Release 0.24.1

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.cargo/mutants.toml

@@ -0,0 +1,14 @@
+# cargo-mutants (docs/mutation-testing.md). Mutants are judged by the black-box suites that will
+# outlive the kernel backend: the reference tests (tests/oracle, through the oracle_cases test)
+# and the pull-request sample of the robustness goldens (every 8th seed, as ci.yml). The
+# kernel's own unit tests are left out on purpose: a mutant only they catch is a behaviour the
+# backend-neutral suites would miss when the kernel is swapped.
+profile = "mutants"
+additional_cargo_test_args = [
+    "--test", "oracle_cases", "--lib", "--", "--include-ignored",
+    "oracle_suite",
+    "robustness_goldens::seed_00", "robustness_goldens::seed_08", "robustness_goldens::seed_16",
+    "robustness_goldens::seed_24", "robustness_goldens::seed_32", "robustness_goldens::seed_40",
+    "robustness_goldens::seed_48", "robustness_goldens::seed_56", "robustness_goldens::seed_64",
+    "robustness_goldens::seed_72", "robustness_goldens::seed_80", "robustness_goldens::seed_88",
+]

.config/nextest.toml

@@ -0,0 +1,129 @@
+# cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
+# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml),
+# except the GPU path tracer's tests (the gpu-path group below), which run in four shards of their own.
+
+[profile.ci]
+# Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
+# every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`. The
+# boolean_props property tests run only nightly (ci.yml excludes them from pushes to main).
+# Keep this list in sync with docs/book/src/dev/testing.md and CONTRIBUTING.md.
+default-filter = """
+not (
+    (package(solidcraft-engine) & (
+        test(=tests::hostile_params_never_panic)
+        | test(/^tests::robustness::/)
+        | test(/^tests::robustness_goldens::seed_/)
+        | test(=pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen)
+        | test(=pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs)
+        | test(=cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall)
+    ))
+    | (package(solidcraft-kernel) & test(=tests::boolean_identity_on_tangent_primitives))
+    | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))
+    | (package(solidcraft-kernel) & binary(boolean_props))
+    | (package(solidcraft-engine) & binary(atomic_commands))
+    | (package(solidcraft-ui-egui) & binary(scenarios) & test(=acceptance_sensor_enclosure))
+)
+"""
+fail-fast = false
+# Every test's time in the log, so the slow ones are easy to find.
+status-level = "pass"
+final-status-level = "slow"
+failure-output = "immediate-final"
+slow-timeout = { period = "60s" }
+
+[profile.ci.junit]
+path = "junit.xml"
+
+# The action matrix sample runs its designs in parallel workers (ACTION_MATRIX_JOBS, set to match in
+# ci.yml). Its workers reserve that many of nextest's threads, so the cores are not oversubscribed
+# (a pi-case hole that takes 8 s alone went past the matrix's 90 s action limit when they were),
+# and it starts first, beside the other slow tests.
+[[profile.ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = 12
+priority = 100
+
+# The slowest tests start first, so a shard does not end with one of them running alone on a
+# core while the others sit idle (seed_81 alone takes about 20 minutes under CI load). Medians
+# from the CI test timings (the junit artifacts), slowest first; a test over ~100 s belongs here.
+[[profile.ci.overrides]]
+filter = """
+(package(solidcraft-engine) & (
+    test(/^tests::robustness_goldens::seed_(81|45|20|24|95|02|57|40|18|48|32|46|85|61)$/)
+    | test(/^tests::robustness::/)
+    | test(=tests::hostile_params_never_panic)
+    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
+    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
+    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
+    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
+    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
+    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
+))
+| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
+| (package(solidcraft-kernel) & (
+    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
+    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
+    | test(=tspline::tests::hostile_tsplines_never_panic)
+    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
+    | test(/^issue_788_tests::equal_bores_crossing_/)
+))
+"""
+priority = 100
+
+# Each nextest test has its own process/device. Concurrent cold lavapipe path
+# compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
+# Serialize this module per CI shard; other tests retain their normal parallelism.
+# CI runs these in their own job (GPU path tests in ci.yml), split into count partitions.
+[test-groups.gpu-path]
+max-threads = 1
+
+[[profile.ci.overrides]]
+filter = "package(=solidcraft-gpu) & test(/^path::/)"
+test-group = "gpu-path"
+
+# Full local validation opts into its own scheduling policy. Keep GitHub CI's
+# worker reservation and slow-test priorities above independent of this runner.
+[profile.local-ci]
+inherits = "ci"
+
+[[profile.local-ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = "num-cpus"
+priority = 100
+
+[[profile.local-ci.overrides]]
+filter = "(package(solidcraft-engine) & test(=tests::robustness_goldens::seed_81)) | (package(solidcraft-kernel) & test(=tspline::tests::hostile_tsplines_never_panic))"
+priority = 99
+
+[[profile.local-ci.overrides]]
+filter = """
+(package(solidcraft-engine) & (
+    test(/^tests::robustness_goldens::seed_(81|45|20|24|95|02|57|40|18|48|32|46|85|61)$/)
+    | test(/^tests::robustness::/)
+    | test(=tests::hostile_params_never_panic)
+    | test(=cmd::clearance::tests::distances_are_exact_on_edges_and_curved_faces)
+    | test(=cmd::clipboard::tests::a_pasted_coil_joins_the_pasted_body)
+    | test(=tests::pleat_join::the_pleats_join_at_every_wall_from_2_4_to_2_6_mm)
+    | test(=tests::flush_join_loft::a_flange_flush_with_the_end_of_a_bent_tapered_tube_joins)
+    | test(=cmd::sheet::tests::perforated_sheet_takes_a_thousand_round_holes)
+    | test(=boolean_regression_tests::joined_loft_frames_plan_their_display_at_every_quality)
+))
+| (package(solidcraft-engine) & (binary(atomic_commands) | binary(step_export_regressions)))
+| (package(solidcraft-kernel) & (
+    test(=curveblend::tests::rolling_ball_turns_about_a_rounded_corner_of_its_radius)
+    | test(=tests::fillet_tabbed_plate_outer_loop_and_partial_selection_after_hole)
+    | test(=tspline::tests::hostile_tsplines_never_panic)
+    | test(=fill::tests::regular_rims_of_three_to_eight_sides_fill_with_one_face_and_close_the_cup)
+    | test(/^issue_788_tests::equal_bores_crossing_/)
+))
+"""
+priority = 98
+
+# Native Windows shader/device creation must not overlap within the local run.
+[test-groups.windows-gpu]
+max-threads = 1
+
+[[profile.local-ci.overrides]]
+platform = "cfg(windows)"
+filter = "package(solidcraft-gpu) | package(solidcraft) | (package(solidcraft-ui-egui) & test(/(offscreen|gpu)/))"
+test-group = "windows-gpu"

.gitattributes

@@ -0,0 +1,3 @@
+# Preserve canonical source receipts and the runtime icon-discovery snapshot.
+.gitattributes text eol=lf
+/assets/icons/ui/design/requested_icons.txt text eol=lf

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: [bherbruck]
+ko_fi: bherbruck

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,43 @@
+name: Bug report
+description: Something in SolidCraft does the wrong thing
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this! Inside the app, **Report an Issue** fills most of this in for you, with the command, its settings and your environment.
+        Before reporting a boolean or modelling failure, please try to reproduce it on the latest nightly or a build from current `main`, and say which build you used.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What did you expect, and what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: |
+        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
+      placeholder: |
+        1. Sketch a circle on the XY plane
+        2. Extrude it 10 mm
+        3. Fillet the top edge with 6 mm
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: SolidCraft version and OS
+      description: Help → About shows the version.
+      placeholder: 0.15.0, Windows 11
+    validations:
+      required: true
+  - type: textarea
+    id: media
+    attributes:
+      label: Screenshots or recording
+      description: |
+        For anything you can see in the app, a screenshot or short recording of a small example helps the most. Please leave out private designs and personal details.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,21 +0,0 @@
----
-name: Bug report
-about: Help reproduce and fix a SolveCraft problem
-title: ''
-labels: ''
-assignees: ''
----
-
-## Behavior
-
-What did you expect, and what happened instead?
-
-## Reproduction
-
-Include steps, SolveCraft version/commit and relevant environment details. Prefer a small example without private design data.
-
-## Screenshots of the behavior (when observable)
-
-For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
-
-Flowcharts and Mermaid diagrams cannot substitute for evidence of visible behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate the point. Changes with no useful observable behavior may omit screenshot/video evidence. Exclude private designs and sensitive details; attach media or link to an accessible recording rather than committing generated review artifacts.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,7 @@
+# Blank issues stay on: the app's Report an Issue opens issues/new?title=…&body=… with the report
+# filled in (crates/ui-egui/src/issue_report.rs), which GitHub drops when blank issues are off.
+blank_issues_enabled: true
+contact_links:
+  - name: Questions and chat
+    url: https://discord.gg/FtU4NQNVDH
+    about: Ask questions and talk with users and contributors on the SolidCraft Discord.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Something SolidCraft should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to do
+      description: The part or workflow you have in mind, and where SolidCraft gets in the way today.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: How you imagine it working
+      description: Optional. Describe the behaviour in your own words; please don't paste another product's documentation.

.github/actionlint.yaml

@@ -0,0 +1,11 @@
+self-hosted-runner:
+  labels:
+    - self-hosted-fast
+    - self-hosted-light
+    # Blacksmith (see the top of workflows/ci.yml).
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
+    - blacksmith-8vcpu-windows-2025

.github/pull_request_template.md

@@ -2,6 +2,12 @@
 
 Describe the problem and resulting behavior. Link the issue when applicable.
 
+Changes a default: no
+
+<!-- Required line, replace "no" if this changes what a user gets out of the box (a default value, key binding, setting, tool behaviour):
+Changes a default: yes — <what>, old behaviour kept behind preference <name>
+Docs-only and bot PRs are exempt. -->
+
 ## Validation
 
 What did you run, and what were the results? Include expected and measured values for geometry changes.

.github/release-notes.md

@@ -1,25 +1,64 @@
-SolveCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
-parameter to watch the timeline rebuild. [Documentation](https://bherbruck.github.io/solvecraft/)
-· [try it in the browser](https://bherbruck.github.io/solvecraft/app/) ·
-[contributing](https://github.com/bherbruck/solvecraft/blob/main/CONTRIBUTING.md) ·
-[issues](https://github.com/bherbruck/solvecraft/issues). AI agents can model with it over MCP:
-`solvecraft-cli mcp` ([how](https://bherbruck.github.io/solvecraft/guide/mcp.html)).
+SolidCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
+parameter to watch the timeline rebuild. [Documentation](https://docs.solidcraft.io/)
+· [try it in the browser](https://solidcraft.io/app) ·
+[contributing](https://github.com/bherbruck/solidcraft/blob/main/CONTRIBUTING.md) ·
+[issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
+`solidcraft-cli mcp` ([how](https://docs.solidcraft.io/guide/mcp.html)).
+
+**What's new** in SolidCraft {version} is listed below, and the
+[ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
+the known limitations. Designs from every earlier version open in this one.
+
+**Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
+`flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
+menu entry.
+
+**Upgrading from 0.5 or earlier.** 0.6 renamed SolveCraft to SolidCraft and made the zip
+container the default save format. `.solvecraft` designs, old settings folders and
+`SOLVECRAFT_*` variables are still picked up, and `solvecraft-cli` still forwards to
+`solidcraft-cli`. Want plain JSON? Use **File ▸ Save As JSON…** or `--save design.json`. On
+macOS, replace `SolveCraft.app` with `SolidCraft.app`. Details:
+[compatibility notes](https://github.com/bherbruck/solidcraft/blob/main/docs/compatibility.md).
+
+Documentation, the browser app and the Flatpak feed use the SolidCraft project Pages URLs.
 
 **Which file?**
-- **Windows:** `SolveCraft-{version}-windows-x64.exe` runs as is. Or install the `.msi`, or unzip the
+- **Windows:** `SolidCraft-{version}-windows-x64.exe` runs as is. Or install the `.msi`, or unzip the
   `-portable.zip` (x64, x86 and arm64).
-- **macOS 11+** (Apple silicon and Intel): open the `.dmg` and drag SolveCraft onto Applications.
-  The CLI is in `solvecraft-cli-{version}-macos-universal.zip`.
+- **macOS 11+** (Apple silicon and Intel): open the `.dmg` and drag `SolidCraft.app` onto Applications.
+  The CLI is in `solidcraft-cli-{version}-macos-universal.zip`.
 - **Linux** (x86_64 and aarch64, glibc 2.35+): the `.AppImage` (`chmod +x`, then run it), the
-  `.deb` or `.rpm`, the `.flatpak` (`flatpak install --user <file>`), or the `.tar.gz`.
-- **FreeBSD:** `tar -xzf solvecraft-{version}-freebsd-x86_64.tar.gz --strip-components 1 -C /usr/local`.
-- **Web:** `solvecraft-web-{version}.zip` is a static site to host yourself.
+  `.deb` or `.rpm`, the `.flatpak` (`flatpak install --user <file>`), the `.snap`
+  (`sudo snap install --dangerous <file>`, or `sudo snap install solidcraft` from the Snap Store), or the `.tar.gz`.
+- **FreeBSD:** `tar -xzf solidcraft-{version}-freebsd-x86_64.tar.gz --strip-components 1 -C /usr/local`.
+- **Web:** `solidcraft-web-{version}.zip` is a static site to host yourself.
 - `SHA256SUMS.txt`: `sha256sum -c SHA256SUMS.txt --ignore-missing`.
+- Files without a version in the name (`solidcraft-windows-x64.msi`, `solidcraft-linux-x86_64.AppImage`, …)
+  are the same packages under fixed names, for download links that always fetch the latest release.
 
-The builds aren't signed yet. On macOS, right-click SolveCraft in Applications and choose
-**Open** the first time (or run `xattr -dr com.apple.quarantine /Applications/SolveCraft.app`).
+For Flatpak feed installation and updates, add Flathub for the required runtime before
+installing SolidCraft; keep both remotes in the same user installation:
+
+```sh
+flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+flatpak remote-add --user --if-not-exists solidcraft https://docs.solidcraft.io/flatpak/solidcraft.flatpakrepo
+flatpak install --user solidcraft ai.storyteller.solidcraft
+flatpak run ai.storyteller.solidcraft
+```
+
+A remote added from the old `bherbruck.github.io` address no longer finds updates: run
+`flatpak remote-modify --user --url=https://docs.solidcraft.io/flatpak/repo/ solidcraft`, then
+`flatpak update --user`.
+
+Flatpak installs from 0.7 or earlier use the old ID `ai.storyteller.solvecraft`: `flatpak update --user`
+offers to replace it with `ai.storyteller.solidcraft`, and settings move along.
+
+Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
+still need an internet connection. [Linux installation details](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).
+
+The builds aren't signed yet. On macOS, right-click `SolidCraft.app` in Applications and choose
+**Open** the first time (or run `xattr -dr com.apple.quarantine /Applications/SolidCraft.app`).
 On Windows, SmartScreen may say "Windows protected your PC": **More info**, then **Run anyway**.
-Licences are built in (Help ▸ About ▸ Licences, `solvecraft-cli licences`); the packages also
-install `THIRD-PARTY-LICENSES.txt`. Known limitations:
-[ROADMAP.md](https://github.com/bherbruck/solvecraft/blob/main/ROADMAP.md#known-limitations).
+Licences are built in (Help ▸ About ▸ Licences, `solidcraft-cli licences`); the packages also
+install `THIRD-PARTY-LICENSES.txt`.
 

.github/workflows/claim.yml

@@ -0,0 +1,52 @@
+# `/claim` and `/unclaim` on issues (CONTRIBUTING.md, "Sending a change"), and a daily sweep that
+# frees claims nobody is working on. A pull request that references an issue (`<summary> (#N)`,
+# `Fixes #N`) claims it too. The logic is in scripts/claim/claim.js (tested in ci.yml).
+name: Claim
+
+on:
+  issue_comment:
+    types: [created]
+  # pull_request_target so PRs from forks can label and assign. It runs the base branch's
+  # scripts/claim and only reads the PR's title, body and author; the PR's code is never checked out.
+  pull_request_target:
+    types: [opened, reopened]
+  schedule:
+    - cron: '17 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read # to check out scripts/claim
+  issues: write
+  pull-requests: read
+
+# One run at a time per issue, so two simultaneous /claim comments can't both win.
+concurrency:
+  group: claim-${{ github.event.issue.number || github.event.pull_request.number || 'sweep' }}
+  cancel-in-progress: false
+
+jobs:
+  claim:
+    name: Claim bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    if: >-
+      github.event_name != 'issue_comment' ||
+      (!github.event.issue.pull_request && github.event.comment.user.type != 'Bot' &&
+      (startsWith(github.event.comment.body, '/claim') || startsWith(github.event.comment.body, '/unclaim')))
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/claim
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const claim = require('./scripts/claim/claim.js');
+            if (context.eventName === 'issue_comment') {
+              await claim.handleComment({ github, context });
+            } else if (context.eventName === 'pull_request_target') {
+              const claimed = await claim.handlePull({ github, context });
+              core.info(`Claimed: ${claimed.join(', ') || 'none'}`);
+            } else {
+              const released = await claim.sweep({ github, context });
+              core.info(`Released: ${released.join(', ') || 'none'}`);
+            }

.github/workflows/docker.yml

@@ -0,0 +1,110 @@
+# The web app as a container image on GitHub's container registry, for self-hosting
+# (packaging/docker; the book's "Self-hosting with Docker"):
+#
+#   ghcr.io/<owner>/solidcraft-web:latest   the latest published release
+#   ghcr.io/<owner>/solidcraft-web:0.14.0   a release (also 0.14); pre-releases get only their version
+#   ghcr.io/<owner>/solidcraft-web:edge     main
+#
+# For linux/amd64 and linux/arm64. The site is built here, as Pages and Release build it, and
+# passed to the Dockerfile as its `site` stage. Pull requests that touch the image build and
+# smoke-test it without publishing. Releases published by an agent or maintainer trigger this;
+# the nightly pre-releases (made with GITHUB_TOKEN) do not.
+name: Docker
+
+on:
+  push:
+    branches: [main]
+    # The image holds the web app only: documentation, test data and the GitHub bots' scripts can't
+    # change it, so a push touching only those builds nothing (edge stays at the last code change).
+    # ATTRIBUTION.md is the exception among the Markdown files: the app embeds it (Help, About).
+    # The last matching pattern wins.
+    paths: ["**", "!docs/**", "!**/*.md", "ATTRIBUTION.md", "!tests/**", "!scripts/claim/**", "!scripts/triage/**"]
+  release:
+    types: [published]
+  pull_request:
+    paths: ["packaging/docker/**", ".github/workflows/docker.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  TRUNK_VERSION: v0.21.14
+
+jobs:
+  image:
+    if: ${{ !github.event.repository.private }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: docker-web
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Install trunk
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - name: Build the web app
+        working-directory: apps/solidcraft-web
+        run: trunk build --release
+      - name: Image name
+        id: image
+        # Registry names are lower case; a fork's owner may not be.
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/solidcraft-web" >> "$GITHUB_OUTPUT"
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        id: meta
+        with:
+          images: ${{ steps.image.outputs.name }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=edge,branch=main
+            type=ref,event=pr
+          labels: |
+            org.opencontainers.image.title=SolidCraft (web)
+            org.opencontainers.image.description=SolidCraft, open-source parametric CAD, in the browser: the web app served by nginx on port 8080
+            org.opencontainers.image.licenses=MIT OR Apache-2.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - name: Build for the smoke test
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: packaging/docker/Dockerfile
+          build-contexts: site=dist/web
+          platforms: linux/amd64
+          load: true
+          tags: solidcraft-web:test
+      - name: Smoke test
+        run: bash packaging/docker/smoke-test.sh solidcraft-web:test
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        if: github.event_name != 'pull_request'
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and publish
+        if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: packaging/docker/Dockerfile
+          build-contexts: site=dist/web
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}

.github/workflows/external-corpus.yml

@@ -0,0 +1,42 @@
+# Nightly import checks on real-world STEP files (#1397): the external corpus in
+# tests/external-corpus.toml is downloaded (hash-verified), imported headless, and checked
+# against tolerance-based expectations — body counts, total volume and area, time and memory
+# budgets. It is not part of `cargo xtask ci`: it downloads from the internet.
+#
+# Import results should improve over time (healing, edge merging, meshing). When a check fails
+# because the numbers moved for the better (or the source changed upstream), re-record with
+# `cargo xtask external-corpus --bless "why"` in a pull request, never by editing numbers.
+name: External corpus
+
+on:
+  schedule:
+    - cron: '40 3 * * *'
+  workflow_dispatch:
+    inputs:
+      only:
+        description: "Run only this corpus entry name (empty = every entry)"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  corpus:
+    name: Import the external STEP corpus
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build the CLI
+        run: cargo build --profile ci -p solidcraft-cli
+      - name: Import and check every entry
+        env:
+          ONLY: ${{ inputs.only }}
+        run: |
+          if [ -z "$ONLY" ]; then
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli
+          else
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli --only "$ONLY"
+          fi

.github/workflows/freecad-oracle.yml

@@ -0,0 +1,47 @@
+# Optional, run by hand: rebuild the reference cases whose expected values come from FreeCAD
+# (tools/freecad-oracle/) and show what changed. FreeCAD runs as a separate program on the runner;
+# it is not a dependency of SolidCraft. Nothing is committed: review the diff and the uploaded
+# files, then commit them in a pull request if the change is intended.
+name: FreeCAD reference values
+
+on:
+  workflow_dispatch:
+    inputs:
+      cases:
+        description: "Case directories (space separated); empty = every case whose source is FreeCAD"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  regenerate:
+    name: Regenerate FreeCAD expected values
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install FreeCAD
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends freecad
+          freecadcmd --version || true
+      - name: Rebuild the cases
+        env:
+          CASES: ${{ inputs.cases }}
+        run: |
+          if [ -z "$CASES" ]; then
+            CASES=$(grep -l '"source": *"freecad' tests/oracle/*/expected.json | xargs -n1 dirname | tr '\n' ' ')
+          fi
+          # shellcheck disable=SC2086
+          tools/freecad-oracle/run.sh --write $CASES
+      - name: Show the changes
+        run: git diff --stat && git diff -- tests/oracle/*/expected.json
+      - name: Upload the regenerated files
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: freecad-expected
+          path: |
+            tests/oracle/*/expected.json
+            tests/oracle/*/reference.stl

