.sh only offers a release candidate that has this file.

apps/solidcraft-web/index.html

@@ -9,39 +9,33 @@
   <meta property="og:site_name" content="SolidCraft">
   <meta property="og:title" content="SolidCraft: try it in your browser">
   <meta property="og:description" content="Open-source parametric CAD built in Rust. Desktop, browser, and MCP for AI agents.">
-  <meta property="og:url" content="https://app.solidcraft.io/">
-  <meta property="og:image" content="https://docs.solidcraft.io/og.png">
+  <meta property="og:url" content="https://bherbruck.github.io/solidcraft/app/">
+  <meta property="og:image" content="https://bherbruck.github.io/solidcraft/og.png">
   <meta property="og:image:width" content="1280">
   <meta property="og:image:height" content="640">
   <meta property="og:image:alt" content="SolidCraft: open-source parametric CAD built in Rust">
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:title" content="SolidCraft: try it in your browser">
   <meta name="twitter:description" content="Open-source parametric CAD built in Rust. Desktop, browser, and MCP for AI agents.">
-  <meta name="twitter:image" content="https://docs.solidcraft.io/og.png">
+  <meta name="twitter:image" content="https://bherbruck.github.io/solidcraft/og.png">
   <meta name="twitter:image:alt" content="SolidCraft: open-source parametric CAD built in Rust">
   <link data-trunk rel="rust" data-bin="solidcraft-web" data-wasm-opt="z" data-weak-refs />
   <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf" data-target-path="fonts" />
   <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/OFL.txt" data-target-path="fonts" />
-  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-sc/CraftUI-SC.otf" data-target-path="fonts" />
-  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-sc/OFL.txt" data-target-path="fonts/craft-ui-sc" />
-  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-tc/CraftUI-TC.otf" data-target-path="fonts" />
-  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-tc/OFL.txt" data-target-path="fonts/craft-ui-tc" />
   <link data-trunk rel="css" href="../../assets/styles/web/loading.css" />
-  <link data-trunk rel="copy-file" href="../../assets/styles/web/loading-logo.svg" />
   <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
   <meta name="theme-color" content="#343840">
   <link rel="manifest" href="manifest.webmanifest">
-  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/io.tangencylabs.solidcraft.png">
-  <link rel="apple-touch-icon" href="icons/256x256/io.tangencylabs.solidcraft.png">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
   <link data-trunk rel="copy-file" href="manifest.webmanifest" />
-  <link data-trunk rel="copy-file" href="channel-storage.txt" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/32x32" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/256x256" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/512x512" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
   <canvas id="solidcraft_canvas"></canvas>
-  <div id="solidcraft_loading" role="status"><img src="loading-logo.svg" alt=""><span class="sr-only">Loading SolidCraft&hellip;</span></div>
+  <div id="solidcraft_loading">Loading SolidCraft&hellip;</div>
   <script>
     // Offline use and updates (sw.js; written into release builds by `cargo xtask web-offline`).
     if ("serviceWorker" in navigator) {

apps/solidcraft-web/manifest.webmanifest

@@ -9,8 +9,8 @@
   "theme_color": "#343840",
   "categories": ["productivity", "utilities"],
   "icons": [
-    { "src": "icons/32x32/io.tangencylabs.solidcraft.png", "sizes": "32x32", "type": "image/png" },
-    { "src": "icons/256x256/io.tangencylabs.solidcraft.png", "sizes": "256x256", "type": "image/png" },
-    { "src": "icons/512x512/io.tangencylabs.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
   ]
 }

apps/solidcraft-web/src/api.rs

@@ -1,131 +0,0 @@
-//! Promise-based access to the running app's existing control channel.
-
-use std::cell::RefCell;
-use std::rc::Rc;
-use std::sync::mpsc::{Receiver, Sender, TryRecvError};
-use std::time::Duration;
-
-use serde_json::{Value, json};
-use solidcraft_control::ControlRequest;
-use wasm_bindgen::{JsValue, closure::Closure};
-
-const MAX_PENDING: usize = 256;
-const MAX_JSON_BYTES: usize = 16 * 1024 * 1024;
-
-struct Pending {
-    reply: Receiver<Value>,
-    resolve: js_sys::Function,
-    reject: js_sys::Function,
-}
-
-#[derive(Clone)]
-pub struct Api {
-    sender: Sender<ControlRequest>,
-    pending: Rc<RefCell<Vec<Pending>>>,
-    ctx: egui::Context,
-}
-
-fn params(value: &JsValue) -> Result<Value, String> {
-    if value.is_undefined() || value.is_null() {
-        return Ok(json!({}));
-    }
-    let text = js_sys::JSON::stringify(value).ok().and_then(|v| v.as_string()).ok_or("params must be JSON serializable")?;
-    if text.len() > MAX_JSON_BYTES {
-        return Err("params exceed 16 MiB".into());
-    }
-    serde_json::from_str(&text).map_err(|e| format!("invalid params: {e}"))
-}
-
-fn error(message: &str) -> JsValue {
-    js_sys::Error::new(message).into()
-}
-
-impl Api {
-    pub fn install(sender: Sender<ControlRequest>, ctx: egui::Context) -> Result<Self, JsValue> {
-        let api = Self { sender, pending: Rc::default(), ctx };
-        let object = js_sys::Object::new();
-        let request = api.clone();
-        let execute = api.clone();
-        let commands = api.clone();
-        let inspect = api.clone();
-        for (name, function) in [
-            (
-                "request",
-                Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(move |method: String, value: JsValue| {
-                    request.request(&method, params(&value))
-                })
-                .into_js_value(),
-            ),
-            (
-                "execute",
-                Closure::<dyn Fn(String, JsValue) -> js_sys::Promise>::new(move |command: String, value: JsValue| {
-                    execute.request("engine.execute", params(&value).map(|p| json!({"command": command, "params": p})))
-                })
-                .into_js_value(),
-            ),
-            ("commands", Closure::<dyn Fn() -> js_sys::Promise>::new(move || commands.request("engine.commands", Ok(json!({})))).into_js_value()),
-            (
-                "inspect",
-                Closure::<dyn Fn(JsValue) -> js_sys::Promise>::new(move |value: JsValue| inspect.request("document.inspect", params(&value)))
-                    .into_js_value(),
-            ),
-        ] {
-            js_sys::Reflect::set(&object, &name.into(), &function)?;
-        }
-        let window = web_sys::window().ok_or_else(|| error("no window"))?;
-        js_sys::Reflect::set(&window, &"solidcraft".into(), &object)?;
-        Ok(api)
-    }
-
-    fn request(&self, method: &str, params: Result<Value, String>) -> js_sys::Promise {
-        let params = match params {
-            Ok(params) => params,
-            Err(message) => return js_sys::Promise::reject(&error(&message)),
-        };
-        if self.pending.borrow().len() >= MAX_PENDING {
-            return js_sys::Promise::reject(&error("too many pending SolidCraft requests (maximum 256)"));
-        }
-        js_sys::Promise::new(&mut |resolve, reject| {
-            let (request, reply) = ControlRequest::new(method, params.clone());
-            if self.sender.send(request).is_err() {
-                let _ = reject.call1(&JsValue::UNDEFINED, &error("SolidCraft is not running"));
-                return;
-            }
-            self.pending.borrow_mut().push(Pending { reply, resolve, reject });
-            self.ctx.request_repaint();
-        })
-    }
-
-    pub fn poll(&self) {
-        let mut completed = Vec::new();
-        self.pending.borrow_mut().retain_mut(|pending| {
-            let result = match pending.reply.try_recv() {
-                Ok(reply) => {
-                    if reply.get("ok").and_then(Value::as_bool) == Some(true) {
-                        js_sys::JSON::parse(&reply.get("result").unwrap_or(&Value::Null).to_string())
-                    } else {
-                        Err(error(reply.get("error").and_then(Value::as_str).unwrap_or("SolidCraft request failed")))
-                    }
-                }
-                Err(TryRecvError::Empty) => return true,
-                Err(TryRecvError::Disconnected) => Err(error("SolidCraft request dropped")),
-            };
-            completed.push((pending.resolve.clone(), pending.reject.clone(), result));
-            false
-        });
-        // Release the queue before calling JavaScript, which can submit another request.
-        for (resolve, reject, result) in completed {
-            match result {
-                Ok(value) => {
-                    let _ = resolve.call1(&JsValue::UNDEFINED, &value);
-                }
-                Err(error) => {
-                    let _ = reject.call1(&JsValue::UNDEFINED, &error);
-                }
-            }
-        }
-        if !self.pending.borrow().is_empty() {
-            self.ctx.request_repaint_after(Duration::from_millis(16));
-        }
-    }
-}

apps/solidcraft-web/src/channel.rs

@@ -1,61 +0,0 @@
-//! Release channels. The site serves the stable web app at `/app/`, the release candidate at
-//! `/app-rc/` and the bleeding-edge build at `/app-edge/`: one origin, so one set of browser
-//! storage. A channel that kept its designs and settings in the same places could save a design
-//! in a file format the stable app can't open, or overwrite stable's settings. So each
-//! pre-release channel keeps everything under its own name, and stable (and any copy served from
-//! another path: the release zip, `trunk serve`) keeps the names it has always used, so what
-//! people have saved at `/app/` is untouched.
-//!
-//! The channel comes from the directory the app is served from, not from the build, so a build
-//! taken from a release zip is as separate as one built on the spot.
-
-/// The channel the app is served as, from the page's path: `"rc"`, `"edge"`, or `""` (stable).
-pub fn of_path(pathname: &str) -> &'static str {
-    match pathname.trim_end_matches("index.html").trim_end_matches('/').rsplit('/').next() {
-        Some("app-rc") => "rc",
-        Some("app-edge") => "edge",
-        _ => "",
-    }
-}
-
-/// `name` as this channel stores it: unchanged for stable, `rc:name` and `edge:name` otherwise.
-pub fn name_in(channel: &str, name: &str) -> String {
-    if channel.is_empty() { name.to_owned() } else { format!("{channel}:{name}") }
-}
-
-#[cfg(target_arch = "wasm32")]
-pub fn current() -> &'static str {
-    web_sys::window().and_then(|w| w.location().pathname().ok()).map_or("", |p| of_path(&p))
-}
-
-/// A storage key (local storage, IndexedDB database name) of the running channel.
-#[cfg(target_arch = "wasm32")]
-pub fn key(name: &str) -> String {
-    name_in(current(), name)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn channel_follows_the_directory() {
-        assert_eq!(of_path("/app/"), "");
-        assert_eq!(of_path("/app/index.html"), "");
-        assert_eq!(of_path("/app-rc/"), "rc");
-        assert_eq!(of_path("/app-rc"), "rc");
-        assert_eq!(of_path("/app-rc/index.html"), "rc");
-        assert_eq!(of_path("/app-edge/"), "edge");
-        assert_eq!(of_path("/"), "");
-        assert_eq!(of_path("/solidcraft-web-0.30.1/"), "");
-        assert_eq!(of_path("/app/app-rc/"), "rc", "only the directory's own name counts");
-        assert_eq!(of_path("/app-rc/app/"), "");
-    }
-
-    #[test]
-    fn stable_keeps_its_names() {
-        assert_eq!(name_in("", "solidcraft.prefs"), "solidcraft.prefs");
-        assert_eq!(name_in("rc", "solidcraft.prefs"), "rc:solidcraft.prefs");
-        assert_ne!(name_in("rc", "x"), name_in("edge", "x"));
-    }
-}

