Release 0.25.1

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.config/nextest.toml

@@ -1,6 +1,6 @@
 # cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
-# CI builds the tests once and runs them in shards: 2 for a pull request, 4 for main and the nightly
-# (.github/workflows/ci.yml).
+# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml),
+# except the GPU path tracer's tests (the gpu-path group below), which run in four shards of their own.
 
 [profile.ci]
 # Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
@@ -34,13 +34,14 @@ slow-timeout = { period = "60s" }
 [profile.ci.junit]
 path = "junit.xml"
 
-# The action matrix sample runs its designs in parallel worker processes, one per CPU. Run with
-# other tests beside it (the heavy ones on main), a pi-case hole that takes 8 s alone (#952 makes
-# it a real hole) went past the matrix's 90 s action limit. It runs on its own.
+# The action matrix sample runs its designs in parallel workers (ACTION_MATRIX_JOBS, set to match in
+# ci.yml). Its workers reserve that many of nextest's threads, so the cores are not oversubscribed
+# (a pi-case hole that takes 8 s alone went past the matrix's 90 s action limit when they were),
+# and it starts first, beside the other slow tests.
 [[profile.ci.overrides]]
 filter = "binary(action_matrix) & test(=action_matrix_sample)"
-threads-required = "num-cpus"
-
+threads-required = 12
+priority = 100
 
 # The slowest tests start first, so a shard does not end with one of them running alone on a
 # core while the others sit idle (seed_81 alone takes about 20 minutes under CI load). Medians
@@ -68,3 +69,61 @@ filter = """
 ))
 """
 priority = 100
+
+# Each nextest test has its own process/device. Concurrent cold lavapipe path
+# compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
+# Serialize this module per CI shard; other tests retain their normal parallelism.
+# CI runs these in their own job (GPU path tests in ci.yml), split into count partitions.
+[test-groups.gpu-path]
+max-threads = 1
+
+[[profile.ci.overrides]]
+filter = "package(=solidcraft-gpu) & test(/^path::/)"
+test-group = "gpu-path"
+
+# Full local validation opts into its own scheduling policy. Keep GitHub CI's
+# worker reservation and slow-test priorities above independent of this runner.
+[profile.local-ci]
+inherits = "ci"
+
+[[profile.local-ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = "num-cpus"
+priority = 100
+
+[[profile.local-ci.overrides]]
+filter = "(package(solidcraft-engine) & test(=tests::robustness_goldens::seed_81)) | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))"
+priority = 99
+
+[[profile.local-ci.overrides]]
+filter = """
+(package(solidcraft-engine) & (
+    test(/^tests::robustness_goldens::seed_(81|45|20|24|95|02|57|40|18|48|32|46|85|61)$/)
+    | test(/^tests::robustness::/)
+    | test(=tests::hostile_params_never_panic)
+    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
+    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
+    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
+    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
+    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
+    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
+))
+| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
+| (package(solidcraft-kernel) & (
+    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
+    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
+    | test(=tspline::tests::hostile_tsplines_never_panic)
+    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
+    | test(/^issue_788_tests::equal_bores_crossing_/)
+))
+"""
+priority = 98
+
+# Native Windows shader/device creation must not overlap within the local run.
+[test-groups.windows-gpu]
+max-threads = 1
+
+[[profile.local-ci.overrides]]
+platform = "cfg(windows)"
+filter = "package(solidcraft-gpu) | package(solidcraft) | (package(solidcraft-ui-egui) & test(/(offscreen|gpu)/))"
+test-group = "windows-gpu"

.gitattributes

@@ -0,0 +1,6 @@
+# Preserve canonical source receipts and the runtime icon-discovery snapshot.
+.gitattributes text eol=lf
+/assets/icons/ui/design/requested_icons.txt text eol=lf
+# SolidCraft designs (.sc): a JSON document or a ZIP container, never Scala source, so they
+# stay out of GitHub's language statistics. Git's own text/binary detection handles both kinds.
+*.sc -linguist-detectable

.github/ISSUE_TEMPLATE/bug.yml

@@ -6,6 +6,7 @@ body:
     attributes:
       value: |
         Thanks for taking the time to report this! Inside the app, **Report an Issue** fills most of this in for you, with the command, its settings and your environment.
+        Before reporting a boolean or modelling failure, please try to reproduce it on the latest nightly or a build from current `main`, and say which build you used.
   - type: textarea
     id: what
     attributes:
@@ -18,7 +19,8 @@ body:
     attributes:
       label: Steps to reproduce
       description: |
-        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.sc --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
       placeholder: |
         1. Sketch a circle on the XY plane
         2. Extrude it 10 mm

.github/actionlint.yaml

@@ -7,4 +7,5 @@ self-hosted-runner:
     - blacksmith-4vcpu-ubuntu-2404
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
     - blacksmith-8vcpu-windows-2025

.github/pull_request_template.md

@@ -2,6 +2,12 @@
 
 Describe the problem and resulting behavior. Link the issue when applicable.
 
+Changes a default: no
+
+<!-- Required line, replace "no" if this changes what a user gets out of the box (a default value, key binding, setting, tool behaviour):
+Changes a default: yes — <what>, old behaviour kept behind preference <name>
+Docs-only and bot PRs are exempt. -->
+
 ## Validation
 
 What did you run, and what were the results? Include expected and measured values for geometry changes.

.github/release-notes.md

@@ -9,9 +9,10 @@ parameter to watch the timeline rebuild. [Documentation](https://docs.solidcraft
 [ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
 the known limitations. Designs from every earlier version open in this one.
 
-**Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
-`flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
-menu entry.
+**New app ID.** The app ID is now `io.tangencylabs.solidcraft` (it was `ai.storyteller.solidcraft`,
+and `ai.storyteller.solvecraft` up to 0.7): `flatpak update` offers to replace the old app, the
+`.deb`, `.rpm` and AppImage remove the old menu entry, and settings stay. On macOS the bundle ID
+changed too, so macOS asks once more for the permissions it had granted.
 
 **Upgrading from 0.5 or earlier.** 0.6 renamed SolveCraft to SolidCraft and made the zip
 container the default save format. `.solvecraft` designs, old settings folders and
@@ -42,16 +43,16 @@ installing SolidCraft; keep both remotes in the same user installation:
 ```sh
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --user --if-not-exists solidcraft https://docs.solidcraft.io/flatpak/solidcraft.flatpakrepo
-flatpak install --user solidcraft ai.storyteller.solidcraft
-flatpak run ai.storyteller.solidcraft
+flatpak install --user solidcraft io.tangencylabs.solidcraft
+flatpak run io.tangencylabs.solidcraft
 ```
 
 A remote added from the old `bherbruck.github.io` address no longer finds updates: run
 `flatpak remote-modify --user --url=https://docs.solidcraft.io/flatpak/repo/ solidcraft`, then
 `flatpak update --user`.
 
-Flatpak installs from 0.7 or earlier use the old ID `ai.storyteller.solvecraft`: `flatpak update --user`
-offers to replace it with `ai.storyteller.solidcraft`, and settings move along.
+Flatpak installs under an old ID (`ai.storyteller.solidcraft`, or `ai.storyteller.solvecraft` from 0.7 or
+earlier): `flatpak update --user` offers to replace it with `io.tangencylabs.solidcraft`, and settings move along.
 
 Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
 still need an internet connection. [Linux installation details](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).

.github/workflows/ci.yml

@@ -8,12 +8,15 @@
 # whole workspace, as do pushes to main that change code, the nightly run and Run workflow.
 # Documentation, packaging, the other workflows and the GitHub bots' scripts select nothing:
 # no native job runs for them, on pull requests or on main.
-# Tests are built once and run in shards. A few heavy tests (see .config/nextest.toml) are
-# skipped on pull requests and run on pushes to main and nightly. The Windows jobs (D3D12 shaders
-# and app startup), the reference tests and the doc tests run on main and nightly only, not on
-# pull requests (the fast lane, in Select checks); a break there is fixed forward on main. Only
-# main saves the build caches; pull requests restore them. On pull requests the test build and the
-# shards start only after the format and repository checks pass.
+# Tests are built and run in one job on a big runner, slowest first, starting beside the repository
+# checks (no archive to upload and download). The GPU path tracer's tests run one at a time
+# (.config/nextest.toml), so they have a job of their own in four shards (GPU path tests). A few
+# heavy tests (see .config/nextest.toml) are skipped on pull requests and run on pushes to main and
+# nightly. The reference tests and the doc tests run in the merge queue, on main and nightly, not
+# on pull requests (the fast lane, in Select checks); a break there is fixed forward on main. The
+# Windows jobs (D3D12 shaders and app startup) run nightly, and in the merge queue only for a group
+# that changes what they exercise. Only main saves the build caches; pull requests restore them.
+# sccache is on a Blacksmith sticky disk that only main commits.
 # A push to main runs only the repository checks when a passing merge-queue run tested that very
 # commit, or when nothing a build reads changed since the last push to main whose run passed.
 # Otherwise it runs everything.
@@ -29,14 +32,13 @@
 # reads `ci` from the newest run of a commit, so a run without it would block a PR that passed.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
 # Every Linux job runs on Blacksmith's Ubuntu 24.04 runners (blacksmith-<N>vcpu-ubuntu-2404), sized
-# per job: 16 vCPU for Build tests, Clippy and the merge queue's test shards, 8 for compiles, the
-# other test shards, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
+# per job: 32 vCPU for the tests, 16 for Clippy, the GPU path tests, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
 # The Windows shader job runs on Blacksmith's Windows Server 2025 runners (blacksmith-8vcpu-windows-2025);
 # the Windows app startup smoke stays on windows-latest, which has a desktop session that presents frames.
 # Pull requests, forks included, the merge queue, pushes to main and the nightly run all use them:
 # the runners are ephemeral, fork runs get no secrets, and main saves the build caches that every
-# other run restores read-only. The tests are built once (Build tests) into an archive the shards
-# run; Blacksmith's image matches ubuntu-24.04, so the archive and the recorded goldens behave the
+# other run restores read-only. Nightly and by hand, Build tests also makes an archive the matrix
+# jobs run; Blacksmith's image matches ubuntu-24.04, so the archive and the recorded goldens behave the
 # same.
 name: CI
 
@@ -96,13 +98,17 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: read
-      # To ask whether the merge queue already tested a commit pushed to main.
+      # To ask whether the merge queue already tested a commit pushed to main, and which labels the
+      # pull requests of a merge group carry (the render-tests opt-in).
+      pull-requests: read
       actions: read
     outputs:
       native: ${{ steps.paths.outputs.native }}
       kernel: ${{ steps.paths.outputs.kernel }}
       goldens: ${{ steps.paths.outputs.goldens }}
       windows: ${{ steps.paths.outputs.windows }}
+      # The GPU path tests run (see the rule where it is computed). The job's `if` and the `ci` job's check both read this, so they cannot disagree.
+      gpu: ${{ steps.paths.outputs.gpu }}
       full: ${{ steps.paths.outputs.full }}
       # Code changed on a pull request that has no approved-for-ci label yet: only Quick compile.
       quick: ${{ steps.paths.outputs.quick }}
@@ -122,8 +128,11 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PUSH_SHA: ${{ github.sha }}
+          GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+          GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          RENDER_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'render-tests') }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
           APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}
@@ -133,6 +142,7 @@ jobs:
           kernel=false
           goldens=false
           windows=false
+          gpu_paths=false
           full=true
           packages=
           # Whether the NUL-separated paths in $1 reach any code: scripts/ci/affected.py selects
@@ -144,6 +154,46 @@ jobs:
             full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
             packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
           }
+          # Whether the NUL-separated paths in $1 (the diff $2) reach what the Windows D3D12 jobs
+          # exercise: the GPU crate and its shaders, the app and its startup, the viewport's wgpu
+          # glue, the vendored egui-wgpu, their scripts, or a lockfile change that moves the
+          # graphics stack (wgpu, naga, egui, winit, windows). Pull requests and merge groups share it.
+          windows_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
+                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
+              esac
+            done < "$1"
+            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$1" \
+              && git diff "$2" -- Cargo.lock \
+                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
+              windows=true
+            fi
+          }
+          # Whether the NUL-separated paths in $1 are render code: the render crate, the path
+          # tracer and its shaders in the GPU crate, the render workspace UI, the render assets.
+          # Core, kernel and CI changes do not trigger the path tests (about 56 runner-minutes):
+          # the tracer reads the scene through interfaces the other tests cover, and the nightly
+          # runs them for everything.
+          gpu_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/render/*|crates/gpu/src/path/*|crates/ui-egui/src/render_workspace*|assets/render/*) gpu_paths=true ;;
+              esac
+            done < "$1"
+          }
+          # Opt-in for a big render change: a pull request labelled render-tests, or a merge group
+          # holding one (its pull requests are the (#N) of its squash commits), runs them whatever
+          # the paths say.
+          group_has_render_label() {
+            for pr in $(git log --format=%s "$1" | grep -o '(#[0-9]*)$' | tr -d '(#)'); do
+              if gh api "repos/$REPO/issues/$pr" --jq '.labels[].name' | grep -qx render-tests; then
+                return 0
+              fi
+            done
+            return 1
+          }
           if [ "$EVENT_NAME" = push ]; then
             # The queue lands the very commit its merge_group run tested. If that run passed,
             # testing the push again proves nothing new; otherwise (a merge that skipped the
@@ -164,37 +214,48 @@ jobs:
               # push before may never have run: a newer push cancels a waiting one).
               echo "$tested..$PUSH_SHA changes no code: repository checks only."
             else
-              # Code changed (or the push can't be compared): main runs everything.
+              # Code changed (or the push can't be compared): main runs everything but Windows.
+              # The merge queue ran Windows for the changes that reach it, and the nightly runs it
+              # for everything else (it passed 129 of 129 non-PR runs before this).
               full=true
               packages=
               native=true
-              windows=true
             fi
+          elif [ "$EVENT_NAME" = merge_group ]; then
+            native=true
+            # Windows (about 16 runner-minutes) only for a group that changes what it exercises;
+            # the nightly runs it whatever changed. A group that can't be compared runs it.
+            if git diff --no-renames --name-only -z "$GROUP_BASE_SHA...$GROUP_HEAD_SHA" > "$RUNNER_TEMP/ci-paths"; then
+              windows_paths "$RUNNER_TEMP/ci-paths" "$GROUP_BASE_SHA...$GROUP_HEAD_SHA"
+              gpu_paths "$RUNNER_TEMP/ci-paths"
+              if [ "$gpu_paths" = false ] && group_has_render_label "$GROUP_BASE_SHA..$GROUP_HEAD_SHA"; then
+                gpu_paths=true
+              fi
+            else
+              windows=true
+              gpu_paths=true
+            fi
+            echo "windows=$windows gpu_paths=$gpu_paths for $GROUP_BASE_SHA...$GROUP_HEAD_SHA"
           elif [ "$EVENT_NAME" != pull_request ]; then
+            # The nightly run and Run workflow: everything, Windows included.
             native=true
             windows=true
+            gpu_paths=true
           else
             # Compare both old and new paths of renames; unknown paths run native checks.
             git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
             while IFS= read -r -d '' path; do
               case "$path" in crates/kernel/*|vendor/truck-*) kernel=true ;; esac
-              # What can change a robustness golden: the kernel and the crates a design is built with.
+              # What a pull request re-checks the goldens for: the kernel, truck and the goldens
+              # themselves (a re-record is checked before it is queued). The goldens are frozen, so
+              # on any other change they would only re-check unchanged results; the merge queue,
+              # main and the nightly run every seed before anything lands.
               case "$path" in
-                crates/kernel/*|crates/engine/*|crates/doc/*|crates/sketch/*|crates/geom/*|vendor/truck-*|tests/robustness/*) goldens=true ;;
-              esac
-              # What the Windows D3D12 jobs exercise: the GPU crate and its shaders, the app and
-              # its startup, the viewport's wgpu glue, the vendored egui-wgpu, their scripts.
-              case "$path" in
-                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
-                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
+                crates/kernel/*|vendor/truck-*|tests/robustness/*) goldens=true ;;
               esac
             done < "$RUNNER_TEMP/ci-paths"
-            # A lockfile change that moves the graphics stack (wgpu, naga, egui, winit, windows).
-            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$RUNNER_TEMP/ci-paths" \
-              && git diff "$BASE_SHA...$HEAD_SHA" -- Cargo.lock \
-                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
-              windows=true
-            fi
+            # Computed as for a merge group, then turned off below (the fast lane).
+            windows_paths "$RUNNER_TEMP/ci-paths" "$BASE_SHA...$HEAD_SHA"
             # Pull requests build and test the touched packages and their dependents; nothing
             # selected means no code changed.
             select_packages "$RUNNER_TEMP/ci-paths"
@@ -239,8 +300,28 @@ jobs:
               goldens=false
             fi
           fi
+          # The GPU path tests (their own job, about 56 runner-minutes) are for render changes only:
+          # - on a pull request, when it carries the render-tests label (opt-in for a big render
+          #   change) or touches render code (gpu_paths); no other pull request runs them;
+          # - in the merge queue, when the group's diff touches render code or one of its pull
+          #   requests carries render-tests;
+          # - in the nightly and by hand, always, so anything the above skipped is caught within a day;
+          # - not on a push to main: the queue tested that commit, or the nightly will.
+          gpu=false
+          if [ "$native" = true ]; then
+            case "$EVENT_NAME" in
+              pull_request)
+                gpu_paths "$RUNNER_TEMP/ci-paths"
+                gpu=$gpu_paths
+                if [ "$RENDER_LABEL" = true ]; then gpu=true; fi ;;
+              merge_group) gpu=$gpu_paths ;;
+              push) gpu=false ;;
+              *) gpu=true ;;
+            esac
+          fi
           {
             echo "native=$native"
+            echo "gpu=$gpu"
             echo "kernel=$kernel"
             echo "goldens=$goldens"
             echo "windows=$windows"
@@ -277,8 +358,16 @@ jobs:
         run: cargo xtask licences --check
       - name: Dependency layers
         run: cargo xtask layers
+      - name: Universal UI containers
+        run: |
+          cargo xtask ui-containers
+          cargo test -p xtask ui_containers --locked
       - name: Sorted lists
         run: cargo xtask lists
+      - name: Agent router and skills cite real files
+        run: |
+          cargo xtask skills
+          cargo test -p xtask skills --locked
       - name: Design format pending changes
         run: bash scripts/test-format-pending.sh
       - name: Web app offline use and updates (headless Chrome)
@@ -287,8 +376,8 @@ jobs:
         run: python3 -I scripts/ci/test_affected.py
       - name: Merge-of-main detection self-test
         run: python3 -I scripts/ci/test_main_merge.py
-      - name: Claim and triage bot tests
-        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js
+      - name: Claim, triage and kernel-paused bot tests
+        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js scripts/kernel-paused/*.test.js scripts/pr-checks/*.test.js
 
   # Fast feedback for a pull request that has not been approved for the full CI yet.
   quick-compile:
@@ -337,25 +426,33 @@ jobs:
 
   build-tests:
     name: Build tests
-    # Fail fast on pull requests: the test archive (and so the shards) waits for the repository
-    # checks, the most common cheap failure; heavy jobs used to run on to the end beside a failed
-    # format check. Main, nightly and Run workflow build regardless, so the action matrix and the
-    # property tests that hang off this job keep their signal.
-    needs: [changes, checks]
-    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.native == 'true' && (github.event_name != 'pull_request' || needs.checks.result == 'success') }}
+    # The archive is for the action matrix and the property tests, which run only nightly and by
+    # hand. Pull requests, the merge queue and main build and run their tests in the `tests` job.
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.native == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
     runs-on: blacksmith-16vcpu-ubuntu-2404
     # Fork builds start from main's cache, read-only; give them room to finish and upload.
     timeout-minutes: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) && 60 || 45 }}
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
       - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-archive
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: native-tests
@@ -387,63 +484,96 @@ jobs:
         run: sccache --show-stats
 
   tests:
-    name: Native Linux tests (${{ matrix.shard }}/4)
-    needs: [changes, checks, build-tests]
-    if: ${{ !cancelled() && needs.changes.outputs.native == 'true' && (github.event_name != 'pull_request' || needs.checks.result == 'success') && needs.build-tests.result == 'success' }}
-    runs-on: ${{ github.event_name == 'merge_group' && 'blacksmith-16vcpu-ubuntu-2404' || 'blacksmith-8vcpu-ubuntu-2404' }}
+    name: Native Linux tests
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.native == 'true' }}
+    # Builds the tests and runs them in one job on a big runner: there is no archive to upload
+    # and download (3 GB on a full run), and the job starts beside the repository checks, not
+    # after them. nextest hands tests to its threads as they free up, the slowest first (priority
+    # in .config/nextest.toml), so they start at once and no core idles at the end.
+    runs-on: blacksmith-32vcpu-ubuntu-2404
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        # Pull requests test their affected crates in 2 shards; main and the nightly use 4.
-        shard: ${{ fromJSON(github.event_name == 'pull_request' && '[1, 2]' || '[1, 2, 3, 4]') }}
     env:
       # Pictures (snapshots, screenshots, ui.render, the viewport's offscreen tests) are drawn on
       # the GPU. The runner has none: Mesa's lavapipe (software Vulkan) draws them, and a test that
       # would skip for want of an adapter fails instead.
       SOLIDCRAFT_GPU: software
       SOLIDCRAFT_REQUIRE_GPU: "1"
+      ACTION_MATRIX_JOBS: "12"
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install a software Vulkan driver (lavapipe)
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-tests
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-tests
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: cargo-nextest
-      # Each shard runs the archive the Build tests job made.
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: nextest-archive
       - name: Run tests
         env:
           EVENT_NAME: ${{ github.event_name }}
           GOLDENS: ${{ needs.changes.outputs.goldens }}
-          SHARD: ${{ matrix.shard }}
-          SHARDS: ${{ github.event_name == 'pull_request' && 2 || 4 }}
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
           # The robustness golden seeds a pull request skips: each takes one to twenty minutes under
           # CI load, together about four fifths of the goldens' time. Pushes to main, the merge
           # queue and the nightly run every seed.
           SLOW_SEEDS: 81|45|20|24|95|02|57|40|18|48|32|46|85|61|77|34|14
         run: |
-          # Pull requests skip the heavy tests (default-filter in .config/nextest.toml).
-          filter=()
+          # Pull requests skip the heavy tests (default-filter in .config/nextest.toml); `default()`
+          # below is that filter, so a pull request still runs only what it ran before.
+          base='default()'
+          if [ "$EVENT_NAME" = pull_request ]; then
+            # The action matrix sample (about 6 minutes on all cores) runs in the merge queue, on
+            # main and nightly, not on every pull request push.
+            base='default() & not (binary(action_matrix) & test(=action_matrix_sample))'
+          fi
           if [ "$EVENT_NAME" != pull_request ]; then
             # The boolean property tests draw new random inputs every run; they run only in the
             # nightly property-tests job, so a known kernel bug cannot turn main red at random.
-            filter=(--ignore-default-filter -E 'not (package(solidcraft-kernel) & binary(boolean_props))')
+            base='not (package(solidcraft-kernel) & binary(boolean_props))'
           elif [ "$GOLDENS" = true ]; then
             # A pull request that can change a robustness golden (tests/robustness/goldens.json)
             # also checks every seed but the slow ones, in the same run so they share its cores.
-            filter=(--ignore-default-filter -E "default() | (package(solidcraft-engine) & test(/^tests::robustness_goldens::/) & not test(/^tests::robustness_goldens::seed_($SLOW_SEEDS)\$/))")
+            base="(default() & not (binary(action_matrix) & test(=action_matrix_sample))) | (package(solidcraft-engine) & test(/^tests::robustness_goldens::/) & not test(/^tests::robustness_goldens::seed_($SLOW_SEEDS)\$/))"
           fi
           junit=${CARGO_TARGET_DIR:-target}/nextest/ci/junit.xml
           rm -f "$junit"
-          # Extract into ./target: tests that run a built binary (env!("CARGO_BIN_EXE_*")) have
-          # the build job's path, which is the same checkout path here.
-          run=(cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite)
-          if ! "${run[@]}" --profile ci --partition "slice:$SHARD/$SHARDS" --no-tests=pass "${filter[@]}"; then
+          # Pull requests test the affected packages (scripts/ci/affected.py).
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          status=0
+          # The GPU path tracer's tests run in their own job (GPU path tests): one at a time, they
+          # took about 36 of this job's 45 minutes.
+          cargo nextest run "${scope[@]}" --cargo-profile ci --locked --profile ci --no-tests=pass \
+            --ignore-default-filter -E "($base) & not (package(=solidcraft-gpu) & test(/^path::/))" || status=1
+          if [ "$status" != 0 ]; then
             # A failed golden gets the hint to re-record it (junit.xml lists the failures).
             if [ -f "$junit" ] && tr '\n' ' ' < "$junit" | grep -q '<testcase name="tests::robustness_goldens::[^"]*"[^>]*>[[:space:]]*<failure'; then
               echo "::error::A robustness golden changed. If the new result is intended, re-record it in this pull request and say why:"
@@ -451,11 +581,104 @@ jobs:
             fi
             exit 1
           fi
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
       - name: Upload test timings
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: junit-${{ matrix.shard }}
+          name: junit
+          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
+          retention-days: 7
+
+  gpu-path-tests:
+    name: GPU path tests (${{ matrix.shard }}/4)
+    # The GPU path tracer's tests (about 108) compile their pipelines on lavapipe, one test at a
+    # time (the gpu-path test group in .config/nextest.toml keeps them within the 600 s pipeline
+    # setup budget). Serial, they took about 36 minutes, the longest chain in Native Linux tests;
+    # here four shards run beside it. Their filter is the one Native Linux tests leaves out, so
+    # every test runs exactly once.
+    # 16 vCPU, not 8: lavapipe compiles on every core, and on 8 vCPU one test went past the 600 s
+    # budget (665 s, against 204 s for the same test in another run) and a shard took 35 minutes.
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.gpu == 'true' }}
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    env:
+      # As in Native Linux tests: lavapipe draws, and a test without an adapter fails.
+      SOLIDCRAFT_GPU: software
+      SOLIDCRAFT_REQUIRE_GPU: "1"
+      # lavapipe's own shader cache (below).
+      MESA_SHADER_CACHE_DIR: /home/runner/.cache/mesa-gpu
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install a software Vulkan driver (lavapipe)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      # The shards build the same thing, so only the first one commits it (and saves the cache).
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-gpu
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # The first test in a shard to build the path pipeline compiles it cold on lavapipe (335 to
+      # 665 s, against the 600 s setup budget); every later one reads Mesa's disk cache (about
+      # 30 s). Keeping that cache from main's last run lets the first test read it too, until the
+      # shaders change. Same sticky disk rules as the compiler cache.
+      - name: Mount lavapipe's shader cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-mesa-gpu
+          path: /home/runner/.cache/mesa-gpu
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-gpu
+          save-if: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 }}
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - name: Run one shard of the GPU path tests
+        env:
+          SHARD: ${{ matrix.shard }}
+        run: |
+          # None of these is in the default filter (the heavy tests), so pull requests, the merge
+          # queue, main and nightly all run every one of them, as before. `count` deals the tests
+          # out in turn (27 each); `hash` split them 41/40/27 across three shards.
+          cargo nextest run -p solidcraft-gpu --cargo-profile ci --locked --profile ci --no-tests=pass \
+            --ignore-default-filter -E 'test(/^path::/)' --partition "count:$SHARD/4"
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
+      - name: Upload test timings
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: junit-gpu-${{ matrix.shard }}
           path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
           retention-days: 7
 
@@ -560,13 +783,23 @@ jobs:
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
       - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-doc
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
       # Main saves the cache; every other run restores it, read-only.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
@@ -608,13 +841,23 @@ jobs:
     env:
       CARGO_INCREMENTAL: "0"
       RUSTC_WRAPPER: sccache
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Size parallel compiles to the job's memory
         run: scripts/ci/build-jobs.sh
       - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-oracle
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && 'on-change' || 'false' }}
       # Main saves the cache; every other run restores it, read-only.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
@@ -700,7 +943,7 @@ jobs:
     # commit's real run instead: the merge queue reads `ci` from the newest run of a commit, so a
     # run without a passing `ci` would block a pull request that passed (#1850, #3182, #3252).
     name: ci
-    needs: [changes, checks, quick-compile, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
+    needs: [changes, checks, quick-compile, clippy, build-tests, tests, gpu-path-tests, doc-tests, oracle, windows-fxc, windows-startup]
     if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
@@ -746,7 +989,10 @@ jobs:
           DOCTESTS: ${{ needs.changes.outputs.doctests }}
           CLIPPY: ${{ needs.clippy.result }}
           BUILD: ${{ needs.build-tests.result }}
+          EVENT_NAME: ${{ github.event_name }}
           TESTS: ${{ needs.tests.result }}
+          GPU_RUN: ${{ needs.changes.outputs.gpu }}
+          GPU: ${{ needs.gpu-path-tests.result }}
           DOCS: ${{ needs.doc-tests.result }}
           ORACLE: ${{ needs.oracle.result }}
           WINDOWS_FXC: ${{ needs.windows-fxc.result }}
@@ -760,9 +1006,16 @@ jobs:
           fi
           if [ "$NATIVE" = true ]; then
             test "$CLIPPY" = success
-            test "$BUILD" = success
+            # The archive for the action matrix and property tests exists nightly and by hand only.
+            if [ "$EVENT_NAME" = schedule ] || [ "$EVENT_NAME" = workflow_dispatch ]; then
+              test "$BUILD" = success
+            fi
             test "$TESTS" = success
           fi
+          # The same output decides whether the GPU path tests run (their job's `if`).
+          if [ "$GPU_RUN" = true ]; then
+            test "$GPU" = success
+          fi
           if [ "$DOCTESTS" = true ]; then
             test "$DOCS" = success
           fi

.github/workflows/external-corpus.yml

@@ -0,0 +1,42 @@
+# Nightly import checks on real-world STEP files (#1397): the external corpus in
+# tests/external-corpus.toml is downloaded (hash-verified), imported headless, and checked
+# against tolerance-based expectations — body counts, total volume and area, time and memory
+# budgets. It is not part of `cargo xtask ci`: it downloads from the internet.
+#
+# Import results should improve over time (healing, edge merging, meshing). When a check fails
+# because the numbers moved for the better (or the source changed upstream), re-record with
+# `cargo xtask external-corpus --bless "why"` in a pull request, never by editing numbers.
+name: External corpus
+
+on:
+  schedule:
+    - cron: '40 3 * * *'
+  workflow_dispatch:
+    inputs:
+      only:
+        description: "Run only this corpus entry name (empty = every entry)"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  corpus:
+    name: Import the external STEP corpus
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build the CLI
+        run: cargo build --profile ci -p solidcraft-cli
+      - name: Import and check every entry
+        env:
+          ONLY: ${{ inputs.only }}
+        run: |
+          if [ -z "$ONLY" ]; then
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli
+          else
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli --only "$ONLY"
+          fi

.github/workflows/generated.yml

@@ -1,6 +1,8 @@
 # Files generated from the code are rewritten here, on main, after each merge, so pull requests
 # never edit them (two pull requests that each regenerated one would always conflict):
 # THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
+# Pending files (assets/locales/pending, attribution/pending) are folded into the catalogs and
+# ATTRIBUTION.md by `cargo xtask fold-pending`.
 name: Generated files
 
 on:
@@ -17,6 +19,8 @@ on:
       - "crates/engine/**"
       - "apps/solidcraft-cli/**"
       - "xtask/**"
+      - "assets/locales/pending/*.json"
+      - "attribution/pending/*.md"
       - ".github/workflows/generated.yml"
   workflow_dispatch:
 
@@ -48,13 +52,15 @@ jobs:
         run: cargo xtask licences
       - name: docs/features.md
         run: cargo xtask features
+      - name: Pending locale strings and attribution rows
+        run: cargo xtask fold-pending
       - name: Commit if changed
         run: |
-          if git diff --quiet -- THIRD-PARTY-LICENSES.txt docs/features.md; then echo "unchanged"; exit 0; fi
+          if [ -z "$(git status --porcelain)" ]; then echo "unchanged"; exit 0; fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add THIRD-PARTY-LICENSES.txt docs/features.md
-          git commit -m "Regenerate THIRD-PARTY-LICENSES.txt and docs/features.md [skip ci]"
+          git add -A THIRD-PARTY-LICENSES.txt docs/features.md assets/locales ATTRIBUTION.md attribution
+          git commit -m "Regenerate generated files and fold pending files [skip ci]"
           for _ in 1 2 3; do
             git pull --rebase origin main && git push origin HEAD:main && exit 0
             sleep 10

.github/workflows/kernel-paused.yml

@@ -0,0 +1,42 @@
+# While a new geometry kernel is evaluated, new issues, pull requests and discussions about kernel
+# work are labelled `kernel-paused` for a maintainer to answer (CONTRIBUTING.md, "Kernel work is
+# paused"). The logic is in scripts/kernel-paused/ (tested in ci.yml).
+name: Kernel paused
+
+on:
+  issues:
+    types: [opened]
+  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
+  # scripts/kernel-paused and only lists the PR's changed paths; the PR's code is never checked out.
+  pull_request_target:
+    types: [opened]
+  discussion:
+    types: [created]
+
+permissions:
+  contents: read # to check out scripts/kernel-paused
+  issues: write
+  pull-requests: write # to list a PR's changed paths and add its label
+  discussions: write
+
+concurrency:
+  group: kernel-paused-${{ github.event.issue.number || github.event.pull_request.number || github.event.discussion.number }}
+  cancel-in-progress: false
+
+jobs:
+  paused:
+    name: Kernel paused bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/kernel-paused
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const paused = require('./scripts/kernel-paused/kernel-paused.js');
+            const done = context.eventName === 'discussion'
+              ? await paused.handleDiscussion({ github, context })
+              : await paused.handleOpened({ github, context });
+            core.info(done);

.github/workflows/packaging-lint.yml

@@ -39,6 +39,8 @@ jobs:
         run: python3 packaging/tests/nightly_test.py
       - name: Windows executable icon validation regression
         run: python3 packaging/tests/windows_icon_test.py
+      - name: AppImage CLI wrapper regression
+        run: python3 packaging/tests/apprun_test.py
       - name: Flatpak desktop smoke validation regression
         run: python3 packaging/tests/flatpak_test.py
       - name: PowerShell
@@ -53,13 +55,15 @@ jobs:
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
           xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
-          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          # The window's X11 class is its app id; the old id stays only as the rename shims.
-          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
+          desktop-file-validate assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          # The window's X11 class is its app id; the old ids stay only as the rename shims.
+          grep -qx 'StartupWMClass=io.tangencylabs.solidcraft' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solidcraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -qx 'X-Flatpak-RenamedFrom=ai.storyteller.solidcraft.desktop;ai.storyteller.solvecraft.desktop;' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
           grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/io.tangencylabs.solidcraft.bundle.yml')); assert m['id'] == 'io.tangencylabs.solidcraft' and m['command'] == 'solidcraft'"
           python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"
           python3 -m py_compile packaging/linux/snap-smoke.py

.github/workflows/pages.yml

@@ -65,6 +65,7 @@ jobs:
         run: |
           mkdir -p site
           cp -r target/book/. site/
+          bash docs/book/seo.sh site  # canonical links, robots.txt, sitemap.xml
           cp -r dist/web site/app
       - uses: actions/configure-pages@v5
         id: pages

.github/workflows/pr-checks.yml

@@ -0,0 +1,69 @@
+# Two quick checks on every pull request (CONTRIBUTING.md, "Sending a change"): no second open PR
+# for an issue a lower-numbered one already closes, and the "Changes a default:" line is filled in.
+# Neither is a required status check. The logic is in scripts/pr-checks/pr-checks.js (tested in ci.yml).
+name: PR checks
+
+on:
+  # pull_request, never pull_request_target: nothing here checks out or runs the PR's code, and the
+  # token is read-only for fork PRs. Only scripts/pr-checks from the PR's own merge commit is run.
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  duplicate:
+    name: Duplicate PR check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDuplicate({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  defaults:
+    name: Defaults line check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDefaults({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  # Labelling needs write access, which a fork PR's token never has, so it is its own job and best
+  # effort: a fork PR just doesn't get the `changes-default` label from here.
+  label:
+    name: Label changes-default
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            await checks.syncDefaultLabel({ github, context, core });

.github/workflows/release.yml

@@ -4,11 +4,14 @@
 # comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
-# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
+# A version with a suffix (0.2.0-rc.1) is a pre-release.
+# The macOS app is signed and notarized when the APPLE_* secrets exist. The Windows binaries and
+# MSI are Authenticode-signed through SignPath Foundation when the SIGNPATH_API_TOKEN secret exists
+# (see the windows job). Nothing else is signed yet.
 #
 #   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
-#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
+#   macOS universal         .dmg, and the CLI as a .zip (both archs built in parallel)  packaging/macos
 #   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
 #   Web                     a .zip of the static site                              packaging/web
 #
@@ -17,6 +20,8 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+# A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
+#   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release
 
 on:
@@ -31,6 +36,10 @@ on:
         description: "Create/update a draft (release branch only; off: build artifacts only)"
         type: boolean
         default: false
+      signpath_signing_policy:
+        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -203,6 +212,8 @@ jobs:
     name: Snap ${{ matrix.arch }}
     needs: [version, linux]
     if: needs.version.outputs.build == 'true'
+    # The Snap Store hasn't accepted SolidCraft yet, so a snap failure never holds up a release.
+    continue-on-error: true
     # Repackages the Linux job's tarball, like the Flatpak. On 24.04 because the core24 base is
     # Ubuntu 24.04, which lets snapcraft build on the runner itself (--destructive-mode).
     runs-on: ${{ matrix.runner }}
@@ -286,18 +297,26 @@ jobs:
             export CARGO_TARGET_DIR=/var/tmp/solidcraft-target CARGO_BUILD_JOBS=4
             bash packaging/freebsd/package.sh
             tar -tzf dist/release/solidcraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
+              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/io\.tangencylabs\.solidcraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-freebsd-x86_64
           path: dist/release/*
           if-no-files-found: error
 
-  macos:
-    name: macOS universal
+  # The two halves of the universal binary build in parallel on their own runners (each alone
+  # took about half of the old single job's 45 minutes); `macos` below joins and packages them.
+  macos-build:
+    name: macOS build ${{ matrix.arch }}
     needs: version
     if: needs.version.outputs.build == 'true'
     runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: aarch64, target: aarch64-apple-darwin }
+          - { arch: x86_64, target: x86_64-apple-darwin }
     env:
       SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
       SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -305,12 +324,58 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
+          targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: release-macos-universal
-      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
-        run: packaging/macos/package.sh --arch universal
+          key: release-macos-${{ matrix.arch }}
+      - name: Build
+        run: packaging/macos/package.sh --build-only ${{ matrix.target }}
+      # Not named release-*: the release job collects every release-* artifact as an asset.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: macos-bin-${{ matrix.arch }}
+          path: |
+            target/${{ matrix.target }}/release/solidcraft
+            target/${{ matrix.target }}/release/solidcraft-cli
+            target/${{ matrix.target }}/release/solvecraft-cli
+          if-no-files-found: error
+
+  macos:
+    name: macOS universal
+    needs: [version, macos-build]
+    if: needs.version.outputs.build == 'true'
+    runs-on: macos-14
+    env:
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-aarch64
+          path: target/aarch64-apple-darwin/release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-x86_64
+          path: target/x86_64-apple-darwin/release
+      - name: Set up Developer ID signing and notarization
+        # Optional until the APPLE_* secrets exist (docs/releasing.md, "macOS signing"). Without
+        # them (forks, dry runs) the app keeps its ad-hoc signature and is not notarized.
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: packaging/macos/signing.sh --setup
+      - name: Join, sign, package and check (dmg, CLI zip; the dmg is mounted and checked)
+        run: |
+          # Artifacts don't keep the executable bit.
+          chmod +x target/*-apple-darwin/release/solidcraft target/*-apple-darwin/release/solidcraft-cli target/*-apple-darwin/release/solvecraft-cli
+          packaging/macos/package.sh --arch universal --skip-build ${MACOS_SIGN_IDENTITY:+--sign}
+      - name: Remove the signing keychain and API key
+        if: always()
+        run: packaging/macos/signing.sh --cleanup
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos
@@ -321,7 +386,14 @@ jobs:
     name: Windows ${{ matrix.arch }}
     needs: [version, icons]
     if: needs.version.outputs.build == 'true'
+    # Must stay a GitHub-hosted runner, like every job before it: SignPath's open-source policy
+    # only signs builds whose jobs all ran on GitHub-hosted runners.
     runs-on: windows-latest
+    # actions: read lets the SignPath action read this job's details and fetch the uploaded
+    # artifact with GITHUB_TOKEN (the workflow default above grants contents: read only).
+    permissions:
+      contents: read
+      actions: read
     strategy:
       fail-fast: false
       matrix:
@@ -332,6 +404,16 @@ jobs:
           - { arch: arm64, target: aarch64-pc-windows-msvc }
     env:
       SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      # Authenticode signing through SignPath Foundation (docs/releasing.md, "Windows signing").
+      # Only when the API token secret exists: forks and repositories without it build unsigned,
+      # exactly as before. `if:` can't read secrets, so the check goes through this variable.
+      SIGN_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
+      # The one switch between the self-signed test certificate (test-signing) and the real one
+      # (release-signing): a dispatch input, else the SIGNPATH_SIGNING_POLICY repository variable,
+      # else test-signing.
+      SIGNPATH_SIGNING_POLICY: ${{ inputs.signpath_signing_policy || vars.SIGNPATH_SIGNING_POLICY || 'test-signing' }}
+      SIGNPATH_ORGANIZATION_ID: fa603ff4-c702-404b-8588-a524371c7a4e
+      SIGNPATH_PROJECT_SLUG: solidcraft
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -350,10 +432,109 @@ jobs:
           dotnet tool install --global wix --version 5.0.2
           wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build and package (msi, portable zip)
+        if: env.SIGN_WINDOWS != 'true'
         shell: pwsh
         env:
           SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
         run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+
+      # ---- signed path ---------------------------------------------------------------------------
+      # SignPath's GitHub integration (docs.signpath.io/trusted-build-systems/github): the files go
+      # up as a workflow artifact, SignPath fetches that artifact itself (so it can verify it came
+      # from this workflow run), signs it, and the action downloads the signed copy. GitHub stores
+      # artifacts as zips, so packaging/windows/signpath-artifact-configuration.xml (pasted into the
+      # SignPath project) describes a zip holding the files at its top level.
+      # Two rounds: the .exe files first, so the MSI, the portable zip and the plain .exe all carry
+      # signed binaries; then the MSI built from them.
+      - name: Build and stage the binaries for signing
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase stage
+      - name: Upload the unsigned binaries
+        id: unsigned-exes
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-exes-windows-${{ matrix.arch }}
+          path: target/windows-package/${{ matrix.arch }}/*.exe
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the binaries (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-exes.outputs.artifact-id }}
+          wait-for-completion: true
+          # release-signing requests wait for a person to approve them in SignPath; give that an
+          # hour instead of the default 10 minutes. test-signing requests finish in seconds.
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-exes-${{ matrix.arch }}
+      - name: Put the signed binaries in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $stage = "target/windows-package/${{ matrix.arch }}"
+          foreach ($exe in 'solidcraft.exe', 'solidcraft-cli.exe', 'solvecraft-cli.exe') {
+            $signed = "target/windows-package/signed-exes-${{ matrix.arch }}/$exe"
+            # The artifact configuration matches each file optionally, so check that every file
+            # actually came back signed rather than trusting the request's success.
+            $sig = Get-AuthenticodeSignature $signed
+            if (-not $sig.SignerCertificate) { throw "$exe came back from SignPath without a signature ($($sig.Status))" }
+            # The test certificate is self-signed, so Status is not Valid until release-signing.
+            Write-Output "$exe signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+            Copy-Item -Force $signed "$stage/$exe"
+          }
+      - name: Package the signed binaries (msi, portable zip)
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase package
+      - name: Upload the unsigned MSI
+        id: unsigned-msi
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-msi-windows-${{ matrix.arch }}
+          path: dist/release/*.msi
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the MSI (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
+          wait-for-completion: true
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-msi-${{ matrix.arch }}
+      - name: Put the signed MSI in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = Get-Item "dist/release/*.msi"
+          $signed = "target/windows-package/signed-msi-${{ matrix.arch }}/$($msi.Name)"
+          $sig = Get-AuthenticodeSignature $signed
+          if (-not $sig.SignerCertificate) { throw "$($msi.Name) came back from SignPath without a signature ($($sig.Status))" }
+          Write-Output "$($msi.Name) signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+          Copy-Item -Force $signed $msi.FullName
+          "Windows ${{ matrix.arch }}: Authenticode-signed through SignPath (policy $env:SIGNPATH_SIGNING_POLICY, $($sig.SignerCertificate.Subject))." >> $env:GITHUB_STEP_SUMMARY
+      - name: Note the unsigned build
+        if: env.SIGN_WINDOWS != 'true'
+        shell: pwsh
+        run: '"Windows ${{ matrix.arch }}: unsigned (no SIGNPATH_API_TOKEN secret)." >> $env:GITHUB_STEP_SUMMARY'
+
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-windows-${{ matrix.arch }}

.gitignore

@@ -7,6 +7,11 @@
 /.claude/worktrees/
 /target-snapshot
 __pycache__/
+.vscode/
 
 # cargo-mutants output (docs/mutation-testing.md)
 mutants.out*/
+
+# external corpus downloads (cargo xtask external-corpus, #1397): fetched at test time,
+# hash-pinned in tests/external-corpus.toml; never commit case data
+/corpus/

AGENTS.md

@@ -1,206 +1,47 @@
-# SolidCraft — instructions for agents
+# SolidCraft: instructions for agents
 
-SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
-sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Projects published by
-[storytold](https://github.com/storytold) can serve as references for implementation conventions.
-Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, pure-Rust parametric 3D CAD app (sketch solver, feature timeline, B-rep kernel, an egui UI that agents drive). This file is a router: the hard rules, then the skill to read for your task. Humans: CONTRIBUTING.md.
 
-## Product name
-SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
-`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
-settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
-survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
-new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
-`/solidcraft/`; do not add permanent old-name Pages aliases.
+## Start here
+Work: ROADMAP.md, "Where help is wanted most" in CONTRIBUTING.md, issues labelled `help wanted`, `good first issue`, `needs-triage`; architecture in `docs/architecture.md`. Act when the code, docs and rules settle a question; ask only when it changes what users see. Local `plan/` notes are optional.
 
-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section.
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
+## Hard rules (what enforces each)
+- Independent: never copy another product's code, icons, text or templates; never drive or take data from commercial CAD. `skills/solidcraft-ground-rules/SKILL.md`.
+- No GPL/LGPL/AGPL code, not even reading it (OpenCASCADE, FreeCAD, SolveSpace, CadQuery, LibreCAD, QCAD): `cargo xtask licences --check`.
+- Every asset is original or openly licensed with a row in ATTRIBUTION.md; read `assets/AGENTS.md` before icon work: `cargo xtask assets`, `cargo xtask icons`.
+- Never crash: no unwrap/expect/panic/unsafe in non-test code (unsafe allowlist in crash-safety), errors are `Result`, input is hostile: clippy `-D warnings`, `hostile_params_never_panic`.
+- Everything is a command and programmatic calls never open dialogs: `skills/solidcraft-commands/SKILL.md`.
+- Layering (geom, sketch/kernel/render, doc, io, engine, ui-egui, apps); only `crates/kernel` uses truck: `cargo xtask layers`.
+- One outer UI container, one camera path (`navigation::handle`), colours from theme tokens: `cargo xtask ui-containers`.
+- Application code is Rust only and builds for wasm: `cargo xtask wasm`, `cargo xtask web-offline-test`.
+- The product name is SolidCraft; the old name lives only in `docs/compatibility.md`.
+- Sorted lists (message catalogs, `mod` lines, languages) stay sorted: `cargo xtask lists`. Never edit generated files (`docs/features.md`, `THIRD-PARTY-LICENSES.txt`) in a PR.
+- A design-format change is ONE new file in `crates/doc/src/format/pending/`: `scripts/test-format-pending.sh`.
+- A command has input and output schemas (will become required; `schema/unconverted.txt` only shrinks): `skills/solidcraft-commands/SKILL.md`.
+- New UI strings go in `assets/locales/pending/<slug>.json`, ATTRIBUTION rows in `attribution/pending/<slug>.md`: `cargo xtask lists`.
+- A changed default keeps the old behaviour behind a preference and fills the PR's `Changes a default:` line, and no second PR for an issue a lower-numbered one closes: `pr-checks.yml`.
+- A regression test goes in the area's existing test file, never a per-bug file (#3226).
+- Look at open PRs first, claim with a draft PR (lowest number wins), one topic per PR, never force-push `main`, no pushes just to catch up with `main`: `skills/solidcraft-contributing/SKILL.md`.
+- Show observable changes with real screenshots or a recording, captured yourself.
+- Run `cargo xtask ci` before every commit, without switching branches while it runs. `cargo xtask skills` keeps this file and `skills/` honest.
 
-`plan/` is gitignored (local only).
-
-## Never crash
-People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
-- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The exceptions, in the app crate and in
-  `crates/threedx-client` (which deny it instead), have no safe API: the macOS-only
-  `crates/threedx-client/src/macos.rs` (loads the 3Dconnexion driver's client framework at run time
-  and calls through its function pointers), two functions in
-  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
-  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
-  records crashes inside native code such as graphics drivers) and the Windows-only
-  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
-  test of the window without OS decorations).
-- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
-- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
-- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
-- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
-- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
-  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
-  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
-  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
-  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
-- **Where tests go:** a regression test goes into the existing test file for its area (booleans, blends,
-  shell, sweep, STEP, naming…), never a new file named after the bug (#3226).
-- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
-- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
-  general CAD conventions and user feedback. Reference tests use analytic values and open-source
-  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
-  materials. File formats come from public specifications.
-- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
-  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
-  measurements, command lists, ids or files produced with them.
-- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
-  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
-  runs FreeCAD as a separate program through its public scripting API to compute reference values;
-  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
-  operations are our own.
-- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
-  artwork from commercial CAD products — ever.** Command icons are the original SVG masters in
-  `assets/icons/ui/design/svg/`, compiled through `crates/ui-egui/src/icon_svg.rs`.
-  **Before any icon, icon assignment or media edit, read `assets/AGENTS.md`,
-  `assets/icons/ui/AGENTS.md` and `assets/icons/ui/STYLE_GUIDE.md`.** Use the canonical
-  bases and named finished references there; never invent a parallel icon style. Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
-- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
-- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
-- **One set of camera controls**: every page or canvas with a camera (viewport, Render
-  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
-  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
-  camera input (a test rejects it).
-- **Application code is Rust only.** Units are millimetres and radians internally; Z is up.
-  Local asset authoring, lint and review tools use Python 3.11+ as documented in
-  `assets/AGENTS.md`; Python is not an application runtime dependency. The application exception is
-  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
-  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
-  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
-- **Publishing**: the repository is github.com/tangency-labs/solidcraft. Changes land through
-  **pull requests** and the **merge queue**: push a branch and open a PR. The heavy CI jobs start
-  when a maintainer adds `approved-for-ci` after reviewing the code. Approved PRs go into the queue
-  with `gh pr merge N -R tangency-labs/solidcraft --squash --auto`; the queue runs the full suite
-  on each group before it lands on `main`. Keep each PR to one topic and one issue, and never
-  force-push `main`. Never commit `plan/`, build dirs (`target*/`) or generated reference data;
-  check `git ls-files` before pushing.
-- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Showing and following through on changes
-
-- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
-  issues and PRs must include actual descriptive screenshots or a short recording from a
-  small reproduction. This includes kernel, geometry, assembly and backend changes whose
-  effects can be shown in the app. Coding agents should run the app and capture this evidence
-  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
-  or result, preferably before and after, with brief reproduction steps, expected/actual
-  behavior and annotations that point out the relevant detail.
-- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
-  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
-  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
-- Use a small public-safe example and check for private designs, paths, account details or
-  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
-  recording; do not commit generated screenshots or videos just to provide review evidence.
-- Throughout the work and before handoff, check the relevant PR's merge status. Don't push to
-  an open PR only to catch up with `main` (no merge of `main`, no Update branch, no rebase for
-  that alone): every push restarts the whole CI run, and `main`'s own run catches what lands in
-  between, to be fixed forward. When you push a change anyway, or GitHub reports a conflict,
-  rebase onto the latest `main` (push your own branch with `--force-with-lease`); never merge
-  `main` into a PR. Resolve conflicts without discarding others' work; never force-push `main`.
-  Don't re-run CI on an unchanged commit: a real failure fails again. Re-run only a job that
-  runner trouble cancelled, with "Re-run failed jobs". Report the PR state you checked and any
-  conflicts resolved. If a PR remains open, keep monitoring it while the task is active and
-  make its pending status clear at handoff; do not claim it merged without checking.
-
-## Before you start: look at what is already open
-- Work with an authenticated GitHub CLI (`gh auth status`) and `git`; the checks below need both.
-- Pull the whole list, not one search: `gh pr list -R tangency-labs/solidcraft --state open --limit 500`
-  (drafts included) and `gh issue list -R tangency-labs/solidcraft --state open --limit 500`. Look for
-  work on the same issue, the same feature under another number, and PRs that change the files
-  you are about to change (`gh pr list ... --json number,title,files`).
-- If someone already has it, comment on their PR or issue instead of opening a second one. Two
-  PRs for one change can't both land, and one of them is wasted work and CI.
-
-## Claim = a draft PR
-- Before working on issue #N, check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
-- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
-  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
-  issue wins**; if yours lost, close it. Opening the PR is the claim: the bot assigns you and
-  labels the issue `in progress` (or says on your PR who holds it). Reference `#N` in the PR title
-  so the bot can find it. Don't claim by editing files; comment `/claim` on the issue only to stake
-  a claim before you have a branch.
-- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
-  comment on it first, then open your own claim (you may start from its branch).
-  This takeover policy is separate from the bot's automatic cleanup deadlines in CONTRIBUTING.md.
-- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
-  and wait while it is over 24; build with `nice`.
-
-## Design file format
-A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
-(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
-`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
-works out the number (the next one while anything is pending), and the release folds pending
-changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
-- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
-  request on a connection carries the launch's token as `"token"`: read it from
-  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
-  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
-- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solidcraft-cli snapshot`.
-- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
-  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
-- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
-  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
-  values never come from a commercial CAD product.
-- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
-`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
-workflow; never regenerate them in a PR.
-
-## Lists many PRs add to
-Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
-(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
-then by id, generated files left to `main`, and a design-format change as one new file.
+## Working on X: read the skill first
+| Working on | Read |
+|---|---|
+| A PR, a claim, review, CI or evidence | `skills/solidcraft-contributing/SKILL.md` |
+| Licences, assets, clean-room, the name | `skills/solidcraft-ground-rules/SKILL.md` |
+| Non-test Rust, hostile input, a crash report | `skills/solidcraft-crash-safety/SKILL.md` |
+| A command, a crate boundary | `skills/solidcraft-commands/SKILL.md` |
+| A dialog, panel, camera, icon, colour | `skills/solidcraft-ui/SKILL.md` |
+| Labels, messages, translations | `skills/solidcraft-ui-text/SKILL.md` |
+| Saving something new in a design, import, export | `skills/solidcraft-file-formats/SKILL.md` |
+| Preferences, a changed default | `skills/solidcraft-preferences/SKILL.md` |
+| Writing or running tests | `skills/solidcraft-tests/SKILL.md` |
+| Slow work, the window thread, wasm | `skills/solidcraft-performance/SKILL.md` |
+| Releases, installers, packages | `skills/solidcraft-packaging/SKILL.md` |
+| Running the app, control channel, MCP tools | `skills/solidcraft-agent-tools/SKILL.md` |
+| Building a part over MCP | `skills/solidcraft-modeling/SKILL.md` |
+| Changing an existing design | `skills/solidcraft-editing/SKILL.md` |
+| A bug report, a crash, a wrong result | `skills/solidcraft-reporting/SKILL.md` |
+| Checking, porting, designs in git | `skills/solidcraft-checking/SKILL.md` |
+| Assemblies, joints, motion | `skills/solidcraft-mechanisms/SKILL.md` |

ATTRIBUTION.md

@@ -14,8 +14,33 @@ Editable drawing code, native projects and shipped exports are collected under `
 
 | File | Author | Source | Licence |
 |---|---|---|---|
+| assets/render/catalog/capabilities.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/capabilities.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/environments.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/environments.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/lighting.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/lighting.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/materials.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/materials.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/quality-presets.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/quality-presets.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| assets/render/catalog/scene-presets.json | SolidCraft contributors | Byte-identical runtime export of docs/render-materials/scene-presets.json; generated and checked by tools/render-library/generate.py | MIT OR Apache-2.0 |
+| examples/chebyshev-motion-trace.json | SolidCraft contributors | Original parametric Chebyshev lambda mechanism and associative-trace demo, constructed from analytic circle intersections; classical link proportions documented at https://doi.org/10.1002/rcs.70095; no external CAD geometry or artwork | MIT OR Apache-2.0 |
+| examples/material-card.json | SolidCraft contributors | original analytic box and explicitly synthetic engineering card; invented illustrative constants, no external material dataset | MIT OR Apache-2.0 |
+| examples/studio/author_sweep.py | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/author_scene.py | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/materials.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded-sweep.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded-render.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-exploded.json | SolidCraft contributors | original editable CAD scene and authoring metadata; no external assets | MIT OR Apache-2.0 |
+| examples/studio/stage1-sweep.json | SolidCraft contributors | original tangent circular-arc CAD cyclorama; no external assets | MIT OR Apache-2.0 |
+| examples/studio/stage1.json | SolidCraft contributors | original editable CAD studio scene; no imported geometry or external image assets | MIT OR Apache-2.0 |
+| examples/studio/stage1-render.json | SolidCraft contributors | original studio camera and lighting parameters | MIT OR Apache-2.0 |
 | examples/render-studio.json | SolidCraft contributors | original procedural box/cylinder enclosure script for the integrated Render workspace | MIT OR Apache-2.0 |
 | examples/render-opaque-studio.json | SolidCraft contributors | original procedural sphere study varying opaque metal fraction and roughness independently; no external assets or engineering data | MIT OR Apache-2.0 |
+| crates/gpu/src/path/denoise.wgsl | SolidCraft contributors | original bounded edge-aware a-trous spatial filter; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/denoise_guides.wgsl | SolidCraft contributors | original deterministic centre-ray material and geometry guide pass; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/shadows.wgsl | SolidCraft contributors | original bounded area, sun and environment visibility transport; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| crates/gpu/src/path/textures.wgsl | SolidCraft contributors | original planar colour and normal map sampling; GPU2 donor d710e31, no external shader source | MIT OR Apache-2.0 |
+| assets/appearances/starter_pack.rs | SolidCraft contributors | original illustrative optical recipes, authored scalar values and future procedural resource descriptors; no measured or external material dataset | MIT OR Apache-2.0 |
+| examples/material-finishes.json | SolidCraft contributors | original procedural sphere study of six illustrative opaque finishes with generic material densities; no external assets or measured optical data | MIT OR Apache-2.0 |
+| examples/render-path-studio.json | SolidCraft contributors | original procedural opaque enclosure, teal insert and metal fasteners for progressive rendering; no imported models | MIT OR Apache-2.0 |
+| crates/gpu/src/path/path.wgsl | SolidCraft contributors | original software BVH traversal and path integration using the existing SolidCraft surface/studio equations; no external shader source | MIT OR Apache-2.0 |
 | crates/gpu/src/pbr.rs | SolidCraft contributors | original WGSL translation of SolidCraft's opaque surface and fixed studio reference, embedded as Rust source; no external shader code | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/icon.json | SolidCraft contributors | approved Icon Composer composition and appearance settings for the original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/Assets/02-grid.svg | SolidCraft contributors | original perspective grid with elliptical radial alpha, exported from VectorCraft | MIT OR Apache-2.0 |
@@ -24,10 +49,12 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/app/macos/exports/Assets.car | SolidCraft contributors | Apple actool compilation of assets/icons/app/macos/source/SolidCraft.icon for macOS; contains original artwork only | MIT OR Apache-2.0 |
 | assets/archive/icons/macos-v1/source/icon.vectorcraft | SolidCraft contributors | retained editable historical VectorCraft source, with named face and background layers; redundant exports retired | MIT OR Apache-2.0 |
 | assets/icons/app/macos/exports/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/icons/app/macos/source/SolidCraft.icon composition | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: two boxes bridged by `surface.blend` (a 40x10 sheet, `solidcraft-cli snapshot` of plan/evidence script ev_blend) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a saddle rim (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch through two sketch lines built by `surface.boundary` with `crown: 0.4` (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
+| assets/models/test_boat.bin | 3DBenchy.com | 3DBenchy.com | Public Domain |
+| assets/models/make_test_boat.py | SolidCraft contributors | original script that packs a model into the compact file above | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: a 24 mm and a 10 mm box bridged by a `surface.blend` sheet (G1 at both edges), rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a skew four-line rim, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a surface through two 3D sketch splines built by `surface.boundary`, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft 0.22.1 itself (`solidcraft --sample`, default dark theme, 1600x1000) | MIT OR Apache-2.0 |
 | assets/samples/exports/0.png | SolidCraft contributors | original Sample Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/1.png | SolidCraft contributors | original Sheet Metal Bracket from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/2.png | SolidCraft contributors | original Hinge Assembly from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
@@ -35,10 +62,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/samples/exports/4.png | SolidCraft contributors | original Bolted Flange from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/5.png | SolidCraft contributors | original Vent Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/scripts.json | SolidCraft contributors | SHA-256 fingerprints of the original sample scripts, generated with the shipped thumbnails | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (2× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
+| docs/screenshots/demo.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/demo.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (15× playback, idle pauses cut, constant-rate camera orbit) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-floating.png | SolidCraft contributors | original UX mockup (Model tab, floating layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-compact.png | SolidCraft contributors | original UX mockup (Model tab, compact docked layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/sketch.png | SolidCraft contributors | original UX mockup (Sketch tab) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
@@ -57,6 +84,24 @@ Editable drawing code, native projects and shipped exports are collected under `
 | docs/book/src/generated/tool-preview.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/tool-preview.json`; gitignored) | MIT OR Apache-2.0 |
 | assets/fonts/liberation-sans/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in assets/fonts/liberation-sans/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
 | assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf | The BIZ UDGothic Project Authors | https://github.com/googlefonts/morisawa-biz-ud-gothic (Google Fonts), unmodified; licence text in assets/fonts/biz-udp-gothic/OFL.txt; used for web UI Japanese font | SIL OFL 1.1 |
+| tests/step-conformance/cone_point.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cone_point_vertex.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_inch.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_placed.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_seam.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/cylinder_twice.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/dome.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/dome_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/far_cylinder.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/grooved_shaft.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/plate_100_holes.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/sheet_disc.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/tiny_pin.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/torus_ring_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-conformance/washer.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-regressions/rod_doubled_edge.step | SolidCraft contributors | written by SolidCraft from the commands of #4598 (a bored rod moved 100 mm and exported); import regression fixture | MIT OR Apache-2.0 |
 | tests/oracle/17-loft/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/17-loft/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/23-bracket-multifeature/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/23-bracket-multifeature/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/28-blind-pocket-fillets/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/28-blind-pocket-fillets/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
@@ -77,21 +122,21 @@ Editable drawing code, native projects and shipped exports are collected under `
 | tests/oracle/61-shaft-keyway/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/61-shaft-keyway/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/63-hinge-knuckle/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/63-hinge-knuckle/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/65-sketch-gear-tooth/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/65-sketch-gear-tooth/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
-
 | assets/appearances/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/appearances/opaque_finishes.rs | SolidCraft contributors | original illustrative opaque finish values; no external dataset, textures or measured engineering data | MIT OR Apache-2.0 |
 | assets/fonts/biz-udp-gothic/OFL.txt | The BIZ UDGothic Project Authors | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/ibm-plex-mono/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/ibm-plex-sans/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/liberation-sans/OFL.txt | Red Hat, Inc.; Liberation Fonts contributors | Unmodified accompanying font licence | SIL OFL 1.1 |
-| assets/icons/app/linux/exports/hicolor/128x128/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/16x16/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/24x24/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/48x48/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/64x64/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/128x128/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/16x16/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/24x24/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/48x48/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft drawing code: the borderless mark, drawn from the faces and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/windows_ico.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft-executable.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
@@ -102,25 +147,37 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/locales/cs.json | potuzai | Czech translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/da.json | SolidCraft contributors | Original Danish translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/de.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/en-GB.json | SolidCraft contributors | English (UK): the English catalog's messages whose spelling differs, in UK spelling | MIT OR Apache-2.0 |
 | assets/locales/en.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/es.json | jawler | Spanish (Spain) translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/fr.json | rlartot | French translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/gl.json | Pablo López (pablopeza) | Galician translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/hu.json | SolidCraft contributors | Original Hungarian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/id.json | SolidCraft contributors | Original Indonesian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/it.json | SolidCraft contributors | Original Italian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ms.json | A.Hakim (a-hakim) | Malay translation of the English message catalog | MIT OR Apache-2.0 |
+| assets/locales/nb.json | SolidCraft contributors | Original Norwegian Bokmål translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/nl.json | SolidCraft contributors | Original Dutch translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pl.json | cyryllo | Polish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/sv.json | SolidCraft contributors | Original Swedish translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pt-BR.json | DuBearte | Brazilian Portuguese translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/ro.json | SolidCraft contributors | Original Romanian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/tr.json | macrulz54 | Turkish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/uk.json | Igor Bronovskyi (BrunIF) | Ukrainian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/vi.json | vandang890615 | Vietnamese translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/zh-TW.json | SolidCraft contributors | Original Traditional Chinese (Taiwan) translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/macos/dmg/background.tiff | SolidCraft contributors | original disk image window background (blueprint sheet: grid, double border, circles, centre lines, leader arrow, title block) drawn by assets/platforms/macos/dmg/make_background.py in IBM Plex Sans/Mono; 1x and 2x representations | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/make_background.py | SolidCraft contributors | authoring script that draws the disk image background (Pillow); not part of any build | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/layout.json | SolidCraft contributors | disk image window size, icon size and icon positions shared by the background script and settings.py | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/settings.py | SolidCraft contributors | dmgbuild settings (MIT, https://github.com/dmgbuild/dmgbuild) for the SolidCraft disk image; original settings, no dmgbuild code copied | MIT OR Apache-2.0 |
 | assets/platforms/macos/Info.plist.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/macos/README.txt | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/windows/solidcraft.en-us.wxl | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
@@ -133,6 +190,22 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/styles/ui/themes/gruvbox-light.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/gruvbox-light-hard.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/gruvbox-light-soft.json | SolidCraft contributors | original SolidCraft theme file mapping SolidCraft's UI colours to the Gruvbox palette's colour values (Gruvbox by Pavel Pertsev, https://github.com/morhetz/gruvbox, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/solidcraft-95.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/platinum-9.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/cupertino.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/green-phosphor.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/amber-phosphor.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/blueprint.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/one-dark.json | SolidCraft contributors | original SolidCraft theme file with colours adapted from the One Dark palette (Atom One Dark by GitHub Atom, https://github.com/atom/atom, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/tokyo-night.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Tokyo Night by enkia, https://github.com/enkia/tokyo-night-vscode-theme, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/solarized-light.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Solarized by Ethan Schoonover, https://github.com/altercation/solarized, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/nord.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Nord by Sven Greb and the Nord contributors, https://github.com/nordtheme/nord, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/high-contrast.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/graphite.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/nosferatu.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Dracula by Zeno Rocha and the Dracula Theme contributors, https://github.com/dracula/dracula-theme, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/catppuccin-mocha.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Catppuccin by the Catppuccin organisation, https://github.com/catppuccin/catppuccin, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/okibi.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Okibi palette (dark) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/akari.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Akari palette (light) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
 | assets/styles/web/loading-logo.svg | SolidCraft contributors | Animation of the SolidCraft mark, built from the paths and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg; original animation | MIT OR Apache-2.0 |
 | assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | crates/io/src/native_cad/fixtures/block.FCStd | SolidCraft contributors | original 10 × 20 × 30 mm test box saved by FreeCAD 1.1.4 run as an external program (`make_block_fcstd.py` beside it); no third-party geometry | MIT OR Apache-2.0 |
@@ -159,6 +232,11 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/flat/redo.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/save.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/settings.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_keyboard.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_monitor.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_mouse.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_palette.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/settings_plug.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/spin.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/style.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/undo.svg | SolidCraft contributors | single-colour application/navigation icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -210,8 +288,57 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/circle_tt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/circle_ttt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/coil.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components_off.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/combine.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/component.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+
+### Render workspace icon drafts
+
+Original SolidCraft drawings, Open for owner review; no runtime assignments.
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/icons/ui/design/svg/model/render_all_shots.svg | SolidCraft contributors | original Camera icon master (64 grid): stacked camera bodies with a lower-right play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_appearance.svg | SolidCraft contributors | original Looks icon master (64 grid): shaded look sphere on the top corner of an accent-shaded cube | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_aspect_frame.svg | SolidCraft contributors | original Camera icon master (64 grid): wide rounded frame with two opposite corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_backdrop.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube in front of a tall upright accent panel | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_cancel.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round stop badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_check.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round check badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_compare.svg | SolidCraft contributors | original Output icon master (64 grid): two grey pictures split by a vertical slider with opposed arrows | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_copy_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere in a square frame offset from a second frame outline | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_execute.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_export_image.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a large outward diagonal arrow at the upper right | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_exposure.svg | SolidCraft contributors | original Camera icon master (64 grid): split light and accent disc with plus and minus marks | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_fit_product.svg | SolidCraft contributors | original Camera icon master (64 grid): grey cube inside four corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_frame_guides.svg | SolidCraft contributors | original Camera icon master (64 grid): rounded frame with a rule-of-thirds grid and four accent nodes | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_from_material.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere struck through above a plain grey slab | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_ground.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube on a slab with an accent contact patch | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lens.svg | SolidCraft contributors | original Camera icon master (64 grid): concentric lens rings around an accent centre | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_library.svg | SolidCraft contributors | original Studio icon master (64 grid): row of three look spheres, middle one accent, on a shelf bar | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_area.svg | SolidCraft contributors | original Lights icon master (64 grid): slanted flat panel above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_by_highlight.svg | SolidCraft contributors | original Lights icon master (64 grid): shaded sphere with a ringed highlight target and dotted stem arriving from above | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_point.svg | SolidCraft contributors | original Lights icon master (64 grid): round source disc with centre dot above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_spot.svg | SolidCraft contributors | original Lights icon master (64 grid): cone source with curved rim above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lighting_presets.svg | SolidCraft contributors | original Studio icon master (64 grid): two stacked cards, the front one holding a light bulb | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_output_size.svg | SolidCraft contributors | original Output icon master (64 grid): picture frame with a diagonal double-headed dimension arrow | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_paint.svg | SolidCraft contributors | original Looks icon master (64 grid): flat brush with an accent tip, light ferrule and slate handle | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_pick_up.svg | SolidCraft contributors | original Looks icon master (64 grid): eyedropper with a grey bulb, slate crossbar and accent sampling tip | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_quality.svg | SolidCraft contributors | original Output icon master (64 grid): three rising bars, the tallest in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_replace_all.svg | SolidCraft contributors | original Looks icon master (64 grid): grey sample sphere with an arrow to an accent sphere beside a second one | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_results.svg | SolidCraft contributors | original Output icon master (64 grid): stack of two pictures, the front one showing a landscape | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_same_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere and three cubes, the two matching cubes ringed | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right plus badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shots_strip.svg | SolidCraft contributors | original Camera icon master (64 grid): strip of three small frames, the middle one in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_solo_light.svg | SolidCraft contributors | original Lights icon master (64 grid): point source and dotted stem inside four corner focus brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_sun.svg | SolidCraft contributors | original Lights icon master (64 grid): source disc with eight short radial rays | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_transparent_background.svg | SolidCraft contributors | original Output icon master (64 grid): grey cube on a checker tile | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_update_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right refresh badge | MIT OR Apache-2.0 |
+
+### UI icon masters (continued)
+
+| File | Author | Source | Licence |
+|---|---|---|---|
 | assets/icons/ui/design/svg/model/compute.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/configuration_table.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/conic.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -296,6 +423,12 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/offset_symmetric.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/import_tray.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/flat/export_tray.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/send.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/stop.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/shield.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/status_recovery.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/frame_member.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_environment.svg | SolidCraft contributors | original Studio icon master (64 grid): dome with a grey cube inside | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/placeholder.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane_angle.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -437,6 +570,17 @@ Editable drawing code, native projects and shipped exports are collected under `
 
 | docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |
 | docs/sponsors/blacksmith-ci-powered.png | Blacksmith (blacksmith.sh) | "CI powered by Blacksmith" sponsor banner supplied by Blacksmith for the sponsorship credit; used only to credit the sponsor, not part of the application | © Blacksmith, used with permission |
+| assets/icons/ui/design/svg/model/path_flange.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| docs/book/src/generated/hem.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/hem.json`; gitignored), original sheet metal demonstration | MIT OR Apache-2.0 |
+| docs/book/scripts/hem.json | SolidCraft contributors | original parametric recipe for an 80 × 50 mm sheet with an 8 mm returned edge, authored for the command guide | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay.json | SolidCraft contributors | original SolidCraft theme file (Clay, light): warm paper palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay-dark.json | SolidCraft contributors | original SolidCraft theme file (Clay Dark): warm charcoal palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/cone.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/locales/ar.json | Abdullah (A-AL-ANAZI) | Original Arabic translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/he.json | SolidCraft contributors | Original Hebrew translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/cga.json | SolidCraft contributors | original SolidCraft theme file using the 16 colours of the IBM Color Graphics Adapter (black, cyan, magenta, and white of its high-intensity palette 1 for the interface) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit-dark.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
 