.github/workflows/generated.yml

@@ -0,0 +1,68 @@
+# Files generated from the code are rewritten here, on main, after each merge, so pull requests
+# never edit them (two pull requests that each regenerated one would always conflict):
+# THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
+# Pending files (assets/locales/pending, attribution/pending) are folded into the catalogs and
+# ATTRIBUTION.md by `cargo xtask fold-pending`.
+name: Generated files
+
+on:
+  push:
+    branches: [main]
+    # THIRD-PARTY-LICENSES.txt follows the manifests, the lockfile, the vendored crates' licence
+    # files and the fonts' licences; docs/features.md follows the command registry (crates/engine),
+    # read through solidcraft-cli. Other pushes regenerate nothing.
+    paths:
+      - "Cargo.lock"
+      - "**/Cargo.toml"
+      - "vendor/**"
+      - "assets/fonts/**"
+      - "crates/engine/**"
+      - "apps/solidcraft-cli/**"
+      - "xtask/**"
+      - "assets/locales/pending/*.json"
+      - "attribution/pending/*.md"
+      - ".github/workflows/generated.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+# One run at a time; a burst of merges leaves one run waiting, which sees all of them.
+concurrency:
+  group: generated-files
+  cancel-in-progress: false
+
+jobs:
+  regenerate:
+    name: Regenerate and commit
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      # Always main itself, never pull request code, since this job can push.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          # main goes through the merge queue; this deploy key may push past it.
+          ssh-key: ${{ secrets.GENERATED_FILES_DEPLOY_KEY }}
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: generated-files
+      - name: THIRD-PARTY-LICENSES.txt
+        run: cargo xtask licences
+      - name: docs/features.md
+        run: cargo xtask features
+      - name: Pending locale strings and attribution rows
+        run: cargo xtask fold-pending
+      - name: Commit if changed
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then echo "unchanged"; exit 0; fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A THIRD-PARTY-LICENSES.txt docs/features.md assets/locales ATTRIBUTION.md attribution
+          git commit -m "Regenerate generated files and fold pending files [skip ci]"
+          for _ in 1 2 3; do
+            git pull --rebase origin main && git push origin HEAD:main && exit 0
+            sleep 10
+          done
+          exit 1

.github/workflows/kernel-paused.yml

@@ -0,0 +1,42 @@
+# While a new geometry kernel is evaluated, new issues, pull requests and discussions about kernel
+# work are labelled `kernel-paused` for a maintainer to answer (CONTRIBUTING.md, "Kernel work is
+# paused"). The logic is in scripts/kernel-paused/ (tested in ci.yml).
+name: Kernel paused
+
+on:
+  issues:
+    types: [opened]
+  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
+  # scripts/kernel-paused and only lists the PR's changed paths; the PR's code is never checked out.
+  pull_request_target:
+    types: [opened]
+  discussion:
+    types: [created]
+
+permissions:
+  contents: read # to check out scripts/kernel-paused
+  issues: write
+  pull-requests: write # to list a PR's changed paths and add its label
+  discussions: write
+
+concurrency:
+  group: kernel-paused-${{ github.event.issue.number || github.event.pull_request.number || github.event.discussion.number }}
+  cancel-in-progress: false
+
+jobs:
+  paused:
+    name: Kernel paused bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/kernel-paused
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const paused = require('./scripts/kernel-paused/kernel-paused.js');
+            const done = context.eventName === 'discussion'
+              ? await paused.handleDiscussion({ github, context })
+              : await paused.handleOpened({ github, context });
+            core.info(done);

.github/workflows/lists.yml

@@ -0,0 +1,33 @@
+# Files many pull requests add to are kept so that additions don't conflict: one file per change
+# or one sorted line per item (CONTRIBUTING.md, "Lists many changes add to"). Fast, no build.
+# Pull requests get the same checks in CI's "Format and repository checks" job (one runner slot
+# per PR instead of three); this copy keeps main honest.
+name: Lists
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  format-changes:
+    name: Design format changes merge cleanly
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: bash scripts/test-format-pending.sh
+
+  sorted:
+    name: Lists are sorted one item per line
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: lists
+      - run: cargo xtask lists

.github/workflows/packaging-lint.yml

@@ -6,9 +6,9 @@ name: Packaging lint
 on:
   push:
     branches: [main]
-    paths: [".github/workflows/**", "packaging/**"]
+    paths: [".github/workflows/**", "packaging/**", "assets/**"]
   pull_request:
-    paths: [".github/workflows/**", "packaging/**"]
+    paths: [".github/workflows/**", "packaging/**", "assets/platforms/**"]
   workflow_dispatch:
 
 permissions:
@@ -37,6 +37,12 @@ jobs:
         run: shellcheck packaging/*.sh packaging/*/*.sh packaging/linux/AppRun
       - name: Nightly release selection regression
         run: python3 packaging/tests/nightly_test.py
+      - name: Windows executable icon validation regression
+        run: python3 packaging/tests/windows_icon_test.py
+      - name: AppImage CLI wrapper regression
+        run: python3 packaging/tests/apprun_test.py
+      - name: Flatpak desktop smoke validation regression
+        run: python3 packaging/tests/flatpak_test.py
       - name: PowerShell
         shell: pwsh
         run: |
@@ -48,8 +54,14 @@ jobs:
           }
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
-          xmllint --noout packaging/windows/solvecraft.wxs packaging/windows/solvecraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
-          desktop-file-validate packaging/linux/ai.storyteller.solvecraft.desktop
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.solvecraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solvecraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solvecraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solvecraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solvecraft' and m['command'] == 'solvecraft'"
+          xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
+          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
+          # The window's X11 class is its app id; the old id stays only as the rename shims.
+          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
+          grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"
+          python3 -m py_compile packaging/linux/snap-smoke.py

.github/workflows/pages.yml

@@ -1,11 +1,13 @@
-# The documentation site on GitHub Pages: the book (docs/book) at /solvecraft/ and the web app
-# at /solvecraft/app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
+# The documentation site on GitHub Pages: the book (docs/book) at https://docs.solidcraft.io/
+# and the bundled web app at /app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
 # repository is private.
 name: Pages
 
 on:
   push:
     branches: [main]
+    # The site is the book and the web app: test data and the GitHub bots' scripts change neither.
+    paths-ignore: ["tests/**", "scripts/claim/**", "scripts/triage/**"]
   workflow_dispatch:
     inputs:
       release_tag:
@@ -45,15 +47,25 @@ jobs:
           curl -sSL "https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
           curl -sSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - name: Install a software Vulkan driver (lavapipe)
+        # The book's pictures are `solidcraft-cli snapshot`s, drawn on the GPU; the runner has none.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
       - name: Build the book
+        env:
+          SOLIDCRAFT_GPU: software
         run: cargo xtask book
       - name: Build the web app
-        working-directory: apps/solvecraft-web
-        run: trunk build --release --public-url /solvecraft/app/
+        working-directory: apps/solidcraft-web
+        run: trunk build --release --public-url ./
+      - name: Test the web app offline and across an update (headless Chrome)
+        run: cargo xtask web-offline-test --site dist/web
       - name: Assemble the site
         run: |
           mkdir -p site
           cp -r target/book/. site/
+          bash docs/book/seo.sh site  # canonical links, robots.txt, sitemap.xml
           cp -r dist/web site/app
       - uses: actions/configure-pages@v5
         id: pages

.github/workflows/pr-checks.yml

@@ -0,0 +1,69 @@
+# Two quick checks on every pull request (CONTRIBUTING.md, "Sending a change"): no second open PR
+# for an issue a lower-numbered one already closes, and the "Changes a default:" line is filled in.
+# Neither is a required status check. The logic is in scripts/pr-checks/pr-checks.js (tested in ci.yml).
+name: PR checks
+
+on:
+  # pull_request, never pull_request_target: nothing here checks out or runs the PR's code, and the
+  # token is read-only for fork PRs. Only scripts/pr-checks from the PR's own merge commit is run.
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  duplicate:
+    name: Duplicate PR check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDuplicate({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  defaults:
+    name: Defaults line check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDefaults({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  # Labelling needs write access, which a fork PR's token never has, so it is its own job and best
+  # effort: a fork PR just doesn't get the `changes-default` label from here.
+  label:
+    name: Label changes-default
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            await checks.syncDefaultLabel({ github, context, core });

.github/workflows/release.yml

@@ -4,15 +4,24 @@
 # comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
-# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
+# A version with a suffix (0.2.0-rc.1) is a pre-release.
+# The macOS app is signed and notarized when the APPLE_* secrets exist. The Windows binaries and
+# MSI are Authenticode-signed through SignPath Foundation when the SIGNPATH_API_TOKEN secret exists
+# (see the windows job). Nothing else is signed yet.
 #
-#   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .tar.gz     packaging/linux
+#   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
-#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
+#   macOS universal         .dmg, and the CLI as a .zip (both archs built in parallel)  packaging/macos
 #   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
 #   Web                     a .zip of the static site                              packaging/web
 #
+# The main installers are also attached without the version in their names
+# (solidcraft-windows-x64.msi, solidcraft-linux-x86_64.AppImage, ...) so that
+# releases/latest/download/<name> links in the README keep working across releases.
+#
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+# A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
+#   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release
 
 on:
@@ -27,6 +36,10 @@ on:
         description: "Create/update a draft (release branch only; off: build artifacts only)"
         type: boolean
         default: false
+      signpath_signing_policy:
+        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -77,9 +90,9 @@ jobs:
           fi
           case "$VERSION" in *-*) pre=true ;; *) pre=false ;; esac
           { echo "version=$VERSION"; echo "date=$(date -u +%Y-%m-%d)"; echo "prerelease=$pre"; } >>"$GITHUB_OUTPUT"
-          echo "### SolveCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
+          echo "### SolidCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
 
-  # The app icon in every size, drawn by solvecraft-cli (no image files are committed), for the
+  # The app icon in every size, drawn by solidcraft-cli (no image files are committed), for the
   # Windows jobs: the ARM64 build is cross-compiled and can't run there to draw its own.
   icons:
     needs: version
@@ -91,10 +104,10 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: release-icons
-      - run: cargo build --release --locked -p solvecraft-cli
+      - run: cargo build --release --locked -p solidcraft-cli
       - run: |
           . packaging/env.sh
-          make_icons target/release/solvecraft-cli icons
+          make_icons target/release/solidcraft-cli icons
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: icons
@@ -114,8 +127,8 @@ jobs:
           - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
           - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
-      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
       NFPM_VERSION: 2.47.0
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -135,17 +148,22 @@ jobs:
       - name: Check the packages
         run: |
           dpkg-deb --info dist/release/*.deb
-          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/solvecraft$|usr/bin/solvecraft-cli$|metainfo|applications|THIRD-PARTY-LICENSES.txt'
+          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/solidcraft$|usr/bin/solidcraft-cli$|metainfo|applications|THIRD-PARTY-LICENSES.txt'
+          # Compatibility shims (docs/compatibility.md): the old CLI name and the package rename.
+          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/solvecraft-cli$'
+          dpkg-deb --field dist/release/*.deb Replaces Conflicts Provides | grep -F solvecraft
           rpm -qip dist/release/*.rpm
-          rpm -qlp dist/release/*.rpm | grep -E '/usr/bin/solvecraft$|THIRD-PARTY-LICENSES.txt'
-          tar -tzf dist/release/*.tar.gz | grep -E '/bin/solvecraft$|THIRD-PARTY-LICENSES.txt'
-          ldd target/release/solvecraft
+          rpm -qlp dist/release/*.rpm | grep -E '/usr/bin/solidcraft$|THIRD-PARTY-LICENSES.txt'
+          tar -tzf dist/release/*.tar.gz | grep -E '/bin/solidcraft$|THIRD-PARTY-LICENSES.txt'
+          ldd target/release/solidcraft
           for appimage in dist/release/*.AppImage; do
             chmod +x "$appimage"
             APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
             "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
             test -s "$appimage.zsync"
           done
+          # Legacy AppImage update alias (docs/compatibility.md).
+          ls dist/release/solvecraft-*-linux-*.AppImage.zsync
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-linux-${{ matrix.arch }}
@@ -166,8 +184,8 @@ jobs:
           - { arch: x86_64, runner: ubuntu-24.04 }
           - { arch: aarch64, runner: ubuntu-24.04-arm }
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
-      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -177,11 +195,11 @@ jobs:
       - name: Install flatpak-builder
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common xvfb xauth weston dbus-x11
           # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Build the Flatpak bundle
-        run: packaging/linux/flatpak-bundle.sh "dist/linux/solvecraft-$SOLVECRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+        run: packaging/linux/flatpak-bundle.sh "dist/linux/solidcraft-$SOLIDCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-flatpak-${{ matrix.arch }}
@@ -190,6 +208,61 @@ jobs:
 
 
 
+  snap:
+    name: Snap ${{ matrix.arch }}
+    needs: [version, linux]
+    if: needs.version.outputs.build == 'true'
+    # The Snap Store hasn't accepted SolidCraft yet, so a snap failure never holds up a release.
+    continue-on-error: true
+    # Repackages the Linux job's tarball, like the Flatpak. On 24.04 because the core24 base is
+    # Ubuntu 24.04, which lets snapcraft build on the runner itself (--destructive-mode).
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-24.04 }
+          - { arch: aarch64, runner: ubuntu-24.04-arm }
+    env:
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      - name: Install snapcraft and the smoke-test tools
+        run: |
+          sudo snap install snapcraft --classic
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends xvfb xauth weston dbus-x11
+      - name: Build the snap
+        run: |
+          sudo --preserve-env=SOLIDCRAFT_VERSION,SOLIDCRAFT_BUILD_DATE env "PATH=$PATH" \
+            packaging/linux/snap-pack.sh --destructive-mode "dist/linux/solidcraft-$SOLIDCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+          sudo chown -R "$(id -u):$(id -g)" dist target
+      - name: Install it and start the app on headless X11 and Wayland
+        run: |
+          snap_file="dist/release/solidcraft-$SOLIDCRAFT_VERSION-linux-${{ matrix.arch }}.snap"
+          sudo snap install --dangerous "$snap_file"
+          snap info --verbose "$snap_file" | head -n 12
+          snap connections solidcraft
+          solidcraft.cli --version
+          # Snaps expect the login session's runtime directory, which runners don't create.
+          sudo install -d -m 700 -o "$(id -u)" -g "$(id -g)" "/run/user/$(id -u)"
+          python3 packaging/linux/snap-smoke.py --out snap-smoke
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: snap-smoke-${{ matrix.arch }}
+          path: snap-smoke/*.png
+          if-no-files-found: error
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-snap-${{ matrix.arch }}
+          path: dist/release/*.snap
+          if-no-files-found: error
+
   freebsd:
     name: FreeBSD x86_64
     needs: version
@@ -198,8 +271,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 180
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
-      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build and package in a FreeBSD VM (tar.gz)
@@ -211,7 +284,7 @@ jobs:
           cpu: 4
           mem: 12288
           # Passed into the VM by name; never templated into the script below.
-          envs: "SOLVECRAFT_VERSION SOLVECRAFT_BUILD_DATE"
+          envs: "SOLIDCRAFT_VERSION SOLIDCRAFT_BUILD_DATE"
           prepare: |
             pkg install -y bash git curl pkgconf libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
@@ -221,34 +294,88 @@ jobs:
             git config --global --add safe.directory "$PWD"
             # Build outside the checkout so only dist/ is copied back out of the VM. 4 jobs: more
             # runs the VM out of memory.
-            export CARGO_TARGET_DIR=/var/tmp/solvecraft-target CARGO_BUILD_JOBS=4
+            export CARGO_TARGET_DIR=/var/tmp/solidcraft-target CARGO_BUILD_JOBS=4
             bash packaging/freebsd/package.sh
-            tar -tzf dist/release/solvecraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/solvecraft$|/bin/solvecraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solvecraft/THIRD-PARTY-LICENSES\.txt$'
+            tar -tzf dist/release/solidcraft-*-freebsd-x86_64.tar.gz \
+              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-freebsd-x86_64
           path: dist/release/*
           if-no-files-found: error
 
-  macos:
-    name: macOS universal
+  # The two halves of the universal binary build in parallel on their own runners (each alone
+  # took about half of the old single job's 45 minutes); `macos` below joins and packages them.
+  macos-build:
+    name: macOS build ${{ matrix.arch }}
     needs: version
     if: needs.version.outputs.build == 'true'
     runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: aarch64, target: aarch64-apple-darwin }
+          - { arch: x86_64, target: x86_64-apple-darwin }
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
-      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
+          targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: release-macos-universal
-      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
-        run: packaging/macos/package.sh --arch universal
+          key: release-macos-${{ matrix.arch }}
+      - name: Build
+        run: packaging/macos/package.sh --build-only ${{ matrix.target }}
+      # Not named release-*: the release job collects every release-* artifact as an asset.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: macos-bin-${{ matrix.arch }}
+          path: |
+            target/${{ matrix.target }}/release/solidcraft
+            target/${{ matrix.target }}/release/solidcraft-cli
+            target/${{ matrix.target }}/release/solvecraft-cli
+          if-no-files-found: error
+
+  macos:
+    name: macOS universal
+    needs: [version, macos-build]
+    if: needs.version.outputs.build == 'true'
+    runs-on: macos-14
+    env:
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-aarch64
+          path: target/aarch64-apple-darwin/release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-x86_64
+          path: target/x86_64-apple-darwin/release
+      - name: Set up Developer ID signing and notarization
+        # Optional until the APPLE_* secrets exist (docs/releasing.md, "macOS signing"). Without
+        # them (forks, dry runs) the app keeps its ad-hoc signature and is not notarized.
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: packaging/macos/signing.sh --setup
+      - name: Join, sign, package and check (dmg, CLI zip; the dmg is mounted and checked)
+        run: |
+          # Artifacts don't keep the executable bit.
+          chmod +x target/*-apple-darwin/release/solidcraft target/*-apple-darwin/release/solidcraft-cli target/*-apple-darwin/release/solvecraft-cli
+          packaging/macos/package.sh --arch universal --skip-build ${MACOS_SIGN_IDENTITY:+--sign}
+      - name: Remove the signing keychain and API key
+        if: always()
+        run: packaging/macos/signing.sh --cleanup
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos
@@ -259,7 +386,14 @@ jobs:
     name: Windows ${{ matrix.arch }}
     needs: [version, icons]
     if: needs.version.outputs.build == 'true'
+    # Must stay a GitHub-hosted runner, like every job before it: SignPath's open-source policy
+    # only signs builds whose jobs all ran on GitHub-hosted runners.
     runs-on: windows-latest
+    # actions: read lets the SignPath action read this job's details and fetch the uploaded
+    # artifact with GITHUB_TOKEN (the workflow default above grants contents: read only).
+    permissions:
+      contents: read
+      actions: read
     strategy:
       fail-fast: false
       matrix:
@@ -269,7 +403,17 @@ jobs:
           # Windows on ARM: cross-compiled on the x64 runner.
           - { arch: arm64, target: aarch64-pc-windows-msvc }
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      # Authenticode signing through SignPath Foundation (docs/releasing.md, "Windows signing").
+      # Only when the API token secret exists: forks and repositories without it build unsigned,
+      # exactly as before. `if:` can't read secrets, so the check goes through this variable.
+      SIGN_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
+      # The one switch between the self-signed test certificate (test-signing) and the real one
+      # (release-signing): a dispatch input, else the SIGNPATH_SIGNING_POLICY repository variable,
+      # else test-signing.
+      SIGNPATH_SIGNING_POLICY: ${{ inputs.signpath_signing_policy || vars.SIGNPATH_SIGNING_POLICY || 'test-signing' }}
+      SIGNPATH_ORGANIZATION_ID: fa603ff4-c702-404b-8588-a524371c7a4e
+      SIGNPATH_PROJECT_SLUG: solidcraft
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -288,10 +432,109 @@ jobs:
           dotnet tool install --global wix --version 5.0.2
           wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
       - name: Build and package (msi, portable zip)
+        if: env.SIGN_WINDOWS != 'true'
         shell: pwsh
         env:
-          SOLVECRAFT_ICONS: ${{ github.workspace }}/icons
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
         run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+
+      # ---- signed path ---------------------------------------------------------------------------
+      # SignPath's GitHub integration (docs.signpath.io/trusted-build-systems/github): the files go
+      # up as a workflow artifact, SignPath fetches that artifact itself (so it can verify it came
+      # from this workflow run), signs it, and the action downloads the signed copy. GitHub stores
+      # artifacts as zips, so packaging/windows/signpath-artifact-configuration.xml (pasted into the
+      # SignPath project) describes a zip holding the files at its top level.
+      # Two rounds: the .exe files first, so the MSI, the portable zip and the plain .exe all carry
+      # signed binaries; then the MSI built from them.
+      - name: Build and stage the binaries for signing
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase stage
+      - name: Upload the unsigned binaries
+        id: unsigned-exes
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-exes-windows-${{ matrix.arch }}
+          path: target/windows-package/${{ matrix.arch }}/*.exe
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the binaries (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-exes.outputs.artifact-id }}
+          wait-for-completion: true
+          # release-signing requests wait for a person to approve them in SignPath; give that an
+          # hour instead of the default 10 minutes. test-signing requests finish in seconds.
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-exes-${{ matrix.arch }}
+      - name: Put the signed binaries in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $stage = "target/windows-package/${{ matrix.arch }}"
+          foreach ($exe in 'solidcraft.exe', 'solidcraft-cli.exe', 'solvecraft-cli.exe') {
+            $signed = "target/windows-package/signed-exes-${{ matrix.arch }}/$exe"
+            # The artifact configuration matches each file optionally, so check that every file
+            # actually came back signed rather than trusting the request's success.
+            $sig = Get-AuthenticodeSignature $signed
+            if (-not $sig.SignerCertificate) { throw "$exe came back from SignPath without a signature ($($sig.Status))" }
+            # The test certificate is self-signed, so Status is not Valid until release-signing.
+            Write-Output "$exe signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+            Copy-Item -Force $signed "$stage/$exe"
+          }
+      - name: Package the signed binaries (msi, portable zip)
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase package
+      - name: Upload the unsigned MSI
+        id: unsigned-msi
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-msi-windows-${{ matrix.arch }}
+          path: dist/release/*.msi
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the MSI (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
+          wait-for-completion: true
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-msi-${{ matrix.arch }}
+      - name: Put the signed MSI in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = Get-Item "dist/release/*.msi"
+          $signed = "target/windows-package/signed-msi-${{ matrix.arch }}/$($msi.Name)"
+          $sig = Get-AuthenticodeSignature $signed
+          if (-not $sig.SignerCertificate) { throw "$($msi.Name) came back from SignPath without a signature ($($sig.Status))" }
+          Write-Output "$($msi.Name) signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+          Copy-Item -Force $signed $msi.FullName
+          "Windows ${{ matrix.arch }}: Authenticode-signed through SignPath (policy $env:SIGNPATH_SIGNING_POLICY, $($sig.SignerCertificate.Subject))." >> $env:GITHUB_STEP_SUMMARY
+      - name: Note the unsigned build
+        if: env.SIGN_WINDOWS != 'true'
+        shell: pwsh
+        run: '"Windows ${{ matrix.arch }}: unsigned (no SIGNPATH_API_TOKEN secret)." >> $env:GITHUB_STEP_SUMMARY'
+
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-windows-${{ matrix.arch }}
@@ -304,7 +547,7 @@ jobs:
     if: needs.version.outputs.build == 'true'
     runs-on: ubuntu-latest
     env:
-      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
       TRUNK_VERSION: 0.21.14
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -328,7 +571,7 @@ jobs:
 