apps/solidcraft-web/src/disk.rs

@@ -1,737 +0,0 @@
-//! Designs on the computer's own disk, through the File System Access API (Chrome, Edge, Opera):
-//! Save As and Open show the browser's file dialogs, and the chosen file's handle is kept (in
-//! memory, and in IndexedDB so Save still reaches the file after a reload) so Save writes back to
-//! it. To the engine such a design is the file `/disk/<id>/<name>`: it saves there like anywhere,
-//! and [`flush`](crate::files::flush) forwards what it wrote to the handle. Browsers without the
-//! API (Firefox, Safari) keep designs in the origin private file system (`files.rs`).
-//!
-//! The path logic is plain Rust and tested natively; the browser calls are wasm-only.
-#![cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
-
-/// Where a design on the computer's disk appears to the engine.
-pub const PREFIX: &str = "/disk/";
-
-/// Where designs kept in the browser's private storage (OPFS) appear to the engine.
-pub const OPFS_PREFIX: &str = "/opfs/";
-/// Paths written here are handed to the user as downloads.
-pub const DOWNLOADS_PREFIX: &str = "/downloads/";
-
-/// Where what a command wrote to an engine path goes.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum WriteTo {
-    /// The browser's private storage: the design (or recovery file) keeps its name there.
-    Opfs,
-    /// A file on the computer, through its handle.
-    Disk,
-    /// A download.
-    Download,
-    /// Kept only in memory (uploads).
-    Memory,
-}
-
-/// Route a write by its path. OPFS paths always go to OPFS, whatever the browser can do: a design
-/// opened from the browser's storage keeps saving there until the user picks Save As.
-pub fn route(path: &str) -> WriteTo {
-    if path.starts_with(OPFS_PREFIX) {
-        WriteTo::Opfs
-    } else if parse(path).is_some() {
-        WriteTo::Disk
-    } else if path.starts_with(DOWNLOADS_PREFIX) {
-        WriteTo::Download
-    } else {
-        WriteTo::Memory
-    }
-}
-
-/// The engine path of the design `name` kept under handle `id`.
-pub fn path(id: &str, name: &str) -> String {
-    format!("{PREFIX}{id}/{name}")
-}
-
-/// The handle id and file name of an engine path made by [`path`].
-pub fn parse(path: &str) -> Option<(&str, &str)> {
-    let (id, name) = path.strip_prefix(PREFIX)?.split_once('/')?;
-    (!id.is_empty() && !name.is_empty() && !name.contains('/')).then_some((id, name))
-}
-
-/// A handle id from the time and a random number.
-pub fn make_id(ms: u64, random: u64) -> String {
-    format!("{ms:x}-{random:x}")
-}
-
-/// How long a remembered file may go unused, and unreferenced by the recent designs and the
-/// autosave, before the browser's copy of its handle is dropped.
-pub const HANDLE_MAX_AGE_MS: f64 = 90.0 * 24.0 * 3600.0 * 1000.0;
-
-/// What to do with the remembered handles.
-#[derive(Debug, Default, PartialEq)]
-pub struct PrunePlan {
-    /// Handles to forget.
-    pub delete: Vec<String>,
-    /// Handles seen unused for the first time: start their clock.
-    pub stamp: Vec<String>,
-}
-
-/// Decide which of the remembered handles `ids` (id, when it was last stamped) to forget: those
-/// that no recent design or autosave (`keep`) names and that have gone unused for `max_age`. One
-/// never stamped starts its clock now, so a file another tab has just saved is never dropped.
-pub fn plan_prune(ids: &[(String, Option<f64>)], keep: &std::collections::HashSet<String>, now: f64, max_age: f64) -> PrunePlan {
-    let mut plan = PrunePlan::default();
-    for (id, stamped) in ids.iter().filter(|(id, _)| !keep.contains(id)) {
-        match stamped {
-            None => plan.stamp.push(id.clone()),
-            Some(at) if now - at > max_age => plan.delete.push(id.clone()),
-            Some(_) => {}
-        }
-    }
-    plan
-}
-
-/// Where a design saved with Save As goes.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum SaveTarget {
-    /// A file the user picks on their computer.
-    Disk,
-    /// The browser's private storage (OPFS): what browsers without the API have always done.
-    Browser,
-    /// Not a design (an export): handed over as a download.
-    Download,
-}
-
-/// Choose where a Save As goes: designs to the disk when the browser can pick a file, else into
-/// the browser's storage; anything else is a download.
-pub fn save_target(api: bool, design: bool) -> SaveTarget {
-    match (design, api) {
-        (false, _) => SaveTarget::Download,
-        (true, true) => SaveTarget::Disk,
-        (true, false) => SaveTarget::Browser,
-    }
-}
-
-/// Does a picker for `extensions` (what the command reads; `&[]`: anything) belong to a design?
-/// Only those go through the disk dialog; inserting a STEP or mesh keeps using the file window.
-pub fn opens_design(extensions: &[&str]) -> bool {
-    extensions.is_empty() || extensions.iter().any(|e| solidcraft_engine::io::DESIGN_EXTS.contains(e))
-}
-
-/// Where an Open for `extensions` (what the command reads; `&[]`: anything) is answered.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum OpenRoute {
-    /// The browser's open dialog for a design: the file keeps its handle, so Save writes back.
-    Disk,
-    /// The "Files in this browser" window, where the browser can't open a design from the disk.
-    Panel,
-    /// A plain file input that offers these types: the file is read into the engine's files and
-    /// the command runs on it (Insert DXF or SVG, images, meshes, imported settings).
-    Upload,
-}
-
-/// Choose how an Open for `extensions` asks for its file; `api`: the browser can open a file
-/// from the disk and keep its handle.
-pub fn open_route(api: bool, extensions: &[&str]) -> OpenRoute {
-    match (opens_design(extensions), api) {
-        (true, true) => OpenRoute::Disk,
-        (true, false) => OpenRoute::Panel,
-        (false, _) => OpenRoute::Upload,
-    }
-}
-
-/// The `accept` list of a file input for `extensions` (with or without their dot): ".dxf,.svg".
-pub fn accept_list(extensions: &[&str]) -> String {
-    let list: Vec<String> = extensions
-        .iter()
-        .map(|e| e.trim().trim_start_matches('.'))
-        .filter(|e| !e.is_empty())
-        .map(|e| format!(".{}", e.to_ascii_lowercase()))
-        .collect();
-    list.join(",")
-}
-
-/// The `accept` of a file input for `extensions` on this device (`apple_touch`: an iPhone or
-/// iPad). The picker there offers only files of a type the system knows from the list and greys
-/// out the rest, `.solidcraft` designs among them, since no system type has that extension
-/// (#6977). So it offers every file there, and the opener checks what it gets.
-pub fn input_accept(extensions: &[&str], apple_touch: bool) -> String {
-    if apple_touch { String::new() } else { accept_list(extensions) }
-}
-
-/// The browser runs on an iPhone or iPad (every browser there is WebKit), from its
-/// `navigator.userAgent` and `navigator.maxTouchPoints`. iPadOS presents itself as a Mac; only its
-/// touch screen tells them apart.
-pub fn apple_touch(user_agent: &str, touch_points: i32) -> bool {
-    ["iPhone", "iPad", "iPod"].iter().any(|d| user_agent.contains(d)) || (user_agent.contains("Macintosh") && touch_points > 1)
-}
-
-/// The largest file an upload for `extensions` reads: images go into a canvas, which has a size
-/// limit, so a bigger one is refused before it is read. `None`: the importer checks the file.
-pub fn upload_limit(extensions: &[&str]) -> Option<usize> {
-    let image = |e: &&str| ["png", "jpg", "jpeg"].contains(&e.trim_start_matches('.').to_ascii_lowercase().as_str());
-    (!extensions.is_empty() && extensions.iter().all(image)).then_some(solidcraft_engine::doc::canvas::MAX_CANVAS_BYTES)
-}
-
-/// The file type a Save As dialog offers for `name`: (description, MIME type, extension). A
-/// design is `.sc` unless the name already has an older design extension, which it keeps.
-pub fn save_type(name: &str) -> (&'static str, &'static str, String) {
-    let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
-    match ext.as_deref() {
-        Some("json") => ("Plain JSON design", "application/json", ".json".into()),
-        Some(e) if solidcraft_engine::io::is_design_ext(e) => ("SolidCraft design", "application/octet-stream", format!(".{e}")),
-        _ => ("SolidCraft design", "application/octet-stream", format!(".{}", solidcraft_engine::io::DESIGN_EXT)),
-    }
-}
-
-/// Is this a cancelled dialog (the browser's `AbortError`)? Not an error to show.
-pub fn is_abort(error_name: &str) -> bool {
-    error_name == "AbortError"
-}
-
-#[cfg(target_arch = "wasm32")]
-pub use web::*;
-
-#[cfg(target_arch = "wasm32")]
-mod web {
-    use std::cell::{Cell, RefCell};
-    use std::collections::{HashMap, VecDeque};
-    use std::rc::Rc;
-
-    use js_sys::{Array, Function, Object, Promise, Reflect};
-    use solidcraft_engine::io::vfs;
-    use wasm_bindgen::{JsCast as _, JsValue, closure::Closure};
-    use wasm_bindgen_futures::{JsFuture, spawn_local};
-    use web_sys::{FileSystemFileHandle, IdbDatabase, IdbObjectStore, IdbOpenDbRequest, IdbRequest, IdbTransactionMode};
-
-    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, parse, path, plan_prune, save_type};
-    use crate::files::{Files, err, read_handle};
-
-    const DB: &str = "solidcraft-disk-handles";
-    const STORE: &str = "handles";
-
-    thread_local! {
-        /// Handles picked or looked up in this session, by id.
-        static HANDLES: RefCell<HashMap<String, FileSystemFileHandle>> = RefCell::new(HashMap::new());
-        /// Writes waiting for their turn (a file takes one writer at a time), latest per id.
-        static QUEUE: RefCell<VecDeque<(String, Vec<u8>)>> = const { RefCell::new(VecDeque::new()) };
-        static BUSY: Cell<bool> = const { Cell::new(false) };
-    }
-
-    /// Why a dialog gave no file.
-    enum Pick {
-        Cancelled,
-        Failed(String),
-    }
-
-    fn failed(e: JsValue) -> Pick {
-        let name = Reflect::get(&e, &"name".into()).ok().and_then(|n| n.as_string()).unwrap_or_default();
-        if is_abort(&name) { Pick::Cancelled } else { Pick::Failed(err(e)) }
-    }
-
-    /// Can this page show the browser's file dialogs and write to the files they pick?
-    pub fn supported() -> bool {
-        let Some(window) = web_sys::window() else { return false };
-        let has = |name: &str| Reflect::get(&window, &name.into()).is_ok_and(|f| f.is_function());
-        window.is_secure_context() && has("showSaveFilePicker") && has("showOpenFilePicker")
-    }
-
-    fn types(description: &str, mime: &str, extension: &str) -> Array {
-        let accept = Object::new();
-        let _ = Reflect::set(&accept, &mime.into(), &Array::of1(&extension.into()));
-        let entry = Object::new();
-        let _ = Reflect::set(&entry, &"description".into(), &description.into());
-        let _ = Reflect::set(&entry, &"accept".into(), &accept);
-        Array::of1(&entry)
-    }
-
-    /// Start a dialog. This must run in the click that asked for it (the browser wants a user
-    /// gesture), so it is called before anything is awaited.
-    fn start_picker(function: &str, options: &Object) -> Result<Promise, Pick> {
-        let window = web_sys::window().ok_or_else(|| Pick::Failed("no window".into()))?;
-        let f: Function = Reflect::get(&window, &function.into())
-            .map_err(failed)?
-            .dyn_into()
-            .map_err(|_| Pick::Failed("this browser can't open file dialogs".into()))?;
-        f.call1(&window, options).map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("no answer from the file dialog".into()))
-    }
-
-    /// Remember a picked file: in memory now, in IndexedDB for the next session.
-    fn register(handle: &FileSystemFileHandle) -> String {
-        let id = make_id(js_sys::Date::now() as u64, (js_sys::Math::random() * 1e15) as u64);
-        HANDLES.with(|h| h.borrow_mut().insert(id.clone(), handle.clone()));
-        let (key, kept, name) = (id.clone(), handle.clone(), handle.name());
-        spawn_local(async move {
-            if let Err(e) = remember(&key, &kept).await {
-                log::warn!("the file's handle isn't kept for the next session: {e}");
-            }
-        });
-        path(&id, &name)
-    }
-
-    fn save_options(name: &str) -> Object {
-        let options = Object::new();
-        let _ = Reflect::set(&options, &"suggestedName".into(), &name.into());
-        let (description, mime, extension) = save_type(name);
-        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, &extension));
-        options
-    }
-
-    /// "Save to computer…" for a design kept in the browser: write a copy of `bytes` to a file the
-    /// user picks (call in the click), or download it where the browser can't pick one. The design
-    /// itself stays where it is.
-    pub fn save_copy(files: &Rc<Files>, name: &str, bytes: Vec<u8>) {
-        if !supported() {
-            if let Err(e) = crate::files::download(name, &bytes) {
-                files.say(format!("{name}: {e}"), true);
-            }
-            return;
-        }
-        let promise = start_picker("showSaveFilePicker", &save_options(name));
-        let files = files.clone();
-        spawn_local(async move {
-            let r = async {
-                let h: FileSystemFileHandle =
-                    JsFuture::from(promise?).await.map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("not a file".into()))?;
-                write_handle(&h, &bytes).await.map_err(Pick::Failed)?;
-                Ok::<String, Pick>(h.name())
-            };
-            match r.await {
-                Ok(saved) => files.say(format!("Saved a copy to {saved}"), false),
-                Err(Pick::Cancelled) => {}
-                Err(Pick::Failed(e)) => files.say(format!("save to computer: {e}"), true),
-            }
-        });
-    }
-
-    /// Save As, step one: show the browser's save dialog (call in the click). The answer is the
-    /// engine path the design is saved to, `None` when the dialog was closed.
-    pub fn pick_save(files: &Rc<Files>, name: &str) -> impl std::future::Future<Output = Option<String>> + use<> {
-        let promise = start_picker("showSaveFilePicker", &save_options(name));
-        let files = files.clone();
-        async move {
-            let handle = match promise {
-                Ok(p) => JsFuture::from(p)
-                    .await
-                    .map_err(failed)
-                    .and_then(|h| h.dyn_into::<FileSystemFileHandle>().map_err(|_| Pick::Failed("not a file".into()))),
-                Err(e) => Err(e),
-            };
-            match handle {
-                Ok(h) => Some(register(&h)),
-                Err(Pick::Cancelled) => None,
-                Err(Pick::Failed(e)) => {
-                    files.say(format!("save: {e}"), true);
-                    None
-                }
-            }
-        }
-    }
-
-    /// Open, step one: show the browser's open dialog for a design (call in the click). The
-    /// answer is the engine path of the file, read into the engine's files; a design keeps its
-    /// handle, so Save writes back to the file. `None`: closed, or it could not be read.
-    pub fn pick_open(files: &Rc<Files>) -> impl std::future::Future<Output = Option<String>> + use<> {
-        let promise = start_picker("showOpenFilePicker", &open_options());
-        let files = files.clone();
-        async move {
-            let r = async {
-                let p = promise?;
-                let handles: Array = JsFuture::from(p).await.map_err(failed)?.dyn_into().map_err(|_| Pick::Failed("no file".into()))?;
-                let h: FileSystemFileHandle = handles.get(0).dyn_into().map_err(|_| Pick::Cancelled)?;
-                let bytes = read_handle(&h).await.map_err(Pick::Failed)?;
-                Ok((h, bytes))
-            };
-            match r.await {
-                Ok((h, bytes)) => Some(arrive(&h, bytes)),
-                Err(Pick::Cancelled) => None,
-                Err(Pick::Failed(e)) => {
-                    files.say(format!("open: {e}"), true);
-                    None
-                }
-            }
-        }
-    }
-
-    /// The options of the open dialog: a single file, designs and CAD files listed first.
-    pub fn open_options() -> Object {
-        let options = Object::new();
-        let _ = Reflect::set(&options, &"multiple".into(), &JsValue::FALSE);
-        let extensions = Array::new();
-        let designs = solidcraft_engine::io::DESIGN_EXTS.iter().map(|e| format!(".{e}"));
-        let others = [".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm", ".dxf", ".svg"].map(String::from);
-        for e in designs.chain(others) {
-            extensions.push(&e.into());
-        }
-        let accept = Object::new();
-        let _ = Reflect::set(&accept, &"application/octet-stream".into(), &extensions);
-        let entry = Object::new();
-        let _ = Reflect::set(&entry, &"description".into(), &"Designs and CAD files".into());
-        let _ = Reflect::set(&entry, &"accept".into(), &accept);
-        let _ = Reflect::set(&options, &"types".into(), &Array::of1(&entry));
-        options
-    }
-
-    /// A file read from a dialog's handle: a design lives at its disk path from now on (and
-    /// keeps the handle); anything else is an upload to open or insert.
-    pub fn arrive(handle: &FileSystemFileHandle, bytes: Vec<u8>) -> String {
-        let name = handle.name();
-        let p = if solidcraft_engine::io::is_design_path(&name) { register(handle) } else { format!("{}{name}", crate::files::UPLOAD) };
-        vfs::insert(&p, bytes);
-        p
-    }
-
-    // ---- writing ------------------------------------------------------------------------
-
-    /// Queue what a command wrote to a disk path. Writes go one at a time; a newer write of the
-    /// same file replaces one still waiting.
-    pub fn enqueue(files: &Rc<Files>, path: &str, bytes: Vec<u8>) {
-        QUEUE.with(|q| {
-            let mut q = q.borrow_mut();
-            q.retain(|(p, _)| p != path);
-            q.push_back((path.to_string(), bytes));
-        });
-        if BUSY.with(|b| b.replace(true)) {
-            return;
-        }
-        let files = files.clone();
-        spawn_local(async move {
-            while let Some((path, bytes)) = QUEUE.with(|q| q.borrow_mut().pop_front()) {
-                if let Err(e) = write(&path, &bytes).await {
-                    files.failed_disk(&path, &e);
-                }
-            }
-            BUSY.with(|b| b.set(false));
-        });
-    }
-
-    async fn write(path: &str, bytes: &[u8]) -> Result<(), String> {
-        let (id, name) = parse(path).ok_or("not a file on the computer")?;
-        let handle = handle_for(id).await.map_err(|e| format!("{name}: {e}"))?;
-        write_handle(&handle, bytes).await.map_err(|e| format!("{name}: {e}"))
-    }
-
-    async fn write_handle(handle: &FileSystemFileHandle, bytes: &[u8]) -> Result<(), String> {
-        ensure_readwrite(handle).await?;
-        let w: web_sys::FileSystemWritableFileStream =
-            JsFuture::from(handle.create_writable()).await.map_err(err)?.dyn_into().map_err(|_| "no writable stream".to_string())?;
-        JsFuture::from(w.write_with_u8_array(bytes).map_err(err)?).await.map_err(err)?;
-        JsFuture::from(w.close()).await.map_err(err)?;
-        Ok(())
-    }
-
-    async fn handle_for(id: &str) -> Result<FileSystemFileHandle, String> {
-        if let Some(h) = HANDLES.with(|h| h.borrow().get(id).cloned()) {
-            return Ok(h);
-        }
-        let h: FileSystemFileHandle = recall(id)
-            .await?
-            .and_then(|v| v.dyn_into().ok())
-            .ok_or("the browser no longer remembers where this design was saved: use Save As to choose the file again")?;
-        HANDLES.with(|m| m.borrow_mut().insert(id.to_string(), h.clone()));
-        Ok(h)
-    }
-
-    /// Ask for write access if the browser doesn't hold it any more (after a reload): one prompt,
-    /// from the click that asked for the save.
-    async fn ensure_readwrite(handle: &FileSystemFileHandle) -> Result<(), String> {
-        let options = Object::new();
-        let _ = Reflect::set(&options, &"mode".into(), &"readwrite".into());
-        for method in ["queryPermission", "requestPermission"] {
-            let Some(f) = Reflect::get(handle, &method.into()).ok().and_then(|f| f.dyn_into::<Function>().ok()) else {
-                // A browser without the permission calls hands out writable handles as they are.
-                return Ok(());
-            };
-            let answer = f.call1(handle, &options).map_err(err)?;
-            let state = JsFuture::from(Promise::resolve(&answer)).await.map_err(err)?;
-            if state.as_string().as_deref() == Some("granted") {
-                return Ok(());
-            }
-        }
-        Err("the browser wasn't given permission to write the file: use Save As to choose it again".into())
-    }
-
-    // ---- IndexedDB: the handles, by id --------------------------------------------------
-
-    /// The result of an IndexedDB request.
-    async fn result(req: &IdbRequest) -> Result<JsValue, String> {
-        let promise = Promise::new(&mut |resolve, reject| {
-            let r = req.clone();
-            let ok = Closure::once_into_js(move || {
-                let _ = resolve.call1(&JsValue::NULL, &r.result().unwrap_or(JsValue::UNDEFINED));
-            });
-            let bad = Closure::once_into_js(move || {
-                let _ = reject.call1(&JsValue::NULL, &"IndexedDB failed".into());
-            });
-            req.set_onsuccess(Some(ok.unchecked_ref()));
-            req.set_onerror(Some(bad.unchecked_ref()));
-        });
-        JsFuture::from(promise).await.map_err(err)
-    }
-
-    async fn open_db() -> Result<IdbDatabase, String> {
-        let factory = web_sys::window().ok_or("no window")?.indexed_db().map_err(err)?.ok_or("this browser has no IndexedDB")?;
-        let request: IdbOpenDbRequest = factory.open_with_u32(&crate::channel::key(DB), 1).map_err(err)?;
-        let target = request.clone();
-        let upgrade = Closure::once_into_js(move || {
-            if let Ok(db) = target.result().and_then(|r| r.dyn_into::<IdbDatabase>()) {
-                let _ = db.create_object_store(STORE);
-            }
-        });
-        request.set_onupgradeneeded(Some(upgrade.unchecked_ref()));
-        result(&request).await?.dyn_into().map_err(|_| "no database".to_string())
-    }
-
-    fn store(db: &IdbDatabase, mode: IdbTransactionMode) -> Result<IdbObjectStore, String> {
-        db.transaction_with_str_and_mode(STORE, mode).map_err(err)?.object_store(STORE).map_err(err)
-    }
-
-    /// Key of the time a handle was last used (the handle's own key is its id).
-    fn stamp_key(id: &str) -> String {
-        format!("at:{id}")
-    }
-
-    async fn remember(id: &str, handle: &FileSystemFileHandle) -> Result<(), String> {
-        let db = open_db().await?;
-        let store = store(&db, IdbTransactionMode::Readwrite)?;
-        result(&store.put_with_key(handle, &id.into()).map_err(err)?).await?;
-        result(&store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into()).map_err(err)?).await.map(|_| ())
-    }
-
-    /// Note that the file was used now.
-    async fn touch(id: &str) {
-        let Ok(db) = open_db().await else { return };
-        if let Ok(store) = store(&db, IdbTransactionMode::Readwrite)
-            && let Ok(req) = store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into())
-        {
-            let _ = result(&req).await;
-        }
-    }
-
-    /// The ids of every remembered file.
-    pub async fn known_ids() -> Result<Vec<String>, String> {
-        let db = open_db().await?;
-        let req = store(&db, IdbTransactionMode::Readonly)?.get_all_keys().map_err(err)?;
-        let keys: Array = result(&req).await?.dyn_into().map_err(|_| "no keys".to_string())?;
-        Ok(keys.iter().filter_map(|k| k.as_string()).filter(|k| !k.starts_with("at:")).collect())
-    }
-
-    async fn forget(ids: &[String]) -> Result<(), String> {
-        let db = open_db().await?;
-        let store = store(&db, IdbTransactionMode::Readwrite)?;
-        for id in ids {
-            result(&store.delete(&id.as_str().into()).map_err(err)?).await?;
-            result(&store.delete(&stamp_key(id).into()).map_err(err)?).await?;
-            HANDLES.with(|h| h.borrow_mut().remove(id));
-        }
-        Ok(())
-    }
-
-    /// Forget the remembered files nothing refers to any more (`keep`: the ids the recent designs
-    /// and the autosave name), once they have gone unused for a long while.
-    pub fn prune(keep: std::collections::HashSet<String>) {
-        spawn_local(async move {
-            let r = async {
-                // A transaction ends when the page awaits anything but its own requests, so each
-                // step opens its own.
-                let known = known_ids().await?;
-                let db = open_db().await?;
-                let reading = store(&db, IdbTransactionMode::Readonly)?;
-                let mut ids = Vec::new();
-                for id in known {
-                    let at = result(&reading.get(&stamp_key(&id).into()).map_err(err)?).await?.as_f64();
-                    ids.push((id, at));
-                }
-                let plan = plan_prune(&ids, &keep, js_sys::Date::now(), HANDLE_MAX_AGE_MS);
-                for id in &plan.stamp {
-                    touch(id).await;
-                }
-                forget(&plan.delete).await
-            };
-            if let Err(e) = r.await {
-                log::warn!("remembered files weren't tidied: {e}");
-            }
-        });
-    }
-
-    /// Open a design remembered from an earlier session (a recent one, after a reload): ask once
-    /// for access to the file (call in the click), read it into the engine's files and queue it
-    /// to open. A file that is gone is forgotten and dropped from the recent designs.
-    pub fn restore(files: &Rc<Files>, path: &str, on_opened: Option<Box<dyn FnOnce()>>) {
-        let Some((id, name)) = parse(path) else { return };
-        let (files, path, id, name) = (files.clone(), path.to_string(), id.to_string(), name.to_string());
-        spawn_local(async move {
-            let r = async {
-                let handle = handle_for(&id).await?;
-                ensure_readwrite(&handle).await?;
-                read_handle(&handle).await
-            };
-            match r.await {
-                Ok(bytes) => {
-                    vfs::insert(&path, bytes);
-                    files.opened.borrow_mut().push(path);
-                    files.wake();
-                    touch(&id).await;
-                    if let Some(done) = on_opened {
-                        done();
-                    }
-                }
-                Err(e) => {
-                    let gone = e.contains("NotFoundError") || e.contains("could not be found") || e.contains("no longer remembers");
-                    if gone {
-                        let _ = forget(std::slice::from_ref(&id)).await;
-                        files.disk_known.borrow_mut().remove(&id);
-                        files.gone.borrow_mut().push(path);
-                        files.say(format!("{name} isn't where it was saved any more"), true);
-                    } else {
-                        files.say(format!("{name}: {e}"), true);
-                    }
-                }
-            }
-        });
-    }
-
-    async fn recall(id: &str) -> Result<Option<JsValue>, String> {
-        let db = open_db().await?;
-        let req = store(&db, IdbTransactionMode::Readonly)?.get(&id.into()).map_err(err)?;
-        Ok(Some(result(&req).await?).filter(|v| !v.is_undefined()))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_disk_path_round_trips_its_handle_id_and_name() {
-        let p = path("18f-2a", "Bracket v2.solidcraft");
-        assert_eq!(p, "/disk/18f-2a/Bracket v2.solidcraft");
-        assert_eq!(parse(&p), Some(("18f-2a", "Bracket v2.solidcraft")));
-    }
-
-    #[test]
-    fn only_disk_paths_parse() {
-        for not in [
-            "/opfs/a.solidcraft",
-            "/downloads/a.step",
-            "/upload/a.step",
-            "/disk/",
-            "/disk/id",
-            "/disk/id/",
-            "/disk//a",
-            "/disk/id/x/y",
-            "a.solidcraft",
-        ] {
-            assert_eq!(parse(not), None, "{not}");
-        }
-    }
-
-    /// Designs already stored in OPFS (and the recovery files) keep saving to OPFS under their own
-    /// names, whether or not the browser can write to the disk.
-    #[test]
-    fn writes_to_opfs_paths_still_go_to_opfs() {
-        for p in
-            ["/opfs/Bracket.solidcraft", "/opfs/Bracket (2).solidcraft", "/opfs/recovery.solidcraft", "/opfs/recovery.json", "/opfs/old.solvecraft"]
-        {
-            assert_eq!(route(p), WriteTo::Opfs, "{p}");
-        }
-        // A design opened from OPFS saves to its own path; only a Save As can pick the disk.
-        assert_eq!(save_target(false, true), SaveTarget::Browser);
-        assert_eq!(route(&format!("{OPFS_PREFIX}Bracket.solidcraft")), WriteTo::Opfs);
-        assert_eq!(route("/disk/18f-2a/Bracket.solidcraft"), WriteTo::Disk);
-        assert_eq!(route("/downloads/part.step"), WriteTo::Download);
-        assert_eq!(route("/upload/part.step"), WriteTo::Memory);
-        // The temporary folder (a screenshot without a path, #7192) stays in memory.
-        assert_eq!(route(&format!("{}/solidcraft-shot.png", solidcraft_engine::io::vfs::BROWSER_TEMP)), WriteTo::Memory);
-    }
-
-    #[test]
-    fn only_unreferenced_handles_unused_for_long_are_forgotten() {
-        let keep: std::collections::HashSet<String> = ["recent".to_string()].into();
-        let day = 24.0 * 3600.0 * 1000.0;
-        let now = 1000.0 * day;
-        let ids = vec![
-            ("recent".to_string(), Some(now - 200.0 * day)),
-            ("old".to_string(), Some(now - 100.0 * day)),
-            ("fresh".to_string(), Some(now - 5.0 * day)),
-            ("unstamped".to_string(), None),
-        ];
-        let plan = plan_prune(&ids, &keep, now, HANDLE_MAX_AGE_MS);
-        assert_eq!(plan, PrunePlan { delete: vec!["old".to_string()], stamp: vec!["unstamped".to_string()] });
-        assert_eq!(plan_prune(&[], &keep, now, HANDLE_MAX_AGE_MS), PrunePlan::default());
-    }
-
-    #[test]
-    fn handle_ids_differ_by_time_and_by_chance() {
-        assert_ne!(make_id(1, 5), make_id(2, 5));
-        assert_ne!(make_id(1, 5), make_id(1, 6));
-        assert!(!make_id(0, 0).contains('/'));
-    }
-
-    /// Save As: a design goes to the disk where the browser can pick files and to the browser's
-    /// storage where it cannot (today's behaviour); an export is a download either way.
-    #[test]
-    fn save_as_chooses_between_the_disk_the_browsers_storage_and_a_download() {
-        assert_eq!(save_target(true, true), SaveTarget::Disk);
-        assert_eq!(save_target(false, true), SaveTarget::Browser);
-        assert_eq!(save_target(true, false), SaveTarget::Download);
-        assert_eq!(save_target(false, false), SaveTarget::Download);
-    }
-
-    #[test]
-    fn only_design_opens_use_the_disk_dialog() {
-        assert!(opens_design(&[]));
-        assert!(opens_design(&["sc"]));
-        assert!(opens_design(&["solidcraft"]));
-        assert!(opens_design(&["solvecraft"]));
-        assert!(!opens_design(&["step", "stp"]));
-        assert!(!opens_design(&["json"]));
-    }
-
-    /// Insert DXF or SVG, images and other non-design files get a file input that offers their
-    /// types in every browser (#2052); designs keep the disk dialog or the browser's files.
-    #[test]
-    fn opens_of_other_files_use_a_file_input_for_their_types() {
-        assert_eq!(open_route(true, &["dxf"]), OpenRoute::Upload);
-        assert_eq!(open_route(false, &["png", "jpg", "jpeg"]), OpenRoute::Upload);
-        assert_eq!(open_route(true, &[]), OpenRoute::Disk);
-        assert_eq!(open_route(false, &["solidcraft"]), OpenRoute::Panel);
-        assert_eq!(accept_list(&["dxf"]), ".dxf");
-        assert_eq!(accept_list(&["png", ".JPG", "", "jpeg"]), ".png,.jpg,.jpeg");
-        assert_eq!(accept_list(&[]), "");
-        assert!(upload_limit(&["png", "jpg", "jpeg"]).is_some());
-        assert_eq!(upload_limit(&["dxf"]), None);
-    }
-
-    /// An iPhone or iPad greys out a `.solidcraft` design the `accept` list names, as it knows no
-    /// type for that extension, so its inputs offer every file; other devices keep the list (#6977).
-    #[test]
-    fn file_inputs_on_an_iphone_or_ipad_offer_every_file() {
-        let iphone =
-            "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1";
-        let mac = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15";
-        let chrome_ios = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/138.0.7204.156 Mobile/15E148 Safari/604.1";
-        let chrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36";
-        assert!(apple_touch(iphone, 5));
-        assert!(apple_touch(chrome_ios, 5), "every browser on iOS has the same picker");
-        assert!(apple_touch(mac, 5), "an iPad presents itself as a Mac");
-        assert!(!apple_touch(mac, 0), "a Mac has no touch screen");
-        assert!(!apple_touch(chrome, 10), "a touch screen elsewhere filters as before");
-        assert!(!apple_touch("", 0), "hostile input is just not an iPhone");
-        let designs = ["solidcraft", "json", "step"];
-        assert_eq!(input_accept(&designs, true), "");
-        assert_eq!(input_accept(&designs, false), ".solidcraft,.json,.step");
-    }
-
-    #[test]
-    fn the_save_dialog_offers_the_type_of_the_name() {
-        assert_eq!(save_type("Plate.sc").2, ".sc");
-        assert_eq!(save_type("Plate.JSON").2, ".json");
-        assert_eq!(save_type("Plate").2, ".sc");
-        // A design opened under an older extension keeps it.
-        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
-    }
-
-    #[test]
-    fn closing_a_dialog_is_not_an_error() {
-        assert!(is_abort("AbortError"));
-        assert!(!is_abort("NotAllowedError"));
-        assert!(!is_abort("SecurityError"));
-    }
-}