 ## Code adapted from sibling projects
 
@@ -479,9 +623,9 @@ crates/engine/src/tests/gltf_import.rs); no third-party models are committed.
 ## FreeCAD and Rhino import library
 
 FreeCAD `.FCStd` and Rhino `.3dm` files are read with [cadmpeg](https://github.com/cadmpeg/cadmpeg)
-0.6.1 (Apache-2.0), linked as the crates `cadmpeg-core`, `cadmpeg-ir`, `cadmpeg-registry`,
+0.6.3 (Apache-2.0), linked as the crates `cadmpeg-core`, `cadmpeg-ir`, `cadmpeg-registry`,
 `cadmpeg-container`, `cadmpeg-codec-freecad`, `cadmpeg-codec-rhino` and `cadmpeg-codec-step`
-in native builds (`crates/io/src/native_cad.rs`). Only those open-format codecs are built: no
+in native and browser builds (`crates/io/src/native_cad.rs`). Only those open-format codecs are built: no
 default features, so cadmpeg's codecs for commercial CAD formats and its ShapeManager/ACIS
 codec are not compiled in. Its licence text is in THIRD-PARTY-LICENSES.txt; no code from it is
 copied into SolidCraft.
@@ -514,3 +658,453 @@ A frame whose meshes the GPU refuses to stage (device lost or out of memory) is
 skipped with a warning instead of panicking (#1469).
 Paint callbacks are prepared only after a drawable is acquired, so a skipped
 surface frame cannot strand cached meshes without their GPU initialization.
+
+## Runtime studio lighting mathematics
+
+`crates/gpu/src/path/path.wgsl` implements the power-heuristic estimator from the
+mathematical description in [PBRT fourth edition, section 13.4](https://pbr-book.org/4ed/Light_Transport_I_Surface_Reflection/A_Better_Path_Tracer).
+No PBRT code or assets were copied. `crates/render/src/job/lighting.rs` evaluates
+[Krzysztof Narkowicz's published 2016 ACES rational fit](https://knarkowicz.wordpress.com/2016/01/06/aces-filmic-tone-mapping-curve/)
+using its published coefficients (author licenses the fit under CC0/MIT).
+These original implementations are under SolidCraft's MIT OR Apache-2.0 licence.
+
+## Original coffee framing variant
+
+| File | Author | Provenance | Licence |
+|---|---|---|---|
+| examples/studio/author_coffee_framing.py | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing-sweep.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing-render.json | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-framing.md | SolidCraft contributors | original editable composition, camera and documentation; no external assets | MIT OR Apache-2.0 |
+
+## Original cylindrical coffee housing variant
+
+| File | Author | Provenance | Licence |
+|---|---|---|---|
+| examples/studio/author_coffee_cylinder.py | SolidCraft contributors | original parametric cylindrical CAD construction and editable command recipes; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder.json | SolidCraft contributors | original cylindrical housing on the original exploded coffee composition; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder-sweep.json | SolidCraft contributors | original cylindrical housing and continuous CAD cyclorama; no external assets | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder-render.json | SolidCraft contributors | original camera, studio lighting and optical settings retained from the framing variant | MIT OR Apache-2.0 |
+| examples/studio/coffee-cylinder.md | SolidCraft contributors | original dimensional recipe, provenance and validation limitations | MIT OR Apache-2.0 |
+
+## Runtime environment sampling
+
+`crates/render/src/lighting/environment.rs` and the environment/sun portions of
+`crates/gpu/src/path/path.wgsl` are original SolidCraft implementations of
+solid-angle importance sampling and MIS, informed by the mathematical description
+in [PBRT fourth edition, sections 12.5](https://pbr-book.org/4ed/Light_Sources/Infinite_Area_Lights)
+and [13.4](https://pbr-book.org/4ed/Light_Transport_I_Surface_Reflection/A_Better_Path_Tracer).
+The procedural gradient and inline RGBE test fixtures are original mathematical
+colours, not downloaded imagery. No third-party environment images or shader code
+are included. Licence: MIT OR Apache-2.0.
+
+## Original tumbler showcase assets
+
+The CAD room, tumblers, window opening, wood/weave patterns and RGBE sky below
+are original SolidCraft contributor work. No third-party scene, photograph, HDRI,
+texture, or AI-generated artwork was used. Python authoring sources are included.
+All listed files use the repository MIT OR Apache-2.0 licence.
+
+| File | Source / author | Use | License |
+| --- | --- | --- | --- |
+| examples/studio/author_showcase.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/author_tumblers.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/ATTRIBUTION.md | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/author_textures.py | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/environment-manifest.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/textures/manifest.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-hdr-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-hdr-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-materials.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-sun.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-textures-blocked-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers-textures-render.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+| examples/studio/tumblers.json | Original SolidCraft contributors | Editable scene / runtime resource / reproducible authoring metadata | MIT OR Apache-2.0 |
+
+The original studio generators produce local ignored PNG maps and an RGBE gradient.
+Generated image bytes are not source assets; their authorship, licences and expected
+hashes are documented under `examples/studio/textures`. Rendered evidence belongs
+on the results branch. No photographs, scans or external image assets are included.
+
+## Additional render and showcase resources
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/render/starter/tools/check_all.py | SolidCraft contributors | original read-only authored/native resource validation orchestration and evidence receipts | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_check_all.py | SolidCraft contributors | original validation-runner regression fixtures and subprocess tests | MIT OR Apache-2.0 |
+| assets/render/starter/tools/requirements.txt | SolidCraft contributors | pinned offline authoring tool requirements; no application dependency changes | MIT OR Apache-2.0 |
+| crates/render/examples/validate_starter.rs | SolidCraft contributors | original native resource conformance checker using public SolidCraft decoding, normalization, sampling and mip APIs | MIT OR Apache-2.0 |
+| .gitattributes | SolidCraft contributors | original canonical line-ending policy for the existing runtime icon-discovery manifest; no artwork or icon-assignment changes | MIT OR Apache-2.0 |
+| assets/render/.gitattributes | SolidCraft contributors | original canonical line-ending policy for SHA-256-pinned renderer authoring resources | MIT OR Apache-2.0 |
+| docs/render-materials/.gitattributes | SolidCraft contributors | original canonical line-ending policy for SHA-256-pinned renderer authoring resources | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/assembly-bench-soft.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/automotive-turntable.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/black-metal-strips.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/cnc-overhead.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/esd-bench-neutral.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/fdm-neutral-inspection.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/garage-door.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/hangar-skylight.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/home-workbench.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/makerspace-worklights.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/mechanical-bay.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/neutral-comparison.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/neutral-side-softbox.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/paint-inspection-bands.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/printed-part-photo.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/rework-offset-strips.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/robot-led-editorial.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/showroom-ribbons.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/spacecraft-clean-bay.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/sun-free-overcast.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/vacuum-black.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/warm-table-window.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/white-enveloping-studio.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/exports/woodshop-window.hdr | SolidCraft contributors | original analytic relative-radiance HDR export; recipe, linear-sRGB primaries and SHA-256 in assets/render/starter/environments/manifest.json; not measured photometry | MIT OR Apache-2.0 |
+| assets/render/starter/environments/manifest.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/environments/source/recipes.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/lighting/exports/rigs.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/lighting/recipe.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-001/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-002/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-003/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-004/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-005/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-006/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-007/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-008/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-009/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-010/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-011/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-012/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-013/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-014/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-015/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-016/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-017/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-018/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-019/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-020/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-021/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-022/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-023/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-024/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-025/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-026/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-027/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-028/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-029/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-030/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-031/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-032/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-033/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-034/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-035/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-036/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-037/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-038/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-039/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-040/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-041/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-042/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-043/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-044/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-045/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-046/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-047/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/base_color.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/height.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/metallic.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/normal_open_gl.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/exports/SURF-048/roughness.png | SolidCraft contributors | original deterministic periodic PBR map export; recipe, role, scale and SHA-256 in assets/render/starter/materials/manifest.json; not measured material data | MIT OR Apache-2.0 |
+| assets/render/starter/materials/manifest.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/materials/source/recipes.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/pack.json | SolidCraft contributors | original clean-room renderer resource recipe or manifest; authored/unbound scope and source receipts in assets/render/starter/README.md | MIT OR Apache-2.0 |
+| assets/render/starter/tools/environments.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/lighting.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/materials.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_environments.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_lighting.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/test_materials.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/starter/tools/validate_pack.py | SolidCraft contributors | original clean-room offline resource authoring, numerical verification or validation tool; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/licenses/UFL.txt | Canonical Ltd. | exact Ubuntu Font Licence 1.0 notice retained from https://github.com/0xlillith/solidcraft-rover/blob/b32437915372d32b71419dc8f5143fe22ff1e869/UFL.txt for the modelled Ubuntu Light lettering | Ubuntu Font Licence 1.0 |
+| assets/render/selene/materials/appearance-pack.json | SolidCraft contributors | original clean-room English appearance authoring data: 48 illustrative opaque PBR projections with separate advanced target specifications; no measured dataset or external assets | MIT OR Apache-2.0 |
+| assets/render/selene/materials/appearance-swatches.json | SolidCraft contributors | original analytic command script for 48 opaque box swatches and a support base, derived only from the adjacent original appearance pack; no external artwork or engineering properties | MIT OR Apache-2.0 |
+| assets/render/selene/models/SELENE-functional.solidcraft | SolidCraft contributors (native enhancements); 0xlillith (original rover); SychPL / Mateusz Sych (supplied showcase assembly); Canonical Ltd. (lettering outlines) | native-command derivative of the unchanged author-supplied source, with original bearing, suspension, gripper, electronics and presentation work; source and final hashes in assets/render/selene/SOURCE.md and VALIDATION.md | Model and showcase contributions: MIT OR Apache-2.0 (explicit SychPL grant https://github.com/tangency-labs/solidcraft/pull/5494#issuecomment-6375788360); lettering: Ubuntu Font Licence 1.0, notice retained in assets/render/selene/licenses/UFL.txt |
+| assets/render/selene/motion/interference-pairs.json | SolidCraft contributors | original authored exact-body pair selection for bounded native clearance checks on the functional SELENE derivative; not a generated collision result | MIT OR Apache-2.0 |
+| assets/render/selene/motion/mechanism-acceptance.json | SolidCraft contributors | original kinematic acceptance criteria, inspected source-container bindings and analytic planning checks from cited public SolidCraft documentation and the admitted native source; derivative runtime acceptance is recorded separately | MIT OR Apache-2.0 |
+| assets/render/selene/motion/preflight-commands.json | SolidCraft contributors | original read-only inventory script using existing project commands; no source-model selectors or state mutations | MIT OR Apache-2.0 |
+| assets/render/selene/motion/sample-sequence.json | SolidCraft contributors | original future lunar sampling and sealed-vial dynamics state specification; no simulation or physical calibration result | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/roles.json | SolidCraft contributors | original semantic role and candidate-material authoring specification for the prepared SELENE demo; no native geometry or external assets bundled | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/shots.json | SolidCraft contributors | original shot, framing and staged-sequence authoring specification for the prepared SELENE demo; no render or simulation result claimed | MIT OR Apache-2.0 |
+| assets/render/selene/scenes/stages.json | SolidCraft contributors | original stage composition and light-ownership authoring specification derived from the project render catalog; scientific context linked in scenes/README.md | MIT OR Apache-2.0 |
+| assets/render/selene/source-lock.json | SolidCraft contributors | original source-admission metadata and public-reference inventory pinning the supplied improved SELENE native file; original-model and font notices preserved in SOURCE.md | MIT OR Apache-2.0 |
+| assets/render/selene/source/SELENE-showcase.solidcraft | 0xlillith (original rover); SychPL / Mateusz Sych (showcase assembly and helpers); SolidCraft contributors (emblem); Canonical Ltd. (lettering outlines) | unchanged author-published native file from https://github.com/SychPL/solidcraft/blob/32ec1720447e3fcc6bb6cc53a63fb5b39cfa21b9/SELENE-showcase.solidcraft; source hash and license evidence in assets/render/selene/SOURCE.md | Model and showcase contributions: MIT OR Apache-2.0 (explicit SychPL grant https://github.com/tangency-labs/solidcraft/pull/5494#issuecomment-6375788360); lettering: Ubuntu Font Licence 1.0, notice retained in assets/render/selene/licenses/UFL.txt |
+| assets/render/selene/tools/bearings.py | SolidCraft contributors | original native-command authoring of grooved bearings, rolling-element kinematics, clamp hubs and arm/head clearances; analytic geometry, no copied CAD source | MIT OR Apache-2.0 |
+| assets/render/selene/tools/build.py | SolidCraft contributors | original Python development tool for pinned-source native command replay, staged checkpoints, command-trace and geometry health checks; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/electronics.py | SolidCraft contributors | original native-command Raspberry Pi 5 visual reconstruction using public manufacturer mechanical dimensions; original package envelopes and connector internals, no manufacturer CAD or artwork copied | MIT OR Apache-2.0 |
+| assets/render/selene/tools/export_views.py | SolidCraft contributors | original native MCP preview export tool for three reusable showcase views; changes only transient visibility and cameras and verifies the source master hash | MIT OR Apache-2.0 |
+| assets/render/selene/tools/finishes.py | SolidCraft contributors | original native physical-material proxy and opaque PBR assignment generator preserving the supplied rover palette | MIT OR Apache-2.0 |
+| assets/render/selene/tools/mechanisms.py | SolidCraft contributors | original native-command gripper sleeves, pads, wheel ownership, joint limits and inspection studies with independent analytic suspension relation | MIT OR Apache-2.0 |
+| assets/render/selene/tools/prepare.py | SolidCraft contributors | original Python development tool for bounded native-container inspection and reviewed opaque body-assignment preparation; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/presentation.py | SolidCraft contributors | original native-command browser organization, camera/render setups and closed sample-vial glass preparation | MIT OR Apache-2.0 |
+| assets/render/selene/tools/suspension.py | SolidCraft contributors | original native-command trailing-arm suspension, telescoping coilover loops, plain bushings, carrier gussets and local motion clearances derived from the admitted rover geometry; independent analytic pin-distance relation, no copied external CAD | MIT OR Apache-2.0 |
+| assets/render/selene/tools/validate_native.py | SolidCraft contributors | original bounded native MCP verification tool for sampled SELENE kinematics, independent analytic follower and world-coordinate checks, optional exact-name interference pairs and unchanged input hashes; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/validate_prepared.py | SolidCraft contributors | original Python development validator for prepared SELENE resources, source status, references, hashes and command projections; no application runtime dependency | MIT OR Apache-2.0 |
+| assets/render/selene/tools/yaw_supports.py | SolidCraft contributors | original native-command plain yaw journals, flanged brass thrust bushings, recessed axial retaining pins and mounting-head clearances derived from the admitted rover geometry; no copied external CAD | MIT OR Apache-2.0 |
+| assets/render/selene/ui/demo-flow.json | SolidCraft contributors | original progressive-disclosure UI integration specification for the existing Render workspace; no copied UI artwork or runtime registration | MIT OR Apache-2.0 |
+| docs/render-materials/baseline-setup-commands.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/capabilities.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/environment-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/environments.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/lighting.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/lunar-physics-fixtures.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/materials.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/provenance.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/quality-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/roadmap.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/scene-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/selene-bindings.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/simulation-requirements.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/studio-presets.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/ui-integration.json | SolidCraft contributors | original English UI integration specification and exact source-revision mappings from SolidCraft's own implemented shell, UI kit and accepted icons; no copied artwork or runtime registration | MIT OR Apache-2.0 |
+| docs/render-materials/ux.json | SolidCraft contributors | original clean-room English catalog, preset or analytic planning data; external references documented in docs/render-materials/SOURCES.md; no external assets bundled | MIT OR Apache-2.0 |
+| docs/render-materials/validate_catalog.py | SolidCraft contributors | original Python development validator for catalog references, preset composition and analytic specification fixtures; no application runtime dependency | MIT OR Apache-2.0 |
+
+### Built-in render resource adapters (personal integration batch, 2026-10-22)
+
+The original adapters in `crates/engine/src/cmd/render/library.rs`, the generated lookup `library_data.rs` and its generator `tools/render-library/generate.py` project the already attributed starter and SELENE resources without replacing their bytes or authoring manifests. The added scalar texture channels, explicit color/V conventions and immutable-source/GPU-payload sharing are original contributor work under MIT OR Apache-2.0. No external code, commercial CAD data or new third-party imagery was imported. Source metadata and the original authoring attribution remain authoritative; pending runtime acceptance is not a photometric or engineering qualification.
+
+## Physical reference resource additions
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/render/physical/bindings.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/exports/coverage.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/exports/native-cards.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/profiles.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/quantities.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/sources.json | SolidCraft contributors | original physical-reference curation, associations or derived schema-1 export; per-fact public sources retained without relicensing their publications | MIT OR Apache-2.0 |
+| assets/render/physical/tools/check_physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/test_physical.py | SolidCraft contributors | original offline physical-reference validation and projection tool | MIT OR Apache-2.0 |
+| assets/render/physical/tools/export_library.py | SolidCraft contributors | original explicit reference-library planner and native no-loss export verifier; no external code | MIT OR Apache-2.0 |
+| assets/render/physical/tools/test_export_library.py | SolidCraft contributors | original regressions for native capability refusal, source identity and physical-card preservation | MIT OR Apache-2.0 |
+
+| tools/render-library/selene_studio.py | SolidCraft contributors | original bounded native MCP studio orchestration with pinned editable master, explicit GPU policy and request/export receipts; no generated model or image substitutes | MIT OR Apache-2.0 |
+
+| tools/render-library/selene_recipe.py | SolidCraft contributors | original full-detail SELENE material/light composition and analytic camera fit; unchanged pinned native master, no external imagery or measured optical dataset | MIT OR Apache-2.0 |
+| tools/render-library/test_selene_recipe.py | SolidCraft contributors | original independent projection, scaling, nonmutation and input-refusal fixtures for the SELENE studio recipe | MIT OR Apache-2.0 |
+
+| assets/render/selene/scenes/studio-hero.json | SolidCraft contributors | original executable render intent and verified provenance for the selected native SELENE studio showcase; authored RGB appearance and relative light units, not measured optics or simulation results | MIT OR Apache-2.0 |
+| tools/render-library/publish_selene.py | SolidCraft contributors | original bounded native-frame publication checks for explicit visual review, source identity, resource hashes, PNG CRCs and scanline limits; copies completed native bytes without image synthesis or resampling | MIT OR Apache-2.0 |
+| tools/render-library/test_publish_selene.py | SolidCraft contributors | original tiny analytic PNG fixtures for source-size, CRC, expansion, dimensions and explicit-publication-consent regressions | MIT OR Apache-2.0 |
+
+| tools/render-library/package_selene.py | SolidCraft contributors | original byte-preserving packaging of the reviewed native SELENE PNG, public provenance and checksums; bounded resource/PNG verification, no fonts, executables or new render execution | MIT OR Apache-2.0 |
+| .github/workflows/selene-showcase.yml | SolidCraft contributors | original read-only artifact-delivery workflow for the reviewed native SELENE export; existing pinned repository actions, no compilation, package installation, secret use or renderer claims | MIT OR Apache-2.0 |
+
+| tools/render-library/verify_linear_master.py | SolidCraft contributors | original independent validation driver for native linear EXR output using the official OpenEXR Python reader as an external test oracle; no codec implementation copied or production dependency added | MIT OR Apache-2.0 |
+
+## Aging, effects and backgrounds showcase, 2026-10-23
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| tools/render-showcase/instrument.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+| tools/render-showcase/compose.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+| tools/render-showcase/package.py | SolidCraft contributors | original native-scene authoring, checksum-verified editorial assembly or bounded delivery tool; no third-party source or font binary copied | MIT OR Apache-2.0 |
+
+| distribution/SolidCraft-Render-Showcase.zip | SolidCraft contributors and the explicitly credited original model/UI/resource authors | byte-verified selected collaborator package of reviewed native media, editable sample, recipes and public provenance; contained attribution and existing SELENE lettering notices retained; no fonts or executable binaries | MIT OR Apache-2.0 for new contributions; referenced original notices retained |
+| distribution/SolidCraft-Render-Showcase.json | SolidCraft contributors | original verified delivery archive manifest with exact SHA-256, member count and bounded scope | MIT OR Apache-2.0 |

CONTRIBUTING.md

@@ -1,8 +1,10 @@
 # Contributing to SolidCraft
 
+Agents: start from the router in [AGENTS.md](AGENTS.md), which points to a short skill in [`skills/`](skills/README.md) for each kind of work. This page stays the full human guide.
+
 SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
 You sketch on a plane, constrain the sketch, turn profiles into solids, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, macOS, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.
 
@@ -11,10 +13,19 @@ build it, how the code is laid out, the few rules that aren't negotiable, and wh
 needed most.
 
 Before choosing a task, check the [command inventory](docs/features.md) and
-[roadmap](ROADMAP.md) for implemented capabilities and current priorities.
+[roadmap](docs/roadmap-detail.md) for implemented capabilities and current priorities.
 
 Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).
 
+## Kernel work is paused
+
+We're evaluating a new geometry kernel. Until that's decided, please don't open issues, pull
+requests or discussions about kernel work: booleans, fillets, chamfers, shell, offsets, sweeps and
+lofts, threads and holes, STEP/IGES import and export, tessellation, or anything else that changes
+`crates/kernel/`. The pinned issue on the tracker explains it. New ones get the `kernel-paused`
+label (`.github/workflows/kernel-paused.yml`) and a maintainer answers them. Crashes and data loss
+are still taken as issues, and everything outside the kernel carries on as normal.
+
 ## Get it running (about 10 minutes on a fast machine)
 
 You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
@@ -121,8 +132,11 @@ The [architecture page](docs/architecture.md) has the layer table. The short ver
    - Every call into truck goes through `solidcraft_kernel::guard`.
    - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
-   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
+   `crates/engine/src/cmd/` with input and output schemas (see
+   [Adding a command](docs/book/src/dev/commands.md#adding-a-command); a test warns about a
+   command without them, and will fail it once required), engine tests that measure the result (volume, area,
    face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+   A command on the toolbar also ships with its help tooltip (step 6 of Adding a command).
 6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
    viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
    `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
@@ -177,8 +191,16 @@ no LTO, and debug assertions off (truck has debug-only assertions that reject va
 builds several times faster than `--release`. If a test fails only in a plain debug build, say so
 in the PR. `cargo xtask test` builds the tests with it and then runs every test binary at once
 (`cargo test` runs them one after another); arguments after `--` go to each binary, e.g.
-`cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
-depend on wall-clock timing.
+`cargo xtask test -- shell`. Set `SOLIDCRAFT_TEST_JOBS` to a positive integer to opt into a
+shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
+For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
+worker consumes one of those slots. Every binary and side check still runs after failures.
+Without the variable the existing concurrency is unchanged. With it set, each test binary
+inherits `RUST_TEST_THREADS` and `ACTION_MATRIX_JOBS` of `max(1, cpus / jobs)` — the machine's
+parallelism shared between the binaries in flight — unless you set either one explicitly;
+explicit caller overrides always win. Cargo's build-job setting remains an independent caller
+override; this limit does not change test filters, timeouts or baselines.
+Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.
 
 **Ready pull requests test what they touch.** CI maps changed files to workspace packages and
 runs Clippy, the test build and tests for those and their dependents. The
@@ -199,7 +221,7 @@ Check that validation after merging. They are listed in
 `.config/nextest.toml` and the [testing page](docs/book/src/dev/testing.md):
 
 - `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness` and
-  the seeds of `tests::robustness_goldens` (`seed_00` … `seed_95`; pull requests matching the workflow's geometry paths run all but the slowest, `SLOW_SEEDS` in `ci.yml`),
+  the seeds of `tests::robustness_goldens` (`seed_00` … `seed_95`; pull requests that change the kernel, truck or the goldens run all but the slowest, `SLOW_SEEDS` in `ci.yml`),
   `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
   `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
   `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`, the `atomic_commands` contract tests
@@ -259,12 +281,21 @@ and a fresh CI run:
   and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
 - **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
   sorted). Add a new module into the existing group, not as a new group at the end.
+- **Commands without schemas** (`crates/engine/src/schema/unconverted.txt`): sorted, one id per
+  line, and it only shrinks. Converting a command removes its line; a new command is never added
+  to it.
+- **Toolbar commands without help** (`BACKLOG` in `crates/ui-egui/src/command_help.rs`): sorted,
+  one id per line, and it only shrinks. Writing a command's help removes its line; a new command
+  is never added to it.
 - **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
   checks it).
 - **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
   after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
   features`). Don't regenerate or edit them in a pull request.
 - **Design format**: one file per change, never an edit to a shared number (above).
+- **New UI strings and attribution rows**: one new file per change, `assets/locales/pending/<slug>.json`
+  and `attribution/pending/<slug>.md`, instead of editing the catalogs or the ATTRIBUTION.md table;
+  `cargo xtask fold-pending` folds them on `main` (see the README in each folder).
 
 ## Sending a change
 
@@ -316,6 +347,16 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.
 
+To show a picture without committing it, attach the media to the PR (it goes to the PR's own
+attachment storage and renders inline in the comment). A gist is the better home for a log or
+another text file, and you link it; a gist does not render a picture inline. The review artifacts
+stay out of the diff that way, and nothing has to be pushed to a branch of its own.
+
+Attaching works in the browser for anyone who can comment: drag the file into a comment on the
+pull request. A command-line agent without a browser session usually cannot attach a file (the
+upload needs write access to this repository). Say so in the pull request, and the person running
+the agent or a maintainer can attach it.
+
 Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
 `main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
 run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
@@ -331,6 +372,10 @@ owning one area, with a human setting direction and reporting bugs. Their workin
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.
 
+Two quick checks run on every pull request (`.github/workflows/pr-checks.yml`, not required): it
+fails when a lower-numbered open PR by someone else already closes the same issue (the label
+`not-a-duplicate` skips it), or when the description lacks the `Changes a default: no` / `Changes a default: yes — <what>, old behaviour kept behind preference <name>` line (docs-only and bot PRs are exempt).
+
 ## Labels and triage
 
 The triage bot labels every new issue and PR (`.github/workflows/triage.yml`). It only adds labels;
@@ -367,7 +412,7 @@ In order of how much they'd help users:
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
    through without a kernel error. Each failing seed is a reproducible bug.
 3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
-   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
+   [ROADMAP.md](docs/roadmap-detail.md)), but anyone who wants to own one is welcome.
 
 ## Updating the generated feature list
 

Cargo.lock

@@ -590,9 +590,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadmpeg-codec-freecad"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a5257265c2549cf59a8457b3c7aadcc96c95abe20205232553766993a808812"
+checksum = "3c4a8fa61748cbb3ce80838b00a8cebfe553460583941f5aba6e2b97c16b4d37"
 dependencies = [
  "cadmpeg-container",
  "cadmpeg-core",
@@ -601,14 +601,14 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "zip 8.6.0",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-codec-rhino"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d88b42fb91c7e5af4c75c0433029771f7e3233a0b72ec3d0b2e5ff2c72bed07"
+checksum = "d7af41440d4c1d69e88e612de02cc3c9bad79d03429531e640ac924fef53c6bf"
 dependencies = [
  "cadmpeg-container",
  "cadmpeg-core",
@@ -625,53 +625,53 @@ dependencies = [
 
 [[package]]
 name = "cadmpeg-codec-step"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e83a52258c129a683f77fb360ca30af54ae34339625ad890be12621128a5811c"
+checksum = "35e1b6d17cf26b31f59f2edab8ef5c29d2a33216c581fd913f012ad4869bd559"
 dependencies = [
  "base64",
  "cadmpeg-container",
  "cadmpeg-core",
  "cadmpeg-ir",
  "encoding_rs",
+ "serde",
  "serde_json",
  "thiserror 2.0.21",
- "zip 8.6.0",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-container"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c110508cd9155e905f52906de505dfd42dc70a0321f5e90b5f68c28ba207686e"
+checksum = "5ab7bcef48ac7480b4917820272d85cd2c9533e17904e15b0e4d22f19a6045bd"
 dependencies = [
  "cadmpeg-core",
  "crc32fast",
  "flate2",
- "zip 8.6.0",
- "zstd 0.14.2",
+ "zip",
 ]
 
 [[package]]
 name = "cadmpeg-core"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b1147e51a74e7c52da5b393a0344597238cdc622fac6443eb2fd526759f6fa"
+checksum = "e86bb7a40521832504bb1f5953a1c706b2c52aad73bf6d84e1b35e5cb0beae3f"
 dependencies = [
  "flate2",
  "memchr",
  "roxmltree",
+ "ruzstd",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
- "zstd 0.14.2",
 ]
 
 [[package]]
 name = "cadmpeg-ir"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71ff19f019f013d97e353bb802c5d2e253c2859aaa5422009aa933dc2f2e7dbc"
+checksum = "b570a1a8c579e407a9fd7bb10fa1900f8827f1d578b8fcb4ea2a056b5f323c72"
 dependencies = [
  "base64",
  "cadmpeg-core",
@@ -684,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "cadmpeg-registry"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66046f1a694926707bea8944f861e699964b04c68972708588f97e14ccee3c5d"
+checksum = "b2be23469a9bca0b684f1811118fffb581ebd32ded08e6cc8b0716a41f8c1377"
 dependencies = [
  "cadmpeg-codec-freecad",
  "cadmpeg-codec-rhino",
@@ -996,6 +996,15 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.8"
@@ -2271,6 +2280,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "keyring"
 version = "3.6.3"
@@ -2480,6 +2499,24 @@ dependencies = [
  "pxfm",
 ]
 
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "keyboard-types",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "png",
+ "thiserror 2.0.21",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "multiversion_no_op"
 version = "1.0.0"
@@ -3749,6 +3786,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
+[[package]]
+name = "ruzstd"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -4162,7 +4208,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "block2 0.6.2",
  "eframe",
@@ -4171,7 +4217,9 @@ dependencies = [
  "getrandom 0.3.4",
  "hidapi",
  "keyring",
+ "libc",
  "log",
+ "muda",
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
@@ -4181,6 +4229,7 @@ dependencies = [
  "rfd",
  "ron",
  "rustls",
+ "serde",
  "serde_json",
  "solidcraft-3dx-client",
  "solidcraft-engine",
@@ -4193,13 +4242,14 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-3dx-client"
-version = "0.18.0"
+version = "0.25.1"
 
 [[package]]
 name = "solidcraft-cli"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "image",
+ "log",
  "serde_json",
  "solidcraft-engine",
  "solidcraft-gpu",
@@ -4208,7 +4258,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-derive"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4217,7 +4267,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-doc"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "log",
  "serde",
@@ -4234,8 +4284,9 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-engine"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
+ "image",
  "log",
  "schemars",
  "serde",
@@ -4248,12 +4299,13 @@ dependencies = [
  "solidcraft-render",
  "solidcraft-sketch",
  "thiserror 2.0.21",
+ "toml_edit",
  "web-time",
 ]
 
 [[package]]
 name = "solidcraft-geom"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "serde",
  "serde_json",
@@ -4262,15 +4314,18 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-gpu"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
+ "image",
  "log",
  "naga",
  "pollster 0.4.0",
+ "robust",
  "serde",
  "serde_json",
  "solidcraft-engine",
  "solidcraft-geom",
+ "solidcraft-io",
  "solidcraft-kernel",
  "solidcraft-render",
  "thiserror 2.0.21",
@@ -4279,13 +4334,14 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-io"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "cadmpeg-core",
  "cadmpeg-ir",
  "cadmpeg-registry",
  "chardetng",
  "encoding_rs",
+ "gethostname",
  "gltf",
  "log",
  "quick-xml",
@@ -4297,12 +4353,12 @@ dependencies = [
  "solidcraft-geom",
  "solidcraft-kernel",
  "thiserror 2.0.21",
- "zip 9.0.4",
+ "zip",
 ]
 
 [[package]]
 name = "solidcraft-kernel"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "log",
  "proptest",
@@ -4322,7 +4378,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-mcp"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "serde_json",
  "solidcraft-engine",
@@ -4331,7 +4387,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-render"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "image",
  "moxcms",
@@ -4345,7 +4401,7 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-sketch"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "serde",
  "serde_json",
@@ -4356,14 +4412,14 @@ dependencies = [
 
 [[package]]
 name = "solidcraft-space-mouse"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "solidcraft-ui-egui"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "arboard",
  "egui",
@@ -4371,7 +4427,9 @@ dependencies = [
  "image",
  "log",
  "minisign-verify",
+ "nix 0.31.3",
  "pollster 0.4.0",
+ "proc-macro2",
  "semver",
  "serde",
  "serde_json",
@@ -4383,22 +4441,25 @@ dependencies = [
  "tiny-skia",
  "toml",
  "ttf-parser",
+ "unicode-bidi",
  "web-time",
  "winreg",
- "zip 9.0.4",
+ "zip",
 ]
 
 [[package]]
 name = "solidcraft-web"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
  "eframe",
  "egui",
  "js-sys",
  "log",
+ "percent-encoding",
  "serde_json",
  "solidcraft-engine",
  "solidcraft-ui-egui",
+ "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -4645,6 +4706,7 @@ dependencies = [
  "indexmap",
  "toml_datetime",
  "toml_parser",
+ "toml_writer",
  "winnow",
 ]
 
@@ -4839,6 +4901,12 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -4883,6 +4951,12 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-general-category"
 version = "1.1.0"
@@ -5920,10 +5994,15 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.25.1"
 dependencies = [
+ "proc-macro2",
+ "serde",
  "serde_json",
  "sha2 0.10.9",
+ "syn 2.0.119",
+ "toml",
+ "zip",
 ]
 
 [[package]]
@@ -6211,20 +6290,6 @@ dependencies = [
  "syn 3.0.6",
 ]
 
-[[package]]
-name = "zip"
-version = "8.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
-dependencies = [
- "crc32fast",
- "flate2",
- "indexmap",
- "memchr",
- "typed-path",
- "zstd 0.13.3",
-]
-
 [[package]]
 name = "zip"
 version = "9.0.4"
@@ -6264,52 +6329,6 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe 7.3.0",
-]
-
-[[package]]
-name = "zstd"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "057cfd910cfac363a0ada849592624b4c9ff2e10bef504c3433810d78ed96f93"
-dependencies = [
- "zstd-safe 8.1.0",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "8.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd44c6a7284e91f3717755b24315a302edd9153a01f753c3cba3d765e8eafac"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.1.1+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
-dependencies = [
- "cc",
- "pkg-config",
-]
-
 [[package]]
 name = "zune-core"
 version = "0.5.3"

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.18.0"
+version = "0.25.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -13,6 +13,7 @@ authors = ["SolidCraft contributors"]
 repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
+robust = "1.2"
 # internal
 solidcraft-geom = { path = "crates/geom" }
 solidcraft-sketch = { path = "crates/sketch" }
@@ -66,18 +67,24 @@ encoding_rs = "0.8"
 # glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
 # read by crates/io itself, so no image decoding or file access comes with it.
 gltf = { version = "1.4", default-features = false, features = ["names"] }
+# The computer's name in a design's "open elsewhere" lock file (MIT OR Apache-2.0; already in the
+# tree through x11rb).
+gethostname = "1"
 
-# FreeCAD and Rhino import (Apache-2.0, pure Rust apart from zstd; native builds only).
+# FreeCAD and Rhino import (Apache-2.0, pure Rust; native and browser builds).
 # Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
 # features, so cadmpeg's codecs for commercial formats (f3d, sldprt, inventor, catia, creo, nx)
 # and its ShapeManager/ACIS `sat` codec are not compiled in. `step` is the writer we restate through.
-cadmpeg-core = "=0.6.1"
-cadmpeg-ir = "=0.6.1"
-cadmpeg-registry = { version = "=0.6.1", default-features = false, features = ["fcstd", "rhino", "step"] }
+cadmpeg-core = "=0.6.3"
+cadmpeg-ir = "=0.6.3"
+cadmpeg-registry = { version = "=0.6.3", default-features = false, features = ["fcstd", "rhino", "step"] }
 
 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
 ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
 
+# Ends a process group with the system call (MIT; already in the tree through zip).
+nix = { version = "0.31", default-features = false, features = ["signal"] }
+
 # images
 image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
 png = "0.18.1"

DISCLAIMER.md

@@ -0,0 +1,44 @@
+# Disclaimer
+
+This disclaimer covers the software, models, data, documentation and every other file in this
+repository and in the releases built from it (together, "the files").
+
+## No warranty
+
+The files are provided "as is", without warranty of any kind, express or implied, including
+warranties of accuracy, merchantability, fitness for a particular purpose and non-infringement.
+Results produced with the files, such as geometry, meshes, analyses and simulations, can be
+wrong. A qualified person must check them before anyone relies on them for a design,
+manufacturing or safety decision.
+
+## No liability
+
+To the fullest extent permitted by law, Tangency Labs and the contributors are not liable for any
+claim, damage, loss or other liability arising from the files or from their use, modification or
+distribution, whether in contract, tort or otherwise.
+
+## No indemnity
+
+Neither Tangency Labs nor any contributor indemnifies, defends or holds harmless anyone who uses,
+modifies or distributes the files, including against claims that the files infringe someone
+else's rights.
+
+## Harmful or unlawful use
+
+Tangency Labs and the contributors do not authorise, endorse or accept any responsibility for use
+of the files to harm people, animals, property or the environment, or for any unlawful use.
+Whoever uses the files is solely responsible for how they use them, for what they make with them
+and for complying with the laws that apply to them. Tangency Labs and the contributors must not be
+named or held out as responsible for any such use.
+
+## No endorsement
+
+Using, modifying or distributing the files does not mean that Tangency Labs or any contributor
+endorses you, your product or your results. Do not use the name of Tangency Labs or of a
+contributor to suggest such an endorsement without written permission.
+
+## Relation to the licence
+
+This disclaimer adds to the warranty and liability terms of the licence the files are distributed
+under. It does not restrict any right that licence grants; where the two differ, the licence
+governs.

README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" width="96" height="96" alt="SolidCraft" />
+  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" width="96" height="96" alt="SolidCraft" />
 </p>
 
 <h1 align="center">SolidCraft</h1>
@@ -46,13 +46,13 @@
   <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
 </p>
 
-![SolidCraft 0.8: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo-0.8.gif)
+![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)
 
-*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 9× playback. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo-0.8.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
 
 ## Download
 
-- **Windows:** the [installer][windows-msi], or `winget install bherbruck.SolidCraft`.
+- **Windows:** the [installer][windows-msi].
 - **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
 - **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
 - **Web:** [try it in your browser][web-app], no install.
@@ -74,7 +74,7 @@ other is a tracked bug.
 - **Parameters and configurations** with unit-aware expressions.
 - **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
 - **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
-- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.solidcraft` designs.
+- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.sc` designs (`.solidcraft` files from earlier releases still open).
 - **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.
 
 The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
@@ -96,8 +96,10 @@ More commands, the Windows cross-build and the browser build are in [docs/buildi
 
 `solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
 runs its own design session, or with `--connect` it drives the running app so you can watch.
-Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Tools, access rules and an
-example session: [docs/mcp.md](docs/mcp.md).
+Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. If a terminal doesn't find
+`solidcraft-cli` (older Windows installers don't put it on `PATH`), give its full path (by default
+`"C:\Program Files\SolidCraft\solidcraft-cli.exe"`). Tools, access rules and an example session:
+[docs/mcp.md](docs/mcp.md).
 
 ## Scripts
 
@@ -119,6 +121,12 @@ the clean-room and licence rules, and where help is wanted most. Open work is in
 SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
 sponsors its CI minutes.
 
+## Disclaimer
+
+The files in this repository are provided as is, without warranty, liability or indemnity, and
+Tangency Labs and the contributors accept no responsibility for any harmful or unlawful use of
+them: read [DISCLAIMER.md](DISCLAIMER.md).
+
 ## Licence
 
 MIT OR Apache-2.0, at your option. Developed under the

ROADMAP.md

@@ -1,650 +1,82 @@
 # SolidCraft roadmap
 
-Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
-features → parametric timeline) as an open, pure-Rust, agent-drivable application.
+The short version, for people who use SolidCraft. The detailed developer status (milestone
+tables, limitations, measurements) is in [docs/roadmap-detail.md](docs/roadmap-detail.md).
 
-## At a glance
+## What SolidCraft is
 
-| Question | Answer |
-|---|---|
-| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; FreeCAD/Rhino import; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
-| Features | Every registered command by area — [docs/features.md](docs/features.md) (`cargo xtask features`); registry breadth does not establish workflow or geometric depth |
-| Reference tests | [Current case count and results](docs/oracle.md): public cases in `tests/oracle/` with analytic or FreeCAD-computed expected values, checked by the reference-test job in [CI](.github/workflows/ci.yml). |
-| Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
-| Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
-| Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
+SolidCraft is open-source parametric 3D CAD written in Rust. You sketch, constrain, extrude, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app and in the browser
+([try it](https://solidcraft.io/app)), and it has a command-line tool and an MCP server so that
+scripts and AI agents can drive the same commands you use.
 
-Optional GPU viewport ambient occlusion is available in View settings and Graphics preferences,
-with persistent settings, Performance/Quality graphics presets (Quality combines AO, Fine tessellation and adaptive 2× supersampling; manual combinations show Custom), and the
-`view.ambient_occlusion` and `view.graphics_preset` commands. See [display settings](docs/ambient-occlusion.md).
+## Works today
 
-## Scope (owner decision, 2026-10-07)
+- Sketching with a constraint solver, and the usual create and modify tools.
+- Extrude, revolve, loft, sweep, coil, fillet, chamfer, shell, draft, holes, threads,
+  patterns, mirror and split.
+- Parameters with units and expressions, and configurations.
+- Faces and edges keep their names through edits, so references survive changes.
+- Components, assemblies, joints, motion studies and exploded views.
+- Sheet metal with flat patterns and DXF export, and a plastic-enclosure subset.
+- A Render workspace with GPU rendering, studio lighting, materials and image export
+  (first release in 0.22.0).
+- Import and export of STEP, IGES, 3MF, STL, OBJ and DXF, and FreeCAD and Rhino files.
+- Autosave and crash recovery, and the browser build of the same app.
 
-The issue batch adds preservation of blind pockets in through cuts, associative projected
-offsets and plastic face placements, XZ (+Y normal) with a v6 migration preserving older
-designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
-toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
-acceptance scenarios now include board resizes; STEP reopening is automated. See [WIP reconciliation](docs/wip-reconciliation.md).
-Face-based Extrude Join (including outward Press Pull) now defaults to the picked body,
-so edge-touching assembly neighbours stay separate regardless of body order (#226).
+The full list of commands is in [docs/features.md](docs/features.md). Release notes for each
+version are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
 
-In scope, in priority order:
-1. SOLID and SKETCH (now).
-2. Parameters / functional constraints (done: see `parameters.*`, `expr.evaluate`; unit-aware,
-   cycles reported with their path, rename follows references, deletes list their users):
-   user parameters with units and expressions (+-*/, ^,
-   parentheses, sin/cos/sqrt/min/max/floor/ceil/round, unit conversion), model parameters
-   d1, d2… for every dimension and feature input, references between parameters with a
-   dependency graph and cycle detection, re-evaluation on change, comments, favourites,
-   CSV/JSON import and export.
-3. Components and assemblies with joints (M9).
-4. SHEET METAL: flange, contour flange, bend, unfold/refold, flat pattern with DXF export, sheet
-   metal rules (thickness, K-factor, bend radius) (M10).
-5. A small PLASTIC subset for enclosures, after sheet metal: Boss, Rib, Web, Lip/Groove, Snap Fit.
+## In progress now
 
-Deferred until further notice: MESH, FORM (T-splines), SURFACE beyond what solids need (scope proposed in #772), PCB / 3D
-PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
+Each feature below is a [milestone](https://github.com/tangency-labs/solidcraft/milestones) holding
+the issues for it, so the count shows how far along it is. Counts are as of 2026-10-25, one per
+feature or request. Work merged on a feature branch (`drawings`, `render`) counts as built but
+reaches the app only when that branch merges. They are rough, not a promise.
 
-## Milestones
+- **[Rendering & materials](https://github.com/tangency-labs/solidcraft/milestone/17)**: in progress, 9 of 34 pieces done, 3 of them built only on the `render` branch and in the app when it merges. The basic Render workspace is already in releases (0.22.0); the interface rework (#6281) and the material and light libraries are what is left.
+- **[Drawings](https://github.com/tangency-labs/solidcraft/milestone/8)**: in progress, 3 of 21 pieces built (2 in releases, 1 on the `drawings` branch), and 3 more partly built there (sheets and borders, bill-of-materials types, the paper scene). Not in the app yet: it lands when the `drawings` branch merges. Today you can export the current view as a DXF.
+- **[Sheet metal](https://github.com/tangency-labs/solidcraft/milestone/15)**: in progress, 1 of 30 requests done. Flanges, hems, unfold and flat patterns already work; the 30 are extensions, mostly the per-edge flange options (segments, miters, partial flanges, reliefs) and bend allowance.
+- **[Sketching](https://github.com/tangency-labs/solidcraft/milestone/14)**: in progress, 12 of 50 pieces done. Dimension types, selection and snapping options.
+- **[Solid modeling](https://github.com/tangency-labs/solidcraft/milestone/2)**: in progress, 9 of 50 pieces done. Blends, holes, threads and patterns.
+- **[Assemblies & joints](https://github.com/tangency-labs/solidcraft/milestone/3)**: in progress, 4 of 19 pieces done. Joints, motion studies and exploded views already work; placement rules, linked sub-assemblies, fastener stacks and weldment corners are the pieces left.
+- **[Import & export](https://github.com/tangency-labs/solidcraft/milestone/5)**: in progress, 7 of 39 pieces done. FreeCAD, SolidWorks and point-cloud import, and mesh export options.
+- **[AI agents & MCP](https://github.com/tangency-labs/solidcraft/milestone/18)**: in progress, 2 of 8 pieces done. Agent chat and the MCP server.
+- **[Interface, web app & plugins](https://github.com/tangency-labs/solidcraft/milestone/4)**: in progress, 31 of 96 pieces done. Ribbon redesign, navigation, themes, the web app and plugins.
+- **[SMLib kernel migration](https://github.com/tangency-labs/solidcraft/milestone/1)**: in progress, 1 tracking issue open. The kernel is moving from truck to NVIDIA's SMLib (usd-brep, Apache-2.0) on the `kernel-smlib` branch; it is not in releases yet. Tracked in [#4012](https://github.com/tangency-labs/solidcraft/issues/4012).
 
-| # | Milestone | Status | Hours left |
-|---|---|---|---|
-| M0 | Vertical slice | done | — |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
-| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks; tiny rim edges remain selected instead of nearby wall seams when filleting (#2498) | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
-| M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; optional compact named left feature history with rollback bar, multi-selection and persistent folders above the parts browser), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
-| M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0, plus `crown`), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane, a face or sketch curves swept onto the surface, keeping a side or the picked regions; mutual trim of two surfaces, extended to meet and stitched, #767), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis, Surface Extrude/Revolve/Sweep/Loft from open and closed curves, Offset, Unstitch and Reverse Normal; the continuity-driven core (`kernel/src/bridge.rs`, G0–G3 Hermite rows) with **Blend** (`surface.blend`, #764: edge chains along one or several faces, closed rims paired seam to seam or from picked seams, a dialog), **Match** (`surface.match`), **Boundary** (`surface.boundary`, #763 — two sketch curves exact with G0–G3, three or four as the flat patch of their loop, and curve networks: Coons and Gordon surfaces through sketch, 3D-sketch or edge curves, a point for a three-sided side, G1/G2 against the faces along one direction's edges, joined into their body on request; G1/G2 on two sides that meet at a corner waits for the Gregory-type corner), **Fair** (`surface.fair`, CV fairing), **continuity analysis** (`inspect.continuity`, #770; a toolbar tool with edge markers and a legend, and curvature combs along face isocurves) and a multi-section **loft** with per-end continuity and crown, and guide rails on solid and surface lofts (one or two, scaling or stretching the sections between; #201). Also in the Class-A pass: G1…G4 blend curves in the sketch, chord and variable-radius fillets on curved edges (with honest refusals where the fit cannot hold), and a G2 corner patch where filleted edges meet (kernel; the command refuses until the patch's sections can be sewn to the blends' contacts). Left: bias/form-factor fillet sections (design recorded), a Gregory-type corner, surface Fillet between separate surface bodies (#769), Ruled (#762), Untrim (#761), curved-face Extend (#760), and every remaining #757–#772 item | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), cams (`joint.cam`: a revolute cam drives a slider or revolute follower along a closed sketch profile or the cam's edges, knife, roller or flat followers, worked out again when the profile changes; drives, studies, closed loops, contact sets), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), motion analysis (joint values and a point's path charted over a study as value, velocity and acceleration; the parts that collide along a study, with the steps where they do), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Cam and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
-| M11 | 2D drawings | deferred | — |
-| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
-| M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
-| M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
+## Next
 
-M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
-pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
-retain their saved two-finger scroll preference; camera motion is available through
-`view.navigate` and modifier-aware `ui.move` automation.
+- **[Surfacing](https://github.com/tangency-labs/solidcraft/milestone/16)**: next, 6 of 14 pieces done. Patch, trim, blend and match exist; the rest of the surface toolset is planned.
+- **[Manufacturing / CAM](https://github.com/tangency-labs/solidcraft/milestone/9)**: next, 1 pieces tracked, none done. There is no CAM in SolidCraft yet. Send to Slicer and a first toolpath slice are in review; proposals are [#1153](https://github.com/tangency-labs/solidcraft/issues/1153) and [#1621](https://github.com/tangency-labs/solidcraft/issues/1621).
 
-M11 precursor: File → Export Current View as DXF exports shown placed bodies from the current
-camera as a 2D millimetre drawing, with hidden edges omitted or dashed. Vector occlusion splits
-partly hidden edges and includes curved silhouettes. Repeated part meshes and triangle
-hierarchies are shared; bounded desktop preparation and occlusion use up to eight workers.
-Curves are approximated; drawing sheets,
-annotations and exact projected curves remain deferred. See [view DXF](docs/view-dxf.md).
+Features are not tied to a release or a date. Work lands in the daily releases as it is finished.
+Anything without a milestone, such as bug fixes, is not a feature and is not listed here.
 
-Drawing foundations: [RFC #860](https://github.com/tangency-labs/solidcraft/issues/860)
-and the [foundation ledger](docs/drawing-foundations.md) track the bounded implementation
-packages. The first geometry increment defines validated section records in a plane-local
-frame; the ledger separates that contract from section producers and the Drawing workspace.
+## How releases work
 
-Desktop view DXF export runs in the file-operation worker with five-stage progress and
-cooperative cancellation. Curve tolerance (0.0001–1 mm, default 0.01 mm) is remembered alongside
-the hidden-edge setting. Cancelled exports preserve the model and the previous destination;
-completed drawings publish atomically. The browser still exports synchronously.
+- Releases ship daily, as numbered versions (v0.22.0, v0.22.1) with nightly pre-releases in
+  between. They are delivered through the in-app updater.
+- SolidCraft tells you when a newer stable release exists and never updates without asking.
+  Where it can replace itself safely (AppImage, Windows installer and portable builds) there is
+  an **Update now** button; downloads are checked against the release's SHA-256 list. See
+  [updates and privacy](docs/book/src/guide/updates.md).
+- Design files carry a format number. A new version opens designs from older versions, but an
+  older version refuses a design saved by a newer one (0.22.0 writes format 35, and 0.21.0 and
+  earlier will not open it). Each release's notes say when the format changed. Keep a copy of
+  an important design before you move to a new version.
 
-## Interactive modelling
+## Licence
 
-- Modelled threads preview their cut before OK using the background worker on desktop.
-  Browser users apply the cut with OK to avoid blocking on every edit.
+SolidCraft is licensed MIT OR Apache-2.0, at your option; see [LICENSE-MIT](LICENSE-MIT) and
+[LICENSE-APACHE](LICENSE-APACHE). Versions already released stay available under those licences
+permanently.
 
-- Thread resolves a suggested metric size when a cylindrical face is picked. Diameter and
-  pitch selectors expose the existing metric designation parameter; custom designations stay
-  editable, and Automatic size returns to the face's suggestion. Cosmetic/modelled and
-  full/partial-length options remain available. This does not add tolerance classes or
-  left-hand threads.
-- New Body extrusion and face-offset previews show completed intermediate geometry while a
-  drag continues, then catch up to the exact final value. Changes to the selected geometry,
-  operation or feature still discard obsolete results. Distance arrows and their value boxes
-  follow the current frame's input.
-- Large fine modelled threads use pitch-based helix resolution and tighter faceted
-  reconstruction fallbacks, preserving thin crests and closed shells on large shafts.
+## How to follow along
 