   release:
     name: GitHub Release or dry-run artifacts
-    needs: [version, linux, flatpak, freebsd, macos, windows, web]
+    needs: [version, linux, flatpak, snap, freebsd, macos, windows, web]
     if: needs.version.outputs.build == 'true'
     runs-on: ubuntu-latest
     permissions:
@@ -345,10 +588,54 @@ jobs:
           pattern: release-*
           path: artifacts
           merge-multiple: true
+      - name: Version-less copies for permanent download links
+        # The README links to releases/latest/download/<name>, which must not change between
+        # releases: solidcraft-<version>-windows-x64.msi is also uploaded as
+        # solidcraft-windows-x64.msi, and so on for the main installers.
+        working-directory: artifacts
+        run: |
+          shopt -s nullglob
+          for f in "solidcraft-$VERSION-"*; do
+            case "$f" in
+              *.msi | *-portable.zip | *.dmg | *.AppImage | *.deb | *.rpm | *.flatpak | *.snap)
+                cp -- "$f" "solidcraft-${f#"solidcraft-$VERSION-"}" ;;
+            esac
+          done
+          for f in solidcraft-windows-x64.msi solidcraft-macos-universal.dmg \
+            solidcraft-linux-x86_64.AppImage solidcraft-linux-x86_64.deb solidcraft-linux-x86_64.rpm; do
+            test -s "$f" || { echo "::error::missing version-less copy $f"; exit 1; }
+          done
+          ls -l solidcraft-[!0-9]*
       - name: Checksums and notes
         run: |
           (cd artifacts && sha256sum -- * | tee SHA256SUMS.txt)
           sed "s/{version}/$VERSION/g" .github/release-notes.md >notes.md
+      - name: Sign the checksum list for in-app updates
+        # Optional until the UPDATE_SIGNING_KEY secret exists (docs/releasing.md, "Update
+        # signing"). The trusted comment names the release, which the app checks.
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+        run: |
+          # The key the app checks against (crates/ui-egui/src/update/install.rs, PUBLIC_KEY).
+          public_key=$(sed -n 's/^pub const PUBLIC_KEY: Option<&str> = Some("\([^"]*\)");/\1/p' crates/ui-egui/src/update/install.rs)
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            if [ -n "$public_key" ]; then
+              echo "::error::the app expects signed updates (PUBLIC_KEY is set) but the UPDATE_SIGNING_KEY secret is missing"
+              exit 1
+            fi
+            echo "UPDATE_SIGNING_KEY isn't set: SHA256SUMS.txt stays unsigned"
+            exit 0
+          fi
+          sudo apt-get update -q
+          sudo apt-get install -y --no-install-recommends minisign
+          umask 077
+          printf '%s\n' "$UPDATE_SIGNING_KEY" >"$RUNNER_TEMP/update.key"
+          minisign -S -s "$RUNNER_TEMP/update.key" -m artifacts/SHA256SUMS.txt \
+            -x artifacts/SHA256SUMS.txt.minisig -t "SolidCraft v$VERSION" </dev/null
+          rm -f "$RUNNER_TEMP/update.key"
+          if [ -n "$public_key" ]; then
+            minisign -V -P "$public_key" -m artifacts/SHA256SUMS.txt -x artifacts/SHA256SUMS.txt.minisig
+          fi
       - name: Publish nightly pre-release
         if: github.event_name == 'schedule'
         working-directory: artifacts
@@ -357,7 +644,7 @@ jobs:
           sha256sum --check SHA256SUMS.txt
           # Stage all packages before publishing. Published tags are never replaced.
           gh release create "$tag" --draft --prerelease --latest=false \
-            --title "SolveCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
+            --title "SolidCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
             --notes-file ../notes.md --generate-notes -- *
           gh release edit "$tag" --draft=false --prerelease --latest=false
           echo "### Published nightly: $tag (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
@@ -386,18 +673,47 @@ jobs:
             while IFS= read -r asset; do
               if [ -n "$asset" ]; then gh release delete-asset "$tag" "$asset" --yes; fi
             done <<<"$assets"
-            gh release edit "$tag" --draft --title "SolveCraft v$VERSION" \
+            gh release edit "$tag" --draft --title "SolidCraft v$VERSION" \
               --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
             gh release upload "$tag" --clobber -- *
           else
-            gh release create "$tag" --draft --title "SolveCraft v$VERSION" \
+            gh release create "$tag" --draft --title "SolidCraft v$VERSION" \
               --target "$GITHUB_SHA" --notes-file ../notes.md --generate-notes "${pre[@]}" -- *
           fi
           {
-            echo "Draft **SolveCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"
+            echo "Draft **SolidCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"
             echo
             sed 's/^/    /' SHA256SUMS.txt
           } >>"$GITHUB_STEP_SUMMARY"
+      # Snap Store: nightlies go to the edge channel and release drafts to candidate, only after
+      # every package built and the GitHub release was staged. Publishing the GitHub release
+      # promotes candidate to stable (snap-store.yml). Dry runs never upload. Skipped until the
+      # owner adds the SNAPCRAFT_STORE_CREDENTIALS secret (docs/releasing.md).
+      - id: snapstore
+        name: Check for Snap Store credentials
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        run: |
+          if [ -n "$SNAPCRAFT_STORE_CREDENTIALS" ]; then
+            echo "configured=true" >>"$GITHUB_OUTPUT"
+          else
+            echo "No SNAPCRAFT_STORE_CREDENTIALS secret: skipping the Snap Store upload."
+          fi
+      - name: Upload the snaps to the Snap Store
+        if: >-
+          steps.snapstore.outputs.configured == 'true' && (github.event_name == 'schedule' ||
+          (github.ref == 'refs/heads/release' && (github.event_name == 'push' || inputs.draft)))
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        working-directory: artifacts
+        run: |
+          sudo snap install snapcraft --classic
+          channel=candidate
+          if [ "$GITHUB_EVENT_NAME" = schedule ]; then channel=edge; fi
+          for arch in x86_64 aarch64; do
+            snapcraft upload --release="$channel" "solidcraft-$VERSION-linux-$arch.snap"
+          done
+          echo "Uploaded the snaps to the Snap Store's $channel channel." >>"$GITHUB_STEP_SUMMARY"
       - name: Keep the files (dry run)
         if: github.event_name == 'workflow_dispatch' && !inputs.draft
         run: cp notes.md artifacts/release-notes.md

.github/workflows/snap-store.yml

@@ -0,0 +1,40 @@
+# Publishing a GitHub release (not a prerelease) promotes the snaps that release.yml uploaded to
+# the Snap Store's candidate channel to stable, so `sudo snap install solidcraft` gets it.
+# Skipped until the owner adds the SNAPCRAFT_STORE_CREDENTIALS secret; see docs/releasing.md.
+name: Snap Store
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: snap-store
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    steps:
+      - id: creds
+        name: Check for Snap Store credentials
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        run: |
+          if [ -n "$SNAPCRAFT_STORE_CREDENTIALS" ]; then
+            echo "configured=true" >>"$GITHUB_OUTPUT"
+          else
+            echo "No SNAPCRAFT_STORE_CREDENTIALS secret: nothing to promote."
+          fi
+      - name: Promote candidate to stable
+        if: steps.creds.outputs.configured == 'true'
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        run: |
+          sudo snap install snapcraft --classic
+          snapcraft status solidcraft
+          snapcraft promote solidcraft --from-channel=latest/candidate --to-channel=latest/stable --yes
+          snapcraft status solidcraft

.github/workflows/triage.yml

@@ -0,0 +1,86 @@
+# Labels new issues and PRs from fixed rules, `/triage` for maintainers, asks short bug reports
+# for reproduction steps (`needs-info`, closed after 14 days unanswered), and a manual backfill
+# (CONTRIBUTING.md, "Labels and triage"). The logic is in scripts/triage/ (tested in ci.yml).
+name: Triage
+
+on:
+  issues:
+    types: [opened, labeled, edited]
+  issue_comment:
+    types: [created]
+  # pull_request_target so PRs from forks can be labelled. It runs the base branch's
+  # scripts/triage and only lists the PR's changed paths; the PR's code is never checked out.
+  pull_request_target:
+    types: [opened]
+  schedule:
+    - cron: '41 5 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Only report what would be labelled'
+        type: boolean
+        default: true
+
+permissions:
+  contents: read # to check out scripts/triage
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: triage-${{ github.event.issue.number || github.event.pull_request.number || 'repo' }}
+  cancel-in-progress: false
+
+jobs:
+  triage:
+    name: Triage bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    # Filtered here so the common events (every comment, every label) start no runner.
+    if: >-
+      (github.event_name == 'issue_comment' &&
+      github.event.comment.user.type != 'Bot' && startsWith(github.event.comment.body, '/triage')) ||
+      ((github.event_name == 'issue_comment' || github.event.action == 'edited') &&
+      contains(github.event.issue.labels.*.name, 'needs-info') &&
+      github.event.sender.login == github.event.issue.user.login) ||
+      (github.event.action == 'labeled' && startsWith(github.event.label.name, 'priority:') &&
+      contains(github.event.issue.labels.*.name, 'needs-triage')) ||
+      (github.event_name != 'issue_comment' && github.event.action != 'labeled' && github.event.action != 'edited')
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/triage
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+        with:
+          script: |
+            const triage = require('./scripts/triage/triage.js');
+            const info = require('./scripts/triage/needs-info.js');
+            const event = context.eventName;
+            const action = context.payload.action;
+            const esc = (t) => String(t).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]);
+            const th = (...names) => names.map((data) => ({ data, header: true }));
+            if (event === 'issue_comment') {
+              core.info(await triage.handleComment({ github, context }));
+              await info.handleReply({ github, context });
+            } else if (event === 'issues' && action === 'labeled') {
+              await triage.handleLabeled({ github, context });
+            } else if (event === 'issues' && action === 'edited') {
+              await info.handleReply({ github, context });
+            } else if (event === 'schedule') {
+              const closed = await info.sweep({ github, context });
+              core.info(`Closed for missing information: ${closed.join(', ') || 'none'}`);
+            } else if (event === 'workflow_dispatch') {
+              const dryRun = process.env.DRY_RUN !== 'false';
+              const plan = await triage.backfill({ github, context, dryRun });
+              const asks = await info.backfill({ github, context, dryRun });
+              await core.summary
+                .addHeading(dryRun ? `Backfill dry run: ${plan.length} unlabelled` : `Backfill: ${plan.length} labelled`)
+                .addTable([th('Item', 'Kind', 'Labels', 'Title'), ...plan.map((p) => [`#${p.number}`, p.pull ? 'PR' : 'issue', esc(p.labels.join(', ') || '—'), esc(p.title)])])
+                .addHeading(dryRun ? `needs-info dry run: ${asks.length} would be asked` : `needs-info: ${asks.length} asked`)
+                .addTable([th('Issue', 'Asks', 'Title'), ...asks.map((p) => [`#${p.number}`, esc(p.asks.join(', ')), esc(p.title)])])
+                .write();
+            } else {
+              core.info(`Labelled: ${(await triage.handleOpened({ github, context })).join(', ') || 'nothing'}`);
+              if (event === 'issues') await info.handleOpened({ github, context });
+            }

.github/workflows/winget.yml

@@ -0,0 +1,77 @@
+# Publishing a GitHub release (not a prerelease) opens a pull request at microsoft/winget-pkgs
+# that adds the new version of bherbruck.SolidCraft, so `winget install bherbruck.SolidCraft`
+# and `winget upgrade` get it. Komac (https://github.com/russellbanks/Komac) downloads the three
+# versioned MSIs, reads their product codes and copies the rest from the previous manifest.
+# Skipped until the owner adds the WINGET_TOKEN secret, and while the package isn't in
+# winget-pkgs yet; see docs/releasing.md.
+name: WinGet
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published release tag to submit (e.g. v0.11.1)
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: winget
+  cancel-in-progress: false
+
+env:
+  PACKAGE_ID: bherbruck.SolidCraft
+  KOMAC_VERSION: 2.16.0
+  KOMAC_SHA256: 7d2707fa6210f2789a3702de49fbd150b736dbf426ee0b9bc8e098736f9fd82d
+
+jobs:
+  submit:
+    runs-on: ubuntu-latest
+    steps:
+      - id: check
+        name: Check for the token and the package
+        env:
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          if [ -z "$WINGET_TOKEN" ]; then
+            echo "No WINGET_TOKEN secret: nothing to submit."
+            exit 0
+          fi
+          case "$TAG" in
+            v[0-9]*.[0-9]*.[0-9]*-*|*nightly*) echo "$TAG is a prerelease: not submitted."; exit 0 ;;
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "::error::Unexpected tag '$TAG'"; exit 1 ;;
+          esac
+          if ! gh api "repos/microsoft/winget-pkgs/contents/manifests/b/bherbruck/SolidCraft" --silent; then
+            echo "$PACKAGE_ID isn't in winget-pkgs yet: nothing to update."
+            exit 0
+          fi
+          echo "version=${TAG#v}" >>"$GITHUB_OUTPUT"
+          echo "tag=$TAG" >>"$GITHUB_OUTPUT"
+      - name: Install Komac
+        if: steps.check.outputs.version != ''
+        run: |
+          archive="komac-${KOMAC_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+          curl -fsSLo "$RUNNER_TEMP/$archive" \
+            "https://github.com/russellbanks/Komac/releases/download/v${KOMAC_VERSION}/$archive"
+          echo "$KOMAC_SHA256  $RUNNER_TEMP/$archive" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" komac
+      - name: Open the winget-pkgs pull request
+        if: steps.check.outputs.version != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          VERSION: ${{ steps.check.outputs.version }}
+          TAG: ${{ steps.check.outputs.tag }}
+        run: |
+          base="https://github.com/${GITHUB_REPOSITORY}/releases/download/$TAG"
+          "$RUNNER_TEMP/komac" update "$PACKAGE_ID" --version "$VERSION" \
+            --urls "$base/solidcraft-$VERSION-windows-x64.msi" \
+                   "$base/solidcraft-$VERSION-windows-x86.msi" \
+                   "$base/solidcraft-$VERSION-windows-arm64.msi" \
+            --release-notes-url "https://github.com/${GITHUB_REPOSITORY}/releases/tag/$TAG" \
+            --submit

.gitignore

@@ -7,3 +7,11 @@
 /.claude/worktrees/
 /target-snapshot
 __pycache__/
+.vscode/
+
+# cargo-mutants output (docs/mutation-testing.md)
+mutants.out*/
+
+# external corpus downloads (cargo xtask external-corpus, #1397): fetched at test time,
+# hash-pinned in tests/external-corpus.toml; never commit case data
+/corpus/

AGENTS.md

@@ -1,124 +1,48 @@
-# SolveCraft — instructions for agents
+# SolidCraft: instructions for agents
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
-it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
-`gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
-code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, pure-Rust parametric 3D CAD app (sketch solver, feature timeline, B-rep kernel, an egui UI that agents drive). This file is a router: the hard rules, then the skill to read for your task. Humans: CONTRIBUTING.md.
 
-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section. Behaviour reference: `plan/fusion/`
-   (`menu-tree.json` is Fusion's toolbar dump; `oracle/*/` are parts built in Fusion with their
-   recipes and measurements).
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
+## Start here
+Work: ROADMAP.md, "Where help is wanted most" in CONTRIBUTING.md, issues labelled `help wanted`, `good first issue`, `needs-triage`; architecture in `docs/architecture.md`. Act when the code, docs and rules settle a question; ask only when it changes what users see. Local `plan/` notes are optional.
 
-`plan/` is gitignored (local only).
+## Hard rules (what enforces each)
+- Independent: never copy another product's code, icons, text or templates; never drive or take data from commercial CAD. `skills/solidcraft-ground-rules/SKILL.md`.
+- No GPL/LGPL/AGPL code, not even reading it (OpenCASCADE, FreeCAD, SolveSpace, CadQuery, LibreCAD, QCAD): `cargo xtask licences --check`.
+- Every asset is original or openly licensed with a row in ATTRIBUTION.md; read `assets/AGENTS.md` before icon work: `cargo xtask assets`, `cargo xtask icons`.
+- Never crash: no unwrap/expect/panic/unsafe in non-test code (unsafe allowlist in crash-safety), errors are `Result`, input is hostile: clippy `-D warnings`, `hostile_params_never_panic`.
+- Everything is a command and programmatic calls never open dialogs: `skills/solidcraft-commands/SKILL.md`.
+- Layering (geom, sketch/kernel/render, doc, io, engine, ui-egui, apps); only `crates/kernel` uses truck: `cargo xtask layers`.
+- One outer UI container, one camera path (`navigation::handle`), colours from theme tokens: `cargo xtask ui-containers`.
+- Application code is Rust only and builds for wasm: `cargo xtask wasm`, `cargo xtask web-offline-test`.
+- The product name is SolidCraft; the old name lives only in `docs/compatibility.md`.
+- Sorted lists (message catalogs, `mod` lines, languages) stay sorted: `cargo xtask lists`. Never edit generated files (`docs/features.md`, `THIRD-PARTY-LICENSES.txt`) in a PR.
+- A design-format change is ONE new file in `crates/doc/src/format/pending/`: `scripts/test-format-pending.sh`.
+- A command has input and output schemas (will become required; `schema/unconverted.txt` only shrinks): `skills/solidcraft-commands/SKILL.md`.
+- New UI strings go in `assets/locales/pending/<slug>.json`, ATTRIBUTION rows in `attribution/pending/<slug>.md`: `cargo xtask lists`.
+- A changed default keeps the old behaviour behind a preference and fills the PR's `Changes a default:` line, and no second PR for an issue a lower-numbered one closes: `pr-checks.yml`.
+- A regression test goes in the area's existing test file, never a per-bug file (#3226).
+- Look at open PRs first, claim with a draft PR (lowest number wins), one topic per PR, never force-push `main`, no pushes just to catch up with `main`: `skills/solidcraft-contributing/SKILL.md`.
+- Show observable changes with real screenshots or a recording, captured yourself.
+- Run `cargo xtask ci` before every commit, without switching branches while it runs. `cargo xtask skills` keeps this file and `skills/` honest.
 
-## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
-- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
-- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
-- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
-- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solvecraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
-- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`).
-- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
-- **Clean-room.** Fusion may be *observed* black-box (its UI, its toolbar dump, parts built in it
-  and their measurements, kept under `plan/fusion/`, never committed). Never copy Autodesk icons,
-  artwork, help text, tooltips, templates or materials, and never commit files produced by
-  Fusion. Command ids and command names are used as identifiers only (`xtask/data/fusion-catalog.tsv`
-  holds ids and names, nothing else). File formats come from public specifications. **Never read,
-  copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
-  CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
-  operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
-  fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
-  file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
-- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
-- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
-- **Rust only.** Units are millimetres and radians internally; Z is up.
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
-  passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
-  then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
-  produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.
-- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Showing and following through on changes
-
-- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
-  issues and PRs must include actual descriptive screenshots or a short recording from a
-  small reproduction. This includes kernel, geometry, assembly and backend changes whose
-  effects can be shown in the app. Coding agents should run the app and capture this evidence
-  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
-  or result, preferably before and after, with brief reproduction steps, expected/actual
-  behavior and annotations that point out the relevant detail.
-- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
-  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
-  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
-- Use a small public-safe example and check for private designs, paths, account details or
-  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
-  recording; do not commit generated screenshots or videos just to provide review evidence.
-- Throughout the work and before handoff, check current upstream commits and the relevant
-  PR's merge status. Keep your branch current with upstream merges, resolve conflicts without
-  discarding others' work, and re-run validation when integration changes the result. Use
-  `git pull --rebase origin main` before pushing as above; never force-push. Report the checked
-  upstream/PR state, any conflicts resolved and the validation performed. If a PR remains open,
-  keep monitoring it while the task is active and make its pending status clear at handoff;
-  do not claim it merged without checking.
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
-- `cargo run --release -p solvecraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
-- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solvecraft-cli snapshot`.
-- Headless: `solvecraft-cli run script.json --out part.step`, `solvecraft-cli eval design.solvecraft`,
-  `solvecraft-cli snapshot script.json --out shot.png`, `solvecraft-cli commands`.
-- Fusion oracle: `cargo xtask oracle` replays `plan/fusion/oracle/*/recipe.json` and compares
-  with Fusion's `measure.json` (writes `docs/oracle.md`).
-- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones, parity and estimates. Update it whenever a
-milestone task lands. `cargo xtask parity` recomputes command parity in `docs/parity.md`;
-`cargo xtask oracle` recomputes `docs/oracle.md`.
+## Working on X: read the skill first
+| Working on | Read |
+|---|---|
+| A PR, a claim, review, CI or evidence | `skills/solidcraft-contributing/SKILL.md` |
+| Licences, assets, clean-room, the name | `skills/solidcraft-ground-rules/SKILL.md` |
+| Non-test Rust, hostile input, a crash report | `skills/solidcraft-crash-safety/SKILL.md` |
+| A command, a crate boundary | `skills/solidcraft-commands/SKILL.md` |
+| A dialog, panel, camera, icon, colour | `skills/solidcraft-ui/SKILL.md` |
+| Labels, messages, translations | `skills/solidcraft-ui-text/SKILL.md` |
+| Saving something new in a design, import, export | `skills/solidcraft-file-formats/SKILL.md` |
+| Preferences, a changed default | `skills/solidcraft-preferences/SKILL.md` |
+| Writing or running tests | `skills/solidcraft-tests/SKILL.md` |
+| Slow work, the window thread, wasm | `skills/solidcraft-performance/SKILL.md` |
+| Releases, installers, packages | `skills/solidcraft-packaging/SKILL.md` |
+| Running the app, control channel, MCP tools | `skills/solidcraft-agent-tools/SKILL.md` |
+| Building a part over MCP | `skills/solidcraft-modeling/SKILL.md` |
+| Changing an existing design | `skills/solidcraft-editing/SKILL.md` |
+| A bug report, a crash, a wrong result | `skills/solidcraft-reporting/SKILL.md` |
+| Checking, porting, designs in git | `skills/solidcraft-checking/SKILL.md` |
+| Assemblies, joints, motion | `skills/solidcraft-mechanisms/SKILL.md` |
+>>>>>>> 4a3e0772a (Agents: AGENTS.md becomes a router to focused skills, with a staleness check (Refs #6439))

CLAUDE.md

@@ -1,101 +1,3 @@
-# SolveCraft — instructions for agents
+@AGENTS.md
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
-it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
-`gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
-code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
-
-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section. Behaviour reference: `plan/fusion/`
-   (`menu-tree.json` is Fusion's toolbar dump; `oracle/*/` are parts built in Fusion with their
-   recipes and measurements).
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
-
-`plan/` is gitignored (local only).
-
-## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
-- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
-- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
-- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
-- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solvecraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
-- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
-- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`).
-- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
-- **Clean-room.** Fusion may be *observed* black-box (its UI, its toolbar dump, parts built in it
-  and their measurements, kept under `plan/fusion/`, never committed). Never copy Autodesk icons,
-  artwork, help text, tooltips, templates or materials, and never commit files produced by
-  Fusion. Command ids and command names are used as identifiers only (`xtask/data/fusion-catalog.tsv`
-  holds ids and names, nothing else). File formats come from public specifications. **Never read,
-  copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
-  CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
-  operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
-  fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
-  file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
-- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
-- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
-- **Rust only.** Units are millimetres and radians internally; Z is up.
-- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
-  passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
-  then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
-  produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.
-- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
-- `cargo run --release -p solvecraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
-- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solvecraft-cli snapshot`.
-- Headless: `solvecraft-cli run script.json --out part.step`, `solvecraft-cli eval design.solvecraft`,
-  `solvecraft-cli snapshot script.json --out shot.png`, `solvecraft-cli commands`.
-- Fusion oracle: `cargo xtask oracle` replays `plan/fusion/oracle/*/recipe.json` and compares
-  with Fusion's `measure.json` (writes `docs/oracle.md`).
-- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones, parity and estimates. Update it whenever a
-milestone task lands. `cargo xtask parity` recomputes command parity in `docs/parity.md`;
-`cargo xtask oracle` recomputes `docs/oracle.md`.
+The agent instructions for this repo live in AGENTS.md; edit that file only.

CONTRIBUTING.md

@@ -1,8 +1,10 @@
-# Contributing to SolveCraft
+# Contributing to SolidCraft
 
-SolveCraft is an open-source parametric 3D CAD app written in pure Rust, in the style of
-Autodesk Fusion. You sketch on a plane, constrain the sketch, turn profiles into solids, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
+Agents: start from the router in [AGENTS.md](AGENTS.md), which points to a short skill in [`skills/`](skills/README.md) for each kind of work. This page stays the full human guide.
+
+SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
+You sketch on a plane, constrain the sketch, turn profiles into solids, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, macOS, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.
 
@@ -10,23 +12,45 @@ Help is welcome, whether that's a one-line fix or owning a whole area. This page
 build it, how the code is laid out, the few rules that aren't negotiable, and where help is
 needed most.
 
+Before choosing a task, check the [command inventory](docs/features.md) and
+[roadmap](docs/roadmap-detail.md) for implemented capabilities and current priorities.
+
+Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).
+
+## Kernel work is paused
+
+We're evaluating a new geometry kernel. Until that's decided, please don't open issues, pull
+requests or discussions about kernel work: booleans, fillets, chamfers, shell, offsets, sweeps and
+lofts, threads and holes, STEP/IGES import and export, tessellation, or anything else that changes
+`crates/kernel/`. The pinned issue on the tracker explains it. New ones get the `kernel-paused`
+label (`.github/workflows/kernel-paused.yml`) and a maintainer answers them. Crashes and data loss
+are still taken as issues, and everything outside the kernel carries on as normal.
+
 ## Get it running (about 10 minutes on a fast machine)
 
-You need stable Rust 1.90 or newer. For the web
-build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://trunkrs.dev).
+You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
+build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://github.com/trunk-rs/trunk)
+([documentation](https://trunk-rs.github.io/trunk/)).
 
 ```sh
-git clone https://github.com/bherbruck/solvecraft && cd solvecraft
-cargo run --release -p solvecraft -- --sample      # desktop app with a sample part
+git clone https://github.com/tangency-labs/solidcraft && cd solidcraft
+cargo run --release -p solidcraft -- --sample      # desktop app with a sample part
 cargo xtask test                                   # unit, engine and UI-scenario tests
 cargo xtask ci                                     # everything a PR must pass (see below)
 ```
 
-Web: `cd apps/solvecraft-web && trunk serve --release`, then open the printed URL (`?sample`
+SolidCraft is the product, repository, Cargo package and executable name.
+Build the desktop app with `cargo build --release -p solidcraft`, or the CLI with
+`cargo build --release -p solidcraft-cli`. Run the CLI with
+`cargo run --release -p solidcraft-cli -- commands` (or `target/release/solidcraft-cli commands`
+after building). The old name appears only in the compatibility shims listed in
+[docs/compatibility.md](docs/compatibility.md); don't add new uses of it.
+
+Web: `cd apps/solidcraft-web && trunk serve --release`, then open the printed URL (`?sample`
 opens the sample part, `?webgl` forces WebGL2). Saving and opening files in the browser needs
 HTTPS or localhost, because it uses the Origin Private File System.
 
-Windows from Linux: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
+Windows from Linux: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
 
 ### NixOS: `nix develop`
 
@@ -36,41 +60,30 @@ loader wgpu renders through, and libdbus-1, which rfd's file dialogs reach xdg-d
 through (a dialog then never appears and the pick returns no path):
 
 ```
-ERROR solvecraft: winit EventLoopError: ... The wayland library could not be loaded
+ERROR solidcraft: winit EventLoopError: ... The wayland library could not be loaded
 ERROR eframe::native::run: Exiting because of error: WGPU error: Failed to create surface for any enabled backend: {}
 ERROR rfd::backend::xdg_desktop_portal::portal::libdbus: Can't connect to a portal: libdbus-1.so not found
 ```
 
-`nix develop` (the [`flake.nix`](flake.nix) in the repository root) puts the Wayland, X11,
-EGL-loader and D-Bus libraries on `LD_LIBRARY_PATH`, so `cargo run --release -p solvecraft` works
-from that shell as on any other distribution, file dialogs included. `nix run` builds the app and
-wraps the binary the same way. The Mesa drivers stay the system's, from `/run/opengl-driver`
-(`hardware.graphics.enable`): that is the driver stack the compositor runs on, and wgpu reaches the
-integrated GPU through the EGL loader. The shell deliberately brings no Rust toolchain — the one on
-`PATH` keeps its build cache, where a second `rustc` would make every build recompile the workspace
-from scratch; `nix develop .#rust` is there for a machine with no Rust at all.
+`nix develop` (the [`flake.nix`](flake.nix) in the repository root) supplies Wayland,
+X11, EGL, Vulkan-loader and D-Bus runtime libraries. It also exposes the NixOS
+driver manifests in `/run/opengl-driver/share`, so Vulkan can discover the system
+drivers. Enable `hardware.graphics.enable` on NixOS; other Linux distributions
+may need a matching [nixGL wrapper](https://github.com/nix-community/nixGL).
+The default development shell retains the Rust/C toolchain already on `PATH`;
+`nix develop .#rust` supplies the pinned toolchain and builds in `target/nix`.
 
-**Anti-aliasing on the OpenGL backend.** NixOS keeps the Vulkan ICD descriptions
-(`/run/opengl-driver/share/vulkan/icd.d`) off the Vulkan loader's search path, so wgpu picks its
-OpenGL backend on the integrated GPU. On that backend any multisampling above 1× — the default is
-4× — draws a black window: the UI still lays out and the control channel still answers, but every
-frame, `ui.screenshot` included, comes out empty. Set **Preferences ▸ Graphics ▸ Anti-aliasing** to
-1× and restart (the setting applies on the next start), or write it before the first run, since a
-black window is no way to reach the dialog:
-
-```sh
-mkdir -p ~/.local/share/solvecraft
-echo '{"msaa": 1}' > ~/.local/share/solvecraft/graphics.json
-```
-
-`apps/solvecraft/src/main.rs` reads that file (`graphics_path()`, eframe's storage dir) before the
-window opens; 2× and 4× are the same black window. The Vulkan backend is no way out of it either:
-`libvulkan.so.1` is not on `LD_LIBRARY_PATH`, so `WGPU_BACKEND=vulkan` exits with a
-`CreateSurfaceError` instead.
+To launch, use `nix run .#solidcraft -- --sample`. To install the app's terminal
+commands, desktop entry and generated icons, use `nix profile install .#solidcraft`.
+`nix build` alone creates a build result; it does not install a launcher in your
+desktop menu. The installed `solidcraft` command runs the wrapped app; `solidcraft-cli` is included as
+well. See
+[Nix installation and troubleshooting](docs/nix.md) for remote-flake commands,
+desktop integration and how to distinguish an old executable on `PATH`.
 
 ## How the code is laid out
 
-The [README](README.md#architecture) has the layer table. The short version:
+The [architecture page](docs/architecture.md) has the layer table. The short version:
 
 - `crates/geom`: vectors, planes, meshes, measures.
 - `crates/sketch`: our own constraint solver, plus profile finding.
@@ -86,33 +99,53 @@ The [README](README.md#architecture) has the layer table. The short version:
   commands.
 - `crates/ui-egui`: the desktop/web front end (egui + wgpu). It's swappable; nothing below it
   depends on egui.
-- `crates/mcp`, `apps/solvecraft`, `apps/solvecraft-cli`, `apps/solvecraft-web`.
+- `crates/mcp`, `apps/solidcraft`, `apps/solidcraft-cli`, `apps/solidcraft-web`.
 
 `cargo xtask layers` fails the build if a lower layer depends on a higher one.
 
 ## Rules that aren't negotiable
 
-1. **Clean-room.** We observe Fusion as a black box: its UI, how parts it builds measure, and
-   what it does with a given input. We never copy Autodesk code, icons, artwork, help text,
-   tooltips, templates or materials, and we never commit files Fusion produced. Command ids are
-   our own (`solid.fillet`, not Fusion's internal names).
+1. **Independent.** SolidCraft is independent. Behaviour is designed from public
+   documentation, general CAD conventions and user feedback. Reference tests use analytic values
+   and open-source tools. We don't drive, script, automate or extract data from commercial CAD
+   products, and we never copy another product's code, icons, artwork, help text, tooltips,
+   templates or materials. Command ids are our own (`solid.fillet`).
 2. **No GPL/LGPL/AGPL code, not even reading it.** That rules out OpenCASCADE, FreeCAD
-   (including planegcs), SolveSpace, CadQuery/OCP, LibreCAD and QCAD. SolveCraft is
-   MIT OR Apache-2.0, and its solver and blends are written from the maths. Permissive
-   dependencies are fine. Note which one you're adding and why in the PR, and run
-   `cargo xtask licences` so THIRD-PARTY-LICENSES.txt lists it (CI checks that it is current).
+   (including planegcs), SolveSpace, CadQuery/OCP, LibreCAD and QCAD. SolidCraft is
+   MIT OR Apache-2.0, and its solver and blends are written from the maths. (Running an
+   open-source application to get reference values for a test is fine; reading its source is
+   not.) Permissive
+   dependencies are fine. Note which one you're adding and why in the PR. THIRD-PARTY-LICENSES.txt
+   lists it once the change lands: the Generated files workflow rewrites it on `main`.
+   Nightly/manual CI also scans advisories, bans and sources with cargo-deny; see
+   [the local command and coverage limits](docs/book/src/dev/testing.md#dependency-advisories).
 3. **Every asset is original or openly licensed and has a row in
    [ATTRIBUTION.md](ATTRIBUTION.md).** Icons are drawn in code (`crates/ui-egui/src/icons.rs`).
    `cargo xtask assets` enforces this.
 4. **Never crash.** People trust a CAD app with their work.
    - Non-test code never uses `unwrap`, `expect`, `panic!` or indexing on input-derived data.
-     There's no `unsafe`, and clippy denies it.
+     There's no `unsafe` outside `apps/solidcraft/src/open_documents.rs` (macOS file-open events),
+     `apps/solidcraft/src/native_crash.rs` (Windows native crash capture) and
+     `crates/threedx-client/src/macos.rs` (the 3Dconnexion driver's client API on macOS), and the
+     compiler denies it.
    - An unsupported case returns an error ("not supported yet: …"); it never panics.
-   - Every call into truck goes through `solvecraft_kernel::guard`.
+   - Every call into truck goes through `solidcraft_kernel::guard`.
    - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
-   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
+   `crates/engine/src/cmd/` with input and output schemas (see
+   [Adding a command](docs/book/src/dev/commands.md#adding-a-command); a test warns about a
+   command without them, and will fail it once required), engine tests that measure the result (volume, area,
    face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
+   viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
+   `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
+   `NavCaps` saying whether it can orbit (off for flat 2D pages) and pick. New canvases must use
+   `navigation::handle`; never read drags, the wheel or pinch to move the camera yourself. The
+   `hand_rolled_camera_input_is_rejected` test fails if a page does.
+
+Labels, parameter docs, messages and docs use the terms in the
+[glossary](https://docs.solidcraft.io/reference/glossary.html): one term for each idea. A change that adds a new
+idea adds its term there.
 
 [AGENTS.md](AGENTS.md) has the long form of these rules. It's written for AI agents, but it's
 the most complete description of the house style.
@@ -123,7 +156,13 @@ the most complete description of the house style.
 |---|---|---|
 | Unit and engine tests | next to the code, or `*_tests.rs` files | `cargo xtask test` (or `cargo test --workspace --profile ci`) |
 | UI scenarios | `crates/ui-egui/tests/scenarios/*.json` | part of `cargo test` |
-| Fusion oracle | `cargo xtask oracle` | needs the local oracle data (see below) |
+| Reference tests | `cargo xtask oracle` | `tests/oracle/` (see below) |
+
+A geometry change that changes the robustness goldens re-records them in the same pull request:
+`ROBUSTNESS_GOLDENS_BLESS="why it changed" cargo test --profile ci -p solidcraft-engine --lib robustness_goldens::`
+(see [docs/robustness.md](docs/robustness.md)); CI runs every seed on pull requests that touch geometry.
+[docs/mutation-testing.md](docs/mutation-testing.md) shows how to find kernel behaviour these
+black-box suites miss.
 
 **UI scenarios** drive the real app headless: start a tool, click a plane or a sketch point,
 press keys, then assert on the result.
@@ -142,32 +181,154 @@ press keys, then assert on the result.
 A new `.json` file in that folder is picked up automatically. To record a bug before it's fixed,
 put `{"pending": "why"}` in the scenario, and remove it in the PR that fixes the bug.
 
+**A failing test without its fix can't merge as-is:** it would turn `main`'s CI red for everyone.
+Either include the fix in the same PR, or mark the test `#[ignore = "fails until #123 is fixed"]`
+(it can then merge right away), and remove that line in the PR that fixes the bug.
+
 **Use the `ci` profile.** CI runs the tests with `--profile ci`: light optimisation, line tables,
 no LTO, and debug assertions off (truck has debug-only assertions that reject valid geometry). It
 builds several times faster than `--release`. If a test fails only in a plain debug build, say so
 in the PR. `cargo xtask test` builds the tests with it and then runs every test binary at once
 (`cargo test` runs them one after another); arguments after `--` go to each binary, e.g.
-`cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
-depend on wall-clock timing.
+`cargo xtask test -- shell`. Set `SOLIDCRAFT_TEST_JOBS` to a positive integer to opt into a
+shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
+For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
+worker consumes one of those slots. Every binary and side check still runs after failures.
+Without the variable the existing concurrency is unchanged. With it set, each test binary
+inherits `RUST_TEST_THREADS` and `ACTION_MATRIX_JOBS` of `max(1, cpus / jobs)` — the machine's
+parallelism shared between the binaries in flight — unless you set either one explicitly;
+explicit caller overrides always win. Cargo's build-job setting remains an independent caller
+override; this limit does not change test filters, timeouts or baselines.
+Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.
 
-**The Fusion oracle** is a set of 76 reference parts, each built in Fusion from a recipe.
-SolveCraft rebuilds the same recipe and compares volume, area and topology counts with Fusion's
-measurements; [docs/oracle.md](docs/oracle.md) has the current results. The recipes and
-measurements live outside the repo (`plan/`, gitignored), because they come from a Fusion
-install. If you work on geometry and want to check against it, ask in an issue.
+**Ready pull requests test what they touch.** CI maps changed files to workspace packages and
+runs Clippy, the test build and tests for those and their dependents. The
+[package selector](scripts/ci/affected.py) and [CI workflow](.github/workflows/ci.yml) define
+which changes require native checks; documentation, packaging, other-workflow and bot-script-only
+changes run the repository checks only, on pull requests and on `main`. Workspace-wide changes,
+merge-queue groups, nightly runs and Run workflow select the full workspace. A push to `main`
+reuses a successful merge-queue run for the same commit, and runs only the repository checks
+when no code changed since the last push to `main` that passed; otherwise it runs the full
+suite. Doc tests, reference tests and the Windows jobs run on `main` and nightly only.
+
+**CI shards the tests.** One job builds them into a cargo-nextest archive; two shards run on
+pull requests and four during full validation. Every test runs in its own process: don't rely
+on state left by another test.
+Pull requests skip a few heavy tests (one to twelve minutes each), which run in full validation
+(the merge queue, nightly, manual runs and pushes to `main` not already tested by the queue).
+Check that validation after merging. They are listed in
+`.config/nextest.toml` and the [testing page](docs/book/src/dev/testing.md):
+
+- `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness` and
+  the seeds of `tests::robustness_goldens` (`seed_00` … `seed_95`; pull requests that change the kernel, truck or the goldens run all but the slowest, `SLOW_SEEDS` in `ci.yml`),
+  `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
+  `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
+  `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`, the `atomic_commands` contract tests
+- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`, `tspline::tests::hostile_tsplines_never_panic`, and the `boolean_props` property tests
+  (these run only in the nightly "Property tests" job: their inputs are random, so main skips them too)
+- `solidcraft-ui-egui` scenarios: `acceptance_sensor_enclosure`
+
+**The action matrix** tries every ordinary action on every face, edge, vertex and body of a
+corpus of designs against a checked-in ratchet ([docs/action-matrix.md](docs/action-matrix.md)).
+A pull request that makes an action pass should record it with `cargo xtask action-matrix --bless`;
+one that makes a passing action fail fails the sample every CI run checks.
+
+**The reference tests** live in [`tests/oracle/`](tests/oracle/), each a `recipe.json`
+in our own format with an `expected.json` beside it. SolidCraft rebuilds the recipe and compares
+body count, volume, area, centre of mass and bounding box (and, where there is a `reference.stl`,
+the surface itself). Expected values are either worked out in closed form
+(`tools/oracle-analytic/`) or computed by building the same recipe in FreeCAD, run as a separate
+program (`tools/freecad-oracle/`); each file says which. The generated
+[reference test report](docs/oracle.md) has the current case count and results. The reference-test
+CI job runs `cargo xtask oracle` during full validation; pull-request runs skip it. A case that
+fails because of a known bug names its issue in `expected.json` (`"known_failure": "#123"`);
+never change an expected value to match SolidCraft's output.
+
+## Changing the design file format
+
+A design file says which format it is in (`"format": "solidcraft/N"`). If your change saves
+something new in a design (a field, a feature type, a new kind of name), or makes older designs
+mean something else, it needs a format change. **Add one file, and edit nothing shared:**
+
+1. Create `crates/doc/src/format/pending/<what-it-is>.rs` (lowercase, dashes). Start it with a
+   `//!` note: what is saved, what older designs get without it, and that the last release asks
+   for an update instead of meeting it.
+2. If older designs must be rewritten as they open, put `pub fn step(v: &mut Value) ->
+   crate::Result<()>` in the same file. Pending steps run in file-name order, after the older
+   formats' steps.
+3. Don't touch `FORMAT`, `JSON_STEPS`, the history in `crates/doc/src/format.rs`, another
+   change's file, or any `v<N>/` folder: those are fixed once released.
+
+That's all. The build counts the files: while any are pending it writes the next format number,
+which no release reads, so a release refuses a design that has your change instead of losing it.
+A file also lists the pending changes it has (`format_pending`), so a later development build
+runs only the steps that file is missing. Two pull requests that each add a change merge without
+a conflict. `crates/doc/src/format/pending/README.md` has an example.
+
+**At release time** the maintainer runs `scripts/fold-format-pending.sh`, which moves the pending
+files into `crates/doc/src/format/v<N>/` and fixes that number for good (see
+[docs/releasing.md](docs/releasing.md)). Never add a file to a `v<N>/` folder afterwards.
+
+## Lists many changes add to
+
+Some files gain an item in many pull requests at once. They are kept so that two changes that
+each add an item only meet when their items are neighbours, which spares everyone a conflict
+and a fresh CI run:
+
+- **Message catalogs** (`assets/locales/*.json`): one message per line, sorted by id. Add your
+  message anywhere and run `cargo xtask lists --fix`; `cargo xtask lists` (in `cargo xtask ci`
+  and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
+- **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
+  sorted). Add a new module into the existing group, not as a new group at the end.
+- **Commands without schemas** (`crates/engine/src/schema/unconverted.txt`): sorted, one id per
+  line, and it only shrinks. Converting a command removes its line; a new command is never added
+  to it.
+- **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
+  checks it).
+- **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
+  after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
+  features`). Don't regenerate or edit them in a pull request.
+- **Design format**: one file per change, never an edit to a shared number (above).
+- **New UI strings and attribution rows**: one new file per change, `assets/locales/pending/<slug>.json`
+  and `attribution/pending/<slug>.md`, instead of editing the catalogs or the ATTRIBUTION.md table;
+  `cargo xtask fold-pending` folds them on `main` (see the README in each folder).
 