apps/solidcraft-web/src/easyprint.rs

@@ -1,40 +0,0 @@
-//! Open with EasyPrint in the browser: upload the model to Printables' import endpoint with
-//! `fetch` (it allows any origin) and answer with the address to open.
-
-use std::sync::mpsc::Sender;
-
-use js_sys::{Array, Uint8Array};
-use solidcraft_engine::easyprint::{IMPORT_URL, parse_import_response};
-use wasm_bindgen::JsCast as _;
-use wasm_bindgen_futures::{JsFuture, spawn_local};
-
-use crate::files::err;
-
-/// Start the upload; the answer arrives on `done`.
-pub fn upload(name: &str, bytes: Vec<u8>, done: Sender<Result<String, String>>) {
-    let name = name.to_string();
-    spawn_local(async move {
-        let _ = done.send(post(&name, &bytes).await);
-    });
-}
-
-async fn post(name: &str, bytes: &[u8]) -> Result<String, String> {
-    let window = web_sys::window().ok_or("no window")?;
-    let parts = Array::new();
-    parts.push(&Uint8Array::from(bytes));
-    let blob = web_sys::Blob::new_with_u8_array_sequence(&parts).map_err(err)?;
-    let form = web_sys::FormData::new().map_err(err)?;
-    form.append_with_blob_and_filename("file", &blob, name).map_err(err)?;
-    form.append_with_str("file_name", name).map_err(err)?;
-    let headers = web_sys::Headers::new().map_err(err)?;
-    headers.set("Accept", "application/json").map_err(err)?;
-    let init = web_sys::RequestInit::new();
-    init.set_method("POST");
-    init.set_body(&form);
-    init.set_headers(&headers);
-    let response = JsFuture::from(window.fetch_with_str_and_init(IMPORT_URL, &init)).await.map_err(err)?;
-    let response: web_sys::Response = response.dyn_into().map_err(|_| "response cast failed".to_string())?;
-    let status = response.status();
-    let text = JsFuture::from(response.text().map_err(err)?).await.map_err(err)?;
-    parse_import_response(status, text.as_string().unwrap_or_default().as_bytes())
-}

apps/solidcraft-web/src/files.rs

@@ -2,38 +2,29 @@
 //! the engine's in-memory files (`solidcraft_engine::io::vfs`) at start, written back whenever a
 //! command writes one. Files come in from the computer through a file picker (the File System
 //! Access API where the browser has it, an `<input type=file>` otherwise) or a drop on the page,
-//! and go out as downloads (exports, and "Download design"). Where the File System Access API
-//! exists a design also lives on the computer's disk, saved and opened through the browser's file
-//! dialogs (`disk.rs`). An autosave of unsaved work is kept in OPFS and offered again after a
-//! reload or a crash. With "keep unsaved work in this browser" on, each open design's unsaved
-//! changes are kept there instead, one copy per design (`keep.rs`, #10220).
+//! and go out as downloads (exports, and "Download design"). An autosave of unsaved work is kept
+//! in OPFS too and offered again after a reload or a crash.
 