-## Physical material data
-
-- Physical material card validation (#923/#922) provides typed SI mechanical and
-  thermal data, per-property sources/conditions and isotropic/orthotropic stability
-  checks through read-only `material.properties.validate`. It does not assign or
-  persist properties, provide a solver or enable rendering; see
-  [the contract and staged follow-ups](docs/physical-material-cards.md).
-
-- Directional elasticity (#994) queries the validated card in material-local axes
-  through read-only `material.properties.directional`, with source/condition review.
-  It does not assign body frames, predict structural behavior or enable a solver.
-
-## Library foundations (#785, #786, #787)
-
-- Local scalar libraries (#846) inspect/export bounded portable catalogs and copy exact
-  selected appearance/material revisions into existing design definitions in one undo step.
-  Appearance offers local loading/search/export; physical materials use existing commands.
-  This slice is independent of the render stack and does not change the document format.
-  See [the contract and limits](docs/book/src/dev/local-libraries.md).
-
-- Proposed phases cover offline bundled/project/user packs, physical materials and
-  appearances, editable wood mapping, and parameterized component/assembly families.
-  Stable identity/revision, copied design definitions, provenance and resource limits
-  apply from the first implementation. Existing material, appearance and standard-part
-  commands remain the application paths. See [the proposal](docs/book/src/dev/libraries.md)
-  for source/license review and acceptance gates. This is planning only: pack loading,
-  texture rendering and expanded component families are not implemented by this entry.
-
-## Render foundation
-
-- Explicit texture normalization (#1218) produces completed float RGBA with
-  role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
-  opt-in EXIF orientation. It retains high-precision raw samples and records lossy
-  gamut clipping only when explicitly requested. It is not a renderer/resource
-  consumer; see [the supported policy and limits](docs/render-texture-normalization.md).
-
-- Opt-in opaque PBR (#1046) connects persisted surface parameters to the integrated
-  product viewport and CPU PNG, using a fixed direct-light studio. Geometry and mass
-  stay unchanged. HDRI, transmission and textures remain separate gates.
-  See [the consumer and limitations](docs/render-opaque-pbr.md).
-
-- Combined integration is tracked in #842, with independent scalar libraries in
-  #863 and richer PBR/material-card transport in #1086. See [phase boundaries and validation gates](docs/render-integration.md).
-  Render/library consumers use the merged asynchronous picker (#1127). Material-card
-  UI (#1094), texture mapping and HDRI lighting remain explicit follow-ups.
-
-- R4a adds bounded CPU product-image jobs, cancellation and atomic PNG export through
-  engine commands, the Render panel, CLI and persistent MCP. Immutable captures and
-  results stay outside persistence/undo; native workers and cooperative browser tasks
-  share the same work protocol. See [jobs, limits and export](docs/render-jobs.md).
-
-- R3 adds an overlay-free product scene and the integrated Render workspace, with
-  runtime GPU host capabilities, per-document drafts and named camera/background
-  controls. Design keeps its camera and drawing policy. Raster transparency remains
-  approximate; PBR and environments are later slices. See
-  [workspace and scene contracts](docs/render-workspace.md).
-
-- R2 adds bounded named render setups in document format 21 and the read/save
-  `render.settings.get/set` commands. Proven render-only changes preserve geometry
-  and prepared world data through undo/redo and checkpoint restore. This slice does
-  not add a Render workspace, PBR, environments or image jobs; see
-  [settings and refresh policy](docs/render-settings.md).
-- Bounded PNG/JPEG texture admission (#900) validates in-memory sources and returns
-  completed RGBA8 pixels with explicit color/data roles. It is an input utility only:
-  ICC/16-bit normalization, local wood mapping, resource persistence and the renderer
-  consumer remain separate work. See [limits and licensed-file probes](docs/render-texture-input.md).
-
-- The initial opaque surface numerical contract for #1004 provides bounded linear
-  color/metallic/roughness/IOR admission and an original tested direct-light BRDF.
-  The numerical module alone advertises no capabilities; the installed consumer above
-  provides rendering. See
-  [the model, evidence and remaining consumer gates](docs/render-surface.md).
-
-- A bounded cooperative Radiance RGBE input utility is available in L1 render;
-  it does not yet enable HDRI/PBR rendering or a document import command. See
-  [the input contract](docs/render-hdr-input.md) and #813 for integration work.
-- R1 adds renderer-independent backend/profile metadata, strict request resolution and
-  bounded image/scratch admission checks, exposed by the read-only `render.backends`
-  command. It describes the current CPU raster snapshot path without evaluating the model.
-  The legacy Design snapshot route remains unchanged. Later slices above provide the
-  workspace/jobs and opaque PBR; HDRI and optional engines remain future work. See [the contract](docs/render-backends.md)
-  and [the phased proposal (#620)](https://github.com/bherbruck/solidcraft/issues/620).
-
-## Dimensioning and error reporting
-
-- MCP `execute` accepts `verbose: false`, sharing the compact reply helper used by
-  `batch`: body changes and created sketch IDs stay, while repeated lists are omitted.
-  Both tools retain full replies by default.
-
-- Sketch Create groups drawing variants under Line, Rectangle, Circle, Arc, Slot,
-  Polygon and Spline. Each open part remembers its last interactive choice per family
-  across sketch sessions and document-tab switches; closing the part resets these UI choices.
-- Inscribed, circumscribed and edge polygon tools preview their actual outline before
-  placement, including orientation and the selected side count.
-- Construction (X) preserves the active sketch drawing tool, picked anchors and inline
-  dimension values, so line type can change while a shape is in progress.
-- Planar sketch construction previews and hover feedback keep the same dashed pattern as
-  committed geometry; centerlines retain their dash-dot pattern.
-
-- Point has a default Sketch CREATE toolbar button alongside the existing drawing tools.
-  Saved custom layouts are preserved; Reset Toolbar restores the default Point button.
-- Construction planes cannot take an origin-plane name (XY, XZ, YZ, Top, Front, Right). Plane
-  arguments reject such a name when an older design's construction plane already has it. Use
-  the other alias, the construction feature's numeric ID or an explicit plane; existing
-  stored references keep their saved meaning. Section Analysis uses the same check.
-- Sketch text can be edited from a letter interior or outline's context menu or the Edit Text command.
-  Interior selection requires every profile boundary to belong to the same text source;
-  the editor highlights the whole source without replacing profile selections.
-  Content, baseline X/Y, height and rotation update the original text source in one undo step;
-  cancelling or rejecting an invalid value preserves the sketch. Position and height fields
-  use the document units captured when editing starts; generated outlines remain associated
-  with their text source, and untouched inputs preserve their saved internal values.
-  Dragging a text outline moves the entire source in one undo step; Escape restores the
-  gesture. Move/Copy on a selected text outline provides unit-aware X/Y distances and rotation
-  about its baseline; copies keep an independent editable text source.
-- Repeating the initial point of a planar multi-point sketch drawing tool is neutral: the tool
-  waits for a distinct point without a degenerate-shape error or history entry. Typed input
-  and programmatic commands retain their validation.
-- Circular-pattern and angled-plane axes reject explicitly supplied malformed or expression
-  origins instead of silently rotating about zero. Numeric origins remain in millimetres;
-  associative axis expressions and construction-axis references remain unsupported.
-- Single-line and rectangle-side dimensioning supports selecting a line or its two endpoints.
-  Type a value and press Enter to commit one undo step; rejected values remain editable and
-  cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
-  and navigation controls, including enlarged displays and nested pending placements.
-- Sketch Dimension takes a line and a circle or arc (#1803): it measures from the line to the
-  circle's edge (the gap, 0 when tangent, or how far the edge reaches past a line that cuts
-  it), drives it like any other dimension and keeps the circle on its side of the line.
-- Sketch annotations, live drawing lengths and Measure use document units. Inches show
-  three decimals and retain a meaningful fourth digit. Bare length dimension entry captures
-  the current design unit; changing units leaves existing geometry and expressions intact.
-  Component/canvas distance controls, sketch cursor coordinates, flat-pattern dimensions
-  and pocket depths, interference volumes and parts-library lengths also use design units.
-- Curvature and Polygon constraints accept complete preselected operands. Fix/Unfix
-  consumes complete point/curve selections consistently; mixed or ambiguous selections
-  retain the picking workflow. Rejected constraints preserve selection and undo history.
-- Contextual error reporting: a **Create Issue** action beside feature errors opens a
-  reviewable GitHub issue draft with the error, operation settings, build diagnostics and
-  useful reproduction context. The draft is editable, with optional capture of the actual
-  viewport and copy/save controls. Opening GitHub does not submit the issue. Help also exposes
-  reporting for unexpected results that did not produce an error.
-- The header exposes **Report a bug**, including an accessible compact control on
-  narrow windows. It opens the same editable report and screenshot review without
-  changing the active model or a pending dimension.
-- Crash reports: every panic (in a command, in the kernel, anywhere else) and every unclean
-  exit (abort, stack overflow, kill: found at the next start through a locked per-run command
-  journal) leaves a local report with the backtrace, version and commit, the command and the
-  design that reproduce it (`solidcraft-cli crashes replay <id>`). Repeats are counted, not
-  rewritten; at most 20 reports, 50 MB and 90 days. The app shows them after a crash (Help >
-  Crash Reports…) with a reviewed issue draft; agents read them through
-  `diagnostics.crash_reports`, the MCP `crash_reports` tool or the CLI. Nothing is sent
-  anywhere. See [crash reports](docs/crash-reports.md).
-- Agent chat (off by default, desktop): a side panel that drives a coding agent the user
-  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, Grok Build, …) over the
-  Agent Client Protocol, under the user's own login; SolidCraft stores no keys. The agent works
-  through SolidCraft's MCP tools on a gated endpoint of its own: file actions wait for Allow or
-  Deny, crash reports are off limits, 24 changes per message, one undo step per message, and
-  the agent's whole process group ends with the panel or the app. Docks left or right,
-  minimises to a strip. Grok Build discovery includes `~/.grok/bin` and reuses the user's
-  Grok login. See [agent chat](docs/agent-chat.md).
-- Command scripts from designs (#886): `timeline.export_script` (CLI `solidcraft-cli script`)
-  writes a design's history as a script that `eval` and `run` replay into the same design —
-  user parameters, units, sheet metal and plastic rules and materials as their own commands,
-  then each feature through `timeline.add` with its ids, names and dimension parameters kept,
-  so every feature kind replays exactly and a failing feature fails the same way. Trimming the
-  script after a step gives the design at that step. Appearances, folders, views and
-  configurations are listed as left out; components and joints are not supported yet.
-
-## 0.2.0 release batch
-
-- Includes the new axis navigation, adaptive sketch drawing/picking, origin-corner repairs,
-  durable supported profile/face references, endpoint dimensioning and contextual reporting.
-- Smooth ruled-wall display joins are hidden only within the supported geometric certificate;
-  authored splits and actual creases remain protected. Wireframe retains physical edges.
-- Paste New uses a bounded current-geometry comparison for supported convex line/circle
-  prisms with separated circular holes; unsupported shapes retain the existing strict check.
-- Common-bore Union retries check additional boundary curves before recutting the bore,
-  preventing the reproduced thin-web loss. Unknown additional trims refuse; inherited
-  common-cylinder trims retain their existing policy, so this is not a general Boolean proof.
-- Exact full-path assembly joint editing remains separate work and is not part of this batch.
-- Stable 0.2.0 is published: all release payload checksums, native cold reopening, deployed
-  web app and both Flatpak architectures were verified. The replacement README demo uses
-  the original electronics enclosure story and animated pointer in the actual English
-  0.2.0 UI, at 4× playback. Publication follows [the release workflow](docs/releasing.md).
-
-## 0.2.1 critical fixes
-
-- Separated multi-profile Join/Cut extrusions into one solid target batch their tools using
-  conservative construction bounds, avoiding a Boolean rebuild for every profile. Live
-  extrusion previews build only their tools; confirmation validates the final Boolean.
-- Coplanar selected body faces share one linked sketch and one extrusion. Automatic Join/Cut
-  keeps the evaluator's participant scope, including parts of an empty imported component. Desktop OK/Enter
-  computes on a scratch session in the background, with atomic acceptance and cancellation.
-  Planar section stitching projects lines/arcs analytically and removes duplicate endpoints.
-- Imported rotated face groups can check all full start-face seams in one guarded
-  construction. Separated tools may batch a Join when each meets the same single body;
-  nearby uninvolved bodies retain the original contact decisions. Regression comparisons
-  cover all four extrusion operations.
-- Inward multi-face cuts retain every eligible target and subtract separated tools together.
-  Safe interior classification handles roundoff at shared imported line/arc endpoints.
-  Straight extrusion feedback caches existing face/profile triangles and updates the display
-  directly, including a newly opened STEP's single identity component placement; other
-  extents, moved or repeated components and curved sketch profiles keep the Engine preview.
-- The extrusion fixes retain tracked Boolean history and the current `solidcraft` packages.
-  Confirmation and tool previews use main's shared background calculation. Main's collapsed
-  blend-wall refusal and its tests are retained, including smaller valid radii and mirrored parts.
-- Axis view and navigation controls stay anchored to the viewport when feature dialogs or
-  the command palette open, at normal and enlarged display scales. Fit still accounts for
-  dialog coverage; covered controls do not receive clicks through dialogs.
-- Eligible planar faces survive fillet, chamfer and shell operations with exact source
-  certificates. Sketches placed directly on the enclosure wall and inner floor follow
-  width and wall changes, including after the USB cut and cold reopening.
-- Remove artificial straight-wall and rounded-corner subdivisions left by shell and
-  extrusion cuts. Identical generated wall segments span adjacent slabs as one physical
-  face, with exact full-height supports and boundary stitching. Preserve authored face
-  splits and face appearances. Permanent regressions cover material, STEP, reopening and
-  unaffected bodies across the extrusion end plane.
-- Feature dialogs use the available screen height for their fields, with OK and Cancel
-  outside the scrolling region, including enlarged display scales.
-- Design format 13 records shell-face attachments. Older designs remain readable;
-  newly saved designs require 0.2.1 or later. Ambiguous or unsupported faces still refuse
-  attachment rather than guessing a plane.
-- Saved projections from a removed strip retain their geometry and report the lost
-  reference. Explicitly reselect the wall to repair that projection.
-
-## View navigation
-
-- Desktop Ctrl/Cmd +/- and 0 change or reset the saved UI scale. The scale slider keeps
-  its layout stable during a drag and applies the selected scale on release.
-
-- OpenSCAD navigation preset: left drag orbits, right/middle drag pans, Shift+right/middle
-  drag zooms, and the wheel zooms. Available in the shared desktop/web Navigation preferences.
-- Compact clickable signed X/Y/Z axis tips, smooth drag-to-orbit, and Shift-orbit snapping
-  to 26 standard and diagonal views. Pointer motion accumulates independently of a lightly
-  damped spring, with a boundary margin to prevent flicker. Z-up/Y-up and the nearest square
-  top/bottom heading are preserved. Diagonals include 45-degree edge and isometric corner views.
-
-## Known limitations
-
-- Scheduled and manual CI scan locked dependency advisories, bans and sources with
-  cargo-deny. Vulnerabilities fail the scan; unmaintained crates warn. Local vendored
-  patches require separate upstream review because advisory databases cannot version-match
-  their path dependencies. Pull requests retain the existing licence checks.
-
-- Associative shell-face sketches require a unique certified planar source. Nested shell
-  attachments and ambiguous coincident sources remain unsupported.
-- G2 fillets: exact quintic blends of straight edges between planar faces, with one planar
-  end face at each end, including sloped ends (#2708). The UI and `solid.fillet` expose
-  `curvature` (alias `g2`); the size is an equivalent circular setback. Curved faces/edges,
-  multi-face ends and corner junctions remain unsupported.
-- Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
-  rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
-  meet (a sphere for equal radii); perpendicular corner fillets after a closed ring of earlier
-  rounds preserve the ring's radii and the enclosed planar face (#1557);
-  mitres between separate rounds of the same radius keep their endpoint tangent, so a later
-  fillet can select an upright and its adjoining bottom mitre as one chain (#2422);
-  straight edges (convex or concave) between planar faces with perpendicular
-  planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
-  basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
-  corners around pocket rims, with unequal wall slopes and extensions confined to the face;
-  connected equal-distance chamfers also trim each other across unequal sloped rim walls;
-  curved chamfer chains with straight planar ends can terminate across two existing planar
-  bevel faces, splitting their shared seam; picks on the same tangent chain are applied once (#1303);
-  whole smooth loops of a planar face, picked whole or by one edge (tangent
-  chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
-  plate outlines), loops with sharp corners between straight or mixed arc/line edges (straight
-  blends meet in mitres; perpendicular curved walls use offset intersections, with D-rim removal
-  checked within 0.1% of analytic offset slices), runs of
-  neighbouring edges along a planar face's loop (two top edges of a box: mitred, ending square;
-  with the edge between them too, the corner becomes a sphere octant),
-  rounded corners rounded again (sphere octants, tori at concave corners); every edge of a
-  convex planar body or of an extruded part; fillets inside patterns; closed chains of curved
-  edges between any two smooth sides (a branch pipe on a main pipe), by a rolling ball (the
-  blend a rational B-spline through exact arcs), closed or ending at planar faces square to the
-  edges, where straight or curved cap edges are trimmed to the contacts (the straight edge
-  between two overlapping extruded arcs); knife edges, where the two faces have opposite
-  normals (a wall that runs out tangent into a face: the ball that fits there); an edge that
-  runs out along an end face tangent to one side (the arc top edge of that wall), cut where the
-  blend meets it; rounds that end in an earlier round on curved faces, in any order (the rounds
-  of two edges at a vertex meet in a crease, as on a box), picked together or one after the
-  other, except a round after a round of the edge between the wall and a flat face that it
-  would run over; the three edges at a vertex of any smooth faces, of one radius, end in a
-  piece of sphere. A limiting blend that collapses a side wall into coincident boundary
-  curves is refused as too large rather than returning an unmeshable face (#1113).
-- Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
-  sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
-  annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
-  curved wall qualification rejects false transverse axes instead of filling holes.
-  Bodies touching along one whole face
-  (a part and its mirror image) are stitched; coincident planar faces are pushed apart when
-  their neighbours are planes or cylinders. Other coincident curved configurations can still
-  fail. Bounded containment classification preserves fully internal cavities and nested
-  material islands independently of shell order, with STEP round-trip and material-membership
-  regressions. Near-contact curved shells use the general boolean path rather than a
-  containment shortcut. Spheres are built from six pole-free patches.
-- Mass properties come from fine tessellation (curved faces within ~1e-4 relative); triangles
-  that cut through curved faces (trimmed faces after booleans) are split onto the surface first.
-- STEP import (our own reader, crates/kernel/src/step_in) reads solids (B-rep with analytic and B-spline geometry), units,
-  product names, colours and assemblies; analytic offsets on planes, cylinders, cones, spheres
-  and regular tori are read exactly (signed/nested distances, units and face sense). Freeform
-  offset surfaces and pcurve-only edges are not read yet,
-  and assembly components are flattened into bodies. Closed periodic faces (torus, B-spline
-  bands) are split in two for meshing; measure() uses a finer tolerance for small radii.
-- Persistent naming follows the kernel's exact face history (docs/book/src/dev/naming.md):
-  references resolve by name first, follow splits and merges, and warn when the entity split,
-  merged or vanished, or was found by geometry only (operations that report no history yet).
-  New planar sketch attachments use exact box, extrusion cap/side and immutable imported-face
-  source certificates with checked target and author occurrence paths. A missing or changed
-  source fails explicitly; Redefine Sketch Plane previews reattachment or a fixed plane while
-  retaining current geometry and dimension identities. Unsupported modified faces need an
-  explicit fixed plane. Legacy attachments retain their original resolver behavior.
-- Modelled threads are cut as a faceted body (curved faces within 1/200 of the pitch); Extrude
-  and Revolve To Object on a curved face cut the tool back to the target's surface.
-- Explicit sketch breaks preserve exact ellipses, fit/control splines (including high degrees)
-  and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
-  touch (no clean crossing) enter that profile as polylines.
-  Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
-  A sweep with a twist, an end scale or a parallel or direction orientation (#771) follows its
-  path that way too, even along sketch lines and arcs: B-spline walls through stations, ruled
-  walls through denser stations where the path has corners or the profile has holes.
-  Guide rails (one or two, #771) do the same: each station meets every rail once, and the rail
-  turns the profile and scales it (or stretches it across to the rail) against the start; two
-  rails carry it between them. Rails along a path with sharp corners are refused for now.
-- Extend intersects exact ellipses and rational/high-degree splines without moving the line or
-  circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
-  certificate and refine within bounded node limits while retaining existing IDs.
-  At the node limit, geometric certificate subdivisions accommodate unequal spline parameter
-  speeds without changing stored nodes or relaxing the distance tolerance (#971).
-  Associated offset fit nodes stay hidden from display, picking and snapping; dragging the
-  editable source updates the derived boundary live. Break Association restores point editing.
-  Singular, self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
-  closed natural-spline seams remain limitations. New explicitly closed fit splines and closed
-  offset outputs use periodic C2 interpolation, supporting repeated certified offsets; older
-  natural splines are preserved. Clicking the starting fit point deliberately closes a new loop.
-  Newly captured adaptive profile references with complete source coverage retain their outer
-  and hole identities through span-count changes, including parameter edits after extrusion.
-  Partial, intersected or ambiguous boundaries do not qualify for these whole-source references.
-  Legacy curve-span multisets remain exact and unchanged; already-lost selections may need
-  reselection. Format 12 stores the new bounded whole-boundary references.
-  Projected analytic boundaries follow nested loop identities through resizing, including
-  stationary holes and rounded corners. Supported convex, tangent line-and-arc boundaries
-  can lose or regain corner arcs during an inset while preserving reserved curve identities
-  and linked profile selections. Format 12 saves those associations; compatible older closed
-  offsets upgrade structurally without changing their curve IDs. Breaking an association
-  freezes its current boundary and materializes downstream profile references. Child offsets
-  of a boundary with retired arcs still require breaking its association first; mixed or
-  nonconvex junctions and retained references to disappearing individual arcs remain limited.
-- Extrude and Revolve editors retain original direction, extent expressions, explicit targets,
-  axes, From/To inputs and All-profile intent. No-op edits preserve downstream dimension names
-  and selected occurrence frames; cancel and successful edits preserve one-step undo history.
-  Placed feature edits preview through the edited timeline entry, and cylindrical Emboss guides
-  use the sketch's actual target, author or uniquely placed third-component frame.
-  Revolve rotators follow the actual signed axis and support symmetric and two-sided extents;
-  dragging a To Object extent converts its derived value to an explicit angle. Legacy reversed-axis
-  symmetric geometry is preserved through format 11's explicit legacy convention. New revolves
-  use the sketch-normal direction for each selected profile, including To Object and curved
-  target trimming, independently of the selected axis sign.
-- Cylindrical emboss/deboss wraps bounded orthogonal line profiles, including holes, concave
-  outlines and nested islands, onto complete exterior cylinders or coaxial sleeves with exact
-  radial walls. New features infer a unique eligible cylinder when the face field is empty;
-  ambiguous targets require an explicit face. Saved target
-  and author occurrence paths retain the chosen placements; missing/split faces refuse rather
-  than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
-  remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
-- Shell and offset faces work on bodies of planes, cylinders, cones, spheres and tori (convex or not:
-  filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
-  floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
-  sections ruled. Circular-meridian barrels retain curved inner walls through either axial
-  opening (#2421). Solid lofts preserve holes through sections with matching hole counts
-  (#2435), including inner walls and caps with openings; a hole cannot appear or disappear
-  between sections, and sections with holes cannot collapse to a point.
-
-- Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
-  its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
-  the origin; clicked UI regressions verify geometry, closed profiles and undo.
-- Sketch display: drawing, picking, highlighting, tool previews and profile shading share
-  adaptive projected curve boundaries. Fit, zoom, display scale and placed sketch frames
-  invalidate the display cache without changing CAD geometry or timeline history. Work
-  budgets and clipped paths prevent unbounded sampling or invented edges across the eye plane.
-  The Sketch Palette scrolls its options on short windows and enlarged displays while
-  keeping constraint status and Finish Sketch visible.
-- Face projection: closed boundaries have a deterministic outer-first order. Refresh matches
-  existing geometry before assigning positions, retaining saved curve IDs and constraints
-  across enumeration changes and resize, including concentric circles. Ambiguous identities
-  retain the last geometry and report a lost reference; permutation matching is bounded.
-- Project accepts complete supported preselection in one undo step. Visible external sketch
-  curves and points retain their source sketch identity; model geometry, axes and planes use
-  the existing linked projection commands. Rejection preserves the document and selection;
-  mixed selections retain ordinary tool-first picking.
-- Inline sketch dimensions: Tab and Shift+Tab cycle within the active shape's value boxes,
-  selecting visited values for replacement. Expression completion retains forward-Tab
-  priority; real keyboard regressions cover rectangles, lines and single-value circles.
-  Typed lengths, radii, line angles, signed arc sweeps and slot lengths persist as constraints
-  and expressions through save/reopen. Shape creation and its dimensions form one undo step;
-  rejected values keep the editable field focused.
-- Repeated components: Browser selection, visibility, properties, copy and Move/Copy use
-  checked occurrence paths. Active nested occurrences author planar sketches and solids in
-  their selected frame. Pending moves compose through parents; dialog cancellation restores
-  its selected move. Source materials and body/face appearances follow transformed instances.
-  Shared nested definitions remain shared. Deep Paste New copies reachable definition graphs,
-  independent feature/input histories, styles and internal motion records, with bounded geometry
-  checks and explicit external-link notices. Paste New selects the copy while preserving the active
-  authoring context. Imported periodic STEP seams survive placement and reexport with shared
-  topology and appearances intact. Recorded body transfers preserve historical Join/Cut membership,
-  material, placements and machining data through edits, copying, undo and reopen. New 3D wires
-  record their coordinate frame; legacy wires migrate from known provenance without changing
-  coordinates. Broken legacy links with missing provenance can require explicit refresh or relink.
-  See [occurrence workflows](docs/occurrence-workflows.md).
-- Toolbar drops on panel labels, gaps and margins append commands with insertion feedback;
-  button drops keep insert-before ordering.
-- Parameters and Configurations have distinct actions in the SOLID toolbar's CONFIGURE panel.
-  Parameters opens the user/model variable editor; Configurations opens the configuration table.
-  Configure remains available in the panel dropdown.
-- Parameter creation supports Enter with validation and continued keyboard entry. Shared
-  expression autocomplete supports Up/Down selection, Enter/Tab acceptance and Escape dismissal;
-  accepting a suggestion does not submit a parameter or trigger viewport shortcuts.
-- Movable window title bars follow the app's dark/light header palette. Radial right-click
-  menus are opt-in in Preferences > Navigation; ordinary context menus remain the default.
-- Desktop distribution: running Windows windows and executable resources use the app icon;
-  packaging validates icon resources. Nix installs launchers, MIME data and generated icons,
-  with explicit launch apps and Vulkan-loader/driver discovery. Flatpak feed instructions
-  register the required runtime source; release checks exercise desktop modelling on X11/Wayland.
-- OpenGL rendering clamps effective anti-aliasing to 1x across UI pipelines, textures and CAD
-  callbacks to prevent black frames. Other backends retain the requested sample count, and
-  stored preferences remain unchanged.
-- Configuration rules: ordered typed conditions can drive parameters and suppressions or
-  restrict values. Preview explains effective values without modifying the document; applying
-  rules validates rows atomically. Length expressions retain their authoring units across
-  document-unit changes. The UI supports structured All/Any/Not conditions and rule ordering.
-  Component styles and certified semantic face styles are available; unsupported lineage refuses
-  atomically, and stale certified face paint cannot jump to another surface. See [configurations](docs/configurations.md).
-- Sheet-metal material: inherited holes, crossing edge notches, overlapping cuts and retained
-  islands share the same boundaries in flat preview, DXF and unfolded solids. Detached material
-  pieces survive unfold/refold as one logical sheet group, including split flanged sheets.
-  Cut-outs made in the flat pattern cross bends at any angle or curved: their edges fold to
-  helices and curves on the bend, their walls square to the sheet. Free-form bases use bounded
-  sampling.
-  Parallel prismatic partial-depth cuts retain pocket side and depth through transfer and
-  unfold/refold, with separate pocket contours in preview and DXF. Planar Intersect preserves
-  exact holes and retained islands, including the union of multiple selected profiles, and
-  records complementary depth layers as pockets while retaining the stock gauge. Unsupported
-  tapered or bend-crossing machining refuses atomically instead of restoring material later.
-  Sketches attach to a sheet's flat faces (base and flanges, either side) by panel, in the
-  flat pattern's coordinates, and follow it through rebuilds and unfold/refold.
-  A flange on another flange's far edge (a return) follows that flange's closed end and keeps
-  clear of the flange beside it, and the returns of one feature are mitred toward each other
-  with the rule's gap where their flanges meet at a corner; returns of separate features, and
-  flanges on returns, are not closed toward each other.
-- Rolling-ball fillet accuracy: independent offset-cylinder tee references check surface
-  distance, actual trimmed tessellation, supporting-cylinder contacts and tangency at two
-  scales. The measured trimmed-part error is below 0.0001 mm; this is an analytic geometry
-  check. Under-resolved fits return an error.
-- Contact driving checks the trajectory between clear endpoints, including linked joints,
-  playback and sparse motion exports. Checks use bounded tessellation samples, not exact
-  continuous collision detection; local thin walls and small details remain limitations.
-  See [contact-set limits and recovery](docs/contact-sets.md).
-
-## 3D sketch bridges
-
-3D sketch drawing snaps to points on other visible sketch planes without flattening them onto
-the active plane. Bridge endpoints capture their source positions; associative endpoint links,
-construction-plane selection of 3D wires and loft guide rails remain separate work.
-Feature dialog header chevrons collapse and restore the form without discarding selections
-or edited values, including the Appearance panel.
-## Construction on 3D paths
-
-Plane Along Path has a viewport path selector, fractional position, live preview and timeline
-editing. Construction planes and points resolve drawn 3D wires without applying their sketch
-plane a second time. Curved paths use sampled segments; multi-curve chains, absolute distance
-and reference-object placement remain separate work, as do loft rails and centerlines.
-
-## Design properties (#1015)
-
-- Designs carry project, part number, revision, author, organization, description and licence
-  in an optional `metadata` object (File → Design Properties…, `document.metadata.*`,
-  `inspect_design`). STEP and IGES headers and 3MF model metadata take the fields their format
-  has a place for. Other tools keep their own data under a reverse-DNS key, kept as it is
-  through open, edit and save and never exported. See [design properties](docs/book/src/guide/files.md#design-properties).
-  Per-component properties (a part number per component) can follow with the same type.
-
-## Document-opening performance
-
-- Desktop STEP import prepares consecutive independent solids in bounded batches with up
-  to eight workers, retaining serial traversal, result order and persistent source identities.
-  The web path remains serial. Original multi-solid fixtures show 64–81% lower complete
-  import times; single-solid assembly parts are not scheduled across nodes. See
-  [measurements and limits](docs/perf.md#parallel-step-body-preparation-2026-10-12).
-- Design containers (#303, phase one) separate and deduplicate STEP, raw images and
-  lossless binary mesh arrays while keeping plain JSON as a supported Save As/export
-  format. Generated-mesh storage measurements reduce serialization and decoding work;
-  a seekable reader defers original blobs until after provisional display.
-  See [container format](docs/design-container.md) and [performance measurements](docs/perf.md).
-- Warm saves with explicit `cache: true` can include a versioned native B-rep cache through SolidCraft-owned topology
-  and geometry records, with a separate truck adapter and bounded binary reader. Exact
-  face-source certificates and operation history survive codec round trips. A provisional
-  picture can be generated before original blobs are read; editing and measurement wait
-  for authoritative reconstruction. Cached metadata binds preview and reconstruction to
-  the same document despite concurrent file writes. Default saves omit this cache and never force cold
-  evaluation or meshing; explicit `preview: true` remains a separate warm-mesh option.
-  Keys, resource budgets and document/revision guards reject incompatible, hostile or
-  stale results. A second modelling kernel still requires its own tested adapter.
-- Warm saves with explicit `cache: true` can also carry a bounded PNG thumbnail from already cached meshes.
-  Home reads it without rebuilding the design when its local picture is missing;
-  mismatched or malformed thumbnails fall back to normal generation. The image is
-  kernel-independent and saving never forces cold meshing to produce it.
-
-- Cold rebuild profiling separates parsing, geometry, placement, display meshing and
-  thumbnails. Straight-line closest-point projection and exact curved-surface evaluation
-  reuse reduce repeated work without relaxing geometry checks. Three alternating optimized
-  benchmark runs reduce median rebuild time by 26% on the public sensor enclosure and 22%
-  on a local case assembly; shape measurements and topology match the original build.
-  See [performance measurements](docs/perf.md). Further cold Boolean and import costs remain.
-- Prepared assembly geometry survives selection and view changes while real geometry and
-  placement changes invalidate it. A Pi assembly edge-selection probe drops from 9.24 s to
-  0.57 s; initial opening is unchanged. Actual Windows desktop profiling measures 15.87 s
-  median opening, with 82% spent rebuilding geometry; halving full opening remains open.
-
-## Kernel
-
-- Successful Boolean retries report their strategy and numerical adjustments as
-  feature warnings and structured inspection data. Diagnostics survive cached
-  evaluation, undo/redo and cold reopening; the robustness runner counts retry
-  events by strategy and reports any bounded-log truncation. Existing geometry
-  acceptance checks remain in force.
-
-- Cylinders of one radius whose axes cross (a second bore across a bore of the same size, a pipe
-  tee of equal pipes) touch at two points, where the mesh intersection cannot trace the curves
-  and a boolean cannot tell the four arms of the crossing apart. When the ordinary boolean fails
-  on such a pair, both faces are split along the line of their cylinder through the touching
-  points (the solids are unchanged), the boolean is taken of those, and its history is composed
-  back over the operands as given (#788). The result keeps the split lines as edges of the bore
-  walls. A crossing the ordinary route fails on and the split faces do not help (a radius of 17.5
-  in a 45 mm block with a tool of 80 mm) is still refused.
-- Boolean intersection-curve construction refuses point-only, collapsed and non-finite
-  polylines without panicking. Direct constructor regressions retain valid open endpoints
-  and closed spherical intersections; the original interactive trigger remains unidentified.
-- Shell of a stepped, joined planar body no longer creates horizontal subdivisions across
-  continuous walls. Fresh axis-aligned Cut walls are stitched using their exact construction
-  support and shared topology, preserving real steps and intentional boundaries. The local
-  reported case returns from 86 to 49 faces with unchanged material and bounds; regressions
-  cover stepped stock, STEP round trips and saved projections from removed pieces.
-
-truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
-retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.
+- Feature milestones: <https://github.com/tangency-labs/solidcraft/milestones>
+- Issues: <https://github.com/tangency-labs/solidcraft/issues> (area labels such as
+  `area:kernel`, `area:sketch` and `area:ui` group them)
+- Discord: <https://discord.gg/FtU4NQNVDH>
+- Releases: <https://github.com/tangency-labs/solidcraft/releases>
+- Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)

apps/solidcraft-cli/Cargo.toml

@@ -19,10 +19,16 @@ path = "src/main.rs"
 name = "solvecraft-cli"
 path = "src/alias.rs"
 
+[features]
+default = ["raytrace-cpu"]
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
+
 [dependencies]
 solidcraft-engine = { workspace = true }
 solidcraft-gpu = { workspace = true }
 solidcraft-mcp = { workspace = true }
+log = { workspace = true }
 serde_json = { workspace = true }
 
 [dev-dependencies]

apps/solidcraft-cli/examples/studio_evidence.rs

@@ -0,0 +1,151 @@
+//! Reproducible evidence through the production command/job interfaces.
+//! Usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png
+//! Writes the editable design, command timings and actual adapter/job metadata beside PNG.
+//! Accepts runtime requests as well as inline or named saved render jobs.
+use serde_json::{Value, json};
+use solidcraft_engine::{
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, ErrorCode, JobId, Phase},
+};
+use std::{
+    io::Read,
+    path::Path,
+    time::{Duration, Instant},
+};
+
+fn read_json(path: &str) -> Result<Value, String> {
+    let mut bytes = Vec::new();
+    std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?.take(16_777_217).read_to_end(&mut bytes).map_err(|e| e.to_string())?;
+    if bytes.len() > 16_777_216 {
+        return Err("evidence input exceeds 16 MiB".into());
+    }
+    serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))
+}
+
+// Only decide which optional host must be installed. The production command
+// still validates and resolves the actual request without a second wire format.
+fn needs_gpu(session: &Session, params: &Value) -> Result<bool, String> {
+    let inline = params.get("settings").filter(|value| !value.is_null());
+    let named = params.get("setup").filter(|value| !value.is_null());
+    if inline.is_some() && named.is_some() {
+        return Err("choose either setup or settings".into());
+    }
+    let inline_setup = inline
+        .filter(|value| value.get("job").is_some_and(|job| !job.is_null()))
+        .map(|value| serde_json::from_value::<RenderSetup>(value.clone()).map_err(|e| e.to_string()))
+        .transpose()?;
+    let setup = if let Some(name) = named.and_then(Value::as_str) {
+        Some(session.doc.render.setups.get(name).ok_or("no saved render setup with that name")?)
+    } else {
+        inline_setup.as_ref()
+    };
+    if let Some(setup) = setup
+        && let Some(job) = &setup.job
+    {
+        if params.as_object().is_some_and(|object| object.keys().any(|key| !matches!(key.as_str(), "setup" | "settings" | "replace"))) {
+            return Err("saved render jobs cannot be mixed with runtime controls".into());
+        }
+        setup.validate().map_err(|e| e.to_string())?;
+        return Ok(matches!(job, RenderJob::GpuPath { .. }));
+    }
+    Ok(params.get("progressive").and_then(Value::as_bool) == Some(true))
+}
+
+fn run() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let [recipe_path, params_path, output_path] = args.as_slice() else {
+        return Err("usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png".into());
+    };
+    let output = Path::new(output_path);
+    if !output.extension().is_some_and(|e| e.eq_ignore_ascii_case("png")) {
+        return Err("output must have a .png extension".into());
+    }
+    let recipe = read_json(recipe_path)?;
+    let params = read_json(params_path)?;
+    let mut session = Session::default();
+    eprintln!("Generating original CAD scene from {recipe_path}");
+    let generation_start = Instant::now();
+    let (commands, command_timings) = session.run_script_timed(&recipe, false).map_err(|e| e.to_string())?;
+    let generation_seconds = generation_start.elapsed().as_secs_f64();
+    let design_path = output.with_extension(solidcraft_engine::io::DESIGN_EXT);
+    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
+    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
+    let bodies: Vec<Value> = scene
+        .meshes
+        .iter()
+        .map(|mesh| json!({"name":mesh.name,"vertices":mesh.mesh.positions.len(),"triangles":mesh.mesh.triangles.len()}))
+        .collect();
+    drop(scene);
+
+    let cpu_host_start = Instant::now();
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    let cpu_host_seconds = cpu_host_start.elapsed().as_secs_f64();
+    // Match runtime and saved-job dispatch. CPU evidence must not require a
+    // Vulkan device, parse GPU policy or initialize a GPU host.
+    let (adapter_report, gpu_host_seconds) = if needs_gpu(&session, &params)? {
+        let gpu_host_start = Instant::now();
+        let policy = solidcraft_gpu::select::Policy::from_env().map_err(|e| e.to_string())?;
+        let (adapter, report) =
+            solidcraft_gpu::select::pick_vulkan(policy, |_| true).ok_or("no Vulkan adapter satisfies the requested GPU policy")?;
+        session.register_render_job_host(solidcraft_gpu::path::host_on_adapter(&adapter).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+        (Some(report), Some(gpu_host_start.elapsed().as_secs_f64()))
+    } else {
+        (None, None)
+    };
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let start = Instant::now();
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let executor = started
+        .get("resolved")
+        .and_then(|resolved| resolved.get("executor"))
+        .and_then(Value::as_str)
+        .ok_or("started job did not report the resolved image executor")?
+        .to_owned();
+    let id: JobId = serde_json::from_value(started.get("job").cloned().ok_or("missing job id")?).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    eprintln!("Rendering through production {executor} executor");
+    if let Some(adapter) = &adapter_report {
+        eprintln!("GPU adapter: {adapter:?}");
+    }
+    let status = loop {
+        match handle.wait_timeout(Duration::from_secs(10)) {
+            Ok(status) => break status,
+            Err(error) if error.code == ErrorCode::TimedOut && start.elapsed() < Duration::from_secs(3600) => {
+                let status = handle.status().map_err(|e| e.to_string())?;
+                eprintln!(
+                    "Render progress: {:?} {}/{} after {:.1}s",
+                    status.progress.phase,
+                    status.progress.done,
+                    status.progress.total,
+                    start.elapsed().as_secs_f64()
+                );
+            }
+            Err(error) => {
+                let _ = handle.cancel();
+                return Err(error.to_string());
+            }
+        }
+    };
+    let render_and_encode_seconds = start.elapsed().as_secs_f64();
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render did not complete".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":output_path,"overwrite":true})).map_err(|e| e.to_string())?;
+    let report = json!({
+        "recipe":recipe_path,"render_params":params,"executor":executor,"adapter":adapter_report,
+        "environment":{"SOLIDCRAFT_GPU":std::env::var("SOLIDCRAFT_GPU").ok(),"WGPU_BACKEND":std::env::var("WGPU_BACKEND").ok()},
+        "cad_generation_seconds":generation_seconds,"cpu_host_setup_seconds":cpu_host_seconds,"gpu_host_setup_seconds":gpu_host_seconds,
+        "render_and_encode_seconds":render_and_encode_seconds,
+        "timing_scope":"wall time from render.start through completed PNG encoding; includes job preparation and readback, excludes CAD generation, preflight and initial CPU/GPU host setup; GPU setup timing includes adapter selection and pipelines when requested",
+        "bodies":bodies,"commands":commands,"command_timings":command_timings,
+        "preflight":preflight,"export":exported,"editable_design":design_path
+    });
+    std::fs::write(output.with_extension("json"), serde_json::to_vec_pretty(&report).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    println!("{}", serde_json::to_string_pretty(&report).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+fn main() -> Result<(), String> {
+    run()
+}

apps/solidcraft-cli/src/bench_agent.rs

@@ -8,7 +8,7 @@
 //! no fixture.
 //!
 //! ```text
-//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.sc]
 //! ```
 //! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
 //! build total, then the phases `bench-open` prints for the saved design.
@@ -36,8 +36,9 @@ impl Script {
         );
     }
 
+    /// A part placed after it is built: free, even as the design's first part (#2804).
     fn component(&mut self, name: &str) {
-        self.c("component.create", json!({"name": name}));
+        self.c("component.create", json!({"name": name, "grounded": false}));
     }
 
     fn root(&mut self) {
@@ -204,7 +205,10 @@ pub fn run(args: &[String]) -> Result<(), String> {
     );
     let path = match flag("--save") {
         Some(p) => p.clone(),
-        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+        None => std::env::temp_dir()
+            .join(format!("bench-agent-{}.{}", std::process::id(), solidcraft_engine::io::DESIGN_EXT))
+            .to_string_lossy()
+            .into_owned(),
     };
     s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
     let r = crate::cmd_bench_open(std::slice::from_ref(&path));

apps/solidcraft-cli/src/bench_assistant.rs

@@ -0,0 +1,701 @@
+//! `bench-assistant`: the standard Assistant model test (v1, #4851), run against a desktop app.
+//!
+//! The app is already running with `--control PORT`; everything goes through its control channel
+//! (`docs/control-protocol.md`), so the command needs no window code of its own. For each task it
+//! starts a new design, runs the task's prescribed setup (a box, for some), adds the endpoint as an
+//! API agent with All permissions, starts a new chat, sends the prompt once and waits for the turn
+//! to end. The result is checked on the design (`document.inspect` with measurements), never on
+//! what the model says, except for the one question whose answer is the reply. A failed task is
+//! put in one of the issue's failure categories from the conversation's items.
+//!
+//! ```text
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT --base-url URL --model NAME
+//!     [--token T] [--tasks 1,2,5] [--repeat N] [--timeout-s 300]
+//!     [--json out.json] [--markdown out.md]
+//! ```
+//! prints a table of the results; `--markdown` writes the issue's comment template filled in,
+//! `--json` every task's rules, conversation and design before and after.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::{SocketAddr, TcpStream};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+
+/// Standard test v1, as #4851 states it. Changing a prompt or a rule makes it another test.
+const TASKS: &str = r#"[
+  {"id": "01-cube", "prompt": "Make a 20 mm cube.", "check": {"bodies": 1, "volume": 8000, "bbox_size": [20, 20, 20]}},
+  {"id": "02-cylinder", "prompt": "Make a cylinder 30 mm in diameter and 50 mm tall.", "check": {"bodies": 1, "volume": 35342.92, "bbox_size": [30, 30, 50]}},
+  {"id": "03-block", "prompt": "Create a block 60 mm long, 40 mm wide and 10 mm thick.", "check": {"bodies": 1, "volume": 24000, "bbox_size": [10, 40, 60]}},
+  {"id": "04-sketch-extrude", "prompt": "Sketch a 50 by 30 mm rectangle on the XY plane and extrude it 15 mm.", "check": {"bodies": 1, "volume": 22500, "bbox_size": [15, 30, 50], "feature_kinds": ["Extrude"]}},
+  {"id": "05-plate-hole", "prompt": "Make a plate 80 x 60 x 10 mm with a 20 mm diameter hole straight through the middle.", "check": {"bodies": 1, "volume": 44858.41, "bbox_size": [10, 60, 80], "note": "80*60*10 - pi*10^2*10"}},
+  {"id": "06-fillet-box", "prompt": "Round all the edges of the box with a 3 mm radius.", "setup": [{"command": "solid.box", "params": {"length": 40, "width": 40, "height": 40}}], "check": {"bodies": 1, "volume": 63108.53, "tol": 0.003, "feature_kinds": ["Fillet"], "note": "all 12 edges of a 40 mm cube rounded r=3"}},
+  {"id": "07-move-body", "prompt": "Move the box 50 mm along the X axis.", "setup": [{"command": "solid.box", "params": {"length": 20, "width": 20, "height": 20}}], "check": {"bodies": 1, "volume": 8000, "bbox_min": [50, 0, 0]}},
+  {"id": "08-rename-body", "prompt": "Rename the body to Bracket.", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "body_name": "Bracket"}},
+  {"id": "09-volume-question", "prompt": "What is the volume of the part?", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "unchanged": true, "reply_number": "6[ ,. ]?000(?![0-9])|6(\\.0+)? ?cm"}},
+  {"id": "10-two-holes", "prompt": "Make a 100 x 50 x 5 mm plate and drill two 10 mm holes through it, each 15 mm in from the short ends and centred across the width.", "check": {"bodies": 1, "volume": 24214.6, "bbox_size": [5, 50, 100], "note": "100*50*5 - 2*pi*5^2*5"}},
+  {"id": "11-any-change", "prompt": "can you use the software to make a change to the current shape, any change at all", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"changed": true, "note": "verbatim user prompt from #4846; pass = the design changed"}}
+]"#;
+
+/// The agent the test adds. A fixed id replaces it on every run instead of adding another.
+const AGENT_ID: &str = "api-bench-assistant";
+const AGENT_NAME: &str = "bench";
+/// Longest control reply read (the channel's own request limit).
+const MAX_REPLY: usize = 16 << 20;
+/// Most result data kept for `--json`.
+const MAX_RESULTS: usize = 64 << 20;
+/// Deadline of the requests that only set up or read (each is answered at once by the app).
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
+/// How often a running turn is polled.
+const POLL: Duration = Duration::from_millis(250);
+/// After this long, an idle chat with no reply yet counts as a turn that ended without one.
+const START_GRACE: Duration = Duration::from_secs(30);
+/// Absolute tolerance of the lowest corner, in millimetres.
+const MIN_CORNER_TOL: f64 = 0.05;
+
+/// A JSON-lines connection to the app. Requests are sent once; a lost reply is never retried,
+/// so nothing runs twice.
+struct Control {
+    addr: SocketAddr,
+    token: String,
+    reader: BufReader<TcpStream>,
+    id: u64,
+}
+
+impl Control {
+    fn connect(addr: &str, token: Option<&str>) -> Result<Self, String> {
+        let addr: SocketAddr = addr.parse().map_err(|_| format!("--connect: `{addr}` is not an IP address and port"))?;
+        if !addr.ip().is_loopback() || addr.port() == 0 {
+            return Err("--connect requires a loopback address and a nonzero port (the app listens on 127.0.0.1)".into());
+        }
+        let token = solidcraft_engine::control_auth::client_token(addr.port(), token)
+            .map(|t| t.token)
+            .ok_or("no control token: pass --token, set SOLIDCRAFT_CONTROL_TOKEN, or run on the app's computer (its token file)")?;
+        if token.len() > 4096 {
+            return Err("the control token is longer than 4096 bytes".into());
+        }
+        Self::open(addr, token)
+    }
+
+    fn open(addr: SocketAddr, token: String) -> Result<Self, String> {
+        let stream = TcpStream::connect_timeout(&addr, Duration::from_secs(5)).map_err(|e| format!("connecting to {addr}: {e}"))?;
+        Ok(Self { addr, token, reader: BufReader::new(stream), id: 0 })
+    }
+
+    /// A new connection to the same app: a request that outlived its deadline keeps the old one
+    /// busy until it is answered.
+    fn reopen(&self) -> Result<Self, String> {
+        Self::open(self.addr, self.token.clone())
+    }
+
+    fn call(&mut self, method: &str, params: Value, deadline: Instant) -> Result<Value, String> {
+        let left = || deadline.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()).ok_or_else(|| "timeout".to_string());
+        let io = |e: std::io::Error| match e.kind() {
+            std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => "timeout".to_string(),
+            _ => format!("control channel: {e}"),
+        };
+        self.reader.get_ref().set_write_timeout(Some(left()?)).map_err(io)?;
+        self.id += 1;
+        // The first request on a connection carries the token; sending it on every one is allowed.
+        let request = json!({"id": self.id, "method": method, "params": params, "token": self.token});
+        writeln!(self.reader.get_mut(), "{request}").map_err(io)?;
+        let mut line = Vec::new();
+        loop {
+            self.reader.get_ref().set_read_timeout(Some(left()?)).map_err(io)?;
+            let bytes = self.reader.fill_buf().map_err(io)?;
+            if bytes.is_empty() {
+                return Err("the app closed the control connection".into());
+            }
+            let newline = bytes.iter().position(|b| *b == b'\n');
+            let used = newline.map_or(bytes.len(), |n| n + 1);
+            if line.len() + used > MAX_REPLY {
+                return Err("a control reply is larger than 16 MiB".into());
+            }
+            line.extend_from_slice(bytes.get(..used).unwrap_or_default());
+            self.reader.consume(used);
+            if newline.is_some() {
+                break;
+            }
+        }
+        let reply: Value = serde_json::from_slice(&line).map_err(|e| format!("control reply: {e}"))?;
+        if reply["id"].as_u64() != Some(self.id) {
+            return Err("control reply for another request".into());
+        }
+        if reply["ok"] != true {
+            return Err(format!("{method}: {}", reply["error"].as_str().unwrap_or("failed")));
+        }
+        reply.get("result").cloned().ok_or_else(|| format!("{method}: reply without a result"))
+    }
+
+    fn execute(&mut self, command: &str, params: Value) -> Result<Value, String> {
+        self.call("engine.execute", json!({"command": command, "params": params, "animate": false}), Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn chat(&mut self, params: Value) -> Result<Value, String> {
+        self.call("ui.agent_chat", params, Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn inspect(&mut self) -> Result<Value, String> {
+        let design = self.call("document.inspect", json!({"measure": true}), Instant::now() + REQUEST_TIMEOUT)?;
+        if design.is_object() { Ok(design) } else { Err("document.inspect returned no design".into()) }
+    }
+}
+
+fn tasks() -> Result<Vec<Value>, String> {
+    serde_json::from_str(TASKS).map_err(|e| format!("embedded tasks: {e}"))
+}
+
+fn triple(value: &Value) -> Option<[f64; 3]> {
+    match value.as_array()?.as_slice() {
+        [x, y, z] => {
+            let n = |v: &Value| v.as_f64().filter(|n| n.is_finite());
+            Some([n(x)?, n(y)?, n(z)?])
+        }
+        _ => None,
+    }
+}
+
+/// What the model said (thoughts left out).
+fn reply(items: &[Value]) -> String {
+    items.iter().filter(|i| i["thought"] != true).filter_map(|i| i["agent"].as_str()).collect::<Vec<_>>().join("\n")
+}
+
+/// v1's reply pattern `6[ ,. ]?000(?![0-9])|6(\.0+)? ?cm`: "6000", "6 000", "6,000", "6.000" not
+/// followed by a digit, or "6 cm", "6.0cm", … (a narrow no-break space also separates thousands).
+fn volume_reply(text: &str) -> bool {
+    text.match_indices('6').any(|(at, _)| {
+        let tail = text.get(at + 1..).unwrap_or_default();
+        let thousands = |t: &str| t.strip_prefix("000").is_some_and(|rest| !rest.starts_with(|c: char| c.is_ascii_digit()));
+        let separated = tail.strip_prefix([' ', ',', '.', '\u{202f}']).is_some_and(thousands);
+        let cm = {
+            let t = tail.strip_prefix(".0").map_or(tail, |t| t.trim_start_matches('0'));
+            t.strip_prefix(' ').unwrap_or(t).starts_with("cm")
+        };
+        thousands(tail) || separated || cm
+    })
+}
+
+/// The design as the user sees it, without what reading or saving changes (path, saved state,
+/// revision, selection, undo depth, evaluation timings).
+fn content(design: &Value) -> Value {
+    let mut v = design.clone();
+    if let Some(o) = v.as_object_mut() {
+        for key in ["path", "dirty", "revision", "selection", "undo", "redo"] {
+            o.remove(key);
+        }
+    }
+    for feature in v.get_mut("timeline").and_then(Value::as_array_mut).into_iter().flatten() {
+        if let Some(o) = feature.as_object_mut() {
+            o.remove("ms");
+            o.remove("boolean_diagnostics");
+        }
+    }
+    v
+}
+
+/// Whether the design changed: its content, or a step on the undo stack (a colour, say, that the
+/// inspection does not list).
+fn changed(before: &Value, after: &Value) -> bool {
+    content(before) != content(after) || after["undo"].as_u64() > before["undo"].as_u64()
+}
+
+/// The rules a task's result breaks (none: it passed). `before` and `after` are
+/// `document.inspect {measure: true}` before the prompt and after the turn.
+pub(super) fn check(rule: &Value, before: &Value, after: &Value, items: &[Value]) -> Vec<String> {
+    let Some(all) = after["bodies"].as_array() else { return vec!["the design could not be read".into()] };
+    // Bodies the user sees; a hidden one (a tool body, a hidden original) is not the result.
+    let bodies: Vec<&Value> = all.iter().filter(|b| b["visible"] != false).collect();
+    let mut errors = Vec::new();
+    if let Some(n) = rule["bodies"].as_u64()
+        && bodies.len() as u64 != n
+    {
+        errors.push(format!("{} bodies, expected {n}", bodies.len()));
+    }
+    if let Some(expected) = rule["volume"].as_f64() {
+        let tol = rule["tol"].as_f64().unwrap_or(0.01);
+        let volumes: Vec<f64> = bodies.iter().filter_map(|b| b["volume_mm3"].as_f64()).filter(|v| v.is_finite()).collect();
+        let total: f64 = volumes.iter().sum();
+        if volumes.len() != bodies.len() || (total - expected).abs() > expected * tol {
+            errors.push(format!("volume {total:.1} mm³, expected {expected} mm³ ±{}%", tol * 100.0));
+        }
+    }
+    let first = bodies.first().copied().unwrap_or(&Value::Null);
+    let min = triple(&first["bbox"]["min"]);
+    if let Some(mut expected) = triple(&rule["bbox_size"]) {
+        expected.sort_by(f64::total_cmp);
+        let size = min.zip(triple(&first["bbox"]["max"])).map(|(lo, hi)| {
+            let mut size = [hi[0] - lo[0], hi[1] - lo[1], hi[2] - lo[2]];
+            size.sort_by(f64::total_cmp);
+            size
+        });
+        if !size.is_some_and(|s| s.iter().zip(expected).all(|(a, e)| (a - e).abs() <= 0.01 * e.max(1.0))) {
+            errors.push(format!("size {size:?}, expected {expected:?} in any orientation"));
+        }
+    }
+    if let Some(expected) = triple(&rule["bbox_min"])
+        && !min.is_some_and(|m| m.iter().zip(expected).all(|(a, e)| (a - e).abs() <= MIN_CORNER_TOL))
+    {
+        errors.push(format!("lowest corner {min:?}, expected {expected:?}"));
+    }
+    if let Some(name) = rule["body_name"].as_str()
+        && !bodies.iter().any(|b| b["name"] == name)
+    {
+        errors.push(format!("no body named {name}"));
+    }
+    for kind in rule["feature_kinds"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        let live = |f: &&Value| f["suppressed"] != true && f["rolled_back"] != true && f["error"].is_null();
+        if !after["timeline"].as_array().into_iter().flatten().filter(live).any(|f| f["type"].as_str().is_some_and(|t| t.contains(kind))) {
+            errors.push(format!("no {kind} in the timeline"));
+        }
+    }
+    if rule["changed"] == true || rule["unchanged"] == true {
+        let changed = before.is_object() && changed(before, after);
+        if rule["changed"] == true && !changed {
+            errors.push("the design did not change".into());
+        }
+        if rule["unchanged"] == true && (changed || !before.is_object()) {
+            errors.push("the design changed".into());
+        }
+    }
+    if rule["reply_number"].is_string() && !volume_reply(&reply(items)) {
+        errors.push("the reply does not give the volume".into());
+    }
+    errors
+}
+
+/// A tool call written into the reply as JSON: `{"name": …`, `{"command": …`, `{"function": …`,
+/// `{"tool": …`.
+fn call_as_text(text: &str) -> bool {
+    text.match_indices('{').any(|(at, _)| {
+        let rest = text.get(at + 1..).unwrap_or_default().trim_start();
+        ["\"name\"", "\"command\"", "\"function\"", "\"tool\""]
+            .iter()
+            .any(|key| rest.strip_prefix(key).is_some_and(|r| r.trim_start().starts_with(':')))
+    })
+}
+
+/// How a failed task failed, in the issue's words, from the conversation's items.
+pub(super) fn classify(items: &[Value], timed_out: bool) -> &'static str {
+    if timed_out {
+        return "timeout";
+    }
+    let tools: Vec<&Value> = items.iter().filter(|i| i.get("tool").is_some()).collect();
+    // A failed call, or a batch whose answer reports a failed step (`"ok": false`).
+    let failed: Vec<String> = tools
+        .iter()
+        .map(|t| t["output"].as_str().unwrap_or_default())
+        .zip(&tools)
+        .filter(|(output, t)| t["status"] == "Failed" || serde_json::from_str::<Value>(output).is_ok_and(|v| v["ok"] == false))
+        .map(|(output, _)| output.to_lowercase())
+        .collect();
+    let notices: Vec<String> = items.iter().filter_map(|i| i["notice"].as_str()).map(str::to_lowercase).collect();
+    let answer = reply(items);
+    if notices.iter().any(|n| n.contains("http 400")) {
+        return "the endpoint refused tools (HTTP 400)";
+    }
+    if notices.iter().any(|n| n.contains("max_turn_requests")) || answer.contains("requests for one message") {
+        return "hit the request limit";
+    }
+    if call_as_text(&answer) {
+        return "wrote the call as text";
+    }
+    if failed.iter().any(|o| o.contains("unknown command") || o.starts_with("unknown tool")) {
+        return "wrong or unknown command";
+    }
+    if failed.iter().any(|o| o.contains("invalid parameters") || o.starts_with("not run:") || o.contains("not valid json")) {
+        return "wrong arguments";
+    }
+    if !failed.is_empty() || notices.iter().any(|n| n.starts_with("http ")) || items.iter().any(|i| i["error"] == true) {
+        return "gave up after errors";
+    }
+    if tools.is_empty() {
+        return if answer.trim().is_empty() { "an empty reply" } else { "only talked" };
+    }
+    "wrong result"
+}
+
+/// One run's results in the issue's comment template (`run`: which repetition).
+pub(super) fn markdown(model: &str, version: &str, results: &[Value], run: u64) -> String {
+    let clean = |s: &str| s.replace(['\n', '\r', '|'], " ");
+    let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+    let passed = rows.iter().filter(|r| r["passed"] == true).count();
+    let mut out = format!(
+        "### {} (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: {}\nResult: {passed}/11\n| # | pass/fail | how it failed |\n|---|---|---|\n",
+        clean(model),
+        clean(version)
+    );
+    for n in 1..=11 {
+        match rows.iter().find(|r| r["task"] == n) {
+            Some(r) if r["passed"] == true => out.push_str(&format!("| {n} | pass | |\n")),
+            Some(r) => out.push_str(&format!("| {n} | fail | {} |\n", clean(r["failure"].as_str().unwrap_or_default()))),
+            None => out.push_str(&format!("| {n} | | not run |\n")),
+        }
+    }
+    out.push_str(if rows.len() == 11 {
+        "Notes: <anything odd, e.g. very slow, needed a retry>\n"
+    } else {
+        "Notes: partial run; the tasks marked \"not run\" were left out.\n"
+    });
+    out
+}
+
+fn write(path: &str, text: &str) -> Result<(), String> {
+    solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"))
+}
+
+struct Options<'a> {
+    connect: &'a str,
+    token: Option<&'a str>,
+    base_url: &'a str,
+    model: &'a str,
+    tasks: Vec<usize>,
+    repeat: u64,
+    timeout: Duration,
+    json: Option<&'a str>,
+    markdown: Option<&'a str>,
+}
+
+fn options(args: &[String]) -> Result<Options<'_>, String> {
+    const FLAGS: [&str; 9] = ["--connect", "--token", "--base-url", "--model", "--tasks", "--repeat", "--timeout-s", "--json", "--markdown"];
+    let mut given = std::collections::BTreeMap::new();
+    let mut args = args.iter();
+    while let Some(flag) = args.next() {
+        let Some(flag) = FLAGS.iter().find(|f| **f == flag.as_str()) else { return Err(format!("unknown bench-assistant option: {flag}")) };
+        let value = args
+            .next()
+            .filter(|v| !v.starts_with("--") && !v.is_empty() && v.len() <= 4096)
+            .ok_or_else(|| format!("{flag} needs a value (at most 4096 bytes)"))?;
+        if given.insert(*flag, value.as_str()).is_some() {
+            return Err(format!("{flag} given twice"));
+        }
+    }
+    let required = |key: &str| given.get(key).copied().ok_or_else(|| format!("bench-assistant needs {key}"));
+    let number = |key: &str, default: u64, max: u64| -> Result<u64, String> {
+        given
+            .get(key)
+            .map_or(Ok(default), |s| s.parse::<u64>().ok().filter(|n| (1..=max).contains(n)).ok_or_else(|| format!("{key} must be 1 to {max}")))
+    };
+    let tasks = match given.get("--tasks") {
+        None => (1..=11).collect(),
+        Some(list) => {
+            let mut tasks = Vec::new();
+            for n in list.split(',') {
+                let n = n
+                    .trim()
+                    .parse::<usize>()
+                    .ok()
+                    .filter(|n| (1..=11).contains(n))
+                    .ok_or("--tasks takes task numbers 1 to 11, separated by commas")?;
+                if tasks.contains(&n) {
+                    return Err(format!("--tasks lists task {n} twice"));
+                }
+                tasks.push(n);
+            }
+            tasks
+        }
+    };
+    Ok(Options {
+        connect: required("--connect")?,
+        token: given.get("--token").copied(),
+        base_url: required("--base-url")?,
+        model: required("--model")?,
+        tasks,
+        repeat: number("--repeat", 1, 100)?,
+        timeout: Duration::from_secs(number("--timeout-s", 300, 3600)?),
+        json: given.get("--json").copied(),
+        markdown: given.get("--markdown").copied(),
+    })
+}
+
+/// Waits for the turn the prompt started to end. Returns the chat's last state and whether the
+/// deadline passed first.
+fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: Instant) -> Result<(Value, bool), String> {
+    let mut seen_busy = false;
+    loop {
+        let state = chat["state"].as_str().unwrap_or_default();
+        let turn = !chat["turn"].is_null();
+        let queued = chat["pending"].as_array().is_some_and(|p| !p.is_empty());
+        seen_busy |= state == "busy" || turn;
+        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
+        // A turn can start and end between two polls: then the conversation has its answer.
+        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
+        if idle && (seen_busy || answered || matches!(state, "exited" | "failed" | "auth" | "off") || began.elapsed() >= START_GRACE) {
+            return Ok((chat, false));
+        }
+        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
+        std::thread::sleep(POLL.min(left));
+        match control.call("ui.agent_chat", json!({}), end) {
+            Ok(next) => chat = next,
+            Err(e) if e == "timeout" => return Ok((chat, true)),
+            Err(e) => return Err(e),
+        }
+    }
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let o = options(args)?;
+    let tasks = tasks()?;
+    let mut control = Control::connect(o.connect, o.token)?;
+    let help = control.call("ui.help", json!({}), Instant::now() + REQUEST_TIMEOUT)?;
+    let version = help["version"].as_str().filter(|s| !s.is_empty() && s.len() <= 256).ok_or("the app reported no version")?.to_string();
+    let config = control.chat(json!({
+        "features": true,
+        "add_agent": {"id": AGENT_ID, "name": AGENT_NAME, "kind": "api", "base_url": o.base_url, "model": o.model},
+    }))?;
+    if !config["agents"].as_array().into_iter().flatten().any(|a| a["id"] == AGENT_ID) {
+        return Err("the app did not add the benchmark's agent".into());
+    }
+    // Put the user's permission setting back afterwards.
+    let permissions = config["permissions"].as_str().map(str::to_string);
+    let result = run_tasks(&mut control, &o, &tasks, &version);
+    let _ = control.chat(json!({"stop": true}));
+    if let Some(p) = permissions {
+        let _ = control.chat(json!({"permissions": p}));
+    }
+    result
+}
+
+fn run_tasks(control: &mut Control, o: &Options, tasks: &[Value], version: &str) -> Result<(), String> {
+    let mut results: Vec<Value> = Vec::new();
+    let mut kept = 0;
+    let mut stdout = std::io::stdout().lock();
+    let mut say = |line: String| writeln!(stdout, "{line}").map_err(|e| format!("stdout: {e}"));
+    say(format!("bench-assistant v1: {} on SolidCraft {version}", o.model))?;
+    say("| run | # | task | pass/fail | how it failed | seconds |\n|---|---|---|---|---|---|".into())?;
+    for run in 1..=o.repeat {
+        for &n in &o.tasks {
+            let task = tasks.get(n - 1).ok_or("missing embedded task")?;
+            // A fresh design and a fresh chat, with nothing of the last task still running.
+            control.chat(json!({"stop": true}))?;
+            control.execute("file.new", json!({"name": "Benchmark"}))?;
+            for step in task["setup"].as_array().into_iter().flatten() {
+                control.execute(step["command"].as_str().ok_or("embedded setup without a command")?, step["params"].clone())?;
+            }
+            control.chat(json!({"agent": AGENT_ID, "permissions": "all", "new_chat": true, "attach_view": false}))?;
+            let before = control.inspect()?;
+            let began = Instant::now();
+            let end = began + o.timeout;
+            let (chat, timed_out) = match control.call("ui.agent_chat", json!({"send": task["prompt"]}), end) {
+                Ok(chat) => wait_for_turn(control, chat, began, end)?,
+                Err(e) if e == "timeout" => (json!({}), true),
+                Err(e) => return Err(e),
+            };
+            if timed_out {
+                // The late reply would arrive on the old connection; stop the model on a new one
+                // before reading the design.
+                *control = control.reopen()?;
+            }
+            // Stop the agent before reading the result, so nothing changes the design meanwhile.
+            let stopped = control.chat(json!({"stop": true}))?;
+            let items = stopped["items"].as_array().or(chat["items"].as_array()).cloned().unwrap_or_default();
+            let after = control.inspect()?;
+            let failed_rules = check(&task["check"], &before, &after, &items);
+            let passed = failed_rules.is_empty();
+            let failure = if passed { "" } else { classify(&items, timed_out) };
+            let seconds = began.elapsed().as_secs_f64();
+            say(format!(
+                "| {run} | {n} | {} | {} | {failure} | {seconds:.0} |",
+                task["id"].as_str().unwrap_or_default(),
+                if passed { "pass" } else { "fail" }
+            ))?;
+            let result = json!({
+                "task": n, "id": task["id"], "prompt": task["prompt"], "repeat": run, "passed": passed, "failure": failure,
+                "failed_rules": failed_rules, "timed_out": timed_out, "seconds": seconds, "check": task["check"],
+                "items": items, "before": before, "after": after,
+            });
+            kept += result.to_string().len();
+            if kept > MAX_RESULTS {
+                return Err("the results passed 64 MiB; run fewer tasks or repetitions".into());
+            }
+            results.push(result);
+            // Written after every task, so an interrupted run keeps what it measured.
+            if let Some(path) = o.json {
+                let all = json!({"test": "v1", "model": o.model, "base_url": o.base_url, "solidcraft": version, "results": results});
+                write(path, &serde_json::to_string_pretty(&all).map_err(|e| e.to_string())?)?;
+            }
+            if let Some(path) = o.markdown {
+                write(path, &(1..=run).map(|r| markdown(o.model, version, &results, r)).collect::<Vec<_>>().join("\n"))?;
+            }
+        }
+    }
+    for run in 1..=o.repeat {
+        let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+        say(format!("run {run}: {}/{} passed", rows.iter().filter(|r| r["passed"] == true).count(), rows.len()))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn design(bodies: Value, timeline: Value) -> Value {
+        json!({"name": "Benchmark", "params": [], "timeline": timeline, "bodies": bodies, "sketches": [], "undo": 1, "revision": 3, "dirty": true})
+    }
+
+    fn body(name: &str, volume: f64, min: [f64; 3], max: [f64; 3]) -> Value {
+        json!({"name": name, "volume_mm3": volume, "bbox": {"min": min, "max": max}, "visible": true})
+    }
+
+    #[test]
+    fn the_embedded_tasks_are_v1() {
+        let tasks = tasks().unwrap();
+        assert_eq!(tasks.len(), 11);
+        assert_eq!(tasks[0]["prompt"], "Make a 20 mm cube.");
+        assert_eq!(tasks[10]["prompt"], "can you use the software to make a change to the current shape, any change at all");
+        assert_eq!(tasks[5]["check"]["tol"], 0.003);
+        assert_eq!(tasks[6]["check"]["bbox_min"], json!([50, 0, 0]));
+        let boxes: Vec<_> = tasks.iter().filter(|t| t["setup"].is_array()).map(|t| t["id"].as_str().unwrap()).collect();
+        assert_eq!(boxes, ["06-fillet-box", "07-move-body", "08-rename-body", "09-volume-question", "11-any-change"]);
+    }
+
+    #[test]
+    fn pass_rules() {
+        let tasks = tasks().unwrap();
+        let rule = |n: usize| tasks[n - 1]["check"].clone();
+        let empty = design(json!([]), json!([]));
+        let pass = |n: usize, before: &Value, after: &Value, items: &[Value]| check(&rule(n), before, after, items);
+        // 3: any orientation, within 1%.
+        let block = design(json!([body("Body1", 24_100.0, [0.0; 3], [40.0, 10.0, 60.2])]), json!([{"type": "Box"}]));
+        assert!(pass(3, &empty, &block, &[]).is_empty());
+        let thick = design(json!([body("Body1", 24_000.0, [0.0; 3], [40.0, 12.0, 60.0])]), json!([]));
+        assert_eq!(pass(3, &empty, &thick, &[]).len(), 1);
+        let two = design(json!([body("A", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0]), body("B", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0])]), json!([]));
+        assert!(!pass(3, &empty, &two, &[]).is_empty());
+        // A hidden body is not part of the result.
+        let mut hidden = two.clone();
+        hidden["bodies"][1]["visible"] = json!(false);
+        hidden["bodies"][0]["volume_mm3"] = json!(24_000.0);
+        hidden["bodies"][0]["bbox"]["max"] = json!([60.0, 40.0, 10.0]);
+        assert!(pass(3, &empty, &hidden, &[]).is_empty());
+        // 4: the timeline needs a working Extrude.
+        let plate = |kind: Value| design(json!([body("Body1", 22_500.0, [0.0; 3], [50.0, 30.0, 15.0])]), kind);
+        assert!(pass(4, &empty, &plate(json!([{"type": "Sketch"}, {"type": "Extrude"}])), &[]).is_empty());
+        assert!(!pass(4, &empty, &plate(json!([{"type": "Box"}])), &[]).is_empty());
+        for flag in [json!({"suppressed": true}), json!({"rolled_back": true}), json!({"error": "failed"})] {
+            let mut feature = json!({"type": "Extrude"});
+            feature.as_object_mut().unwrap().extend(flag.as_object().unwrap().clone());
+            assert!(!pass(4, &empty, &plate(json!([feature])), &[]).is_empty(), "{flag}");
+        }
+        // 6: the fillet's tolerance is 0.3%.
+        let start = design(json!([body("Body1", 64_000.0, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}]));
+        let filleted = |v: f64| design(json!([body("Body1", v, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}, {"type": "Fillet"}]));
+        assert!(pass(6, &start, &filleted(63_108.53 * 1.002), &[]).is_empty());
+        assert!(!pass(6, &start, &filleted(63_108.53 * 1.004), &[]).is_empty());
+        // 7: the lowest corner.
+        let moved = |x: f64| design(json!([body("Body1", 8000.0, [x, 0.0, 0.0], [x + 20.0, 20.0, 20.0])]), json!([]));
+        assert!(pass(7, &empty, &moved(50.0), &[]).is_empty());
+        assert!(!pass(7, &empty, &moved(0.0), &[]).is_empty());
+        // 8: the name.
+        let named = |name: &str| design(json!([body(name, 6000.0, [0.0; 3], [30.0, 20.0, 10.0])]), json!([]));
+        assert!(pass(8, &empty, &named("Bracket"), &[]).is_empty());
+        assert!(!pass(8, &empty, &named("Body1"), &[]).is_empty());
+        // 9: unchanged, and the reply gives the volume.
+        let start = named("Body1");
+        let said = |text: &str| [json!({"user": "What is the volume of the part?"}), json!({"agent": text, "thought": false})];
+        let mut read = start.clone();
+        read["revision"] = json!(7);
+        read["dirty"] = json!(false);
+        read["selection"] = json!([{"body": "Body1"}]);
+        assert!(pass(9, &start, &read, &said("The volume is 6000 mm³.")).is_empty());
+        assert!(!pass(9, &start, &read, &said("About 60 cm³.")).is_empty());
+        assert!(!pass(9, &start, &named("Bracket"), &said("6 000 mm³")).is_empty());
+        let mut undone = start.clone();
+        undone["undo"] = json!(2);
+        assert!(!pass(9, &start, &undone, &said("6000 mm³")).is_empty());
+        // 11: any change counts; reading does not.
+        assert!(pass(11, &start, &named("Bracket"), &[]).is_empty());
+        assert!(pass(11, &start, &undone, &[]).is_empty());
+        assert!(!pass(11, &start, &read, &[]).is_empty());
+        // An unreadable design passes nothing.
+        assert!(!pass(11, &start, &json!({}), &[]).is_empty());
+    }
+
+    #[test]
+    fn the_volume_reply() {
+        for yes in ["6000", "6 000 mm³", "6,000", "6.000", "6\u{202f}000", "6 cm³", "6.00cm3", "is 6000."] {
+            assert!(volume_reply(yes), "{yes}");
+        }
+        for no in ["60000", "6,0001", "60 cm³", "600", "6.01 cm³", ""] {
+            assert!(!volume_reply(no), "{no}");
+        }
+    }
+
+    #[test]
+    fn failure_categories() {
+        for (items, expected) in [
+            (
+                json!([{"user": "Make a 20 mm cube."}, {"agent": "{\"name\": \"execute\", \"arguments\": {}}", "thought": false}]),
+                "wrote the call as text",
+            ),
+            (
+                json!([{"notice": "HTTP 400: registry.ollama.ai/library/gemma3:4b does not support tools", "error": true}]),
+                "the endpoint refused tools (HTTP 400)",
+            ),
+            (json!([{"user": "Make a 20 mm cube."}, {"agent": "", "thought": false}]), "an empty reply"),
+            (json!([{"agent": "Let me think", "thought": true}]), "an empty reply"),
+            (json!([{"agent": "Sure, here is how to make a cube.", "thought": false}]), "only talked"),
+            (
+                json!([{"tool": "1", "status": "Failed", "output": "unknown command `solid.cube` (did you mean `solid.box`?)"}]),
+                "wrong or unknown command",
+            ),
+            (json!([{"tool": "1", "status": "Failed", "output": "unknown tool `make_cube`"}]), "wrong or unknown command"),
+            (json!([{"tool": "1", "status": "Failed", "output": "invalid parameters for `solid.box`: `length` is required"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "Not run: the tool arguments were not valid JSON"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "no body `Box`"}]), "gave up after errors"),
+            (
+                json!([{"tool": "1", "status": "Completed", "output": "{\"ok\": false, \"failed\": {\"error\": \"unknown command `solid.delete`\"}}"}]),
+                "wrong or unknown command",
+            ),
+            (
+                json!([{"tool": "1", "status": "Completed"}, {"agent": "\n(stopped after 24 requests for one message; send another message to go on)"}]),
+                "hit the request limit",
+            ),
+            (json!([{"tool": "1", "status": "Completed", "output": "{}"}]), "wrong result"),
+        ] {
+            let items = items.as_array().unwrap();
+            assert_eq!(classify(items, false), expected, "{items:?}");
+            assert_eq!(classify(items, true), "timeout");
+        }
+    }
+
+    #[test]
+    fn markdown_is_the_comment_template() {
+        let rows: Vec<Value> =
+            (1..=11).map(|n| json!({"task": n, "repeat": 1, "passed": n != 2, "failure": if n == 2 { "an empty reply" } else { "" }})).collect();
+        let report = markdown("qwen2.5:7b", "0.19.0", &rows, 1);
+        assert!(report.starts_with(
+            "### qwen2.5:7b (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: 0.19.0\nResult: 10/11\n| # | pass/fail | how it failed |\n|---|---|---|\n| 1 | pass | |\n| 2 | fail | an empty reply |\n"
+        ));
+        assert!(report.ends_with("| 11 | pass | |\nNotes: <anything odd, e.g. very slow, needed a retry>\n"));
+        let partial = markdown("m|x", "v", &rows[..1], 1);
+        assert!(partial.starts_with("### m x ("));
+        assert!(partial.contains("Result: 1/11") && partial.contains("| 2 | | not run |") && partial.contains("partial run"));
+    }
+
+    #[test]
+    fn options_are_checked_before_connecting() {
+        for extra in [
+            &["--repeat", "0"][..],
+            &["--repeat", "101"],
+            &["--timeout-s", "3601"],
+            &["--tasks", "0"],
+            &["--tasks", "12"],
+            &["--tasks", "1,1"],
+            &["--model", "again"],
+            &["--unexpected", "1"],
+            &["--token"],
+        ] {
+            let mut args: Vec<String> =
+                ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "http://127.0.0.1:11434/v1"].iter().map(|s| s.to_string()).collect();
+            args.extend(extra.iter().map(|s| s.to_string()));
+            assert!(options(&args).is_err(), "{extra:?}");
+        }
+        let args: Vec<String> =
+            ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "u", "--tasks", "2, 5"].iter().map(|s| s.to_string()).collect();
+        let o = options(&args).unwrap();
+        assert_eq!((o.tasks, o.repeat, o.timeout), (vec![2, 5], 1, Duration::from_secs(300)));
+        assert!(Control::connect("10.0.0.1:9271", Some("t")).is_err());
+        assert!(Control::connect("localhost", Some("t")).is_err());
+    }
+}

apps/solidcraft-cli/src/crashes.rs

@@ -6,11 +6,14 @@ use std::sync::Mutex;
 use serde_json::{Value, json};
 use solidcraft_engine::crash;
 