 ## Sending a change
 
-1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solvecraft/issues), labelled
-   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). Before starting,
-   comment on the issue so it gets the `in progress` label and two people don't build the same
-   thing. For anything bigger than a bug fix that has no issue yet, open one first.
+1. Work is tracked in [GitHub issues](https://github.com/tangency-labs/solidcraft/issues), labelled
+   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). For anything
+   bigger than a bug fix that has no issue yet, open one first. **Claim the issue with a draft
+   PR** before you start, so two people don't build the same thing:
+   - Check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
+   - Branch from the latest `main`, commit `git commit --allow-empty -m "claim: #N"`, push, and
+     open a **draft** PR titled `<summary> (#N)`, e.g. `Fillet: variable radius along a chain (#123)`.
+   - **The lowest-numbered open PR for an issue wins.** If yours lost, close it (or offer to help
+     on the other one).
+   - The bot records the claim when the PR is opened: it assigns you, adds `in progress` and
+     says so on the issue. It reads `#N` in the PR title and `Fixes #N` in the body. If someone
+     already holds the issue, or an older open PR references it, it says so on your PR instead.
+   - Want to stake a claim before you have a branch? Comment `/claim` on the issue (below).
+   - Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
+     comment on it first, then open your own claim.
+   - Mark the PR ready for review when it is done.
 2. Branch from `main` and keep the PR to one topic.
 3. Run `cargo xtask ci` before pushing. It runs fmt, the asset, licence and layer checks,
    clippy (`-D warnings`), then the tests with the wasm build check alongside. A PR has to pass it.
+   Heavy CI runs after review: a pull request gets the formatting and repository checks and a
+   quick compile (`cargo check`) when you push. Once a maintainer has reviewed it they add the
+   `approved-for-ci` label when the PR is ready to merge, which runs the full CI (build, tests,
+   goldens, Clippy); every push after that runs the full set again. Maintainers merge approved
+   PRs in groups by area, so PRs that touch the same code meet a conflict at most once.
 4. Reference the issue (`Fixes #12`). In the PR, say what you tested and how. For geometry work, include the measured numbers (and
    the expected ones).
 
+Commenting `/claim` assigns you, adds the `in progress` label, and replies with its automatic cleanup
+deadline. It frees a claim with no linked PR after 72 hours, or a claim with a PR after 14 days
+without pushes. These automatic cleanup deadlines are separate from the daily progress and
+72-hour takeover policy above. A draft PR that references the issue claims it the same way.
+`/unclaim` releases the bot claim early (only you or a maintainer can). Issues a maintainer has
+taken are never freed automatically.
+
 Help reviewers see what the words mean. For observable CAD, UI or model behavior, please
 include actual descriptive screenshots or a short recording in the issue or PR. This evidence
 is required for changes or bugs that can be demonstrated in the app, including kernel,
@@ -182,22 +343,62 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.
 
-Keep checking upstream commits and the relevant PR's merge status throughout the work and
-before handoff. Integrate upstream merges, resolve conflicts without losing others' changes,
-and validate the integrated result. Before pushing, run `git pull --rebase origin main`, re-run
-CI if it brought changes, and push without force. Report the upstream/PR state you checked,
-any conflicts resolved and validation results. While a task remains active, follow an open
-PR through its status changes; at handoff, clearly identify anything still awaiting merge.
+To show a picture without committing it, attach the media to the PR (it goes to the PR's own
+attachment storage and renders inline in the comment). A gist is the better home for a log or
+another text file, and you link it; a gist does not render a picture inline. The review artifacts
+stay out of the diff that way, and nothing has to be pushed to a branch of its own.
 
-Much of SolveCraft so far was written by AI coding agents (Claude) working in parallel, each
+Attaching works in the browser for anyone who can comment: drag the file into a comment on the
+pull request. A command-line agent without a browser session usually cannot attach a file (the
+upload needs write access to this repository). Say so in the pull request, and the person running
+the agent or a maintainer can attach it.
+
+Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
+`main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
+run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
+push a change anyway, or GitHub reports a conflict, rebase onto the latest `main` (push your
+branch with `--force-with-lease`) or merge `main` in once, and resolve conflicts without losing
+others' changes. Don't re-run CI on an unchanged commit either: a real failure fails again.
+Re-run only a job that runner trouble cancelled, with "Re-run failed jobs". While a task remains
+active, follow an open PR through its status changes; at handoff, clearly identify anything
+still awaiting merge.
+
+Much of SolidCraft so far was written by AI coding agents (Claude) working in parallel, each
 owning one area, with a human setting direction and reporting bugs. Their working notes are in
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.
 
+Two quick checks run on every pull request (`.github/workflows/pr-checks.yml`, not required): it
+fails when a lower-numbered open PR by someone else already closes the same issue (the label
+`not-a-duplicate` skips it), or when the description lacks the `Changes a default: no` / `Changes a default: yes — <what>, old behaviour kept behind preference <name>` line (docs-only and bot PRs are exempt).
+
+## Labels and triage
+
+The triage bot labels every new issue and PR (`.github/workflows/triage.yml`). It only adds labels;
+correct them freely and it won't put them back.
+
+- **PRs** get `area:*` from the paths they change (`crates/kernel` and `crates/geom` →
+  `area:kernel`, `crates/ui-egui` and the apps → `area:ui`, `.github/`, `scripts/`, `docs/` →
+  `area:infra`, and so on).
+- **Issues** get `bug` (in-app reports and the bug template), `enhancement` (feature requests),
+  `priority:P1` for crashes, and an `area:*` from the title or the reported command. Until it has
+  a priority, an issue carries `needs-triage`; setting a priority removes it.
+- **Maintainers** comment `/triage area:kernel P1` (any existing label; `P0`–`P3` for a
+  priority, which replaces the old one; `-label` removes one) to sort an issue or PR.
+- **Short bug reports without steps to reproduce** get `needs-info` and one comment asking for
+  the steps (and the version, when it's missing). An app report that arrived empty is asked to
+  paste the report the app copied to the clipboard. The reporter's reply, or an edit that adds the
+  steps, removes the label; an issue that stays in `needs-info` for 14 days is closed, and can be
+  reopened any time. Feature requests, app reports with their details, and maintainers' issues
+  are never asked.
+- `needs-triage` is the queue: [open issues with it](https://github.com/tangency-labs/solidcraft/issues?q=is%3Aopen+label%3Aneeds-triage).
+
 ## Where help is wanted most
 
-See the [`help wanted`](https://github.com/bherbruck/solvecraft/labels/help%20wanted) and
-[`good first issue`](https://github.com/bherbruck/solvecraft/labels/good%20first%20issue) labels.
+**Kernel speed (slow fillets, booleans, STEP):** please don't rewrite the current kernel code for speed; it is being replaced by [solidcore](https://github.com/bherbruck/solidcore) ([progress](https://tangency-labs.github.io/solidcore/)). Report slow cases with a file under the `kernel-perf` label, and put kernel effort into solidcore instead. See [#1597](https://github.com/tangency-labs/solidcraft/issues/1597).
+
+See the [`help wanted`](https://github.com/tangency-labs/solidcraft/labels/help%20wanted) and
+[`good first issue`](https://github.com/tangency-labs/solidcraft/labels/good%20first%20issue) labels.
 In order of how much they'd help users:
 
 1. **Fillet and blend robustness.** Fillets are our own code (truck has no fillet operation).
@@ -206,15 +407,24 @@ In order of how much they'd help users:
    faces, and fillets that consume neighbouring faces.
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
    through without a kernel error. Each failing seed is a reproducible bug.
-3. **Y-up / Z-up.** SolveCraft is Z-up only, so most STEP files (from SolidWorks, Onshape, or
-   Fusion's default) open lying on their backs. Fusion solves this with a "default modeling
-   orientation" preference.
-4. **Imported appearances.** Colours from STEP files are lost when a feature changes the
-   imported body. They should become design appearances on import.
-5. **Drawings, CAM and mesh tools.** These are out of scope for now (see
-   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
+3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
+   [ROADMAP.md](docs/roadmap-detail.md)), but anyone who wants to own one is welcome.
+
+## Updating the generated feature list
+
+After adding or renaming commands, run `cargo xtask features`. The registry is the
+source of truth for `docs/features.md`; do not hand-edit the generated rows.
+The generator sorts commands by ID and omits global and per-section counters,
+so additions to unrelated areas no longer rewrite shared summary lines.
+
+If two branches still conflict in this file (for example, adjacent additions in
+the same area), first resolve the command registry and source conflicts, then run
+`cargo xtask features` again and stage the regenerated file. Do not use Git's
+`union` merge driver: it can silently retain stale or duplicate command rows.
+The generator tests cover stable ordering and additions that leave existing lines
+unchanged. The initial switch to sorted rows is a one-time larger diff.
 
 ## Licence
 
 By contributing you agree that your contribution is licensed as MIT OR Apache-2.0, like the rest
-of SolveCraft. SolveCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.
+of SolidCraft. SolidCraft isn't affiliated with any CAD vendor; product names are trademarks of their owners (see NOTICE).

Cargo.toml

@@ -5,31 +5,45 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.24.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
-rust-version = "1.90"
-authors = ["SolveCraft contributors"]
-repository = "https://github.com/bherbruck/solvecraft"
+rust-version = "1.95"
+authors = ["SolidCraft contributors"]
+repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
+robust = "1.2"
 # internal
-solvecraft-geom = { path = "crates/geom" }
-solvecraft-sketch = { path = "crates/sketch" }
-solvecraft-kernel = { path = "crates/kernel" }
-solvecraft-render = { path = "crates/render" }
-solvecraft-doc = { path = "crates/doc" }
-solvecraft-io = { path = "crates/io" }
-solvecraft-engine = { path = "crates/engine" }
-solvecraft-ui-egui = { path = "crates/ui-egui" }
-solvecraft-mcp = { path = "crates/mcp" }
+solidcraft-geom = { path = "crates/geom" }
+solidcraft-sketch = { path = "crates/sketch" }
+solidcraft-kernel = { path = "crates/kernel" }
+solidcraft-render = { path = "crates/render" }
+solidcraft-gpu = { path = "crates/gpu" }
+solidcraft-doc = { path = "crates/doc" }
+solidcraft-io = { path = "crates/io" }
+solidcraft-engine = { path = "crates/engine" }
+solidcraft-ui-egui = { path = "crates/ui-egui" }
+solidcraft-space-mouse = { path = "crates/space-mouse" }
+solidcraft-mcp = { path = "crates/mcp" }
+solidcraft-derive = { path = "crates/derive" }
+solidcraft-3dx-client = { path = "crates/threedx-client" }
 
 # foundation
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
+# derive macros (crates/derive); already in the tree through serde_derive
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
+# command parameter and result schemas
+schemars = "1.2"
+serde_path_to_error = "0.1"
 log = "0.4"
 sha2 = "0.10"
+moxcms = { version = "0.8.1", default-features = false, features = ["extended_range"] }
+semver = "1"
 
 # geometry kernel (Apache-2.0; see plan/adr/0001-geometry-kernel.md). Only crates/kernel uses it.
 truck-modeling = "0.6"
@@ -37,16 +51,49 @@ truck-shapeops = { version = "0.4", default-features = false }
 truck-meshalgo = { version = "0.4", default-features = false, features = ["tessellation", "analyzers"] }
 truck-stepio = { version = "0.3", default-features = false }
 truck-topology = "0.6"
+# constrained Delaunay + Ruppert refinement for trimmed faces (MIT OR Apache-2.0); already in the
+# tree through truck-meshalgo.
+spade = { version = "2.15", default-features = false, features = ["std"] }
+rayon = "1.12"
 
 # packages (3MF)
-zip = { version = "3", default-features = false, features = ["deflate"] }
-quick-xml = "0.38"
+zip = { version = "9", default-features = false, features = ["deflate"] }
+quick-xml = "0.41"
+# STEP text in a legacy encoding (GBK, Shift_JIS, …) instead of Part 21 escapes (#2344): detect
+# and decode it. Both MIT OR Apache-2.0 (encoding_rs adds BSD-3-Clause data); encoding_rs is
+# already in the tree through cadmpeg-codec-step.
+chardetng = "0.1"
+encoding_rs = "0.8"
+# glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
+# read by crates/io itself, so no image decoding or file access comes with it.
+gltf = { version = "1.4", default-features = false, features = ["names"] }
+# The computer's name in a design's "open elsewhere" lock file (MIT OR Apache-2.0; already in the
+# tree through x11rb).
+gethostname = "1"
+
+# FreeCAD and Rhino import (Apache-2.0, pure Rust; native and browser builds).
+# Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
+# features, so cadmpeg's codecs for commercial formats (f3d, sldprt, inventor, catia, creo, nx)
+# and its ShapeManager/ACIS `sat` codec are not compiled in. `step` is the writer we restate through.
+cadmpeg-core = "=0.6.3"
+cadmpeg-ir = "=0.6.3"
+cadmpeg-registry = { version = "=0.6.3", default-features = false, features = ["fcstd", "rhino", "step"] }
 
 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
 ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
 
+# Ends a process group with the system call (MIT; already in the tree through zip).
+nix = { version = "0.31", default-features = false, features = ["signal"] }
+
 # images
-image = { version = "0.25", default-features = false, features = ["png"] }
+image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
+png = "0.18.1"
+# LZW for GIF animations (MIT OR Apache-2.0, pure Rust; already in the tree through image's tiff).
+weezl = "0.1.12"
+# rasterises the UI icon SVGs (BSD-3-Clause, pure Rust, builds for wasm)
+tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd"] }
+# build scripts: reads the icon palette (MIT OR Apache-2.0)
+toml = "1"
 
 # ui
 egui = "0.36"
@@ -54,6 +101,10 @@ eframe = { version = "0.36", default-features = false, features = ["persistence"
 # Instant/SystemTime that also work in the browser (std panics on wasm32-unknown-unknown).
 web-time = "1"
 egui-wgpu = "0.36"
+# the wgpu egui-wgpu uses, for compute (crates/gpu); backends come from the apps' features
+wgpu = { version = "30", default-features = false, features = ["std", "wgsl"] }
+naga = { version = "30", default-features = false }
+pollster = "0.4"
 rfd = "0.17"
 
 [workspace.lints.rust]
@@ -87,16 +138,31 @@ incremental = false
 
 [profile.ci.package."*"]
 opt-level = 2
+# No line tables for dependencies: they were over a third of the test archive every CI shard
+# downloads. Our own crates keep theirs, so a backtrace still names file:line in them.
+debug = false
 
 [profile.release]
 opt-level = 3
 lto = "thin"
 codegen-units = 16
-debug = 0
+# Line tables only: crash reports name file:line in their backtraces (no runtime cost; a larger
+# binary). See docs/crash-reports.md.
+debug = "line-tables-only"
 
-# truck-shapeops with SolveCraft fixes (Apache-2.0, see vendor/truck-shapeops and ATTRIBUTION.md).
+# truck-shapeops with SolidCraft fixes (Apache-2.0, see vendor/truck-shapeops and ATTRIBUTION.md).
 [patch.crates-io]
+truck-geometry = { path = "vendor/truck-geometry" }
 truck-shapeops = { path = "vendor/truck-shapeops" }
 truck-stepio = { path = "vendor/truck-stepio" }
 truck-meshalgo = { path = "vendor/truck-meshalgo" }
 matext4cgmath = { path = "vendor/matext4cgmath" }
+
+# Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
+egui-wgpu = { path = "vendor/egui-wgpu" }
+
+# Mutation testing (cargo-mutants, docs/mutation-testing.md): the ci profile with incremental
+# builds, since every mutant rebuilds the crates above the one it changes.
+[profile.mutants]
+inherits = "ci"
+incremental = true

LICENSE-MIT

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 SolveCraft contributors
+Copyright (c) 2026 SolidCraft contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

NOTICE

@@ -1,5 +1,5 @@
-SolveCraft
-Copyright (c) 2026 SolveCraft contributors.
+SolidCraft
+Copyright (c) 2026 SolidCraft contributors.
 Licensed under the MIT License or the Apache License, Version 2.0, at your option
 (LICENSE-MIT, LICENSE-APACHE).
 
@@ -7,10 +7,10 @@ Third-party material
 
 Software dependencies are listed in Cargo.lock; their licences are in THIRD-PARTY-LICENSES.txt
 (`cargo xtask licences`), which the programs also carry (Help > About > Licences,
-`solvecraft-cli licences`). The geometry kernel builds on the truck crates
+`solidcraft-cli licences`). The geometry kernel builds on the truck crates
 (truck-modeling, truck-shapeops, truck-meshalgo, truck-stepio, truck-topology and their
 dependencies, https://github.com/ricosjp/truck), licensed under the Apache License 2.0 and used
-as libraries. truck-shapeops 0.4.0 is vendored in vendor/truck-shapeops with SolveCraft
+as libraries. truck-shapeops 0.4.0 is vendored in vendor/truck-shapeops with SolidCraft
 modifications (listed in vendor/README.md and marked in the source); its licence is in
 vendor/truck-shapeops/LICENSE. Copyright (c) RICOS Co. Ltd.
 
@@ -19,9 +19,18 @@ licensed MIT OR Apache-2.0; ATTRIBUTION.md lists the files.
 The release packaging (.github/workflows/release.yml, packaging/) is adapted from PhotoCraft
 (https://github.com/storytold/photocraft), licensed under the Apache License 2.0.
 
-None of the bundled assets come from third parties: every icon is drawn in code. The per-file
-list is in ATTRIBUTION.md.
+The incremental Radiance RGBE row adapter in crates/render/src/lighting/hdr.rs adapts
+decoding state machines from image 0.25.10 (https://github.com/image-rs/image),
+MIT OR Apache-2.0. ATTRIBUTION.md describes the bounded/cancellable changes; the
+original licence texts are included in THIRD-PARTY-LICENSES.txt.
 
-SolveCraft is an independent project and is not affiliated with, sponsored by or endorsed by
-Autodesk, Inc. Autodesk and Fusion are trademarks of Autodesk, Inc.; they are used here only to
-describe compatibility goals.
+Most bundled assets are drawn in code or contributed originally; third-party fonts (Liberation Sans
+for sketch text, BIZ UDPGothic for web Japanese display) are licensed under SIL OFL 1.1. The
+per-file list is in ATTRIBUTION.md.
+
+SolidCraft is an independent project and is not affiliated with, sponsored by or endorsed by
+Autodesk, Dassault Systèmes, PTC, Siemens, Blender or any other CAD vendor. Fusion, AutoCAD,
+Inventor, Alias and Tinkercad are trademarks of Autodesk, Inc.; SolidWorks is a trademark of
+Dassault Systèmes; Onshape and Creo are trademarks of PTC; Blender is a trademark of the Blender
+Foundation. Product names appear only to describe compatibility, such as the mouse navigation
+presets in Preferences › Navigation and file formats from public specifications.