 use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 
 use js_sys::{Array, Function, Object, Reflect, Uint8Array};
 use solidcraft_engine::io::vfs;
-
-use crate::{disk, keep};
 use wasm_bindgen::{JsCast as _, JsValue, closure::Closure};
 use wasm_bindgen_futures::{JsFuture, spawn_local};
-use web_sys::{
-    FileSystemDirectoryHandle, FileSystemFileHandle, FileSystemGetDirectoryOptions, FileSystemGetFileOptions, FileSystemWritableFileStream,
-};
+use web_sys::{FileSystemDirectoryHandle, FileSystemFileHandle, FileSystemGetFileOptions, FileSystemWritableFileStream};
 
 /// Where OPFS files appear to the engine.
-pub const OPFS: &str = disk::OPFS_PREFIX;
+pub const OPFS: &str = "/opfs/";
 /// Paths written here are handed to the user as downloads.
-pub const DOWNLOADS: &str = disk::DOWNLOADS_PREFIX;
+pub const DOWNLOADS: &str = "/downloads/";
 /// Files brought in from the computer.
 pub const UPLOAD: &str = "/upload/";
-/// The autosave of unsaved work (in OPFS: `recovery.sc` and `recovery.json`), named with
-/// `solidcraft_engine::io::DESIGN_EXT`.
-const RECOVERY: &str = "recovery.sc";
-/// The autosaves earlier releases kept, newest first, one per entry of
-/// `solidcraft_engine::io::LEGACY_DESIGN_EXTS` (compatibility shim, docs/compatibility.md): the
-/// newest is recovered when there is no current one.
-const LEGACY_RECOVERY: [&str; 2] = ["recovery.solidcraft", "recovery.solvecraft"];
+/// The autosave of unsaved work (in OPFS: `recovery.solidcraft` and `recovery.json`).
+const RECOVERY: &str = "recovery.solidcraft";
+/// The autosave earlier releases kept (compatibility shim, docs/compatibility.md): recovered
+/// when there is no current one.
+const LEGACY_RECOVERY: &str = "recovery.solvecraft";
 const RECOVERY_META: &str = "recovery.json";
 
 /// What to do with a file brought in from the computer.
@@ -43,8 +34,6 @@ pub enum Intent {
     Open,
     /// Add its bodies to the open design (STEP, 3MF, STL).
     Insert,
-    /// Import it as a theme: it was dropped on Preferences' Import tile (#8226).
-    Theme,
 }
 
 /// A stored design, as the file panel lists it.
@@ -62,14 +51,6 @@ pub struct Files {
     pub entries: RefCell<Vec<Entry>>,
     /// Files read from the computer: (name, bytes, what to do).
     pub incoming: RefCell<Vec<(String, Vec<u8>, Intent)>>,
-    /// Designs opened from the computer's disk: their paths in the engine's files.
-    pub opened: RefCell<Vec<String>>,
-    /// The ids of the files remembered from earlier sessions (see `disk::restore`).
-    pub disk_known: RefCell<std::collections::HashSet<String>>,
-    /// Recent designs whose file is gone: to drop from the recent list.
-    pub gone: RefCell<Vec<String>>,
-    /// Disk designs whose last write failed: they are not saved.
-    pub unsaved: RefCell<Vec<String>>,
     /// Messages for the status line (errors and confirmations).
     pub messages: RefCell<Vec<(String, bool)>>,
     /// The stored designs are loaded (the app may open them).
@@ -80,30 +61,14 @@ pub struct Files {
     pub recovery: RefCell<Option<(String, Option<String>)>>,
     /// The app's context, to wake it when a browser call finishes.
     pub ctx: RefCell<Option<egui::Context>>,
-    /// This page's id: the copies it keeps are named after it (`keep::entry_id`).
-    pub keep_page: RefCell<String>,
-    /// Kept copies stored by this page, and the design revision each holds once its write ended.
-    pub kept: RefCell<std::collections::HashMap<String, Option<u64>>>,
-    /// Kept copies being written or removed now (one browser call at a time per copy).
-    pub keeping: RefCell<std::collections::HashSet<String>>,
-    /// When (ms) the last write of a copy failed, to wait before trying again (`keep::may_write`).
-    pub kept_failed: RefCell<std::collections::HashMap<String, f64>>,
-    /// Copies earlier pages left, newer than their design's last save: offered at start.
-    pub keep_offered: RefCell<Vec<keep::Entry>>,
 }
 
 impl Files {
-    pub fn say(&self, text: impl Into<String>, error: bool) {
+    fn say(&self, text: impl Into<String>, error: bool) {
         self.messages.borrow_mut().push((text.into(), error));
         self.wake();
     }
 
-    /// Writing the design at disk `path` failed: say so, and take its "saved" back.
-    pub fn failed_disk(&self, path: &str, error: &str) {
-        self.unsaved.borrow_mut().push(path.to_string());
-        self.say(format!("Not saved to your computer: {error}"), true);
-    }
-
     /// A file arrived from the computer.
     fn arrive(&self, name: String, bytes: Vec<u8>, intent: Intent) {
         self.incoming.borrow_mut().push((name, bytes, intent));
@@ -111,7 +76,7 @@ impl Files {
     }
 
     /// Run a frame (the app sleeps until something happens).
-    pub fn wake(&self) {
+    fn wake(&self) {
         if let Some(c) = self.ctx.borrow().as_ref() {
             c.request_repaint();
         }
@@ -124,7 +89,7 @@ thread_local! {
     static LOCAL: Cell<bool> = const { Cell::new(false) };
 }
 
-/// Local storage keys of stored files (under the channel's name, see `channel.rs`).
+/// Local storage keys of stored files.
 const LOCAL_PREFIX: &str = "solidcraft.file.";
 /// Local-storage files kept by earlier releases (compatibility shim, docs/compatibility.md):
 /// still listed and opened; removing one removes either key.
@@ -162,7 +127,7 @@ pub fn local_only() -> bool {
     LOCAL.with(Cell::get)
 }
 
-pub(crate) fn err(e: JsValue) -> String {
+fn err(e: JsValue) -> String {
     e.as_string().or_else(|| Reflect::get(&e, &"message".into()).ok().and_then(|m| m.as_string())).unwrap_or_else(|| format!("{e:?}"))
 }
 
@@ -182,20 +147,10 @@ fn has(sm: &web_sys::StorageManager, method: &str) -> bool {
 async fn root() -> Result<FileSystemDirectoryHandle, String> {
     let sm = storage_manager().filter(|sm| has(sm, "getDirectory")).ok_or("this page has no private file storage (it needs https or localhost)")?;
     let dir = JsFuture::from(sm.get_directory()).await.map_err(err)?;
-    let dir = dir.dyn_into::<FileSystemDirectoryHandle>().map_err(|_| "this browser has no private file storage (OPFS)".to_string())?;
-    // Stable keeps its files in the root, where they have always been; a pre-release channel has a folder of its own.
-    match crate::channel::current() {
-        "" => Ok(dir),
-        channel => {
-            let opts = FileSystemGetDirectoryOptions::new();
-            opts.set_create(true);
-            let sub = JsFuture::from(dir.get_directory_handle_with_options(&format!("channel-{channel}"), &opts)).await.map_err(err)?;
-            sub.dyn_into::<FileSystemDirectoryHandle>().map_err(|_| "not a folder".to_string())
-        }
-    }
+    dir.dyn_into::<FileSystemDirectoryHandle>().map_err(|_| "this browser has no private file storage (OPFS)".to_string())
 }
 
-pub(crate) async fn read_handle(h: &FileSystemFileHandle) -> Result<Vec<u8>, String> {
+async fn read_handle(h: &FileSystemFileHandle) -> Result<Vec<u8>, String> {
     let file: web_sys::File = JsFuture::from(h.get_file()).await.map_err(err)?.dyn_into().map_err(|_| "not a file".to_string())?;
     blob_bytes(&file).await
 }
@@ -214,7 +169,7 @@ async fn file_handle(dir: &FileSystemDirectoryHandle, name: &str, create: bool)
 async fn write_file(name: &str, bytes: &[u8]) -> Result<(), String> {
     if local_only() {
         return local()?
-            .set_item(&crate::channel::key(&format!("{LOCAL_PREFIX}{name}")), &encode(bytes))
+            .set_item(&format!("{LOCAL_PREFIX}{name}"), &encode(bytes))
             .map_err(|e| format!("local storage is full or blocked: {}", err(e)));
     }
     let dir = root().await?;
@@ -230,7 +185,7 @@ async fn remove_file(name: &str) -> Result<(), String> {
     if local_only() {
         let st = local()?;
         st.remove_item(&format!("{LEGACY_LOCAL_PREFIX}{name}")).map_err(err)?;
-        return st.remove_item(&crate::channel::key(&format!("{LOCAL_PREFIX}{name}"))).map_err(err);
+        return st.remove_item(&format!("{LOCAL_PREFIX}{name}")).map_err(err);
     }
     let dir = root().await?;
     JsFuture::from(dir.remove_entry(name)).await.map_err(err)?;
@@ -243,10 +198,7 @@ fn read_local() -> Result<Vec<(String, Vec<u8>, f64)>, String> {
     let mut out = Vec::new();
     for i in 0..st.length().unwrap_or(0).min(10_000) {
         let Some(k) = st.key(i).ok().flatten() else { continue };
-        let own = crate::channel::key(LOCAL_PREFIX);
-        // The old names belong to stable; a pre-release channel has none.
-        let legacy = crate::channel::current().is_empty().then_some(LEGACY_LOCAL_PREFIX);
-        let Some(name) = k.strip_prefix(own.as_str()).or_else(|| legacy.and_then(|l| k.strip_prefix(l))) else { continue };
+        let Some(name) = k.strip_prefix(LOCAL_PREFIX).or_else(|| k.strip_prefix(LEGACY_LOCAL_PREFIX)) else { continue };
         if let Some(v) = st.get_item(&k).ok().flatten() {
             out.push((name.to_string(), decode(&v), 0.0));
         }
@@ -299,27 +251,18 @@ pub fn start(files: &Rc<Files>) {
             let _ = JsFuture::from(p).await;
         });
     }
-    let page = keep::page_id(js_sys::Date::now(), js_sys::Math::random());
-    hold_page_lock(&page);
-    *files.keep_page.borrow_mut() = page;
     let files = files.clone();
     spawn_local(async move {
-        match disk::known_ids().await {
-            Ok(ids) => files.disk_known.borrow_mut().extend(ids),
-            Err(e) => log::info!("no remembered files: {e}"),
-        }
         match read_all().await {
             Ok(all) => {
                 if local_only() {
                     files.say("This page can't use the browser's file storage (it needs https or localhost): designs are kept in local storage, a few MB at most.", false);
                 }
                 let mut entries = Vec::new();
-                let kept = kept_copies(&all);
                 let has_recovery = all.iter().any(|(n, _, _)| n == RECOVERY);
-                let legacy = (!has_recovery).then(|| LEGACY_RECOVERY.into_iter().find(|l| all.iter().any(|(n, _, _)| n == l))).flatten();
                 for (name, bytes, modified) in all {
-                    if LEGACY_RECOVERY.contains(&name.as_str()) {
-                        if legacy == Some(name.as_str()) {
+                    if name == LEGACY_RECOVERY {
+                        if !has_recovery {
                             vfs::insert(&format!("{OPFS}{RECOVERY}"), bytes);
                         }
                         continue;
@@ -330,7 +273,7 @@ pub fn start(files: &Rc<Files>) {
                         *files.recovery.borrow_mut() = Some((n, meta["path"].as_str().map(str::to_string)));
                         continue;
                     }
-                    if name != RECOVERY && keep::parse_name(&name).is_none() {
+                    if name != RECOVERY {
                         entries.push(Entry { name: name.clone(), size: bytes.len() as u64, modified });
                     }
                     vfs::insert(&format!("{OPFS}{name}"), bytes);
@@ -341,7 +284,6 @@ pub fn start(files: &Rc<Files>) {
                 if !vfs::exists(&format!("{OPFS}{RECOVERY}")) {
                     *files.recovery.borrow_mut() = None;
                 }
-                sort_kept(&files, kept, &live_pages().await);
             }
             Err(e) => files.say(format!("browser storage: {e}"), true),
         }
@@ -353,32 +295,26 @@ pub fn start(files: &Rc<Files>) {
 /// Store what commands wrote: OPFS paths into OPFS, download paths as downloads.
 pub fn flush(files: &Rc<Files>) {
     for (path, bytes) in vfs::take_writes() {
-        match disk::route(&path) {
-            disk::WriteTo::Opfs => {
-                let name = path.strip_prefix(OPFS).unwrap_or(&path).to_string();
-                {
-                    let mut e = files.entries.borrow_mut();
-                    e.retain(|x| x.name != name);
-                    if name != RECOVERY && name != RECOVERY_META && keep::parse_name(&name).is_none() {
-                        e.push(Entry { name: name.clone(), size: bytes.len() as u64, modified: js_sys::Date::now() });
-                        e.sort_by_key(|a| a.name.to_lowercase());
-                    }
+        if let Some(name) = path.strip_prefix(OPFS) {
+            let name = name.to_string();
+            {
+                let mut e = files.entries.borrow_mut();
+                e.retain(|x| x.name != name);
+                if name != RECOVERY && name != RECOVERY_META {
+                    e.push(Entry { name: name.clone(), size: bytes.len() as u64, modified: js_sys::Date::now() });
+                    e.sort_by_key(|a| a.name.to_lowercase());
                 }
-                let files = files.clone();
-                spawn_local(async move {
-                    if let Err(e) = write_file(&name, &bytes).await {
-                        files.say(format!("{name}: {e}"), true);
-                    }
-                });
             }
-            disk::WriteTo::Disk => disk::enqueue(files, &path, bytes),
-            disk::WriteTo::Download => {
-                let name = path.strip_prefix(DOWNLOADS).unwrap_or(&path);
-                if let Err(e) = download(name, &bytes) {
+            let files = files.clone();
+            spawn_local(async move {
+                if let Err(e) = write_file(&name, &bytes).await {
                     files.say(format!("{name}: {e}"), true);
                 }
-            }
-            disk::WriteTo::Memory => {}
+            });
+        } else if let Some(name) = path.strip_prefix(DOWNLOADS)
+            && let Err(e) = download(name, &bytes)
+        {
+            files.say(format!("{name}: {e}"), true);
         }
     }
 }
@@ -460,9 +396,7 @@ pub fn autosave(files: &Rc<Files>, doc: Option<(&solidcraft_engine::doc::Documen
         }
         None => spawn_local(async move {
             let _ = remove_file(RECOVERY).await;
-            for legacy in LEGACY_RECOVERY {
-                let _ = remove_file(legacy).await;
-            }
+            let _ = remove_file(LEGACY_RECOVERY).await;
             let _ = remove_file(RECOVERY_META).await;
         }),
     }
@@ -486,26 +420,6 @@ pub fn recovery_path() -> String {
     format!("{OPFS}{RECOVERY}")
 }
 