-const USAGE: &str = "usage: solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]";
+/// The command's usage, from the same lines the top-level usage lists.
+fn usage() -> String {
+    crate::command_usage("crashes")
+}
 
 pub fn run(args: &[String]) -> Result<(), String> {
     let dir = crash::default_dir().ok_or("no crash folder on this system")?;
-    let id = || args.get(1).map(String::as_str).ok_or_else(|| USAGE.to_string());
+    let id = || args.get(1).map(String::as_str).ok_or_else(usage);
     match args.first().map(String::as_str) {
         None | Some("list") => {
             let reports = crash::list(&dir);
@@ -43,7 +46,7 @@ pub fn run(args: &[String]) -> Result<(), String> {
             println!("deleted {} report(s)", crash::clear(&dir, args.get(1).map(String::as_str)));
             Ok(())
         }
-        _ => Err(USAGE.to_string()),
+        _ => Err(usage()),
     }
 }
 

apps/solidcraft-cli/src/fuzz.rs

@@ -16,9 +16,16 @@ fn flag<T: std::str::FromStr>(args: &[String], name: &str, default: T) -> T {
     args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
+/// The options `fuzz` takes, and the ones that stand alone.
+const OPTIONS: &[&str] = &["--from", "--count", "--jobs", "--timeout", "--steps", "--out", "--report"];
+const SWITCHES: &[&str] = &["--minimise"];
+
 /// One seed: a design and a boolean case, as JSON on stdout (progress on stderr).
 pub fn one(args: &[String]) -> Result<(), String> {
     let seed: u64 = args.first().and_then(|s| s.parse().ok()).ok_or("fuzz-one <seed> [--steps N] [--minimise]")?;
+    // The seed is the first argument; the rest are options, and an option `fuzz-one` doesn't
+    // take is refused rather than ignored.
+    crate::known_args("fuzz-one", &args[1..], &["--steps"], SWITCHES, false)?;
     let steps = flag(args, "--steps", 8usize);
     let minimise = args.iter().any(|a| a == "--minimise");
     // Panics caught inside the kernel: harmless natively, fatal in the web build.
@@ -64,6 +71,9 @@ struct Job {
 /// Run seeds `--from`…`--from + --count` in `--jobs` processes, `--timeout` seconds each;
 /// write failing scripts to `--out` and a summary to `--report`.
 pub fn run(args: &[String]) -> Result<(), String> {
+    // An option `fuzz` doesn't take is refused before a seed runs: it would otherwise be
+    // ignored, and the run would go on for minutes with the wrong settings.
+    crate::known_args("fuzz", args, OPTIONS, SWITCHES, false)?;
     let from = flag(args, "--from", 0u64);
     let count = flag(args, "--count", 100u64);
     let last = from.checked_add(count.saturating_sub(1)).ok_or("seed range exceeds u64::MAX: reduce --from or --count")?;

apps/solidcraft-cli/src/logger.rs

@@ -0,0 +1,49 @@
+//! What the engine logs (`log::info!`, `log::debug!`: why a body has no display plan, why a save
+//! left its model cache out), written to stderr. Off unless asked for, so the CLI's output and
+//! the scripts reading it stay as they are: `--debug` shows SolidCraft's own debug messages (and
+//! other crates' warnings, whose debug output is large), `RUST_LOG=error|warn|info|debug|trace`
+//! sets one level for every crate.
+
+use log::{LevelFilter, Log, Metadata, Record};
+
+struct Stderr {
+    /// The level for SolidCraft's crates.
+    ours: LevelFilter,
+    /// The level for every other crate.
+    others: LevelFilter,
+}
+
+impl Log for Stderr {
+    fn enabled(&self, m: &Metadata) -> bool {
+        m.level() <= if m.target().starts_with("solidcraft") { self.ours } else { self.others }
+    }
+
+    fn log(&self, r: &Record) {
+        if self.enabled(r.metadata()) {
+            use std::io::Write as _;
+            // A closed stderr is no reason to stop.
+            let _ = writeln!(std::io::stderr().lock(), "[{} {}] {}", r.level().as_str().to_ascii_lowercase(), r.target(), r.args());
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+/// Removes `--debug` from `args`, wherever it is (every subcommand takes it), and installs the
+/// logger when it or `RUST_LOG` asks for one.
+pub fn init(args: &mut Vec<String>) {
+    let before = args.len();
+    args.retain(|a| a != "--debug");
+    let debug = args.len() != before;
+    let env = std::env::var("RUST_LOG").ok().and_then(|v| v.trim().parse::<LevelFilter>().ok());
+    let (ours, others) = match (debug, env) {
+        (false, Some(all)) => (all, all),
+        (true, Some(all)) => (all.max(LevelFilter::Debug), all),
+        (true, None) => (LevelFilter::Debug, LevelFilter::Warn),
+        (false, None) => return,
+    };
+    // Installed once, for the life of the process.
+    if log::set_logger(Box::leak(Box::new(Stderr { ours, others }))).is_ok() {
+        log::set_max_level(ours.max(others));
+    }
+}

apps/solidcraft-cli/src/main.rs

@@ -1,29 +1,37 @@
 //! SolidCraft headless command line.
 //!
 //! ```text
-//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
-//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
-//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
+//! solidcraft-cli run <script.json|design.sc|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
+//! solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.sc> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
 //! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N]
+//!                                 [--timeout-s 300] [--json out.json] [--markdown out.md]
+//!                                                             the standard Assistant model test (#4851) on a running app
 //! solidcraft-cli snapshot <script|design> [--in design|part.step] --out shot.png [--width W] [--height H] [--view iso|front|top|…|NAME | --camera JSON] [--no-grid] [--no-axes]
 //!                                                             [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]
 //! solidcraft-cli exec <command> [json-params]                 run one command on an empty design
 //! solidcraft-cli commands                                     the command registry as JSON
 //! solidcraft-cli recipe <recipe.json>                         translate an oracle recipe to a script
 //! solidcraft-cli oracle <case-dir>...                         replay recipes and compare with expected.json
-//! solidcraft-cli mcp [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
+//! solidcraft-cli mcp [--headless] [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
 //!                    [--param-check off|warn|strict]
 //!                                                             MCP server on stdio (docs/mcp.md)
+//! solidcraft-cli mcp setup [--dry-run] [--client NAME] [--live] (alias: mcp install) add it to OpenCode, Claude Desktop, Claude Code, Cursor
 //! solidcraft-cli licences                                     SolidCraft's licence and the third-party licences
 //! solidcraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
+//!
+//! --debug (with any command)                                  SolidCraft's debug log on stderr (or RUST_LOG=LEVEL)
 //! ```
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
 mod bench_agent;
+mod bench_assistant;
 mod crashes;
 mod fuzz;
+mod logger;
 mod oracle;
 mod preview;
 mod recipe;
@@ -39,54 +47,98 @@ mod app_icon;
 use solidcraft_engine::Session;
 use solidcraft_engine::view::Guides;
 
-const USAGE: &str = "usage:
-  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
-  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...
-      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)
-      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;
-       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)
-  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)
-      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,
-       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)
-  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]
-      (the design's history as a command script that eval and run replay)
-  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]
-      (--ops: after opening, run each command of the script and undo it, timing the command, the
-       evaluations it caused and the view it leaves: placing and meshing what changed)
-  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]
-  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]
-      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]
-  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...
-      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;
-       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;
-       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);
-       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;
-       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside
-         it shows) and color #rrggbb, either or both, once per body;
-       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body
-         is visible inside the material it meets; a later --body overrides it;
-       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world
-         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)
-  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]
-  solidcraft-cli exec <command> [json-params]
-  solidcraft-cli commands
-  solidcraft-cli recipe <recipe.json>
-  solidcraft-cli oracle <case-dir>... [--json]
-  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]
-  solidcraft-cli mcp [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
-                     [--param-check off|warn|strict]
-  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]
-  solidcraft-cli licences
-  solidcraft-cli gpu [--policy auto|hardware|software|cpu]
-      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it
-       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults
-       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)
-  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico
-";
+/// One command the CLI takes: the name to type, the usage it prints for `--help`,
+/// and whether the top-level usage lists it (an alias answers to another command's name).
+struct Command {
+    name: &'static str,
+    usage: &'static str,
+    listed: bool,
+}
+
+/// `run`'s lines in the usage.
+const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.sc|part.step> [--in design.sc|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.sc|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
+/// `eval`'s lines in the usage.
+const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE]     (alias: inspect)\n  solidcraft-cli eval --in <script.json|design.sc|part.step> [--json-out FILE]\n      (with both inputs, runs the positional script on --in before measuring; does not automatically save the modified design)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
+/// `script`'s lines in the usage.
+const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.sc|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
+/// `bench-open`'s lines in the usage.
+const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
+/// `bench-agent`'s lines in the usage.
+const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.sc] [--script-out script.json]\n";
+/// `bench-assistant`'s lines in the usage.
+const USAGE_BENCH_ASSISTANT: &str = "  solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N] [--timeout-s 300] [--json out.json] [--markdown out.md]\n";
+/// `snapshot`'s lines in the usage.
+const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.sc|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.sc|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
+/// `render`'s lines in the usage.
+const USAGE_RENDER: &str = "  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]\n      [--progressive] [--samples N] [--max-depth N] [--seed N] [--exposure EV] [--lighting FILE.json] [--environment FILE.json] [--tone-map reinhard|aces_fitted]\n";
+/// `exec`'s lines in the usage.
+const USAGE_EXEC: &str = "  solidcraft-cli exec <command> [json-params]\n";
+/// `commands`'s lines in the usage.
+const USAGE_COMMANDS: &str = "  solidcraft-cli commands\n";
+/// `recipe`'s lines in the usage.
+const USAGE_RECIPE: &str = "  solidcraft-cli recipe <recipe.json>\n";
+/// `oracle`'s lines in the usage.
+const USAGE_ORACLE: &str = "  solidcraft-cli oracle <case-dir>... [--json]\n";
+/// `fuzz`'s lines in the usage.
+const USAGE_FUZZ: &str =
+    "  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]\n";
+/// `mcp`'s lines in the usage.
+const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.sc|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
+/// `crashes`'s lines in the usage.
+const USAGE_CRASHES: &str = "  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]\n";
+/// `licences`'s lines in the usage.
+const USAGE_LICENCES: &str = "  solidcraft-cli licences\n";
+/// `gpu`'s lines in the usage.
+const USAGE_GPU: &str = "  solidcraft-cli gpu [--policy auto|hardware|software|cpu]\n      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it\n       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults\n       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)\n";
+/// `icon`'s lines in the usage.
+const USAGE_ICON: &str = "  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico\n";
+/// `fuzz-one`'s lines in the usage: a seed and the flags of one fuzz run.
+const USAGE_FUZZ_ONE: &str = "  solidcraft-cli fuzz-one <seed> [--steps N] [--minimise]\n";
+/// `bench-edit`'s lines in the usage: the parameter a script changes.
+const USAGE_BENCH_EDIT: &str = "  solidcraft-cli bench-edit <script.json|recipe.json> <param> <expr>\n";
+/// `save-stress`'s lines in the usage: the file saved over and over.
+const USAGE_SAVE_STRESS: &str = "  solidcraft-cli save-stress <path> <rounds>\n";
+/// The flags every command takes, at the end of the top-level usage.
+const USAGE_DEBUG: &str = "  --debug, with any command: what SolidCraft logs (why a body has no display plan, why a save left its\n      model cache out), on stderr; RUST_LOG=error|warn|info|debug|trace sets one level for every crate\n";
+
+/// The commands the CLI takes, in the order the top-level usage lists them.
+const COMMANDS: &[Command] = &[
+    Command { name: "run", usage: USAGE_RUN, listed: true },
+    Command { name: "eval", usage: USAGE_EVAL, listed: true },
+    Command { name: "inspect", usage: USAGE_EVAL, listed: false },
+    Command { name: "script", usage: USAGE_SCRIPT, listed: true },
+    Command { name: "bench-open", usage: USAGE_BENCH_OPEN, listed: true },
+    Command { name: "bench-agent", usage: USAGE_BENCH_AGENT, listed: true },
+    Command { name: "bench-assistant", usage: USAGE_BENCH_ASSISTANT, listed: true },
+    Command { name: "snapshot", usage: USAGE_SNAPSHOT, listed: true },
+    Command { name: "render", usage: USAGE_RENDER, listed: true },
+    Command { name: "exec", usage: USAGE_EXEC, listed: true },
+    Command { name: "commands", usage: USAGE_COMMANDS, listed: true },
+    Command { name: "recipe", usage: USAGE_RECIPE, listed: true },
+    Command { name: "oracle", usage: USAGE_ORACLE, listed: true },
+    Command { name: "fuzz", usage: USAGE_FUZZ, listed: true },
+    Command { name: "fuzz-one", usage: USAGE_FUZZ_ONE, listed: false },
+    Command { name: "mcp", usage: USAGE_MCP, listed: true },
+    Command { name: "crashes", usage: USAGE_CRASHES, listed: true },
+    Command { name: "licences", usage: USAGE_LICENCES, listed: true },
+    Command { name: "licenses", usage: USAGE_LICENCES, listed: false },
+    Command { name: "gpu", usage: USAGE_GPU, listed: true },
+    Command { name: "icon", usage: USAGE_ICON, listed: true },
+    Command { name: "bench-edit", usage: USAGE_BENCH_EDIT, listed: false },
+    Command { name: "save-stress", usage: USAGE_SAVE_STRESS, listed: false },
+];
 
 fn main() -> ExitCode {
-    let args: Vec<String> = std::env::args().skip(1).collect();
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    logger::init(&mut args);
     let r = match args.first().map(String::as_str) {
+        // Asked-for help is not an error: the command's usage on stdout, exit 0. It is read
+        // before the command runs, so `--help` never starts a run (a fuzz run, a server).
+        Some(cmd) if wants_help(&args[1..]) && is_command(cmd) => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(command_usage(cmd).as_bytes());
+            Ok(())
+        }
         Some("run") => cmd_run(&args[1..]),
         Some("eval" | "inspect") => cmd_eval(&args[1..]),
         Some("script") => cmd_script(&args[1..]),
@@ -107,7 +159,7 @@ fn main() -> ExitCode {
                 }
             })
         }
-        Some("recipe") => args.get(1).ok_or_else(|| USAGE.to_string()).and_then(|p| {
+        Some("recipe") => args.get(1).ok_or_else(usage).and_then(|p| {
             let v = read_json(p)?;
             recipe::to_script(&v).map(|s| println!("{}", pretty(&s)))
         }),
@@ -130,11 +182,19 @@ fn main() -> ExitCode {
         Some("bench-open") => cmd_bench_open(&args[1..]),
         // A ~1,300-body design built command by command, as an agent builds one over MCP.
         Some("bench-agent") => bench_agent::run(&args[1..]),
+        // The standard Assistant model test (#4851), run against a desktop app over its control channel.
+        Some("bench-assistant") => bench_assistant::run(&args[1..]),
         Some("--version" | "-V") => {
             println!("solidcraft-cli {}", env!("CARGO_PKG_VERSION"));
             Ok(())
         }
-        _ => Err(USAGE.to_string()),
+        // Asked-for help is not an error: usage on stdout, exit 0.
+        Some("--help" | "-h" | "help") => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(usage().as_bytes());
+            Ok(())
+        }
+        _ => Err(usage()),
     };
     match r {
         Ok(()) => ExitCode::SUCCESS,
@@ -149,6 +209,35 @@ fn pretty(v: &Value) -> String {
     serde_json::to_string_pretty(v).unwrap_or_default()
 }
 
+/// The whole usage: every command's lines under one `usage:` line. The lines come from the
+/// same place a command's own `--help` prints, so the two cannot drift apart.
+fn usage() -> String {
+    let mut s = String::from("usage:\n");
+    for c in COMMANDS.iter().filter(|c| c.listed) {
+        s.push_str(c.usage);
+    }
+    s.push_str(USAGE_DEBUG);
+    s
+}
+
+/// A command's own usage: its lines under a `usage:` line.
+fn command_usage(cmd: &str) -> String {
+    match COMMANDS.iter().find(|c| c.name == cmd) {
+        Some(c) => format!("usage:\n{}", c.usage),
+        None => usage(),
+    }
+}
+
+/// Whether the name is a command the CLI takes.
+fn is_command(cmd: &str) -> bool {
+    COMMANDS.iter().any(|c| c.name == cmd)
+}
+
+/// Whether the arguments ask for help.
+fn wants_help(args: &[String]) -> bool {
+    args.iter().any(|a| a == "--help" || a == "-h")
+}
+
 pub fn read_json(path: &str) -> Result<Value, String> {
     // Through the engine's file access, which refuses anything that is not a regular file and
     // reads no more than the cap: a character device or a FIFO would otherwise never end.
@@ -173,8 +262,7 @@ fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Res
     let bytes = solidcraft_engine::io::vfs::read(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
     if solidcraft_engine::io::is_design_container(&bytes) {
         let doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| format!("{path}: {e}"))?;
-        let mut session = Session::new(doc);
-        session.path = Some(path.to_owned());
+        let mut session = Session::opened_at(doc, None, Some(path));
         session.param_check = check;
         return Ok(session);
     }
@@ -251,10 +339,11 @@ fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
 fn cmd_run(args: &[String]) -> Result<(), String> {
     install_renderer();
     let json_out = json_out(args)?;
+    known_args("run", args, &["--in", "--out", "--save", "--json-out"], &["--quiet", "--results", "--timings", "--profile", "--allow-errors"], true)?;
     let base = flag(args, "--in");
     let path = positional(args);
     if path.is_none() && base.is_none() {
-        return Err(USAGE.to_string());
+        return Err(usage());
     }
     let want_results = args.iter().any(|a| a == "--results");
     // `--profile` times each command and splits out its kernel time; it implies `--timings`.
@@ -303,7 +392,7 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
-/// The session `run` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// The session `run`, `eval` and `snapshot` start from: `--in` (a design or STEP file) with the
 /// positional script run on top of it, or either one alone.
 fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
     match (base, path) {
@@ -314,13 +403,14 @@ fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
         }
         (Some(b), None) => load(b),
         (None, Some(p)) => load(p),
-        (None, None) => Err(USAGE.to_string()),
+        (None, None) => Err(usage()),
     }
 }
 
 /// Refuses an option `cmd` doesn't take, and one missing its value: a typo, or another
-/// command's option, would otherwise be ignored without a word.
-fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -> Result<(), String> {
+/// command's option, would otherwise be ignored without a word. `positionals` says whether the
+/// command takes a word of its own (a file, a seed): `fuzz` takes none, and would start a run.
+fn known_args(cmd: &str, args: &[String], valued: &[&str], switches: &[&str], positionals: bool) -> Result<(), String> {
     let mut i = 0;
     while let Some(a) = args.get(i) {
         if valued.contains(&a.as_str()) {
@@ -328,7 +418,9 @@ fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -
                 Some(v) if !v.starts_with("--") => i += 2,
                 _ => return Err(format!("{cmd}: {a} needs a value")),
             }
-        } else if a.starts_with("--") && !switches.contains(&a.as_str()) {
+        } else if switches.contains(&a.as_str()) {
+            i += 1;
+        } else if a.starts_with("--") || !positionals {
             return Err(format!("{cmd} doesn't take {a} (it takes {})", [valued, switches].concat().join(", ")));
         } else {
             i += 1;
@@ -352,8 +444,8 @@ fn timeline_ok(s: &Session) -> Result<(), String> {
 
 fn cmd_eval(args: &[String]) -> Result<(), String> {
     let json_out = json_out(args)?;
-    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(|| USAGE.to_string())?;
-    let mut s = load(path)?;
+    known_args("eval", args, &["--in", "--json-out"], &[], true)?;
+    let mut s = open(flag(args, "--in"), positional(args))?;
     let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
     let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
     let out = json!({
@@ -370,7 +462,7 @@ fn cmd_eval(args: &[String]) -> Result<(), String> {
 /// A design's history as a command script (`timeline.export_script`): printed, or written to
 /// `--out`; what the script leaves out goes to stderr.
 fn cmd_script(args: &[String]) -> Result<(), String> {
-    let path = positional(args).ok_or_else(|| USAGE.to_string())?;
+    let path = positional(args).ok_or_else(usage)?;
     let s = &mut load(path)?;
     let out = flag(args, "--out");
     let r = s.execute("timeline.export_script", &json!({"path": out})).map_err(|e| e.to_string())?;
@@ -431,14 +523,15 @@ fn install_renderer() {
 
 fn cmd_snapshot(args: &[String]) -> Result<(), String> {
     install_renderer();
-    known_flags(
+    known_args(
         "snapshot",
         args,
         &["--in", "--out", "--width", "--height", "--view", "--camera", "--body", "--tool", "--section"],
         &["--no-grid", "--no-axes"],
+        true,
     )?;
     if positional(args).is_none() && flag(args, "--in").is_none() {
-        return Err(USAGE.to_string());
+        return Err(usage());
     }
     let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
     let size = |name: &str, default: u32| match flag(args, name) {
@@ -522,7 +615,7 @@ fn ico(images: &[(usize, Vec<u8>)]) -> Result<Vec<u8>, String> {
 
 fn cmd_exec(args: &[String]) -> Result<(), String> {
     install_renderer();
-    let id = args.first().ok_or_else(|| USAGE.to_string())?;
+    let id = args.first().ok_or_else(usage)?;
     let p: Value = match args.get(1) {
         Some(t) => serde_json::from_str(t).map_err(|e| format!("params: {e}"))?,
         None => json!({}),
@@ -533,10 +626,27 @@ fn cmd_exec(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// `mcp setup`: add the server to each installed AI client, with this program's own path.
+fn cmd_mcp_setup(args: &[String]) -> Result<(), String> {
+    use solidcraft_engine::agent_setup as setup;
+    let (lines, ok) = setup::setup(args, &setup::Env::from_process(), &setup::current_exe()?)?;
+    for l in lines {
+        println!("{l}");
+    }
+    if ok { Ok(()) } else { Err("mcp setup: some clients could not be configured".into()) }
+}
+
 /// MCP server on stdio: headless (optionally starting from a design or script) or bridged to
 /// a running app's control port. stdout carries only protocol messages. Files the agent's tool
 /// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
 fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    if matches!(args.first().map(String::as_str), Some("setup" | "install")) {
+        return cmd_mcp_setup(&args[1..]);
+    }
+    let render_gpu = args.iter().any(|arg| arg == "--render-gpu");
+    if render_gpu && flag(args, "--connect").is_some() {
+        return Err("mcp: --render-gpu installs a headless image host; a connected application owns its own device".into());
+    }
     install_renderer();
     let scope = (!args.iter().any(|a| a == "--allow-any-path"))
         .then(|| solidcraft_mcp::agent_scope(flags(args, "--allow-path").into_iter().map(std::path::PathBuf::from)));
@@ -580,18 +690,49 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
             }
             Box::new(remote)
         }
-        (None, Some(path)) => Box::new(solidcraft_mcp::Headless::new(load_checked(path, param_check)?)),
-        (None, None) => {
-            let mut headless = solidcraft_mcp::Headless::default();
-            headless.session.param_check = param_check;
+        (None, Some(path)) => {
+            let mut headless = solidcraft_mcp::Headless::new(load_checked(path, param_check)?);
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
             Box::new(headless)
         }
+        (None, None) => {
+            let auto = !args.iter().any(|a| a == "--headless");
+            if auto && let Some(port) = discover_app() {
+                eprintln!("solidcraft mcp: bridged to the running app at 127.0.0.1:{port} (--headless starts a session of its own)");
+                return serve_mcp(Box::new(solidcraft_mcp::Remote::new(&format!("127.0.0.1:{port}"), flag(args, "--token"))), scope);
+            }
+            let mut headless = solidcraft_mcp::Headless::default();
+            headless.session.param_check = param_check;
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
+            if auto {
+                // The app may start after the agent: look for it again until there is work here.
+                Box::new(solidcraft_mcp::Auto::new(headless, Box::new(discover_app), flag(args, "--token")))
+            } else {
+                Box::new(headless)
+            }
+        }
     };
+    serve_mcp(backend, scope)
+}
+
+fn serve_mcp(backend: Box<dyn solidcraft_mcp::Backend>, scope: Option<solidcraft_engine::io::vfs::PathScope>) -> Result<(), String> {
     let stdin = std::io::stdin();
     let stdout = std::io::stdout();
     solidcraft_mcp::Server::new(backend).with_path_scope(scope).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
 }
 
+/// The port of the running desktop app: the one its discovery file names, if something listens
+/// there (a file left by an app that crashed names a closed port).
+fn discover_app() -> Option<u16> {
+    let port = solidcraft_engine::control_auth::read_current_port()?;
+    let addr = std::net::SocketAddr::from(([127, 0, 0, 1], port));
+    std::net::TcpStream::connect_timeout(&addr, std::time::Duration::from_millis(500)).ok().map(|_| port)
+}
+
 /// `save-stress <path> <rounds>`: save a design of a few hundred kilobytes `rounds` times, its
 /// parameter `save_round` set to the round number each time.
 fn cmd_save_stress(args: &[String]) -> Result<(), String> {
@@ -676,7 +817,7 @@ fn bench_ops(mut s: Session, script: &str) -> Result<Session, String> {
 
 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
 pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
-    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
+    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.sc | part.step> [--parse-only]")?;
     let t = std::time::Instant::now();
     let step = solidcraft_engine::io::is_step_path(path);
     let limit = if step { solidcraft_engine::io::MAX_STEP_BYTES } else { solidcraft_engine::io::MAX_DESIGN_BYTES };
@@ -702,11 +843,12 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
         return Ok(());
     }
     let t = std::time::Instant::now();
-    let s = Session::opened(doc, saved.as_ref());
+    let s = Session::opened_at(doc, saved.as_ref(), (!step).then_some(path.as_str()));
     drop(read);
-    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway).
+    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway), or
+    // only the features whose state a thinned file left out.
     let adopted = saved.is_some() && s.model.last_recomputed == 0;
-    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0, "adopted": adopted}));
+    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0, "adopted": adopted, "recomputed": s.model.last_recomputed}));
     for r in &s.model.results {
         println!("{}", json!({"step": "feature", "id": r.id, "name": r.name, "ms": r.ms, "error": r.error}));
     }
@@ -721,13 +863,13 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
         json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "place_ms": place_ms, "bodies": st.bodies.len(), "triangles": triangles})
     );
     let flag = |name: &str| args.iter().position(|a| a == name);
-    // `--save PATH`: save the opened design without its model cache (to PATH.plain.solidcraft) and
+    // `--save PATH`: save the opened design without its model cache (to PATH.plain.sc) and
     // as the app does, with it, then read the cache back.
     let s = match flag("--save").and_then(|i| args.get(i + 1)) {
         Some(out) => {
             let mut s = s;
             // Without the cache first, for comparison.
-            let plain = format!("{out}.plain.solidcraft");
+            let plain = format!("{out}.plain.{}", solidcraft_engine::io::DESIGN_EXT);
             let t = std::time::Instant::now();
             s.execute("file.save_as", &json!({"path": plain, "cache": false})).map_err(|e| e.to_string())?;
             let plain_ms = t.elapsed().as_secs_f64() * 1000.0;

apps/solidcraft-cli/src/render.rs

@@ -1,25 +1,89 @@
 //! Complete headless image-job workflow through the same engine commands as the UI/MCP.
-use serde_json::json;
+use serde_json::{Value, json};
 use solidcraft_engine::{
-    doc::render_settings::RenderSetup,
-    render::job::{CpuHost, JobId, Phase},
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, JobId, Phase, ToneMap},
 };
 
+/// Only explicit runtime CLI flags are stored here. A typed setup owns these
+/// values even when a supplied flag happens to match the saved value.
+#[derive(Default)]
+struct RuntimeOptions {
+    progressive: bool,
+    transparent: bool,
+    samples: Option<u32>,
+    max_depth: Option<u32>,
+    seed: Option<u32>,
+    lighting: Option<String>,
+    tone_map: Option<ToneMap>,
+    environment: Option<String>,
+}
+
+impl RuntimeOptions {
+    fn explicit_flag(&self) -> Option<&'static str> {
+        [
+            (self.progressive, "--progressive"),
+            (self.transparent, "--transparent"),
+            (self.samples.is_some(), "--samples"),
+            (self.max_depth.is_some(), "--max-depth"),
+            (self.seed.is_some(), "--seed"),
+            (self.lighting.is_some(), "--lighting"),
+            (self.tone_map.is_some(), "--tone-map"),
+            (self.environment.is_some(), "--environment"),
+        ]
+        .into_iter()
+        .find_map(|(present, flag)| present.then_some(flag))
+    }
+
+    fn request(&self, session: &Session, settings: RenderSetup) -> Result<(Value, bool), String> {
+        if let Some(job) = &settings.job {
+            if let Some(flag) = self.explicit_flag() {
+                return Err(format!("{flag} cannot accompany a typed saved render setup; change the saved job options instead"));
+            }
+            settings.validate().map_err(|e| e.to_string())?;
+            session.doc.render.validate_resources(&settings).map_err(|e| e.to_string())?;
+            let needs_gpu = matches!(job, RenderJob::GpuPath { .. });
+            return Ok((json!({"settings":settings}), needs_gpu));
+        }
+        // Legacy setups and unnamed requests retain their runtime wire contract.
+        settings.validate().map_err(|e| e.to_string())?;
+        let mut params = json!({"settings":settings,"transparent_background":self.transparent,
+            "progressive":self.progressive,"samples":self.samples,"max_depth":self.max_depth,"seed":self.seed});
+        if let Some(path) = &self.lighting {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read lighting: {e}"))?;
+            let lighting: solidcraft_engine::render::job::StudioLighting = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+            params["lighting"] = json!(lighting);
+        }
+        if let Some(tone_map) = self.tone_map {
+            params["tone_map"] = json!(tone_map);
+        }
+        if let Some(path) = &self.environment {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read environment: {e}"))?;
+            params["environment"] = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+        }
+        Ok((params, self.progressive))
+    }
+}
+
 pub fn run(args: &[String]) -> Result<(), String> {
     let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
     let mut out = None;
     let mut setup = None;
     let mut width = None;
     let mut height = None;
-    let mut transparent = false;
+    let mut exposure = None;
+    let mut runtime = RuntimeOptions::default();
     let mut overwrite = false;
     let mut timeout = 120u64;
     let mut i = 1;
     while let Some(arg) = args.get(i) {
         match arg.as_str() {
-            "--transparent" => transparent = true,
+            "--progressive" => runtime.progressive = true,
+            "--transparent" => runtime.transparent = true,
             "--overwrite" => overwrite = true,
-            "--out" | "--setup" | "--width" | "--height" | "--timeout" => {
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" | "--samples" | "--max-depth" | "--seed" | "--exposure" | "--lighting"
+            | "--tone-map" | "--environment" => {
                 i += 1;
                 let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
                 match arg.as_str() {
@@ -27,6 +91,20 @@ pub fn run(args: &[String]) -> Result<(), String> {
                     "--setup" => setup = Some(value.clone()),
                     "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
                     "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
+                    "--samples" => runtime.samples = Some(value.parse::<u32>().map_err(|_| "invalid samples")?),
+                    "--max-depth" => runtime.max_depth = Some(value.parse::<u32>().map_err(|_| "invalid depth")?),
+                    "--seed" => runtime.seed = Some(value.parse::<u32>().map_err(|_| "invalid seed")?),
+                    "--exposure" => exposure = Some(value.parse::<f64>().map_err(|_| "invalid exposure")?),
+                    // Defer file reads until a saved job has rejected conflicting controls.
+                    "--environment" => runtime.environment = Some(value.clone()),
+                    "--lighting" => runtime.lighting = Some(value.clone()),
+                    "--tone-map" => {
+                        runtime.tone_map = Some(match value.as_str() {
+                            "reinhard" => ToneMap::Reinhard,
+                            "aces_fitted" => ToneMap::AcesFitted,
+                            _ => return Err("tone-map must be reinhard or aces_fitted".into()),
+                        })
+                    }
                     _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
                 }
             }
@@ -39,18 +117,10 @@ pub fn run(args: &[String]) -> Result<(), String> {
     }
     let out = out.ok_or("render requires --out FILE.png")?;
     let mut session = crate::load(input)?;
-    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
-    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
-    let mut settings = if let Some(name) = setup {
-        session.doc.render.setups.get(&name).cloned().ok_or("no saved render setup with that name")?
+    let mut settings = if let Some(name) = setup.as_deref() {
+        session.doc.render.setups.get(name).cloned().ok_or("no saved render setup with that name")?
     } else {
-        let mut settings = RenderSetup::default();
-        if let Some(camera) = session.camera {
-            settings.camera = camera;
-        } else {
-            settings.camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
-        }
-        settings
+        RenderSetup::default()
     };
     if let Some(width) = width {
         settings.width = width;
@@ -58,7 +128,27 @@ pub fn run(args: &[String]) -> Result<(), String> {
     if let Some(height) = height {
         settings.height = height;
     }
-    let params = json!({"settings":settings,"transparent_background":transparent});
+    if let Some(exposure) = exposure {
+        settings.exposure_ev = exposure;
+    }
+    // Resolve saved intent before opening a GPU or explicitly settling geometry.
+    // Width/height/exposure only change this validated inline settings clone.
+    let (mut params, needs_gpu) = runtime.request(&session, settings)?;
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    if needs_gpu {
+        session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    }
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    if setup.is_none() {
+        let camera = if let Some(camera) = session.camera {
+            camera
+        } else {
+            let mut camera = RenderSetup::default().camera;
+            camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+            camera
+        };
+        params["settings"]["camera"] = json!(camera);
+    }
     let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
     let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
     let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;

apps/solidcraft-cli/tests/action_matrix.rs

@@ -92,7 +92,7 @@ fn designs() -> Vec<(String, PathBuf)> {
     add("regressions", root.join("examples/regressions"), "json");
     add("demo", root.join("examples/demo"), "json");
     add("typical", root.join("tests/action_matrix/designs"), "json");
-    add("demo", root.join("tests/action_matrix/designs"), "solidcraft");
+    add("demo", root.join("tests/action_matrix/designs"), solidcraft_engine::io::DESIGN_EXT);
     let mut cases: Vec<PathBuf> =
         std::fs::read_dir(root.join("tests/oracle")).unwrap().flatten().map(|e| e.path()).filter(|p| p.join("recipe.json").is_file()).collect();
     cases.sort();
@@ -105,7 +105,7 @@ fn designs() -> Vec<(String, PathBuf)> {
 /// Build a design from its file.
 fn load(path: &Path) -> Result<Session, String> {
     let mut s = Session::default();
-    if path.extension().is_some_and(|x| x == "solidcraft") {
+    if solidcraft_engine::io::is_design_container_path(path) {
         s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
         return Ok(s);
     }
@@ -395,8 +395,10 @@ fn actions(s: &Session) -> Vec<Action> {
             let r = round3((shortest * 0.1).max(0.01));
             let mut add = |action, act| out.push(Action { entity: entity.clone(), action, act });
             if !smooth(e, mid) {
-                add("edge.fillet", Act::Run("solid.fillet", json!({"edges": [pt(mid)], "radius": r})));
-                add("edge.chamfer", Act::Run("solid.chamfer", json!({"edges": [pt(mid)], "distance": r})));
+                // The midpoint is interior to this edge, but other bodies (including component
+                // copies in their local frames) can have coincident edges. Retain the picked body.
+                add("edge.fillet", Act::Run("solid.fillet", json!({"body": world, "edges": [pt(mid)], "radius": r})));
+                add("edge.chamfer", Act::Run("solid.chamfer", json!({"body": world, "edges": [pt(mid)], "distance": r})));
             }
             let dir = straight(pts);
             if dir.is_some() {
@@ -1278,6 +1280,41 @@ fn rectangle(plane: Value, p0: [f64; 2], p1: [f64; 2]) -> [Value; 3] {
     ]
 }
 
+#[test]
+fn edge_round_actions_keep_the_picked_body() {
+    for (corner, length) in [([10, 0, 20], 4), ([0, 0, 0], 20)] {
+        let mut s = Session::default();
+        s.execute("solid.box", &json!({"length": 20, "width": 20, "height": 20, "body_name": "Plate"})).unwrap();
+        s.execute(
+            "solid.box",
+            &json!({"corner": corner, "length": length, "width": length, "height": length, "body_name": "Block", "operation": "new"}),
+        )
+        .unwrap();
+        let mut tried = 0;
+        for a in actions(&s) {
+            if !a.entity.starts_with("Plate/") || !matches!(a.action, "edge.chamfer" | "edge.fillet") {
+                continue;
+            }
+            let Act::Run(id, ref p) = a.act else { continue };
+            let q = &p["edges"][0];
+            let x = q[0].as_f64().unwrap();
+            if q[1] != 0.0 || q[2] != 20.0 || !(0.0..20.0).contains(&x) {
+                continue;
+            }
+            // Block either meets this midpoint or coincides with the whole edge.
+            assert_eq!(p["body"], "Plate", "{}: {p}", a.action);
+            assert_eq!(q, &json!([10.0, 0.0, 20.0]));
+            let mut unscoped = p.clone();
+            unscoped.as_object_mut().unwrap().remove("body");
+            let err = s.scratch().execute(id, &unscoped).unwrap_err().to_string();
+            assert!(err.contains("edges meet"), "{err}");
+            perform(&mut s.scratch(), &a.act, &errors(&s)).unwrap();
+            tried += 1;
+        }
+        assert_eq!(tried, 2);
+    }
+}
+
 #[test]
 fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
     for (cmd, size) in [("solid.fillet", "radius"), ("solid.chamfer", "distance")] {
@@ -1412,7 +1449,7 @@ fn a_sketch_on_a_patterned_boss_top() {
 fn construction_geometry_and_holes_on_a_moved_component() {
     let moved = || {
         vec![
-            json!({"command": "component.create", "params": {"name": "Arm"}}),
+            json!({"command": "component.create", "params": {"name": "Arm", "grounded": false}}),
             json!({"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}}),
             json!({"command": "component.activate", "params": {"component": 0}}),
             json!({"command": "occurrence.move", "params": {"occurrence": "Arm:1", "translate": [0, 50, 0]}}),
@@ -1521,7 +1558,7 @@ fn sketches_on_loft_and_sweep_faces() {
 #[test]
 fn press_pull_on_the_pi_case_floor() {
     reproduces(
-        Some("tests/action_matrix/designs/pi-case.solidcraft"),
+        Some("tests/action_matrix/designs/pi-case.sc"),
         json!([{"command": "solid.press_pull", "params": {"face": [30, 20, 0], "distance": 1}}]),
     );
 }

apps/solidcraft-cli/tests/corpus/scripts/components-arm.json

@@ -1,6 +1,6 @@
 {"commands": [
  {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
- {"command": "component.create", "params": {"name": "Arm"}},
+ {"command": "component.create", "params": {"name": "Arm", "grounded": false}},
  {"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
  {"command": "solid.fillet", "params": {"edges": [[25, 4, 4]], "radius": 1}},
  {"command": "component.activate", "params": {"component": 0}},

apps/solidcraft-cli/tests/help_output.rs

@@ -0,0 +1,159 @@
+//! An explicit help request prints usage to stdout and succeeds; an unknown command still fails.
+
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// Every command the CLI takes, with the name its own usage names: `inspect` is `eval`, and
+/// `licenses` is `licences`.
+const COMMANDS: &[(&str, &str)] = &[
+    ("run", "run"),
+    ("eval", "eval"),
+    ("inspect", "eval"),
+    ("script", "script"),
+    ("bench-open", "bench-open"),
+    ("bench-agent", "bench-agent"),
+    ("snapshot", "snapshot"),
+    ("render", "render"),
+    ("exec", "exec"),
+    ("commands", "commands"),
+    ("recipe", "recipe"),
+    ("oracle", "oracle"),
+    ("fuzz", "fuzz"),
+    ("fuzz-one", "fuzz-one"),
+    ("mcp", "mcp"),
+    ("crashes", "crashes"),
+    ("licences", "licences"),
+    ("licenses", "licences"),
+    ("gpu", "gpu"),
+    ("icon", "icon"),
+    ("bench-edit", "bench-edit"),
+    ("save-stress", "save-stress"),
+];
+
+/// The commands the usage lists: the aliases answer to another command's name.
+const LISTED: &[&str] = &[
+    "run",
+    "eval",
+    "script",
+    "bench-open",
+    "bench-agent",
+    "snapshot",
+    "render",
+    "exec",
+    "commands",
+    "recipe",
+    "oracle",
+    "fuzz",
+    "mcp",
+    "crashes",
+    "licences",
+    "gpu",
+    "icon",
+];
+
+/// The command names a text mentions after `solidcraft-cli `, each one only once.
+fn mentioned(text: &str) -> Vec<&str> {
+    let mut names: Vec<&str> = text.split("solidcraft-cli ").skip(1).filter_map(|rest| rest.split_whitespace().next()).collect();
+    names.sort_unstable();
+    names.dedup();
+    names
+}
+
+/// Runs the binary and waits at most `limit` for it to finish. `None` means it was still
+/// running and was killed: the fuzz run `fuzz --help` used to start goes on for minutes.
+fn run_within(limit: Duration, args: &[&str]) -> Option<(Option<i32>, String, String)> {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let started = Instant::now();
+    loop {
+        match child.try_wait().unwrap() {
+            Some(status) => {
+                let out = child.wait_with_output().unwrap();
+                return Some((status.code(), String::from_utf8_lossy(&out.stdout).into_owned(), String::from_utf8_lossy(&out.stderr).into_owned()));
+            }
+            None if started.elapsed() >= limit => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+            None => std::thread::sleep(Duration::from_millis(25)),
+        }
+    }
+}
+
+#[test]
+fn help_prints_usage_and_succeeds() {
+    for arg in ["--help", "-h", "help"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg(arg).output().unwrap();
+        assert!(output.status.success(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        assert!(stdout.starts_with("usage:"), "{arg}: {stdout}");
+        assert!(stdout.contains("solidcraft-cli run"), "{arg}: {stdout}");
+        assert!(output.stderr.is_empty(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+    }
+}
+
+#[test]
+fn unknown_command_still_fails_with_usage() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--not-a-command").output().unwrap();
+    assert!(!output.status.success());
+    assert!(output.stdout.is_empty());
+    assert!(String::from_utf8_lossy(&output.stderr).starts_with("error: usage:"));
+}
+
+#[test]
+fn every_command_prints_its_own_usage() {
+    for (cmd, named) in COMMANDS {
+        for flag in ["--help", "-h"] {
+            let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args([*cmd, flag]).output().unwrap();
+            assert!(output.status.success(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            assert!(stdout.starts_with("usage:"), "{cmd} {flag}: {stdout}");
+            assert_eq!(mentioned(&stdout), vec![*named], "{cmd} {flag} printed another command's usage: {stdout}");
+            assert!(output.stderr.is_empty(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+        }
+    }
+}
+
+#[test]
+fn the_top_level_usage_still_lists_every_command() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    for cmd in LISTED {
+        assert!(stdout.contains(&format!("solidcraft-cli {cmd}")), "{cmd}: {stdout}");
+    }
+}
+
+#[test]
+fn fuzz_help_does_not_start_a_fuzz_run() {
+    let Some((code, stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", "--help"]) else {
+        panic!("`fuzz --help` kept running: it started a fuzz run instead of printing the usage");
+    };
+    assert_eq!(code, Some(0), "{stderr}");
+    assert!(stdout.starts_with("usage:"), "{stdout}");
+    assert_eq!(mentioned(&stdout), vec!["fuzz"], "{stdout}");
+    assert!(stderr.is_empty(), "{stderr}");
+}
+
+#[test]
+fn fuzz_refuses_an_argument_it_does_not_take() {
+    for arg in ["--not-a-flag", "stray"] {
+        let Some((code, _stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", arg]) else {
+            panic!("`fuzz {arg}` kept running: it started a fuzz run instead of refusing the argument");
+        };
+        assert_ne!(code, Some(0), "`fuzz {arg}` succeeded");
+        assert!(stderr.contains(arg), "`fuzz {arg}`: {stderr}");
+    }
+}
+
+#[test]
+fn render_help_keeps_the_registered_gpu_request_controls() {
+    for args in [vec!["--help"], vec!["render", "--help"]] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(&args).output().unwrap();
+        assert!(output.status.success(), "{args:?}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stderr.is_empty());
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        for flag in ["--progressive", "--samples", "--max-depth", "--seed", "--exposure", "--lighting", "--environment", "--tone-map"] {
+            assert!(stdout.contains(flag), "{args:?} lost {flag}: {stdout}");
+        }
+    }
+}

apps/solidcraft-cli/tests/json_out.rs

@@ -139,11 +139,13 @@ fn eval_json_out_holds_what_stdout_would() {
 fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
     let dir = Scratch::new();
     let script = dir.script();
-    for cmd in ["run", "eval"] {
-        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
-        assert_eq!(output.status.code(), Some(1), "{cmd}");
-        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
-        assert!(output.stdout.is_empty(), "{cmd}");
+    for cmd in ["run", "eval", "inspect"] {
+        for trailing in [&[][..], &["--in"][..]] {
+            let output = cli().arg(cmd).arg(&script).arg("--json-out").args(trailing).output().unwrap();
+            assert_eq!(output.status.code(), Some(1), "{cmd}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+            assert!(output.stdout.is_empty(), "{cmd}");
+        }
 
         let missing = dir.0.join("missing").join("out.json");
         let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();

apps/solidcraft-cli/tests/mcp_connect.rs

@@ -89,3 +89,177 @@ fn mcp_connect_without_a_port_is_refused_at_start() {
         assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
     }
 }
+
+/// `mcp` with no arguments finds the running app through the discovery file and uses that
+/// launch's token; with no app behind the file it stays a headless session.
+#[test]
+fn mcp_without_arguments_finds_the_running_app() {
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-discover-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let token = "fedcba9876543210".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    std::fs::write(control_dir.join("current.port"), format!("{port}\n")).unwrap();
+    let app = std::thread::spawn(move || {
+        // The discovery probe connects and leaves without a request; the tool call follows.
+        let (stream, line) = loop {
+            let (stream, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+            if !line.is_empty() {
+                break (stream, line);
+            }
+        };
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let ok = req["token"] == json!(token);
+        let reply = json!({"id": req["id"], "ok": ok, "result": {"bodies": [], "method": req["method"]}, "error": "unauthorized"});
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "measure", "arguments": {}}})).unwrap();
+    let mut line = String::new();
+    stdout.read_line(&mut line).unwrap();
+    let r: Value = serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"));
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(r["result"]["content"][0]["text"].as_str().unwrap_or_default().contains("engine.execute"), "{r}");
+    app.join().unwrap();
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+
+    // The file names a port nothing listens on (the app crashed): a headless session instead.
+    let closed = TcpListener::bind("127.0.0.1:0").unwrap();
+    let dead = closed.local_addr().unwrap().port();
+    drop(closed);
+    std::fs::write(control_dir.join("current.port"), format!("{dead}\n")).unwrap();
+    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .stdin(Stdio::null())
+        .output()
+        .unwrap();
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("bridged to the running app"), "{}", String::from_utf8_lossy(&out.stderr));
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+/// `mcp setup` against a temporary home: the client folders it finds are the only ones it writes.
+mod setup {
+    use serde_json::{Value, json};
+    use std::path::{Path, PathBuf};
+    use std::process::Command;
+
+    fn home(name: &str) -> PathBuf {
+        let h = std::env::temp_dir().join(format!("solidcraft-mcp-setup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&h);
+        std::fs::create_dir_all(&h).unwrap();
+        h
+    }
+
+    fn run(home: &Path, args: &[&str]) -> std::process::Output {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "setup"])
+            .args(args)
+            .env_clear()
+            .env("HOME", home)
+            .env("USERPROFILE", home)
+            .env("APPDATA", home.join("AppData/Roaming"))
+            .env("LOCALAPPDATA", home.join("AppData/Local"))
+            .env("XDG_CONFIG_HOME", home.join(".config"))
+            .env("PATH", "")
+            .output()
+            .unwrap()
+    }
+
+    fn json_of(p: &Path) -> Value {
+        serde_json::from_str(&std::fs::read_to_string(p).unwrap()).unwrap()
+    }
+
+    fn exe() -> String {
+        let p = Path::new(env!("CARGO_BIN_EXE_solidcraft-cli")).canonicalize().unwrap();
+        p.to_string_lossy().trim_start_matches(r"\\?\").to_owned()
+    }
+
+    #[test]
+    fn merges_into_opencode_and_cursor_keeping_other_servers() {
+        let h = home("merge");
+        let oc = h.join(".config/opencode");
+        std::fs::create_dir_all(&oc).unwrap();
+        let old = json!({"$schema": "https://opencode.ai/config.json", "theme": "x", "mcp": {"other": {"type": "local", "command": ["o"]}}});
+        std::fs::write(oc.join("opencode.json"), old.to_string()).unwrap();
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), r#"{"mcpServers": {"other": {"command": "o"}}}"#).unwrap();
+
+        let out = run(&h, &["--live"]);
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        let v = json_of(&oc.join("opencode.json"));
+        assert_eq!(v["theme"], "x");
+        assert_eq!(v["mcp"]["other"], old["mcp"]["other"]);
+        assert_eq!(v["mcp"]["solidcraft"], json!({"type": "local", "command": [exe(), "mcp"], "enabled": true}));
+        assert_eq!(v["mcp"]["solidcraft-live"]["command"], json!([exe(), "mcp", "--connect", "127.0.0.1:7878"]));
+        assert_eq!(json_of(&oc.join("opencode.json.bak")), old);
+        let c = json_of(&h.join(".cursor/mcp.json"));
+        assert_eq!(c["mcpServers"]["other"], json!({"command": "o"}));
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"command": exe(), "args": ["mcp"]}));
+
+        // Codex (TOML) and Claude Code (a big file the CLI owns) are edited in place too.
+        std::fs::create_dir_all(h.join(".codex")).unwrap();
+        std::fs::write(h.join(".codex/config.toml"), "# mine\nmodel = \"x\"\n").unwrap();
+        let cc = "{\n  \"numStartups\": 3,\n  \"projects\": {}\n}\n";
+        std::fs::write(h.join(".claude.json"), cc).unwrap();
+        assert!(run(&h, &[]).status.success());
+        let toml = std::fs::read_to_string(h.join(".codex/config.toml")).unwrap();
+        assert!(toml.starts_with("# mine\nmodel = \"x\"\n") && toml.contains("[mcp_servers.solidcraft]"), "{toml}");
+        let c = json_of(&h.join(".claude.json"));
+        assert_eq!(c["numStartups"], 3);
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"type": "stdio", "command": exe(), "args": ["mcp"]}));
+        assert_eq!(std::fs::read_to_string(h.join(".claude.json.bak")).unwrap(), cc);
+
+        // Running again updates the same entries and leaves one of each.
+        assert!(run(&h, &[]).status.success());
+        assert_eq!(json_of(&h.join(".cursor/mcp.json"))["mcpServers"].as_object().unwrap().len(), 3);
+    }
+
+    #[test]
+    fn dry_run_writes_nothing_and_missing_clients_are_skipped() {
+        let h = home("dry");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        let out = run(&h, &["--dry-run"]);
+        assert!(out.status.success());
+        let text = String::from_utf8_lossy(&out.stdout);
+        assert!(text.contains("would write") && text.contains("solidcraft"), "{text}");
+        assert!(!h.join(".cursor/mcp.json").exists());
+        assert!(!h.join(".config/opencode").exists(), "OpenCode was not installed, so nothing is created for it");
+        let out = run(&h, &["--client", "claude-desktop"]);
+        assert!(String::from_utf8_lossy(&out.stdout).contains("not found"));
+    }
+
+    #[test]
+    fn a_file_that_is_not_json_is_left_alone() {
+        let h = home("bad");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), "{ // comment").unwrap();
+        let out = run(&h, &[]);
+        assert!(!out.status.success());
+        assert_eq!(std::fs::read_to_string(h.join(".cursor/mcp.json")).unwrap(), "{ // comment");
+    }
+
+    #[test]
+    fn claude_desktop_msix_folder_is_found() {
+        let h = home("msix");
+        let pkg = h.join("AppData/Local/Packages/Claude_abc/LocalCache/Roaming/Claude");
+        std::fs::create_dir_all(&pkg).unwrap();
+        // The MSIX folder is only read through LOCALAPPDATA, set for every platform here.
+        assert!(run(&h, &["--client", "claude-desktop"]).status.success());
+        assert!(json_of(&pkg.join("claude_desktop_config.json"))["mcpServers"]["solidcraft"].is_object());
+    }
+}

apps/solidcraft-cli/tests/mcp_render_host.rs

@@ -0,0 +1,9 @@
+//! Explicit native GPU registration must not change bridged MCP ownership.
+use std::process::Command;
+#[test]
+fn connected_application_rejects_headless_gpu_installation_before_connecting() {
+    let result = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--render-gpu", "--connect", "127.0.0.1:1"]).output().unwrap();
+    assert!(!result.status.success());
+    let message = String::from_utf8_lossy(&result.stderr);
+    assert!(message.contains("connected application owns its own device"), "{message}");
+}

apps/solidcraft-cli/tests/model_cache.rs

@@ -7,7 +7,7 @@ use std::sync::Arc;
 
 use serde_json::{Value, json};
 use solidcraft_engine::Session;
-use solidcraft_engine::doc::{ModelBody, ModelState};
+use solidcraft_engine::doc::{ModelBody, ModelState, SavedModel};
 
 fn corpus() -> Vec<PathBuf> {
     let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
@@ -149,6 +149,87 @@ fn imported_assemblies_open_from_their_model_as_evaluated() {
     check("imported hinge", s);
 }
 
+/// `built` saved with `saved`, a model of it that keeps only some states (as a file without room
+/// for all of them does, #3220), opens as the design evaluated again: evaluating just the
+/// features whose state the file left out, then after suppressing a feature at, before or after
+/// each state it kept, after undoing that, and with the marker moved there and back.
+fn check_thinned(name: &str, built: &Session, saved: &SavedModel) {
+    let design = built.design();
+    let bytes =
+        solidcraft_engine::io::write_design_container_with_cache(&design, solidcraft_engine::io::DesignCompression::Fast, None, Some(saved)).unwrap();
+    assert!(solidcraft_engine::io::read_design_geometry(&bytes).is_some(), "{name}: the file keeps the final state");
+    let path = temp(&name.replace(' ', "-"));
+    std::fs::write(&path, &bytes).unwrap();
+    let mut cached = open(&path);
+    let mut rebuilt = Session::new(solidcraft_engine::io::read_design(&bytes).unwrap());
+    let features = saved.records["features"].as_array().unwrap();
+    let unkept = features.iter().filter(|f| f["skipped"] == false && f.get("state").is_none()).count();
+    assert!(unkept > 0, "{name}: some states left out");
+    assert_eq!(cached.model.recomputed, unkept, "{name}: evaluated just the features whose state the file left out");
+    assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: opened from the file's model");
+    let n = cached.doc.features.len();
+    let mut at: Vec<usize> = features
+        .iter()
+        .enumerate()
+        .filter(|(_, f)| f["skipped"] == false && f.get("state").is_some())
+        .flat_map(|(k, _)| [k.saturating_sub(1), k, k + 1])
+        .filter(|i| *i < n)
+        .collect();
+    at.dedup();
+    for i in at {
+        let edit = json!({"feature": cached.doc.features[i].id, "suppressed": true});
+        let (a, b) = (cached.execute("timeline.suppress", &edit), rebuilt.execute("timeline.suppress", &edit));
+        assert_eq!(a.is_ok(), b.is_ok(), "{name}: suppressing feature {i}");
+        assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: feature {i} suppressed");
+        if a.is_ok() {
+            cached.execute("edit.undo", &json!({})).unwrap();
+            rebuilt.execute("edit.undo", &json!({})).unwrap();
+            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: suppressing feature {i} undone");
+        }
+        for marker in [json!({"position": i}), json!({})] {
+            cached.execute("timeline.rollback", &marker).unwrap();
+            rebuilt.execute("timeline.rollback", &marker).unwrap();
+            assert_eq!(model(name, &cached), model(name, &rebuilt), "{name}: the marker at {marker}, from feature {i}");
+        }
+    }
+    let _ = std::fs::remove_file(&path);
+}
+
+/// A model too big for its file keeps the final state, then the slowest features' states as fit
+/// (#3220). Both the smallest such model (the final state, and states that add no body to it)
+/// and one that keeps more open as the design evaluated again. The placed components' design has
+/// a cut whose fingerprint reads where the bodies before it lie, which a state left out does not
+/// say until it is evaluated.
+#[test]
+fn thinned_models_open_as_evaluated() {
+    let corpus = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/components-arm.solidcraft");
+    for sample in ["Sample Plate", "Plastic Enclosure", "components-arm"] {
+        let built = match solidcraft_engine::sample::samples().into_iter().find(|s| s.name == sample) {
+            Some(s) => {
+                let mut built = Session::default();
+                for c in (s.script)()["commands"].as_array().unwrap() {
+                    built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+                }
+                built
+            }
+            None => open(&corpus),
+        };
+        let saved = built.model.saved(&built.design()).unwrap();
+        // Every body a megabyte (the records fit in the room left over): each budget keeps one more
+        // body's worth of states.
+        let body = 1 << 20;
+        let pieces: Vec<Vec<(usize, usize)>> = (0..saved.bodies.len()).map(|i| vec![(i, body)]).collect();
+        let thinned: Vec<SavedModel> =
+            (0..=saved.bodies.len()).filter_map(|n| saved.thinned(&pieces, n * body + body - 1).map(|(m, _, _)| m)).collect();
+        let kept = |m: &SavedModel| m.records["features"].as_array().unwrap().iter().filter(|f| f.get("state").is_some()).count();
+        let smallest = thinned.first().unwrap();
+        assert!(smallest.records["states"].as_array().unwrap().len() < saved.records["states"].as_array().unwrap().len(), "{sample}");
+        let more = thinned.iter().find(|m| kept(m) > kept(smallest) && kept(m) < built.doc.features.len()).unwrap();
+        check_thinned(&format!("{sample} smallest"), &built, smallest);
+        check_thinned(&format!("{sample} thinned"), &built, more);
+    }
+}
+
 /// Opened from its model, a design evaluates only from the first feature an edit changes: the
 /// saved states before it are kept as they were read (the same states, not evaluated again).
 #[test]

apps/solidcraft-cli/tests/rebuild_topology.rs

@@ -75,12 +75,15 @@ fn designs() -> Vec<(String, Session)> {
             .unwrap()
             .flatten()
             .map(|e| e.path())
-            .filter(|p| p.extension().is_some_and(|x| x == "solidcraft" || x == "json") && !p.to_string_lossy().ends_with(".expected.json"))
+            .filter(|p| {
+                (solidcraft_engine::io::is_design_container_path(p) || p.extension().is_some_and(|x| x == "json"))
+                    && !p.to_string_lossy().ends_with(".expected.json")
+            })
             .collect();
         files.sort();
         for p in files {
             let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-            let s = if p.extension().is_some_and(|x| x == "solidcraft") {
+            let s = if solidcraft_engine::io::is_design_container_path(&p) {
                 open(&p)
             } else {
                 let mut s = Session::default();
@@ -150,7 +153,7 @@ fn pi_case_faces_per_step_at_both_heights() {
     const FACES: [(usize, usize); 13] =
         [(2, 6), (3, 10), (4, 19), (5, 19), (6, 25), (7, 43), (8, 43), (9, 55), (10, 55), (11, 59), (12, 59), (13, 63), (14, 79)];
     let dir = scratch_dir("pi");
-    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.solidcraft")).unwrap()).unwrap();
+    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.sc")).unwrap()).unwrap();
     let at = |height: &str, file: &str| {
         let mut d = design.clone();
         for p in d["params"].as_array_mut().unwrap() {

apps/solidcraft-cli/tests/run_results.rs

@@ -22,6 +22,19 @@ impl Scratch {
         std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
         path
     }
+
+    fn saving_script(&self) -> (PathBuf, PathBuf) {
+        let path = self.0.join("saving.json");
+        let saved = self.0.join("script-ran.solidcraft");
+        std::fs::write(
+            &path,
+            json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+                {"command": "file.save_as", "params": {"path": saved}}]})
+            .to_string(),
+        )
+        .unwrap();
+        (path, saved)
+    }
 }
 
 impl Drop for Scratch {
@@ -43,10 +56,96 @@ fn body_count(path: &Path) -> Value {
     json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
 }
 
+#[test]
+fn run_rejects_invalid_options_before_script_execution_or_output_writes() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--out"][..], "--out needs a value"),
+        (&["--save"][..], "--save needs a value"),
+        (&["--in"][..], "--in needs a value"),
+        (&["--out", "--quiet"][..], "--out needs a value"),
+        (&["--ouut", "part.step"][..], "doesn't take --ouut"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for existing in [false, true] {
+        let saved = dir.0.join(format!("{existing}.solidcraft"));
+        let exported = dir.0.join(format!("{existing}.step"));
+        let report = dir.0.join(format!("{existing}.json"));
+        let outputs = [&saved, &exported, &report];
+        if existing {
+            for path in outputs {
+                std::fs::write(path, b"existing output").unwrap();
+            }
+        }
+        for (extra, message) in cases {
+            let output = cli()
+                .arg("run")
+                .arg(&script)
+                .arg("--save")
+                .arg(&saved)
+                .arg("--out")
+                .arg(&exported)
+                .arg("--json-out")
+                .arg(&report)
+                .args(extra)
+                .output()
+                .unwrap();
+            assert_eq!(output.status.code(), Some(1), "{extra:?}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains(message), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+            assert!(output.stdout.is_empty());
+            assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+            for path in outputs {
+                if existing {
+                    assert_eq!(std::fs::read(path).unwrap(), b"existing output");
+                } else {
+                    assert!(!path.exists());
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_and_inspect_reject_invalid_options_before_script_execution_or_reporting() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--in"][..], "--in needs a value"),
+        (&["--in", "--quiet"][..], "--in needs a value"),
+        (&["--out", "part.step"][..], "doesn't take --out"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for command in ["eval", "inspect"] {
+        for existing in [false, true] {
+            let report = dir.0.join(format!("{command}-{existing}.json"));
+            if existing {
+                std::fs::write(&report, b"existing report").unwrap();
+            }
+            for (extra, message) in cases {
+                let output = cli().arg(command).arg(&script).arg("--json-out").arg(&report).args(extra).output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command} {extra:?}");
+                assert!(
+                    String::from_utf8_lossy(&output.stderr).contains(message),
+                    "{command} {extra:?}: {}",
+                    String::from_utf8_lossy(&output.stderr)
+                );
+                assert!(output.stdout.is_empty());
+                assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+                if existing {
+                    assert_eq!(std::fs::read(&report).unwrap(), b"existing report");
+                } else {
+                    assert!(!report.exists());
+                }
+            }
+        }
+    }
+}
+
 #[test]
 fn cli_loads_both_design_encodings_by_contents() {
     let dir = Scratch::new();
-    for extension in ["solidcraft", "solvecraft", "json"] {
+    for extension in ["sc", "solidcraft", "solvecraft", "json"] {
         let saved = dir.0.join(format!("box.{extension}"));
         json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&saved).output().unwrap());
         let bytes = std::fs::read(&saved).unwrap();
@@ -59,6 +158,84 @@ fn cli_loads_both_design_encodings_by_contents() {
     }
 }
 
+/// #1369: a pending concept that did not land in the numbered release must not be silently
+/// dropped on open/resave, in either encoding or before replacing an existing destination.
+#[test]
+fn unknown_pending_concepts_preserve_the_open_design_and_output_files() {
+    use solidcraft_engine::{Session, doc, io};
+
+    let dir = Scratch::new();
+    for version in [33, doc::format::FORMAT] {
+        let mut experimental = doc::Document::new("Experimental");
+        experimental.format = doc::format::format_string(version);
+        experimental.format_pending.push("experimental-card".into());
+        for (extension, bytes) in [("json", io::write_design(&experimental)), ("solidcraft", io::write_design_container(&experimental).unwrap())] {
+            let source = dir.0.join(format!("experimental-{version}.{extension}"));
+            std::fs::write(&source, &bytes).unwrap();
+            let mut session = Session::default();
+            session.execute("solid.box", &json!({"length": 2, "width": 3, "height": 4})).unwrap();
+            let original = session.doc.clone();
+            let original_path = session.path.clone();
+            let undo = session.undo.len();
+            let dirty = session.is_dirty();
+            let err = session.execute("doc.open", &json!({"path": source})).unwrap_err().to_string();
+            assert!(err.contains("experimental-card") && err.contains("update SolidCraft"), "{err}");
+            assert_eq!(session.doc, original);
+            assert_eq!(session.path, original_path);
+            assert_eq!(session.undo.len(), undo);
+            assert_eq!(session.is_dirty(), dirty);
+
+            for existing in [false, true] {
+                let destination = dir.0.join(format!("output-{version}-{extension}-{existing}.{extension}"));
+                let backup = io::backup_path(&destination);
+                if existing {
+                    std::fs::write(&destination, b"existing design").unwrap();
+                    std::fs::write(&backup, b"existing backup").unwrap();
+                }
+                let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
+                assert_eq!(output.status.code(), Some(1));
+                let error = String::from_utf8_lossy(&output.stderr);
+                assert!(error.contains("experimental-card") && error.contains("update SolidCraft"), "{error}");
+                if existing {
+                    assert_eq!(std::fs::read(&destination).unwrap(), b"existing design");
+                    assert_eq!(std::fs::read(&backup).unwrap(), b"existing backup");
+                } else {
+                    assert!(!destination.exists() && !backup.exists());
+                }
+                assert_eq!(std::fs::read(&source).unwrap(), bytes);
+            }
+        }
+    }
+}
+
+#[test]
+fn known_pending_concepts_and_released_files_round_trip_with_inert_metadata() {
+    use solidcraft_engine::{doc, io};
+
+    let dir = Scratch::new();
+    let current = doc::Document::new("Supported");
+    let mut released = current.clone();
+    released.format = doc::format::format_string(33);
+    released.format_pending.clear();
+    let mut experimental = released.clone();
+    experimental.format_pending.push("reserved-body-names".into());
+    for (index, mut document) in [current, released, experimental].into_iter().enumerate() {
+        document.metadata.0.insert("com.example.tool".into(), json!({"format_pending": ["experimental-card"], "physical_card": {"density": 700}}));
+        for (extension, bytes) in [("json", io::write_design(&document)), ("solidcraft", io::write_design_container(&document).unwrap())] {
+            let source = dir.0.join(format!("supported-{index}.{extension}"));
+            let destination = dir.0.join(format!("resaved-{index}.{extension}"));
+            std::fs::write(&source, &bytes).unwrap();
+            let output = cli().args(["run", "--in"]).arg(&source).arg("--save").arg(&destination).output().unwrap();
+            assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+            let reopened = io::read_design(&std::fs::read(&destination).unwrap()).unwrap();
+            assert_eq!(reopened.metadata, document.metadata);
+            assert_eq!(reopened.name, document.name);
+            assert_eq!(reopened.features, document.features);
+            assert_eq!(std::fs::read(&source).unwrap(), bytes);
+        }
+    }
+}
+
 #[test]
 fn results_still_save_and_export_the_script_once() {
     let dir = Scratch::new();
@@ -90,6 +267,110 @@ fn results_with_base_design_and_quiet_still_report_and_save() {
     assert_eq!(body_count(&base), 1);
 }
 
+/// `eval` and its alias must measure the script applied to the input design, rather than
+/// silently reporting the input alone (#6861).
+#[test]
+fn eval_runs_its_script_on_the_in_design() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solidcraft");
+    let script = dir.0.join("add.json");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let original = std::fs::read(&base).unwrap();
+    std::fs::write(
+        &script,
+        json!({"commands": [{"command": "solid.box", "params": {"length": 5, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
+    )
+    .unwrap();
+    for command in ["eval", "inspect"] {
+        // Both existing one-input forms still measure just the original body.
+        for input in [&base, &dir.script()] {
+            for named_input in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if named_input {
+                    c.arg("--in");
+                }
+                let measured = json_output(c.arg(input).output().unwrap());
+                assert_eq!(measured["body_count"], 1);
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 24.0).abs() < 1e-6);
+            }
+        }
+        for input_first in [false, true] {
+            for to_file in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if input_first {
+                    c.arg("--in").arg(&base).arg(&script);
+                } else {
+                    c.arg(&script).arg("--in").arg(&base);
+                }
+                let report = dir.0.join("measurement.json");
+                if to_file {
+                    c.arg("--json-out").arg(&report);
+                }
+                let output = c.output().unwrap();
+                let measured = if to_file {
+                    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+                    assert!(output.stdout.is_empty());
+                    serde_json::from_slice(&std::fs::read(&report).unwrap()).unwrap()
+                } else {
+                    json_output(output)
+                };
+                assert_eq!(measured["body_count"], 2, "{command}, input_first={input_first}, to_file={to_file}");
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 84.0).abs() < 1e-6);
+                assert_eq!(measured["timeline"].as_array().unwrap().len(), 2, "the script runs exactly once");
+                assert_eq!(std::fs::read(&base).unwrap(), original, "evaluation never saves its changes to the input");
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_propagates_script_errors_before_writing_a_report() {
+    let dir = Scratch::new();
+    let base = dir.script();
+    let script = dir.0.join("bad.json");
+    for command in ["eval", "inspect"] {
+        for contents in ["{", r#"{"commands":[{"command":"missing.command","params":{}}]}"#] {
+            std::fs::write(&script, contents).unwrap();
+            let report = dir.0.join("report.json");
+            let output = cli().arg(command).arg(&script).arg("--in").arg(&base).arg("--json-out").arg(&report).output().unwrap();
+            assert_eq!(output.status.code(), Some(1));
+            assert!(!output.stderr.is_empty());
+            assert!(output.stdout.is_empty());
+            assert!(!report.exists());
+        }
+    }
+}
+
+#[test]
+fn eval_rejects_unknown_options_and_missing_input_values_before_writing_a_report() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let report = dir.0.join("report.json");
+    for command in ["eval", "inspect"] {
+        for (options, message) in [(&["--frobnicate", "1"][..], "doesn't take --frobnicate"), (&["--in"][..], "--in needs a value")] {
+            for options_first in [false, true] {
+                std::fs::write(&report, b"previous report").unwrap();
+                let mut c = cli();
+                c.arg(command);
+                if options_first {
+                    c.args(options).arg("--json-out").arg(&report).arg(&script);
+                } else {
+                    c.arg(&script).args(options).arg("--json-out").arg(&report);
+                }
+                // A following option also proves that --in cannot consume a flag as its value.
+                let output = c.output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command}, {options:?}");
+                let error = String::from_utf8_lossy(&output.stderr);
+                assert!(error.contains(message), "{command}: {error}");
+                assert!(output.stdout.is_empty());
+                assert_eq!(std::fs::read(&report).unwrap(), b"previous report");
+            }
+        }
+    }
+}
+
 #[test]
 fn results_propagate_output_errors() {
     let dir = Scratch::new();
@@ -131,6 +412,11 @@ fn legacy_extension_and_format_tag_still_open() {
     assert_eq!(body_count(&resaved), 2);
     let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
     assert!(reopened.to_json().contains("\"solidcraft/"));
+    // `.solidcraft` (before `.sc`) opens as `--in` and as the design to evaluate; `.sc` too.
+    let current = dir.0.join("current.sc");
+    json_output(cli().args(["run", "--in"]).arg(&resaved).arg(dir.script()).arg("--save").arg(&current).output().unwrap());
+    assert_eq!(body_count(&current), 3);
+    assert!(solidcraft_engine::io::is_design_container(&std::fs::read(&current).unwrap()), "a .sc file is a design container");
 }
 