README.md

@@ -1,143 +1,146 @@
-# SolveCraft
+<p align="center">
+  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" width="96" height="96" alt="SolidCraft" />
+</p>
 
-**Parametric 3D CAD; an open-source, [clean-room](CLAUDE.md) reimplementation of Autodesk
-Fusion 360, built in pure Rust.**
+<h1 align="center">SolidCraft</h1>
 
-Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
-and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
-model through the built-in MCP server. Part of the storytold "craft" family.
+<p align="center">
+  <strong>An open-source parametric 3D CAD application built in pure Rust.</strong><br />
+  Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
+  and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
+  model through the built-in MCP server.
+</p>
 
-![SolveCraft 0.2.0: dimension a line, extrude a plate with an elliptical hole, and change its width while preserving the hole](docs/screenshots/demo.gif)
+<div align="center">
 
-*The actual 0.2.0 desktop UI: dimension a line from its endpoints, build a plate with an elliptical hole, then change its width from 25 → 35 mm and watch it rebuild. Includes the new axis navigation. 2× GIF preview; [full video at real-time speed](https://github.com/bherbruck/solvecraft/releases/download/v0.2.0/solvecraft-0.2.0-demo.mp4).*
+[![Download for Windows][badge-windows]][windows-msi]
+[![Download for macOS][badge-macos]][macos-dmg]
+[![Download for Linux][badge-linux]][linux-appimage]
+[![Get it from the Snap Store][badge-snap]][snap-store]
+[![Try it in your browser][badge-web]][web-app]
 
-**Documentation:** the [SolveCraft book](https://bherbruck.github.io/solvecraft/) (user guide,
-developer guide and command reference; sources in [docs/book](docs/book)), and the
-[web app](https://bherbruck.github.io/solvecraft/app/) to try it in the browser.
+</div>
 
-**Status: early but usable for simple parts.** 76 of 76 reference parts built in Fusion
-rebuild in SolveCraft with the same volume, area and topology ([docs/oracle.md](docs/oracle.md));
-command parity with Fusion's Design workspace is tracked in [docs/parity.md](docs/parity.md).
-Open work and known bugs are in [GitHub issues](https://github.com/bherbruck/solvecraft/issues),
-and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
+<p align="center">
+  <a href="https://solidcraft.io">Website</a> ·
+  <a href="https://solidcraft.io/download">Download</a> ·
+  <a href="https://solidcraft.io/app">Try it in the browser</a> ·
+  <a href="https://docs.solidcraft.io/">Documentation</a> ·
+  <a href="https://www.blacksmith.sh"><img src="https://img.shields.io/badge/CI-Blacksmith-000000?logo=githubactions&logoColor=white" alt="CI powered by Blacksmith" /></a>
+  <a href="https://discord.gg/FtU4NQNVDH">Discord</a> ·
+  <a href="https://github.com/bherbruck/solidcore">SolidCore</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/tangency-labs/solidcraft/actions/workflows/ci.yml?query=branch%3Amain"><img src="https://github.com/tangency-labs/solidcraft/actions/workflows/ci.yml/badge.svg?branch=main" alt="CI" /></a>
+  <a href="https://github.com/tangency-labs/solidcraft/releases/latest"><img src="https://img.shields.io/github/v/release/tangency-labs/solidcraft?label=release" alt="Latest release" /></a>
+  <a href="https://github.com/tangency-labs/solidcraft/releases"><img src="https://img.shields.io/github/downloads/tangency-labs/solidcraft/total?label=downloads" alt="Downloads" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/tangency-labs/solidcraft" alt="Licence" /></a>
+  <a href="https://discord.gg/FtU4NQNVDH"><img src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
+  <a href="https://remade.wiki/projects/solidcraft/"><img src="https://remade.wiki/badges/listed-on-remade-classic.svg" alt="Listed on Remade" /></a>
+  <a href="https://github.com/tangency-labs/solidcraft/stargazers"><img src="https://img.shields.io/github/stars/tangency-labs/solidcraft?style=flat" alt="Stars" /></a>
+</p>
+
+<p align="center">
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily" alt="tangency-labs%2Fsolidcraft | Trendshift" width="250" height="55"/></a>
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
+</p>
+
+![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)
+
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+
+## Download
+
+- **Windows:** the [installer][windows-msi].
+- **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
+- **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
+- **Web:** [try it in your browser][web-app], no install.
+
+ARM64 and 32-bit builds, portable zip, .deb, .rpm, Flatpak and the other packages are on the
+[downloads page](docs/downloads.md). The downloads aren't signed yet: on Windows choose
+**More info**, then **Run anyway** in SmartScreen; on macOS right-click SolidCraft and choose **Open**
+the first time. On SolidCraft 0.11 to 0.14, download once by hand; see
+[updating](https://docs.solidcraft.io/guide/updates.html#updating-from-011-to-014).
 
 ## What works
 
-- **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
-  arcs, polygons, slots, ellipses, fit/control splines, conics and text; construction geometry,
-  projection, trimming, fillets and chamfers, including corners at the origin.
-  New face attachments retain supported construction identities and chosen occurrences;
-  missing sources expose an explicit plane repair workflow. See [face attachments](docs/face-attachments.md).
-  Explicitly closed fit splines and closed associative offsets use periodic C2 interpolation.
-  Supported convex line-and-arc offsets retain their identity when an inset consumes corner
-  arcs, and linked extrusions follow the current boundary. Breaking the association freezes
-  the boundary and keeps existing extrusions usable.
-  Curve drawing and picking adapt together to zoom and display scale, including small circles
-  at Fit and sketches in placed components.
-- **Constraints and dimensions** solved by our own solver (damped Gauss–Newton with
-  degree-of-freedom analysis): coincident, horizontal/vertical, parallel, perpendicular, tangent,
-  equal, concentric, collinear, midpoint, symmetry, fix; linear, aligned, horizontal, vertical,
-  radius, diameter and angle dimensions driven by parameters. Over-constraining edits are
-  rejected; fully constrained geometry turns black.
-  Select a line or its two endpoints, type its dimension and press Enter to commit one undo
-  step. Fit keeps sketch geometry clear of the palette and navigation controls.
-- **Profiles** found automatically, including regions split by lines and holes inside outlines.
-  Newly captured complete adaptive boundaries retain their outer and hole source identities
-  when spline span counts change. Partial or ambiguous boundaries do not qualify.
-- **Features** on a parametric timeline: extrude, revolve, sweep, loft, fillet/chamfer,
-  shell, draft, holes, threads, patterns, mirror, split, combine, move and construction geometry.
-  The timeline rebuilds incrementally; features can be edited, suppressed, renamed, reordered
-  and deleted. Supported geometry and current limitations are described in [ROADMAP.md](ROADMAP.md).
-  New revolves preserve symmetric and two-sided angular placement across reversed axes;
-  older designs retain their saved convention when reopened or edited.
-- **Parameters and configurations** with unit-aware expressions (`2 * width + 5 mm`,
-  `angle / 2`), ordered rules, feature suppression and per-row body materials/appearances.
-- **Assemblies** with nested components and occurrences, joints, motion studies, contact sets,
-  interference and material-aware mass properties. Recorded body transfers preserve modelling
-  history and world placement; 3D sketch wires retain their coordinate frames through edits.
-- **Sheet metal** with flanges, hems, fold/unfold/refold, material cutouts, flat patterns,
-  retained shallow prismatic pockets, exact line/arc/circle DXF outlines and bend tables;
-  plastic enclosure features and rules. Pocket depth and side survive unfold/refold and appear
-  separately from through-hole outlines in the flat preview and DXF.
-- **Files**: designs as JSON (`.solvecraft`), export to STEP (AP242 with body names, colours and
-  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
-  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ;
-  3MF, STL and OBJ import as mesh bodies (they render, measure, move and export; solid features
-  need B-rep bodies);
-  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
-  (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
-  that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
-  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)).
-- **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
-  axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
-  control channel so agents and tests can drive it.
-  Feature errors and Help can open an editable **Create Issue** draft with relevant context
-  and an optional reviewed screenshot; opening GitHub does not submit the report.
-- **Headless CLI** `solvecraft-cli`: run command scripts, measure (volume, area, centre of mass,
-  face/edge/vertex counts), export, render PNG snapshots, replay Fusion oracle recipes.
-- **MCP server** `solvecraft-cli mcp`: AI agents model, measure and look at parts headless or
-  in the running app (see below).
+Early but usable for simple parts: 75 of 76 public reference parts match their analytic or
+FreeCAD-computed volume, area, centre of mass and bounding box ([oracle](docs/oracle.md)); the
+other is a tracked bug.
 
-## Build and run
+- **Sketches and constraints:** lines, arcs, splines, text and more, solved by our own constraint solver, with parameter-driven dimensions.
+- **Features:** extrude, revolve, sweep, loft, fillet, chamfer, shell, draft, holes, threads, patterns, mirror, split and combine on an editable parametric timeline.
+- **Parameters and configurations** with unit-aware expressions.
+- **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
+- **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
+- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.solidcraft` designs.
+- **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.
+
+The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
+status and plans are in [ROADMAP.md](ROADMAP.md). See also [what people built](docs/showcase.md),
+[3D mouse support](docs/3d-mouse.md) and the [architecture](docs/architecture.md).
+
+## Build from source
 
 ```sh
-cargo run --release -p solvecraft -- --sample          # desktop app with a sample part
-cargo run --release -p solvecraft-cli -- commands      # the command registry
-cargo run --release -p solvecraft-cli -- run examples/bracket.json --out bracket.step
-cargo run --release -p solvecraft-cli -- snapshot examples/bracket.json --out bracket.png
-cargo run --release -p solvecraft -- part.step          # open a STEP file as a new design
-cargo run --release -p solvecraft-cli -- eval part.step # measure an imported STEP file
-cargo xtask ci                                          # fmt, clippy, tests, assets, layers, wasm
+cargo run --release -p solidcraft -- --sample      # desktop app with a sample part
+cargo run --release -p solidcraft-cli -- commands  # the command registry
+cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
+cargo xtask ci                                     # fmt, clippy, tests, icons, assets, layers, wasm
 ```
 
-Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
-
-In the browser: `cd apps/solvecraft-web && trunk build --release --public-url ./` (WebGPU, or
-WebGL2 with `?webgl`; `?sample` opens the sample part).
-
-## Scripts
-
-A script is a JSON list of commands, the same ones the UI runs:
-
-```json
-{"commands": [
-  {"command": "sketch.create", "params": {"plane": "XY"}},
-  {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [40, 30]}},
-  {"command": "solid.extrude", "params": {"distance": 20}},
-  {"command": "solid.fillet", "params": {"edges": [[0, 0, 10]], "radius": 3}}
-]}
-```
+More commands, the Windows cross-build and the browser build are in [docs/building.md](docs/building.md).
 
 ## AI agents (MCP)
 
-`solvecraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server on
-stdio. Headless it runs its own design session; with `--connect 127.0.0.1:PORT` it drives the app
-started with `solvecraft --control PORT`, so you can watch the agent model. Tools:
-`list_commands`, `execute`, `batch`, `inspect_design`, `measure`, `body_topology`,
-`set_parameter`, `screenshot` (returns the image), `export`, `undo`, `redo`, `new_design`, `open`,
-`save`. Claude Code: `claude mcp add solvecraft -- solvecraft-cli mcp`. Details, client
-configuration and an example session: [docs/mcp.md](docs/mcp.md).
+`solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
+runs its own design session, or with `--connect` it drives the running app so you can watch.
+Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. If a terminal doesn't find
+`solidcraft-cli` (older Windows installers don't put it on `PATH`), give its full path (by default
+`"C:\Program Files\SolidCraft\solidcraft-cli.exe"`). Tools, access rules and an example session:
+[docs/mcp.md](docs/mcp.md).
 
-## Architecture
+## Scripts
 
-<!-- ANCHOR: architecture -->
-| Layer | Crates | Role |
-|---|---|---|
-| L0 | `geom` | vectors, planes, profiles, meshes and their measures |
-| L1 | `sketch`, `kernel`, `render` | constraint solver and profiles; the B-rep kernel boundary (truck); view math and CPU rasterizer |
-| L2 | `doc` | parameters, expressions, the feature timeline and its incremental evaluation |
-| L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL import features |
-| L4 | `engine` | the session and the command registry (everything is a command) |
-| L5 | `ui-egui`, `mcp` | the swappable desktop front end; the MCP server (headless or bridged to the app) |
-| apps | `solvecraft`, `solvecraft-cli` | desktop app, headless CLI |
-<!-- ANCHOR_END: architecture -->
+A script is a JSON list of the same commands the UI runs, executed with `solidcraft-cli run`.
+Format and example: [docs/scripts.md](docs/scripts.md). Pages can also be driven through the
+[browser command API](docs/browser-api.md).
 
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md): how to build and test, the code map, the clean-room
-and licence rules, and where help is wanted most.
+Help is welcome. [CONTRIBUTING.md](CONTRIBUTING.md) covers how to build and test, the code map,
+the clean-room and licence rules, and where help is wanted most. Open work is in
+[GitHub issues](https://github.com/tangency-labs/solidcraft/issues); chat is on
+[Discord](https://discord.gg/FtU4NQNVDH).
+
+## Sponsors
+
+[![CI powered by Blacksmith](docs/sponsors/blacksmith-ci-powered.png)](https://www.blacksmith.sh)
+
+SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
+sponsors its CI minutes.
 
 ## Licence
 
-MIT OR Apache-2.0, at your option. SolveCraft is not affiliated with Autodesk; Fusion is a
-trademark of Autodesk, Inc.
+MIT OR Apache-2.0, at your option. Developed under the
+[clean-room contribution rules](AGENTS.md); third-party code and assets retain their
+documented licences and attribution.
+
+SolidCraft is independent. Behaviour is designed from public documentation, general CAD
+conventions and user feedback. Reference tests use analytic values and open-source tools.
+SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk, Dassault Systèmes, PTC,
+Siemens or any other CAD vendor. Fusion, AutoCAD, Inventor, SolidWorks, Onshape, Creo, Blender and
+Tinkercad are trademarks of their respective owners, named only to describe compatibility
+(see [NOTICE](NOTICE)).
+
+[badge-windows]: https://img.shields.io/badge/Windows-Download-0078D6?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGUiPjxwYXRoIGQ9Ik0yIDJoOS41djkuNUgyek0xMi41IDJIMjJ2OS41aC05LjV6TTIgMTIuNWg5LjVWMjJIMnpNMTIuNSAxMi41SDIyVjIyaC05LjV6Ii8%2BPC9zdmc%2B
+[badge-macos]: https://img.shields.io/badge/macOS-Download-333333?style=for-the-badge&logo=apple&logoColor=white
+[badge-linux]: https://img.shields.io/badge/Linux-AppImage-E95420?style=for-the-badge&logo=linux&logoColor=white
+[badge-snap]: https://img.shields.io/badge/Snap-Snap_Store-82BEA0?style=for-the-badge&logo=snapcraft&logoColor=white
+[badge-web]: https://img.shields.io/badge/Web-Try_in_browser-2EA44F?style=for-the-badge&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIyIj48Y2lyY2xlIGN4PSIxMiIgY3k9IjEyIiByPSIxMCIvPjxwYXRoIGQ9Ik0yIDEyaDIwTTEyIDJhMTUgMTUgMCAwIDEgMCAyME0xMiAyYTE1IDE1IDAgMCAwIDAgMjAiLz48L3N2Zz4%3D
+[windows-msi]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-windows-x64.msi
+[macos-dmg]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-macos-universal.dmg
+[linux-appimage]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.AppImage
+[snap-store]: https://snapcraft.io/solidcraft
+[web-app]: https://solidcraft.io/app

ROADMAP.md

@@ -1,253 +1,82 @@
-# SolveCraft roadmap
+# SolidCraft roadmap
 
-Status as of **2026-10-11**. SolveCraft targets Fusion-style parametric modelling (sketch →
-features → parametric timeline) as an open, pure-Rust, agent-drivable application.
+The short version, for people who use SolidCraft. The detailed developer status (milestone
+tables, limitations, measurements) is in [docs/roadmap-detail.md](docs/roadmap-detail.md).
 
-## At a glance
+## What SolidCraft is
 
-| Question | Answer |
-|---|---|
-| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server, oracle harness. |
-| Command parity (in scope) | **335 / 541 (62%)** in-scope commands; SOLID + SKETCH **188 / 291 (65%)** — [docs/parity.md](docs/parity.md); registry breadth does not establish workflow or geometric parity |
-| Fusion oracle | **76 / 76 parts match** in the checked-in historical report — [docs/oracle.md](docs/oracle.md). The current sprint adds independent analytic and UI regressions; the local Fusion oracle corpus has not been rerun. |
-| Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
-| Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
-| Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
+SolidCraft is open-source parametric 3D CAD written in Rust. You sketch, constrain, extrude, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app and in the browser
+([try it](https://solidcraft.io/app)), and it has a command-line tool and an MCP server so that
+scripts and AI agents can drive the same commands you use.
 
-## Scope (owner decision, 2026-10-07)
+## Works today
 
-The issue batch adds preservation of blind pockets in through cuts, associative projected
-offsets and plastic face placements, XZ (+Y normal) with a v6 migration preserving older
-designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
-toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
-acceptance scenarios now include board resizes; STEP reopening is automated. Inspection in
-Fusion remains an external acceptance step. See [WIP reconciliation](docs/wip-reconciliation.md).
+- Sketching with a constraint solver, and the usual create and modify tools.
+- Extrude, revolve, loft, sweep, coil, fillet, chamfer, shell, draft, holes, threads,
+  patterns, mirror and split.
+- Parameters with units and expressions, and configurations.
+- Faces and edges keep their names through edits, so references survive changes.
+- Components, assemblies, joints, motion studies and exploded views.
+- Sheet metal with flat patterns and DXF export, and a plastic-enclosure subset.
+- A Render workspace with GPU rendering, studio lighting, materials and image export
+  (first release in 0.22.0).
+- Import and export of STEP, IGES, 3MF, STL, OBJ and DXF, and FreeCAD and Rhino files.
+- Autosave and crash recovery, and the browser build of the same app.
 
-In scope, in priority order:
-1. SOLID and SKETCH (now).
-2. Parameters / functional constraints (done: see `parameters.*`, `expr.evaluate`; unit-aware,
-   cycles reported with their path, rename follows references, deletes list their users):
-   user parameters with units and expressions (+-*/, ^,
-   parentheses, sin/cos/sqrt/min/max/floor/ceil/round, unit conversion), model parameters
-   d1, d2… for every dimension and feature input, references between parameters with a
-   dependency graph and cycle detection, re-evaluation on change, comments, favourites,
-   CSV/JSON import and export.
-3. Components and assemblies with joints (M9).
-4. SHEET METAL: flange, contour flange, bend, unfold/refold, flat pattern with DXF export, sheet
-   metal rules (thickness, K-factor, bend radius) (M10).
-5. A small PLASTIC subset for enclosures, after sheet metal: Boss, Rib, Web, Lip/Groove, Snap Fit.
+The full list of commands is in [docs/features.md](docs/features.md). Release notes for each
+version are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
 
-Deferred until further notice: MESH, FORM (T-splines), SURFACE beyond what solids need, PCB / 3D
-PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings. The parity report's
-headline counts in-scope tabs only and lists the deferred ones separately.
+## In progress now
 
-## Milestones
+Each feature below is a [milestone](https://github.com/tangency-labs/solidcraft/milestones) holding
+the issues for it, so the count shows how far along it is. Counts are as of 2026-10-25, one per
+feature or request. Work merged on a feature branch (`drawings`, `render`) counts as built but
+reaches the app only when that branch merges. They are rough, not a promise.
 
-| # | Milestone | Status | Hours left |
-|---|---|---|---|
-| M0 | Vertical slice | done | — |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
-| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
-| M4 | Files: STEP import (done: all 29 Fusion STEP files — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), DXF sketches, OBJ import | in progress | 6 |
-| M5 | Persistent naming of faces and edges (plan/adr/0002): faces named from their history (sketch curve sides, caps, revolve sections, primitive sides, blends, pattern/mirror copies; split pieces numbered), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. Left: kernel-reported face history (exact through coincident surfaces) | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, reorder with dependency checks, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
-| M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace | deferred | — |
-| M9 | Components and assemblies (Fusion-style): New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done (oracle 67-76). PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, no Fusion oracle (licence), tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line) | in progress | 36 |
-| M11 | 2D drawings | deferred | — |
-| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
-| M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
-| M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solvecraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solvecraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
+- **[Rendering & materials](https://github.com/tangency-labs/solidcraft/milestone/17)**: in progress, 9 of 34 pieces done, 3 of them built only on the `render` branch and in the app when it merges. The basic Render workspace is already in releases (0.22.0); the interface rework (#6281) and the material and light libraries are what is left.
+- **[Drawings](https://github.com/tangency-labs/solidcraft/milestone/8)**: in progress, 3 of 21 pieces built (2 in releases, 1 on the `drawings` branch), and 3 more partly built there (sheets and borders, bill-of-materials types, the paper scene). Not in the app yet: it lands when the `drawings` branch merges. Today you can export the current view as a DXF.
+- **[Sheet metal](https://github.com/tangency-labs/solidcraft/milestone/15)**: in progress, 1 of 30 requests done. Flanges, hems, unfold and flat patterns already work; the 30 are extensions, mostly the per-edge flange options (segments, miters, partial flanges, reliefs) and bend allowance.
+- **[Sketching](https://github.com/tangency-labs/solidcraft/milestone/14)**: in progress, 12 of 50 pieces done. Dimension types, selection and snapping options.
+- **[Solid modeling](https://github.com/tangency-labs/solidcraft/milestone/2)**: in progress, 9 of 50 pieces done. Blends, holes, threads and patterns.
+- **[Assemblies & joints](https://github.com/tangency-labs/solidcraft/milestone/3)**: in progress, 4 of 19 pieces done. Joints, motion studies and exploded views already work; placement rules, linked sub-assemblies, fastener stacks and weldment corners are the pieces left.
+- **[Import & export](https://github.com/tangency-labs/solidcraft/milestone/5)**: in progress, 7 of 39 pieces done. FreeCAD, SolidWorks and point-cloud import, and mesh export options.
+- **[AI agents & MCP](https://github.com/tangency-labs/solidcraft/milestone/18)**: in progress, 2 of 8 pieces done. Agent chat and the MCP server.
+- **[Interface, web app & plugins](https://github.com/tangency-labs/solidcraft/milestone/4)**: in progress, 31 of 96 pieces done. Ribbon redesign, navigation, themes, the web app and plugins.
+- **[SMLib kernel migration](https://github.com/tangency-labs/solidcraft/milestone/1)**: in progress, 1 tracking issue open. The kernel is moving from truck to NVIDIA's SMLib (usd-brep, Apache-2.0) on the `kernel-smlib` branch; it is not in releases yet. Tracked in [#4012](https://github.com/tangency-labs/solidcraft/issues/4012).
 