-/// A recovery file lives in OPFS, but its relative links belong to the original design's
-/// folder (which can be on disk). Resolve them before Open sees the temporary file location.
-pub fn prepare_recovery(original_path: Option<&str>) -> Result<String, String> {
-    prepare_copy(recovery_path(), original_path)
-}
-
-/// The same for a kept copy (#10220).
-pub fn prepare_kept(id: &str, original_path: Option<&str>) -> Result<String, String> {
-    prepare_copy(format!("{OPFS}{}", keep::design_file(id)), original_path)
-}
-
-fn prepare_copy(path: String, original_path: Option<&str>) -> Result<String, String> {
-    let bytes = vfs::read(&path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
-    let mut doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?;
-    solidcraft_engine::resolve_design_links(&mut doc, original_path);
-    let bytes = solidcraft_engine::io::write_design_container(&doc).map_err(|e| e.to_string())?;
-    vfs::insert(&path, bytes);
-    Ok(path)
-}
-
 /// Pick files on the computer: the File System Access picker where there is one, else an
 /// `<input type=file>`. Read files arrive in `files.incoming`.
 pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
@@ -513,15 +427,8 @@ pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
     let picker = Reflect::get(&window, &"showOpenFilePicker".into()).ok().and_then(|f| f.dyn_into::<Function>().ok());
     match picker {
         Some(f) => {
-            // A design from the computer's disk keeps its file, so Save writes back to it.
-            let on_disk = intent == Intent::Open && disk::supported();
-            let opts = if on_disk {
-                disk::open_options()
-            } else {
-                let opts = Object::new();
-                let _ = Reflect::set(&opts, &"multiple".into(), &JsValue::FALSE);
-                opts
-            };
+            let opts = Object::new();
+            let _ = Reflect::set(&opts, &"multiple".into(), &JsValue::FALSE);
             let promise = f.call1(&window, &opts);
             let files = files.clone();
             spawn_local(async move {
@@ -531,13 +438,7 @@ pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
                     for h in handles.iter() {
                         let h: FileSystemFileHandle = h.dyn_into().map_err(|_| "not a file".to_string())?;
                         let bytes = read_handle(&h).await?;
-                        if on_disk && solidcraft_engine::io::is_design_path(&h.name()) {
-                            let path = disk::arrive(&h, bytes);
-                            files.opened.borrow_mut().push(path);
-                            files.wake();
-                        } else {
-                            files.arrive(h.name(), bytes, intent);
-                        }
+                        files.arrive(h.name(), bytes, intent);
                     }
                     Ok::<(), String>(())
                 };
@@ -557,11 +458,7 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
     let Some(doc) = web_sys::window().and_then(|w| w.document()) else { return };
     let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
     input.set_type("file");
-    // Everything the browser build imports, from the format registry: cadmpeg is pure Rust, so
-    // FreeCAD and Rhino files are part of it; plus the DXF and SVG drawings Open and Insert take.
-    let mut extensions = solidcraft_engine::io::formats::open_extensions(true);
-    extensions.extend(["dxf", "svg"]);
-    input.set_accept(&disk::input_accept(&extensions, apple_touch()));
+    input.set_accept(".solidcraft,.solvecraft,.json,.step,.stp,.3mf,.stl");
     // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
     let _ = input.set_attribute("style", "display:none");
     if let Some(body) = doc.body() {
@@ -586,233 +483,16 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
     input.click();
 }
 
-/// Ask for one file of these types (`extensions`, e.g. `["dxf"]`) with a plain file input, the
-/// dialog every browser has. The answer is the file's path in the engine's files (under
-/// [`UPLOAD`], as for a file picked in the disk dialog), so the command that asked runs on it;
-/// `None` when the dialog was closed or the file could not be read.
-pub fn pick_upload(files: &Rc<Files>, extensions: &[&str]) -> impl std::future::Future<Output = Option<String>> + use<> {
-    // Shown now, in the click: a file dialog needs the user's gesture.
-    let chosen = choose_file(&disk::input_accept(extensions, apple_touch()));
-    let limit = disk::upload_limit(extensions);
-    let files = files.clone();
-    async move {
-        let read = async {
-            let value = JsFuture::from(chosen?).await.map_err(err)?;
-            // Closing the dialog answers no file: nothing to say.
-            let Ok(file) = value.dyn_into::<web_sys::File>() else { return Ok(None) };
-            let name = file.name();
-            if limit.is_some_and(|max| !file.size().is_finite() || file.size() > max as f64) {
-                return Err(format!("{name}: the file is too large"));
-            }
-            let bytes = blob_bytes(&file).await.map_err(|e| format!("{name}: {e}"))?;
-            let path = format!("{UPLOAD}{name}");
-            vfs::insert(&path, bytes);
-            Ok(Some(path))
-        };
-        match read.await {
-            Ok(path) => path,
-            Err(e) => {
-                files.say(format!("open: {e}"), true);
-                None
-            }
-        }
-    }
-}
-
-/// The page runs on an iPhone or iPad, whose file inputs offer every file (`disk::input_accept`).
-fn apple_touch() -> bool {
-    web_sys::window().is_some_and(|w| {
-        let nav = w.navigator();
-        disk::apple_touch(&nav.user_agent().unwrap_or_default(), nav.max_touch_points())
-    })
-}
-
-/// Show a hidden `<input type=file>` offering `accept` (call in the click). The promise answers
-/// the picked `File`, or `null` when the dialog is closed (the input's `cancel` event).
-fn choose_file(accept: &str) -> Result<js_sys::Promise, String> {
-    let doc = web_sys::window().and_then(|w| w.document()).ok_or("this page can't show a file dialog")?;
-    let input = doc.create_element("input").map_err(err)?.dyn_into::<web_sys::HtmlInputElement>().map_err(|_| "no file input".to_string())?;
-    input.set_type("file");
-    input.set_accept(accept);
-    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
-    input.set_attribute("style", "display:none").map_err(err)?;
-    doc.body().ok_or("this page has no body")?.append_child(&input).map_err(err)?;
-    let promise = js_sys::Promise::new(&mut |resolve: Function, _reject: Function| {
-        // One answer for a pick or a cancel; read from the event, so it does not keep the input.
-        let done = Closure::once_into_js(move |event: web_sys::Event| {
-            let file = event.target().and_then(|t| t.dyn_into::<web_sys::HtmlInputElement>().ok()).and_then(|input| {
-                input.set_onchange(None);
-                input.set_oncancel(None);
-                input.remove();
-                input.files().and_then(|list| list.get(0))
-            });
-            let _ = resolve.call1(&JsValue::UNDEFINED, &file.map_or(JsValue::NULL, JsValue::from));
-        });
-        input.set_onchange(Some(done.unchecked_ref()));
-        input.set_oncancel(Some(done.unchecked_ref()));
-    });
-    input.click();
-    Ok(promise)
-}
-
 /// Read files dropped on the page.
-/// `theme`: the pointer is over Preferences' Import tile, so the files are themes.
-pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput, theme: bool) {
-    let intent = if theme { Intent::Theme } else { Intent::Insert };
+pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput) {
     for f in std::mem::take(&mut raw.dropped_files) {
         let files = files.clone();
         spawn_local(async move {
             let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
             match f.bytes_async().await {
-                Ok(b) => files.arrive(name, b, intent),
+                Ok(b) => files.arrive(name, b, Intent::Insert),
                 Err(e) => files.say(format!("{name}: {e}"), true),
             }
         });
     }
 }
-
-/// Hold this page's browser lock while it runs, so other tabs know its kept copies are in use
-/// (`keep.rs`). Browsers without the Web Locks API hold none; their copies are then offered by
-/// any later page.
-fn hold_page_lock(page: &str) {
-    let Some(locks) = web_locks() else { return };
-    let Ok(request) = Reflect::get(&locks, &"request".into()).and_then(|f| f.dyn_into::<Function>()) else { return };
-    // A promise that never settles: the lock is let go only when the page goes.
-    let hold = Closure::<dyn FnMut(JsValue) -> js_sys::Promise>::new(|_lock: JsValue| js_sys::Promise::new(&mut |_, _| {}));
-    let name = format!("{}{page}", keep::LOCK_PREFIX);
-    if let Err(e) = request.call2(&locks, &name.into(), hold.as_ref().unchecked_ref()) {
-        log::info!("keep: no page lock: {}", err(e));
-    }
-    // The callback lives as long as the page.
-    hold.forget();
-}
-
-fn web_locks() -> Option<JsValue> {
-    let nav = web_sys::window()?.navigator();
-    Reflect::get(&nav, &"locks".into()).ok().filter(|l| l.is_object())
-}
-
-/// The pages still open (in this browser profile) that hold their lock.
-async fn live_pages() -> Vec<String> {
-    let query = async {
-        let locks = web_locks().ok_or("no Web Locks")?;
-        let f: Function = Reflect::get(&locks, &"query".into()).map_err(err)?.dyn_into().map_err(|_| "no query".to_string())?;
-        let p: js_sys::Promise = f.call0(&locks).map_err(err)?.dyn_into().map_err(|_| "no promise".to_string())?;
-        let state = JsFuture::from(p).await.map_err(err)?;
-        let held: Array = Reflect::get(&state, &"held".into()).map_err(err)?.dyn_into().map_err(|_| "no list".to_string())?;
-        Ok::<_, String>(
-            held.iter()
-                .take(10_000)
-                .filter_map(|l| Reflect::get(&l, &"name".into()).ok()?.as_string())
-                .filter_map(|n| n.strip_prefix(keep::LOCK_PREFIX).map(str::to_string))
-                .collect(),
-        )
-    };
-    query.await.unwrap_or_else(|e| {
-        log::info!("keep: open pages unknown ({e})");
-        Vec::new()
-    })
-}
-
-/// The kept copies among the stored files: (copy, when its design's file was last written), and
-/// the ids of designs stored without their metadata.
-struct Found {
-    copies: Vec<(keep::Entry, Option<f64>)>,
-    orphans: Vec<String>,
-}
-
-fn kept_copies(all: &[(String, Vec<u8>, f64)]) -> Found {
-    let modified = |path: &str| path.strip_prefix(OPFS).and_then(|n| all.iter().find(|(name, _, _)| name == n)).map(|(_, _, m)| *m);
-    let mut copies = Vec::new();
-    let mut designs = Vec::new();
-    for (name, bytes, _) in all {
-        match keep::parse_name(name) {
-            Some((id, keep::Part::Meta)) => {
-                if let Some(e) = keep::Entry::parse(id, bytes) {
-                    let saved = e.path.as_deref().and_then(modified);
-                    copies.push((e, saved));
-                }
-            }
-            Some((id, keep::Part::Design)) => designs.push(id.to_string()),
-            None => {}
-        }
-    }
-    // A copy is whole only with its design.
-    copies.retain(|(e, _)| designs.contains(&e.id));
-    let orphans = designs.into_iter().filter(|id| !copies.iter().any(|(e, _)| &e.id == id)).collect();
-    Found { copies, orphans }
-}
-
-/// Offer the copies earlier pages left that hold unsaved work, and remove those their design's
-/// later save made stale (and parts without the rest), leaving open pages' copies alone.
-fn sort_kept(files: &Rc<Files>, found: Found, live: &[String]) {
-    let mut offered = Vec::new();
-    let mut gone = Vec::new();
-    for (e, saved) in found.copies {
-        match keep::fate(&e, live, saved) {
-            keep::Fate::Offer => offered.push(e),
-            keep::Fate::Drop => gone.push(e.id),
-            keep::Fate::Leave => {}
-        }
-    }
-    gone.extend(found.orphans.into_iter().filter(|id| !keep::page_of(id).is_some_and(|p| live.iter().any(|l| l == p))));
-    keep::order_offered(&mut offered);
-    *files.keep_offered.borrow_mut() = offered;
-    for id in gone {
-        remove_kept(files, &id);
-    }
-}
-
-/// The path (in the engine's files) a kept copy opens from.
-pub fn kept_path(id: &str) -> String {
-    format!("{OPFS}{}", keep::design_file(id))
-}
-
-/// Write the copy of a design with unsaved changes (`bytes`, described by `entry`) that holds
-/// its revision `revision`. Its metadata goes last, so a copy is never offered half written.
-pub fn write_kept(files: &Rc<Files>, entry: &keep::Entry, bytes: Vec<u8>, revision: u64) {
-    let id = entry.id.clone();
-    if !files.keeping.borrow_mut().insert(id.clone()) {
-        return;
-    }
-    files.kept.borrow_mut().entry(id.clone()).or_insert(None);
-    let meta = entry.to_json();
-    let files = files.clone();
-    spawn_local(async move {
-        let r = async {
-            write_file(&keep::design_file(&id), &bytes).await?;
-            write_file(&keep::meta_file(&id), meta.as_bytes()).await
-        };
-        match r.await {
-            Ok(()) => {
-                files.kept.borrow_mut().insert(id.clone(), Some(revision));
-                files.kept_failed.borrow_mut().remove(&id);
-            }
-            Err(e) => {
-                files.kept_failed.borrow_mut().insert(id.clone(), js_sys::Date::now());
-                files.say(format!("keeping unsaved work in this browser: {e}"), true)
-            }
-        }
-        files.keeping.borrow_mut().remove(&id);
-        files.wake();
-    });
-}
-
-/// Remove kept copy `id` (its design was saved, closed, discarded or restored).
-pub fn remove_kept(files: &Rc<Files>, id: &str) {
-    let id = id.to_string();
-    if !files.keeping.borrow_mut().insert(id.clone()) {
-        return;
-    }
-    let _ = vfs::remove(&kept_path(&id));
-    files.kept_failed.borrow_mut().remove(&id);
-    let files = files.clone();
-    spawn_local(async move {
-        // The metadata first: what's left without it is never offered.
-        let _ = remove_file(&keep::meta_file(&id)).await;
-        let _ = remove_file(&keep::design_file(&id)).await;
-        files.kept.borrow_mut().remove(&id);
-        files.keeping.borrow_mut().remove(&id);
-        files.wake();
-    });
-}

apps/solidcraft-web/src/install.rs

@@ -23,9 +23,9 @@ fn prompt() {
         let _ = js_sys::Reflect::set(&window, &OFFER.into(), &JsValue::NULL);
     }
     let shown = js_sys::Reflect::get(&offer, &"prompt".into())
-        .and_then(|f| f.dyn_into::<js_sys::Function>())
+        .and_then(|f| f.dyn_into::<js_sys::Function>().map_err(JsValue::from))
         .and_then(|f| f.call0(&offer))
-        .and_then(|p| p.dyn_into::<js_sys::Promise>());
+        .and_then(|p| p.dyn_into::<js_sys::Promise>().map_err(JsValue::from));
     match shown {
         // Accepted or dismissed, the browser handles it; a refusal is only logged.
         Ok(p) => wasm_bindgen_futures::spawn_local(async move {