 /// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
@@ -209,3 +495,175 @@ fn timings_and_profile_report_each_command() {
     assert!(!output.status.success());
     assert!(String::from_utf8_lossy(&output.stderr).contains("--timings needs a script"));
 }
+
+fn render_setup_script(dir: &Scratch, job: Value) -> PathBuf {
+    let path = dir.0.join("render.json");
+    std::fs::write(
+        &path,
+        json!({"commands":[
+            {"command":"solid.box","params":{"length":10,"width":10,"height":10}},
+            {"command":"render.settings.set","params":{"name":"Portable setup","set":{"width":16,"height":16,"job":job}}}
+        ]})
+        .to_string(),
+    )
+    .unwrap();
+    path
+}
+
+#[cfg(feature = "raytrace-cpu")]
+#[test]
+fn render_uses_typed_cpu_setups_from_scripts_and_saved_designs() {
+    for options in [json!({}), json!({"progressive":{"samples_per_pixel":3,"seed":81},"lights":[]})] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":options}));
+        let image = dir.0.join("script.png");
+        let result = json_output(
+            cli()
+                .arg("render")
+                .arg(&script)
+                .args(["--setup", "Portable setup", "--out"])
+                .arg(&image)
+                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
+                .output()
+                .unwrap(),
+        );
+        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-raytrace");
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
+        assert_eq!(result["preflight"]["request"]["integrator"], "raytrace");
+        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
+        let png = image::load_from_memory(&std::fs::read(&image).unwrap()).unwrap();
+        assert_eq!((png.width(), png.height()), (16, 16));
+
+        let saved = dir.0.join("portable.solidcraft");
+        json_output(cli().arg("run").arg(&script).arg("--save").arg(&saved).output().unwrap());
+        let original = std::fs::read(&saved).unwrap();
+        let overridden = dir.0.join("overridden.png");
+        let result = json_output(
+            cli()
+                .arg("render")
+                .arg(&saved)
+                .args(["--setup", "Portable setup", "--out"])
+                .arg(&overridden)
+                .args(["--width", "12", "--height", "8", "--exposure", "1.25"])
+                .env("SOLIDCRAFT_GPU", "must-not-be-read-for-cpu")
+                .output()
+                .unwrap(),
+        );
+        assert_eq!(result["preflight"]["request"]["width"], 12);
+        assert_eq!(result["preflight"]["request"]["height"], 8);
+        assert_eq!(result["preflight"]["request"]["raytrace"]["exposure_ev"], 1.25);
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-raytrace");
+        assert_eq!(result["preflight"]["request"]["raytrace"].get("progressive"), options.get("progressive"));
+        let png = image::load_from_memory(&std::fs::read(overridden).unwrap()).unwrap();
+        assert_eq!((png.width(), png.height()), (12, 8));
+        assert_eq!(std::fs::read(saved).unwrap(), original, "CLI overrides must not rewrite saved intent");
+    }
+}
+
+#[test]
+fn render_preserves_typed_raster_and_legacy_runtime_controls() {
+    for job in [Value::Null, json!({"method":"raster","transparent_background":true})] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, job.clone());
+        let out = dir.0.join("raster.png");
+        let mut command = cli();
+        command
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-raster");
+        if job.is_null() {
+            command.arg("--transparent");
+        }
+        let result = json_output(command.output().unwrap());
+        assert_eq!(result["preflight"]["resolved"]["executor"], "cpu-product");
+        assert_eq!(result["export"]["frame"]["executor"], "cpu-product");
+        assert_eq!(result["preflight"]["request"]["transparent_background"], true);
+        assert!(std::fs::read(out).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"));
+    }
+}
+
+#[test]
+fn typed_render_rejects_explicit_runtime_flags_before_gpu_or_option_file_reads() {
+    let dir = Scratch::new();
+    let script = render_setup_script(&dir, json!({"method":"gpu_path","options":{"samples":64,"seed":0}}));
+    let out = dir.0.join("existing.png");
+    std::fs::write(&out, b"previous completed image").unwrap();
+    for flags in [
+        &["--progressive"][..],
+        &["--transparent"][..],
+        &["--samples", "64"][..],
+        &["--max-depth", "8"][..],
+        &["--seed", "0"][..],
+        &["--lighting", "deliberately-missing-lighting.json"][..],
+        &["--tone-map", "reinhard"][..],
+        &["--environment", "deliberately-missing-environment.json"][..],
+    ] {
+        let output = cli()
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .arg("--overwrite")
+            .args(flags)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-conflicts")
+            .output()
+            .unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains(&format!("{} cannot accompany a typed saved render setup", flags[0])), "{error}");
+        assert!(output.stdout.is_empty());
+        assert_eq!(std::fs::read(&out).unwrap(), b"previous completed image");
+    }
+}
+
+#[test]
+fn typed_gpu_render_selects_its_host_without_a_progressive_runtime_flag() {
+    // A deliberately invalid policy proves that dispatch reached the GPU host
+    // without depending on an adapter or accepting a CPU fallback. The legacy
+    // --progressive path must still reach that same host-selection boundary.
+    for job in [json!({"method":"gpu_path","options":{"samples":2}}), Value::Null] {
+        let dir = Scratch::new();
+        let script = render_setup_script(&dir, job.clone());
+        let out = dir.0.join("gpu.png");
+        let mut command = cli();
+        command.arg("render").arg(&script).args(["--setup", "Portable setup", "--out"]).arg(&out).env("SOLIDCRAFT_GPU", "not-a-gpu-policy");
+        if job.is_null() {
+            command.arg("--progressive");
+        }
+        let output = command.output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains("SOLIDCRAFT_GPU must be auto, hardware, software or cpu"), "{error}");
+        assert!(!out.exists());
+    }
+}
+
+#[test]
+fn render_setup_overrides_obey_shared_validation_before_host_initialization() {
+    let dir = Scratch::new();
+    let script = render_setup_script(&dir, json!({"method":"cpu_raytrace","options":{"progressive":{"samples_per_pixel":64}}}));
+    let out = dir.0.join("invalid.png");
+    // 1024 * 1024 * 64 exceeds the unchanged default Compact camera-sample
+    // budget. Admission must name that envelope before initializing any host.
+    for (flags, message) in [
+        (&["--width", "1024", "--height", "1024"][..], "CPU Compact exceeds its 16777216 camera-sample admission"),
+        (&["--width", "0"][..], "render output must be at least"),
+        (&["--exposure", "NaN"][..], "render exposure must be finite"),
+    ] {
+        let output = cli()
+            .arg("render")
+            .arg(&script)
+            .args(["--setup", "Portable setup", "--out"])
+            .arg(&out)
+            .args(flags)
+            .env("SOLIDCRAFT_GPU", "must-not-be-read-for-invalid-settings")
+            .output()
+            .unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        let error = String::from_utf8_lossy(&output.stderr);
+        assert!(error.contains(message), "{error}");
+        assert!(!out.exists());
+    }
+}

apps/solidcraft-cli/tests/straight_edges_after_cuts.rs

@@ -1,5 +1,5 @@
 //! Straight edges stay one edge after many cuts (#1049). The owner's design
-//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
+//! (`tests/action_matrix/designs/crazy-geom-cuts.sc`, saved by 0.10.0): five extrudes,
 //! joins and cuts, over four sketches, three of them on faces of the body with the faces'
 //! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
 //! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
@@ -14,7 +14,7 @@ use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
 use solidcraft_engine::geom::Vec3;
 
 fn design() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.sc")
 }
 
 fn open(path: &Path) -> Session {

apps/solidcraft-web/Cargo.toml

@@ -13,11 +13,17 @@ workspace = true
 name = "solidcraft-web"
 path = "src/main.rs"
 
+[features]
+default = []
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+
 [dependencies]
 solidcraft-engine = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
+url = "2"
+percent-encoding = "2"
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
@@ -30,5 +36,6 @@ web-sys = { version = "0.3", features = [
     "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
     "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
     "IdbFactory", "IdbDatabase", "IdbObjectStore", "IdbOpenDbRequest", "IdbRequest", "IdbTransaction", "IdbTransactionMode",
-    "BeforeUnloadEvent", "Event", "EventTarget", "Response", "MediaQueryList", "Gamepad", "Performance",
+    "Headers", "ReadableStream", "ReadableStreamDefaultReader",
+    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "FormData", "RequestInit", "MediaQueryList", "Gamepad", "Performance",
 ] }

apps/solidcraft-web/index.html

@@ -27,12 +27,12 @@
   <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
   <meta name="theme-color" content="#343840">
   <link rel="manifest" href="manifest.webmanifest">
-  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
-  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/io.tangencylabs.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/io.tangencylabs.solidcraft.png">
   <link data-trunk rel="copy-file" href="manifest.webmanifest" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
   <canvas id="solidcraft_canvas"></canvas>

apps/solidcraft-web/manifest.webmanifest

@@ -9,8 +9,8 @@
   "theme_color": "#343840",
   "categories": ["productivity", "utilities"],
   "icons": [
-    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
-    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
-    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+    { "src": "icons/32x32/io.tangencylabs.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/io.tangencylabs.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/io.tangencylabs.solidcraft.png", "sizes": "512x512", "type": "image/png" }
   ]
 }

apps/solidcraft-web/src/disk.rs

@@ -59,6 +59,34 @@ pub fn make_id(ms: u64, random: u64) -> String {
     format!("{ms:x}-{random:x}")
 }
 
+/// How long a remembered file may go unused, and unreferenced by the recent designs and the
+/// autosave, before the browser's copy of its handle is dropped.
+pub const HANDLE_MAX_AGE_MS: f64 = 90.0 * 24.0 * 3600.0 * 1000.0;
+
+/// What to do with the remembered handles.
+#[derive(Debug, Default, PartialEq)]
+pub struct PrunePlan {
+    /// Handles to forget.
+    pub delete: Vec<String>,
+    /// Handles seen unused for the first time: start their clock.
+    pub stamp: Vec<String>,
+}
+
+/// Decide which of the remembered handles `ids` (id, when it was last stamped) to forget: those
+/// that no recent design or autosave (`keep`) names and that have gone unused for `max_age`. One
+/// never stamped starts its clock now, so a file another tab has just saved is never dropped.
+pub fn plan_prune(ids: &[(String, Option<f64>)], keep: &std::collections::HashSet<String>, now: f64, max_age: f64) -> PrunePlan {
+    let mut plan = PrunePlan::default();
+    for (id, stamped) in ids.iter().filter(|(id, _)| !keep.contains(id)) {
+        match stamped {
+            None => plan.stamp.push(id.clone()),
+            Some(at) if now - at > max_age => plan.delete.push(id.clone()),
+            Some(_) => {}
+        }
+    }
+    plan
+}
+
 /// Where a design saved with Save As goes.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SaveTarget {
@@ -86,10 +114,70 @@ pub fn opens_design(extensions: &[&str]) -> bool {
     extensions.is_empty() || extensions.iter().any(|e| solidcraft_engine::io::DESIGN_EXTS.contains(e))
 }
 
-/// The file type a Save As dialog offers for `name`: (description, MIME type, extension).
-pub fn save_type(name: &str) -> (&'static str, &'static str, &'static str) {
-    let json = std::path::Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case("json"));
-    if json { ("Plain JSON design", "application/json", ".json") } else { ("SolidCraft design", "application/octet-stream", ".solidcraft") }
+/// Where an Open for `extensions` (what the command reads; `&[]`: anything) is answered.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum OpenRoute {
+    /// The browser's open dialog for a design: the file keeps its handle, so Save writes back.
+    Disk,
+    /// The "Files in this browser" window, where the browser can't open a design from the disk.
+    Panel,
+    /// A plain file input that offers these types: the file is read into the engine's files and
+    /// the command runs on it (Insert DXF or SVG, images, meshes, imported settings).
+    Upload,
+}
+
+/// Choose how an Open for `extensions` asks for its file; `api`: the browser can open a file
+/// from the disk and keep its handle.
+pub fn open_route(api: bool, extensions: &[&str]) -> OpenRoute {
+    match (opens_design(extensions), api) {
+        (true, true) => OpenRoute::Disk,
+        (true, false) => OpenRoute::Panel,
+        (false, _) => OpenRoute::Upload,
+    }
+}
+
+/// The `accept` list of a file input for `extensions` (with or without their dot): ".dxf,.svg".
+pub fn accept_list(extensions: &[&str]) -> String {
+    let list: Vec<String> = extensions
+        .iter()
+        .map(|e| e.trim().trim_start_matches('.'))
+        .filter(|e| !e.is_empty())
+        .map(|e| format!(".{}", e.to_ascii_lowercase()))
+        .collect();
+    list.join(",")
+}
+
+/// The `accept` of a file input for `extensions` on this device (`apple_touch`: an iPhone or
+/// iPad). The picker there offers only files of a type the system knows from the list and greys
+/// out the rest, `.solidcraft` designs among them, since no system type has that extension
+/// (#6977). So it offers every file there, and the opener checks what it gets.
+pub fn input_accept(extensions: &[&str], apple_touch: bool) -> String {
+    if apple_touch { String::new() } else { accept_list(extensions) }
+}
+
+/// The browser runs on an iPhone or iPad (every browser there is WebKit), from its
+/// `navigator.userAgent` and `navigator.maxTouchPoints`. iPadOS presents itself as a Mac; only its
+/// touch screen tells them apart.
+pub fn apple_touch(user_agent: &str, touch_points: i32) -> bool {
+    ["iPhone", "iPad", "iPod"].iter().any(|d| user_agent.contains(d)) || (user_agent.contains("Macintosh") && touch_points > 1)
+}
+
+/// The largest file an upload for `extensions` reads: images go into a canvas, which has a size
+/// limit, so a bigger one is refused before it is read. `None`: the importer checks the file.
+pub fn upload_limit(extensions: &[&str]) -> Option<usize> {
+    let image = |e: &&str| ["png", "jpg", "jpeg"].contains(&e.trim_start_matches('.').to_ascii_lowercase().as_str());
+    (!extensions.is_empty() && extensions.iter().all(image)).then_some(solidcraft_engine::doc::canvas::MAX_CANVAS_BYTES)
+}
+
+/// The file type a Save As dialog offers for `name`: (description, MIME type, extension). A
+/// design is `.sc` unless the name already has an older design extension, which it keeps.
+pub fn save_type(name: &str) -> (&'static str, &'static str, String) {
+    let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+    match ext.as_deref() {
+        Some("json") => ("Plain JSON design", "application/json", ".json".into()),
+        Some(e) if solidcraft_engine::io::is_design_ext(e) => ("SolidCraft design", "application/octet-stream", format!(".{e}")),
+        _ => ("SolidCraft design", "application/octet-stream", format!(".{}", solidcraft_engine::io::DESIGN_EXT)),
+    }
 }
 
 /// Is this a cancelled dialog (the browser's `AbortError`)? Not an error to show.
@@ -112,7 +200,7 @@ mod web {
     use wasm_bindgen_futures::{JsFuture, spawn_local};
     use web_sys::{FileSystemFileHandle, IdbDatabase, IdbObjectStore, IdbOpenDbRequest, IdbRequest, IdbTransactionMode};
 
-    use super::{is_abort, make_id, opens_design, parse, path, save_type};
+    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, parse, path, plan_prune, save_type};
     use crate::files::{Files, err, read_handle};
 
     const DB: &str = "solidcraft-disk-handles";
@@ -181,7 +269,7 @@ mod web {
         let options = Object::new();
         let _ = Reflect::set(&options, &"suggestedName".into(), &name.into());
         let (description, mime, extension) = save_type(name);
-        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, extension));
+        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, &extension));
         options
     }
 
@@ -266,7 +354,9 @@ mod web {
         let options = Object::new();
         let _ = Reflect::set(&options, &"multiple".into(), &JsValue::FALSE);
         let extensions = Array::new();
-        for e in [".solidcraft", ".solvecraft", ".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf"] {
+        let designs = solidcraft_engine::io::DESIGN_EXTS.iter().map(|e| format!(".{e}"));
+        let others = [".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm", ".dxf", ".svg"].map(String::from);
+        for e in designs.chain(others) {
             extensions.push(&e.into());
         }
         let accept = Object::new();
@@ -287,11 +377,6 @@ mod web {
         p
     }
 
-    /// Does an Open for `extensions` use the browser's open dialog?
-    pub fn handles_open(extensions: &[&str]) -> bool {
-        supported() && opens_design(extensions)
-    }
-
     // ---- writing ------------------------------------------------------------------------
 
     /// Queue what a command wrote to a disk path. Writes go one at a time; a newer write of the
@@ -397,10 +482,106 @@ mod web {
         db.transaction_with_str_and_mode(STORE, mode).map_err(err)?.object_store(STORE).map_err(err)
     }
 
+    /// Key of the time a handle was last used (the handle's own key is its id).
+    fn stamp_key(id: &str) -> String {
+        format!("at:{id}")
+    }
+
     async fn remember(id: &str, handle: &FileSystemFileHandle) -> Result<(), String> {
         let db = open_db().await?;
-        let req = store(&db, IdbTransactionMode::Readwrite)?.put_with_key(handle, &id.into()).map_err(err)?;
-        result(&req).await.map(|_| ())
+        let store = store(&db, IdbTransactionMode::Readwrite)?;
+        result(&store.put_with_key(handle, &id.into()).map_err(err)?).await?;
+        result(&store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into()).map_err(err)?).await.map(|_| ())
+    }
+
+    /// Note that the file was used now.
+    async fn touch(id: &str) {
+        let Ok(db) = open_db().await else { return };
+        if let Ok(store) = store(&db, IdbTransactionMode::Readwrite)
+            && let Ok(req) = store.put_with_key(&js_sys::Date::now().into(), &stamp_key(id).into())
+        {
+            let _ = result(&req).await;
+        }
+    }
+
+    /// The ids of every remembered file.
+    pub async fn known_ids() -> Result<Vec<String>, String> {
+        let db = open_db().await?;
+        let req = store(&db, IdbTransactionMode::Readonly)?.get_all_keys().map_err(err)?;
+        let keys: Array = result(&req).await?.dyn_into().map_err(|_| "no keys".to_string())?;
+        Ok(keys.iter().filter_map(|k| k.as_string()).filter(|k| !k.starts_with("at:")).collect())
+    }
+
+    async fn forget(ids: &[String]) -> Result<(), String> {
+        let db = open_db().await?;
+        let store = store(&db, IdbTransactionMode::Readwrite)?;
+        for id in ids {
+            result(&store.delete(&id.as_str().into()).map_err(err)?).await?;
+            result(&store.delete(&stamp_key(id).into()).map_err(err)?).await?;
+            HANDLES.with(|h| h.borrow_mut().remove(id));
+        }
+        Ok(())
+    }
+
+    /// Forget the remembered files nothing refers to any more (`keep`: the ids the recent designs
+    /// and the autosave name), once they have gone unused for a long while.
+    pub fn prune(keep: std::collections::HashSet<String>) {
+        spawn_local(async move {
+            let r = async {
+                // A transaction ends when the page awaits anything but its own requests, so each
+                // step opens its own.
+                let known = known_ids().await?;
+                let db = open_db().await?;
+                let reading = store(&db, IdbTransactionMode::Readonly)?;
+                let mut ids = Vec::new();
+                for id in known {
+                    let at = result(&reading.get(&stamp_key(&id).into()).map_err(err)?).await?.as_f64();
+                    ids.push((id, at));
+                }
+                let plan = plan_prune(&ids, &keep, js_sys::Date::now(), HANDLE_MAX_AGE_MS);
+                for id in &plan.stamp {
+                    touch(id).await;
+                }
+                forget(&plan.delete).await
+            };
+            if let Err(e) = r.await {
+                log::warn!("remembered files weren't tidied: {e}");
+            }
+        });
+    }
+
+    /// Open a design remembered from an earlier session (a recent one, after a reload): ask once
+    /// for access to the file (call in the click), read it into the engine's files and queue it
+    /// to open. A file that is gone is forgotten and dropped from the recent designs.
+    pub fn restore(files: &Rc<Files>, path: &str) {
+        let Some((id, name)) = parse(path) else { return };
+        let (files, path, id, name) = (files.clone(), path.to_string(), id.to_string(), name.to_string());
+        spawn_local(async move {
+            let r = async {
+                let handle = handle_for(&id).await?;
+                ensure_readwrite(&handle).await?;
+                read_handle(&handle).await
+            };
+            match r.await {
+                Ok(bytes) => {
+                    vfs::insert(&path, bytes);
+                    files.opened.borrow_mut().push(path);
+                    files.wake();
+                    touch(&id).await;
+                }
+                Err(e) => {
+                    let gone = e.contains("NotFoundError") || e.contains("could not be found") || e.contains("no longer remembers");
+                    if gone {
+                        let _ = forget(std::slice::from_ref(&id)).await;
+                        files.disk_known.borrow_mut().remove(&id);
+                        files.gone.borrow_mut().push(path);
+                        files.say(format!("{name} isn't where it was saved any more"), true);
+                    } else {
+                        files.say(format!("{name}: {e}"), true);
+                    }
+                }
+            }
+        });
     }
 
     async fn recall(id: &str) -> Result<Option<JsValue>, String> {
@@ -453,6 +634,24 @@ mod tests {
         assert_eq!(route("/disk/18f-2a/Bracket.solidcraft"), WriteTo::Disk);
         assert_eq!(route("/downloads/part.step"), WriteTo::Download);
         assert_eq!(route("/upload/part.step"), WriteTo::Memory);
+        // The temporary folder (a screenshot without a path, #7192) stays in memory.
+        assert_eq!(route(&format!("{}/solidcraft-shot.png", solidcraft_engine::io::vfs::BROWSER_TEMP)), WriteTo::Memory);
+    }
+
+    #[test]
+    fn only_unreferenced_handles_unused_for_long_are_forgotten() {
+        let keep: std::collections::HashSet<String> = ["recent".to_string()].into();
+        let day = 24.0 * 3600.0 * 1000.0;
+        let now = 1000.0 * day;
+        let ids = vec![
+            ("recent".to_string(), Some(now - 200.0 * day)),
+            ("old".to_string(), Some(now - 100.0 * day)),
+            ("fresh".to_string(), Some(now - 5.0 * day)),
+            ("unstamped".to_string(), None),
+        ];
+        let plan = plan_prune(&ids, &keep, now, HANDLE_MAX_AGE_MS);
+        assert_eq!(plan, PrunePlan { delete: vec!["old".to_string()], stamp: vec!["unstamped".to_string()] });
+        assert_eq!(plan_prune(&[], &keep, now, HANDLE_MAX_AGE_MS), PrunePlan::default());
     }
 
     #[test]
@@ -475,17 +674,55 @@ mod tests {
     #[test]
     fn only_design_opens_use_the_disk_dialog() {
         assert!(opens_design(&[]));
+        assert!(opens_design(&["sc"]));
         assert!(opens_design(&["solidcraft"]));
         assert!(opens_design(&["solvecraft"]));
         assert!(!opens_design(&["step", "stp"]));
         assert!(!opens_design(&["json"]));
     }
 
+    /// Insert DXF or SVG, images and other non-design files get a file input that offers their
+    /// types in every browser (#2052); designs keep the disk dialog or the browser's files.
+    #[test]
+    fn opens_of_other_files_use_a_file_input_for_their_types() {
+        assert_eq!(open_route(true, &["dxf"]), OpenRoute::Upload);
+        assert_eq!(open_route(false, &["png", "jpg", "jpeg"]), OpenRoute::Upload);
+        assert_eq!(open_route(true, &[]), OpenRoute::Disk);
+        assert_eq!(open_route(false, &["solidcraft"]), OpenRoute::Panel);
+        assert_eq!(accept_list(&["dxf"]), ".dxf");
+        assert_eq!(accept_list(&["png", ".JPG", "", "jpeg"]), ".png,.jpg,.jpeg");
+        assert_eq!(accept_list(&[]), "");
+        assert!(upload_limit(&["png", "jpg", "jpeg"]).is_some());
+        assert_eq!(upload_limit(&["dxf"]), None);
+    }
+
+    /// An iPhone or iPad greys out a `.solidcraft` design the `accept` list names, as it knows no
+    /// type for that extension, so its inputs offer every file; other devices keep the list (#6977).
+    #[test]
+    fn file_inputs_on_an_iphone_or_ipad_offer_every_file() {
+        let iphone =
+            "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1";
+        let mac = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15";
+        let chrome_ios = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/138.0.7204.156 Mobile/15E148 Safari/604.1";
+        let chrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36";
+        assert!(apple_touch(iphone, 5));
+        assert!(apple_touch(chrome_ios, 5), "every browser on iOS has the same picker");
+        assert!(apple_touch(mac, 5), "an iPad presents itself as a Mac");
+        assert!(!apple_touch(mac, 0), "a Mac has no touch screen");
+        assert!(!apple_touch(chrome, 10), "a touch screen elsewhere filters as before");
+        assert!(!apple_touch("", 0), "hostile input is just not an iPhone");
+        let designs = ["solidcraft", "json", "step"];
+        assert_eq!(input_accept(&designs, true), "");
+        assert_eq!(input_accept(&designs, false), ".solidcraft,.json,.step");
+    }
+
     #[test]
     fn the_save_dialog_offers_the_type_of_the_name() {
-        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
+        assert_eq!(save_type("Plate.sc").2, ".sc");
         assert_eq!(save_type("Plate.JSON").2, ".json");
-        assert_eq!(save_type("Plate").2, ".solidcraft");
+        assert_eq!(save_type("Plate").2, ".sc");
+        // A design opened under an older extension keeps it.
+        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
     }
 
     #[test]

apps/solidcraft-web/src/easyprint.rs

@@ -0,0 +1,40 @@
+//! Open with EasyPrint in the browser: upload the model to Printables' import endpoint with
+//! `fetch` (it allows any origin) and answer with the address to open.
+
+use std::sync::mpsc::Sender;
+
+use js_sys::{Array, Uint8Array};
+use solidcraft_engine::easyprint::{IMPORT_URL, parse_import_response};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::files::err;
+
+/// Start the upload; the answer arrives on `done`.
+pub fn upload(name: &str, bytes: Vec<u8>, done: Sender<Result<String, String>>) {
+    let name = name.to_string();
+    spawn_local(async move {
+        let _ = done.send(post(&name, &bytes).await);
+    });
+}
+
+async fn post(name: &str, bytes: &[u8]) -> Result<String, String> {
+    let window = web_sys::window().ok_or("no window")?;
+    let parts = Array::new();
+    parts.push(&Uint8Array::from(bytes));
+    let blob = web_sys::Blob::new_with_u8_array_sequence(&parts).map_err(err)?;
+    let form = web_sys::FormData::new().map_err(err)?;
+    form.append_with_blob_and_filename("file", &blob, name).map_err(err)?;
+    form.append_with_str("file_name", name).map_err(err)?;
+    let headers = web_sys::Headers::new().map_err(err)?;
+    headers.set("Accept", "application/json").map_err(err)?;
+    let init = web_sys::RequestInit::new();
+    init.set_method("POST");
+    init.set_body(&form);
+    init.set_headers(&headers);
+    let response = JsFuture::from(window.fetch_with_str_and_init(IMPORT_URL, &init)).await.map_err(err)?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "response cast failed".to_string())?;
+    let status = response.status();
+    let text = JsFuture::from(response.text().map_err(err)?).await.map_err(err)?;
+    parse_import_response(status, text.as_string().unwrap_or_default().as_bytes())
+}

apps/solidcraft-web/src/files.rs

@@ -24,11 +24,13 @@ pub const OPFS: &str = disk::OPFS_PREFIX;
 pub const DOWNLOADS: &str = disk::DOWNLOADS_PREFIX;
 /// Files brought in from the computer.
 pub const UPLOAD: &str = "/upload/";
-/// The autosave of unsaved work (in OPFS: `recovery.solidcraft` and `recovery.json`).
-const RECOVERY: &str = "recovery.solidcraft";
-/// The autosave earlier releases kept (compatibility shim, docs/compatibility.md): recovered
-/// when there is no current one.
-const LEGACY_RECOVERY: &str = "recovery.solvecraft";
+/// The autosave of unsaved work (in OPFS: `recovery.sc` and `recovery.json`), named with
+/// `solidcraft_engine::io::DESIGN_EXT`.
+const RECOVERY: &str = "recovery.sc";
+/// The autosaves earlier releases kept, newest first, one per entry of
+/// `solidcraft_engine::io::LEGACY_DESIGN_EXTS` (compatibility shim, docs/compatibility.md): the
+/// newest is recovered when there is no current one.
+const LEGACY_RECOVERY: [&str; 2] = ["recovery.solidcraft", "recovery.solvecraft"];
 const RECOVERY_META: &str = "recovery.json";
 
 /// What to do with a file brought in from the computer.
@@ -57,6 +59,10 @@ pub struct Files {
     pub incoming: RefCell<Vec<(String, Vec<u8>, Intent)>>,
     /// Designs opened from the computer's disk: their paths in the engine's files.
     pub opened: RefCell<Vec<String>>,
+    /// The ids of the files remembered from earlier sessions (see `disk::restore`).
+    pub disk_known: RefCell<std::collections::HashSet<String>>,
+    /// Recent designs whose file is gone: to drop from the recent list.
+    pub gone: RefCell<Vec<String>>,
     /// Disk designs whose last write failed: they are not saved.
     pub unsaved: RefCell<Vec<String>>,
     /// Messages for the status line (errors and confirmations).
@@ -90,7 +96,7 @@ impl Files {
     }
 
     /// Run a frame (the app sleeps until something happens).
-    fn wake(&self) {
+    pub fn wake(&self) {
         if let Some(c) = self.ctx.borrow().as_ref() {
             c.request_repaint();
         }
@@ -267,6 +273,10 @@ pub fn start(files: &Rc<Files>) {
     }
     let files = files.clone();
     spawn_local(async move {
+        match disk::known_ids().await {
+            Ok(ids) => files.disk_known.borrow_mut().extend(ids),
+            Err(e) => log::info!("no remembered files: {e}"),
+        }
         match read_all().await {
             Ok(all) => {
                 if local_only() {
@@ -274,9 +284,10 @@ pub fn start(files: &Rc<Files>) {
                 }
                 let mut entries = Vec::new();
                 let has_recovery = all.iter().any(|(n, _, _)| n == RECOVERY);
+                let legacy = (!has_recovery).then(|| LEGACY_RECOVERY.into_iter().find(|l| all.iter().any(|(n, _, _)| n == l))).flatten();
                 for (name, bytes, modified) in all {
-                    if name == LEGACY_RECOVERY {
-                        if !has_recovery {
+                    if LEGACY_RECOVERY.contains(&name.as_str()) {
+                        if legacy == Some(name.as_str()) {
                             vfs::insert(&format!("{OPFS}{RECOVERY}"), bytes);
                         }
                         continue;
@@ -416,7 +427,9 @@ pub fn autosave(files: &Rc<Files>, doc: Option<(&solidcraft_engine::doc::Documen
         }
         None => spawn_local(async move {
             let _ = remove_file(RECOVERY).await;
-            let _ = remove_file(LEGACY_RECOVERY).await;
+            for legacy in LEGACY_RECOVERY {
+                let _ = remove_file(legacy).await;
+            }
             let _ = remove_file(RECOVERY_META).await;
         }),
     }
@@ -440,6 +453,18 @@ pub fn recovery_path() -> String {
     format!("{OPFS}{RECOVERY}")
 }
 
+/// A recovery file lives in OPFS, but its relative links belong to the original design's
+/// folder (which can be on disk). Resolve them before Open sees the temporary file location.
+pub fn prepare_recovery(original_path: Option<&str>) -> Result<String, String> {
+    let path = recovery_path();
+    let bytes = vfs::read(&path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
+    let mut doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?;
+    solidcraft_engine::resolve_design_links(&mut doc, original_path);
+    let bytes = solidcraft_engine::io::write_design_container(&doc).map_err(|e| e.to_string())?;
+    vfs::insert(&path, bytes);
+    Ok(path)
+}
+
 /// Pick files on the computer: the File System Access picker where there is one, else an
 /// `<input type=file>`. Read files arrive in `files.incoming`.
 pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
@@ -491,7 +516,11 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
     let Some(doc) = web_sys::window().and_then(|w| w.document()) else { return };
     let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
     input.set_type("file");
-    input.set_accept(".solidcraft,.solvecraft,.json,.step,.stp,.3mf,.stl,.obj,.glb,.gltf");
+    // Everything the browser build imports, from the format registry: cadmpeg is pure Rust, so
+    // FreeCAD and Rhino files are part of it; plus the DXF and SVG drawings Open and Insert take.
+    let mut extensions = solidcraft_engine::io::formats::open_extensions(true);
+    extensions.extend(["dxf", "svg"]);
+    input.set_accept(&disk::input_accept(&extensions, apple_touch()));
     // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
     let _ = input.set_attribute("style", "display:none");
     if let Some(body) = doc.body() {
@@ -516,6 +545,75 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
     input.click();
 }
 
+/// Ask for one file of these types (`extensions`, e.g. `["dxf"]`) with a plain file input, the
+/// dialog every browser has. The answer is the file's path in the engine's files (under
+/// [`UPLOAD`], as for a file picked in the disk dialog), so the command that asked runs on it;
+/// `None` when the dialog was closed or the file could not be read.
+pub fn pick_upload(files: &Rc<Files>, extensions: &[&str]) -> impl std::future::Future<Output = Option<String>> + use<> {
+    // Shown now, in the click: a file dialog needs the user's gesture.
+    let chosen = choose_file(&disk::input_accept(extensions, apple_touch()));
+    let limit = disk::upload_limit(extensions);
+    let files = files.clone();
+    async move {
+        let read = async {
+            let value = JsFuture::from(chosen?).await.map_err(err)?;
+            // Closing the dialog answers no file: nothing to say.
+            let Ok(file) = value.dyn_into::<web_sys::File>() else { return Ok(None) };
+            let name = file.name();
+            if limit.is_some_and(|max| !file.size().is_finite() || file.size() > max as f64) {
+                return Err(format!("{name}: the file is too large"));
+            }
+            let bytes = blob_bytes(&file).await.map_err(|e| format!("{name}: {e}"))?;
+            let path = format!("{UPLOAD}{name}");
+            vfs::insert(&path, bytes);
+            Ok(Some(path))
+        };
+        match read.await {
+            Ok(path) => path,
+            Err(e) => {
+                files.say(format!("open: {e}"), true);
+                None
+            }
+        }
+    }
+}
+
+/// The page runs on an iPhone or iPad, whose file inputs offer every file (`disk::input_accept`).
+fn apple_touch() -> bool {
+    web_sys::window().is_some_and(|w| {
+        let nav = w.navigator();
+        disk::apple_touch(&nav.user_agent().unwrap_or_default(), nav.max_touch_points())
+    })
+}
+
+/// Show a hidden `<input type=file>` offering `accept` (call in the click). The promise answers
+/// the picked `File`, or `null` when the dialog is closed (the input's `cancel` event).
+fn choose_file(accept: &str) -> Result<js_sys::Promise, String> {
+    let doc = web_sys::window().and_then(|w| w.document()).ok_or("this page can't show a file dialog")?;
+    let input = doc.create_element("input").map_err(err)?.dyn_into::<web_sys::HtmlInputElement>().map_err(|_| "no file input".to_string())?;
+    input.set_type("file");
+    input.set_accept(accept);
+    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
+    input.set_attribute("style", "display:none").map_err(err)?;
+    doc.body().ok_or("this page has no body")?.append_child(&input).map_err(err)?;
+    let promise = js_sys::Promise::new(&mut |resolve: Function, _reject: Function| {
+        // One answer for a pick or a cancel; read from the event, so it does not keep the input.
+        let done = Closure::once_into_js(move |event: web_sys::Event| {
+            let file = event.target().and_then(|t| t.dyn_into::<web_sys::HtmlInputElement>().ok()).and_then(|input| {
+                input.set_onchange(None);
+                input.set_oncancel(None);
+                input.remove();
+                input.files().and_then(|list| list.get(0))
+            });
+            let _ = resolve.call1(&JsValue::UNDEFINED, &file.map_or(JsValue::NULL, JsValue::from));
+        });
+        input.set_onchange(Some(done.unchecked_ref()));
+        input.set_oncancel(Some(done.unchecked_ref()));
+    });
+    input.click();
+    Ok(promise)
+}
+
 /// Read files dropped on the page.
 pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput) {
     for f in std::mem::take(&mut raw.dropped_files) {

apps/solidcraft-web/src/linked.rs

@@ -0,0 +1,142 @@
+//! Bounded HTTPS or same-origin downloads, handed to the normal design-open command as unsaved copies.
+use std::{cell::RefCell, rc::Rc};
+
+use js_sys::{Reflect, Uint8Array};
+use solidcraft_engine::io::vfs;
+use solidcraft_ui_egui::{SolveApp, ui_kit};
+use wasm_bindgen::{JsCast as _, JsValue};
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::{check_download_size, design_url};
+
+type Reply = Result<(String, Vec<u8>), String>;
+
+#[derive(Default)]
+pub struct Download {
+    reply: Rc<RefCell<Option<Reply>>>,
+    pending: Option<(String, Vec<u8>)>,
+}
+
+impl Download {
+    pub fn start(url: Option<&str>, ctx: &egui::Context) -> Self {
+        let download = Self::default();
+        if let Some(url) = url {
+            let url = url.to_owned();
+            let slot = download.reply.clone();
+            let ctx = ctx.clone();
+            spawn_local(async move {
+                *slot.borrow_mut() = Some(fetch(&url).await);
+                ctx.request_repaint();
+            });
+        }
+        download
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        if let Some(reply) = self.reply.borrow_mut().take() {
+            match reply {
+                Ok(file) => self.pending = Some(file),
+                Err(error) => app.set_status(format!("Could not open design link: {error}"), true),
+            }
+        }
+        if self.pending.is_none() || app.file_picker_busy() {
+            return;
+        }
+        if solidcraft_ui_egui::documents::any_dirty(app) {
+            let mut answer = None;
+            let closed = ui_kit::Window::new(egui::Id::new("open_link"), "status_warning", solidcraft_ui_egui::i18n::tr("web.open_link"))
+                .required()
+                .show_body(ctx, |ui| {
+                    ui.label(solidcraft_ui_egui::i18n::tr("web.open_link_confirm"));
+                    ui.horizontal(|ui| {
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.open"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(true);
+                        }
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.cancel"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(false);
+                        }
+                    });
+                });
+            match answer {
+                Some(true) => {}
+                Some(false) => {
+                    self.pending = None;
+                    return;
+                }
+                None if closed => {
+                    self.pending = None;
+                    return;
+                }
+                None => return,
+            }
+        }
+        let Some((name, bytes)) = self.pending.take() else { return };
+        // The extension selects the design loader even when the URL has no extension.
+        let path = &format!("/linked/design.{}", solidcraft_engine::io::DESIGN_EXT);
+        vfs::insert(path, bytes);
+        app.open_path(path);
+        if app.session.path.as_deref() == Some(path.as_str()) {
+            app.session.path = None;
+            app.session.doc_mut().name = name;
+            app.session.mark_unsaved();
+        } else {
+            app.set_status("Could not open design link: the downloaded file is not a valid SolidCraft design", true);
+        }
+        let _ = vfs::remove(path);
+    }
+}
+
+async fn fetch(value: &str) -> Reply {
+    let window = web_sys::window().ok_or("No browser window")?;
+    let page_origin = window.location().origin().map_err(|_| "Cannot read page origin")?;
+    let url = design_url(value, &page_origin)?;
+    let name = url.path_segments().and_then(|mut segments| segments.next_back()).filter(|name| !name.is_empty()).unwrap_or("Design");
+    let decoded = js_sys::decode_uri_component(name).ok().and_then(|name| name.as_string()).unwrap_or_else(|| name.to_owned());
+    // `arm.sc` (or a legacy `arm.solidcraft`) is named `arm`.
+    let stem = match decoded.rsplit_once('.') {
+        Some((stem, ext)) if !stem.is_empty() && solidcraft_engine::io::is_design_ext(ext) => stem,
+        _ => decoded.as_str(),
+    };
+    let name: String = stem.chars().take(255).collect();
+    let response = JsFuture::from(window.fetch_with_str(url.as_str())).await.map_err(|_| "Network request failed or the host refused CORS access")?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "Invalid download response")?;
+    design_url(&response.url(), &page_origin).map_err(|_| "Design redirected to a URL that does not use HTTPS or the page's own origin")?;
+    if !response.ok() {
+        return Err(format!("HTTP {} {}", response.status(), response.status_text()));
+    }
+    let length = response
+        .headers()
+        .get("Content-Length")
+        .map_err(|_| "Cannot read download size")?
+        .map(|value| value.parse::<u64>().map_err(|_| "Invalid Content-Length"))
+        .transpose()?;
+    if let Some(length) = length {
+        check_download_size(0, length)?;
+    }
+    let stream = response.body().ok_or("Download has no body")?;
+    let reader: web_sys::ReadableStreamDefaultReader = stream.get_reader().dyn_into().map_err(|_| "Cannot read download stream")?;
+    let result = read(&reader).await;
+    if result.is_err() {
+        let _ = JsFuture::from(reader.cancel()).await;
+    }
+    // Fetch rejects interrupted HTTP bodies and decodes Content-Encoding. Content-Length
+    // can describe compressed bytes, so the streamed limit also checks the decoded size.
+    let bytes = result?;
+    Ok((name, bytes))
+}
+
+async fn read(reader: &web_sys::ReadableStreamDefaultReader) -> Result<Vec<u8>, String> {
+    let mut bytes = Vec::new();
+    // Bound even a stream which keeps returning empty chunks.
+    for _ in 0..1_000_000 {
+        let chunk = JsFuture::from(reader.read()).await.map_err(|_| "Download interrupted")?;
+        if Reflect::get(&chunk, &JsValue::from_str("done")).map_err(|_| "Invalid download stream")?.as_bool() == Some(true) {
+            return Ok(bytes);
+        }
+        let value = Reflect::get(&chunk, &JsValue::from_str("value")).map_err(|_| "Invalid download chunk")?;
+        let chunk: Uint8Array = value.dyn_into().map_err(|_| "Invalid download bytes")?;
+        check_download_size(bytes.len(), u64::from(chunk.length()))?;
+        bytes.extend_from_slice(&chunk.to_vec());
+    }
+    Err("Download returned too many chunks".into())
+}

apps/solidcraft-web/src/main.rs

@@ -11,19 +11,114 @@ mod api;
 #[cfg(any(target_arch = "wasm32", test))]
 mod disk;
 #[cfg(target_arch = "wasm32")]
+mod easyprint;
+#[cfg(target_arch = "wasm32")]
 mod files;
 #[cfg(target_arch = "wasm32")]
 mod install;
+#[cfg(target_arch = "wasm32")]
+mod linked;
 #[cfg(any(target_arch = "wasm32", test))]
 mod space_mouse;
 
+/// The browser switches tabs with Ctrl+Tab and Ctrl+Shift+Tab, so the page leaves those keys to
+/// it (#5227); plain Tab and Shift+Tab still move between the app's fields. (Ctrl+PageUp and
+/// Ctrl+PageDown already reach the browser.)
+#[cfg(any(target_arch = "wasm32", test))]
+fn browser_switches_tabs(key: &str, ctrl: bool) -> bool {
+    ctrl && key == "Tab"
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn query_flag(query: &str, name: &str) -> bool {
+    url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()).any(|(key, _)| key == name)
+}
+
+/// Launch options use exact query keys; URL values are decoded only once.
+#[cfg(any(target_arch = "wasm32", test))]
+#[derive(Default, Debug)]
+struct Launch {
+    open: Option<String>,
+    embed: bool,
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+impl Launch {
+    fn parse(query: &str) -> Self {
+        let mut launch = Self::default();
+        let mut embed = false;
+        for (key, value) in url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()) {
+            match key.as_ref() {
+                "open" if launch.open.is_none() => launch.open = Some(value.into_owned()),
+                "embed" => embed = true,
+                _ => {}
+            }
+        }
+        launch.embed = embed && launch.open.is_some();
+        launch
+    }
+
+    fn persists(&self) -> bool {
+        !self.embed
+    }
+
+    fn full_app_url(&self, mut url: url::Url) -> String {
+        url.set_query(None);
+        url.set_fragment(None);
+        if let Some(open) = &self.open {
+            url.query_pairs_mut().append_pair("open", open);
+        }
+        url.to_string()
+    }
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn design_url(value: &str, page_origin: &str) -> Result<url::Url, String> {
+    if value.len() > 16_384 {
+        return Err("Design URL is too long".into());
+    }
+    let decoded = percent_encoding::percent_decode_str(value).decode_utf8().map_err(|_| "Invalid design URL encoding")?;
+    if decoded.chars().any(|ch| ch.is_control() || ch == '\\') {
+        return Err("Design links must not contain backslashes or control characters".into());
+    }
+    // Check before URL parsing normalizes away dot segments. Decode escaped slashes too.
+    let path = value.split(['?', '#']).next().unwrap_or_default();
+    let path = percent_encoding::percent_decode_str(path).collect::<Vec<_>>();
+    if path.split(|byte| *byte == b'/').any(|segment| segment == b"..") {
+        return Err("Design links must not contain parent path segments".into());
+    }
+    let page = url::Url::parse(page_origin).map_err(|_| "Invalid page origin")?;
+    let url = if value.starts_with('/') && !value.starts_with("//") {
+        page.join(value).map_err(|_| "Invalid design path")?
+    } else {
+        url::Url::parse(value).map_err(|_| "Invalid design URL")?
+    };
+    if (url.scheme() != "https" && url.origin() != page.origin())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+    {
+        return Err("Design links must use HTTPS or the page's own origin without credentials".into());
+    }
+    Ok(url)
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn check_download_size(current: usize, incoming: u64) -> Result<(), String> {
+    let cap = solidcraft_engine::io::MAX_DESIGN_BYTES as u64;
+    if current as u64 > cap || incoming > cap.saturating_sub(current as u64) {
+        return Err(format!("Design exceeds the {} MB size limit", cap / (1024 * 1024)));
+    }
+    Ok(())
+}
+
 #[cfg(target_arch = "wasm32")]
 mod web {
     use std::rc::Rc;
 
     use solidcraft_engine::Session;
     use solidcraft_engine::io::vfs;
-    use solidcraft_ui_egui::{Services, SolveApp};
+    use solidcraft_ui_egui::{Services, SolveApp, ui_kit};
     use wasm_bindgen::JsCast as _;
 
     use crate::api::Api;
@@ -84,12 +179,29 @@ mod web {
         on_unload.forget();
     }
 
+    /// eframe cancels the browser's action for every Tab it gets, so the browser couldn't switch
+    /// tabs while the app has the keyboard. Its tab-switching keys stop here, on the way down to
+    /// the canvas, before eframe sees them; the browser then acts on them as usual.
+    fn leave_tab_switching_to_browser(window: &web_sys::Window) {
+        let on_key = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::KeyboardEvent)>::new(|e: web_sys::KeyboardEvent| {
+            if crate::browser_switches_tabs(&e.key(), e.ctrl_key()) {
+                e.stop_propagation();
+            }
+        });
+        let _ = window.add_event_listener_with_callback_and_bool("keydown", on_key.as_ref().unchecked_ref(), true);
+        // The listener lives as long as the page.
+        on_key.forget();
+    }
+
     const JAPANESE_FONT_PATH: &str = "./fonts/BIZUDPGothic-Regular.ttf";
 
     type FontLoadResult = Rc<std::cell::RefCell<Option<Result<Vec<u8>, String>>>>;
 
     struct Shell {
         app: SolveApp,
+        launch: crate::Launch,
+        linked: crate::linked::Download,
+        full_url: Option<String>,
         api: Api,
         files: Rc<Files>,
         /// When the last autosave was (seconds), and the revision it holds (none stored: `None`).
@@ -109,11 +221,15 @@ mod web {
         /// The language the fonts were last set up for (a CJK UI leads with the CJK face).
         font_language: String,
         space_mouse: SpaceMouse,
+        wheel_gestures: solidcraft_ui_egui::WebWheelGestures,
     }
 
     impl Shell {
         /// Files from the computer, writes to store, messages and the autosave.
         fn files_tick(&mut self, ctx: &egui::Context) {
+            if !self.launch.persists() {
+                return;
+            }
             if self.files.ctx.borrow().is_none() {
                 *self.files.ctx.borrow_mut() = Some(ctx.clone());
             }
@@ -136,6 +252,11 @@ mod web {
                 self.app.open_path(&path);
                 self.files.panel.set(false);
             }
+            // Recent designs whose file is gone are dropped from the list.
+            for path in self.files.gone.borrow_mut().drain(..) {
+                self.app.home.recent.retain(|r| *r != path);
+                self.app.home.opened_at.remove(&path);
+            }
             for (text, error) in self.files.messages.borrow_mut().drain(..) {
                 self.app.set_status(text, error);
             }
@@ -202,15 +323,27 @@ mod web {
         fn sync_recents(&mut self) {
             let mut entries = self.files.entries.borrow().clone();
             entries.sort_by(|a, b| b.modified.total_cmp(&a.modified));
+            let forgotten = self.app.home.forgotten.clone();
             let recent = &mut self.app.home.recent;
-            recent.retain(|p| vfs::exists(p));
+            let known = self.files.disk_known.borrow().clone();
+            // A design on the computer's disk stays listed while its file is remembered.
+            recent.retain(|p| vfs::exists(p) || disk::parse(p).is_some_and(|(id, _)| known.contains(id)));
             for e in entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)) {
                 let p = format!("{}{}", files::OPFS, e.name);
-                if !recent.contains(&p) {
+                // A design the user removed from the list is not added back while it is stored.
+                if !recent.contains(&p) && !forgotten.contains(&p) {
                     recent.push(p);
                 }
             }
             recent.truncate(solidcraft_ui_egui::home::MAX_RECENT);
+            // Remembered files that no recent design or autosave names are forgotten in time.
+            let recovered = self.files.recovery.borrow().as_ref().and_then(|(_, p)| p.clone());
+            let keep = recent.iter().chain(recovered.as_ref()).filter_map(|p| disk::parse(p)).map(|(id, _)| id.to_string()).collect();
+            disk::prune(keep);
+            // Drop forgotten entries whose stored design is gone, so the set does not grow without bound.
+            let stored: std::collections::BTreeSet<String> =
+                entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)).map(|e| format!("{}{}", files::OPFS, e.name)).collect();
+            self.app.home.forgotten.retain(|p| stored.contains(p));
         }
 
         /// The stored designs: open, insert, rename, delete, download; open from the computer.
@@ -218,24 +351,21 @@ mod web {
             if !self.files.panel.get() {
                 return;
             }
-            let mut open = true;
             let mut act: Option<(&'static str, String)> = None;
-            egui::Window::new("Files in this browser")
-                .open(&mut open)
-                .collapsible(false)
-                .resizable(true)
-                .default_width(520.0)
-                .pivot(egui::Align2::CENTER_CENTER)
-                .default_pos(ctx.content_rect().center())
-                .show(ctx, |ui| {
+            let closed = solidcraft_ui_egui::ui_kit::Window::new(egui::Id::new("sc_browser_files"), "folder", "Files in this browser")
+                .cards(3.0)
+                .show_body(ctx, |ui| {
                     ui.horizontal(|ui| {
-                        if ui.button("Open from computer…").clicked() {
+                        if ui_kit::button(ui, "Open from computer…", ui_kit::Button::Normal).clicked() {
                             files::pick_from_disk(&self.files, Intent::Open);
                         }
-                        if ui.button("Insert from computer…").on_hover_text("STEP, 3MF or STL into the open design").clicked() {
+                        if ui_kit::button(ui, "Insert from computer…", ui_kit::Button::Normal)
+                            .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_drawings_hint"))
+                            .clicked()
+                        {
                             files::pick_from_disk(&self.files, Intent::Insert);
                         }
-                        if ui.button("Download open design").clicked() {
+                        if ui_kit::button(ui, "Download open design", ui_kit::Button::Normal).clicked() {
                             act = Some(("download_open", String::new()));
                         }
                     });
@@ -259,7 +389,7 @@ mod web {
                             for e in &entries {
                                 match &mut self.renaming {
                                     Some((from, to)) if *from == e.name => {
-                                        let r = ui.add(egui::TextEdit::singleline(to).desired_width(200.0));
+                                        let r = ui_kit::cell_editor(ui, ui.make_persistent_id(("stored_file_name", from.as_str())), to, "", false);
                                         if std::mem::take(&mut self.rename_focus) {
                                             r.request_focus();
                                         }
@@ -277,28 +407,31 @@ mod web {
                                 }
                                 ui.label(format!("{:.1} KB", e.size as f64 / 1024.0));
                                 ui.horizontal(|ui| {
-                                    if ui.small_button("Open").clicked() {
+                                    if ui_kit::button(ui, "Open", ui_kit::Button::Small).clicked() {
                                         act = Some(("open", e.name.clone()));
                                     }
                                     let design = solidcraft_engine::io::is_design_path(&e.name);
-                                    if !design && ui.small_button("Insert").on_hover_text("Into the open design (STEP, 3MF, STL)").clicked() {
+                                    if !design
+                                        && ui_kit::button(ui, "Insert", ui_kit::Button::Small)
+                                            .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_stored_drawings_hint"))
+                                            .clicked()
+                                    {
                                         act = Some(("insert", e.name.clone()));
                                     }
-                                    if ui.small_button("Rename").clicked() {
+                                    if ui_kit::button(ui, "Rename", ui_kit::Button::Small).clicked() {
                                         self.renaming = Some((e.name.clone(), e.name.clone()));
                                         self.rename_focus = true;
                                     }
-                                    if ui
-                                        .small_button("Save to computer…")
+                                    if ui_kit::button(ui, "Save to computer…", ui_kit::Button::Small)
                                         .on_hover_text("A copy in a file you choose; the stored design stays here")
                                         .clicked()
                                     {
                                         act = Some(("save_copy", e.name.clone()));
                                     }
-                                    if ui.small_button("Download").clicked() {
+                                    if ui_kit::button(ui, "Download", ui_kit::Button::Small).clicked() {
                                         act = Some(("download", e.name.clone()));
                                     }
-                                    if ui.small_button("Delete").clicked() {
+                                    if ui_kit::button(ui, "Delete", ui_kit::Button::Small).clicked() {
                                         act = Some(("delete", e.name.clone()));
                                     }
                                 });
@@ -307,7 +440,7 @@ mod web {
                         });
                     });
                 });
-            if !open {
+            if closed {
                 self.files.panel.set(false);
                 self.renaming = None;
             }
@@ -349,6 +482,8 @@ mod web {
                 "delete" => {
                     files::delete(&self.files, &name);
                     self.app.home.recent.retain(|r| *r != path);
+                    // The file is gone, so there is nothing left to keep forgotten.
+                    self.app.home.forgotten.remove(&path);
                 }
                 "rename_cancel" => self.renaming = None,
                 "rename" => {
@@ -362,6 +497,10 @@ mod web {
                                         *r = new.clone();
                                     }
                                 }
+                                // A forgotten design follows its new name.
+                                if self.app.home.forgotten.remove(&old) {
+                                    self.app.home.forgotten.insert(new);
+                                }
                             }
                             Err(e) => self.app.set_status(e, true),
                         }
@@ -375,30 +514,39 @@ mod web {
         fn recovery_prompt(&mut self, ctx: &egui::Context) {
             let Some((name, path)) = self.files.recovery.borrow().clone() else { return };
             let mut answer = None;
-            egui::Window::new("Recover unsaved work?").collapsible(false).resizable(false).anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0]).show(
-                ctx,
-                |ui| {
+            let _ = solidcraft_ui_egui::ui_kit::Window::new(egui::Id::new("sc_browser_recovery"), "restore", "Recover unsaved work?")
+                .required()
+                .show_body(ctx, |ui| {
                     ui.label(format!("“{name}” had unsaved changes when this page last closed."));
                     ui.horizontal(|ui| {
-                        if ui.button("Recover").clicked() {
+                        if ui_kit::button(ui, "Recover", ui_kit::Button::Normal).clicked() {
                             answer = Some(true);
                         }
-                        if ui.button("Discard").clicked() {
+                        if ui_kit::button(ui, "Discard", ui_kit::Button::Normal).clicked() {
                             answer = Some(false);
                         }
                     });
-                },
-            );
+                });
             let Some(recover) = answer else { return };
-            *self.files.recovery.borrow_mut() = None;
             if recover {
-                self.app.open_path(&files::recovery_path());
+                let recovery = match files::prepare_recovery(path.as_deref()) {
+                    Ok(recovery) => recovery,
+                    Err(error) => {
+                        self.app.set_status(error, true);
+                        return;
+                    }
+                };
+                self.app.open_path(&recovery);
+                if self.app.session.path.as_deref() != Some(recovery.as_str()) {
+                    return;
+                }
                 // It belongs to its own file again (saving goes there); it is unsaved.
                 self.app.session.path = path;
                 self.app.session.doc_mut().name = name;
                 self.app.session.mark_unsaved();
                 self.app.home.open = false;
             }
+            *self.files.recovery.borrow_mut() = None;
             files::autosave(&self.files, None);
         }
 
@@ -477,19 +625,46 @@ mod web {
             UNSAVED.with(|u| u.set(solidcraft_ui_egui::documents::any_dirty(&self.app)));
         }
         fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
-            files::take_drops(&self.files, raw);
+            let now = raw.time.unwrap_or_else(|| ctx.input(|i| i.time));
+            if let Some(delay) = self.wheel_gestures.update(raw, now) {
+                ctx.request_repaint_after(delay);
+            }
+            if self.launch.persists() {
+                files::take_drops(&self.files, raw);
+            } else {
+                raw.dropped_files.clear();
+            }
             // Before the app's own hook, which adds the control channel's events.
             self.space_mouse.raw_input_hook(ctx, self.app.preferences.space_mouse_enabled, raw);
             self.app.raw_input_hook(raw);
         }
         fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+            self.linked.tick(&mut self.app, ui.ctx());
+            UNSAVED.with(|u| u.set(self.launch.persists() && solidcraft_ui_egui::documents::any_dirty(&self.app)));
+            if self.launch.embed {
+                ui_kit::Container::new(ui.ctx(), ui_kit::Surface::Chrome).edge("embed_header", ui_kit::Edge::Top).show(ui, |ui| {
+                    if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("web.open_full"), ui_kit::Button::Normal).clicked()
+                        && let (Some(window), Some(url)) = (web_sys::window(), &self.full_url)
+                    {
+                        let _ = window.open_with_url_and_target_and_features(url, "_blank", "noopener");
+                    }
+                });
+            }
             self.app.ui(ui);
             let ctx = ui.ctx().clone();
-            self.file_panel(&ctx);
-            self.recovery_prompt(&ctx);
+            if self.launch.persists() {
+                self.file_panel(&ctx);
+                self.recovery_prompt(&ctx);
+            }
             self.watch_text_for_font(&ctx);
         }
+        fn persist_egui_memory(&self) -> bool {
+            self.launch.persists()
+        }
         fn save(&mut self, storage: &mut dyn eframe::Storage) {
+            if !self.launch.persists() {
+                return;
+            }
             // Persist the user's own language, not a session-only English fallback.
             let saved = self.font.persisted_language(&self.app.preferences.language).to_owned();
             let live = std::mem::replace(&mut self.app.preferences.language, saved);
@@ -508,15 +683,15 @@ mod web {
 
     /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
     fn webgl() -> bool {
-        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let storage = crate::Launch::parse(&query()).persists().then(|| web_sys::window().and_then(|w| w.local_storage().ok().flatten())).flatten();
         let q = query();
-        if q.contains("webgl") {
+        if crate::query_flag(&q, "webgl") {
             if let Some(s) = &storage {
                 let _ = s.set_item(WEBGL_KEY, "1");
             }
             return true;
         }
-        if q.contains("webgpu") {
+        if crate::query_flag(&q, "webgpu") {
             if let Some(s) = &storage {
                 let _ = s.remove_item(WEBGL_KEY);
             }
@@ -542,7 +717,11 @@ mod web {
         eframe::WebLogger::init(log::LevelFilter::Info).ok();
         wasm_bindgen_futures::spawn_local(async {
             let Some(window) = web_sys::window() else { return };
-            ask_before_unload(&window);
+            let launch = crate::Launch::parse(&query());
+            if launch.persists() {
+                ask_before_unload(&window);
+            }
+            leave_tab_switching_to_browser(&window);
             let Some(document) = window.document() else { return };
             let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
                 log::error!("missing <canvas id=\"{CANVAS_ID}\">");
@@ -561,18 +740,24 @@ mod web {
                     Box::new(move |cc| {
                         solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
                         let files = Rc::new(Files::default());
-                        files::start(&files);
+                        if launch.persists() {
+                            files::start(&files);
+                        }
                         let (panel, opener, saver, shown) = (files.clone(), files.clone(), files.clone(), files.clone());
-                        let services = Services {
+                        let (restorable, restorer) = (files.clone(), files.clone());
+                        let services = if launch.embed { Services::default() } else { Services {
                             // Open shows the browser's open dialog for a design where it has one
-                            // (the file keeps its handle, so Save writes back to it); otherwise,
-                            // and for inserting STEP or meshes, the browser's files window.
-                            pick_open: Some(Box::new(move |exts: &[&str]| {
-                                if disk::handles_open(exts) {
-                                    return Box::pin(disk::pick_open(&opener));
+                            // (the file keeps its handle, so Save writes back to it), else the
+                            // browser's files window. A command that reads another kind of file
+                            // (Insert DXF or SVG, an image, a mesh, settings) gets a file dialog
+                            // offering that kind, and runs on the picked file.
+                            pick_open: Some(Box::new(move |exts: &[&str]| match disk::open_route(disk::supported(), exts) {
+                                disk::OpenRoute::Disk => Box::pin(disk::pick_open(&opener)),
+                                disk::OpenRoute::Upload => Box::pin(files::pick_upload(&opener, exts)),
+                                disk::OpenRoute::Panel => {
+                                    panel.panel.set(true);
+                                    Box::pin(std::future::ready(None))
                                 }
-                                panel.panel.set(true);
-                                Box::pin(std::future::ready(None))
                             })),
                             // A design is saved to a file the user picks, or kept in the browser
                             // where the browser can't pick one; everything else is downloaded.
@@ -587,30 +772,38 @@ mod web {
                                     SaveTarget::Download => Box::pin(std::future::ready(Some(format!("{}{name}", files::DOWNLOADS)))),
                                 }
                             })),
+                            // A recent design on the disk, from an earlier session, opens by asking
+                            // the browser for its remembered file.
+                            can_restore: Some(Box::new(move |path: &str| {
+                                disk::parse(path).is_some_and(|(id, _)| restorable.disk_known.borrow().contains(id))
+                            })),
+                            restore_file: Some(Box::new(move |path: &str| disk::restore(&restorer, path))),
                             download_design: Some(Box::new(files::download)),
+                            easyprint_upload: Some(std::sync::Arc::new(crate::easyprint::upload)),
                             browser_files: Some(Box::new(move || shown.panel.set(true))),
                             install_app: Some(crate::install::service(&cc.egui_ctx)),
                             ..Default::default()
-                        };
+                        }};
                         // Thumbnails of saves and start-page cards.
                         solidcraft_ui_egui::gpu::install_cpu_picture_renderer();
                         let (sender, receiver) = std::sync::mpsc::channel();
                         let mut app = SolveApp::new(Session::default(), services).with_control(receiver);
-                        if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+                        app.embedded = launch.embed;
+                        if launch.persists() && let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
                             app.load_prefs(&p);
                         }
                         if let Some(rs) = &cc.wgpu_render_state {
                             // eframe's web painter has no stencil buffer.
                             app.set_wgpu(rs, DEPTH_BITS, 0, 1);
                         }
-                        if query().contains("sample") {
+                        if launch.open.is_none() && crate::query_flag(&query(), "sample") {
                             if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                                 app.set_status(format!("sample: {e}"), true);
                             }
                             app.session.doc_mut().name = "Sample Plate".into();
                             app.session.mark_saved();
                         }
-                        if !query().contains("sample") {
+                        if launch.open.is_none() && !crate::query_flag(&query(), "sample") {
                             // The empty design takes Units of new designs (#1205). The sample
                             // part is built in millimetres and is left that way.
                             solidcraft_ui_egui::prefs::apply_new_design(&mut app);
@@ -619,8 +812,13 @@ mod web {
                         }
                         let api = Api::install(sender, cc.egui_ctx.clone()).map_err(|e| format!("SolidCraft browser API: {e:?}"))?;
                         let font_language = app.preferences.language.clone();
+                        let linked = crate::linked::Download::start(launch.open.as_deref(), &cc.egui_ctx);
+                        let full_url = window.location().href().ok().and_then(|value| url::Url::parse(&value).ok()).map(|url| launch.full_app_url(url));
                         Ok(Box::new(Shell {
                             app,
+                            launch,
+                            linked,
+                            full_url,
                             api,
                             files,
                             autosaved_at: f64::NEG_INFINITY,
@@ -633,6 +831,7 @@ mod web {
                             cjk_bytes: None,
                             font_language,
                             space_mouse: SpaceMouse::default(),
+                            wheel_gestures: solidcraft_ui_egui::WebWheelGestures::default(),
                         }))
                     }),
                 )
@@ -658,3 +857,101 @@ fn main() {
 fn main() {
     eprintln!("solidcraft-web only runs in the browser: build it with `trunk build --release` in apps/solidcraft-web");
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn link_query_decodes_once_and_embed_disables_persistence() {
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "webgl"));
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "sample"));
+        assert!(query_flag("?embed&webgl", "webgl"));
+        let launch = Launch::parse("?embed&open=https%3A%2F%2Fexample.org%2Farm.solidcraft%3Fx%3Da%2520b%26y%3D1");
+        assert_eq!(launch.open.as_deref(), Some("https://example.org/arm.solidcraft?x=a%20b&y=1"));
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        assert!(!Launch::parse("?embed").embed);
+        assert!(!Launch::parse("?other=embed&reopen=https://example.org").embed);
+        assert!(Launch::parse("?open=https://example.org/a").persists());
+        assert_eq!(Launch::parse("?open=first&open=second").open.as_deref(), Some("first"));
+        let launch = Launch::parse("?embed&open=/dutchman/jobs/abc/part.solidcraft%3Fx%3Da%2520b");
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        let page = url::Url::parse("http://solidcraft.io/?embed#view").expect("synthetic page");
+        let full = url::Url::parse(&launch.full_app_url(page)).expect("full app URL");
+        let reopened = Launch::parse(full.query().unwrap_or_default());
+        assert_eq!(reopened.open, launch.open);
+        assert_eq!(reopened.open.as_deref(), Some("/dutchman/jobs/abc/part.solidcraft?x=a%20b"));
+        assert!(!reopened.embed);
+        assert!(reopened.persists());
+        assert!(full.fragment().is_none());
+    }
+
+    #[test]
+    fn design_links_refuse_hostile_schemes_credentials_and_sizes() {
+        assert!(design_url("https://example.org/arm.solidcraft?download=1", "http://solidcraft.io").is_ok());
+        for value in [
+            "http://example.org/a",
+            "data:application/json,{}",
+            "blob:https://example.org/a",
+            "javascript:alert(1)",
+            "https://user:secret@example.org/a",
+            "//evil.example/x",
+            "/../x",
+            "/%2e%2e/x",
+            "/a/%2E./x",
+            "/a%2f..%2fx",
+            "/a\\x",
+            "/a%5cx",
+            "/a\nx",
+            "/a%00x",
+            "/a%7fx",
+            "/a%C2%85x",
+            "/a%3f/../x",
+            "/a/..#view",
+            "/a/..?download=1",
+            "https://solidcraft.io/a/../x",
+            "http://user:secret@solidcraft.io/x",
+            "http://solidcraft.io.evil.example/x",
+            "http://solidcraft.io:8080/x",
+            "relative.solidcraft",
+            "",
+        ] {
+            assert!(design_url(value, "http://solidcraft.io").is_err(), "{value}");
+        }
+        assert!(design_url(&format!("https://example.org/{}", "x".repeat(16_384)), "http://solidcraft.io").is_err());
+        assert!(design_url("http://redirect.example.org/a", "http://solidcraft.io").is_err());
+
+        let cap = solidcraft_engine::io::MAX_DESIGN_BYTES;
+        assert!(check_download_size(0, cap as u64).is_ok());
+        assert!(check_download_size(0, cap as u64 + 1).is_err());
+        assert!(check_download_size(cap - 2, 2).is_ok());
+        assert!(check_download_size(cap - 2, 3).is_err());
+        assert!(check_download_size(0, u64::MAX).is_err());
+        assert!(check_download_size(cap, 1).is_err());
+        assert!(check_download_size(usize::MAX, 0).is_err());
+    }
+
+    #[test]
+    fn design_links_allow_same_origin_paths_and_redirects() {
+        for origin in ["http://solidcraft.io", "https://solidcraft.io", "http://solidcraft.io:8080"] {
+            assert_eq!(design_url("/a/b.solidcraft", origin).map(|url| url.to_string()), Ok(format!("{origin}/a/b.solidcraft")));
+            assert!(design_url(&format!("{origin}/x"), origin).is_ok());
+            // Final response URLs follow the same origin and scheme rules as the request.
+            assert!(design_url("https://docs.solidcraft.io/x", origin).is_ok());
+            assert!(design_url("http://other/x", origin).is_err());
+        }
+        assert!(design_url("http://solidcraft.io/x", "https://solidcraft.io").is_err());
+        assert!(design_url("http://SOLIDCRAFT.io:80/x", "http://solidcraft.io").is_ok());
+    }
+
+    #[test]
+    fn only_ctrl_tab_is_left_to_the_browser() {
+        // Ctrl+Tab and Ctrl+Shift+Tab (the event's key is "Tab" either way) switch browser tabs.
+        assert!(browser_switches_tabs("Tab", true));
+        // Tab and Shift+Tab move between the app's fields; Ctrl with other keys stays the app's.
+        assert!(!browser_switches_tabs("Tab", false));
+        assert!(!browser_switches_tabs("s", true));
+    }
+}

apps/solidcraft-web/src/space_mouse.rs

@@ -246,11 +246,11 @@ mod tests {
         let axis =
             |source, rest, full| solidcraft_ui_egui::space_mouse::AxisCalibration { source, reversed: false, rest, dead_zone: 0, full: [full; 2] };
         // A short-range device: 15 of its 50 is under the raw dead zone, but 105 of 350 calibrated.
-        let short = Calibration { dead_zone_share: 0.0, axes: std::array::from_fn(|r| axis(r, 0, 50)) };
+        let short = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 0, 50)) };
         let push = Axes { translation: [15, 0, 0], rotation: [0; 3] };
         assert!(!push.moving() && moving(push, Some(short)));
         // A device resting at 100 on every axis: past the raw dead zone, but at rest calibrated.
-        let offset = Calibration { dead_zone_share: 0.0, axes: std::array::from_fn(|r| axis(r, 100, 350)) };
+        let offset = Calibration { dead_zone_share: 0.0, kind: Default::default(), axes: std::array::from_fn(|r| axis(r, 100, 350)) };
         let resting = Axes { translation: [100; 3], rotation: [100; 3] };
         assert!(resting.moving() && !moving(resting, Some(offset)));
         // Without a calibration, as read.

apps/solidcraft/Cargo.toml

@@ -7,9 +7,15 @@ license.workspace = true
 publish = false
 default-run = "solidcraft"
 
+[features]
+default = ["raytrace-cpu", "bundled-render-library"]
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
+
 # The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
-# (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
-# (Windows resize border) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+# (macOS file-open events), src/native_crash.rs (Windows exception filter), src/native_crash_macos.rs
+# (macOS crash signal handler) and src/native_frame.rs (Windows resize border, taskbar icon) can
+# allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
 [lints.rust]
 unsafe_code = "deny"
 