-## Dimensioning and error reporting
+## Next
 
-- Single-line and rectangle-side dimensioning supports selecting a line or its two endpoints.
-  Type a value and press Enter to commit one undo step; rejected values remain editable and
-  cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
-  and navigation controls, including enlarged displays and nested pending placements.
-- Contextual error reporting: a **Create Issue** action beside feature errors opens a
-  reviewable GitHub issue draft with the error, operation settings, build diagnostics and
-  useful reproduction context. The draft is editable, with optional capture of the actual
-  viewport and copy/save controls. Opening GitHub does not submit the issue. Help also exposes
-  reporting for unexpected results that did not produce an error.
+- **[Surfacing](https://github.com/tangency-labs/solidcraft/milestone/16)**: next, 6 of 14 pieces done. Patch, trim, blend and match exist; the rest of the surface toolset is planned.
+- **[Manufacturing / CAM](https://github.com/tangency-labs/solidcraft/milestone/9)**: next, 1 pieces tracked, none done. There is no CAM in SolidCraft yet. Send to Slicer and a first toolpath slice are in review; proposals are [#1153](https://github.com/tangency-labs/solidcraft/issues/1153) and [#1621](https://github.com/tangency-labs/solidcraft/issues/1621).
 
-## 0.2.0 release batch
+Features are not tied to a release or a date. Work lands in the daily releases as it is finished.
+Anything without a milestone, such as bug fixes, is not a feature and is not listed here.
 
-- Includes the new axis navigation, adaptive sketch drawing/picking, origin-corner repairs,
-  durable supported profile/face references, endpoint dimensioning and contextual reporting.
-- Smooth ruled-wall display joins are hidden only within the supported geometric certificate;
-  authored splits and actual creases remain protected. Wireframe retains physical edges.
-- Paste New uses a bounded current-geometry comparison for supported convex line/circle
-  prisms with separated circular holes; unsupported shapes retain the existing strict check.
-- Common-bore Union retries check additional boundary curves before recutting the bore,
-  preventing the reproduced thin-web loss. Unknown additional trims refuse; inherited
-  common-cylinder trims retain their existing policy, so this is not a general Boolean proof.
-- Exact full-path assembly joint editing remains separate work and is not part of this batch.
-- The replacement README demo records the actual English 0.2.0 UI, with a 2× preview and
-  a full video at real-time speed. Package verification and publication follow
-  [the release workflow](docs/releasing.md); development pushes are not application releases.
+## How releases work
 
-## View navigation
+- Releases ship daily, as numbered versions (v0.22.0, v0.22.1) with nightly pre-releases in
+  between. They are delivered through the in-app updater.
+- SolidCraft tells you when a newer stable release exists and never updates without asking.
+  Where it can replace itself safely (AppImage, Windows installer and portable builds) there is
+  an **Update now** button; downloads are checked against the release's SHA-256 list. See
+  [updates and privacy](docs/book/src/guide/updates.md).
+- Design files carry a format number. A new version opens designs from older versions, but an
+  older version refuses a design saved by a newer one (0.22.0 writes format 35, and 0.21.0 and
+  earlier will not open it). Each release's notes say when the format changed. Keep a copy of
+  an important design before you move to a new version.
 
-- Compact clickable signed X/Y/Z axis tips, smooth drag-to-orbit, and Shift-orbit snapping
-  to 26 standard and diagonal views. Pointer motion accumulates independently of a lightly
-  damped spring, with a boundary margin to prevent flicker. Z-up/Y-up and the nearest square
-  top/bottom heading are preserved. Diagonals include 45-degree edge and isometric corner views.
+## Licence
 
-## Known limitations
+SolidCraft is licensed MIT OR Apache-2.0, at your option; see [LICENSE-MIT](LICENSE-MIT) and
+[LICENSE-APACHE](LICENSE-APACHE). Versions already released stay available under those licences
+permanently.
 
-- Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
-  rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
-  meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
-  planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
-  basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
-  corners around pocket rims, with unequal wall slopes and extensions confined to the face;
-  connected equal-distance chamfers also trim each other across unequal sloped rim walls;
-  whole smooth loops of a planar face, picked whole or by one edge (tangent
-  chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
-  plate outlines), loops with sharp corners between straight edges (the blends meet in mitres), runs of
-  neighbouring edges along a planar face's loop (two top edges of a box: mitred, ending square;
-  with the edge between them too, the corner becomes a sphere octant),
-  rounded corners rounded again (sphere octants, tori at concave corners); every edge of a
-  convex planar body or of an extruded part; fillets inside patterns; closed chains of curved
-  edges between any two smooth sides (a branch pipe on a main pipe), by a rolling ball (the
-  blend a rational B-spline through exact arcs), closed or ending at planar faces square to the
-  edges.
-- Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
-  sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
-  annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
-  curved wall qualification rejects false transverse axes instead of filling holes.
-  Bodies touching along one whole face
-  (a part and its mirror image) are stitched; coincident planar faces are pushed apart when
-  their neighbours are planes or cylinders. Other coincident curved configurations can still
-  fail. Bounded containment classification preserves fully internal cavities and nested
-  material islands independently of shell order, with STEP round-trip and material-membership
-  regressions. Near-contact curved shells use the general boolean path rather than a
-  containment shortcut. Spheres are built from six pole-free patches.
-- Mass properties come from fine tessellation (curved faces within ~1e-4 relative); triangles
-  that cut through curved faces (trimmed faces after booleans) are split onto the surface first.
-- STEP import (our own reader, crates/kernel/src/step_in; all 29 Fusion STEP files pass
-  `cargo xtask step-corpus`) reads solids (B-rep with analytic and B-spline geometry), units,
-  product names, colours and assemblies; analytic offsets on planes, cylinders, cones, spheres
-  and regular tori are read exactly (signed/nested distances, units and face sense). Freeform
-  offset surfaces and pcurve-only edges are not read yet,
-  and assembly components are flattened into bodies. Closed periodic faces (torus, B-spline
-  bands) are split in two for meshing; measure() uses a finer tolerance for small radii.
-- Persistent naming (plan/adr/0002) names faces from their history and edges by their faces;
-  references resolve by name first and warn when the entity split or vanished. Kernel-reported
-  face history (exact through coincident surfaces) is not wired in yet.
-  New planar sketch attachments use exact box, extrusion cap/side and immutable imported-face
-  source certificates with checked target and author occurrence paths. A missing or changed
-  source fails explicitly; Redefine Sketch Plane previews reattachment or a fixed plane while
-  retaining current geometry and dimension identities. Unsupported modified faces need an
-  explicit fixed plane. Legacy attachments retain their original resolver behavior.
-- Modelled threads are cut as a faceted body (curved faces within 1/200 of the pitch); Extrude
-  and Revolve To Object on a curved face cut the tool back to the target's surface.
-- Explicit sketch breaks preserve exact ellipses, fit/control splines (including high degrees)
-  and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
-  touch (no clean crossing) enter that profile as polylines.
-  Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
-- Extend intersects exact ellipses and rational/high-degree splines without moving the line or
-  circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
-  certificate and refine within bounded node limits while retaining existing IDs. Singular,
-  self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
-  closed natural-spline seams remain limitations. New explicitly closed fit splines and closed
-  offset outputs use periodic C2 interpolation, supporting repeated certified offsets; older
-  natural splines are preserved. Clicking the starting fit point deliberately closes a new loop.
-  Newly captured adaptive profile references with complete source coverage retain their outer
-  and hole identities through span-count changes, including parameter edits after extrusion.
-  Partial, intersected or ambiguous boundaries do not qualify for these whole-source references.
-  Legacy curve-span multisets remain exact and unchanged; already-lost selections may need
-  reselection. Format 12 stores the new bounded whole-boundary references.
-  Projected analytic boundaries follow nested loop identities through resizing, including
-  stationary holes and rounded corners. Supported convex, tangent line-and-arc boundaries
-  can lose or regain corner arcs during an inset while preserving reserved curve identities
-  and linked profile selections. Format 12 saves those associations; compatible older closed
-  offsets upgrade structurally without changing their curve IDs. Breaking an association
-  freezes its current boundary and materializes downstream profile references. Child offsets
-  of a boundary with retired arcs still require breaking its association first; mixed or
-  nonconvex junctions and retained references to disappearing individual arcs remain limited.
-- Extrude and Revolve editors retain original direction, extent expressions, explicit targets,
-  axes, From/To inputs and All-profile intent. No-op edits preserve downstream dimension names
-  and selected occurrence frames; cancel and successful edits preserve one-step undo history.
-  Placed feature edits preview through the edited timeline entry, and cylindrical Emboss guides
-  use the sketch's actual target, author or uniquely placed third-component frame.
-  Revolve rotators follow the actual signed axis and support symmetric and two-sided extents;
-  dragging a To Object extent converts its derived value to an explicit angle. Legacy reversed-axis
-  symmetric geometry is preserved through format 11's explicit legacy convention. New revolves
-  use the sketch-normal direction for each selected profile, including To Object and curved
-  target trimming, independently of the selected axis sign.
-- Cylindrical emboss/deboss wraps bounded orthogonal line profiles, including holes, concave
-  outlines and nested islands, onto complete exterior cylinders or coaxial sleeves with exact
-  radial walls. New features infer a unique eligible cylinder when the face field is empty;
-  ambiguous targets require an explicit face. Saved target
-  and author occurrence paths retain the chosen placements; missing/split faces refuse rather
-  than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
-  remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
-- Shell and offset faces work on bodies of planes, cylinders, cones and spheres (convex or not:
-  filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
-  floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
-  sections ruled.
+## How to follow along
 
-- Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
-  its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
-  the origin; clicked UI regressions verify geometry, closed profiles and undo.
-- Sketch display: drawing, picking, highlighting, tool previews and profile shading share
-  adaptive projected curve boundaries. Fit, zoom, display scale and placed sketch frames
-  invalidate the display cache without changing CAD geometry or timeline history. Work
-  budgets and clipped paths prevent unbounded sampling or invented edges across the eye plane.
-  The Sketch Palette scrolls its options on short windows and enlarged displays while
-  keeping constraint status and Finish Sketch visible.
-- Face projection: closed boundaries have a deterministic outer-first order. Refresh matches
-  existing geometry before assigning positions, retaining saved curve IDs and constraints
-  across enumeration changes and resize, including concentric circles. Ambiguous identities
-  retain the last geometry and report a lost reference; permutation matching is bounded.
-- Inline sketch dimensions: Tab and Shift+Tab cycle within the active shape's value boxes,
-  selecting visited values for replacement. Expression completion retains forward-Tab
-  priority; real keyboard regressions cover rectangles, lines and single-value circles.
-  Typed lengths, radii, line angles, signed arc sweeps and slot lengths persist as constraints
-  and expressions through save/reopen. Shape creation and its dimensions form one undo step;
-  rejected values keep the editable field focused.
-- Repeated components: Browser selection, visibility, properties, copy and Move/Copy use
-  checked occurrence paths. Active nested occurrences author planar sketches and solids in
-  their selected frame. Pending moves compose through parents; dialog cancellation restores
-  its selected move. Source materials and body/face appearances follow transformed instances.
-  Shared nested definitions remain shared. Deep Paste New copies reachable definition graphs,
-  independent feature/input histories, styles and internal motion records, with bounded geometry
-  checks and explicit external-link notices. Paste New selects the copy while preserving the active
-  authoring context. Imported periodic STEP seams survive placement and reexport with shared
-  topology and appearances intact. Recorded body transfers preserve historical Join/Cut membership,
-  material, placements and machining data through edits, copying, undo and reopen. New 3D wires
-  record their coordinate frame; legacy wires migrate from known provenance without changing
-  coordinates. Broken legacy links with missing provenance can require explicit refresh or relink.
-  See [occurrence workflows](docs/occurrence-workflows.md).
-- Configuration rules: ordered typed conditions can drive parameters and suppressions or
-  restrict values. Preview explains effective values without modifying the document; applying
-  rules validates rows atomically. Length expressions retain their authoring units across
-  document-unit changes. The UI supports structured All/Any/Not conditions and rule ordering.
-  Component styles and certified semantic face styles are available; unsupported lineage refuses
-  atomically, and stale certified face paint cannot jump to another surface. See [configurations](docs/configurations.md).
-- Sheet-metal material: inherited holes, crossing edge notches, overlapping cuts and retained
-  islands share the same boundaries in flat preview, DXF and unfolded solids. Detached material
-  pieces survive unfold/refold as one logical sheet group, including split flanged sheets.
-  Circular cuts crossing bends remain unsupported; free-form bases use bounded sampling.
-  Parallel prismatic partial-depth cuts retain pocket side and depth through transfer and
-  unfold/refold, with separate pocket contours in preview and DXF. Planar Intersect preserves
-  exact holes and retained islands, including the union of multiple selected profiles, and
-  records complementary depth layers as pockets while retaining the stock gauge. Unsupported
-  tapered or bend-crossing machining refuses atomically instead of restoring material later.
-- Rolling-ball fillet accuracy: independent offset-cylinder tee references check surface
-  distance, actual trimmed tessellation, supporting-cylinder contacts and tangency at two
-  scales. The measured trimmed-part error is below 0.0001 mm; this is an analytic geometry
-  check, not a new Fusion oracle result. Under-resolved fits return an error.
-- Contact driving checks the trajectory between clear endpoints, including linked joints,
-  playback and sparse motion exports. Checks use bounded tessellation samples, not exact
-  continuous collision detection; local thin walls and small details remain limitations.
-  See [contact-set limits and recovery](docs/contact-sets.md).
-
-## Kernel
-
-truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
-retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.
+- Feature milestones: <https://github.com/tangency-labs/solidcraft/milestones>
+- Issues: <https://github.com/tangency-labs/solidcraft/issues> (area labels such as
+  `area:kernel`, `area:sketch` and `area:ui` group them)
+- Discord: <https://discord.gg/FtU4NQNVDH>
+- Releases: <https://github.com/tangency-labs/solidcraft/releases>
+- Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)

SECURITY.md

@@ -0,0 +1,32 @@
+# Security policy
+
+## Supported versions
+
+SolidCraft is young and moves quickly, so only the latest release gets security fixes. Please
+update to the [latest release](https://github.com/bherbruck/solidcraft/releases/latest) before
+reporting, and check whether the problem is still on `main`.
+
+| Version | Supported |
+| --- | --- |
+| Latest release | ✅ |
+| Nightly builds | ✅ (fixes land here first) |
+| Older releases | ❌ |
+
+## Reporting a vulnerability
+
+Please **don't open a public issue** for a security problem. Report it privately through GitHub:
+open the repository's [Security tab](https://github.com/bherbruck/solidcraft/security) and choose
+**Report a vulnerability**
+([direct link](https://github.com/bherbruck/solidcraft/security/advisories/new)).
+
+Please include what you found, how to reproduce it (a design file, command or MCP request), the
+version and platform, and the impact you expect. I'll acknowledge the report as soon as I can,
+keep you updated in the advisory, and credit you when the fix is published unless you'd rather
+stay anonymous.
+
+Areas where reports are especially useful:
+
+- opening untrusted design, STEP, STL or 3MF files (crashes, excessive memory or CPU, path tricks)
+- the MCP server and the control API (file access outside the allowed folders, command injection)
+- the web app (anything reaching beyond the page's own storage)
+- release packages and the update paths (AppImage, Flatpak, MSI, deb, rpm, snap)

apps/solidcraft-cli/Cargo.toml

@@ -0,0 +1,36 @@
+[package]
+name = "solidcraft-cli"
+description = "SolidCraft headless CLI: run command scripts, measure, export, render snapshots, replay oracle recipes"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+default-run = "solidcraft-cli"
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "solidcraft-cli"
+path = "src/main.rs"
+
+# Compatibility alias for the CLI's former name: forwards to solidcraft-cli with a deprecation
+# note on stderr. Shipped in every package for at least one release.
+[[bin]]
+name = "solvecraft-cli"
+path = "src/alias.rs"
+
+[features]
+default = ["raytrace-cpu"]
+bundled-render-library = ["solidcraft-engine/bundled-render-library"]
+raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]
+
+[dependencies]
+solidcraft-engine = { workspace = true }
+solidcraft-gpu = { workspace = true }
+solidcraft-mcp = { workspace = true }
+log = { workspace = true }
+serde_json = { workspace = true }
+
+[dev-dependencies]
+# Snapshot tests decode the pictures to compare them with a tolerance.
+image = { workspace = true }

apps/solidcraft-cli/examples/studio_evidence.rs

@@ -0,0 +1,151 @@
+//! Reproducible evidence through the production command/job interfaces.
+//! Usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png
+//! Writes the editable design, command timings and actual adapter/job metadata beside PNG.
+//! Accepts runtime requests as well as inline or named saved render jobs.
+use serde_json::{Value, json};
+use solidcraft_engine::{
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, ErrorCode, JobId, Phase},
+};
+use std::{
+    io::Read,
+    path::Path,
+    time::{Duration, Instant},
+};
+
+fn read_json(path: &str) -> Result<Value, String> {
+    let mut bytes = Vec::new();
+    std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?.take(16_777_217).read_to_end(&mut bytes).map_err(|e| e.to_string())?;
+    if bytes.len() > 16_777_216 {
+        return Err("evidence input exceeds 16 MiB".into());
+    }
+    serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))
+}
+
+// Only decide which optional host must be installed. The production command
+// still validates and resolves the actual request without a second wire format.
+fn needs_gpu(session: &Session, params: &Value) -> Result<bool, String> {
+    let inline = params.get("settings").filter(|value| !value.is_null());
+    let named = params.get("setup").filter(|value| !value.is_null());
+    if inline.is_some() && named.is_some() {
+        return Err("choose either setup or settings".into());
+    }
+    let inline_setup = inline
+        .filter(|value| value.get("job").is_some_and(|job| !job.is_null()))
+        .map(|value| serde_json::from_value::<RenderSetup>(value.clone()).map_err(|e| e.to_string()))
+        .transpose()?;
+    let setup = if let Some(name) = named.and_then(Value::as_str) {
+        Some(session.doc.render.setups.get(name).ok_or("no saved render setup with that name")?)
+    } else {
+        inline_setup.as_ref()
+    };
+    if let Some(setup) = setup
+        && let Some(job) = &setup.job
+    {
+        if params.as_object().is_some_and(|object| object.keys().any(|key| !matches!(key.as_str(), "setup" | "settings" | "replace"))) {
+            return Err("saved render jobs cannot be mixed with runtime controls".into());
+        }
+        setup.validate().map_err(|e| e.to_string())?;
+        return Ok(matches!(job, RenderJob::GpuPath { .. }));
+    }
+    Ok(params.get("progressive").and_then(Value::as_bool) == Some(true))
+}
+
+fn run() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let [recipe_path, params_path, output_path] = args.as_slice() else {
+        return Err("usage: studio_evidence RECIPE.json RENDER-PARAMS.json OUTPUT.png".into());
+    };
+    let output = Path::new(output_path);
+    if !output.extension().is_some_and(|e| e.eq_ignore_ascii_case("png")) {
+        return Err("output must have a .png extension".into());
+    }
+    let recipe = read_json(recipe_path)?;
+    let params = read_json(params_path)?;
+    let mut session = Session::default();
+    eprintln!("Generating original CAD scene from {recipe_path}");
+    let generation_start = Instant::now();
+    let (commands, command_timings) = session.run_script_timed(&recipe, false).map_err(|e| e.to_string())?;
+    let generation_seconds = generation_start.elapsed().as_secs_f64();
+    let design_path = output.with_extension("solidcraft");
+    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
+    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
+    let bodies: Vec<Value> = scene
+        .meshes
+        .iter()
+        .map(|mesh| json!({"name":mesh.name,"vertices":mesh.mesh.positions.len(),"triangles":mesh.mesh.triangles.len()}))
+        .collect();
+    drop(scene);
+
+    let cpu_host_start = Instant::now();
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    let cpu_host_seconds = cpu_host_start.elapsed().as_secs_f64();
+    // Match runtime and saved-job dispatch. CPU evidence must not require a
+    // Vulkan device, parse GPU policy or initialize a GPU host.
+    let (adapter_report, gpu_host_seconds) = if needs_gpu(&session, &params)? {
+        let gpu_host_start = Instant::now();
+        let policy = solidcraft_gpu::select::Policy::from_env().map_err(|e| e.to_string())?;
+        let (adapter, report) =
+            solidcraft_gpu::select::pick_vulkan(policy, |_| true).ok_or("no Vulkan adapter satisfies the requested GPU policy")?;
+        session.register_render_job_host(solidcraft_gpu::path::host_on_adapter(&adapter).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+        (Some(report), Some(gpu_host_start.elapsed().as_secs_f64()))
+    } else {
+        (None, None)
+    };
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let start = Instant::now();
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let executor = started
+        .get("resolved")
+        .and_then(|resolved| resolved.get("executor"))
+        .and_then(Value::as_str)
+        .ok_or("started job did not report the resolved image executor")?
+        .to_owned();
+    let id: JobId = serde_json::from_value(started.get("job").cloned().ok_or("missing job id")?).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    eprintln!("Rendering through production {executor} executor");
+    if let Some(adapter) = &adapter_report {
+        eprintln!("GPU adapter: {adapter:?}");
+    }
+    let status = loop {
+        match handle.wait_timeout(Duration::from_secs(10)) {
+            Ok(status) => break status,
+            Err(error) if error.code == ErrorCode::TimedOut && start.elapsed() < Duration::from_secs(3600) => {
+                let status = handle.status().map_err(|e| e.to_string())?;
+                eprintln!(
+                    "Render progress: {:?} {}/{} after {:.1}s",
+                    status.progress.phase,
+                    status.progress.done,
+                    status.progress.total,
+                    start.elapsed().as_secs_f64()
+                );
+            }
+            Err(error) => {
+                let _ = handle.cancel();
+                return Err(error.to_string());
+            }
+        }
+    };
+    let render_and_encode_seconds = start.elapsed().as_secs_f64();
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render did not complete".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":output_path,"overwrite":true})).map_err(|e| e.to_string())?;
+    let report = json!({
+        "recipe":recipe_path,"render_params":params,"executor":executor,"adapter":adapter_report,
+        "environment":{"SOLIDCRAFT_GPU":std::env::var("SOLIDCRAFT_GPU").ok(),"WGPU_BACKEND":std::env::var("WGPU_BACKEND").ok()},
+        "cad_generation_seconds":generation_seconds,"cpu_host_setup_seconds":cpu_host_seconds,"gpu_host_setup_seconds":gpu_host_seconds,
+        "render_and_encode_seconds":render_and_encode_seconds,
+        "timing_scope":"wall time from render.start through completed PNG encoding; includes job preparation and readback, excludes CAD generation, preflight and initial CPU/GPU host setup; GPU setup timing includes adapter selection and pipelines when requested",
+        "bodies":bodies,"commands":commands,"command_timings":command_timings,
+        "preflight":preflight,"export":exported,"editable_design":design_path
+    });
+    std::fs::write(output.with_extension("json"), serde_json::to_vec_pretty(&report).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    println!("{}", serde_json::to_string_pretty(&report).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+fn main() -> Result<(), String> {
+    run()
+}