apps/solidcraft-web/src/keep.rs

@@ -1,403 +0,0 @@
-//! Keep unsaved work in this browser (#10220): the decisions, in plain Rust (tested natively).
-//!
-//! With Preferences › General › "Keep unsaved work in this browser instead of asking when the tab
-//! closes" on, each open design with unsaved changes has a copy in the browser's private storage:
-//! `keep-<id>.sc` (the design) and `keep-<id>.json` (its name, its file and when it last
-//! changed). The copy is written shortly after each change ([`due`]) and again when the page is
-//! hidden, so it is already current when the tab closes; the page then doesn't ask through the
-//! browser's "leave site?" box ([`asks_before_unload`]). A design that is saved, closed or
-//! discarded has its copy removed. The next visit offers the copies newer than their design's
-//! last save ([`fate`]) in SolidCraft's own window, answered with [`plan`].
-//!
-//! An id is `<page>-<n>`: the page that wrote it (each page load has its own) and the design's
-//! number in that page. A page holds a browser lock named after it while it runs, so another tab
-//! never offers, or removes, the copies of a page that is still open.
-#![cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
-
-use serde_json::{Value, json};
-
-/// The start of every kept file's name.
-pub const PREFIX: &str = "keep-";
-/// The browser lock a page holds while it runs: this, then its page id.
-pub const LOCK_PREFIX: &str = "solidcraft.keep.";
-/// A copy is written once the design has been still this long (ms)…
-pub const QUIET_MS: f64 = 800.0;
-/// …or at the latest this long after the first change it doesn't hold yet (ms).
-pub const MAX_WAIT_MS: f64 = 4000.0;
-/// The most copies offered at once (the rest wait for the next visit).
-pub const MAX_OFFERED: usize = 32;
-const MAX_ID: usize = 64;
-const MAX_NAME: usize = 256;
-const MAX_PATH: usize = 4096;
-/// Copies' metadata is small: a damaged or hostile one is not read.
-pub const MAX_META_BYTES: usize = 64 * 1024;
-
-/// Ids are short and safe in a file name: ASCII letters, digits and dashes, with a page part.
-pub fn valid_id(id: &str) -> bool {
-    !id.is_empty() && id.len() <= MAX_ID && id.chars().all(|c| c.is_ascii_alphanumeric() || c == '-') && page_of(id).is_some()
-}
-
-/// The page that wrote copy `id`.
-pub fn page_of(id: &str) -> Option<&str> {
-    id.rsplit_once('-').map(|(page, _)| page).filter(|p| !p.is_empty())
-}
-
-/// This page's id, from the time it started (ms since 1970) and a random number in 0..1:
-/// letters and digits only.
-pub fn page_id(now_ms: f64, random: f64) -> String {
-    let now = if now_ms.is_finite() && now_ms > 0.0 { now_ms.min(1e15) as u64 } else { 0 };
-    let random = if random.is_finite() { (random.clamp(0.0, 1.0) * f64::from(0xff_ffff)) as u64 } else { 0 };
-    format!("{now:x}{random:06x}")
-}
-
-/// The copy of design `uid` (`Session::uid`) open in page `page`.
-pub fn entry_id(page: &str, uid: u64) -> String {
-    format!("{page}-{uid}")
-}
-
-/// The stored file names of copy `id`: its design and its metadata.
-pub fn design_file(id: &str) -> String {
-    format!("{PREFIX}{id}.{}", solidcraft_engine::io::DESIGN_EXT)
-}
-pub fn meta_file(id: &str) -> String {
-    format!("{PREFIX}{id}.json")
-}
-
-/// Which part of a copy a stored file is.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Part {
-    Design,
-    Meta,
-}
-
-/// A stored file's copy id and part; `None` for every other file.
-pub fn parse_name(name: &str) -> Option<(&str, Part)> {
-    let rest = name.strip_prefix(PREFIX)?;
-    let (id, part) = if let Some(id) = rest.strip_suffix(".json") {
-        (id, Part::Meta)
-    } else {
-        (rest.strip_suffix(solidcraft_engine::io::DESIGN_EXT)?.strip_suffix('.')?, Part::Design)
-    };
-    valid_id(id).then_some((id, part))
-}
-
-/// A kept copy, as its metadata describes it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct Entry {
-    pub id: String,
-    /// The design's name.
-    pub name: String,
-    /// Its file (`None`: never saved).
-    pub path: Option<String>,
-    /// When the design last changed (ms since 1970).
-    pub changed_at: f64,
-}
-
-impl Entry {
-    pub fn to_json(&self) -> String {
-        json!({"name": self.name, "path": self.path, "changed_at": self.changed_at}).to_string()
-    }
-
-    /// Read copy `id`'s metadata. Anything malformed, oversized or not finite is no copy.
-    pub fn parse(id: &str, bytes: &[u8]) -> Option<Entry> {
-        if !valid_id(id) || bytes.len() > MAX_META_BYTES {
-            return None;
-        }
-        let v: Value = serde_json::from_slice(bytes).ok()?;
-        let name = v.get("name")?.as_str()?.chars().take(MAX_NAME).collect::<String>();
-        let path = match v.get("path") {
-            None | Some(Value::Null) => None,
-            Some(p) => Some(p.as_str().filter(|p| !p.is_empty() && p.len() <= MAX_PATH)?.to_string()),
-        };
-        let changed_at = v.get("changed_at")?.as_f64().filter(|t| t.is_finite() && *t >= 0.0)?;
-        Some(Entry { id: id.to_string(), name, path, changed_at })
-    }
-}
-
-/// Whether a copy that last changed at `changed_at` holds work its design's file doesn't:
-/// the file was last written at `saved_at` (ms since 1970; `None` or unknown: never saved, or
-/// the time can't be read, so the copy is kept rather than lost).
-pub fn newer_than_save(changed_at: f64, saved_at: Option<f64>) -> bool {
-    match saved_at {
-        Some(saved) if saved.is_finite() && saved > 0.0 => changed_at > saved,
-        _ => true,
-    }
-}
-
-/// What the next visit does with a copy it finds.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Fate {
-    /// Offer it: "Restore unsaved design…?".
-    Offer,
-    /// Its design was saved after it: remove it without asking.
-    Drop,
-    /// Its page is still open (another tab): leave it alone.
-    Leave,
-}
-
-/// The copy `entry`, whose design's file was last written at `saved_at`, while the pages
-/// `live` are open.
-pub fn fate(entry: &Entry, live: &[String], saved_at: Option<f64>) -> Fate {
-    if page_of(&entry.id).is_some_and(|p| live.iter().any(|l| l == p)) {
-        Fate::Leave
-    } else if newer_than_save(entry.changed_at, saved_at) {
-        Fate::Offer
-    } else {
-        Fate::Drop
-    }
-}
-
-/// Copies to offer first: the most recently changed, at most [`MAX_OFFERED`].
-pub fn order_offered(entries: &mut Vec<Entry>) {
-    entries.sort_by(|a, b| b.changed_at.total_cmp(&a.changed_at).then_with(|| a.id.cmp(&b.id)));
-    entries.truncate(MAX_OFFERED);
-}
-
-/// Whether a design's copy is due to be written at `now`: the design last changed at
-/// `last_change`, and the copy has lacked a change since `first_unwritten` (all ms).
-pub fn due(now: f64, first_unwritten: f64, last_change: f64) -> bool {
-    now - last_change >= QUIET_MS || now - first_unwritten >= MAX_WAIT_MS
-}
-
-/// How long after a failed write of a design's copy it isn't tried again (ms).
-pub const RETRY_MS: f64 = 30_000.0;
-
-/// Whether a copy whose write last failed at `failed_at` (ms; `None`: it hasn't) may be written
-/// at `now`: not before [`RETRY_MS`] has passed, so a full or denied store isn't hit every tick.
-pub fn may_write(now: f64, failed_at: Option<f64>) -> bool {
-    failed_at.is_none_or(|t| !(now >= t) || now - t >= RETRY_MS)
-}
-
-/// Whether `wanted` is the design now open, given the open design's path.
-pub fn is_open(open: Option<&str>, wanted: &str) -> bool {
-    open == Some(wanted)
-}
-
-/// What follows once a design restored from a kept copy, or recovered, is open: it opens in
-/// stages, a few features a frame with progress and Cancel (#10198), so this waits for the answer.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum AfterOpen {
-    /// A kept copy (#10220): it is its own design again (saving goes to `path`, it is named
-    /// `name`), with its changes unsaved; then the copy `id` goes when `drop` says so.
-    KeptCopy { opened: String, id: String, path: Option<String>, name: String, drop: bool },
-    /// The saved design offered beside a kept copy: the copy `id` goes when `drop` says so.
-    KeptSaved { opened: String, id: String, drop: bool },
-    /// Unsaved work from the page's last visit: it belongs to `path` again, named `name`, unsaved.
-    Recovery { opened: String, path: Option<String>, name: String },
-}
-
-impl AfterOpen {
-    /// The file the open reads.
-    pub fn opened(&self) -> &str {
-        match self {
-            AfterOpen::KeptCopy { opened, .. } | AfterOpen::KeptSaved { opened, .. } | AfterOpen::Recovery { opened, .. } => opened,
-        }
-    }
-}
-
-/// Whether the open of `wanted` answered with `reply` put it in: the answer says so, and it is
-/// the design now open (`open`: the open design's path). A refusal, a Cancel or another file
-/// leaves the copy or the recovered work offered.
-pub fn opened(reply: &Value, open: Option<&str>, wanted: &str) -> bool {
-    reply["ok"].as_bool() == Some(true) && is_open(open, wanted)
-}
-
-/// Whether leaving the page asks through the browser's "leave site?" box: there is unsaved work,
-/// and either the user still wants to be asked or it isn't all kept in the browser yet (with the
-/// keep preference off it never is, so there the box always stays).
-pub fn asks_before_unload(persists: bool, keep: bool, also_ask: bool, any_unsaved: bool, all_kept: bool) -> bool {
-    persists && any_unsaved && (also_ask || !(keep && all_kept))
-}
-
-/// An answer in the "Restore unsaved design?" window.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Answer {
-    /// Open the copy, with its unsaved changes, as the design it was (saving goes to its file).
-    Restore,
-    /// Open the design's file as last saved; the copy goes.
-    OpenSaved,
-    /// The copy goes.
-    Discard,
-}
-
-/// What an answer does.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Plan {
-    /// Open the copy (and, once it is open, give it back its name and file).
-    pub open_copy: bool,
-    /// Open this saved file.
-    pub open_saved: Option<String>,
-    /// Remove the copy.
-    pub drop_copy: bool,
-}
-
-/// What `answer` does to copy `entry`; `saved_exists`: its file can still be opened. `None`: the
-/// answer isn't offered for it (Open saved version of a design never saved, or gone).
-pub fn plan(answer: Answer, entry: &Entry, saved_exists: bool) -> Option<Plan> {
-    match answer {
-        Answer::Restore => Some(Plan { open_copy: true, open_saved: None, drop_copy: true }),
-        Answer::OpenSaved => {
-            let path = entry.path.clone().filter(|_| saved_exists)?;
-            Some(Plan { open_copy: false, open_saved: Some(path), drop_copy: true })
-        }
-        Answer::Discard => Some(Plan { open_copy: false, open_saved: None, drop_copy: true }),
-    }
-}
-
-/// The answers the window offers for `entry`, in order.
-pub fn answers(entry: &Entry, saved_exists: bool) -> Vec<Answer> {
-    [Answer::Restore, Answer::OpenSaved, Answer::Discard].into_iter().filter(|a| plan(*a, entry, saved_exists).is_some()).collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A restored or recovered design opens in stages (#10198): only an answer that it is in, for
-    /// the file asked for, counts; a refusal, a Cancel or another design open leaves it offered.
-    #[test]
-    fn a_staged_restore_counts_only_when_its_file_is_in() {
-        let copy = "/opfs/.kept/a.sc";
-        assert!(opened(&json!({"ok": true}), Some(copy), copy));
-        assert!(!opened(&json!({"ok": false, "error": "cancelled"}), Some(copy), copy));
-        assert!(!opened(&json!({"ok": false, "error": "not a design"}), None, copy));
-        assert!(!opened(&json!({"ok": true}), Some("/opfs/other.sc"), copy));
-        assert!(!opened(&json!({}), Some(copy), copy));
-        let after = AfterOpen::KeptCopy { opened: copy.into(), id: "a".into(), path: None, name: "Bracket".into(), drop: true };
-        assert_eq!(after.opened(), copy);
-    }
-
-    fn entry(id: &str, changed_at: f64, path: Option<&str>) -> Entry {
-        Entry { id: id.into(), name: "Bracket".into(), path: path.map(str::to_string), changed_at }
-    }
-
-    #[test]
-    fn a_failed_write_waits_before_the_next_try() {
-        assert!(may_write(1000.0, None));
-        assert!(!may_write(1000.0 + RETRY_MS - 1.0, Some(1000.0)));
-        assert!(may_write(1000.0 + RETRY_MS, Some(1000.0)));
-        // A clock that went back doesn't block for good.
-        assert!(may_write(10.0, Some(1000.0)));
-    }
-
-    #[test]
-    fn a_design_counts_as_opened_only_at_its_own_path() {
-        assert!(is_open(Some("a.sc"), "a.sc"));
-        assert!(!is_open(Some("b.sc"), "a.sc"));
-        assert!(!is_open(None, "a.sc"));
-    }
-
-    #[test]
-    fn copies_are_named_by_page_and_design_and_nothing_else_reads_as_one() {
-        let page = page_id(1_700_000_000_000.0, 0.5);
-        assert!(page.chars().all(|c| c.is_ascii_hexdigit()));
-        let id = entry_id(&page, 7);
-        assert!(valid_id(&id));
-        assert_eq!(page_of(&id), Some(page.as_str()));
-        assert_eq!(parse_name(&design_file(&id)), Some((id.as_str(), Part::Design)));
-        assert_eq!(parse_name(&meta_file(&id)), Some((id.as_str(), Part::Meta)));
-        for other in ["part.sc", "recovery.sc", "recovery.json", "keep-.sc", "keep-x.sc", "keep-a/b-1.sc", "keep-a-1.step", "keep-a-1sc"] {
-            assert_eq!(parse_name(other), None, "{other}");
-        }
-        // Hostile clocks still give a usable id.
-        for (now, random) in [(f64::NAN, f64::NAN), (f64::INFINITY, -1.0), (-5.0, 9.0)] {
-            assert!(valid_id(&entry_id(&page_id(now, random), 1)));
-        }
-    }
-
-    #[test]
-    fn metadata_round_trips_and_hostile_metadata_is_no_copy() {
-        let e = entry("a1-3", 1234.0, Some("/opfs/Bracket.sc"));
-        assert_eq!(Entry::parse("a1-3", e.to_json().as_bytes()), Some(e.clone()));
-        let never_saved = entry("a1-4", 99.0, None);
-        assert_eq!(Entry::parse("a1-4", never_saved.to_json().as_bytes()), Some(never_saved));
-        for bad in [
-            "",
-            "[]",
-            r#"{"name":"x","changed_at":"soon"}"#,
-            r#"{"name":"x","changed_at":-1}"#,
-            r#"{"name":"x","changed_at":1e999}"#,
-            r#"{"name":"x","path":7,"changed_at":1}"#,
-            r#"{"name":"x","path":"","changed_at":1}"#,
-            r#"{"changed_at":1}"#,
-        ] {
-            assert_eq!(Entry::parse("a1-3", bad.as_bytes()), None, "{bad}");
-        }
-        assert_eq!(Entry::parse("../x", e.to_json().as_bytes()), None);
-        assert_eq!(Entry::parse("a1-3", &vec![b' '; MAX_META_BYTES + 1]), None);
-        let long = json!({"name": "n".repeat(10_000), "changed_at": 1}).to_string();
-        assert_eq!(Entry::parse("a1-3", long.as_bytes()).map(|e| e.name.len()), Some(MAX_NAME));
-    }
-
-    #[test]
-    fn a_copy_newer_than_the_last_save_is_offered_an_older_one_dropped_an_open_pages_left() {
-        let e = entry("p1-1", 2000.0, Some("/opfs/Bracket.sc"));
-        // Changed after the file was last written: offered.
-        assert_eq!(fate(&e, &[], Some(1000.0)), Fate::Offer);
-        // Saved since (in this tab or another): nothing to offer.
-        assert_eq!(fate(&e, &[], Some(2000.0)), Fate::Drop);
-        assert_eq!(fate(&e, &[], Some(3000.0)), Fate::Drop);
-        // Never saved, or the save time can't be read: kept rather than lost.
-        for saved in [None, Some(0.0), Some(f64::NAN), Some(f64::INFINITY), Some(-4.0)] {
-            assert_eq!(fate(&e, &[], saved), Fate::Offer, "{saved:?}");
-        }
-        // Its page is still open in another tab: neither offered nor removed.
-        assert_eq!(fate(&e, &["p1".into()], Some(1000.0)), Fate::Leave);
-        assert_eq!(fate(&e, &["p1".into()], Some(3000.0)), Fate::Leave);
-        assert_eq!(fate(&e, &["p2".into()], Some(1000.0)), Fate::Offer);
-    }
-
-    #[test]
-    fn the_newest_copies_are_offered_first_and_at_most_a_windowful() {
-        let mut list: Vec<Entry> = (0..40).map(|i| entry(&format!("p-{i}"), f64::from(i), None)).collect();
-        order_offered(&mut list);
-        assert_eq!(list.len(), MAX_OFFERED);
-        assert_eq!(list.first().map(|e| e.id.as_str()), Some("p-39"));
-    }
-
-    #[test]
-    fn a_copy_is_written_once_the_design_is_still_or_after_the_longest_wait() {
-        // Still changing, not waited long: not yet.
-        assert!(!due(1000.0, 900.0, 900.0));
-        // Still for QUIET_MS: due.
-        assert!(due(900.0 + QUIET_MS, 900.0, 900.0));
-        // Changing all the time: due after MAX_WAIT_MS anyway.
-        assert!(!due(5000.0, 2000.0, 4900.0));
-        assert!(due(2000.0 + MAX_WAIT_MS, 2000.0, 2000.0 + MAX_WAIT_MS - 1.0));
-    }
-
-    #[test]
-    fn the_browser_asks_before_unload_unless_told_not_to_and_every_copy_is_current() {
-        // Keeping off: exactly as before, unsaved work asks, whatever the second option says.
-        assert!(asks_before_unload(true, false, true, true, true));
-        assert!(asks_before_unload(true, false, true, true, false));
-        assert!(asks_before_unload(true, false, false, true, true));
-        // Keeping on, asking on (the default): both, the box and the copy.
-        assert!(asks_before_unload(true, true, true, true, true));
-        // Keeping on, asking off, every unsaved design kept: no browser box.
-        assert!(!asks_before_unload(true, true, false, true, true));
-        // Keeping on, asking off, a copy still being written (or failed): the browser still asks.
-        assert!(asks_before_unload(true, true, false, true, false));
-        // Nothing unsaved, or an embedded page that keeps nothing: never.
-        assert!(!asks_before_unload(true, true, true, false, false));
-        assert!(!asks_before_unload(true, false, true, false, false));
-        assert!(!asks_before_unload(false, false, true, true, false));
-    }
-
-    #[test]
-    fn restore_open_saved_and_discard_each_do_one_thing_and_always_remove_the_copy() {
-        let saved = entry("p-1", 5.0, Some("/opfs/Bracket.sc"));
-        assert_eq!(plan(Answer::Restore, &saved, true), Some(Plan { open_copy: true, open_saved: None, drop_copy: true }));
-        assert_eq!(
-            plan(Answer::OpenSaved, &saved, true),
-            Some(Plan { open_copy: false, open_saved: Some("/opfs/Bracket.sc".into()), drop_copy: true })
-        );
-        assert_eq!(plan(Answer::Discard, &saved, true), Some(Plan { open_copy: false, open_saved: None, drop_copy: true }));
-        assert_eq!(answers(&saved, true), [Answer::Restore, Answer::OpenSaved, Answer::Discard]);
-        // A design never saved, or whose file is gone, has no saved version to open.
-        let never = entry("p-2", 5.0, None);
-        assert_eq!(plan(Answer::OpenSaved, &never, true), None);
-        assert_eq!(plan(Answer::OpenSaved, &saved, false), None);
-        assert_eq!(answers(&never, false), [Answer::Restore, Answer::Discard]);
-    }
-}