@@ -26,6 +32,7 @@ solidcraft-ui-egui = { workspace = true }
 solidcraft-space-mouse = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links"] }
 egui = { workspace = true }
+serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
@@ -49,9 +56,15 @@ hidapi = { version = "2.6.7", default-features = false, features = ["windows-nat
 # The main window's handle for src/native_frame.rs (already in the tree through eframe and winit).
 raw-window-handle = "0.6"
 # Native crash capture (src/native_crash.rs): the exception filter, the faulting module, a minidump.
-# The window's resize border and DPI size (src/native_frame.rs): the window procedure, hit test, DPI.
+# The window's resize border, DPI size and class icon (src/native_frame.rs): the window procedure, hit
+# test, DPI, the exe's icon.
+# Finding 3D mice through Plug and Play without asking other devices anything (src/space_mouse/windows_hid.rs).
 windows-sys = { version = "0.61", features = [
+    "Win32_Devices_DeviceAndDriverInstallation",
+    "Win32_Devices_HumanInterfaceDevice",
+    "Win32_Devices_Properties",
     "Win32_Foundation",
+    "Win32_Graphics_Gdi",
     "Win32_Security",
     "Win32_Storage_FileSystem",
     "Win32_System_Diagnostics_Debug",
@@ -65,16 +78,21 @@ windows-sys = { version = "0.61", features = [
 ] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
+muda = { version = "0.21.2", default-features = false }
 # The 3D mouse through the 3Dconnexion driver, which keeps the device to itself (src/space_mouse.rs).
 solidcraft-3dx-client = { workspace = true }
 # The 3D mouse (src/space_mouse.rs), in the shared-device open mode so that a running 3DxWare
 # driver does not shut the app out.
 hidapi = { version = "2.6.7", default-features = false, features = ["macos-shared-device"] }
-# Files opened from Finder and the Dock (src/open_documents.rs); all already come with eframe and rfd.
+# Files opened from Finder and the Dock (src/open_documents.rs), and the fullscreen title-bar
+# inset (src/main.rs); all already come with eframe and rfd.
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder"] }
-objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder", "NSWindow"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSProcessInfo", "NSString", "NSURL"] }
 block2 = "0.6"
+# Native crash capture (src/native_crash_macos.rs): the signal handler, the faulting module
+# (already in the tree through many crates).
+libc = "0.2"
 
 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }

apps/solidcraft/src/control_server.rs

@@ -3,22 +3,28 @@
 
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpListener, TcpStream};
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
 use std::sync::mpsc::{Receiver, Sender, TryRecvError, channel};
-use std::time::Duration;
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+use std::time::{Duration, Instant};
 
 use serde_json::{Value, json};
 use solidcraft_engine::MAX_LINE;
 use solidcraft_engine::control_auth;
+use solidcraft_engine::control_pending;
 use solidcraft_ui_egui::ControlRequest;
+use solidcraft_ui_egui::control::{DESIGN_WATCH, DesignWatch, Subscriber};
 
 /// Connections served at once, so a flood must not be able to spawn threads without end.
 const MAX_CONNECTIONS: usize = 16;
 /// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
 const MAX_BAD_LINES: usize = 8;
+/// How long a subscribed connection waits after a `design.changed` line before the next: what
+/// changes meanwhile (a parameter dragged) goes out as one line, the latest (#6985).
+const EVENT_GAP: Duration = Duration::from_millis(100);
 
 static OPEN: AtomicUsize = AtomicUsize::new(0);
-/// The token files this launch wrote (its `--control` port, the agent chat's endpoint), removed
+/// The token files this launch wrote (its control port, the agent chat's endpoint), removed
 /// when the app ends.
 static TOKEN_FILES: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());
 
@@ -33,17 +39,45 @@ fn new_token() -> Option<String> {
 pub fn remove_token_file() {
     if let Ok(files) = TOKEN_FILES.lock() {
         for p in files.iter() {
-            let _ = std::fs::remove_file(p);
+            control_auth::remove_token_file(p);
         }
     }
+    if let Some(port) = APP_PORT.lock().ok().and_then(|p| *p) {
+        control_auth::remove_current_port(port);
+    }
 }
 
-pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
+/// The port the app's own channel listens on, for removing the discovery file at exit.
+static APP_PORT: std::sync::Mutex<Option<u16>> = std::sync::Mutex::new(None);
+
+pub fn start(listen_on: control_auth::Listen, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
     // Every connection must show the token before anything runs (docs/control-protocol.md).
     match control_auth::env_token().or_else(new_token) {
         Some(token) => {
-            listen(port, token, tx, ctx, false);
+            let listener = match listen_on {
+                control_auth::Listen::Exact(port) => TcpListener::bind(("127.0.0.1", port)),
+                control_auth::Listen::Default => control_auth::bind_with_fallback(control_auth::DEFAULT_PORT, control_auth::PORT_TRIES),
+            };
+            match listener {
+                Ok(l) => {
+                    if let Some(port) = listen_on_listener(l, token, tx, ctx, false) {
+                        if matches!(listen_on, control_auth::Listen::Default) {
+                            eprintln!("solidcraft: control channel on the default port 127.0.0.1:{port} (Preferences > Assistant turns it off)");
+                        }
+                        // The discovery file: where `solidcraft-cli mcp` finds this app with no arguments.
+                        match control_auth::write_current_port(port) {
+                            Ok(_) => {
+                                if let Ok(mut p) = APP_PORT.lock() {
+                                    *p = Some(port);
+                                }
+                            }
+                            Err(e) => eprintln!("solidcraft: could not write the control discovery file ({e})"),
+                        }
+                    }
+                }
+                Err(e) => eprintln!("solidcraft: control server failed to bind 127.0.0.1: {e}"),
+            }
         }
         None => eprintln!("solidcraft: control server not started: no random token available"),
     }
@@ -59,20 +93,20 @@ pub fn listen_agent(tx: Sender<ControlRequest>, ctx: egui::Context) -> Option<u1
         eprintln!("solidcraft: agent chat endpoint not started: no random token available");
         return None;
     };
-    listen(0, token, tx, ctx, true)
-}
-
-/// Listen on `port` (0: a free port the system picks) with `token`; the port it listens on.
-/// `patient`: every request may wait as long as a batch (a person decides on it).
-fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
-    let listener = match TcpListener::bind(("127.0.0.1", port)) {
+    let listener = match TcpListener::bind(("127.0.0.1", 0)) {
         Ok(l) => l,
         Err(e) => {
-            eprintln!("solidcraft: control server failed to bind 127.0.0.1:{port}: {e}");
+            eprintln!("solidcraft: control server failed to bind 127.0.0.1: {e}");
             return None;
         }
     };
-    let port = listener.local_addr().map(|a| a.port()).unwrap_or(port);
+    listen_on_listener(listener, token, tx, ctx, true)
+}
+
+/// Serve `listener` (loopback) with `token`; the port it listens on.
+/// `patient`: every request may wait as long as a batch (a person decides on it).
+fn listen_on_listener(listener: TcpListener, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
+    let port = listener.local_addr().ok()?.port();
     match control_auth::token_path(port) {
         Some(path) => match control_auth::write_token_file(&path, &token) {
             Ok(()) => {
@@ -97,7 +131,7 @@ fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Conte
             if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
                 OPEN.fetch_sub(1, Ordering::Relaxed);
                 let mut refused = stream;
-                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                let _ = send(&mut refused, &json!({"ok": false, "error": "too many connections"}));
                 continue;
             }
             let tx = tx.clone();
@@ -144,6 +178,44 @@ fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>
     }
 }
 
+/// A reply line, written to the socket at once. `writeln!` with a JSON value hands the socket each
+/// of its pieces apart, a system call for every string, number and comma: half a second for a
+/// design's component tree when it has thousands of components.
+fn send(out: &mut impl Write, reply: &Value) -> std::io::Result<()> {
+    let mut line = serde_json::to_vec(reply).map_err(std::io::Error::other)?;
+    line.push(b'\n');
+    out.write_all(&line)
+}
+
+/// The `"token"` of a request line that is a JSON object, read without building the rest of it.
+/// Until a connection shows the token, a line costs only its own bytes: parsed whole, a 16 MiB
+/// line of `[0,0,…]` is hundreds of MB, and 16 such connections could exhaust memory before any
+/// token was checked.
+fn token_of(line: &str) -> Option<String> {
+    struct Token;
+    impl<'de> serde::de::Visitor<'de> for Token {
+        type Value = Option<String>;
+        fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+            f.write_str("a request object")
+        }
+        fn visit_map<A: serde::de::MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+            let mut token = None;
+            while let Some(key) = map.next_key::<String>()? {
+                if key == "token" {
+                    token = Some(map.next_value::<String>()?);
+                } else {
+                    map.next_value::<serde::de::IgnoredAny>()?;
+                }
+            }
+            Ok(token)
+        }
+    }
+    let mut de = serde_json::Deserializer::from_str(line);
+    let token = serde::Deserializer::deserialize_map(&mut de, Token).ok()?;
+    de.end().ok()?;
+    token
+}
+
 /// The reply to a connection that didn't show the token; the connection is then closed.
 fn unauthorized() -> Value {
     json!({"ok": false, "error": "unauthorized: send the control token as \"token\" (see docs/control-protocol.md)"})
@@ -154,7 +226,7 @@ fn unauthorized() -> Value {
 /// the connection, and a reset can reach the client before it has read the refusal.
 fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
     use std::io::Read;
-    let _ = writeln!(out, "{}", unauthorized());
+    let _ = send(out, &unauthorized());
     let _ = out.shutdown(std::net::Shutdown::Write);
     let _ = reader.get_ref().set_read_timeout(Some(Duration::from_millis(500)));
     let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
@@ -175,54 +247,303 @@ const WAITS: Waits = Waits { short: Duration::from_secs(60), long: Duration::fro
 struct Pending {
     id: Value,
     method: String,
+    /// The request in messages ("`engine.execute` (solid.fillet)").
+    what: String,
     reply: Receiver<Value>,
 }
 
-fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
-    serve_with(stream, token, tx, ctx, patient, WAITS);
+/// Every request the app has been sent and not answered yet, from every connection, for
+/// `control.running` (#3654). Each connection's own thread answers that, so it never waits behind
+/// a running request.
+struct Running {
+    list: Mutex<Vec<InFlight>>,
+    connections: AtomicU64,
+    keys: AtomicU64,
 }
 
-fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool, waits: Waits) {
+/// What `control.running` says about a request: never its parameters beyond the command id.
+struct InFlight {
+    key: u64,
+    connection: u64,
+    id: Value,
+    method: String,
+    command: Option<&'static str>,
+    steps: Option<usize>,
+    since: Instant,
+    started: Arc<AtomicBool>,
+}
+
+/// The app's requests, from both of its listeners.
+static RUNNING: Running = Running::new();
+
+impl Running {
+    const fn new() -> Self {
+        Running { list: Mutex::new(Vec::new()), connections: AtomicU64::new(0), keys: AtomicU64::new(0) }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, Vec<InFlight>> {
+        self.list.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// List `req`, sent on `connection`, until the returned ticket is dropped.
+    fn add(&'static self, connection: u64, id: &Value, req: &ControlRequest) -> Ticket {
+        let key = self.keys.fetch_add(1, Ordering::Relaxed);
+        // Ids and methods come from the client: only short ones are repeated to the others.
+        let id = match id {
+            Value::Number(_) => id.clone(),
+            Value::String(s) if s.len() <= 64 => id.clone(),
+            _ => Value::Null,
+        };
+        let p = &req.params;
+        let command = match req.method.as_str() {
+            "engine.execute" | "command" => p.get("command").and_then(Value::as_str).and_then(solidcraft_engine::find_command).map(|c| c.id),
+            _ => None,
+        };
+        let steps = match req.method.as_str() {
+            "engine.batch" | "engine.script" => p.get("commands").and_then(Value::as_array).map(Vec::len),
+            _ => None,
+        };
+        let method = req.method.chars().take(64).collect();
+        let started = req.started.clone();
+        self.lock().push(InFlight { key, connection, id, method, command, steps, since: Instant::now(), started });
+        Ticket { running: self, key }
+    }
+
+    /// The `control.running` result, as `asker`'s connection sees it.
+    fn result(&self, asker: u64) -> Value {
+        let rows: Vec<Value> = self
+            .lock()
+            .iter()
+            .map(|e| {
+                let mut r = json!({
+                    "connection": e.connection,
+                    "id": e.id,
+                    "method": e.method,
+                    "running_s": (e.since.elapsed().as_secs_f64() * 10.0).round() / 10.0,
+                    "queued": !e.started.load(Ordering::Relaxed),
+                });
+                if let Some(c) = e.command {
+                    r["command"] = json!(c);
+                }
+                if let Some(n) = e.steps {
+                    r["steps"] = json!(n);
+                }
+                if e.connection == asker {
+                    r["self"] = json!(true);
+                }
+                r
+            })
+            .collect();
+        json!({"running": rows})
+    }
+}
+
+/// A listed request; dropped when its reply arrives.
+struct Ticket {
+    running: &'static Running,
+    key: u64,
+}
+
+impl Drop for Ticket {
+    fn drop(&mut self) {
+        let key = self.key;
+        self.running.lock().retain(|e| e.key != key);
+    }
+}
+
+/// The reply to a timed-out request, received on a thread of its own so the request stays listed
+/// until the app answers, also once its connection has closed (#3654).
+fn watch(reply: Receiver<Value>, ticket: Ticket) -> Receiver<Value> {
+    let (late_tx, late_rx) = channel();
+    // A small thread per timed-out request (each connection has at most one). If none can be
+    // made, the reply is lost and `control.pending` says the app ended the request without one.
+    // The reply is passed on before the request leaves the list: once `control.running` no longer
+    // shows it, its connection's `control.pending` has it.
+    let _ = std::thread::Builder::new().stack_size(64 * 1024).spawn(move || {
+        if let Ok(v) = reply.recv() {
+            let _ = late_tx.send(v);
+        }
+        drop(late_tx);
+        drop(ticket);
+    });
+    late_rx
+}
+
+/// The reply text for a request that outlasts its wait. A request that only reads changes
+/// nothing when it finishes; an export or a save still writes its file, and any other request
+/// still applies, as it was not cancelled.
+fn timeout_message(what: &str, effect: control_pending::Effect) -> String {
+    match effect {
+        control_pending::Effect::ReadsOnly => {
+            format!("timeout: {what} is still running in the app ({}); ask `control.pending` for its answer", effect.when_done())
+        }
+        control_pending::Effect::WritesFile => format!(
+            "timeout: {what} is still running in the app and will still write the file when it finishes (it was not cancelled: \
+             don't send it again; the design does not change); ask `control.pending` for its result"
+        ),
+        control_pending::Effect::Changes => format!(
+            "timeout: {what} is still running in the app and will still apply when it finishes (it was not cancelled: don't send it \
+             again); ask `control.pending` for its result"
+        ),
+    }
+}
+
+/// The reply text for a request refused because an earlier one on the connection still runs.
+fn busy_message(p: &Pending, method: &str) -> String {
+    let method: String = method.chars().take(128).collect();
+    format!(
+        "busy: request {} ({}) is still running, so `{method}` was not run; ask `control.pending` for that request's result, then \
+         send this one again",
+        p.id, p.what
+    )
+}
+
+/// A subscribed connection's socket, for its replies and its events: each line is written whole
+/// and alone, so an event never lands inside a reply (#6985).
+struct Lines {
+    socket: TcpStream,
+    turn: Mutex<()>,
+}
+
+impl Lines {
+    fn send(&self, line: &Value) -> std::io::Result<()> {
+        let _turn = self.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        send(&mut &self.socket, line)
+    }
+}
+
+/// A connection's `control.subscribe` (#6985): its `design.changed` lines, sent from a thread of
+/// their own until the connection ends.
+struct Subscription {
+    lines: Arc<Lines>,
+    stop: Arc<AtomicBool>,
+}
+
+impl Subscription {
+    /// Write `reply`, the window's answer to `control.subscribe` naming the design `seen`, on
+    /// `out`, then send `design`'s changes after it: the reply goes out before any event. `None`,
+    /// with nothing written, when no thread or socket was left for the events.
+    fn start(
+        design: &'static DesignWatch,
+        counted: Subscriber,
+        out: &TcpStream,
+        seen: (String, u64),
+        reply: &Value,
+    ) -> Option<(Self, std::io::Result<()>)> {
+        let lines = Arc::new(Lines { socket: out.try_clone().ok()?, turn: Mutex::new(()) });
+        let stop = Arc::new(AtomicBool::new(false));
+        let first = lines.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        let (l, s) = (lines.clone(), stop.clone());
+        // The connection's seat on the watch rides the events thread: it leaves when the thread
+        // does, so the next failed write to a closed client retires it even while the connection's
+        // own thread is slow to see the end of the stream (#7226).
+        std::thread::Builder::new().stack_size(64 * 1024).spawn(move || send_events(design, &l, &s, seen, counted)).ok()?;
+        let sent = send(&mut &lines.socket, reply);
+        drop(first);
+        Some((Subscription { lines, stop }, sent))
+    }
+}
+
+/// The design a `control.subscribe` reply names.
+fn design_of(reply: &Value) -> Option<(String, u64)> {
+    let result = reply.get("result")?;
+    Some((result.get("document_id")?.as_str()?.to_string(), result.get("revision")?.as_u64()?))
+}
+
+impl Drop for Subscription {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+        // The socket closes now, not when the thread next looks; a line blocked on a client that
+        // stopped reading ends too.
+        let _ = self.lines.socket.shutdown(std::net::Shutdown::Both);
+    }
+}
+
+/// The `design.changed` lines of a subscribed connection, each time the design differs from the
+/// last one it was told of (`seen`), until `stop`. Owns the connection's seat on the watch
+/// (`counted`), so the seat leaves exactly when this thread does: on `stop`, or on the first
+/// write a closed client refuses (#7226).
+fn send_events(design: &DesignWatch, lines: &Lines, stop: &AtomicBool, mut seen: (String, u64), _counted: Subscriber) {
+    while !stop.load(Ordering::Relaxed) {
+        let Some(now) = design.wait(&seen, stop, Duration::from_secs(1)).filter(|now| *now != seen) else { continue };
+        if lines.send(&json!({"event": "design.changed", "params": {"document_id": now.0, "revision": now.1}})).is_err() {
+            break;
+        }
+        seen = now;
+        std::thread::sleep(EVENT_GAP);
+    }
+}
+
+/// Write `reply` on the connection: through its subscription once it has one.
+fn answer(out: &mut TcpStream, events: Option<&Subscription>, reply: &Value) -> std::io::Result<()> {
+    match events {
+        Some(e) => e.lines.send(reply),
+        None => send(out, reply),
+    }
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
+    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING, &DESIGN_WATCH);
+}
+
+#[allow(clippy::too_many_arguments)]
+fn serve_with(
+    stream: TcpStream,
+    token: &str,
+    tx: Sender<ControlRequest>,
+    ctx: egui::Context,
+    patient: bool,
+    waits: Waits,
+    running: &'static Running,
+    design: &'static DesignWatch,
+) {
+    let connection = running.connections.fetch_add(1, Ordering::Relaxed) + 1;
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
     let mut reader = BufReader::new(read);
     let mut bad = 0usize;
     let mut authenticated = false;
     let mut pending: Option<Pending> = None;
+    let mut events: Option<Subscription> = None;
     loop {
+        // A first `control.subscribe` on its way to the window (#6985).
+        let mut joining = None;
         let line = match read_line(&mut reader, MAX_LINE) {
             Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
             Ok(None) => break,
             Err(e) => {
-                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                let _ = answer(&mut out, events.as_ref(), &json!({"ok": false, "error": e.to_string()}));
                 break;
             }
         };
         if line.trim().is_empty() {
             continue;
         }
+        // The first request must carry the token; later ones on the same connection may.
+        if !authenticated {
+            match token_of(&line) {
+                Some(t) if control_auth::tokens_match(&t, token) => authenticated = true,
+                _ => {
+                    refuse(&mut out, &mut reader);
+                    break;
+                }
+            }
+        }
         let reply = match serde_json::from_str::<Value>(&line) {
             Ok(msg) => {
-                // The first request must carry the token; later ones on the same connection may.
-                if !authenticated {
-                    match msg.get("token").and_then(Value::as_str) {
-                        Some(t) if control_auth::tokens_match(t, token) => authenticated = true,
-                        _ => {
-                            refuse(&mut out, &mut reader);
-                            break;
-                        }
-                    }
-                }
                 let id = msg.get("id").cloned().unwrap_or(Value::Null);
                 let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                 let params = msg.get("params").cloned().unwrap_or(json!({}));
-                // A request that timed out may have finished since (#1618).
-                let late = pending.as_ref().and_then(|p| match p.reply.try_recv() {
+                // A request that timed out may have finished since (#1618). `control.running` only
+                // looks, so it leaves that reply where it is.
+                let late = pending.as_ref().filter(|_| method != "control.running").and_then(|p| match p.reply.try_recv() {
                     Ok(reply) => Some(reply),
                     Err(TryRecvError::Disconnected) => Some(json!({"ok": false, "error": "the app ended the request without a reply"})),
                     Err(TryRecvError::Empty) => None,
                 });
-                let mut r = if method == "control.pending" {
+                let mut r = if method == "control.running" {
+                    json!({"ok": true, "result": running.result(connection)})
+                } else if method == "control.pending" {
                     match (pending.take(), late) {
                         (None, _) => json!({"ok": true, "result": {"pending": null}}),
                         (Some(p), Some(reply)) => json!({"ok": true, "result": {"pending": p.id, "method": p.method, "done": true, "reply": reply}}),
@@ -234,7 +555,15 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     }
                 } else if let Some(p) = pending.as_ref().filter(|_| late.is_none()) {
                     // Nothing more is queued behind it, to run unseen when it ends.
-                    json!({"ok": false, "busy": true, "error": format!("busy: request {} (`{}`) is still running; ask `control.pending` for its result", p.id, p.method)})
+                    json!({"ok": false, "busy": true, "error": busy_message(p, &method)})
+                } else if method == "control.subscribe" && events.is_some() {
+                    if late.is_some() {
+                        // As below: finished, and the client moved on without asking.
+                        pending = None;
+                    }
+                    // Its events already say how the design moves; a second answer could only
+                    // arrive behind a newer one.
+                    json!({"ok": false, "error": "already subscribed: this connection is sent design.changed lines; ask document.revision for the design now"})
                 } else {
                     if late.is_some() {
                         // Finished, and the client moved on without asking: it is dropped.
@@ -242,7 +571,13 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     }
                     // A batch replaces many short requests: the whole of it may take long (#743).
                     let wait = if patient || method == "engine.batch" { waits.long } else { waits.short };
+                    let what = control_pending::describe(&method, &params);
+                    let effect = control_pending::effect(&method, &params);
+                    // Counted before the window answers, so it publishes every change from its
+                    // answer on.
+                    joining = (method == "control.subscribe").then(|| design.join());
                     let (req, rrx) = ControlRequest::new(method.clone(), params);
+                    let ticket = running.add(connection, &id, &req);
                     if tx.send(req).is_err() {
                         break;
                     }
@@ -250,8 +585,8 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                     match rrx.recv_timeout(wait) {
                         Ok(r) => r,
                         Err(_) => {
-                            let r = json!({"ok": false, "running": true, "error": format!("timeout: `{method}` is still running in the app and will still apply; ask `control.pending` for its result")});
-                            pending = Some(Pending { id: id.clone(), method, reply: rrx });
+                            let r = json!({"ok": false, "running": true, "error": timeout_message(&what, effect)});
+                            pending = Some(Pending { id: id.clone(), method, what, reply: watch(rrx, ticket) });
                             r
                         }
                     }
@@ -261,16 +596,25 @@ fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: e
                 }
                 r
             }
-            Err(_) if !authenticated => {
-                refuse(&mut out, &mut reader);
-                break;
-            }
             Err(e) => {
                 bad += 1;
                 json!({"ok": false, "error": format!("bad JSON: {e}")})
             }
         };
-        if writeln!(out, "{reply}").is_err() {
+        // Subscribed once the window named the design (not when it refused or timed out).
+        let sent = match joining.and_then(|counted| design_of(&reply).map(|seen| (counted, seen))) {
+            Some((counted, seen)) => match Subscription::start(design, counted, &out, seen, &reply) {
+                Some((subscription, sent)) => {
+                    events = Some(subscription);
+                    sent
+                }
+                None => {
+                    send(&mut out, &json!({"id": reply.get("id"), "ok": false, "error": "not subscribed: no thread or socket left for the events"}))
+                }
+            },
+            None => answer(&mut out, events.as_ref(), &reply),
+        };
+        if sent.is_err() {
             break;
         }
         if bad >= MAX_BAD_LINES {
@@ -307,9 +651,10 @@ mod tests {
             }
         });
         let waits = Waits { short: Duration::from_millis(100), long: Duration::from_millis(100) };
+        static RUNNING: Running = Running::new();
         std::thread::spawn(move || {
             if let Some(stream) = listener.incoming().flatten().next() {
-                serve_with(stream, token, tx, egui::Context::default(), false, waits);
+                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH);
             }
         });
         let s = TcpStream::connect(addr).unwrap();
@@ -349,6 +694,229 @@ mod tests {
         assert_eq!(*ran.lock().unwrap(), ["slow", "ui.view"], "the busy request never reached the app");
     }
 
+    /// #3654: `control.running` answers on every connection, at once, with what any connection
+    /// has the app running or queued (command ids, never parameters); a timed-out request stays
+    /// listed until the app answers it, and an idle app lists nothing.
+    #[test]
+    fn every_connection_sees_what_the_app_is_running() {
+        static RUNNING: Running = Running::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window: one request at a time, as `drain_control` takes them; the export is held
+        // until the test lets it go.
+        let (gate_tx, gate_rx) = channel::<()>();
+        std::thread::spawn(move || {
+            for req in rx {
+                req.started.store(true, Ordering::Relaxed);
+                if req.method == "engine.execute" {
+                    let _ = gate_rx.recv();
+                }
+                let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+            }
+        });
+        let waits = Waits { short: Duration::from_millis(100), long: Duration::from_secs(60) };
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH));
+            }
+        });
+        let open = || {
+            let s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            let mut out = s.try_clone().unwrap();
+            let mut lines = BufReader::new(s);
+            move |v: Value| -> Value {
+                writeln!(out, "{v}").unwrap();
+                let mut l = String::new();
+                lines.read_line(&mut l).unwrap();
+                serde_json::from_str(&l).unwrap()
+            }
+        };
+        let running = |ask: &mut dyn FnMut(Value) -> Value, until: &dyn Fn(&[Value]) -> bool| {
+            let deadline = Instant::now() + Duration::from_secs(10);
+            loop {
+                let r = ask(json!({"id": 0, "method": "control.running", "token": token}));
+                let rows = r["result"]["running"].as_array().cloned().unwrap_or_default();
+                if until(&rows) || Instant::now() > deadline {
+                    return (r, rows);
+                }
+                std::thread::sleep(Duration::from_millis(10));
+            }
+        };
+        let mut watcher = open();
+        let (r, rows) = running(&mut watcher, &|_| true);
+        assert!(r["ok"] == true && rows.is_empty(), "idle: {r}");
+
+        let mut export = open();
+        let path = "/private/part.step";
+        let params = json!({"command": "file.export", "params": {"path": path}});
+        let r = export(json!({"id": 7, "method": "engine.execute", "params": params, "token": token}));
+        assert_eq!(r["running"], true, "{r}");
+        // A batch from another connection waits behind the export.
+        let mut batch = open();
+        let queued = std::thread::spawn(move || {
+            let steps = json!([{"command": "solid.box"}, {"command": "solid.box"}]);
+            batch(json!({"id": "b", "method": "engine.batch", "params": {"commands": steps}, "token": token}))
+        });
+        // The window may not have taken the export yet, even though it timed out.
+        let (r, rows) = running(&mut watcher, &|rows| rows.len() == 2 && rows[0]["queued"] == false);
+        assert_eq!(rows.len(), 2, "{r}");
+        let (e, b) = (&rows[0], &rows[1]);
+        assert_eq!(
+            (&e["id"], &e["method"], &e["command"], &e["queued"]),
+            (&json!(7), &json!("engine.execute"), &json!("file.export"), &json!(false)),
+            "{r}"
+        );
+        assert!(e["running_s"].as_f64().is_some_and(|s| s >= 0.1), "{r}");
+        assert_eq!((&b["id"], &b["method"], &b["steps"], &b["queued"]), (&json!("b"), &json!("engine.batch"), &json!(2), &json!(true)), "{r}");
+        assert_ne!(e["connection"], b["connection"], "{r}");
+        assert!(rows.iter().all(|row| row.get("self").is_none()), "{r}");
+        assert!(!r.to_string().contains(path), "parameters stay with their connection: {r}");
+        // The connection whose request timed out may ask too, and sees its own marked.
+        let r = export(json!({"id": 8, "method": "control.running"}));
+        let own: Vec<&Value> = r["result"]["running"].as_array().unwrap().iter().filter(|row| row["self"] == true).collect();
+        assert_eq!(own.len(), 1, "{r}");
+        assert_eq!(own[0]["command"], "file.export", "{r}");
+
+        gate_tx.send(()).unwrap();
+        assert_eq!(queued.join().unwrap()["result"], "engine.batch");
+        let (r, rows) = running(&mut watcher, &|rows| rows.is_empty());
+        assert!(rows.is_empty(), "done: {r}");
+        // Asking `control.running` did not take the export's reply from its connection.
+        let r = export(json!({"id": 9, "method": "control.pending"}));
+        assert_eq!((&r["result"]["pending"], &r["result"]["done"]), (&json!(7), &json!(true)), "{r}");
+    }
+
+    /// #6985: a connection that sends `control.subscribe` gets the design in the reply, then a
+    /// `design.changed` line each time the window publishes another: never before the reply,
+    /// none for the same design, the latest after a burst, each line whole between its replies.
+    /// A second subscribe is refused without reaching the window. A connection that did not
+    /// subscribe gets no events, and one that closed is no longer counted.
+    #[test]
+    fn subscribed_connections_are_told_of_design_changes() {
+        static RUNNING: Running = Running::new();
+        static WATCH: DesignWatch = DesignWatch::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window: it answers `control.subscribe` as the app does, publishing the design first;
+        // then the design changes at once, before the reply may have been written.
+        std::thread::spawn(move || {
+            for req in rx {
+                if req.method == "control.subscribe" {
+                    WATCH.publish("d-1", 3);
+                    let _ = req.reply.send(json!({"ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+                    WATCH.publish("d-1", 4);
+                } else {
+                    let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+                }
+            }
+        });
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, WAITS, &RUNNING, &WATCH));
+            }
+        });
+        let open = || {
+            let s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            (s.try_clone().unwrap(), BufReader::new(s))
+        };
+        let next = |lines: &mut BufReader<TcpStream>| -> Value {
+            let mut l = String::new();
+            lines.read_line(&mut l).unwrap();
+            serde_json::from_str(&l).unwrap()
+        };
+        let changed = |id: &str, revision: u64| json!({"event": "design.changed", "params": {"document_id": id, "revision": revision}});
+
+        let (mut quiet_out, mut quiet) = open();
+        writeln!(quiet_out, "{}", json!({"id": 1, "method": "ui.view", "token": token})).unwrap();
+        assert_eq!(next(&mut quiet)["id"], 1);
+
+        let (mut out, mut lines) = open();
+        writeln!(out, "{}", json!({"id": 1, "method": "control.subscribe", "token": token})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 1, "ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+        assert_eq!(next(&mut lines), changed("d-1", 4), "the change after the window's answer comes after the reply");
+        assert!(WATCH.subscribed());
+        // The design it was told of is no news; another revision is.
+        WATCH.publish("d-1", 4);
+        WATCH.publish("d-1", 5);
+        assert_eq!(next(&mut lines), changed("d-1", 5));
+        // A burst ends with its latest.
+        for revision in 6..=10 {
+            WATCH.publish("d-1", revision);
+        }
+        let mut last = 5;
+        while last < 10 {
+            let e = next(&mut lines);
+            let revision = e["params"]["revision"].as_u64().unwrap();
+            assert!(e["event"] == "design.changed" && revision > last, "{e} after {last}");
+            last = revision;
+        }
+        // Another tab: another id, whatever its revision.
+        WATCH.publish("d-2", 2);
+        assert_eq!(next(&mut lines), changed("d-2", 2));
+        // Subscribed already: refused here (the window would have published d-1 again).
+        writeln!(out, "{}", json!({"id": 2, "method": "control.subscribe"})).unwrap();
+        let r = next(&mut lines);
+        assert!(r["id"] == 2 && r["ok"] == false && r["error"].as_str().is_some_and(|e| e.starts_with("already subscribed")), "{r}");
+        // Replies still come, whole, and nothing else was sent meanwhile.
+        writeln!(out, "{}", json!({"id": 3, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 3, "ok": true, "result": "ui.view"}));
+        writeln!(quiet_out, "{}", json!({"id": 2, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut quiet), json!({"id": 2, "ok": true, "result": "ui.view"}), "no events without subscribing");
+        // Closed, it is no longer counted. Each publish asks the events thread for one more line,
+        // and its write to the closed connection is what retires the seat; that keeps the wait off
+        // the connection's own thread, which anything else this process is doing may hold up past
+        // the deadline (#7226).
+        drop((out, lines));
+        let mut revision = 11;
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while WATCH.subscribed() && Instant::now() < deadline {
+            WATCH.publish("d-1", revision);
+            revision += 1;
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        assert!(!WATCH.subscribed());
+    }
+
+    /// A timed-out request that only reads is not said to "still apply", nor is one that only
+    /// writes a file (an export, #1989); a change is, by name.
+    #[test]
+    fn timeout_text_tells_reads_from_changes() {
+        let says = |method: &str, p: Value| timeout_message(&control_pending::describe(method, &p), control_pending::effect(method, &p));
+        let read = says("ui.inspect", json!({}));
+        assert!(read.starts_with("timeout") && read.contains("only reads") && !read.contains("will still apply"), "{read}");
+        let read = says("engine.execute", json!({"command": "sketch.inspect"}));
+        assert!(read.contains("only reads") && read.contains("sketch.inspect"), "{read}");
+        let change = says("engine.execute", json!({"command": "solid.fillet"}));
+        assert!(change.starts_with("timeout") && change.contains("will still apply") && change.contains("solid.fillet"), "{change}");
+        let export = says("engine.execute", json!({"command": "file.export", "params": {"path": "/tmp/wall.step"}}));
+        assert!(export.contains("will still write the file") && !export.contains("apply") && export.contains("file.export"), "{export}");
+        let save = says("engine.execute", json!({"command": "file.save"}));
+        assert!(save.contains("will still write the file") && !save.contains("apply"), "{save}");
+        let render = says("ui.render", json!({"path": "/tmp/a.png"}));
+        assert!(render.contains("will still write the file"), "{render}");
+    }
+
+    /// The token is read from a request object without building the rest of it: other fields,
+    /// however large or nested, are only skipped. Anything but an object with a string token is
+    /// no token.
+    #[test]
+    fn token_is_read_without_parsing_the_request() {
+        assert_eq!(token_of(r#"{"id":1,"token":"abc","params":{"a":[1,[2,{"b":null}]]}}"#).as_deref(), Some("abc"));
+        let flood = format!(r#"{{"params":[{}0],"token":"t"}}"#, "0,".repeat(1 << 20));
+        assert_eq!(token_of(&flood).as_deref(), Some("t"));
+        for no in [r#"["abc"]"#, r#"{"token":5}"#, r#"{"token":"a"} x"#, r#"{"id":1}"#, "GET / HTTP/1.1", r#""token""#] {
+            assert_eq!(token_of(no), None, "{no}");
+        }
+    }
+
     /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
     /// missing token, or garbage, is refused and the connection closed. Once shown, the token
     /// need not be repeated on that connection.
@@ -441,4 +1009,31 @@ mod tests {
         let mut r = BufReader::with_capacity(64, text.as_slice());
         assert!(read_line(&mut r, 1000).is_err());
     }
+
+    /// A large reply reaches the socket in one write, not one per JSON piece (a component tree of
+    /// thousands of components took half a second to send), and reads back as it was.
+    #[test]
+    fn a_large_reply_is_written_at_once() {
+        struct Counted {
+            writes: usize,
+            bytes: Vec<u8>,
+        }
+        impl Write for Counted {
+            fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+                self.writes += 1;
+                self.bytes.extend_from_slice(buf);
+                Ok(buf.len())
+            }
+            fn flush(&mut self) -> std::io::Result<()> {
+                Ok(())
+            }
+        }
+        let components: Vec<Value> = (0..2000).map(|i| json!({"id": i, "name": format!("Part {i}"), "bodies": ["a", "b"], "parent": 0})).collect();
+        let reply = json!({"ok": true, "id": 7, "result": {"components": components}});
+        let mut out = Counted { writes: 0, bytes: Vec::new() };
+        send(&mut out, &reply).unwrap();
+        assert_eq!(out.writes, 1);
+        assert_eq!(out.bytes.last(), Some(&b'\n'));
+        assert_eq!(serde_json::from_slice::<Value>(&out.bytes).unwrap(), reply);
+    }
 }

apps/solidcraft/src/device_lost.rs

@@ -0,0 +1,91 @@
+//! The graphics device was lost after the window opened: the driver was reset (on Windows a TDR,
+//! "Display driver stopped responding and has recovered") or the GPU went away (#4172). A lost
+//! device can't draw again, so the window can't show anything more, not even a message. The
+//! painter stops drawing (`egui_wgpu::DeviceLost`); the app then closes, keeping unsaved changes
+//! for recovery as a forced quit does, and starts again ([`restart`]), and the new start says what
+//! happened ([`note`]). A device lost again soon after such a restart starts the next one on the
+//! software renderer, which doesn't depend on the graphics driver.
+
+use crate::startup;
+
+/// Set on the start after a lost device: when the device was lost (seconds since 1970).
+pub const LOST_ENV: &str = "SOLIDCRAFT_DEVICE_LOST";
+
+/// A loss this recent (seconds) counts for the start after it: its note, and a second loss
+/// within it starts on the software renderer. Inherited by later starts, an older stamp is
+/// ignored.
+const RECENT_SECS: u64 = 600;
+
+/// Seconds since 1970.
+pub fn now_secs() -> u64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs())
+}
+
+/// Whether `stamp` ([`LOST_ENV`]) names a loss at most [`RECENT_SECS`] before `now`.
+pub fn recent(stamp: Option<&str>, now: u64) -> bool {
+    stamp.and_then(|s| s.trim().parse::<u64>().ok()).is_some_and(|at| at <= now && now - at <= RECENT_SECS)
+}
+
+/// Whether the start after a lost device uses the software renderer: when this launch already
+/// followed a recent loss (the driver keeps losing it), or ran on it anyway.
+pub fn restart_on_software(after_recent_loss: bool, cpu_renderer: bool) -> bool {
+    after_recent_loss || cpu_renderer
+}
+
+/// What the start after a lost device tells the user, `software` when it runs on the software
+/// renderer.
+pub fn note(software: bool) -> String {
+    let mut note = String::from(
+        "The graphics device was reset (the graphics driver stopped responding), so SolidCraft closed and started again. Unsaved changes were kept for recovery.",
+    );
+    if software {
+        note.push_str(" This start uses software rendering, which doesn't depend on the graphics driver.");
+    }
+    note
+}
+
+/// Start SolidCraft again with the same arguments, the loss stamped at `lost_at`, on the software
+/// renderer when `software`.
+pub fn restart(software: bool, lost_at: u64) {
+    let Ok(exe) = std::env::current_exe() else { return };
+    let mut command = std::process::Command::new(exe);
+    command.args(std::env::args_os().skip(1)).env(LOST_ENV, lost_at.to_string());
+    if software {
+        command.env(startup::RENDERER_ENV, "cpu");
+    }
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        // Not tied to this process: its own process group, no console.
+        command.creation_flags(0x0000_0200 | 0x0000_0008);
+    }
+    if let Err(e) = command.spawn() {
+        log::error!("graphics: starting again after the device was lost: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    /// Only a recent, well-formed stamp counts: a later start that inherited it says nothing.
+    #[test]
+    fn only_a_recent_loss_counts() {
+        let now = 1_000_000;
+        assert!(super::recent(Some("999990"), now));
+        assert!(super::recent(Some(" 999400 "), now));
+        assert!(!super::recent(Some("999399"), now), "older than ten minutes");
+        assert!(!super::recent(Some("1000001"), now), "from the future");
+        assert!(!super::recent(Some("soon"), now));
+        assert!(!super::recent(None, now));
+    }
+
+    /// The first loss starts again on the GPU; a second one soon after, on the software renderer.
+    #[test]
+    fn a_second_loss_in_a_row_starts_on_the_software_renderer() {
+        assert!(!super::restart_on_software(false, false));
+        assert!(super::restart_on_software(true, false));
+        assert!(super::restart_on_software(false, true));
+        assert!(super::note(true).contains("software rendering"));
+        assert!(!super::note(false).contains("software rendering"));
+        assert!(super::note(false).contains("kept for recovery"));
+    }
+}

apps/solidcraft/src/native_crash_macos.rs

@@ -0,0 +1,879 @@
+//! macOS: what a crash in native code leaves behind (docs/crash-reports.md).
+//!
+//! A crash inside a graphics driver or another library (a segfault, an `abort()`, a stack
+//! overflow) is no Rust panic: the panic hook never runs and the next start only found "an
+//! unclean exit". A signal handler for SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP (how a trap
+//! instruction arrives on Apple silicon) and SIGABRT now writes, before the process goes, the
+//! same small JSON file as the Windows filter (`native_crash.rs`): the signal, the faulting
+//! module and the offset into it, and a short frame-pointer walk, next to the run's crash journal
+//! (`solidcraft_engine::crash::native_paths`). The next start puts it into the unclean exit's
+//! report. The signal then goes on to the handler that was there before (the standard library's
+//! stack overflow message) or to the default action, so the process still dies of it and macOS
+//! still writes its own crash report (`~/Library/Logs/DiagnosticReports`; the file names the
+//! `pid` the JSON records).
+//!
+//! Installing a signal handler and asking dyld which image holds an address have no safe API,
+//! hence the `unsafe_code` allowance on this module (the app crate denies it). The handler runs
+//! on a thread that may have a broken heap, or on the small alternate stack after a stack
+//! overflow: it doesn't allocate, formats into a buffer on the stack, and only reads memory on
+//! the thread's own stack. It writes what it knows from the signal first and only then calls
+//! `dladdr` (not on POSIX's async-signal-safe list; it takes dyld's recursive reader lock and
+//! doesn't allocate) to name the modules, rewriting the file, so a hang or a fault in there
+//! still leaves a record.
+#![allow(unsafe_code)]
+
+use std::ffi::{CStr, CString, c_int, c_void};
+use std::fmt::Write as _;
+use std::os::unix::ffi::OsStrExt;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicI32, AtomicUsize, Ordering};
+
+use libc::{SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP, siginfo_t};
+
+/// The signals a crash arrives as, in the order of [`PREVIOUS`].
+const SIGNALS: [c_int; 6] = [SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP, SIGABRT];
+/// Frames the walk records (the faulting instruction first).
+const MAX_FRAMES: usize = 24;
+/// A fault this far below a thread's stack is taken for a stack overflow.
+const GUARD: usize = 64 << 10;
+
+/// Where the handler writes (NUL-terminated), set once by [`install`].
+static PATH: OnceLock<CString> = OnceLock::new();
+/// The handler that was installed before ours for each of [`SIGNALS`] (called after ours), as an
+/// address (`SIG_DFL` is 0, `SIG_IGN` 1), and its `sa_flags`.
+static PREVIOUS: [AtomicUsize; 6] = [const { AtomicUsize::new(libc::SIG_DFL) }; 6];
+static PREVIOUS_FLAGS: [AtomicI32; 6] = [const { AtomicI32::new(0) }; 6];
+/// The handler has started writing (a second signal while it does is only passed on).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+/// Catch native crashes from now on (after `solidcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, _)) = solidcraft_engine::crash::native_paths() else { return };
+    let Ok(path) = CString::new(info.as_os_str().as_bytes()) else { return };
+    if PATH.set(path).is_err() {
+        return;
+    }
+    for (slot, &signal) in SIGNALS.iter().enumerate() {
+        // SAFETY: `sigaction` is plain data; all zeros is a valid (empty) value.
+        let mut ours: libc::sigaction = unsafe { std::mem::zeroed() };
+        ours.sa_sigaction = handler as *const () as usize;
+        // On the alternate stack the standard library gives each of its threads, so that a stack
+        // overflow can still be recorded.
+        ours.sa_flags = libc::SA_SIGINFO | libc::SA_ONSTACK;
+        // SAFETY: as above.
+        let mut old: libc::sigaction = unsafe { std::mem::zeroed() };
+        // SAFETY: `handler` has the signature SA_SIGINFO calls it with and stays valid for the
+        // process's life; both structs are valid for the call.
+        if unsafe { libc::sigaction(signal, &ours, &mut old) } == 0
+            && old.sa_sigaction != ours.sa_sigaction
+            && let (Some(p), Some(f)) = (PREVIOUS.get(slot), PREVIOUS_FLAGS.get(slot))
+        {
+            f.store(old.sa_flags, Ordering::SeqCst);
+            p.store(old.sa_sigaction, Ordering::SeqCst);
+        }
+    }
+}
+
+/// The signal handler: record, then pass the signal on.
+unsafe extern "C" fn handler(signal: c_int, info: *mut siginfo_t, context: *mut c_void) {
+    // SAFETY: `__error` is this thread's errno, restored for whatever runs after us.
+    let errno = unsafe { *libc::__error() };
+    let slot = SIGNALS.iter().position(|&s| s == signal).unwrap_or(0);
+    let previous = PREVIOUS.get(slot).map_or(libc::SIG_DFL, |p| p.load(Ordering::SeqCst));
+    // SAFETY: the system passes a valid siginfo and the interrupted thread's context for the
+    // duration of an SA_SIGINFO handler.
+    let f = unsafe { fault(signal, info, context) };
+    // Someone sent a signal the app ignored before: still nothing to record.
+    let ignored = previous == libc::SIG_IGN && !f.fault;
+    if !ignored && !BUSY.swap(true, Ordering::SeqCst) {
+        record(&f);
+    }
+    // SAFETY: as above.
+    unsafe { pass_on(signal, slot, previous, f.fault, info, context) };
+    // SAFETY: as above.
+    unsafe { *libc::__error() = errno };
+}
+
+/// The signal comes from the faulting instruction itself (not `kill`, `raise` or `abort`), so
+/// returning runs it again: on arm64, the exception the thread last took matches the signal.
+/// macOS gives a SIGSEGV sent with `kill` the same `si_code` as a real one (SEGV_ACCERR), but
+/// the exception is then the thread's last system call (or something long past, whose fault
+/// address doesn't match).
+#[cfg(any(target_arch = "aarch64", test))]
+fn arm64_fault(signal: c_int, si_code: c_int, addr: usize, esr: u32, far: u64) -> bool {
+    const ABORTS: [u32; 4] = [0x20, 0x21, 0x24, 0x25];
+    const SVC: u32 = 0x15;
+    let class = esr >> 26;
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => ABORTS.contains(&class) && far as usize == addr,
+            _ => class != SVC && !ABORTS.contains(&class),
+        }
+}
+
+/// As [`arm64_fault`], from the x86 trap number and page-fault address.
+#[cfg(any(target_arch = "x86_64", test))]
+fn x86_fault(signal: c_int, si_code: c_int, addr: usize, trapno: u16, faultvaddr: u64) -> bool {
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => (trapno == 14 && faultvaddr as usize == addr) || matches!(trapno, 12 | 13),
+            SIGILL => trapno == 6,
+            SIGFPE => matches!(trapno, 0 | 16 | 19),
+            SIGTRAP => matches!(trapno, 1 | 3),
+            _ => false,
+        }
+}
+
+/// Hand the signal to the previous handler, or to the default action. A crash signal that was
+/// only sent goes to the default action: the handler before ours (the standard library's, for
+/// SIGSEGV and SIGBUS) expects a fault that happens again when it returns.
+unsafe fn pass_on(signal: c_int, slot: usize, previous: usize, fault: bool, info: *mut siginfo_t, context: *mut c_void) {
+    let ours = handler as *const () as usize;
+    if previous != libc::SIG_DFL && previous != libc::SIG_IGN && previous != ours && (fault || signal == SIGABRT) {
+        let flags = PREVIOUS_FLAGS.get(slot).map_or(0, |f| f.load(Ordering::SeqCst));
+        if flags & libc::SA_SIGINFO != 0 {
+            // SAFETY: the address came from `sigaction` as an SA_SIGINFO handler.
+            let previous: unsafe extern "C" fn(c_int, *mut siginfo_t, *mut c_void) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal, info, context) };
+        } else {
+            // SAFETY: the address came from `sigaction` as a plain handler.
+            let previous: unsafe extern "C" fn(c_int) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal) };
+        }
+        return;
+    }
+    if previous == libc::SIG_IGN && !fault {
+        return;
+    }
+    // SAFETY: as in `install`.
+    let mut default: libc::sigaction = unsafe { std::mem::zeroed() };
+    default.sa_sigaction = libc::SIG_DFL;
+    // SAFETY: a valid struct; restoring the default action is async-signal-safe.
+    unsafe { libc::sigaction(signal, &default, std::ptr::null_mut()) };
+    // A fault happens again when we return, now with the default action, so macOS reports it at
+    // the instruction; anything else is raised again, and arrives once this handler returns.
+    if !fault {
+        // SAFETY: async-signal-safe.
+        unsafe { libc::raise(signal) };
+    }
+}
+
+/// The darwin `ucontext_t`, up to the pointer to the machine context (`<sys/_types/_ucontext.h>`).
+#[repr(C)]
+struct UContext {
+    _onstack: c_int,
+    _sigmask: u32,
+    _stack: libc::stack_t,
+    _link: *mut c_void,
+    _mcsize: usize,
+    mcontext: *const MContext,
+}
+
+/// The darwin arm64 machine context: exception state, then the general registers
+/// (`<mach/arm/_structs.h>`; the floating-point state that follows isn't read).
+#[cfg(target_arch = "aarch64")]
+#[repr(C)]
+struct MContext {
+    far: u64,
+    esr: u32,
+    _exception: u32,
+    _x: [u64; 29],
+    fp: u64,
+    _lr: u64,
+    _sp: u64,
+    pc: u64,
+}
+
+/// The darwin x86_64 machine context: exception state, then the general registers
+/// (`<mach/i386/_structs.h>`; rax rbx rcx rdx rdi rsi rbp rsp r8–r15, then rip).
+#[cfg(target_arch = "x86_64")]
+#[repr(C)]
+struct MContext {
+    trapno: u16,
+    _cpu: u16,
+    err: u32,
+    faultvaddr: u64,
+    gpr: [u64; 16],
+    rip: u64,
+}
+
+/// What the faulting instruction did to its address, when the processor says.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Access {
+    Unknown,
+    Read,
+    Write,
+    Execute,
+}
+
+/// What a crash signal says, read out of the signal before anything is looked up.
+#[derive(Clone, Copy, Debug)]
+struct Fault {
+    signal: c_int,
+    si_code: c_int,
+    /// `si_addr`: the address that faulted (for SIGILL, SIGFPE and SIGTRAP, the instruction).
+    addr: usize,
+    pc: usize,
+    fp: usize,
+    access: Access,
+    /// It comes from the faulting instruction (not `kill`, `raise` or `abort`).
+    fault: bool,
+    /// The process that sent the signal (0 or our own for a fault or an `abort()`).
+    sender: i32,
+    pid: i32,
+    thread: u64,
+    thread_name: [u8; 64],
+    /// The thread's stack, `[low, high)` (0, 0 when unknown).
+    stack: (usize, usize),
+}
+
+impl Fault {
+    /// The fault hit just below the thread's stack: the stack ran out.
+    fn overflow(&self) -> bool {
+        let (low, high) = self.stack;
+        matches!(self.signal, SIGSEGV | SIGBUS) && high > low && self.addr < low.saturating_add(4096) && self.addr >= low.saturating_sub(GUARD)
+    }
+
+    fn signal_name(&self) -> &'static str {
+        match self.signal {
+            SIGSEGV => "SIGSEGV",
+            SIGBUS => "SIGBUS",
+            SIGILL => "SIGILL",
+            SIGFPE => "SIGFPE",
+            SIGTRAP => "SIGTRAP",
+            SIGABRT => "SIGABRT",
+            _ => "signal",
+        }
+    }
+
+    fn name(&self) -> &'static str {
+        if self.overflow() {
+            return "stack overflow";
+        }
+        match self.signal {
+            SIGSEGV => "segmentation fault",
+            SIGBUS => "bus error",
+            SIGILL => "illegal instruction",
+            SIGFPE => "arithmetic exception",
+            SIGTRAP => "trap",
+            SIGABRT => "abort",
+            _ => "signal",
+        }
+    }
+
+    /// The `si_code` names that say something about a crash.
+    fn code_name(&self) -> Option<&'static str> {
+        Some(match (self.signal, self.si_code) {
+            (SIGSEGV, 1) => "SEGV_MAPERR",
+            (SIGSEGV, 2) => "SEGV_ACCERR",
+            (SIGBUS, 1) => "BUS_ADRALN",
+            (SIGBUS, 2) => "BUS_ADRERR",
+            (SIGBUS, 3) => "BUS_OBJERR",
+            (SIGFPE, 7) => "FPE_INTDIV",
+            (SIGFPE, 8) => "FPE_INTOVF",
+            _ => return None,
+        })
+    }
+
+    /// One line on what happened: the address read or written, a stack overflow, who sent it.
+    fn detail(&self, b: &mut Buf) {
+        if self.sender != 0 && self.sender != self.pid {
+            let _ = write!(b, "sent by process {}", self.sender);
+            return;
+        }
+        if !self.fault {
+            if self.signal != SIGABRT {
+                let _ = b.write_str("sent with kill or raise, not a fault");
+            }
+            return;
+        }
+        let what = match self.access {
+            Access::Read => "read of",
+            Access::Write => "write to",
+            Access::Execute => "execution at",
+            Access::Unknown => "access to",
+        };
+        if self.overflow() {
+            let _ = write!(b, "{what} 0x{:016X}, below the thread's stack", self.addr);
+        } else if matches!(self.signal, SIGSEGV | SIGBUS) {
+            let _ = write!(b, "{what} 0x{:016X}", self.addr);
+        } else {
+            let _ = write!(b, "at 0x{:016X}", self.addr);
+        }
+        if let Some(c) = self.code_name() {
+            let _ = write!(b, " ({c})");
+        }
+    }
+}
+
+/// An image that holds an address, as `dladdr` names it.
+struct Module<'a> {
+    path: &'a [u8],
+    base: usize,
+    symbol: Option<(&'a [u8], usize)>,
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 8192],
+    len: usize,
+}
+
+impl Buf {
+    fn new() -> Buf {
+        Buf { bytes: [0; 8192], len: 0 }
+    }
+
+    fn room(&self) -> usize {
+        self.bytes.len().saturating_sub(self.len)
+    }
+
+    fn as_bytes(&self) -> &[u8] {
+        self.bytes.get(..self.len).unwrap_or_default()
+    }
+
+    /// `s` as the inside of a JSON string, at most `max` bytes of it (bytes that aren't UTF-8
+    /// and control characters become `?`).
+    fn escaped(&mut self, s: &[u8], max: usize) {
+        for chunk in s.get(..s.len().min(max)).unwrap_or_default().utf8_chunks() {
+            for c in chunk.valid().chars() {
+                let _ = match c {
+                    '"' => self.write_str("\\\""),
+                    '\\' => self.write_str("\\\\"),
+                    c if (c as u32) < 0x20 => self.write_str("?"),
+                    c => self.write_char(c),
+                };
+            }
+            if !chunk.invalid().is_empty() {
+                let _ = self.write_str("?");
+            }
+        }
+    }
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let n = s.len().min(self.room());
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The last part of a path.
+fn file_name(path: &[u8]) -> &[u8] {
+    path.rsplit(|&c| c == b'/').next().unwrap_or(path)
+}
+
+/// The report: what the signal says, then (with `resolve`) the module of the faulting
+/// instruction and the `frames`. Always valid JSON: frames stop while there is room to close it.
+fn json(b: &mut Buf, f: &Fault, frames: &[usize], resolve: impl Fn(usize, bool) -> Option<Module<'static>>) {
+    let signal = f.signal_name();
+    let _ = write!(b, "{{\"signal\":\"{signal}\",\"number\":{},\"code\":\"{signal}\",\"name\":\"{}\"", f.signal, f.name());
+    let _ = write!(b, ",\"si_code\":{},\"address\":\"0x{:016X}\",\"thread\":{},\"pid\":{}", f.si_code, f.pc, f.thread, f.pid);
+    let name = f.thread_name.split(|&c| c == 0).next().unwrap_or_default();
+    if !name.is_empty() {
+        let _ = b.write_str(",\"thread_name\":\"");
+        b.escaped(name, 64);
+        let _ = b.write_str("\"");
+    }
+    let mark = b.len;
+    let _ = b.write_str(",\"detail\":\"");
+    let start = b.len;
+    f.detail(b);
+    if b.len == start {
+        b.len = mark;
+    } else {
+        let _ = b.write_str("\"");
+    }
+    if let Some(m) = resolve(f.pc, false) {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", f.pc.wrapping_sub(m.base));
+        b.escaped(m.path, 300);
+        let _ = b.write_str("\"");
+    }
+    if !frames.is_empty() {
+        let _ = b.write_str(",\"frames\":[");
+        for (i, &at) in frames.iter().enumerate() {
+            // A frame is at most ~300 bytes; keep room for it and the closing `]}`.
+            if b.room() < 400 {
+                break;
+            }
+            if i > 0 {
+                let _ = b.write_str(",");
+            }
+            let _ = b.write_str("\"");
+            // A return address points after the call: look up the call itself.
+            match resolve(at, i > 0) {
+                Some(m) => {
+                    b.escaped(file_name(m.path), 100);
+                    let _ = write!(b, "+0x{:X}", at.wrapping_sub(m.base));
+                    if let Some((symbol, start)) = m.symbol {
+                        let _ = b.write_str(" ");
+                        b.escaped(symbol, 160);
+                        let _ = write!(b, "+0x{:X}", at.wrapping_sub(start));
+                    }
+                }
+                None => {
+                    let _ = write!(b, "0x{at:016X}");
+                }
+            }
+            let _ = b.write_str("\"");
+        }
+        let _ = b.write_str("]");
+    }
+    let _ = b.write_str("}");
+}
+
+/// The return addresses up the frame-pointer chain from `fp`, after `pc`. `read` gives the word
+/// at an address; frames outside `stack`, misaligned or not going up end the walk.
+fn walk(pc: usize, fp: usize, stack: (usize, usize), read: impl Fn(usize) -> Option<usize>, out: &mut [usize; MAX_FRAMES]) -> usize {
+    let (low, high) = stack;
+    let mut n = 0;
+    if let Some(slot) = out.get_mut(n) {
+        *slot = pc;
+        n += 1;
+    }
+    let mut fp = fp;
+    while n < MAX_FRAMES {
+        let in_stack = fp >= low && fp.checked_add(16).is_some_and(|end| end <= high);
+        if !fp.is_multiple_of(8) || !in_stack {
+            break;
+        }
+        let (Some(next), Some(ret)) = (read(fp), read(fp + 8)) else { break };
+        let ret = strip_pointer_auth(ret);
+        if ret == 0 {
+            break;
+        }
+        if let Some(slot) = out.get_mut(n) {
+            *slot = ret;
+            n += 1;
+        }
+        if next <= fp {
+            break;
+        }
+        fp = next;
+    }
+    n
+}
+
+/// Return addresses saved by arm64e code carry a signature in their top bits.
+fn strip_pointer_auth(addr: usize) -> usize {
+    if cfg!(target_arch = "aarch64") { addr & 0x0000_7FFF_FFFF_FFFF } else { addr }
+}
+
+/// Read what the signal and the interrupted thread's registers say.
+unsafe fn fault(signal: c_int, info: *const siginfo_t, context: *const c_void) -> Fault {
+    let mut f = Fault {
+        signal,
+        si_code: 0,
+        addr: 0,
+        pc: 0,
+        fp: 0,
+        access: Access::Unknown,
+        fault: false,
+        sender: 0,
+        // SAFETY: async-signal-safe.
+        pid: unsafe { libc::getpid() },
+        thread: 0,
+        thread_name: [0; 64],
+        stack: (0, 0),
+    };
+    if !info.is_null() {
+        // SAFETY: the system passes a valid siginfo for the duration of the handler.
+        let info = unsafe { &*info };
+        f.si_code = info.si_code;
+        f.addr = info.si_addr as usize;
+        f.sender = info.si_pid;
+        // Without registers (never seen), the signal's own code has to do.
+        f.fault = signal != SIGABRT && (1..0x10000).contains(&f.si_code);
+    }
+    let context = context as *const UContext;
+    // SAFETY: an SA_SIGINFO handler's third argument is the interrupted thread's ucontext, whose
+    // machine context pointer the kernel fills in.
+    let mcontext = if context.is_null() { std::ptr::null() } else { unsafe { (*context).mcontext } };
+    if !mcontext.is_null() {
+        // SAFETY: as above.
+        let m = unsafe { &*mcontext };
+        #[cfg(target_arch = "aarch64")]
+        {
+            f.pc = strip_pointer_auth(m.pc as usize);
+            f.fp = m.fp as usize;
+            f.fault = arm64_fault(signal, f.si_code, f.addr, m.esr, m.far);
+            // A data abort says whether it was a write (WnR); an instruction abort is execution.
+            f.access = match m.esr >> 26 {
+                0x24 | 0x25 if m.esr & (1 << 6) != 0 => Access::Write,
+                0x24 | 0x25 => Access::Read,
+                0x20 | 0x21 => Access::Execute,
+                _ => Access::Unknown,
+            };
+        }
+        #[cfg(target_arch = "x86_64")]
+        {
+            f.pc = m.rip as usize;
+            f.fp = m.gpr.get(6).copied().unwrap_or(0) as usize;
+            f.fault = x86_fault(signal, f.si_code, f.addr, m.trapno, m.faultvaddr);
+            // A page fault's error code: bit 4 instruction fetch, bit 1 write.
+            f.access = match (m.trapno, m.err) {
+                (14, e) if e & 0x10 != 0 => Access::Execute,
+                (14, e) if e & 0x2 != 0 => Access::Write,
+                (14, _) => Access::Read,
+                _ => Access::Unknown,
+            };
+        }
+    }
+    if f.pc == 0 && matches!(signal, SIGILL | SIGFPE | SIGTRAP) {
+        f.pc = f.addr;
+    }
+    // SAFETY: these read the calling thread's own pthread structure; the buffers are as long as
+    // we say.
+    unsafe {
+        let me = libc::pthread_self();
+        libc::pthread_threadid_np(me, &mut f.thread);
+        libc::pthread_getname_np(me, f.thread_name.as_mut_ptr().cast(), f.thread_name.len());
+        let high = libc::pthread_get_stackaddr_np(me) as usize;
+        let size = libc::pthread_get_stacksize_np(me);
+        if let Some(low) = high.checked_sub(size) {
+            f.stack = (low, high);
+        }
+    }
+    f
+}
+
+/// The image that holds `addr` (the call before it, for a return address).
+fn resolve(addr: usize, return_address: bool) -> Option<Module<'static>> {
+    let at = if return_address { addr.saturating_sub(1) } else { addr };
+    // SAFETY: `Dl_info` is plain data; all zeros is a valid value.
+    let mut info: libc::Dl_info = unsafe { std::mem::zeroed() };
+    // SAFETY: `dladdr` only reads dyld's image list; the strings it returns live as long as the
+    // image, which a crashing process never unloads.
+    unsafe {
+        if libc::dladdr(at as *const c_void, &mut info) == 0 || info.dli_fname.is_null() {
+            return None;
+        }
+        let symbol = (!info.dli_sname.is_null()).then(|| (CStr::from_ptr(info.dli_sname).to_bytes(), info.dli_saddr as usize));
+        Some(Module { path: CStr::from_ptr(info.dli_fname).to_bytes(), base: info.dli_fbase as usize, symbol })
+    }
+}
+
+/// Write what the signal says into the info file, then again with the modules and frames.
+fn record(f: &Fault) {
+    let Some(path) = PATH.get() else { return };
+    // SAFETY: NUL-terminated path; the descriptor is closed below.
+    let fd = unsafe { libc::open(path.as_ptr(), libc::O_WRONLY | libc::O_CREAT | libc::O_TRUNC | libc::O_CLOEXEC, 0o600) };
+    if fd < 0 {
+        return;
+    }
+    let mut b = Buf::new();
+    json(&mut b, f, &[], |_, _| None);
+    let bytes = b.as_bytes();
+    // SAFETY: the buffer is as long as we say.
+    unsafe { libc::write(fd, bytes.as_ptr().cast(), bytes.len()) };
+    let mut frames = [0usize; MAX_FRAMES];
+    // SAFETY: `walk` only reads inside the thread's own stack, 8-byte aligned.
+    let n = walk(f.pc, f.fp, f.stack, |at| Some(unsafe { (at as *const usize).read() }), &mut frames);
+    b.len = 0;
+    json(&mut b, f, frames.get(..n).unwrap_or_default(), resolve);
+    let bytes = b.as_bytes();
+    // SAFETY: as above.
+    unsafe {
+        if libc::pwrite(fd, bytes.as_ptr().cast(), bytes.len(), 0) == bytes.len() as isize {
+            libc::ftruncate(fd, bytes.len() as libc::off_t);
+        }
+        libc::close(fd);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::process::ExitStatusExt;
+    use std::path::{Path, PathBuf};
+
+    use super::*;
+
+    fn fault(signal: c_int, si_code: c_int, addr: usize) -> Fault {
+        let mut thread_name = [0u8; 64];
+        thread_name[..4].copy_from_slice(b"main");
+        Fault {
+            signal,
+            si_code,
+            addr,
+            pc: 0x1_0000_1234,
+            fp: 0,
+            access: Access::Read,
+            fault: true,
+            sender: 0,
+            pid: 77,
+            thread: 4242,
+            thread_name,
+            stack: (0x7000_0000, 0x7080_0000),
+        }
+    }
+
+    fn report(f: &Fault, frames: &[usize]) -> serde_json::Value {
+        let mut b = Buf::new();
+        json(&mut b, f, frames, |at, _| {
+            (at >= 0x1_0000_0000).then_some(Module {
+                path: b"/Applications/SolidCraft.app/Contents/MacOS/solidcraft",
+                base: 0x1_0000_0000,
+                symbol: Some((b"_ZN4main17h0123456789abcdefE", 0x1_0000_1200)),
+            })
+        });
+        serde_json::from_slice(b.as_bytes()).unwrap()
+    }
+
+    #[test]
+    fn a_segfault_says_the_signal_the_address_read_and_the_module() {
+        let v = report(&fault(SIGSEGV, 1, 0x10), &[0x1_0000_1234, 0x1_0000_2000, 0x5000]);
+        assert_eq!(v["signal"], "SIGSEGV");
+        assert_eq!(v["code"], "SIGSEGV");
+        assert_eq!(v["name"], "segmentation fault");
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_MAPERR)");
+        assert_eq!(v["address"], "0x0000000100001234");
+        assert_eq!(v["module"], "/Applications/SolidCraft.app/Contents/MacOS/solidcraft");
+        assert_eq!(v["offset"], "0x1234");
+        assert_eq!(v["thread"], 4242);
+        assert_eq!(v["thread_name"], "main");
+        assert_eq!(v["pid"], 77);
+        let frames: Vec<&str> = v["frames"].as_array().unwrap().iter().map(|f| f.as_str().unwrap()).collect();
+        assert_eq!(
+            frames,
+            ["solidcraft+0x1234 _ZN4main17h0123456789abcdefE+0x34", "solidcraft+0x2000 _ZN4main17h0123456789abcdefE+0xE00", "0x0000000000005000"]
+        );
+    }
+
+    #[test]
+    fn a_fault_below_the_stack_is_a_stack_overflow() {
+        let mut f = fault(SIGBUS, 2, 0x7000_0000 - 0x100);
+        f.access = Access::Write;
+        let v = report(&f, &[]);
+        assert_eq!(v["name"], "stack overflow");
+        assert_eq!(v["code"], "SIGBUS");
+        assert_eq!(v["detail"], "write to 0x000000006FFFFF00, below the thread's stack (BUS_ADRERR)");
+        // Far below it, or inside it, it is not.
+        assert_eq!(report(&fault(SIGBUS, 2, 0x10), &[])["name"], "bus error");
+        assert_eq!(report(&fault(SIGSEGV, 2, 0x7040_0000), &[])["name"], "segmentation fault");
+        // Nor without knowing the stack.
+        let mut f = fault(SIGSEGV, 1, 0x7000_0000 - 0x100);
+        f.stack = (0, 0);
+        assert_eq!(report(&f, &[])["name"], "segmentation fault");
+    }
+
+    #[test]
+    fn an_abort_or_a_signal_sent_by_another_process_has_no_address_detail() {
+        let mut f = fault(SIGABRT, 0, 0);
+        f.fault = false;
+        f.sender = 77;
+        let v = report(&f, &[]);
+        assert_eq!(v["signal"], "SIGABRT");
+        assert_eq!(v["name"], "abort");
+        assert!(v.get("detail").is_none(), "{v}");
+        let mut f = fault(SIGSEGV, 0x10001, 0);
+        f.fault = false;
+        f.sender = 501;
+        assert_eq!(report(&f, &[])["detail"], "sent by process 501");
+        // `kill` without a sender, or `raise`.
+        f.sender = 0;
+        assert_eq!(report(&f, &[])["detail"], "sent with kill or raise, not a fault");
+        // A trap names the instruction.
+        assert_eq!(report(&fault(SIGTRAP, 1, 0x1_0000_1234), &[])["detail"], "at 0x0000000100001234");
+    }
+
+    #[test]
+    fn only_a_fault_runs_again_when_the_handler_returns() {
+        // Measured on an M5 Pro, macOS 27: a read of address 16, then `kill -SEGV` while the
+        // thread waits in a system call. Both have si_code 2.
+        assert!(arm64_fault(SIGSEGV, 2, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x5600_0080, 0));
+        assert!(!arm64_fault(SIGBUS, 1, 0, 0x5600_0080, 0));
+        // A data abort long past, while the signal names no address.
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x9200_0046, 0x10));
+        // A trap instruction (BRK) or an undefined one; but not a system call.
+        assert!(arm64_fault(SIGTRAP, 1, 0x1000, 0xF200_0001, 0));
+        assert!(arm64_fault(SIGILL, 1, 0x1000, 0x0200_0000, 0));
+        assert!(!arm64_fault(SIGILL, 1, 0x1000, 0x5600_0080, 0));
+        // Sent: SI_USER, no code, or an abort.
+        assert!(!arm64_fault(SIGSEGV, 0x10001, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGTRAP, 0, 0, 0xF200_0001, 0));
+        assert!(!arm64_fault(SIGABRT, 1, 0, 0x5600_0080, 0));
+        // x86_64: a page fault at its address, a general protection fault, ud2, int3.
+        assert!(x86_fault(SIGSEGV, 1, 0x10, 14, 0x10));
+        assert!(!x86_fault(SIGSEGV, 1, 0, 14, 0x10));
+        assert!(x86_fault(SIGSEGV, 1, 0, 13, 0));
+        assert!(x86_fault(SIGILL, 1, 0x1000, 6, 0));
+        assert!(x86_fault(SIGTRAP, 1, 0x1000, 3, 0));
+        assert!(!x86_fault(SIGILL, 1, 0x1000, 14, 0));
+    }
+
+    #[test]
+    fn names_with_quotes_control_characters_or_bad_utf8_stay_valid_json() {
+        let mut f = fault(SIGILL, 1, 0x1_0000_1234);
+        f.thread_name = [0; 64];
+        f.thread_name[..7].copy_from_slice(b"a\"b\\\n\xFFc");
+        let v = report(&f, &[]);
+        assert_eq!(v["thread_name"], "a\"b\\??c");
+    }
+
+    #[test]
+    fn a_report_with_long_names_still_closes_its_json() {
+        let long: &'static [u8] = Box::leak(vec![b'x'; 4000].into_boxed_slice());
+        let f = fault(SIGSEGV, 1, 0x10);
+        let mut b = Buf::new();
+        json(&mut b, &f, &[0x1_0000_1234; MAX_FRAMES], |_, _| Some(Module { path: long, base: 0x1_0000_0000, symbol: Some((long, 0x1_0000_0000)) }));
+        let v: serde_json::Value = serde_json::from_slice(b.as_bytes()).unwrap();
+        assert_eq!(v["module"].as_str().unwrap().len(), 300);
+        let frames = v["frames"].as_array().unwrap();
+        assert!(!frames.is_empty() && frames.len() <= MAX_FRAMES, "{}", frames.len());
+    }
+
+    #[test]
+    fn the_frame_walk_stays_on_the_stack_and_goes_up() {
+        let stack = (0x1000, 0x2000);
+        // Three frames: 0x1100 -> 0x1200 -> 0x1300 -> 0 (end).
+        let memory = |at: usize| match at {
+            0x1100 => Some(0x1200),
+            0x1108 => Some(0xA),
+            0x1200 => Some(0x1300),
+            0x1208 => Some(0xB),
+            0x1300 => Some(0),
+            0x1308 => Some(0xC),
+            _ => None,
+        };
+        let mut out = [0; MAX_FRAMES];
+        let n = walk(0x9, 0x1100, stack, memory, &mut out);
+        assert_eq!(&out[..n], &[0x9, 0xA, 0xB, 0xC]);
+        // A frame pointer off the stack, misaligned, or one that doesn't go up ends the walk.
+        assert_eq!(walk(0x9, 0x3000, stack, memory, &mut out), 1);
+        assert_eq!(walk(0x9, 0x1101, stack, memory, &mut out), 1);
+        let looping = |at: usize| if at.is_multiple_of(16) { Some(at) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1100, stack, looping, &mut out), 2);
+        // A chain that never ends stops at MAX_FRAMES.
+        let endless = |at: usize| if at.is_multiple_of(16) { Some(at + 16) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1000, stack, endless, &mut out), MAX_FRAMES);
+    }
+
+    /// The child half: install crash reporting and the handler, then crash the way
+    /// `SOLIDCRAFT_NATIVE_CRASH_FAULT` says.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = solidcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234", built: "2026-10-25" };
+        let fresh = solidcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        let Some(fault) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_FAULT") else {
+            solidcraft_engine::crash::end_session();
+            return;
+        };
+        super::install();
+        solidcraft_engine::crash::phase("device creation");
+        match fault.to_str() {
+            Some("abort") => std::process::abort(),
+            Some("overflow") => println!("unreachable {}", recurse(0)),
+            Some("raise") => {
+                // SAFETY: none needed; this is the crash under test.
+                unsafe { libc::raise(SIGSEGV) };
+                println!("survived");
+            }
+            _ => segfault(),
+        }
+    }
+
+    /// Runs out of stack.
+    #[inline(never)]
+    fn recurse(n: u64) -> u64 {
+        let a = std::hint::black_box([n; 64]);
+        if n == u64::MAX { 0 } else { recurse(n + 1).wrapping_add(a[0]) }
+    }
+
+    /// The crash under test: a read of address 16, as a null struct pointer's field would be.
+    #[inline(never)]
+    fn segfault() {
+        // SAFETY: none; this is the crash under test.
+        let v = unsafe { std::ptr::read_volatile(std::hint::black_box(16usize) as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &Path, fault: Option<&str>) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash_macos::tests::child", "--test-threads=1", "--nocapture"]).env("SOLIDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if let Some(f) = fault {
+            c.env("SOLIDCRAFT_NATIVE_CRASH_FAULT", f);
+        }
+        c.output().unwrap()
+    }
+
+    /// Crash a child the way `fault` says; returns what the handler wrote and the next start's report.
+    fn crash(name: &str, fault: &str, signal: c_int) -> (serde_json::Value, serde_json::Value, String) {
+        let dir = std::env::temp_dir().join(format!("solidcraft-native-crash-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, Some(fault));
+        assert_eq!(out.status.signal(), Some(signal), "the child died of the signal itself: {out:?}");
+        let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+        let info =
+            std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).find(|p| p.to_string_lossy().ends_with(".native.json"));
+        let info = info.expect("the handler wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        // The next start reports it.
+        let out = run(&dir, None);
+        assert!(out.status.success(), "{out:?}");
+        let reports = solidcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = solidcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+        (v, r, stderr)
+    }
+
+    #[test]
+    fn a_segfault_is_reported_with_its_signal_module_frames_and_step() {
+        let (v, r, _) = crash("segv", "segv", SIGSEGV);
+        assert_eq!(v["signal"], "SIGSEGV", "{v}");
+        // Address 16 is in __PAGEZERO, mapped without access: SEGV_ACCERR.
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_ACCERR)", "{v}");
+        assert!(v["module"].as_str().unwrap().contains("solidcraft"), "the fault is in the test binary: {v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.len() >= 3, "{v}");
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("child")), "the walk reaches the test that crashed: {v}");
+        let message = r["message"].as_str().unwrap();
+        assert!(message.contains("segmentation fault (SIGSEGV) in solidcraft"), "{r}");
+        assert!(message.contains("during startup (device creation"), "{r}");
+        assert_eq!(r["kind"], "unclean_exit");
+        assert_eq!(r["native"]["signal"], "SIGSEGV");
+        assert!(r["backtrace"].as_array().unwrap().iter().any(|f| f.as_str().unwrap().contains("segfault")), "{r}");
+    }
+
+    #[test]
+    fn an_abort_is_reported_as_sigabrt_with_the_code_that_called_it() {
+        let (v, r, _) = crash("abrt", "abort", SIGABRT);
+        assert_eq!(v["signal"], "SIGABRT", "{v}");
+        assert!(v.get("detail").is_none(), "{v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("abort")), "{v}");
+        assert!(r["message"].as_str().unwrap().contains("abort (SIGABRT)"), "{r}");
+    }
+
+    #[test]
+    fn a_stack_overflow_is_recorded_and_the_standard_library_still_says_so() {
+        // The fault on the guard page is recorded on the alternate stack; the standard library's
+        // handler, called after ours, prints its message and aborts.
+        let (v, r, stderr) = crash("overflow", "overflow", SIGABRT);
+        assert!(matches!(v["signal"].as_str(), Some("SIGSEGV" | "SIGBUS")), "{v}");
+        assert_eq!(v["name"], "stack overflow", "{v}");
+        assert!(v["detail"].as_str().unwrap().contains("below the thread's stack"), "{v}");
+        assert!(stderr.contains("has overflowed its stack"), "{stderr}");
+        assert!(r["message"].as_str().unwrap().contains("stack overflow ("), "{r}");
+    }
+
+    #[test]
+    fn a_segfault_signal_that_was_only_sent_still_ends_the_app() {
+        // The standard library's handler, which comes before ours, returns expecting the fault
+        // to happen again; a sent signal never does, so it goes to the default action instead.
+        let (v, r, _) = crash("raise", "raise", SIGSEGV);
+        assert_eq!(v["detail"], "sent with kill or raise, not a fault", "{v}");
+        assert!(r["message"].as_str().unwrap().contains("(SIGSEGV)"), "{r}");
+    }
+}

apps/solidcraft/src/native_frame.rs

@@ -15,10 +15,14 @@
 //! window rescales once at the crossing and stays under the pointer, instead of the OS's move
 //! loop and winit disagreeing about a frame the window doesn't have.
 //!
-//! Replacing a window procedure has no safe API, hence the `unsafe_code` allowance on this
-//! module (the app crate denies it; see `native_crash.rs` and `open_documents.rs` for the others).
+//! Replacing a window procedure and setting a window class's icon have no safe API, hence the
+//! `unsafe_code` allowance on this module (the app crate denies it; see `native_crash.rs` and
+//! `open_documents.rs` for the others).
 //! The procedure is installed once, on the thread that owns the window, for the main window only,
 //! and calls the previous one (winit's) for everything it doesn't answer.
+//!
+//! [`set_class_icon`] gives the window's class the exe's icon, so the taskbar button shows the
+//! mark even when the window is too busy to answer the taskbar's request for its icon.
 #![allow(unsafe_code)]
 
 use std::sync::atomic::{AtomicIsize, Ordering};
@@ -26,12 +30,81 @@ use std::sync::atomic::{AtomicIsize, Ordering};
 use raw_window_handle::{HasWindowHandle, RawWindowHandle};
 use solidcraft_ui_egui::titlebar;
 use windows_sys::Win32::Foundation::{HWND, LPARAM, LRESULT, RECT, SIZE, WPARAM};
+use windows_sys::Win32::Graphics::Gdi::{GetMonitorInfoW, MONITOR_DEFAULTTONEAREST, MONITORINFO, MonitorFromWindow};
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleW;
 use windows_sys::Win32::UI::HiDpi::{GetDpiForWindow, GetSystemMetricsForDpi};
 use windows_sys::Win32::UI::WindowsAndMessaging::{
-    CallWindowProcW, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTLEFT,
-    HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IsIconic, IsZoomed, SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SetWindowLongPtrW, WM_GETDPISCALEDSIZE,
-    WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
+    CallWindowProcW, GCLP_HICON, GCLP_HICONSM, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT,
+    HTBOTTOMRIGHT, HTLEFT, HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IMAGE_ICON, IsIconic, IsZoomed, LR_DEFAULTCOLOR, LoadImageW, SM_CXICON,
+    SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SM_CXSMICON, SetWindowLongPtrW, WM_GETDPISCALEDSIZE, WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
 };
+// windows-sys has SetClassLongPtrW only on 64-bit targets; on 32-bit Windows it is SetClassLongW.
+#[cfg(target_pointer_width = "64")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongPtrW;
+#[cfg(target_pointer_width = "32")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongW as SetClassLongPtrW;
+
+/// The work area (the monitor without the taskbar) of the monitor nearest the window, in physical
+/// pixels: left, top, width, height.
+pub fn work_area(window: &impl HasWindowHandle) -> Option<(i32, i32, i32, i32)> {
+    let handle = window.window_handle().ok()?;
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return None };
+    let hwnd = w.hwnd.get() as HWND;
+    // SAFETY: `hwnd` is the live main window; `info` is a MONITORINFO with its size set, as
+    // GetMonitorInfoW requires, and the monitor handle comes from the call before it.
+    let rc = unsafe {
+        let monitor = MonitorFromWindow(hwnd, MONITOR_DEFAULTTONEAREST);
+        let mut info: MONITORINFO = std::mem::zeroed();
+        info.cbSize = std::mem::size_of::<MONITORINFO>() as u32;
+        if monitor.is_null() || GetMonitorInfoW(monitor, &mut info) == 0 {
+            return None;
+        }
+        info.rcWork
+    };
+    Some((rc.left, rc.top, rc.right - rc.left, rc.bottom - rc.top))
+}
+
+/// The exe's icon resource (`build.rs` embeds it as `1 ICON`).
+const ICON_RESOURCE: usize = 1;
+
+/// Give the main window's class the exe's icon, big and small. Call it before the window is
+/// shown (eframe's app creator).
+///
+/// The taskbar asks a window for its icon when the window appears. eframe sets the window's
+/// icon before that, while the window is still hidden, and then shows the window at the end of
+/// its first frame; if that frame is slow, or startup kept the thread busy long enough for
+/// Windows to mark the window as not responding, the request isn't answered in time. The taskbar then
+/// takes the window class's icon and doesn't ask again. winit registers its class without one,
+/// so the button showed Windows' generic icon for as long as the window was open.
+/// `false` if it isn't a Win32 window or the exe's icon doesn't load; SetClassLongPtrW's own
+/// failure can't be told from a class that had no icon (both return 0), so it isn't reported.
+pub fn set_class_icon(window: &impl HasWindowHandle) -> bool {
+    let Ok(handle) = window.window_handle() else { return false };
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return false };
+    let hwnd = w.hwnd.get() as HWND;
+    // SAFETY: a plain query on the live main window.
+    let dpi = unsafe { GetDpiForWindow(hwnd) };
+    let (Some(big), Some(small)) = (exe_icon(SM_CXICON, dpi), exe_icon(SM_CXSMICON, dpi)) else { return false };
+    // SAFETY: `hwnd` is the live main window and both icons are valid handles. The class keeps
+    // them for the rest of the process, so they are never destroyed. `as _`: on 32-bit Windows
+    // this is SetClassLongW (see the imports), which takes an i32.
+    unsafe {
+        SetClassLongPtrW(hwnd, GCLP_HICON, big as _);
+        SetClassLongPtrW(hwnd, GCLP_HICONSM, small as _);
+    }
+    true
+}
+
+/// The exe's icon at the size of system metric `metric` (`SM_CXICON`, `SM_CXSMICON`) at `dpi`.
+fn exe_icon(metric: i32, dpi: u32) -> Option<windows_sys::Win32::Foundation::HANDLE> {
+    // SAFETY: GetModuleHandleW(null) is this exe, loaded for the life of the process; the name
+    // is an integer resource id (MAKEINTRESOURCE), which LoadImageW accepts in place of a string.
+    let icon = unsafe {
+        let size = GetSystemMetricsForDpi(metric, dpi);
+        LoadImageW(GetModuleHandleW(std::ptr::null()), std::ptr::without_provenance(ICON_RESOURCE), IMAGE_ICON, size, size, LR_DEFAULTCOLOR)
+    };
+    (!icon.is_null()).then_some(icon)
+}
 
 /// The window procedure ours replaced (winit's), as an address; 0 before [`install`].
 static PREVIOUS: AtomicIsize = AtomicIsize::new(0);

apps/solidcraft/src/native_menu.rs

@@ -0,0 +1,195 @@
+//! macOS system menus, owned and updated on eframe's main thread.
+
+use std::sync::mpsc::{Receiver, sync_channel};
+
+use muda::{
+    AboutMetadata, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu,
+    accelerator::{Accelerator, Code, Modifiers},
+};
+use solidcraft_ui_egui::{SolveApp, toolbar::FileAction};
+
+pub struct NativeMenu {
+    menu: Menu,
+    actions: Vec<(MenuItem, FileAction)>,
+    help_actions: Vec<(MenuItem, &'static str)>,
+    events: Receiver<MenuEvent>,
+    recent: Submenu,
+    recent_paths: Vec<String>,
+}
+
+impl NativeMenu {
+    pub fn new(app: &SolveApp, ctx: &egui::Context) -> muda::Result<Self> {
+        let menu = Menu::new();
+        let application = Submenu::new("SolidCraft", true);
+        let file = Submenu::new(app.tr("ui.file"), true);
+        let edit = Submenu::new(app.tr_label("Edit"), true);
+        let recent = Submenu::new(app.tr("ui.open_recent"), true);
+        let window = Submenu::new("Window", true);
+        let help = Submenu::new(app.tr("ui.help"), true);
+        let mut help_actions = Vec::new();
+        let mut actions = Vec::new();
+        let mut add = |parent: &Submenu, label: &str, action: FileAction, shortcut: Option<Accelerator>| -> muda::Result<()> {
+            let item = MenuItem::new(label, Self::action_enabled(&action, app, ctx), shortcut);
+            parent.append(&item)?;
+            actions.push((item, action));
+            Ok(())
+        };
+        application.append(&PredefinedMenuItem::about(
+            Some("About SolidCraft"),
+            Some(AboutMetadata { name: Some("SolidCraft".into()), version: Some(env!("CARGO_PKG_VERSION").into()), ..Default::default() }),
+        ))?;
+        application.append(&PredefinedMenuItem::separator())?;
+        add(
+            &application,
+            &format!("{}\u{2026}", app.tr("ui.preferences")),
+            FileAction::Settings,
+            Some(Accelerator::new(Modifiers::META, Code::Comma)),
+        )?;
+        add(&application, &format!("{}\u{2026}", app.tr("ui.keyboard_shortcuts")), FileAction::Shortcuts, None)?;
+        application.append(&PredefinedMenuItem::separator())?;
+        application.append(&PredefinedMenuItem::services(None))?;
+        application.append(&PredefinedMenuItem::separator())?;
+        application.append_items(&[
+            &PredefinedMenuItem::hide(Some("Hide SolidCraft")),
+            &PredefinedMenuItem::hide_others(None),
+            &PredefinedMenuItem::show_all(None),
+            &PredefinedMenuItem::separator(),
+        ])?;
+        add(&application, &format!("{} SolidCraft", app.tr("ui.quit")), FileAction::Quit, Some(Accelerator::new(Modifiers::META, Code::KeyQ)))?;
+        add(&file, app.tr("ui.new_design"), FileAction::New, Some(Accelerator::new(Modifiers::META, Code::KeyN)))?;
+        add(&file, &format!("{}\u{2026}", app.tr("ui.open")), FileAction::Open, Some(Accelerator::new(Modifiers::META, Code::KeyO)))?;
+        file.append(&recent)?;
+        file.append(&PredefinedMenuItem::separator())?;
+        for (label, command) in
+            [("Insert STEP\u{2026}", "file.insert_step"), ("Insert Mesh\u{2026}", "file.insert_mesh"), ("Insert Design", "component.insert_design")]
+        {
+            add(&file, app.tr_label(label), FileAction::Command(command), None)?;
+        }
+        file.append(&PredefinedMenuItem::separator())?;
+        add(&file, app.tr("ui.save"), FileAction::Save, Some(Accelerator::new(Modifiers::META, Code::KeyS)))?;
+        add(
+            &file,
+            &format!("{}\u{2026}", app.tr("ui.save_as")),
+            FileAction::SaveAs,
+            Some(Accelerator::new(Modifiers::META | Modifiers::SHIFT, Code::KeyS)),
+        )?;
+        add(&file, app.tr_label("Save As JSON\u{2026}"), FileAction::SaveJson, None)?;
+        file.append(&PredefinedMenuItem::separator())?;
+        for (label, action) in [
+            ("Export STL\u{2026}", FileAction::ExportMesh("stl")),
+            ("Export 3MF\u{2026}", FileAction::ExportMesh("3mf")),
+            ("Export STEP\u{2026}", FileAction::Export("step")),
+            ("Export Current View as DXF\u{2026}", FileAction::Command("file.export_view_dxf")),
+            ("Export OBJ\u{2026}", FileAction::Export("obj")),
+            ("Export URDF\u{2026}", FileAction::Export("urdf")),
+            ("Export Design as JSON\u{2026}", FileAction::Export("json")),
+        ] {
+            add(&file, app.tr_label(label), action, None)?;
+        }
+        file.append(&PredefinedMenuItem::separator())?;
+        add(&file, app.tr_label("Design Properties"), FileAction::Command("document.metadata"), None)?;
+        add(&edit, app.tr("ui.undo"), FileAction::Undo, Some(Accelerator::new(Modifiers::META, Code::KeyZ)))?;
+        add(&edit, app.tr("ui.redo"), FileAction::Redo, Some(Accelerator::new(Modifiers::META | Modifiers::SHIFT, Code::KeyZ)))?;
+        add(&window, app.tr_label("Agent Chat"), FileAction::AgentChat, None)?;
+        window.append(&PredefinedMenuItem::separator())?;
+        window.append_items(&[
+            &PredefinedMenuItem::minimize(None),
+            &PredefinedMenuItem::maximize(None),
+            &PredefinedMenuItem::fullscreen(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::bring_all_to_front(None),
+        ])?;
+        for (action, label) in [
+            ("docs", "Documentation"),
+            ("shortcuts", "Keyboard Shortcuts"),
+            ("messages", "Messages\u{2026}"),
+            ("report", "Report an Issue\u{2026}"),
+            ("crashes", "Crash Reports\u{2026}"),
+            ("install_cli", "Install solidcraft-cli command"),
+        ] {
+            let item = MenuItem::new(app.tr_label(label), true, None);
+            help.append(&item)?;
+            help_actions.push((item, action));
+        }
+        menu.append_items(&[&application, &file, &edit, &window, &help])?;
+        let (sender, events) = sync_channel(64);
+        let ctx = ctx.clone();
+        MenuEvent::set_event_handler(Some(move |event| {
+            let _ = sender.try_send(event);
+            ctx.request_repaint();
+        }));
+        menu.init_for_nsapp();
+        let mut native = Self { menu, actions, help_actions, events, recent, recent_paths: Vec::new() };
+        native.update_recent(app)?;
+        Ok(native)
+    }
+
+    pub fn raw_input_hook(&mut self, app: &mut SolveApp, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        for event in self.events.try_iter().take(64) {
+            if let Some((_, action)) = self.help_actions.iter().find(|(item, _)| item.id() == &event.id) {
+                solidcraft_ui_egui::help::run(app, ctx, action);
+            }
+            if let Some((_, action)) = self.actions.iter().find(|(item, _)| item.id() == &event.id) {
+                if matches!(action, FileAction::Undo | FileAction::Redo) && ctx.egui_wants_keyboard_input() {
+                    raw.events.push(egui::Event::Key {
+                        key: egui::Key::Z,
+                        physical_key: None,
+                        pressed: true,
+                        repeat: false,
+                        modifiers: egui::Modifiers { command: true, mac_cmd: true, shift: matches!(action, FileAction::Redo), ..Default::default() },
+                    });
+                } else {
+                    action.run(app);
+                }
+            }
+        }
+    }
+
+    fn action_enabled(action: &FileAction, app: &SolveApp, ctx: &egui::Context) -> bool {
+        action.menu_enabled(app, ctx.egui_wants_keyboard_input())
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        for (item, action) in &self.actions {
+            let enabled = Self::action_enabled(action, app, ctx);
+            if item.is_enabled() != enabled {
+                item.set_enabled(enabled);
+            }
+        }
+        for (item, action) in &self.help_actions {
+            let enabled = solidcraft_ui_egui::help::available(app, action);
+            if item.is_enabled() != enabled {
+                item.set_enabled(enabled);
+            }
+        }
+        if !self.recent_paths.iter().eq(app.home.recent.iter().take(32))
+            && let Err(error) = self.update_recent(app)
+        {
+            app.set_status(format!("Recent designs menu: {error}"), true);
+        }
+    }
+
+    fn update_recent(&mut self, app: &SolveApp) -> muda::Result<()> {
+        while self.recent.remove_at(0).is_some() {}
+        self.actions.retain(|(_, action)| !matches!(action, FileAction::OpenRecent(_) | FileAction::ClearRecent));
+        self.recent_paths = app.home.recent.iter().take(32).cloned().collect();
+        for path in &self.recent_paths {
+            let action = FileAction::OpenRecent(path.clone());
+            let item = MenuItem::new(path, action.enabled(app), None);
+            self.recent.append(&item)?;
+            self.actions.push((item, action));
+        }
+        self.recent.append(&PredefinedMenuItem::separator())?;
+        let clear = MenuItem::new(app.tr("ui.clear_recent"), !self.recent_paths.is_empty(), None);
+        self.recent.append(&clear)?;
+        self.actions.push((clear, FileAction::ClearRecent));
+        Ok(())
+    }
+}
+
+impl Drop for NativeMenu {
+    fn drop(&mut self) {
+        MenuEvent::set_event_handler(None::<fn(MenuEvent)>);
+        self.menu.remove_for_nsapp();
+    }
+}

apps/solidcraft/src/nav_bridge.rs

@@ -0,0 +1,463 @@
+//! The navigation bridge: a 3D input device's own program (a homemade device's driver app) moves
+//! the view over a loopback connection, the way a 3D mouse driver hands its axes to the programs
+//! it supports, so the device emulates no mouse and the pointer stays the user's.
+//!
+//! The device app listens on `127.0.0.1:<port>`; with Preferences › Navigation › "Navigate with a
+//! device app" on (off by default), SolidCraft connects to it, says hello and reads one JSON
+//! object per line (docs/3d-mouse.md). The reader thread only sums the motion; the egui thread
+//! hands it to the view once per frame (`space_mouse::bridge_frame`). A device the app says it
+//! reads is left to it by the 3D mouse reader ([`Claim`]), so the view doesn't move twice.
+
+use std::io::{ErrorKind, Read, Write};
+use std::net::{Ipv4Addr, SocketAddr, TcpStream};
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::Duration;
+
+use egui::Context;
+use serde_json::{Value, json};
+use solidcraft_ui_egui::SolveApp;
+use solidcraft_ui_egui::space_mouse::{BRIDGE_VIEWS, BridgeMotion, bridge_frame, bridge_step};
+
+/// The longest line read; a longer one is skipped to its end.
+const MAX_LINE: usize = 4096;
+/// Standard views waiting for the next frame; past this many, more are a flood and dropped.
+const MAX_VIEWS: usize = 8;
+/// The longest name a device app may give for itself or its device, in characters.
+const MAX_NAME: usize = 64;
+/// How long a connection attempt waits.
+const CONNECT_TIMEOUT: Duration = Duration::from_millis(500);
+/// How long a read waits for data before the reader looks at the preferences again.
+const READ_WAKE: Duration = Duration::from_millis(250);
+/// The wait before connecting again when no device app answered or one went away.
+const RETRY_AFTER: Duration = Duration::from_secs(1);
+/// In zoom mode, a motion of this many points along Y is one zoom step: with 8 % a step, the 1 %
+/// a point that a zoom drag moves.
+const POINTS_PER_ZOOM_STEP: f64 = 8.0;
+
+/// What the device's motion drives, as the device app last said (`mode`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum Mode {
+    #[default]
+    Orbit,
+    Pan,
+    Zoom,
+}
+
+/// What the reader thread and the egui thread share.
+#[derive(Debug, Default)]
+struct Shared {
+    /// The port the preferences ask to connect to; none while the bridge is off.
+    wanted: Option<u16>,
+    /// The device app connected, by the name it gave ("?" until it gives one).
+    connected: Option<String>,
+    /// The device the connected app reads, as it named it: the 3D mouse reader leaves that one alone.
+    device: Option<String>,
+    /// Motion since the egui thread last took it.
+    motion: BridgeMotion,
+    /// Standard views asked for since then.
+    views: Vec<String>,
+}
+
+fn lock(shared: &Mutex<Shared>) -> Option<MutexGuard<'_, Shared>> {
+    shared.lock().ok()
+}
+
+/// A name a device app gave, without control characters and cut to [`MAX_NAME`]; none when empty.
+fn name(value: Option<&Value>) -> Option<String> {
+    let name: String = value?.as_str()?.chars().filter(|c| !c.is_control()).take(MAX_NAME).collect();
+    let name = name.trim();
+    (!name.is_empty()).then(|| name.to_string())
+}
+
+/// A number of a message, finite and in range; none when it isn't one.
+fn number(msg: &Value, key: &str) -> f64 {
+    bridge_step(msg.get(key).and_then(Value::as_f64).unwrap_or(0.0))
+}
+
+/// Takes one line from the device app into `shared`. Lines that aren't a message this version
+/// knows are ignored. Returns whether the view has something new to show.
+fn consume(line: &[u8], mode: &mut Mode, shared: &mut Shared) -> bool {
+    let Ok(msg) = serde_json::from_slice::<Value>(line) else { return false };
+    let add = |shared: &mut Shared, motion: BridgeMotion| {
+        shared.motion = shared.motion.plus(motion);
+        !motion.is_still()
+    };
+    match msg.get("t").and_then(Value::as_str) {
+        Some("axis") => {
+            let (x, y) = (number(&msg, "x"), number(&msg, "y"));
+            let motion = match mode {
+                Mode::Orbit => BridgeMotion { orbit: [x, y], ..Default::default() },
+                Mode::Pan => BridgeMotion { pan: [x, y], ..Default::default() },
+                // Up zooms in, as a zoom drag does.
+                Mode::Zoom => BridgeMotion { zoom: -y / POINTS_PER_ZOOM_STEP, ..Default::default() },
+            };
+            add(shared, motion)
+        }
+        Some("zoom") => add(shared, BridgeMotion { zoom: number(&msg, "d"), ..Default::default() }),
+        Some("mode") => {
+            let on = msg.get("on").and_then(Value::as_bool).unwrap_or(false);
+            *mode = match msg.get("mode").and_then(Value::as_str) {
+                Some("pan") if on => Mode::Pan,
+                Some("zoom") if on => Mode::Zoom,
+                _ => Mode::Orbit,
+            };
+            false
+        }
+        Some("view") => {
+            let view = msg.get("name").and_then(Value::as_str).and_then(|n| BRIDGE_VIEWS.iter().find(|v| **v == n));
+            match view {
+                Some(view) if shared.views.len() < MAX_VIEWS => {
+                    shared.views.push((*view).to_string());
+                    true
+                }
+                _ => false,
+            }
+        }
+        Some("hello") => {
+            shared.connected = name(msg.get("server")).or_else(|| shared.connected.clone());
+            shared.device = name(msg.get("device"));
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Splits what arrives into lines, across reads. A line longer than [`MAX_LINE`] is dropped up to
+/// its newline, so a peer that never sends one can't make the reader hold more than that.
+#[derive(Default)]
+struct Lines {
+    line: Vec<u8>,
+    skipping: bool,
+}
+
+impl Lines {
+    fn feed(&mut self, mut data: &[u8], mut each: impl FnMut(&[u8])) {
+        while !data.is_empty() {
+            let end = data.iter().position(|b| *b == b'\n');
+            let (part, rest) = match end {
+                Some(i) => (data.get(..i).unwrap_or_default(), data.get(i + 1..).unwrap_or_default()),
+                None => (data, &[][..]),
+            };
+            if !self.skipping {
+                let room = (MAX_LINE + 1).saturating_sub(self.line.len());
+                self.line.extend_from_slice(part.get(..room.min(part.len())).unwrap_or_default());
+                if self.line.len() > MAX_LINE {
+                    self.line.clear();
+                    self.skipping = true;
+                }
+            }
+            if end.is_some() {
+                if !self.skipping {
+                    each(self.line.strip_suffix(b"\r").unwrap_or(&self.line));
+                }
+                self.line.clear();
+                self.skipping = false;
+            }
+            data = rest;
+        }
+    }
+}
+
+/// What SolidCraft says first, so the device app knows which program it is driving.
+fn hello() -> Value {
+    json!({"t": "hello", "app": "solidcraft", "version": env!("CARGO_PKG_VERSION")})
+}
+
+/// Reads one connection until the device app closes it, it fails, or the preferences no longer
+/// ask for this port; then forgets what it had.
+fn serve(mut stream: TcpStream, port: u16, ctx: &Context, shared: &Mutex<Shared>) {
+    // Without a read timeout the reader couldn't notice the bridge being switched off.
+    if stream.set_read_timeout(Some(READ_WAKE)).is_err() || writeln!(stream, "{}", hello()).is_err() {
+        return;
+    }
+    let _ = stream.set_nodelay(true);
+    log::info!("navigation bridge: connected to 127.0.0.1:{port}");
+    if let Some(mut shared) = lock(shared) {
+        shared.connected = Some("?".into());
+    }
+    ctx.request_repaint();
+    let (mut lines, mut mode) = (Lines::default(), Mode::default());
+    let mut chunk = [0_u8; 4096];
+    while lock(shared).is_some_and(|shared| shared.wanted == Some(port)) {
+        match stream.read(&mut chunk) {
+            Ok(0) => break,
+            Ok(size) => {
+                let mut news = false;
+                if let Some(mut shared) = lock(shared) {
+                    lines.feed(chunk.get(..size).unwrap_or_default(), |line| news |= consume(line, &mut mode, &mut shared));
+                }
+                if news {
+                    ctx.request_repaint();
+                }
+            }
+            Err(error) if matches!(error.kind(), ErrorKind::WouldBlock | ErrorKind::TimedOut | ErrorKind::Interrupted) => {}
+            Err(error) => {
+                log::info!("navigation bridge: connection lost: {error}");
+                break;
+            }
+        }
+    }
+    if let Some(mut shared) = lock(shared) {
+        *shared = Shared { wanted: shared.wanted, ..Shared::default() };
+    }
+    ctx.request_repaint();
+}
+
+/// Connects to the device app while the preferences ask for it, again whenever it goes away.
+fn reader(ctx: Context, shared: Arc<Mutex<Shared>>) {
+    loop {
+        let Some(port) = lock(&shared).and_then(|shared| shared.wanted) else {
+            std::thread::sleep(READ_WAKE);
+            continue;
+        };
+        if let Ok(stream) = TcpStream::connect_timeout(&SocketAddr::from((Ipv4Addr::LOCALHOST, port)), CONNECT_TIMEOUT) {
+            serve(stream, port, &ctx, &shared);
+        }
+        std::thread::sleep(RETRY_AFTER);
+    }
+}
+
+/// Which 3D mouse the connected device app reads, for the 3D mouse reader to leave alone. Only
+/// the Windows and macOS readers know a device's strings to compare.
+#[derive(Clone)]
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+pub struct Claim(Arc<Mutex<Shared>>);
+
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+impl Claim {
+    /// Whether a device with these manufacturer and product strings is the one the connected
+    /// device app reads (its name appears in one, ignoring case).
+    pub fn claims(&self, strings: &[String]) -> bool {
+        let Some(device) = lock(&self.0).and_then(|shared| shared.device.clone()) else { return false };
+        let device = device.to_lowercase();
+        strings.iter().any(|s| s.to_lowercase().contains(&device))
+    }
+}
+
+pub struct NavBridge {
+    shared: Arc<Mutex<Shared>>,
+}
+
+impl NavBridge {
+    pub fn start(ctx: &Context) -> Self {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let (worker_ctx, worker_state) = (ctx.clone(), Arc::clone(&shared));
+        if let Err(error) = std::thread::Builder::new().name("solidcraft-nav-bridge".into()).spawn(move || reader(worker_ctx, worker_state)) {
+            log::warn!("navigation bridge: reader could not start: {error}");
+        }
+        Self { shared }
+    }
+
+    #[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+    pub fn claim(&self) -> Claim {
+        Claim(Arc::clone(&self.shared))
+    }
+
+    /// Each frame: passes the preferences to the reader, and the motion and views since the last
+    /// frame to the view. Motion that arrived while the window had no focus is dropped with it.
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
+        let wanted = Some(app.preferences.nav_bridge_port).filter(|port| app.preferences.nav_bridge_enabled && *port != 0);
+        let Some((motion, views, connected)) = lock(&self.shared).map(|mut shared| {
+            shared.wanted = wanted;
+            (std::mem::take(&mut shared.motion), std::mem::take(&mut shared.views), shared.connected.clone())
+        }) else {
+            return;
+        };
+        app.space_mouse.bridge = connected.filter(|_| wanted.is_some());
+        if !motion.is_still() || !views.is_empty() {
+            bridge_frame(app, ctx, motion, &views);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{BufRead, BufReader};
+    use std::net::TcpListener;
+    use std::time::Instant;
+
+    fn feed(shared: &mut Shared, mode: &mut Mode, text: &str) -> bool {
+        let mut news = false;
+        Lines::default().feed(text.as_bytes(), |line| news |= consume(line, mode, shared));
+        news
+    }
+
+    #[test]
+    fn axis_motion_orbits_pans_or_zooms_as_the_mode_says() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"axis\",\"x\":3,\"y\":-2}\n{\"t\":\"axis\",\"x\":1.5,\"y\":0}\n"));
+        assert_eq!(shared.motion, BridgeMotion { orbit: [4.5, -2.0], ..Default::default() });
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":true}\n{\"t\":\"axis\",\"x\":5,\"y\":6}\n");
+        assert_eq!(mode, Mode::Pan);
+        assert_eq!(shared.motion.pan, [5.0, 6.0]);
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"zoom\",\"on\":true}\n{\"t\":\"axis\",\"x\":0,\"y\":-16}\n");
+        assert_eq!(shared.motion.zoom, 2.0, "up zooms in, 8 points a step");
+        // Off, whichever mode it names, is back to orbit.
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":false}\n");
+        assert_eq!(mode, Mode::Orbit);
+        // The ring's steps add up with the zoom mode's.
+        feed(&mut shared, &mut mode, "{\"t\":\"zoom\",\"d\":-0.5}\n");
+        assert_eq!(shared.motion.zoom, 1.5);
+    }
+
+    #[test]
+    fn views_are_queued_by_their_known_names_only() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"iso\"}\n{\"t\":\"view\",\"name\":\"fit\"}\n"));
+        assert!(!feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"ISO\"}\n{\"t\":\"view\",\"name\":\"../etc\"}\n{\"t\":\"view\"}\n"));
+        assert_eq!(shared.views, ["iso", "fit"]);
+        let flood = "{\"t\":\"view\",\"name\":\"top\"}\n".repeat(100);
+        feed(&mut shared, &mut mode, &flood);
+        assert_eq!(shared.views.len(), MAX_VIEWS);
+    }
+
+    #[test]
+    fn hostile_lines_never_move_the_view_out_of_range() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        let lines = [
+            "not json",
+            "{\"t\":\"axis\",\"x\":\"5\",\"y\":null}",
+            "{\"t\":\"axis\",\"x\":1e308,\"y\":-1e308}",
+            "{\"t\":\"axis\",\"x\":1e999}",
+            "{\"t\":\"zoom\",\"d\":[1]}",
+            "{\"t\":42}",
+            "[1,2,3]",
+            "{\"t\":\"mode\",\"mode\":{\"x\":1},\"on\":\"yes\"}",
+            "\u{0}\u{1}\u{2}",
+        ];
+        for line in lines {
+            Lines::default().feed(format!("{line}\n").as_bytes(), |l| {
+                consume(l, &mut mode, &mut shared);
+            });
+        }
+        let limit = solidcraft_ui_egui::space_mouse::BRIDGE_MAX_STEP;
+        let values = shared.motion.orbit.into_iter().chain(shared.motion.pan).chain([shared.motion.zoom]);
+        for value in values {
+            assert!(value.is_finite() && value.abs() <= limit, "{value}");
+        }
+        assert_eq!(mode, Mode::Orbit);
+        // Invalid UTF-8 is no message either.
+        assert!(!consume(&[0xff, 0xfe, b'{', b'}'], &mut mode, &mut shared));
+    }
+
+    #[test]
+    fn lines_split_across_reads_and_long_ones_are_skipped_to_their_end() {
+        let mut got = Vec::new();
+        let mut lines = Lines::default();
+        for part in ["{\"t\":", "\"zoom\"}\r\n{\"a\"", ":1}\n"] {
+            lines.feed(part.as_bytes(), |line| got.push(String::from_utf8_lossy(line).to_string()));
+        }
+        assert_eq!(got, ["{\"t\":\"zoom\"}", "{\"a\":1}"]);
+        got.clear();
+        let long = vec![b'x'; MAX_LINE * 3];
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert!(lines.line.len() <= MAX_LINE + 1, "never holds more than one line");
+        lines.feed(b"tail\nnext\n", |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert_eq!(got, ["next"], "the long line is dropped to its newline, the next one read");
+    }
+
+    #[test]
+    fn the_device_app_names_itself_and_the_device_it_leaves_alone() {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let claim = Claim(Arc::clone(&shared));
+        let strings = ["STMicroelectronics".to_string(), "MAKMOUSE 3D".to_string()];
+        assert!(!claim.claims(&strings), "nothing is claimed before an app says so");
+        let mut mode = Mode::default();
+        if let Ok(mut shared) = shared.lock() {
+            let hello = format!("{{\"t\":\"hello\",\"server\":\"Dev\\u0007App {}\",\"device\":\"makmouse\"}}\n", "x".repeat(200));
+            feed(&mut shared, &mut mode, &hello);
+            assert_eq!(shared.connected.as_deref().map(|n| n.chars().count()), Some(MAX_NAME));
+            assert!(shared.connected.as_deref().is_some_and(|n| n.starts_with("DevApp")));
+        }
+        assert!(claim.claims(&strings), "the name matches ignoring case");
+        assert!(!claim.claims(&["3Dconnexion".to_string(), "SpaceMouse Compact".to_string()]), "another 3D mouse stays the reader's");
+    }
+
+    /// Waits until `check` holds, or fails after a few seconds.
+    fn wait_for(what: &str, mut check: impl FnMut() -> bool) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !check() {
+            assert!(Instant::now() < deadline, "timed out waiting for {what}");
+            std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+
+    #[test]
+    fn a_connection_says_hello_reads_the_stream_and_ends_when_the_bridge_is_switched_off() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (mut server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        let mut hello_line = String::new();
+        BufReader::new(server.try_clone().unwrap()).read_line(&mut hello_line).unwrap();
+        let hello: Value = serde_json::from_str(&hello_line).unwrap();
+        assert_eq!((hello["t"].as_str(), hello["app"].as_str()), (Some("hello"), Some("solidcraft")));
+        server
+            .write_all(b"{\"t\":\"hello\",\"server\":\"MAKMOUSE\",\"device\":\"MAKMOUSE\"}\n{\"t\":\"axis\",\"x\":2,\"y\":1}\n{\"t\":\"view\",\"name\":\"top\"}\n")
+            .unwrap();
+        wait_for("the stream", || shared.lock().is_ok_and(|s| s.motion.orbit == [2.0, 1.0] && s.views == ["top"]));
+        assert_eq!(shared.lock().unwrap().connected.as_deref(), Some("MAKMOUSE"));
+        // Switched off: the connection ends and what it had is forgotten.
+        shared.lock().unwrap().wanted = None;
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert!(after.connected.is_none() && after.device.is_none() && after.motion.is_still() && after.views.is_empty());
+    }
+
+    #[test]
+    fn a_closed_connection_forgets_the_app() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        wait_for("the connection", || shared.lock().is_ok_and(|s| s.connected.is_some()));
+        drop(server);
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert_eq!((after.connected.as_deref(), after.wanted), (None, Some(port)), "still wanted, so the reader connects again");
+    }
+
+    #[test]
+    fn each_frame_hands_the_view_the_motion_and_passes_the_preferences_on() {
+        let mut app = SolveApp::new(solidcraft_engine::Session::default(), solidcraft_ui_egui::Services::default());
+        app.home.open = false;
+        let ctx = Context::default();
+        let _ = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |_| {});
+        let mut bridge = NavBridge { shared: Arc::new(Mutex::new(Shared::default())) };
+        let queue = |bridge: &NavBridge| {
+            let mut shared = bridge.shared.lock().unwrap();
+            shared.connected = Some("MAKMOUSE".into());
+            shared.motion = BridgeMotion { orbit: [10.0, 0.0], ..Default::default() };
+        };
+        // Off (the default): nothing is wanted, nothing reaches the view.
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+        assert!(app.viewport.bridge_motion.is_none() && app.space_mouse.bridge.is_none());
+        // On: the port is passed to the reader and the motion to the view, once.
+        app.preferences.nav_bridge_enabled = true;
+        app.preferences.nav_bridge_port = 9123;
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, Some(9123));
+        assert_eq!(app.space_mouse.bridge.as_deref(), Some("MAKMOUSE"));
+        assert_eq!(app.viewport.bridge_motion.map(|m| m.orbit), Some([10.0, 0.0]));
+        assert!(bridge.shared.lock().unwrap().motion.is_still(), "taken, not handed over twice");
+        // Port 0 is no port.
+        app.preferences.nav_bridge_port = 0;
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+    }
+}

apps/solidcraft/src/space_mouse/hidraw.rs

@@ -2,13 +2,29 @@
 //! its report descriptor and ids under `/sys/class/hidraw/hidrawN/device/`. Reading them is plain
 //! file I/O, so no udev or hidapi library is needed.
 
+use std::io::Read;
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 
 use solidcraft_space_mouse::{Descriptor, Layout};
 
 const SYSFS: &str = "/sys/class/hidraw";
 const DEV: &str = "/dev";
 
+/// `O_NONBLOCK` on Linux's common architectures (x86, ARM, RISC-V). The device is opened with it so
+/// a read with nothing to read returns at once and the reader can see whether it should stop.
+pub const O_NONBLOCK: i32 = 0o4000;
+
+/// Opens a hidraw node the way the Direct reader reads it: read-only and non-blocking.
+pub fn open(path: &Path) -> std::io::Result<std::fs::File> {
+    use std::os::unix::fs::OpenOptionsExt;
+    std::fs::OpenOptions::new().read(true).custom_flags(O_NONBLOCK).open(path)
+}
+
+/// How long the reader waits when the device has nothing to say, which is also the most a report
+/// can be delayed.
+const IDLE_POLL: Duration = Duration::from_millis(5);
+
 pub struct Device {
     pub path: PathBuf,
     pub layout: Layout,
@@ -23,6 +39,30 @@ pub fn find() -> Option<Device> {
     names.into_iter().find_map(|name| probe(&Path::new(SYSFS).join(&name), Path::new(DEV).join(&name)))
 }
 
+/// Hands every report to `publish` until the device is gone (end of file or an error) or `stop`
+/// says so. `source` is non-blocking: when it has nothing, `stop` is asked and the reader waits
+/// [`IDLE_POLL`]. Reports are read and handed over exactly as they were with blocking reads.
+pub fn read_reports(mut source: impl Read, mut publish: impl FnMut(&[u8]), mut stop: impl FnMut() -> bool) {
+    let mut report = [0_u8; super::REPORT_BUFFER_BYTES];
+    loop {
+        match source.read(&mut report) {
+            Ok(0) => return,
+            Ok(size) => publish(report.get(..size).unwrap_or_default()),
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                if stop() {
+                    return;
+                }
+                std::thread::sleep(IDLE_POLL);
+            }
+            Err(error) => {
+                log::info!("3D mouse disconnected: {error}");
+                return;
+            }
+        }
+    }
+}
+
 fn probe(sysfs: &Path, path: PathBuf) -> Option<Device> {
     let descriptor = Descriptor::parse(&std::fs::read(sysfs.join("device/report_descriptor")).ok()?);
     // A controller that declares no motion axis (buttons only, say) isn't read.
@@ -42,6 +82,73 @@ fn ids(uevent: &str) -> Option<(u16, u16)> {
 mod tests {
     use super::*;
 
+    /// A real EACCES, as a user without the udev rule gets: a file of the user's own with no permission
+    /// bits. Skipped for root, which can open anything.
+    #[test]
+    fn a_device_without_permission_is_denied_and_the_daemon_takes_over_within_the_backoff() {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt};
+        if std::fs::metadata("/proc/self").is_ok_and(|meta| meta.uid() == 0) {
+            return;
+        }
+        let dir = std::env::temp_dir().join(format!("sc-hidraw-denied-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let node = dir.join("hidraw0");
+        std::fs::write(&node, [0_u8; 4]).unwrap();
+        std::fs::set_permissions(&node, std::fs::Permissions::from_mode(0o000)).unwrap();
+        let denied = open(&node);
+        std::fs::set_permissions(&node, std::fs::Permissions::from_mode(0o600)).unwrap();
+        assert!(open(&node).is_ok(), "the same node opens once it is readable");
+        std::fs::remove_dir_all(&dir).ok();
+        assert_eq!(denied.err().map(|error| error.kind()), Some(std::io::ErrorKind::PermissionDenied));
+        // The failure is the choice's `since_failed`, with an injected clock: inside the backoff the
+        // daemon is read, whichever driver was asked for; after it the device is tried again.
+        use super::super::{Pick, SpaceMouseDriver, UNREADABLE_RETRY, choose, direct_usable};
+        for wanted in [SpaceMouseDriver::Automatic, SpaceMouseDriver::Spacenavd, SpaceMouseDriver::Direct] {
+            for ago in [Duration::ZERO, Duration::from_secs(29)] {
+                assert_eq!(choose(wanted, true, direct_usable(true, Some(ago), UNREADABLE_RETRY)), Some(Pick::Spacenavd), "{wanted:?} {ago:?}");
+            }
+        }
+        assert_eq!(choose(SpaceMouseDriver::Direct, true, direct_usable(true, Some(UNREADABLE_RETRY), UNREADABLE_RETRY)), Some(Pick::Direct));
+        // And the daemon's own reader delivers over a fake connection.
+        let (mut daemon, client) = std::os::unix::net::UnixStream::pair().unwrap();
+        let mut record = [0_u8; 32];
+        record[4..8].copy_from_slice(&100_i32.to_ne_bytes());
+        std::io::Write::write_all(&mut daemon, &record).unwrap();
+        drop(daemon);
+        let mut seen = 0;
+        super::super::spacenavd::read(client, |_| seen += 1, |_, _| {}, || false, Duration::from_secs(3600));
+        assert_eq!(seen, 1);
+    }
+
+    #[test]
+    fn reports_come_through_idle_gaps_until_the_device_ends_or_a_stop() {
+        use crate::space_mouse::fake::Script;
+        let mut script = Script::new();
+        script.timeout(std::io::ErrorKind::WouldBlock).data(&[1, 2, 3]).timeout(std::io::ErrorKind::WouldBlock).data(&[4]).end();
+        let (mut seen, mut asked) = (Vec::new(), 0);
+        read_reports(
+            script,
+            |report| seen.push(report.to_vec()),
+            || {
+                asked += 1;
+                false
+            },
+        );
+        assert_eq!(seen, [vec![1, 2, 3], vec![4]]);
+        assert_eq!(asked, 2);
+        let mut script = Script::new();
+        script.data(&[1]).timeout(std::io::ErrorKind::WouldBlock).data(&[2]);
+        let mut seen = Vec::new();
+        read_reports(script, |report| seen.push(report.to_vec()), || true);
+        assert_eq!(seen, [vec![1]], "a stop at an idle moment ends the read");
+        // An unplugged device is an error, which ends the read as before.
+        let mut script = Script::new();
+        script.data(&[1]).fail(std::io::ErrorKind::BrokenPipe).data(&[2]);
+        let mut seen = Vec::new();
+        read_reports(script, |report| seen.push(report.to_vec()), || false);
+        assert_eq!(seen, [vec![1]]);
+    }
+
     #[test]
     fn ids_come_from_the_uevent() {
         let wireless = "DRIVER=hid-generic\nHID_ID=0005:0000256F:0000C63A\nHID_NAME=SpaceMouse Wireless BT\n";

apps/solidcraft/src/space_mouse/spacenavd.rs

@@ -3,7 +3,8 @@
 //! to its clients, so a program that reads the HID device itself bypasses that setup. Over its
 //! socket the daemon sends fixed 32-byte records: eight native-endian `i32`, the first the kind of
 //! record (0 for motion, then x y z rx ry rz and the milliseconds since the last record).
-//! Other records (button presses, from newer daemons also configuration changes) are ignored.
+//! Button records (1 pressed, 2 released, then the button's number from 0) are read too; other
+//! records (from newer daemons also configuration changes) are ignored.
 //!
 //! The socket is plain file I/O, so no library is needed, and it needs no udev rule: the daemon
 //! is what has access to the device.
@@ -11,6 +12,7 @@
 use std::io::Read;
 use std::os::unix::net::UnixStream;
 use std::path::Path;
+use std::time::{Duration, Instant};
 
 use solidcraft_ui_egui::space_mouse::{Axes, FULL_SCALE};
 
@@ -23,6 +25,11 @@ const RECORD_BYTES: usize = 32;
 /// sensitivity). Our axes are in the raw HID units of [`FULL_SCALE`].
 const DAEMON_FULL_SCALE: i64 = 500;
 
+/// Whether the daemon's socket is there, without connecting to it.
+pub fn exists() -> bool {
+    SOCKETS.iter().any(|path| Path::new(path).exists())
+}
+
 pub fn connect() -> Option<UnixStream> {
     SOCKETS.iter().find_map(|path| connect_to(Path::new(path)))
 }
@@ -49,6 +56,22 @@ fn decode(record: &[u8; RECORD_BYTES]) -> Option<Axes> {
     })
 }
 
+/// The button a button record is about, from 0, and whether it went down; `None` for any other
+/// record, or a button past the 32 a bitmask holds.
+fn button(record: &[u8; RECORD_BYTES]) -> Option<(u32, bool)> {
+    let mut data = [0_i32; 2];
+    for (slot, bytes) in data.iter_mut().zip(record.as_chunks::<4>().0) {
+        *slot = i32::from_ne_bytes(*bytes);
+    }
+    let [kind, number] = data;
+    let number = u32::try_from(number).ok().filter(|&n| n < 32)?;
+    match kind {
+        1 => Some((number, true)),
+        2 => Some((number, false)),
+        _ => None,
+    }
+}
+
 /// A daemon value in our raw units. Out-of-range values stay in `i16`: they are input from another
 /// process.
 fn unit(value: impl Into<i64>) -> i16 {
@@ -56,18 +79,53 @@ fn unit(value: impl Into<i64>) -> i16 {
     i16::try_from(scaled.clamp(i64::from(i16::MIN), i64::from(i16::MAX))).unwrap_or_default()
 }
 
-/// Hands every motion record to `publish` until the daemon closes the connection or fails. A
-/// partial record at the end is dropped.
-pub fn read(mut stream: impl Read, mut publish: impl FnMut(Axes)) {
+/// Hands every motion record to `publish` and every button record to `pressed` until the daemon
+/// closes the connection or fails, or `stop` says so. A stream with a read timeout
+/// (`set_read_timeout`) times out when the daemon is quiet, which is no record and no disconnect:
+/// `stop` is asked, and the read goes on, with what of a record had arrived kept. `stop` is also asked
+/// at least every `check_every` while records keep arriving, so a daemon that never pauses for that
+/// long (a moving cap sends every few milliseconds) does not keep the reader from noticing that the
+/// device it prefers is back. A partial record at the end is dropped.
+pub fn read(
+    mut stream: impl Read,
+    mut publish: impl FnMut(Axes),
+    mut pressed: impl FnMut(u32, bool),
+    mut stop: impl FnMut() -> bool,
+    check_every: Duration,
+) {
     let mut record = [0_u8; RECORD_BYTES];
+    let mut filled = 0;
+    let mut asked = Instant::now();
     loop {
-        match stream.read_exact(&mut record) {
-            Ok(()) => {
-                if let Some(axes) = decode(&record) {
-                    publish(axes);
+        if asked.elapsed() >= check_every {
+            asked = Instant::now();
+            if stop() {
+                return;
+            }
+        }
+        match stream.read(record.get_mut(filled..).unwrap_or_default()) {
+            Ok(0) => {
+                log::info!("3D mouse: spacenavd connection ended");
+                return;
+            }
+            Ok(size) => {
+                filled += size;
+                if filled == RECORD_BYTES {
+                    filled = 0;
+                    if let Some(axes) = decode(&record) {
+                        publish(axes);
+                    } else if let Some((number, down)) = button(&record) {
+                        pressed(number, down);
+                    }
                 }
             }
             Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) if matches!(error.kind(), std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut) => {
+                asked = Instant::now();
+                if stop() {
+                    return;
+                }
+            }
             Err(error) => {
                 log::info!("3D mouse: spacenavd connection ended: {error}");
                 return;
@@ -113,6 +171,10 @@ mod tests {
     fn other_records_and_hostile_values_are_harmless() {
         // A button record (kind 1, press) and one of an unknown kind are not motion.
         assert_eq!(decode(&record([1, 0, 1, 0, 0, 0, 0, 0])), None);
+        // Nor are hostile button numbers a button.
+        assert_eq!(button(&record([1, -1, 0, 0, 0, 0, 0, 0])), None);
+        assert_eq!(button(&record([1, i32::MAX, 0, 0, 0, 0, 0, 0])), None);
+        assert_eq!(button(&record([7, 3, 0, 0, 0, 0, 0, 0])), None);
         assert_eq!(decode(&record([7, 500, 500, 500, 500, 500, 500, 0])), None);
         // Nothing overflows on the extremes of `i32`.
         let extreme = decode(&record([0, i32::MIN, i32::MIN, i32::MAX, i32::MAX, i32::MIN, i32::MIN, -1]));
@@ -126,14 +188,84 @@ mod tests {
         let (mut daemon, client) = UnixStream::pair().expect("a socket pair");
         let mut bytes = Vec::new();
         bytes.extend(record([0, 100, 0, 0, 0, 0, 0, 8]));
-        bytes.extend(record([2, 1, 0, 0, 0, 0, 0, 0])); // a button release: skipped
+        bytes.extend(record([1, 4, 0, 0, 0, 0, 0, 0])); // button 4 down
+        bytes.extend(record([2, 4, 0, 0, 0, 0, 0, 0])); // and up
+        bytes.extend(record([1, 40, 0, 0, 0, 0, 0, 0])); // past the 32 a bitmask holds: skipped
         bytes.extend(record([0, 0, 0, 0, 0, 0, 0, 900]));
         bytes.extend([1, 2, 3]); // the daemon went away mid-record
         daemon.write_all(&bytes).expect("written");
         drop(daemon);
-        let mut seen = Vec::new();
-        read(client, |axes| seen.push(axes.translation));
+        let (mut seen, mut buttons) = (Vec::new(), Vec::new());
+        read(client, |axes| seen.push(axes.translation), |number, down| buttons.push((number, down)), || false, Duration::from_secs(3600));
         assert_eq!(seen, [[70, 0, 0], [0, 0, 0]]);
+        assert_eq!(buttons, [(4, true), (4, false)]);
+    }
+
+    #[test]
+    fn a_quiet_daemon_times_out_without_losing_the_record_it_was_sending() {
+        use crate::space_mouse::fake::Script;
+        use std::io::ErrorKind::{TimedOut, WouldBlock};
+        let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+        let mut script = Script::new();
+        script.timeout(WouldBlock).data(&bytes[..10]).timeout(TimedOut).timeout(WouldBlock).data(&bytes[10..]).timeout(WouldBlock).end();
+        let (mut seen, mut asked) = (Vec::new(), 0);
+        read(
+            script,
+            |axes| seen.push(axes.translation),
+            |_, _| {},
+            || {
+                asked += 1;
+                false
+            },
+            Duration::from_secs(3600),
+        );
+        assert_eq!(seen, [[70, 0, 0]]);
+        assert_eq!(asked, 4, "each timeout asks whether to stop");
+    }
+
+    #[test]
+    fn a_stop_ends_the_read_at_the_next_timeout_only() {
+        use crate::space_mouse::fake::Script;
+        let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+        let mut script = Script::new();
+        script.data(&bytes).timeout(std::io::ErrorKind::WouldBlock).data(&bytes);
+        let mut seen = 0;
+        read(script, |_| seen += 1, |_, _| {}, || true, Duration::from_secs(3600));
+        assert_eq!(seen, 1, "the record before the timeout arrived; the one after never was read");
+    }
+
+    /// A daemon that never goes quiet (a moving cap sends every few milliseconds) is still asked whether to
+    /// stop, at the interval given, so the reader can go back to a device that returned.
+    #[test]
+    fn a_busy_daemon_is_asked_whether_to_stop_on_a_timer() {
+        // Ends by itself after half a second, so a read that never asks fails the assertion below
+        // instead of hanging the test.
+        struct Busy(Instant);
+        impl Read for Busy {
+            fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+                if self.0.elapsed() > Duration::from_millis(500) {
+                    return Ok(0);
+                }
+                std::thread::sleep(Duration::from_millis(2));
+                let bytes = record([0, 100, 0, 0, 0, 0, 0, 8]);
+                let size = bytes.len().min(buf.len());
+                buf[..size].copy_from_slice(&bytes[..size]);
+                Ok(size)
+            }
+        }
+        let (mut seen, mut asked) = (0, 0);
+        read(
+            Busy(Instant::now()),
+            |_| seen += 1,
+            |_, _| {},
+            || {
+                asked += 1;
+                asked == 3
+            },
+            Duration::from_millis(10),
+        );
+        assert_eq!(asked, 3, "asked on the timer although no read ever timed out");
+        assert!(seen > 3, "records kept coming meanwhile: {seen}");
     }
 
     #[test]

apps/solidcraft/src/space_mouse/windows_hid.rs

@@ -0,0 +1,172 @@
+//! Windows: finding 3D mice without asking any other device anything (#2614).
+//!
+//! hidapi's enumeration opens every HID interface and reads its serial number, manufacturer and
+//! product strings: on USB, three control requests to every keyboard, mouse and touchscreen. The
+//! reader repeated it every two seconds while no 3D mouse was plugged in, and on some machines the
+//! keyboard then kept dropping off the bus and the cursor jumped. Plug and Play already names each
+//! interface's top-level usage in its hardware IDs (`HID_DEVICE_UP:0001_U:0008`: Generic Desktop,
+//! Multi-Axis Controller), so the reader asks it, which sends nothing to any device, and opens only
+//! the interfaces that are 3D mice.
+//!
+//! The configuration manager has no safe API, hence the `unsafe_code` allowance on this module
+//! (the app crate denies it; see `native_crash.rs`).
+#![allow(unsafe_code)]
+
+use std::ffi::CString;
+use std::ptr::{null, null_mut};
+
+use windows_sys::Win32::Devices::DeviceAndDriverInstallation::{
+    CM_GET_DEVICE_INTERFACE_LIST_PRESENT, CM_Get_DevNode_PropertyW, CM_Get_Device_Interface_List_SizeW, CM_Get_Device_Interface_ListW,
+    CM_Get_Device_Interface_PropertyW, CM_LOCATE_DEVNODE_NORMAL, CM_Locate_DevNodeW, CONFIGRET, CR_BUFFER_SMALL, CR_SUCCESS,
+};
+use windows_sys::Win32::Devices::HumanInterfaceDevice::GUID_DEVINTERFACE_HID;
+use windows_sys::Win32::Devices::Properties::{
+    DEVPKEY_Device_HardwareIds, DEVPKEY_Device_InstanceId, DEVPROP_TYPE_STRING, DEVPROP_TYPE_STRING_LIST, DEVPROPTYPE,
+};
+use windows_sys::Win32::Foundation::DEVPROPKEY;
+
+/// The hardware ID Windows gives a top-level collection with the Generic Desktop page's
+/// Multi-Axis Controller usage.
+const MULTI_AXIS_CONTROLLER: &str = "HID_DEVICE_UP:0001_U:0008";
+/// Largest property read, in bytes: hardware IDs are a few hundred.
+const MAX_PROPERTY_BYTES: u32 = 64 * 1024;
+/// Tries at reading the interface list, which can grow between asking its size and reading it.
+const LIST_TRIES: usize = 4;
+
+/// The paths of the present HID interfaces whose top-level collection is a multi-axis controller.
+pub fn multi_axis_controllers() -> Vec<CString> {
+    interfaces()
+        .into_iter()
+        .filter(|path| {
+            let Some(instance) = interface_strings(path, &DEVPKEY_Device_InstanceId).and_then(|ids| ids.into_iter().next()) else {
+                return false;
+            };
+            devnode_strings(&instance, &DEVPKEY_Device_HardwareIds).is_some_and(|ids| is_multi_axis(&ids))
+        })
+        .filter_map(|path| CString::new(path).ok())
+        .collect()
+}
+
+/// Whether a device with these hardware IDs is a multi-axis controller.
+fn is_multi_axis(hardware_ids: &[String]) -> bool {
+    hardware_ids.iter().any(|id| id.eq_ignore_ascii_case(MULTI_AXIS_CONTROLLER))
+}
+
+/// The strings of a nul-separated list (`REG_MULTI_SZ`, or one string), without empty ones.
+fn split_multi_sz(buffer: &[u16]) -> Vec<String> {
+    buffer.split(|c| *c == 0).filter(|s| !s.is_empty()).map(String::from_utf16_lossy).collect()
+}
+
+/// `s` as a nul-terminated wide string.
+fn wide(s: &str) -> Vec<u16> {
+    s.encode_utf16().chain(std::iter::once(0)).collect()
+}
+
+/// The paths of the present HID interfaces.
+fn interfaces() -> Vec<String> {
+    for _ in 0..LIST_TRIES {
+        let mut len = 0u32;
+        // SAFETY: `len` is a valid place for the size; the class GUID is a static; no device filter.
+        let sized = unsafe { CM_Get_Device_Interface_List_SizeW(&mut len, &GUID_DEVINTERFACE_HID, null(), CM_GET_DEVICE_INTERFACE_LIST_PRESENT) };
+        if sized != CR_SUCCESS || len == 0 {
+            return Vec::new();
+        }
+        let mut buffer = vec![0u16; len as usize];
+        // SAFETY: `buffer` holds `len` wide characters, the length the call is given.
+        let listed =
+            unsafe { CM_Get_Device_Interface_ListW(&GUID_DEVINTERFACE_HID, null(), buffer.as_mut_ptr(), len, CM_GET_DEVICE_INTERFACE_LIST_PRESENT) };
+        match listed {
+            CR_SUCCESS => return split_multi_sz(&buffer),
+            CR_BUFFER_SMALL => continue,
+            _ => return Vec::new(),
+        }
+    }
+    Vec::new()
+}
+
+/// A string or string-list property, read by `get` (property type, buffer, its size in bytes) in
+/// two calls: the size, then the value.
+fn property_strings(get: impl Fn(*mut DEVPROPTYPE, *mut u8, *mut u32) -> CONFIGRET) -> Option<Vec<String>> {
+    let mut kind: DEVPROPTYPE = 0;
+    let mut size = 0u32;
+    if get(&mut kind, null_mut(), &mut size) != CR_BUFFER_SMALL || size == 0 || size > MAX_PROPERTY_BYTES {
+        return None;
+    }
+    let mut buffer = vec![0u16; (size as usize).div_ceil(2)];
+    let mut size = (buffer.len() * 2) as u32;
+    if get(&mut kind, buffer.as_mut_ptr().cast(), &mut size) != CR_SUCCESS || (kind != DEVPROP_TYPE_STRING && kind != DEVPROP_TYPE_STRING_LIST) {
+        return None;
+    }
+    Some(split_multi_sz(&buffer))
+}
+
+/// A string property of the device interface at `path`.
+fn interface_strings(path: &str, key: &DEVPROPKEY) -> Option<Vec<String>> {
+    let path = wide(path);
+    property_strings(|kind, buffer, size| {
+        // SAFETY: `path` is nul-terminated and outlives the call; `buffer` is null (asking the size)
+        // or holds `*size` bytes, as `property_strings` sets up.
+        unsafe { CM_Get_Device_Interface_PropertyW(path.as_ptr(), key, kind, buffer, size, 0) }
+    })
+}
+
+/// A string property of the device with instance ID `instance`.
+fn devnode_strings(instance: &str, key: &DEVPROPKEY) -> Option<Vec<String>> {
+    let instance = wide(instance);
+    let mut devnode = 0u32;
+    // SAFETY: `instance` is nul-terminated and outlives the call; `devnode` is a valid place for the result.
+    if unsafe { CM_Locate_DevNodeW(&mut devnode, instance.as_ptr(), CM_LOCATE_DEVNODE_NORMAL) } != CR_SUCCESS {
+        return None;
+    }
+    property_strings(|kind, buffer, size| {
+        // SAFETY: `buffer` is null (asking the size) or holds `*size` bytes, as `property_strings` sets up.
+        unsafe { CM_Get_DevNode_PropertyW(devnode, key, kind, buffer, size, 0) }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The hardware IDs Windows gives a wired 3Dconnexion device's motion interface, and a
+    /// keyboard's: only the first is a multi-axis controller.
+    #[test]
+    fn only_the_multi_axis_usage_is_a_3d_mouse() {
+        let ids = |list: &[&str]| list.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let space_mouse = ids(&["HID\\VID_256F&PID_C635&REV_0437&MI_00", "HID\\VID_256F&UP:0001_U:0008", "HID_DEVICE_UP:0001_U:0008", "HID_DEVICE"]);
+        let keyboard = ids(&[
+            "HID\\VID_046D&PID_C31C&REV_6400&MI_00",
+            "HID\\VID_046D&UP:0001_U:0006",
+            "HID_DEVICE_SYSTEM_KEYBOARD",
+            "HID_DEVICE_UP:0001_U:0006",
+            "HID_DEVICE",
+        ]);
+        let vendor = ids(&["HID\\VID_256F&UP:FF00_U:0001", "HID_DEVICE_UP:FF00_U:0001", "HID_DEVICE_UPR:FF00-FFFF", "HID_DEVICE"]);
+        assert!(is_multi_axis(&space_mouse));
+        assert!(is_multi_axis(&ids(&["hid_device_up:0001_u:0008"])), "IDs compare without regard to case");
+        assert!(!is_multi_axis(&keyboard) && !is_multi_axis(&vendor) && !is_multi_axis(&[]));
+    }
+
+    #[test]
+    fn nul_separated_lists_split_into_their_strings() {
+        let buffer: Vec<u16> = "a\\b\0HID_DEVICE\0\0".encode_utf16().collect();
+        assert_eq!(split_multi_sz(&buffer), ["a\\b", "HID_DEVICE"]);
+        assert_eq!(split_multi_sz(&wide("one")), ["one"]);
+        assert!(split_multi_sz(&[0, 0]).is_empty() && split_multi_sz(&[]).is_empty());
+    }
+
+    /// The scan asks Plug and Play only: on any machine it returns, and every path it returns is a
+    /// present HID interface whose hardware IDs name the multi-axis usage.
+    #[test]
+    fn the_scan_returns_only_multi_axis_interfaces() {
+        let found = multi_axis_controllers();
+        let all = interfaces();
+        for path in &found {
+            let path = path.to_str().unwrap_or_default();
+            assert!(all.iter().any(|p| p == path), "{path}");
+            let instance = interface_strings(path, &DEVPKEY_Device_InstanceId).and_then(|ids| ids.into_iter().next()).unwrap_or_default();
+            assert!(devnode_strings(&instance, &DEVPKEY_Device_HardwareIds).is_some_and(|ids| is_multi_axis(&ids)), "{path}");
+        }
+        eprintln!("{} HID interfaces present, {} multi-axis controllers", all.len(), found.len());
+    }
+}

apps/solidcraft/src/startup.rs

@@ -8,8 +8,9 @@
 //!   row the next launch starts in safe mode by itself.
 //! - **Safe mode** (`--safe-mode` or `SOLIDCRAFT_SAFE_MODE=1`): default settings (the saved ones
 //!   are left untouched), no recovery offer, the software renderer and CPU meshing.
-//! - **No usable graphics device**: one retry on the software renderer
-//!   (`SOLIDCRAFT_RENDERER=cpu`), then a message box saying what failed and what to try.
+//! - **A renderer that cannot start**: on Windows, try the remaining graphics APIs in order,
+//!   then the software renderer (`SOLIDCRAFT_RENDERER=cpu`). An explicit `WGPU_BACKEND` fails
+//!   cleanly without switching. Exhausted retries show a message box with the error.
 