apps/solidcraft-web/src/linked.rs

@@ -1,161 +0,0 @@
-//! Bounded HTTPS or same-origin downloads, handed to the normal design-open command as unsaved copies.
-use std::{cell::RefCell, rc::Rc};
-
-use js_sys::{Reflect, Uint8Array};
-use solidcraft_engine::io::vfs;
-use solidcraft_ui_egui::{SolveApp, ui_kit};
-use wasm_bindgen::{JsCast as _, JsValue};
-use wasm_bindgen_futures::{JsFuture, spawn_local};
-
-use crate::{check_download_size, design_url};
-
-type Reply = Result<(String, Vec<u8>), String>;
-
-#[derive(Default)]
-pub struct Download {
-    reply: Rc<RefCell<Option<Reply>>>,
-    pending: Option<(String, Vec<u8>)>,
-    /// The downloaded design being opened (a few features a frame, #10198): the answer to come,
-    /// the name it takes and the file it was read from.
-    opening: Option<(std::sync::mpsc::Receiver<serde_json::Value>, String, String)>,
-}
-
-impl Download {
-    pub fn start(url: Option<&str>, ctx: &egui::Context) -> Self {
-        let download = Self::default();
-        if let Some(url) = url {
-            let url = url.to_owned();
-            let slot = download.reply.clone();
-            let ctx = ctx.clone();
-            spawn_local(async move {
-                *slot.borrow_mut() = Some(fetch(&url).await);
-                ctx.request_repaint();
-            });
-        }
-        download
-    }
-
-    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
-        self.opened(app);
-        if let Some(reply) = self.reply.borrow_mut().take() {
-            match reply {
-                Ok(file) => self.pending = Some(file),
-                Err(error) => app.set_status(format!("Could not open design link: {error}"), true),
-            }
-        }
-        if self.pending.is_none() || self.opening.is_some() || app.file_picker_busy() {
-            return;
-        }
-        if solidcraft_ui_egui::documents::any_dirty(app) {
-            let mut answer = None;
-            let closed = ui_kit::Window::new(egui::Id::unique("open_link"), "status_warning", solidcraft_ui_text::tr("web.open_link"))
-                .required()
-                .show_body(ctx, |ui| {
-                    ui.label(solidcraft_ui_text::tr("web.open_link_confirm"));
-                    ui.horizontal(|ui| {
-                        if ui_kit::button(ui, solidcraft_ui_text::tr("ui.open"), ui_kit::Button::Normal).clicked() {
-                            answer = Some(true);
-                        }
-                        if ui_kit::button(ui, solidcraft_ui_text::tr("ui.cancel"), ui_kit::Button::Normal).clicked() {
-                            answer = Some(false);
-                        }
-                    });
-                });
-            match answer {
-                Some(true) => {}
-                Some(false) => {
-                    self.pending = None;
-                    return;
-                }
-                None if closed => {
-                    self.pending = None;
-                    return;
-                }
-                None => return,
-            }
-        }
-        let Some((name, bytes)) = self.pending.take() else { return };
-        // The extension selects the design loader even when the URL has no extension. Named
-        // after the link, as the progress card shows the file's name.
-        let file: String = name.chars().map(|c| if matches!(c, '/' | '\\') { '_' } else { c }).collect();
-        let path = format!("/linked/{}.{}", if file.is_empty() { "design" } else { &file }, solidcraft_engine::io::DESIGN_EXT);
-        vfs::insert(&path, bytes);
-        // Opened as any design is, with its progress and Cancel; finished in `opened`.
-        self.opening = Some((app.open_path_answered(&path), name, path));
-        self.opened(app);
-    }
-
-    /// The downloaded design is in: it is an unsaved copy under the link's name.
-    fn opened(&mut self, app: &mut SolveApp) {
-        let Some((rx, _, _)) = &self.opening else { return };
-        let (ok, cancelled) = match rx.try_recv() {
-            Ok(reply) => (reply["ok"].as_bool() == Some(true), reply["error"].as_str().is_some_and(|e| e.contains("cancelled"))),
-            Err(std::sync::mpsc::TryRecvError::Empty) => return,
-            Err(std::sync::mpsc::TryRecvError::Disconnected) => (false, false),
-        };
-        let Some((_, name, path)) = self.opening.take() else { return };
-        if ok && app.session.path.as_deref() == Some(path.as_str()) {
-            app.session.path = None;
-            app.session.doc_mut().name = name;
-            app.session.mark_unsaved();
-        } else if !ok && !cancelled {
-            app.set_status("Could not open design link: the downloaded file is not a valid SolidCraft design", true);
-        }
-        let _ = vfs::remove(&path);
-    }
-}
-
-async fn fetch(value: &str) -> Reply {
-    let window = web_sys::window().ok_or("No browser window")?;
-    let page_origin = window.location().origin().map_err(|_| "Cannot read page origin")?;
-    let url = design_url(value, &page_origin)?;
-    let name = url.path_segments().and_then(|mut segments| segments.next_back()).filter(|name| !name.is_empty()).unwrap_or("Design");
-    let decoded = js_sys::decode_uri_component(name).ok().and_then(|name| name.as_string()).unwrap_or_else(|| name.to_owned());
-    // `arm.sc` (or a legacy `arm.solidcraft`) is named `arm`.
-    let stem = match decoded.rsplit_once('.') {
-        Some((stem, ext)) if !stem.is_empty() && solidcraft_engine::io::is_design_ext(ext) => stem,
-        _ => decoded.as_str(),
-    };
-    let name: String = stem.chars().take(255).collect();
-    let response = JsFuture::from(window.fetch_with_str(url.as_str())).await.map_err(|_| "Network request failed or the host refused CORS access")?;
-    let response: web_sys::Response = response.dyn_into().map_err(|_| "Invalid download response")?;
-    design_url(&response.url(), &page_origin).map_err(|_| "Design redirected to a URL that does not use HTTPS or the page's own origin")?;
-    if !response.ok() {
-        return Err(format!("HTTP {} {}", response.status(), response.status_text()));
-    }
-    let length = response
-        .headers()
-        .get("Content-Length")
-        .map_err(|_| "Cannot read download size")?
-        .map(|value| value.parse::<u64>().map_err(|_| "Invalid Content-Length"))
-        .transpose()?;
-    if let Some(length) = length {
-        check_download_size(0, length)?;
-    }
-    let stream = response.body().ok_or("Download has no body")?;
-    let reader: web_sys::ReadableStreamDefaultReader = stream.get_reader().dyn_into().map_err(|_| "Cannot read download stream")?;
-    let result = read(&reader).await;
-    if result.is_err() {
-        let _ = JsFuture::from(reader.cancel()).await;
-    }
-    // Fetch rejects interrupted HTTP bodies and decodes Content-Encoding. Content-Length
-    // can describe compressed bytes, so the streamed limit also checks the decoded size.
-    let bytes = result?;
-    Ok((name, bytes))
-}
-
-async fn read(reader: &web_sys::ReadableStreamDefaultReader) -> Result<Vec<u8>, String> {
-    let mut bytes = Vec::new();
-    // Bound even a stream which keeps returning empty chunks.
-    for _ in 0..1_000_000 {
-        let chunk = JsFuture::from(reader.read()).await.map_err(|_| "Download interrupted")?;
-        if Reflect::get(&chunk, &JsValue::from_str("done")).map_err(|_| "Invalid download stream")?.as_bool() == Some(true) {
-            return Ok(bytes);
-        }
-        let value = Reflect::get(&chunk, &JsValue::from_str("value")).map_err(|_| "Invalid download chunk")?;
-        let chunk: Uint8Array = value.dyn_into().map_err(|_| "Invalid download bytes")?;
-        check_download_size(bytes.len(), u64::from(chunk.length()))?;
-        bytes.extend_from_slice(&chunk.to_vec());
-    }
-    Err("Download returned too many chunks".into())
-}

apps/solidcraft-web/src/space_mouse.rs

@@ -1,367 +0,0 @@
-//! The 3D mouse in the browser (#1336), through the Gamepad API.
-//!
-//! Chromium browsers list a 3Dconnexion device itself, with its six axes scaled to -1..1 from the
-//! device's ±350. Firefox lists only joysticks and gamepads (a 3D mouse is a HID multi-axis
-//! controller), but 3DxWare's virtual joystick carries the same six axes once 3DxWare's profile
-//! for Firefox sends them there. Both come in the device's own order and signs, so the shared
-//! navigation takes them with 3DxWare's object-mode mapping, as the Linux app does without a
-//! profile.
-
-use solidcraft_ui_egui::space_mouse::{Axes, Calibration, FULL_SCALE, calibrated};
-
-/// Logitech's vendor id, which older 3Dconnexion devices carry, and those devices' product ids
-/// (usb.ids). Logitech's own gamepads and wheels carry the same vendor id.
-const LOGITECH: u16 = 0x046d;
-const LOGITECH_3D_MICE: [u16; 11] = [0xc603, 0xc605, 0xc606, 0xc621, 0xc623, 0xc625, 0xc626, 0xc627, 0xc628, 0xc629, 0xc62b];
-/// 3Dconnexion's own vendor id. The browser lists only its 3D mice as gamepads: its mice, and the
-/// mouse side of its receivers, are not gamepads.
-const THREEDCONNEXION: u16 = 0x256f;
-/// 3DxWare's virtual joystick.
-const VIRTUAL_JOYSTICK: (u16, u16) = (0xbeef, 0x046d);
-
-/// What a gamepad the browser lists is, when it is a 3D mouse. A device is read before the
-/// joystick: in a Chromium browser both are listed, and the joystick stays at rest.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
-pub enum Source {
-    Device,
-    VirtualJoystick,
-}
-
-/// The vendor and product ids in a gamepad's id: `Name (Vendor: 046d Product: c62b)` in Chromium
-/// browsers, `046d-c62b-Name` in Firefox.
-fn vendor_product(id: &str) -> Option<(u16, u16)> {
-    fn hex(digits: &str) -> Option<u16> {
-        if (1..=4).contains(&digits.len()) && digits.bytes().all(|b| b.is_ascii_hexdigit()) { u16::from_str_radix(digits, 16).ok() } else { None }
-    }
-    if let Some((_, ids)) = id.rsplit_once("Vendor: ") {
-        let (vendor, rest) = ids.split_once(" Product: ")?;
-        let product = rest.split(|c: char| !c.is_ascii_hexdigit()).next()?;
-        return Some((hex(vendor)?, hex(product)?));
-    }
-    let mut parts = id.splitn(3, '-');
-    let (vendor, product, _name) = (parts.next()?, parts.next()?, parts.next()?);
-    Some((hex(vendor)?, hex(product)?))
-}
-
-/// Whether a gamepad is a 3D mouse, from the id the browser gives it.
-pub fn source(id: &str) -> Option<Source> {
-    match vendor_product(id)? {
-        VIRTUAL_JOYSTICK => Some(Source::VirtualJoystick),
-        (THREEDCONNEXION, _) => Some(Source::Device),
-        (LOGITECH, product) if LOGITECH_3D_MICE.contains(&product) => Some(Source::Device),
-        _ => None,
-    }
-}
-
-/// The six axes in the device's raw units, from a gamepad's axes (-1..1). Fewer than six: not a
-/// 3D mouse. A value that isn't a number reads as rest.
-pub fn axes(values: &[f64]) -> Option<Axes> {
-    let raw = |i: usize| values.get(i).map(|&v| if v.is_finite() { (v.clamp(-1.0, 1.0) * f64::from(FULL_SCALE)).round() as i16 } else { 0 });
-    Some(Axes { translation: [raw(0)?, raw(1)?, raw(2)?], rotation: [raw(3)?, raw(4)?, raw(5)?] })
-}
-
-/// What a calibration of the gamepad with this id is saved under: `web` and its vendor and
-/// product ids.
-pub fn device_key(id: &str) -> Option<String> {
-    vendor_product(id).map(|(vendor, product)| format!("web {vendor:04x}:{product:04x}"))
-}
-
-/// The 3D mouse to read among the ones listed: the first device, else the first joystick.
-pub fn choose<T>(found: impl IntoIterator<Item = (Source, T)>) -> Option<T> {
-    found.into_iter().min_by_key(|(source, _)| *source).map(|(_, reading)| reading)
-}
-
-/// Whether the cap is moving as the next frame will see it: through the device's calibration
-/// (as of the last frame) when it has one. The idle page wakes for a short-range device's push,
-/// and not for a device resting off zero; the wheel filter goes by the same.
-pub fn moving(axes: Axes, calibration: Option<Calibration>) -> bool {
-    calibrated(axes, calibration).moving()
-}
-
-/// The calibration as of the last frame, and the device it was for.
-pub type Cached = (Option<String>, Option<Calibration>);
-
-/// Whether the cap of `device` is moving, judged with the calibration kept from the last frame:
-/// `None` when that was for another device, so another's calibration never judges this one. The
-/// waker then lets a frame look, which brings the cache up to date.
-pub fn moving_as_cached(device: &Option<String>, axes: Axes, cached: &Cached) -> Option<bool> {
-    (*device == cached.0).then(|| moving(axes, cached.1))
-}
-
-/// Whether the idle page's timer redraws: when the cap is moving as the last frame's calibration
-/// judges it, when the device read isn't the one that calibration was for (a frame then judges
-/// it with its own), and once when the device the last frame read is gone, so the page shows
-/// that. With no device, and none last frame, it stays quiet.
-pub fn wakes(reading: Option<(Option<String>, Axes)>, cached: &Cached) -> bool {
-    match reading {
-        Some((device, axes)) => moving_as_cached(&device, axes, cached).unwrap_or(true),
-        None => cached.0.is_some(),
-    }
-}
-
-#[cfg(target_arch = "wasm32")]
-pub use browser::SpaceMouse;
-
-#[cfg(target_arch = "wasm32")]
-mod browser {
-    use std::cell::{Cell, RefCell};
-    use std::rc::Rc;
-
-    use solidcraft_ui_egui::SolveApp;
-    use solidcraft_ui_egui::space_mouse::{Axes, DriverMapping, calibration, navigate_frame};
-    use wasm_bindgen::JsCast as _;
-    use wasm_bindgen::closure::Closure;
-
-    use solidcraft_ui_egui::space_mouse::WheelGuard;
-
-    use super::{Cached, axes, choose, device_key, moving_as_cached, source, wakes};
-
-    /// How often the page looks for the cap starting to move while nothing else redraws.
-    const WAKE_MS: i32 = 50;
-
-    /// The 3D mouse the browser lists, if any: its calibration key and its axes.
-    fn read() -> Option<(Option<String>, Axes)> {
-        let pads = web_sys::window()?.navigator().get_gamepads().ok()?;
-        choose(pads.iter().filter_map(|pad| {
-            let pad = pad.dyn_into::<web_sys::Gamepad>().ok().filter(web_sys::Gamepad::connected)?;
-            let source = source(&pad.id())?;
-            let values: Vec<f64> = pad.axes().iter().map(|v| v.as_f64().unwrap_or(f64::NAN)).collect();
-            Some((source, (device_key(&pad.id()), axes(&values)?)))
-        }))
-    }
-
-    /// Reads the 3D mouse once per frame and moves the view with it.
-    #[derive(Default)]
-    pub struct SpaceMouse {
-        axes: Axes,
-        /// The 3D mouse being read, as `SolveApp::space_mouse` keeps it.
-        device: Option<String>,
-        /// The previous frame's time and the step since it (seconds).
-        last: Option<f64>,
-        seconds: f64,
-        wheel: WheelGuard,
-        /// Listening for gamepads (from the first frame with navigation on).
-        listening: bool,
-        /// The timer that wakes the app when the cap starts moving runs (from when a 3D mouse
-        /// is first listed).
-        waking: bool,
-        /// Navigation is on (the waker reads it).
-        enabled: Rc<Cell<bool>>,
-        /// The calibration as of the last frame and its device (the waker and the wheel filter read it).
-        cached: Rc<RefCell<Cached>>,
-    }
-
-    impl SpaceMouse {
-        /// At the start of a frame: reads the cap and drops 3DxWare's emulated wheel from the
-        /// frame's input, before the app sees it.
-        pub fn raw_input_hook(&mut self, ctx: &egui::Context, enabled: bool, raw: &mut egui::RawInput) {
-            let now = raw.time.unwrap_or_else(|| js_sys::Date::now() / 1000.0);
-            self.seconds = self.last.map_or(0.0, |last| now - last);
-            self.last = Some(now);
-            self.enabled.set(enabled);
-            self.axes = Axes::default();
-            if !enabled {
-                return;
-            }
-            if !self.listening {
-                self.listening = true;
-                listen(ctx);
-            }
-            let reading = read();
-            if reading.is_some() && !self.waking {
-                self.waking = wake(ctx, &self.enabled, &self.cached);
-            }
-            // As read: calibration needs the readings at rest too, and `navigate_frame` leaves a
-            // cap resting inside the dead zone alone.
-            (self.device, self.axes) = reading.unwrap_or_default();
-            let moving = moving_as_cached(&self.device, self.axes, &self.cached.borrow()).unwrap_or_else(|| self.axes.moving());
-            self.wheel.filter(moving, now, &mut raw.events);
-        }
-
-        pub fn logic(&self, app: &mut SolveApp, ctx: &egui::Context) {
-            app.space_mouse.device.clone_from(&self.device);
-            *self.cached.borrow_mut() = (self.device.clone(), calibration(app));
-            navigate_frame(app, ctx, DriverMapping::object_mode(), self.axes, self.seconds);
-        }
-    }
-
-    /// A 3D mouse is listed only once it has been moved on the page: redraw then, so the frame
-    /// finds it without waiting for the pointer.
-    fn listen(ctx: &egui::Context) {
-        let Some(window) = web_sys::window() else { return };
-        let ctx = ctx.clone();
-        let on_connect = Closure::<dyn FnMut()>::new(move || ctx.request_repaint());
-        let _ = window.add_event_listener_with_callback("gamepadconnected", on_connect.as_ref().unchecked_ref());
-        // The listener lives as long as the page.
-        on_connect.forget();
-    }
-
-    /// The browser sends no event when a gamepad moves, so a timer looks while the app is idle and
-    /// redraws when the cap starts moving; the frames that follow keep going on their own.
-    fn wake(ctx: &egui::Context, enabled: &Rc<Cell<bool>>, cached: &Rc<RefCell<Cached>>) -> bool {
-        let Some(window) = web_sys::window() else { return false };
-        let (ctx, enabled, cached) = (ctx.clone(), Rc::clone(enabled), Rc::clone(cached));
-        let tick = Closure::<dyn FnMut()>::new(move || {
-            if enabled.get() && wakes(read(), &cached.borrow()) {
-                ctx.request_repaint();
-            }
-        });
-        let started = window.set_interval_with_callback_and_timeout_and_arguments_0(tick.as_ref().unchecked_ref(), WAKE_MS).is_ok();
-        // The timer lives as long as the page.
-        tick.forget();
-        started
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn recognises_3d_mice_in_each_browsers_ids() {
-        // As Edge and Firefox list them (Windows 11, SpaceMouse Pro, 3DxWare 10).
-        assert_eq!(source("SpaceMouse Pro (Vendor: 046d Product: c62b)"), Some(Source::Device));
-        assert_eq!(source("Unknown Gamepad (Vendor: beef Product: 046d)"), Some(Source::VirtualJoystick));
-        assert_eq!(source("beef-046d-Unknown Gamepad"), Some(Source::VirtualJoystick));
-        // 3Dconnexion's own vendor id, any product; the older devices under Logitech's.
-        assert_eq!(source("SpaceMouse Compact (Vendor: 256f Product: c635)"), Some(Source::Device));
-        assert_eq!(source("256f-c652-3Dconnexion Universal Receiver"), Some(Source::Device));
-        assert_eq!(source("46d-c626-SpaceNavigator"), Some(Source::Device));
-        assert_eq!(source("SpaceNavigator (STANDARD GAMEPAD Vendor: 046d Product: c626)"), Some(Source::Device));
-        for product in LOGITECH_3D_MICE {
-            assert_eq!(source(&format!("x (Vendor: 046d Product: {product:04x})")), Some(Source::Device));
-            assert_eq!(source(&format!("046d-{product:04X}-x")), Some(Source::Device));
-        }
-    }
-
-    #[test]
-    fn a_calibration_is_saved_under_the_ids_whichever_browser_lists_it() {
-        assert_eq!(device_key("SpaceMouse Pro (Vendor: 046d Product: c62b)").as_deref(), Some("web 046d:c62b"));
-        assert_eq!(device_key("46d-c62b-SpaceMouse Pro").as_deref(), Some("web 046d:c62b"));
-        assert_eq!(device_key("Xbox Wireless Controller"), None);
-    }
-
-    #[test]
-    fn the_idle_page_wakes_for_motion_as_calibrated_not_as_read() {
-        let axis =
-            |source, rest, full| solidcraft_ui_egui::space_mouse::AxisCalibration { source, reversed: false, rest, dead_zone: 0, full: [full; 2] };
-        // A short-range device: 15 of its 50 is under the raw dead zone, but 105 of 350 calibrated.
-        let short = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 0, 50)) };
-        let push = Axes { translation: [15, 0, 0], rotation: [0; 3] };
-        assert!(!push.moving() && moving(push, Some(short)));
-        // A device resting at 100 on every axis: past the raw dead zone, but at rest calibrated.
-        let offset = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 100, 350)) };
-        let resting = Axes { translation: [100; 3], rotation: [100; 3] };
-        assert!(resting.moving() && !moving(resting, Some(offset)));
-        // Without a calibration, as read.
-        assert!(!moving(push, None) && moving(resting, None));
-        // Kept from the last frame: only for the device it was for.
-        let (a, b) = (Some("web 256f:c63a".to_string()), Some("web 1234:5678".to_string()));
-        assert_eq!(moving_as_cached(&b, push, &(b.clone(), Some(short))), Some(true));
-        assert_eq!(moving_as_cached(&b, push, &(a.clone(), Some(offset))), None, "A's calibration doesn't judge B");
-        assert_eq!(moving_as_cached(&b, push, &(None, None)), None);
-        assert_eq!(moving_as_cached(&a, resting, &(a.clone(), None)), Some(true), "A was read without a calibration");
-    }
-
-    #[test]
-    fn the_idle_page_wakes_once_for_a_device_change_and_stays_quiet_without_one() {
-        let (a, b) = (Some("web 256f:c63a".to_string()), Some("web 1234:5678".to_string()));
-        let still = Axes::default();
-        let last_frame_read_a: Cached = (a.clone(), None);
-        assert!(!wakes(Some((a.clone(), still)), &last_frame_read_a), "A, at rest");
-        assert!(wakes(Some((b.clone(), still)), &last_frame_read_a), "A to B: a frame looks at B");
-        assert!(wakes(None, &last_frame_read_a), "A to none: a frame shows it's gone");
-        assert!(!wakes(None, &(None, None)), "none to none: quiet");
-    }
-
-    #[test]
-    fn gamepads_and_other_logitech_devices_are_not_3d_mice() {
-        for id in [
-            "Logitech Dual Action (STANDARD GAMEPAD Vendor: 046d Product: c216)",
-            "046d-c21d-Logitech Gamepad F310",
-            "G29 Driving Force Racing Wheel (Vendor: 046d Product: c24f)",
-            "046d-c215-Logitech Extreme 3D",
-            "NuLOOQ navigator (Vendor: 046d Product: c640)",
-            "Xbox 360 Controller (XInput STANDARD GAMEPAD)",
-            "45e-28e-Xbox 360 Wired Controller",
-            "beef-046e-Unknown Gamepad",
-            "beee-046d-Unknown Gamepad",
-            "",
-            "-",
-            "--",
-            "256f-",
-            "256f-c635",
-            "Vendor: 256f",
-            "Vendor: 256f Product: ",
-            "x (Vendor: 256fff Product: c635)",
-            "x (Vendor: zz6f Product: c635)",
-            "12345-c635-x",
-            "256f--x",
-            "SpaceMouse Pro",
-        ] {
-            assert_eq!(source(id), None, "{id:?}");
-        }
-    }
-
-    #[test]
-    fn ids_never_panic() {
-        // Hostile and odd ids: multi-byte text around the markers, markers repeated or cut short.
-        for id in [
-            "Vendor: é Product: ü",
-            "Vendor: Vendor: 256f Product: c635)",
-            "é-ü-ö",
-            "Ⅰ (Vendor: 256f Product: c6Ⅰ)",
-            "\u{0}-\u{0}-\u{0}",
-            "Vendor: 256f Product: c635 Vendor: ",
-        ] {
-            let _ = source(id);
-        }
-        let mut seed = 0x2545_f491_4f6c_dd1d_u64;
-        let alphabet: Vec<char> = "0123456789abcdefABCDEF- ():VendorProductéⅠ\u{0}".chars().collect();
-        for _ in 0..20_000 {
-            let len = (seed % 40) as usize;
-            let id: String = (0..len)
-                .map(|_| {
-                    seed ^= seed << 13;
-                    seed ^= seed >> 7;
-                    seed ^= seed << 17;
-                    alphabet[(seed % alphabet.len() as u64) as usize]
-                })
-                .collect();
-            if let Some(Source::Device) = source(&id) {
-                let (vendor, product) = vendor_product(&id).expect("recognised ids have both");
-                assert!(vendor == THREEDCONNEXION || (vendor == LOGITECH && LOGITECH_3D_MICE.contains(&product)), "{id:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn gamepad_axes_are_the_devices_raw_units() {
-        // Full deflection is the desktop's 350, and the browser's scale keeps the device's steps.
-        let axes = axes(&[1.0, -1.0, 0.5, -0.5, 2.0 / 700.0, 0.0]).expect("six axes");
-        assert_eq!(axes, Axes { translation: [350, -350, 175], rotation: [-175, 1, 0] });
-        for raw in -350_i16..=350 {
-            let value = f64::from(raw) / 350.0;
-            assert_eq!(super::axes(&[value; 6]).map(|a| a.translation[0]), Some(raw));
-        }
-        // Past full deflection is full deflection; anything that isn't a number is rest.
-        let hostile = super::axes(&[f64::NAN, f64::INFINITY, f64::NEG_INFINITY, 1e300, -1e300, f64::MIN_POSITIVE]).expect("six axes");
-        assert_eq!(hostile, Axes { translation: [0, 0, 0], rotation: [350, -350, 0] });
-        // A gamepad with fewer than six axes is not a 3D mouse; extra axes are ignored.
-        assert_eq!(super::axes(&[1.0; 5]), None);
-        assert_eq!(super::axes(&[]), None);
-        assert_eq!(super::axes(&[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 1.0]), Some(Axes::default()));
-    }
-
-    #[test]
-    fn a_device_is_read_before_the_virtual_joystick() {
-        let moving = Axes { translation: [100, 0, 0], rotation: [0; 3] };
-        let other = Axes { translation: [0, 200, 0], rotation: [0; 3] };
-        assert_eq!(choose([(Source::VirtualJoystick, other), (Source::Device, moving)]), Some(moving));
-        assert_eq!(choose([(Source::Device, moving), (Source::VirtualJoystick, other)]), Some(moving));
-        assert_eq!(choose([(Source::VirtualJoystick, other)]), Some(other));
-        // Two devices: the first listed.
-        assert_eq!(choose([(Source::Device, moving), (Source::Device, other)]), Some(moving));
-        assert_eq!(choose::<Axes>([]), None);
-    }
-}