 use std::path::{Path, PathBuf};
 
@@ -21,6 +22,25 @@ pub const RENDERER_ENV: &str = "SOLIDCRAFT_RENDERER";
 pub const FAILED_STARTS_FOR_SAFE_MODE: u32 = 2;
 const MARKER: &str = "starting";
 
+/// Explicit application-settings isolation for side-by-side builds and native UI
+/// acceptance. A supplied invalid path refuses startup rather than falling back
+/// to the user's ordinary settings. No directory is read or created here.
+pub fn settings_directory(override_path: Option<&std::ffi::OsStr>, default: Option<PathBuf>) -> Result<Option<PathBuf>, String> {
+    match override_path {
+        None => Ok(default),
+        Some(raw) => {
+            let path = PathBuf::from(raw);
+            if raw.is_empty() || !path.is_absolute() {
+                return Err("SOLIDCRAFT_SETTINGS_DIR must be a nonempty absolute directory path".into());
+            }
+            if path.exists() && !path.is_dir() {
+                return Err("SOLIDCRAFT_SETTINGS_DIR names a file, not a directory".into());
+            }
+            Ok(Some(path))
+        }
+    }
+}
+
 /// Whether an environment value switches something on.
 pub fn env_on(v: Option<&str>) -> bool {
     v.map(str::trim).is_some_and(|v| !v.is_empty() && v != "0" && !v.eq_ignore_ascii_case("false"))
@@ -110,6 +130,48 @@ pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&efr
         })
 }
 
+/// Adapter properties used to choose a card without opening a device.
+#[derive(Clone, Debug)]
+pub struct AdapterChoice {
+    pub name: String,
+    pub compatible: bool,
+}
+
+/// Choose only surface-compatible adapters. Names saved in preferences are exact; the
+/// environment override follows wgpu's case-insensitive substring convention.
+/// No match leaves selection to the normal wgpu request.
+pub fn choose_adapter(adapters: &[AdapterChoice], environment: Option<&str>, preference: Option<&str>) -> Option<usize> {
+    // wgpu's environment helper panics on a missing name; an override must remain recoverable.
+    let compatible = || adapters.iter().enumerate().filter(|(_, a)| a.compatible);
+    if let Some(name) = environment.filter(|s| !s.is_empty()) {
+        let name = name.to_lowercase();
+        if let Some((index, _)) = compatible().find(|(_, a)| a.name.to_lowercase().contains(&name)) {
+            return Some(index);
+        }
+    }
+    if let Some(name) = preference.filter(|s| !s.is_empty())
+        && let Some((index, _)) = compatible().find(|(_, a)| a.name == name)
+    {
+        return Some(index);
+    }
+    None
+}
+
+/// Leave Automatic on wgpu's normal request path; named choices may defer to it too.
+pub fn configure_adapter(setup: &mut eframe::egui_wgpu::WgpuSetupCreateNew, cpu: bool, environment: Option<String>, preference: Option<String>) {
+    if cpu {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(|adapters, surface| pick_cpu_adapter(adapters, surface).map(Some)));
+    } else if environment.as_deref().is_some_and(|s| !s.is_empty()) || preference.as_deref().is_some_and(|s| !s.is_empty()) {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let choices: Vec<_> = adapters
+                .iter()
+                .map(|a| AdapterChoice { name: a.get_info().name, compatible: surface.is_none_or(|s| a.is_surface_supported(s)) })
+                .collect();
+            Ok(choose_adapter(&choices, environment.as_deref(), preference.as_deref()).and_then(|i| adapters.get(i)).cloned())
+        }));
+    }
+}
+
 /// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
 pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";
 
@@ -157,6 +219,34 @@ pub fn choose_backends(
     Some(WINDOWS_ORDER.into_iter().find(|b| has_hardware(*b)).unwrap_or(Backends::DX12))
 }
 
+/// Internal, process-local retry choice; never written to the graphics preference.
+pub const RETRY_BACKEND_ENV: &str = "SOLIDCRAFT_STARTUP_BACKEND";
+/// Why this launch is using a fallback, carried to the new process for status and Preferences.
+pub const FALLBACK_NOTE_ENV: &str = "SOLIDCRAFT_GRAPHICS_FALLBACK";
+
+/// A handled startup failure tries each remaining Windows API once, then software rendering.
+/// An explicit environment choice is final, including when software rendering was requested.
+pub fn fallback_backend(windows: bool, explicit: bool, cpu: bool, failed: eframe::wgpu::Backends) -> Option<&'static str> {
+    if explicit || cpu {
+        return None;
+    }
+    if windows {
+        let last = WINDOWS_ORDER.iter().rposition(|backend| failed.intersects(*backend));
+        if let Some(next) = last.and_then(|i| WINDOWS_ORDER.get(i + 1)) {
+            return Some(if *next == eframe::wgpu::Backends::VULKAN { "vulkan" } else { "gl" });
+        }
+    }
+    Some("cpu")
+}
+
+/// Keep driver diagnostics on one bounded line, including across the finite retry chain.
+pub fn fallback_note(previous: &str, failed: eframe::wgpu::Backends, next: &str, error: &str) -> String {
+    let previous: String = previous.chars().take(2048).collect();
+    let error: String = error.chars().take(1024).collect();
+    let line = format!("{previous} Graphics fallback: {failed:?} failed ({error}); trying {next}.");
+    line.split_whitespace().collect::<Vec<_>>().join(" ").chars().take(4096).collect()
+}
+
 /// The device feature for a 32-bit float depth buffer with a stencil (reversed depth, #1434).
 pub const FLOAT_DEPTH_STENCIL: eframe::wgpu::Features = eframe::wgpu::Features::DEPTH32FLOAT_STENCIL8;
 
@@ -189,6 +279,29 @@ pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
     adapters.iter().any(|a| a.get_info().device_type != eframe::wgpu::DeviceType::Cpu)
 }
 
+/// The environment variable that switches wgpu's indirect-call validation on or off.
+pub const INDIRECT_VALIDATION_ENV: &str = "WGPU_VALIDATION_INDIRECT_CALL";
+
+/// The instance flags for the window. wgpu's indirect-call validation compiles a compute shader
+/// when the device is created, and on Intel Macs (macOS 12 with Intel Iris graphics, #3024,
+/// #3080, #4605) the Metal compiler refuses it: the device is lost and the window never opens.
+/// So on an Intel Mac the validation is left off, unless the user turned it on or off with
+/// `WGPU_VALIDATION_INDIRECT_CALL` themselves.
+pub fn window_instance_flags(flags: eframe::wgpu::InstanceFlags, intel_mac: bool, env: Option<&str>) -> eframe::wgpu::InstanceFlags {
+    if intel_mac && env.map(str::trim).is_none_or(str::is_empty) { flags - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL } else { flags }
+}
+
+/// Windows with OpenGL: the window keeps the system title bar (#2063). The window without OS
+/// decorations keeps its caption style while having no frame, and some OpenGL drivers (older
+/// Intel HD/UHD) then show the picture a caption's height lower than the window, so it no longer
+/// lines up with the pointer. Direct3D 12 and Vulkan draw it in place and keep the application bar
+/// as the title bar. `backends` are the ones wgpu starts: OpenGL alone is decided before the
+/// window opens.
+pub fn system_title_bar(windows: bool, backends: eframe::wgpu::Backends) -> bool {
+    use eframe::wgpu::Backends;
+    windows && backends.contains(Backends::GL) && !backends.intersects(Backends::DX12 | Backends::VULKAN)
+}
+
 /// The message shown when no window could be opened at all.
 pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
     let folder = settings.map(|d| d.display().to_string()).unwrap_or_else(|| "the SolidCraft settings folder".into());
@@ -207,6 +320,48 @@ pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
 mod tests {
     use super::*;
 
+    fn cards() -> Vec<AdapterChoice> {
+        ["Integrated", "Discrete small", "Discrete large"].into_iter().map(|name| AdapterChoice { name: name.into(), compatible: true }).collect()
+    }
+
+    #[test]
+    fn adapter_names_environment_override_and_missing_card_fallback() {
+        let cards = cards();
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some("LARGE"), Some("Discrete small")), Some(2));
+        assert_eq!(choose_adapter(&cards, None, Some("removed")), None);
+        assert_eq!(choose_adapter(&cards, Some("missing"), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some(""), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete")), None, "saved names are exact");
+    }
+
+    #[test]
+    fn automatic_adapter_leaves_selection_to_wgpu() {
+        let mut cards = cards();
+        assert_eq!(choose_adapter(&cards, None, None), None);
+        assert_eq!(choose_adapter(&cards, Some(""), Some("")), None);
+        cards[2].compatible = false;
+        assert_eq!(choose_adapter(&cards, Some("large"), Some("Discrete large")), None);
+        assert_eq!(choose_adapter(&cards, Some("small"), None), Some(1));
+        assert_eq!(choose_adapter(&[], None, None), None);
+    }
+
+    #[test]
+    fn automatic_adapter_preserves_the_previous_request_configuration() {
+        use eframe::egui_wgpu::WgpuSetupCreateNew;
+        let previous = WgpuSetupCreateNew::without_display_handle();
+        for preference in [None, Some(String::new())] {
+            let mut setup = WgpuSetupCreateNew::without_display_handle();
+            configure_adapter(&mut setup, false, None, preference);
+            assert!(setup.native_adapter_selector.is_none(), "Automatic must use the normal wgpu request");
+            assert_eq!(setup.power_preference, previous.power_preference);
+            assert_eq!(setup.instance_descriptor.backends, previous.instance_descriptor.backends);
+        }
+        let mut setup = WgpuSetupCreateNew::without_display_handle();
+        configure_adapter(&mut setup, false, Some("missing".into()), Some("removed".into()));
+        assert!(setup.native_adapter_selector.unwrap()(&[], None).unwrap().is_none(), "missing names must use the normal request too");
+    }
+
     fn scratch(name: &str) -> PathBuf {
         let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&d);
@@ -214,6 +369,32 @@ mod tests {
         d
     }
 
+    #[test]
+    fn isolated_settings_are_explicit_absolute_and_never_fall_back() {
+        let default = std::env::temp_dir().join("ordinary-settings");
+        assert_eq!(settings_directory(None, Some(default.clone())).unwrap(), Some(default.clone()));
+        let selected = std::env::temp_dir().join("solidcraft-isolated-settings-fixture");
+        assert_eq!(settings_directory(Some(selected.as_os_str()), Some(default.clone())).unwrap(), Some(selected));
+        for raw in ["", "relative/settings", "../ordinary"] {
+            assert!(settings_directory(Some(std::ffi::OsStr::new(raw)), Some(default.clone())).is_err());
+        }
+        let file = std::env::current_exe().unwrap();
+        assert!(settings_directory(Some(file.as_os_str()), Some(default)).is_err());
+    }
+
+    #[test]
+    fn intel_macs_start_without_indirect_call_validation() {
+        use eframe::wgpu::InstanceFlags as F;
+        let on = F::VALIDATION | F::VALIDATION_INDIRECT_CALL;
+        assert_eq!(window_instance_flags(on, true, None), F::VALIDATION);
+        assert_eq!(window_instance_flags(on, true, Some("  ")), F::VALIDATION);
+        // The user's own choice stands, on or off.
+        assert_eq!(window_instance_flags(on, true, Some("1")), on);
+        assert_eq!(window_instance_flags(F::VALIDATION, true, Some("0")), F::VALIDATION);
+        // Every other machine keeps what it had.
+        assert_eq!(window_instance_flags(on, false, None), on);
+    }
+
     #[test]
     fn switches_read_from_the_environment() {
         assert!(env_on(Some("1")) && env_on(Some("yes")) && !env_on(Some("0")) && !env_on(Some(" ")) && !env_on(None) && !env_on(Some("false")));
@@ -290,6 +471,54 @@ mod tests {
         assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
     }
 
+    #[test]
+    fn failed_windows_backends_fall_back_in_order_and_stop_after_software() {
+        use eframe::wgpu::Backends as B;
+        assert_eq!(fallback_backend(true, false, false, B::DX12), Some("vulkan"));
+        assert_eq!(fallback_backend(true, false, false, B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(true, false, false, B::GL), Some("cpu"));
+        assert_eq!(fallback_backend(true, false, true, B::DX12), None);
+        assert_eq!(fallback_backend(true, false, false, B::DX12 | B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(false, false, false, B::VULKAN), Some("cpu"));
+        let note = fallback_note("", B::DX12, "vulkan", "egui_pipeline\n0x80070057");
+        assert!(note.contains("egui_pipeline 0x80070057") && note.contains("vulkan") && !note.contains('\n'));
+        let long = fallback_note(&"x".repeat(5000), B::VULKAN, "gl", &"y".repeat(5000));
+        assert!(long.chars().count() <= 4096 && long.ends_with("trying gl."));
+    }
+
+    #[test]
+    fn explicit_backend_failure_never_switches_api_or_retries_software() {
+        use eframe::wgpu::Backends as B;
+        for windows in [false, true] {
+            for cpu in [false, true] {
+                for backend in [B::DX12, B::VULKAN, B::GL, B::all()] {
+                    assert_eq!(fallback_backend(windows, true, cpu, backend), None);
+                    let mut probed = false;
+                    assert_eq!(
+                        choose_backends(windows, true, cpu, Some("vulkan"), |_| {
+                            probed = true;
+                            false
+                        }),
+                        None
+                    );
+                    assert!(!probed);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn only_opengl_on_windows_gets_the_system_title_bar() {
+        use eframe::wgpu::Backends;
+        assert!(system_title_bar(true, Backends::GL));
+        for b in [Backends::DX12, Backends::VULKAN, Backends::DX12 | Backends::GL, Backends::VULKAN | Backends::GL, Backends::all()] {
+            assert!(!system_title_bar(true, b), "{b:?}");
+        }
+        for b in [Backends::GL, Backends::VULKAN, Backends::METAL] {
+            assert!(!system_title_bar(false, b), "{b:?}");
+        }
+    }
+
     #[test]
     fn wgpu_backend_the_preference_and_the_software_renderer_override_the_order() {
         use eframe::wgpu::Backends;
@@ -314,9 +543,16 @@ mod tests {
 
     #[test]
     fn probing_a_backend_alone_never_panics() {
-        // Whatever this machine has (often nothing): an answer, not a crash.
-        for b in WINDOWS_ORDER {
-            let _ = has_hardware_adapter(b);
+        // Whatever this machine has (often nothing): an answer, not a crash. On Windows the probe
+        // goes the way the app's does, stopping at the first backend with a GPU: a machine with
+        // D3D12 never loads its OpenGL driver into the test process, and AMD's (`atio6axx.dll`)
+        // aborted the process as it exited (#1156).
+        if cfg!(target_os = "windows") {
+            let _ = choose_backends(true, false, false, None, has_hardware_adapter);
+        } else {
+            for b in WINDOWS_ORDER {
+                let _ = has_hardware_adapter(b);
+            }
         }
     }
 
@@ -329,8 +565,18 @@ mod tests {
     #[test]
     fn the_software_adapter_is_preferred_and_its_absence_is_an_error_not_a_panic() {
         assert!(pick_cpu_adapter(&[], None).unwrap_err().contains("none"));
-        let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
-        let adapters = pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all()));
+        // The adapters the software renderer chooses among: it starts D3D12 alone on Windows
+        // (WARP), not every backend, so the test doesn't load the OpenGL driver either (#1156).
+        let options = crate::wgpu_options(true, None);
+        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &options.wgpu_setup else { panic!("the software renderer makes its own device") };
+        let backends = setup.instance_descriptor.backends;
+        if cfg!(target_os = "windows") && std::env::var_os(WGPU_BACKEND_ENV).is_none() {
+            assert_eq!(backends, eframe::wgpu::Backends::DX12);
+        }
+        let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle_from_env();
+        desc.backends = backends;
+        let instance = eframe::wgpu::Instance::new(desc);
+        let adapters = pollster::block_on(instance.enumerate_adapters(backends));
         if adapters.is_empty() {
             return;
         }

apps/solidcraft/src/window_fit.rs

@@ -0,0 +1,117 @@
+//! Keeping the restored window reachable.
+//!
+//! The window comes back where it was left. After a monitor was unplugged, the scale changed or
+//! the settings came from a larger screen, that can put its title bar above the top edge or
+//! under the taskbar, out of reach of the mouse. [`fit`] pulls a window back into the monitor's
+//! work area (the screen without the taskbar), in whatever unit the caller measures both, as
+//! long as it is the same one.
+
+/// A rectangle: left, top, width, height.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Area {
+    pub x: f32,
+    pub y: f32,
+    pub w: f32,
+    pub h: f32,
+}
+
+impl Area {
+    pub const fn new(x: f32, y: f32, w: f32, h: f32) -> Self {
+        Area { x, y, w, h }
+    }
+    fn right(self) -> f32 {
+        self.x + self.w
+    }
+    fn bottom(self) -> f32 {
+        self.y + self.h
+    }
+    fn sane(self) -> bool {
+        [self.x, self.y, self.w, self.h].iter().all(|v| v.is_finite()) && self.w > 0.0 && self.h > 0.0
+    }
+}
+
+/// How much of the title bar must stay over the work area at least, to grab it.
+pub const REACHABLE: f32 = 100.0;
+/// The size a window gets when its saved geometry is unusable, before it is fitted to the screen.
+pub const DEFAULT_SIZE: (f32, f32) = (1600.0, 1000.0);
+
+/// `window` moved and shrunk so that it can be reached on `work`: no larger than the work area
+/// (but not below `min`), the title bar not above the work area's top, the window not below its
+/// bottom, and at least [`REACHABLE`] of it over the work area horizontally. A window that is
+/// fine is returned unchanged. Geometry that makes no sense (not finite, empty), or a work
+/// area that does not, gives the default size centred on the work area.
+pub fn fit(window: Area, work: Area, min: (f32, f32)) -> Area {
+    if !work.sane() {
+        return window;
+    }
+    let min = (min.0.min(work.w), min.1.min(work.h));
+    if !window.sane() {
+        let w = DEFAULT_SIZE.0.min(work.w * 0.9).max(min.0);
+        let h = DEFAULT_SIZE.1.min(work.h * 0.9).max(min.1);
+        return Area::new(work.x + (work.w - w) / 2.0, work.y + (work.h - h) / 2.0, w, h);
+    }
+    let w = window.w.clamp(min.0, work.w);
+    let h = window.h.clamp(min.1, work.h);
+    let reach = REACHABLE.min(w);
+    // A window that had to shrink goes fully onto the screen; one that fits may keep straddling two.
+    let x = if w < window.w { window.x.max(work.x).min(work.right() - w) } else { window.x.max(work.x + reach - w).min(work.right() - reach) };
+    let y = window.y.min(work.bottom() - h).max(work.y);
+    Area::new(x, y, w, h)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const WORK: Area = Area::new(0.0, 0.0, 2560.0, 1400.0);
+    const MIN: (f32, f32) = (960.0, 600.0);
+
+    #[test]
+    fn a_window_on_screen_is_left_alone() {
+        let w = Area::new(300.0, 120.0, 1600.0, 1000.0);
+        assert_eq!(fit(w, WORK, MIN), w);
+    }
+
+    #[test]
+    fn a_title_bar_above_the_top_or_under_the_taskbar_comes_back() {
+        let fitted = fit(Area::new(300.0, -400.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!((fitted.y, fitted.h), (0.0, 1000.0));
+        let fitted = fit(Area::new(300.0, 1300.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(fitted.y + fitted.h, 1400.0);
+        // A taskbar at the top moves the work area down.
+        let below_bar = Area::new(0.0, 48.0, 2560.0, 1352.0);
+        assert_eq!(fit(Area::new(300.0, 0.0, 1600.0, 1000.0), below_bar, MIN).y, 48.0);
+    }
+
+    #[test]
+    fn a_window_from_a_monitor_that_is_gone_keeps_a_grabbable_part_on_screen() {
+        let right = fit(Area::new(5000.0, 100.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(right.x, 2560.0 - REACHABLE);
+        let left = fit(Area::new(-4000.0, 100.0, 1600.0, 1000.0), WORK, MIN);
+        assert_eq!(left.x + left.w, REACHABLE);
+    }
+
+    #[test]
+    fn a_window_larger_than_the_screen_shrinks_to_it() {
+        let small = Area::new(0.0, 0.0, 1280.0, 720.0);
+        let fitted = fit(Area::new(-20.0, -30.0, 3200.0, 2000.0), small, MIN);
+        assert_eq!(fitted, small);
+        // Never below the minimum, unless the screen itself is smaller.
+        assert_eq!(fit(Area::new(0.0, 0.0, 100.0, 100.0), WORK, MIN).w, 960.0);
+        assert_eq!(fit(Area::new(0.0, 0.0, 100.0, 100.0), Area::new(0.0, 0.0, 800.0, 500.0), MIN).h, 500.0);
+    }
+
+    #[test]
+    fn unusable_geometry_is_centred_at_a_sensible_size() {
+        for bad in [Area::new(f32::NAN, 0.0, 1600.0, 1000.0), Area::new(0.0, 0.0, 0.0, 0.0), Area::new(0.0, 0.0, f32::INFINITY, 10.0)] {
+            let fitted = fit(bad, WORK, MIN);
+            assert_eq!(fitted, Area::new(480.0, 200.0, 1600.0, 1000.0));
+        }
+        let small = Area::new(100.0, 50.0, 1366.0, 728.0);
+        let fitted = fit(Area::new(f32::NAN, 0.0, 1.0, 1.0), small, MIN);
+        assert!(fitted.w <= small.w && fitted.h <= small.h && fitted.x >= small.x && fitted.y >= small.y);
+        // No work area to go by: nothing to change.
+        let w = Area::new(1.0, 2.0, 3.0, 4.0);
+        assert_eq!(fit(w, Area::new(0.0, 0.0, 0.0, 0.0), MIN), w);
+    }
+}

assets/README.md

@@ -25,6 +25,7 @@ assets/
   fonts/{liberation-sans,biz-udp-gothic}/ # unmodified fonts and OFL licences
   locales/{en,de,ja,ko}.json          # shared offline catalogs
   platforms/{macos,linux,windows}/    # bundle, freedesktop and WiX templates
+  platforms/macos/dmg/                # disk image window: layout, dmgbuild settings, background art
   archive/icons/macos-v1/
     source/icon.vectorcraft          # earlier editable work, retained
                                      # redundant historical exports are retired
@@ -75,7 +76,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 | macOS | Composer master and paired exports; bundle installs `Assets.car` and `SolidCraft.icns` |
 | Windows executable | `solidcraft-executable.ico`: original DIB/mask representations at 16/24/32/48/64/128/256 px |
 | Windows installer | `solidcraft.ico`: PNG representations at 16/20/24/32/40/48/64/128/256 px; `SOLIDCRAFT_ICONS` override retained |
-| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `ai.storyteller.solidcraft` |
+| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `io.tangencylabs.solidcraft` |
 | AppImage | Uses the Linux 256 px image and `.DirIcon` alias |
 | FreeBSD | Shares Linux hicolor images and freedesktop metadata |
 | Web | HTML/Trunk and `manifest.webmanifest` stay in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/`, uses the collected CSS, and copies the Linux 32/256/512 px images to `icons/` for the favicon and installed app |
@@ -84,7 +85,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 ## Code and provenance
 
 Resources remain compiled by their owning layer through existing APIs:
-`ui-egui::icons::paint` and `Tokens` at L5, model presets in L2 `doc`, and sketch
+`ui-egui::icons::paint_icon` and `Tokens` at L5, model presets in L2 `doc`, and sketch
 fonts at L1. State, projection, interaction, commands and GPU bindings stay in
 their current modules. Embedded data uses `CARGO_MANIFEST_DIR`; application code
 needs no runtime resource registry or repository lookup.

assets/appearances/opaque_finishes.rs

@@ -0,0 +1,11 @@
+//! Original illustrative opaque finishes; not measured optical or engineering data.
+//! (name, sRGB color, metal fraction, perceptual roughness). IOR is an illustrative 1.5.
+//! Separate names preserve the scalar library's appearance and saved assignments.
+pub const OPAQUE_FINISHES: [(&str, [u8; 3], f64, f64); 6] = [
+    ("Steel - Satin PBR", [158, 164, 172], 1.0, 0.4),
+    ("Aluminum - Satin PBR", [204, 208, 214], 1.0, 0.3),
+    ("Copper - Clean PBR", [204, 122, 80], 1.0, 0.25),
+    ("ABS - Molded PBR", [222, 222, 216], 0.0, 0.4),
+    ("PLA - Smooth PBR", [110, 160, 222], 0.0, 0.35),
+    ("Wood - Oak Uniform PBR Preview", [190, 146, 92], 0.0, 0.65),
+];

assets/appearances/starter_pack.rs

@@ -0,0 +1,292 @@
+//! Original starter visual data, MIT OR Apache-2.0. No external material library.
+use crate::appearance_pack::{Category, GlassBoundary, GlassRecipe, OpaqueRecipe, TextureAxis, TextureRecipe, VisualPreset};
+
+const WOOD: &str = "Uniform opaque preview only; grain resources/mapping are not applied";
+const SOLAR: &str = "Uniform opaque preview only; no cell grid, busbars, electricity or efficiency claim";
+const REGOLITH: &str = "Uniform opaque preview only; no granular displacement or measured lunar optical data";
+const OPAQUE: &str = "Illustrative opaque isotropic PBR; no measured alloy, polymer or engineering properties";
+
+const fn look(color: [u8; 3], metallic: f64, roughness: f64, dielectric_ior: f64) -> OpaqueRecipe {
+    OpaqueRecipe { color, metallic, roughness, dielectric_ior }
+}
+const fn maps(id: &'static str, repeat_mm: [f64; 2], grain: bool) -> Option<TextureRecipe> {
+    Some(TextureRecipe { id, repeat_mm, grain_axis: if grain { Some(TextureAxis::V) } else { None } })
+}
+const fn glass(transmission_linear_rgb: [f64; 3], ior: f64, reference_path_mm: f64, boundary: GlassBoundary) -> GlassRecipe {
+    GlassRecipe { transmission_linear_rgb, dielectric_ior: ior, reference_path_mm, boundary }
+}
+
+pub const STARTER_PACK: [VisualPreset; 40] = [
+    VisualPreset::opaque(
+        "starter.wood.oak-honey",
+        "Wood - Honey Oak Uniform Preview",
+        Category::Wood,
+        look([190, 145, 88], 0.0, 0.64, 1.5),
+        WOOD,
+        maps("starter.wood.oak-honey.maps-v1", [120.0, 240.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.oak-smoked",
+        "Wood - Smoked Oak Uniform Preview",
+        Category::Wood,
+        look([91, 72, 55], 0.0, 0.68, 1.5),
+        WOOD,
+        maps("starter.wood.oak-smoked.maps-v1", [120.0, 240.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.walnut-dark",
+        "Wood - Dark Walnut Uniform Preview",
+        Category::Wood,
+        look([99, 66, 43], 0.0, 0.60, 1.5),
+        WOOD,
+        maps("starter.wood.walnut-dark.maps-v1", [100.0, 220.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.maple-light",
+        "Wood - Light Maple Uniform Preview",
+        Category::Wood,
+        look([221, 192, 141], 0.0, 0.57, 1.5),
+        WOOD,
+        maps("starter.wood.maple-light.maps-v1", [100.0, 200.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.cherry-warm",
+        "Wood - Warm Cherry Uniform Preview",
+        Category::Wood,
+        look([164, 99, 65], 0.0, 0.58, 1.5),
+        WOOD,
+        maps("starter.wood.cherry-warm.maps-v1", [110.0, 220.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.ash-pale",
+        "Wood - Pale Ash Uniform Preview",
+        Category::Wood,
+        look([209, 186, 146], 0.0, 0.70, 1.5),
+        WOOD,
+        maps("starter.wood.ash-pale.maps-v1", [120.0, 260.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.birch-cream",
+        "Wood - Cream Birch Uniform Preview",
+        Category::Wood,
+        look([228, 206, 163], 0.0, 0.63, 1.5),
+        WOOD,
+        maps("starter.wood.birch-cream.maps-v1", [100.0, 200.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.wood.teak-golden",
+        "Wood - Golden Teak Uniform Preview",
+        Category::Wood,
+        look([167, 122, 66], 0.0, 0.61, 1.5),
+        WOOD,
+        maps("starter.wood.teak-golden.maps-v1", [110.0, 250.0], true),
+    ),
+    VisualPreset::opaque(
+        "starter.metal.carbon-steel-polished",
+        "Metal - Polished Carbon Steel",
+        Category::Metal,
+        look([161, 166, 173], 1.0, 0.16, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.stainless-soft-satin",
+        "Metal - Soft Satin Stainless",
+        Category::Metal,
+        look([187, 193, 201], 1.0, 0.36, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.aluminum-bead-blast",
+        "Metal - Bead Blast Aluminum",
+        Category::Metal,
+        look([195, 201, 210], 1.0, 0.58, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.aluminum-silver-polish",
+        "Metal - Silver Polish Aluminum",
+        Category::Metal,
+        look([218, 224, 232], 1.0, 0.13, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.copper-aged-warm",
+        "Metal - Warm Aged Copper",
+        Category::Metal,
+        look([171, 95, 57], 1.0, 0.48, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.brass-champagne",
+        "Metal - Champagne Satin Brass",
+        Category::Metal,
+        look([205, 173, 102], 1.0, 0.32, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.bronze-dark-cast",
+        "Metal - Dark Cast Bronze",
+        Category::Metal,
+        look([133, 95, 58], 1.0, 0.66, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.titanium-matte",
+        "Metal - Matte Gray Titanium",
+        Category::Metal,
+        look([147, 149, 157], 1.0, 0.53, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.gold-warm",
+        "Metal - Warm Reflective Gold",
+        Category::Metal,
+        look([235, 190, 82], 1.0, 0.18, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.metal.silver-cool",
+        "Metal - Cool Reflective Silver",
+        Category::Metal,
+        look([225, 230, 237], 1.0, 0.12, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.abs-charcoal",
+        "Plastic - Charcoal ABS",
+        Category::Plastic,
+        look([43, 45, 48], 0.0, 0.44, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.abs-warm-white",
+        "Plastic - Warm White ABS",
+        Category::Plastic,
+        look([232, 229, 220], 0.0, 0.40, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque("starter.plastic.pla-coral", "Plastic - Coral PLA", Category::Plastic, look([218, 99, 83], 0.0, 0.43, 1.5), OPAQUE, None),
+    VisualPreset::opaque(
+        "starter.plastic.petg-cyan-opaque",
+        "Plastic - Opaque Cyan PETG",
+        Category::Plastic,
+        look([36, 148, 167], 0.0, 0.29, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.nylon-ivory",
+        "Plastic - Ivory Nylon",
+        Category::Plastic,
+        look([220, 213, 190], 0.0, 0.62, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.pc-graphite-opaque",
+        "Plastic - Opaque Graphite PC",
+        Category::Plastic,
+        look([70, 76, 84], 0.0, 0.27, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.hdpe-natural-opaque",
+        "Plastic - Opaque Natural HDPE",
+        Category::Plastic,
+        look([221, 222, 207], 0.0, 0.48, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque("starter.plastic.pom-black", "Plastic - Black POM", Category::Plastic, look([29, 31, 35], 0.0, 0.32, 1.5), OPAQUE, None),
+    VisualPreset::opaque(
+        "starter.plastic.tpu-matte-black",
+        "Plastic - Matte Black TPU",
+        Category::Plastic,
+        look([31, 30, 32], 0.0, 0.83, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::opaque(
+        "starter.plastic.peek-amber-opaque",
+        "Plastic - Opaque Amber PEEK",
+        Category::Plastic,
+        look([157, 119, 62], 0.0, 0.51, 1.5),
+        OPAQUE,
+        None,
+    ),
+    VisualPreset::glass(
+        "starter.glass.clear-soda-lime",
+        "Glass Recipe - Clear Soda Lime",
+        glass([0.92, 0.98, 0.96], 1.52, 3.0, GlassBoundary::Closed),
+    ),
+    VisualPreset::glass("starter.glass.low-iron-clear", "Glass Recipe - Low Iron Clear", glass([0.98, 0.99, 1.0], 1.50, 4.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.smoky-neutral", "Glass Recipe - Smoky Neutral", glass([0.35, 0.38, 0.42], 1.52, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.amber-tint", "Glass Recipe - Amber Tint", glass([0.84, 0.38, 0.08], 1.51, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass("starter.glass.cobalt-blue", "Glass Recipe - Cobalt Blue", glass([0.06, 0.14, 0.76], 1.53, 3.0, GlassBoundary::Closed)),
+    VisualPreset::glass(
+        "starter.glass.thin-clear",
+        "Glass Recipe - Thin Clear Sheet",
+        glass([0.95, 0.98, 0.99], 1.50, 2.0, GlassBoundary::Thin { thickness_mm: 2.0 }),
+    ),
+    VisualPreset::opaque(
+        "starter.solar.mono-blue",
+        "Solar Panel - Mono Blue Uniform Preview",
+        Category::Solar,
+        look([20, 41, 85], 0.0, 0.20, 1.5),
+        SOLAR,
+        maps("starter.solar.mono-blue.maps-v1", [160.0, 160.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.solar.thin-film-dark",
+        "Solar Panel - Dark Thin Film Uniform Preview",
+        Category::Solar,
+        look([28, 33, 42], 0.0, 0.28, 1.5),
+        SOLAR,
+        maps("starter.solar.thin-film-dark.maps-v1", [100.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.mare-charcoal",
+        "Regolith - Mare Charcoal Uniform Preview",
+        Category::Regolith,
+        look([56, 56, 55], 0.0, 0.97, 1.5),
+        REGOLITH,
+        maps("starter.regolith.mare-charcoal.maps-v1", [200.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.highland-pale",
+        "Regolith - Highland Pale Uniform Preview",
+        Category::Regolith,
+        look([116, 113, 106], 0.0, 0.93, 1.5),
+        REGOLITH,
+        maps("starter.regolith.highland-pale.maps-v1", [200.0, 200.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.dust-neutral",
+        "Regolith - Neutral Dust Uniform Preview",
+        Category::Regolith,
+        look([86, 85, 81], 0.0, 1.0, 1.5),
+        REGOLITH,
+        maps("starter.regolith.dust-neutral.maps-v1", [150.0, 150.0], false),
+    ),
+    VisualPreset::opaque(
+        "starter.regolith.agglutinate-dark",
+        "Regolith - Dark Agglutinate Uniform Preview",
+        Category::Regolith,
+        look([66, 63, 60], 0.0, 0.89, 1.5),
+        REGOLITH,
+        maps("starter.regolith.agglutinate-dark.maps-v1", [200.0, 200.0], false),
+    ),
+];

assets/icons/app/shared/source/app_icon.rs

@@ -1,88 +1,93 @@
-//! Original SolidCraft mark, shared by desktop, packaging and CLI.
+//! Original SolidCraft mark, shared by desktop, packaging and CLI: the borderless mark, five
+//! faces with transparent gaps between them, drawn from the macOS icon's
+//! `macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg`.
+type P = (f32, f32);
+
+/// One face in that SVG's units: its outline, and its linear gradient from one point and
+/// colour to another.
+struct Face {
+    outline: &'static [P],
+    from: (P, [u8; 3]),
+    to: (P, [u8; 3]),
+}
+
+const FACES: [Face; 5] = [
+    // Inner side of the upper step.
+    Face {
+        outline: &[(547.883, 282.66), (709.797, 188.211), (709.797, 375.985)],
+        from: ((619.14, 179.734), [29, 99, 198]),
+        to: ((694.687, 396.761), [21, 73, 158]),
+    },
+    // Top of the lower step.
+    Face {
+        outline: &[(727.797, 593.626), (727.797, 407.136), (889.571, 500.381)],
+        from: ((619.14, 413.244), [69, 159, 255]),
+        to: ((790.839, 605.547), [35, 121, 231]),
+    },
+    // Right face, with the recess.
+    Face {
+        outline: &[(530.0, 521.17), (691.797, 427.912), (691.797, 655.928), (907.594, 531.545), (907.594, 740.159), (530.0, 957.8)],
+        from: ((632.876, 399.508), [27, 102, 207]),
+        to: ((783.971, 968.175), [18, 69, 150]),
+    },
+    // Left face, stepped.
+    Face {
+        outline: &[(116.406, 510.769), (116.406, 303.529), (494.0, 521.17), (494.0, 957.8), (314.203, 854.167), (314.203, 624.777)],
+        from: ((207.063, 303.357), [37, 141, 245]),
+        to: ((426.837, 968.175), [20, 97, 218]),
+    },
+    // Top of the extruded profile.
+    Face {
+        outline: &[(134.374, 272.334), (512.0, 53.364), (691.828, 157.015), (476.117, 282.846), (673.752, 396.761), (512.0, 489.993)],
+        from: ((385.63, 53.364), [81, 173, 255]),
+        to: ((522.989, 510.769), [43, 131, 241]),
+    },
+];
+
+/// The mark's extent in SVG units: left, top, width, height.
+const BOUNDS: (f32, f32, f32, f32) = (116.406, 53.364, 791.188, 904.436);
+
 /// This block is the icon image data
 pub fn rgba(size: usize) -> Result<Vec<u8>, String> {
     if !(1..=2048).contains(&size) {
         return Err("icon size must be 1..=2048".into());
     }
-    type P = (f32, f32);
     // Coverage buffer at 4x4 samples per pixel (2x2 for big sizes), averaged down at the end.
     let ss = if size > 512 { 2 } else { 4 };
     let n = size * ss;
     let mut buf = vec![[0u8; 4]; n * n];
-    let s = n as f32 / 412.217; // SVG units -> samples: the logo fills the height
-    let ox = (n as f32 - 357.0 * s) / 2.0; // and is centred sideways
-    // Fill a convex polygon given in SVG units.
-    let mut fill = |pts: &[P], col: [u8; 3]| {
-        let v: Vec<P> = pts.iter().map(|p| (ox + p.0 * s, p.1 * s)).collect();
+    let (bx, by, bw, bh) = BOUNDS;
+    let s = n as f32 / bh; // SVG units -> samples: the mark fills the height
+    let (ox, oy) = ((n as f32 - bw * s) / 2.0 - bx * s, -by * s); // and is centred sideways
+    // Fill each face's outline (even-odd spans per row, so concave outlines work) with its gradient.
+    for face in &FACES {
+        let v: Vec<P> = face.outline.iter().map(|p| (ox + p.0 * s, oy + p.1 * s)).collect();
+        let (((fx, fy), c0), ((tx, ty), c1)) = (face.from, face.to);
+        let (gx, gy) = (tx - fx, ty - fy);
+        let g2 = gx * gx + gy * gy;
         let (top, bottom) = v.iter().fold((f32::MAX, f32::MIN), |(a, b), p| (a.min(p.1), b.max(p.1)));
+        let mut xs = Vec::with_capacity(v.len());
         for y in ((top - 0.5).ceil() as i32).max(0)..=((bottom - 0.5).floor() as i32).min(n as i32 - 1) {
             let cy = y as f32 + 0.5;
-            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
+            xs.clear();
             for i in 0..v.len() {
                 let (a, b) = (v[i], v[(i + 1) % v.len()]);
                 if (a.1 <= cy) != (b.1 <= cy) {
-                    let x = a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0);
-                    lo = lo.min(x);
-                    hi = hi.max(x);
+                    xs.push(a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0));
                 }
             }
-            if lo > hi {
-                continue;
-            }
-            for x in ((lo - 0.5).ceil() as i32).max(0)..=((hi - 0.5).floor() as i32).min(n as i32 - 1) {
-                buf[y as usize * n + x as usize] = [col[0], col[1], col[2], 255];
+            xs.sort_by(f32::total_cmp);
+            for &[from, to] in xs.as_chunks::<2>().0 {
+                for x in ((from - 0.5).ceil() as i32).max(0)..=((to - 0.5).floor() as i32).min(n as i32 - 1) {
+                    // The sample's place along the gradient, in SVG units.
+                    let (px, py) = ((x as f32 + 0.5 - ox) / s, (cy - oy) / s);
+                    let t = (((px - fx) * gx + (py - fy) * gy) / g2).clamp(0.0, 1.0);
+                    let mix = |k: usize| (f32::from(c0[k]) + (f32::from(c1[k]) - f32::from(c0[k])) * t).round() as u8;
+                    buf[y as usize * n + x as usize] = [mix(0), mix(1), mix(2), 255];
+                }
             }
         }
-    };
-    // Faces: each is a few overlapping convex pieces (the filler only does convex shapes).
-    let (light, mid, dark) = ([96, 158, 236], [58, 136, 238], [55, 108, 197]);
-    fill(&[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)], light);
-    fill(&[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], light);
-    fill(&[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)], mid);
-    fill(&[(3.5, 105.9), (3.5, 205.7), (90.3, 256.2), (177.0, 206.1)], mid);
-    fill(&[(177.0, 206.1), (90.3, 256.2), (90.0, 356.2), (177.0, 406.4)], mid);
-    fill(&[(264.1, 155.8), (177.0, 206.1), (177.0, 406.4), (263.8, 256.2)], dark);
-    fill(&[(263.8, 256.2), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], dark);
-    fill(&[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)], dark);
-    fill(&[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)], dark);
-    // White edge lines, 10 units wide: a rectangle per segment and a disc at each inner corner.
-    let white = [255, 255, 255];
-    let mut stroke = |pts: &[P], closed: bool| {
-        let m = pts.len();
-        for i in 0..(if closed { m } else { m - 1 }) {
-            let (a, b) = (pts[i], pts[(i + 1) % m]);
-            let l = ((b.0 - a.0).powi(2) + (b.1 - a.1).powi(2)).sqrt();
-            let (nx, ny) = (-(b.1 - a.1) / l * 5.0, (b.0 - a.0) / l * 5.0);
-            fill(&[(a.0 + nx, a.1 + ny), (b.0 + nx, b.1 + ny), (b.0 - nx, b.1 - ny), (a.0 - nx, a.1 - ny)], white);
-        }
-        for c in &pts[if closed { 0 } else { 1 }..if closed { m } else { m - 1 }] {
-            let disc: Vec<P> = (0..16)
-                .map(|k| {
-                    let t = k as f32 * std::f32::consts::TAU / 16.0;
-                    (c.0 + 5.0 * t.cos(), c.1 + 5.0 * t.sin())
-                })
-                .collect();
-            fill(&disc, white);
-        }
-    };
-    stroke(&[(263.8, 55.9), (177.1, 105.9), (263.8, 156.0), (263.8, 256.2), (350.6, 206.1)], false);
-    stroke(&[(5.0, 105.9), (178.5, 206.1), (178.5, 406.4)], false);
-    stroke(&[(177.0, 206.1), (263.8, 156.0)], false);
-    stroke(
-        &[
-            (178.5, 5.8),
-            (5.0, 105.9),
-            (5.0, 206.1),
-            (91.7, 256.2),
-            (91.7, 356.4),
-            (178.5, 406.4),
-            (352.0, 306.3),
-            (352.0, 206.1),
-            (265.2, 156.0),
-            (265.2, 55.9),
-        ],
-        true,
-    );
+    }
     // Average each ss x ss block down to one pixel (straight alpha = covered share).
     let mut rgba = Vec::with_capacity(size * size * 4);
     for y in 0..size {
@@ -123,4 +128,20 @@ mod tests {
         assert!(super::rgba(0).is_err());
         assert!(super::rgba(2049).is_err());
     }
+
+    /// Borderless: no white edge lines, and the gaps between faces are see-through. At 256 px
+    /// the gap between the left and right faces (SVG x 494..530) is transparent on the row
+    /// through the middle of the mark, and no opaque pixel is white.
+    #[test]
+    fn shared_mark_is_borderless() {
+        let size = 256;
+        let pixels = super::rgba(size).expect("valid size");
+        let px = |x: usize, y: usize| pixels.as_chunks::<4>().0[y * size + x];
+        let s = size as f32 / 904.436;
+        let gap_x = ((size as f32 - 791.188 * s) / 2.0 + (512.0 - 116.406) * s) as usize;
+        let row = ((750.0 - 53.364) * s) as usize;
+        assert_eq!(px(gap_x, row)[3], 0, "the seam between the left and right faces is a gap");
+        assert!(px(gap_x - 8, row)[3] == 255 && px(gap_x + 8, row)[3] == 255, "faces on both sides of the gap");
+        assert!(pixels.as_chunks::<4>().0.iter().all(|p| p[3] == 0 || p[0] < 200), "no white edges");
+    }
 }

assets/icons/ui/README.md

@@ -91,7 +91,7 @@ Palette changes preserve accepted artwork and never update review hashes.
 | `source/` | Rust viewport glyphs, markers, navigation and pointer; not command icons |
 
 `crates/ui-egui/build.rs` embeds SVGs, palette and aliases. `icon_svg.rs` parses and
-rasterises them for `icons::paint`; adding an icon still requires its registry or
+rasterises them for `icons::paint_icon`; adding an icon still requires its registry or
 UI assignment and an application rebuild. Review status never controls rendering.
 
 ## Checks and reports

assets/icons/ui/RENDER_DRAFTS.md

@@ -0,0 +1,93 @@
+# Render workspace icon drafts
+
+All ids below are **Open** for owner review, except `render_scene` and `render_image`,
+which are existing accepted icons used only as references. No commands, toolbar
+entries, browser selectors or runtime request manifests are changed by this draft set.
+`render_remove_override` is the one remaining alias (of `render_from_material`);
+`render_execute`, `render_environment` and `render_fit_product` now have their own
+masters in `design/svg/model/`. Accepted source masters stay unchanged.
+
+Review with `python3 -B assets/icons/ui/design/tools/icon_status.py --serve`,
+search `render_`, and select Open. See [STYLE_GUIDE.md](STYLE_GUIDE.md) for
+acceptance; drafts do not imply implemented commands.
+
+The finished references in each row were read and previewed in both themes
+before authoring. Draft contact sheets (96, 24 and 16 px, both themes) are local
+review evidence, not shipped assets. The icons are grouped in five families, each
+with one shared design rule.
+
+## Lights
+
+Rule: a slate source glyph with light passive fill, 2.55-unit outlines and a dotted
+accent stem (three dots, 4.25 diameter, 7 units apart) showing the direction.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Light area | `render_light_area` | `box`, `camera` | Slanted flat panel on the canonical axes above the dotted stem. |
+| Light spot | `render_light_spot` | `camera`, `material` | Cone with a curved rim above the dotted stem. |
+| Light point | `render_light_point` | `camera`, `material` | Round source disc with a centre dot above the dotted stem. |
+| Sun | `render_sun` | `sphere`, `camera` | Source disc of the same size with eight short radial rays instead of a stem. |
+| Light by highlight | `render_light_by_highlight` | `sphere`, `material` | Shaded sphere with a ringed highlight target; the dotted stem arrives from above. |
+| Solo light | `render_solo_light` | `fit`, `camera` | Point source and stem inside four corner focus brackets. |
+
+## Looks
+
+Rule: the lit look sphere (top-left highlight, bottom-right shade) plus one cue that
+says what happens to it; receiving bodies stay canonical grey or cube shapes.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Appearance | `render_appearance` | `material`, `box` | Shaded look sphere on the top corner of an accent-shaded cube: a look assigned to a body. |
+| Paint | `render_paint` | `material`, `paste` | Flat brush with an accent tip, light ferrule and slate handle. |
+| Pick up | `render_pick_up` | `material`, `copy` | Eyedropper with a grey bulb, slate crossbar and accent sampling tip. |
+| Replace all | `render_replace_all` | `copy`, `box` | Grey sample sphere with an arrow to an accent sphere, beside a second accent sphere. |
+| Copy look | `render_copy_look` | `material`, `copy` | Look sphere in a square frame, offset from a second frame outline. |
+| Remove override | `render_remove_override` | `appearance`, `box` | Alias of `render_from_material`: the custom look is crossed off. |
+| Same look | `render_same_look` | `select`, `box` | Look sphere and three cubes; the two matching cubes are ringed. |
+| From material | `render_from_material` | `material`, `extrude` | Look sphere struck through above a plain grey slab, so the material shows. |
+
+## Studio
+
+Rule: the standard grey cube stands in the set-up it is lit or placed in.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Library | `render_library` | `library`, `copy` | Row of three look spheres, the middle one accent, on a shelf bar. |
+| Lighting presets | `render_lighting_presets` | `new`, `render_scene` | Two stacked cards, the front one holding a light bulb. |
+| Environment | `render_environment` | `environment_map`, `render_scene` | Dome with a grey cube inside. |
+| Ground | `render_ground` | `box`, `render_scene` | Grey cube on a slab with an accent contact patch. |
+| Backdrop | `render_backdrop` | `render_scene`, `render_image` | Grey cube in front of a tall upright accent panel. |
+
+## Camera and shots
+
+Rule: one chunky camera body with a lower-right round badge for shot actions; the
+other camera icons are simple frames.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Shot | `render_shot` | `camera`, `new` | Camera body with a plus badge: save a shot. |
+| Update shot | `render_update_shot` | `camera`, `undo` | Camera body with a refresh badge. |
+| Render all shots | `render_all_shots` | `copy`, `render_image` | Stacked camera bodies with a play badge. |
+| Shots strip | `render_shots_strip` | `camera`, `copy` | Strip of three small frames, the middle one in accent. |
+| Fit product | `render_fit_product` | `fit`, `camera` | Grey cube inside four corner brackets. |
+| Lens / field of view | `render_lens` | `camera`, `fit` | Concentric lens rings around an accent centre. |
+| Exposure | `render_exposure` | `material`, `environment_map` | Disc split light and accent, with plus and minus marks. |
+| Aspect frame | `render_aspect_frame` | `render_image`, `fit` | Wide rounded frame with two opposite corner brackets. |
+| Frame guides | `render_frame_guides` | `render_image`, `fit` | Rounded frame with a rule-of-thirds grid and four accent nodes. |
+
+## Output and result
+
+Rule: one picture base (frame with landscape) with a lower-right round badge; the
+size, background and quality icons draw their own simple subject.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Render image | `render_execute` | `render_image`, `camera` | Picture with a play badge: create a rendered image. |
+| Render output size | `render_output_size` | `render_image`, `fit` | Picture frame with a diagonal double-headed dimension arrow. |
+| Transparent background | `render_transparent_background` | `material`, `render_image` | Grey cube on a checker tile. |
+| Quality | `render_quality` | `list`, `library` | Three rising bars, the tallest in accent. |
+| Check render | `render_check` | `render_image`, `new` | Picture with a check badge. |
+| Cancel render | `render_cancel` | `render_image`, `delete` | Picture with a square stop badge. |
+| Export image | `render_export_image` | `render_image`, `copy` | Picture with a large outward diagonal arrow at the upper right. |
+| Compare | `render_compare` | `render_image`, `material` | Two grey pictures split by a vertical slider with opposed arrows. |
+| Results | `render_results` | `render_image`, `copy` | Stack of two pictures, the front one showing a landscape. |

assets/icons/ui/STYLE_GUIDE.md

@@ -78,7 +78,7 @@ Its projected circle uses the same axes; do not arbitrarily flatten the ellipse.
 
 Only use the stable `source` identifiers below in model SVGs. The renderer maps roles to
 light/dark theme values. `currentColor` is the background line-art role, not a way
-to add arbitrary colours. All values and accents come from `design/palette.toml`.
+to add arbitrary colours. Default display values and semantic accents come from `design/palette.toml`. Theme files may override those display roles and ramps through `icon_palette`; source identifiers and accent assignments stay unchanged.
 
 | Role | Author helper | Light value | Use |
 | --- | --- | --- | --- |
@@ -96,9 +96,9 @@ The source hexes identify paint roles, not the displayed colour. **Never recolou
 SVG to apply a workspace accent.** Keep these identifiers and every finished shape
 unchanged; the runtime and review page resolve them through `design/palette.toml`.
 
-That file is the single colour authority: edit `light`/`dark` in the relevant
+That file is the default colour authority: edit `light`/`dark` in the relevant
 `accents` ramp; `active-3` is its primary stroke and `active-1/2` are shaded faces.
-Do not edit a role's `source` identifier. `variants` holds colour-vision adjustments.
+Do not edit a role's `source` identifier. Theme `icon_palette` overrides affect display colours only; colour-vision variants still take precedence. `variants` holds colour-vision adjustments.
 A role with `use = "active-3"` follows that stroke automatically.
 
 | Meaning | Accent | Assignment |

assets/icons/ui/design/aliases.toml

@@ -29,6 +29,7 @@ ground = "c_fix"
 
 # Same finished drawing, different semantic operation. Colours live only in palette.toml.
 sketch_break = { master = "break", accent = "sketch" }
+sketch_cancel = { master = "close", accent = "sketch" }
 sketch_dxf = { master = "dxf", accent = "sketch" }
 sketch_move = { master = "move", accent = "sketch" }
 sketch_scale = { master = "scale", accent = "sketch" }
@@ -44,3 +45,7 @@ sketch_chamfer_equal = { master = "sketch_chamfer", accent = "sketch" }
 sketch_chamfer_two = { master = "sketch_chamfer_two_distances", accent = "sketch" }
 offset_one_side = { master = "offset", accent = "sketch" }
 bom = "list"
+
+# Render workspace drafts: shared meanings; owner review remains Open.
+# Removing a look override returns the body to its material look.
+render_remove_override = "render_from_material"

assets/icons/ui/design/palette.toml

@@ -48,6 +48,38 @@ source = "#236ead"
 light = "#236ead"
 dark  = "#2976b8"
 
+# Simultaneous component colours for inspection icons; existing workspace ramps stay unchanged.
+
+[roles.component-orange-1]
+source = "#f1d2af"
+light = "#f1d2af"
+dark = "#ba8f6a"
+
+[roles.component-orange-2]
+source = "#c06f00"
+light = "#c06f00"
+dark = "#b86f04"
+
+[roles.component-orange-3]
+source = "#a45000"
+light = "#a45000"
+dark = "#95682d"
+
+[roles.component-yellow-1]
+source = "#e5d99b"
+light = "#e5d99b"
+dark = "#a9985f"
+
+[roles.component-yellow-2]
+source = "#a28200"
+light = "#a28200"
+dark = "#9a8100"
+
+[roles.component-yellow-3]
+source = "#826700"
+light = "#826700"
+dark = "#857100"
+
 [strokes]          # on the 64 grid
 geometry = 2.55
 action = 4.25

assets/icons/ui/design/requested_icons.txt

@@ -57,10 +57,13 @@ circle_tt	false
 circle_ttt	false
 close	false
 coil	false
+colored_components	false
+colored_components_off	false
 combine	false
 compare	false
 component	false
 compute	false
+cone	false
 configuration_table	false
 conic	false
 constrainer	false
@@ -104,6 +107,7 @@ flange	false
 flat	false
 fold	false
 folder	false
+frame_member	false
 gear	false
 graph	false
 ground	false
@@ -141,18 +145,14 @@ new	false
 normal	false
 offset	false
 offset_face	false
-offset_one_side	false
-offset_symmetric	false
-offset_two_sides	false
 open	false
 orbit	false
 origin	false
 pan	false
 params	false
 paste	false
-pattern_center	false
+path_flange	false
 pattern_circ	false
-pattern_flip	false
 pattern_path	false
 pattern_rect	false
 perforate	false
@@ -208,12 +208,15 @@ scale	false
 screw	false
 section	false
 select	false
+send	false
 settings	false
 sheet_rules	false
 shell	false
+shield	false
 silhouette	false
 sketch	false
 sketch_break	false
+sketch_cancel	false
 sketch_chamfer	false
 sketch_chamfer_angle	false
 sketch_chamfer_equal	false
@@ -242,8 +245,10 @@ split_face	false
 spun	false
 star	false
 status_error	false
+status_recovery	false
 style	false
 suppress	false
+surface	false
 surface_blend	false
 surface_boundary	false
 surface_extend	false

assets/icons/ui/design/review.json

@@ -101,6 +101,7 @@
   "error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
   "explode": "2aecb05d5f05aff1ab629066cb9bea8718ea213ac70948ef71a3ced3321f4cb2",
   "export": "c8c2abf007e43e896479d78798e3976ba9eda809507c820bb38538f77db696ac",
+  "export_tray": "f18606e1f63726c57a0787dced4fb8a221b4a4fc18b88b0bbdee743e546cb489",
   "extend": "28c63df352c77d02feffe44cf09fb0fc1d48f7905aaabbfa6dba601dbb70f8e8",
   "extrude": "9cc1538971c5d25467aaed23f739899d9d102fd07f86472ac3197c54ca2e1144",
   "eye": "2449167c8410826dc1106b687c12a309d5bea8f7817b897943e80f182a163c2d",
@@ -122,6 +123,7 @@
   "hole": "f82d47751f826e08682db847a270897474661bfe9f35b6d3678f49a203172563",
   "home": "ab5f1c41d377687e4c5a808dfdccf2757b33dd43f934d44df43d6e9118176853",
   "import": "e343540eb49fdb1e53c4d54b9e60ae513b3103df6c9133048bed878e58067455",
+  "import_tray": "c6aec9556dc8ecb6c953d6bf1f384f220c68167a92e444950c24ded81f66a0b6",
   "include": "f5b80ad3e06e3b863fcfbe415ec912e4e09653dd519f9ac207819339fe34730f",
   "infinite": "53fb781131078d2f8e71be23aa610d9f9d9c8bb79ba5f97fa397475e9ff8c3bd",
   "inspect": "d2b4644b2d5f1aa50cb576b9265e275fa91201e296c2bc79865f810067d538e9",
@@ -206,8 +208,45 @@
   "redo": "28e925493fa9e5f52e2c8e3beeb288af13fdb4f85f3cd92270096a10561e7a1a",
   "refold": "1fa6a8604af7d04c01bc31d0e5875eb2cc91f5fa6bfc5491dd6680d3299eb26f",
   "rename": "6887c5467101dca1d213154020d3b03be9b2704ac310de9d0a8ebde62c013bf5",
+  "render_all_shots": "9c04f49624cc2685472041cb3f3e95da2c5f32deeebb9723f4a8e3c369680a5b",
+  "render_appearance": "53287b30915a266d8a3858d5bef24b93ed11f8d612c20c445d3032f400a925cc",
+  "render_aspect_frame": "5d74b263eeb03eb0494b3774817135b8f119caff205a8b31c480d7dd0e5a8554",
+  "render_backdrop": "d27f7d6da7a31c5944dd0ff67c21838690f000f2d87b0bf5274bef0744de34ce",
+  "render_cancel": "2f1d8b3039007ccfc224390758e05d6202fa2eabf63724c744217dcab5d58e5e",
+  "render_check": "65ccf0407d80937c6931cbf87b6d0e628cfb62ca3e841483d02dd9de19c3717c",
+  "render_compare": "1b2d3f3920782490b96b4d14a7cc9506eff98ff2efae00f86d911fabcabc7cb0",
+  "render_copy_look": "25e9138a839a7e6b8225b48cd2f36daba42a928eff541fe616f3df39a1bc82b7",
+  "render_environment": "50cb18380d9310f6e04084c24ac85529599966b1d90c6bef514f4e63f9b30854",
+  "render_execute": "e4d9a66f4569e00c4b4b2ac05a80a9f3eba4e59802c62d3af5bb951ba9153cbf",
+  "render_export_image": "2456f55fa3b50ab84ae871963d4a6b6e92f486cf6ed3039f3a2f07f11192a655",
+  "render_exposure": "60eb5fa040aefe872ab2de66099493513a494ab758a23d443753d033eaf3a05d",
+  "render_fit_product": "8e58b293a39a06fca4cda0543adc2afef3d0041fe34b0bc0c800afb2d5635123",
+  "render_frame_guides": "cb1df01051de42047e38de9dd2a96fcb5b67bd5979cb5756412890400b69e5bc",
+  "render_from_material": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_ground": "2b900b433870cbc4bd0282e54c604ec696aa28354c753a13b09806f5e87d99c3",
   "render_image": "e3dd622591de4fdc211f9bd3c6dcb54b01a308e8bcebd02bb80dd6b3982ce2a5",
+  "render_lens": "79bb615d46a05ea5ffc9e2e905cc25f266b3b7e761c160f7d25bbdb3dea0a430",
+  "render_library": "828af74034a62616c774ab0cbe70b7cf9fd42778b574febfb1812f8aa17fd49b",
+  "render_light_area": "b1f3ee596ee1d35f6e8444b54e94f36a34c2129697c88e5286dbf38565f50816",
+  "render_light_by_highlight": "5b37c8c6aa27ac2002dd8c8094e415c64e9eb315a55c4f146e328314e8f639a2",
+  "render_light_point": "a602cb5fa26f04f1bb9be7c14e5a9a9ce52b37550dfd3211a55e915f941f5803",
+  "render_light_spot": "a9413de906266bec0165b4cb06ecac8e36dce0b6ddec4bc4cc6ff4f152601483",
+  "render_lighting_presets": "e0a08433f548a9dd139296107b04b1d4c57ff04303c9bee32d896e2ea06a8d07",
+  "render_output_size": "f08fe354e4d5a6dd21af29cb077ceed96c413c68f48d9f72548ae1614337f88b",
+  "render_paint": "e3d3202205a5a90906348cae519340d38f475e42039a7f60c835cf7a21081da1",
+  "render_pick_up": "df67d10f333a3c9e367897d599a4be510f10ed36c24763c26817f22d24ff35b7",
+  "render_quality": "28fe44cdd2b2f58b91d91dcf20a6dfbd22cf3db6008e1db179717523ecc4889e",
+  "render_remove_override": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_replace_all": "3bbf830619a91be186b9dc91726b8e47c293556d2ac8c93d87c71014c9f3abcd",
+  "render_results": "94e78898d88eef415e56ca5ec1e056089a2a5aa709abc69e5b8103d6096a019c",
+  "render_same_look": "2b5c69c523a1c949c22638c378803e77123095fddd36cfa58e94b2fd91ca61d7",
   "render_scene": "1c4d7350f6f17ad637a7d633cb65a64c298af20321b1dbdac01b51d47a0e2822",
+  "render_shot": "4428080faa94f276c8a1d20eb38d04835ee5ae9d6337402371a5edf09f97ddc5",
+  "render_shots_strip": "1dcf5cc8e704691985284e0ca06e03b22540ea9d4cd23f4fb8675801ae7e69ec",
+  "render_solo_light": "abb9f8993be108a79d491bfaca32cde59d07a69db3ead58195e8ca0d8e8d909b",
+  "render_sun": "d86b51f3d4d83df4e932a22bb20d567513529a2eaaa42b93f744412eed2be901",
+  "render_transparent_background": "71dab4763516053734d4eec964b0899716d617597fe0d09e3bfa0cc36224dd7a",
+  "render_update_shot": "22d82ad332f8325395596c4bec4c1ec9bbb72d9fc4cd62ad658a93d7f5f803b9",
   "reorder": "c45755c8f23575415397bffb316eed9f2d8c014f451ab6f8c3123aca1a99b675",
   "replace_face": "fcee556c684a1138a30a2574ea565c98ff29f9368c2e861d0fb861155a57d28b",
   "rest": "eab64961b5340bdbbd92affe0c9b8477dc297a3b49e05e39d5fa71c0f2fda66c",
@@ -224,10 +263,17 @@
   "screw": "5e30570785360d6a591ea22862a82f1cf62228385c1e96382536db8a453ac791",
   "section": "cdd13f99f15f6d59bfa21c747810608d6afd00cb8207faf0337928c8521e7eae",
   "select": "fdf6431270006ca7409c60c37cfed59572de04229f104ec723e6010ffa2b7163",
+  "send": "f83b6cdab792f9567a81d46d7828ed20795513c57a2c7d00fbbe6bd14d2f5848",
   "settings": "9193dd3a1007c43660d0d47b6499cb2571338b67949e1a99df112057b9bf2b8a",
+  "settings_keyboard": "4968c70788094365af9c6e2b1c15b2aac45cf21212a14b8a256daf1ffe17f41a",
+  "settings_monitor": "6fcea26e2fc1673c76c6e7fadac4a91812ed43250cfb363c4f40c0cacfbd7aa5",
+  "settings_mouse": "47754752ea6fb37ec9686c0460740935a4db30fb267f1136a9246aec9a17b3f1",
+  "settings_palette": "a060015a750ff4367c65c04b83bf43720e13a38d8dee35330e1d8880f89eaa22",
+  "settings_plug": "79c00b84b2d1d28e3bf6096639c75476b7e1ee0a326c34ad76a79ad866c0102e",
   "sheet": "774e30923ef6f37dd9c0b2bc3e45705e83b3a76700bf071cd41155a365d0daa4",
   "sheet_rules": "5d3a2f37d3b4a4262b3ddbdae53d61f29e0f8e284dd54006da25a7acebfa1114",
   "shell": "a1959ea0d0441a479bf654b6e549e2e44a0bfdc9cda4eb46fe1fbfd884de7e38",
+  "shield": "5e2d2d157309e0daa72f7c53073dfdb0a474def972a041cd172567f1d1e485ec",
   "silhouette": "2a848aed2f247b1c0439f830a34a513c93bc5493c40044c821d493d863ad996e",
   "sketch": "b52e5862b1709a9a7e3ca00d7436d126fbfc01b38080006fa4e17dc581dfa103",
   "sketch_break": "67a5fab332616e6d6a9aeae3bedc04ee0768179143ba34b795bdd98cea04bb24",
@@ -261,6 +307,7 @@
   "status_error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
   "status_warning": "1ac4f0ccfac2c01f6f66cb42188f9ae053c4aef9c5bbd249f1fb09611eb4d825",
   "stitch": "6c3205d64007b771ed78d6f8055867578439fb25d591563b32dbd3343c98732d",
+  "stop": "36967eb4d423370d0d6c679b0a71f8d09f4fb2c73eed3e8cc50c604c44b0c32b",
   "style": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
   "suppress": "c54fbc01c12c0175d78cd63f692e8aaf73fc2cac79752b2a3ad821ac32734343",
   "surface": "ba0e839ce0ee03e7ff95a2389a5ecb20bd80c713064d9b1bd5f461f4a80d1921",

assets/icons/ui/design/svg/flat/send.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Send message</title>
+  <path d="M32 51L32 13M17 28L32 13L47 28" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/settings_keyboard.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Keyboard shortcuts</title>
+  <path d="M13 16L51 16A5 5 0 0 1 56 21L56 43A5 5 0 0 1 51 48L13 48A5 5 0 0 1 8 43L8 21A5 5 0 0 1 13 16Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="20" cy="27" r="2.8" fill="currentColor"/>
+  <circle cx="32" cy="27" r="2.8" fill="currentColor"/>
+  <circle cx="44" cy="27" r="2.8" fill="currentColor"/>
+  <path d="M20 39L44 39" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/settings_monitor.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Graphics display</title>
+  <path d="M13 10L51 10A5 5 0 0 1 56 15L56 37A5 5 0 0 1 51 42L13 42A5 5 0 0 1 8 37L8 15A5 5 0 0 1 13 10ZM32 42L32 54M24 54L40 54" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/settings_mouse.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Mouse navigation</title>
+  <path d="M32 8A13 13 0 0 1 45 21L45 43A13 13 0 0 1 19 43L19 21A13 13 0 0 1 32 8ZM32 8L32 24" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>

assets/icons/ui/design/svg/flat/settings_palette.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Interface palette</title>
+  <path d="M32 8C18.75 8 8 18.75 8 32C8 45.25 18.75 56 32 56C37 56 39 52.5 36.5 49C34 45.5 36 42 40 42L45 42C51.1 42 56 37.1 56 31C56 19 45 8 32 8Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="21" cy="29" r="2.8" fill="currentColor"/>
+  <circle cx="29" cy="20" r="2.8" fill="currentColor"/>
+  <circle cx="41" cy="23" r="2.8" fill="currentColor"/>
+</svg>