apps/solidcraft-cli/src/alias.rs

@@ -0,0 +1,30 @@
+//! `solvecraft-cli`: the CLI's former name, kept for at least one release so existing scripts
+//! and MCP client setups (`claude mcp add solvecraft -- solvecraft-cli mcp`) keep working.
+//! Compatibility shim: it runs `solidcraft-cli` (next to this executable, else on PATH) with the
+//! same arguments and standard streams, after a one-line deprecation note on stderr (stdout
+//! stays clean for MCP's JSON-RPC), and exits with its status.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+use std::process::{Command, ExitCode};
+
+const TARGET: &str = "solidcraft-cli";
+
+fn main() -> ExitCode {
+    eprintln!("solvecraft-cli is deprecated and will be removed in a later release: use solidcraft-cli");
+    let sibling = std::env::current_exe()
+        .ok()
+        .and_then(|exe| exe.parent().map(|dir| dir.join(format!("{TARGET}{}", std::env::consts::EXE_SUFFIX))))
+        .filter(|p| p.is_file());
+    let program = sibling.map(|p| p.into_os_string()).unwrap_or_else(|| TARGET.into());
+    match Command::new(&program).args(std::env::args_os().skip(1)).status() {
+        Ok(status) => match status.code() {
+            Some(code) => ExitCode::from(u8::try_from(code).unwrap_or(1)),
+            None => ExitCode::FAILURE,
+        },
+        Err(e) => {
+            eprintln!("solvecraft-cli: could not run {}: {e}", program.to_string_lossy());
+            ExitCode::FAILURE
+        }
+    }
+}

apps/solidcraft-cli/src/bench_agent.rs

@@ -0,0 +1,240 @@
+//! `bench-agent`: a large design built the way an agent builds one over MCP, one small command
+//! at a time, timed as it grows and then opened again.
+//!
+//! The design is a bicycle of about 1,300 bodies: frame tubes joined at root and then moved into
+//! a component, two wheels whose spokes and nipples are placed one by one, a chainring with
+//! patterned teeth, a cassette, a chain of individual links, cockpit, seat and a few hundred
+//! fasteners. Nothing is read from a file; the script is generated here, so the benchmark needs
+//! no fixture.
+//!
+//! ```text
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! ```
+//! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
+//! build total, then the phases `bench-open` prints for the saved design.
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+struct Script {
+    commands: Vec<Value>,
+}
+
+impl Script {
+    fn c(&mut self, command: &str, params: Value) {
+        self.commands.push(json!({"command": command, "params": params}));
+    }
+
+    /// A round tube from `a` to `b` (an agent's frame tube, spoke or post).
+    fn tube(&mut self, a: [f64; 3], b: [f64; 3], radius: f64, body: &str) {
+        let d = [b[0] - a[0], b[1] - a[1], b[2] - a[2]];
+        let len = (d[0] * d[0] + d[1] * d[1] + d[2] * d[2]).sqrt();
+        let axis = [d[0] / len, d[1] / len, d[2] / len];
+        self.c(
+            "solid.cylinder",
+            json!({"radius": radius, "height": round3(len), "base": a.map(round3), "axis": axis.map(round6), "body_name": body}),
+        );
+    }
+
+    /// A part placed after it is built: free, even as the design's first part (#2804).
+    fn component(&mut self, name: &str) {
+        self.c("component.create", json!({"name": name, "grounded": false}));
+    }
+
+    fn root(&mut self) {
+        self.c("component.activate", json!({"component": "root"}));
+    }
+
+    /// A wheel built at the origin in its own component, then placed where it goes (the
+    /// component's occurrence moved), as an agent builds one part and positions it.
+    fn wheel(&mut self, label: &str, at: f64, spokes: usize) {
+        let cx = 0.0;
+        self.component(&format!("{label} wheel"));
+        self.c("solid.torus", json!({"major": 311, "minor": 12, "center": [cx, 0, 340], "body_name": format!("{label} rim")}));
+        self.c("solid.torus", json!({"major": 330, "minor": 18, "center": [cx, 0, 340], "body_name": format!("{label} tyre")}));
+        self.c("solid.cylinder", json!({"radius": 18, "height": 110, "base": [cx, -55, 340], "axis": "Y", "body_name": format!("{label} hub")}));
+        for k in 0..spokes {
+            let a = std::f64::consts::TAU * k as f64 / spokes as f64;
+            let side = if k % 2 == 1 { 1.0 } else { -1.0 };
+            let hub = [cx + 30.0 * a.cos(), side * 40.0, 340.0 + 30.0 * a.sin()];
+            let (ca, sa) = ((a + 0.12).cos(), (a + 0.12).sin());
+            let rim = [cx + 300.0 * ca, side * 4.0, 340.0 + 300.0 * sa];
+            self.tube(hub, rim, 1.0, &format!("{label} spoke {k}"));
+            let nipple = json!({"radius": 2, "height": 12, "base": rim.map(round3), "axis": [round6(ca), 0, round6(sa)], "body_name": format!("{label} nipple {k}")});
+            self.c("solid.cylinder", nipple);
+        }
+        self.root();
+        self.c("occurrence.move", json!({"occurrence": format!("{label} wheel:1"), "translate": [at, 0, 0]}));
+    }
+}
+
+fn round3(v: f64) -> f64 {
+    (v * 1e3).round() / 1e3
+}
+
+fn round6(v: f64) -> f64 {
+    (v * 1e6).round() / 1e6
+}
+
+/// The bicycle's command script. `scale` multiplies the counts of repeated parts (spokes,
+/// chain links, fasteners); 1.0 gives about 1,300 bodies.
+pub fn bicycle(scale: f64) -> Value {
+    let n = |k: f64| ((k * scale).round() as usize).max(1);
+    let mut s = Script { commands: Vec::new() };
+    // Frame: tubes at root, the main triangle joined, then everything moved into its component.
+    let (bb, head_top, head_bot, seat_top) = ([0.0, 0.0, 300.0], [600.0, 0.0, 860.0], [580.0, 0.0, 740.0], [-150.0, 0.0, 820.0]);
+    s.tube(bb, head_bot, 19.0, "Down tube");
+    s.tube(seat_top, head_top, 16.0, "Top tube");
+    s.tube(bb, seat_top, 16.0, "Seat tube");
+    s.tube(head_bot, head_top, 22.0, "Head tube");
+    for (side, y) in [("L", 60.0), ("R", -60.0)] {
+        s.tube([0.0, y * 0.3, 300.0], [-420.0, y, 340.0], 10.0, &format!("Chainstay {side}"));
+        s.tube([-140.0, y * 0.3, 800.0], [-420.0, y, 340.0], 9.0, &format!("Seatstay {side}"));
+        s.c("solid.box", json!({"length": 20, "width": 6, "height": 40, "corner": [-430.0, y - 3.0, 320], "body_name": format!("Dropout {side}")}));
+    }
+    s.c("solid.cylinder", json!({"radius": 24, "height": 80, "base": [0, -40, 300], "axis": "Y", "body_name": "BB shell"}));
+    s.c("solid.combine", json!({"target": "Down tube", "tools": ["Top tube", "Seat tube", "Head tube", "BB shell"]}));
+    s.component("Frame");
+    s.root();
+    let frame = ["Down tube", "Chainstay L", "Seatstay L", "Dropout L", "Chainstay R", "Seatstay R", "Dropout R"];
+    s.c("component.move_bodies", json!({"bodies": frame, "component": "Frame"}));
+    // Wheels: every spoke and nipple a body of its own.
+    s.wheel("Front", 640.0, n(36.0));
+    s.wheel("Rear", -420.0, n(36.0));
+    // Drivetrain: patterned chainring teeth, a cassette and a chain of separate links.
+    s.component("Drivetrain");
+    s.c("solid.cylinder", json!({"radius": 95, "height": 4, "base": [0, 50, 300], "axis": "Y", "body_name": "Chainring"}));
+    s.c("solid.box", json!({"length": 6, "width": 4, "height": 8, "corner": [-3, 50, 395], "name": "Tooth", "body_name": "Tooth"}));
+    s.c("solid.pattern.circular", json!({"bodies": ["Tooth"], "axis": {"origin": [0, 50, 300], "dir": [0, 1, 0]}, "count": 44}));
+    for g in 0..11 {
+        let r = 22.0 + 3.5 * g as f64;
+        s.c(
+            "solid.cylinder",
+            json!({"radius": r, "height": 2, "base": [-420.0, round3(30.0 + 2.6 * g as f64), 340.0], "axis": "Y", "body_name": format!("Cog {g}")}),
+        );
+    }
+    let links = n(112.0);
+    for k in 0..links {
+        let a = std::f64::consts::TAU * k as f64 / links as f64;
+        let (x, z) = (round3(-210.0 + 230.0 * a.cos()), round3(320.0 + 80.0 * a.sin()));
+        for (side, y) in [("in", 46), ("out", 56)] {
+            s.c("solid.box", json!({"length": 12, "width": 1, "height": 8, "corner": [round3(x - 6.0), y, round3(z - 4.0)], "body_name": format!("Link {k} {side}")}));
+        }
+        s.c("solid.cylinder", json!({"radius": 3.5, "height": 10, "base": [x, 46, z], "axis": "Y", "body_name": format!("Roller {k}")}));
+    }
+    for (side, y) in [("L", -90.0), ("R", 90.0)] {
+        let x0 = if side == "L" { -15.0 } else { 0.0 };
+        s.c("solid.box", json!({"length": 170, "width": 12, "height": 30, "corner": [x0, y - 6.0, 285], "body_name": format!("Crank {side}")}));
+        let py = if y > 0.0 { y + 8.0 } else { y - 68.0 };
+        s.c("solid.box", json!({"length": 90, "width": 60, "height": 15, "corner": [150.0, py, 280], "body_name": format!("Pedal {side}")}));
+    }
+    s.root();
+    // Cockpit and seat.
+    s.component("Cockpit");
+    s.tube([600.0, 0.0, 860.0], [620.0, 0.0, 940.0], 14.0, "Steerer");
+    s.tube([620.0, 0.0, 940.0], [700.0, 0.0, 950.0], 16.0, "Stem");
+    s.tube([700.0, -380.0, 950.0], [700.0, 380.0, 950.0], 11.0, "Handlebar");
+    s.c("solid.cylinder", json!({"radius": 16, "height": 120, "base": [700, 260, 950], "axis": "Y", "body_name": "Grip R"}));
+    s.c("solid.mirror", json!({"bodies": ["Grip R"], "plane": "XZ"}));
+    s.root();
+    s.component("Seat");
+    s.tube([-150.0, 0.0, 820.0], [-170.0, 0.0, 960.0], 13.0, "Seatpost");
+    s.c("solid.box", json!({"length": 260, "width": 140, "height": 40, "center": [-180, 0, 980], "body_name": "Saddle"}));
+    s.root();
+    // Fasteners: head, shank and washer, each its own body.
+    s.component("Hardware");
+    let bolts = n(240.0);
+    for k in 0..bolts {
+        let a = std::f64::consts::TAU * k as f64 / bolts as f64;
+        let p = [round3(-300.0 + 2.5 * k as f64), round3(120.0 + 10.0 * a.sin()), round3(400.0 + 10.0 * a.cos())];
+        s.c("solid.cylinder", json!({"radius": 5, "height": 4, "base": p, "axis": "Z", "body_name": format!("Bolt {k} head")}));
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 2.5, "height": 16, "base": [p[0], p[1], round3(p[2] - 16.0)], "axis": "Z", "body_name": format!("Bolt {k} shank")}),
+        );
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 4.5, "height": 1, "base": [p[0], p[1], round3(p[2] - 1.0)], "axis": "Z", "body_name": format!("Bolt {k} washer")}),
+        );
+    }
+    s.root();
+    json!({"commands": s.commands})
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let flag = |name: &str| args.iter().position(|a| a == name).and_then(|i| args.get(i + 1));
+    let scale = match flag("--scale") {
+        Some(v) => v.parse::<f64>().ok().filter(|v| v.is_finite() && *v > 0.0 && *v <= 20.0).ok_or("--scale takes a number from 0 to 20")?,
+        None => 1.0,
+    };
+    let script = bicycle(scale);
+    if let Some(path) = flag("--script-out") {
+        let text = serde_json::to_string_pretty(&script).map_err(|e| e.to_string())?;
+        return solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"));
+    }
+    let commands = script["commands"].as_array().cloned().unwrap_or_default();
+    let mut s = Session::default();
+    let began = std::time::Instant::now();
+    // Per command: the command itself, then what a window needs to draw its result (the
+    // bodies placed in the world and their display meshes).
+    let (mut run, mut shown): (Vec<f64>, Vec<f64>) = (Vec::new(), Vec::new());
+    for (i, c) in commands.iter().enumerate() {
+        let id = c["command"].as_str().unwrap_or_default();
+        let t = std::time::Instant::now();
+        s.execute(id, &c["params"]).map_err(|e| format!("command {i} ({id}): {e}"))?;
+        run.push(t.elapsed().as_secs_f64() * 1000.0);
+        let t = std::time::Instant::now();
+        s.world_state().warm_meshes(|| true);
+        shown.push(t.elapsed().as_secs_f64() * 1000.0);
+        if run.len() == 100 || i + 1 == commands.len() {
+            let mean = |v: &[f64]| v.iter().sum::<f64>() / v.len().max(1) as f64;
+            let bodies = s.model.state().bodies.len();
+            println!(
+                "{}",
+                json!({"step": "build", "commands": i + 1, "bodies": bodies, "command_ms": mean(&run), "display_ms": mean(&shown),
+                       "max_ms": run.iter().zip(&shown).map(|(a, b)| a + b).fold(0.0, f64::max)})
+            );
+            run.clear();
+            shown.clear();
+        }
+    }
+    let world = s.world_state();
+    println!(
+        "{}",
+        json!({"step": "built", "ms": began.elapsed().as_secs_f64() * 1000.0, "commands": commands.len(), "features": s.doc.features.len(), "bodies": world.bodies.len()})
+    );
+    let path = match flag("--save") {
+        Some(p) => p.clone(),
+        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+    };
+    s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
+    let r = crate::cmd_bench_open(std::slice::from_ref(&path));
+    if flag("--save").is_none() {
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_file(format!("{path}.bak"));
+    }
+    r
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The generated commands stay valid as the command set changes: a small bicycle builds
+    /// without a failing command or feature.
+    #[test]
+    fn a_small_bicycle_builds() {
+        let script = bicycle(0.03);
+        let mut s = Session::default();
+        for c in script["commands"].as_array().into_iter().flatten() {
+            let id = c["command"].as_str().unwrap_or_default();
+            if let Err(e) = s.execute(id, &c["params"]) {
+                panic!("{id}: {e}");
+            }
+        }
+        assert!(s.model.results.iter().all(|r| r.error.is_none()));
+        let world = s.world_state();
+        assert!(world.bodies.len() > 40, "{} bodies", world.bodies.len());
+        assert!(world.bodies.iter().any(|b| b.name.contains("spoke")));
+    }
+}

apps/solidcraft-cli/src/bench_assistant.rs

@@ -0,0 +1,701 @@
+//! `bench-assistant`: the standard Assistant model test (v1, #4851), run against a desktop app.
+//!
+//! The app is already running with `--control PORT`; everything goes through its control channel
+//! (`docs/control-protocol.md`), so the command needs no window code of its own. For each task it
+//! starts a new design, runs the task's prescribed setup (a box, for some), adds the endpoint as an
+//! API agent with All permissions, starts a new chat, sends the prompt once and waits for the turn
+//! to end. The result is checked on the design (`document.inspect` with measurements), never on
+//! what the model says, except for the one question whose answer is the reply. A failed task is
+//! put in one of the issue's failure categories from the conversation's items.
+//!
+//! ```text
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT --base-url URL --model NAME
+//!     [--token T] [--tasks 1,2,5] [--repeat N] [--timeout-s 300]
+//!     [--json out.json] [--markdown out.md]
+//! ```
+//! prints a table of the results; `--markdown` writes the issue's comment template filled in,
+//! `--json` every task's rules, conversation and design before and after.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::{SocketAddr, TcpStream};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+
+/// Standard test v1, as #4851 states it. Changing a prompt or a rule makes it another test.
+const TASKS: &str = r#"[
+  {"id": "01-cube", "prompt": "Make a 20 mm cube.", "check": {"bodies": 1, "volume": 8000, "bbox_size": [20, 20, 20]}},
+  {"id": "02-cylinder", "prompt": "Make a cylinder 30 mm in diameter and 50 mm tall.", "check": {"bodies": 1, "volume": 35342.92, "bbox_size": [30, 30, 50]}},
+  {"id": "03-block", "prompt": "Create a block 60 mm long, 40 mm wide and 10 mm thick.", "check": {"bodies": 1, "volume": 24000, "bbox_size": [10, 40, 60]}},
+  {"id": "04-sketch-extrude", "prompt": "Sketch a 50 by 30 mm rectangle on the XY plane and extrude it 15 mm.", "check": {"bodies": 1, "volume": 22500, "bbox_size": [15, 30, 50], "feature_kinds": ["Extrude"]}},
+  {"id": "05-plate-hole", "prompt": "Make a plate 80 x 60 x 10 mm with a 20 mm diameter hole straight through the middle.", "check": {"bodies": 1, "volume": 44858.41, "bbox_size": [10, 60, 80], "note": "80*60*10 - pi*10^2*10"}},
+  {"id": "06-fillet-box", "prompt": "Round all the edges of the box with a 3 mm radius.", "setup": [{"command": "solid.box", "params": {"length": 40, "width": 40, "height": 40}}], "check": {"bodies": 1, "volume": 63108.53, "tol": 0.003, "feature_kinds": ["Fillet"], "note": "all 12 edges of a 40 mm cube rounded r=3"}},
+  {"id": "07-move-body", "prompt": "Move the box 50 mm along the X axis.", "setup": [{"command": "solid.box", "params": {"length": 20, "width": 20, "height": 20}}], "check": {"bodies": 1, "volume": 8000, "bbox_min": [50, 0, 0]}},
+  {"id": "08-rename-body", "prompt": "Rename the body to Bracket.", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "body_name": "Bracket"}},
+  {"id": "09-volume-question", "prompt": "What is the volume of the part?", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"bodies": 1, "volume": 6000, "unchanged": true, "reply_number": "6[ ,. ]?000(?![0-9])|6(\\.0+)? ?cm"}},
+  {"id": "10-two-holes", "prompt": "Make a 100 x 50 x 5 mm plate and drill two 10 mm holes through it, each 15 mm in from the short ends and centred across the width.", "check": {"bodies": 1, "volume": 24214.6, "bbox_size": [5, 50, 100], "note": "100*50*5 - 2*pi*5^2*5"}},
+  {"id": "11-any-change", "prompt": "can you use the software to make a change to the current shape, any change at all", "setup": [{"command": "solid.box", "params": {"length": 30, "width": 20, "height": 10}}], "check": {"changed": true, "note": "verbatim user prompt from #4846; pass = the design changed"}}
+]"#;
+
+/// The agent the test adds. A fixed id replaces it on every run instead of adding another.
+const AGENT_ID: &str = "api-bench-assistant";
+const AGENT_NAME: &str = "bench";
+/// Longest control reply read (the channel's own request limit).
+const MAX_REPLY: usize = 16 << 20;
+/// Most result data kept for `--json`.
+const MAX_RESULTS: usize = 64 << 20;
+/// Deadline of the requests that only set up or read (each is answered at once by the app).
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
+/// How often a running turn is polled.
+const POLL: Duration = Duration::from_millis(250);
+/// After this long, an idle chat with no reply yet counts as a turn that ended without one.
+const START_GRACE: Duration = Duration::from_secs(30);
+/// Absolute tolerance of the lowest corner, in millimetres.
+const MIN_CORNER_TOL: f64 = 0.05;
+
+/// A JSON-lines connection to the app. Requests are sent once; a lost reply is never retried,
+/// so nothing runs twice.
+struct Control {
+    addr: SocketAddr,
+    token: String,
+    reader: BufReader<TcpStream>,
+    id: u64,
+}
+
+impl Control {
+    fn connect(addr: &str, token: Option<&str>) -> Result<Self, String> {
+        let addr: SocketAddr = addr.parse().map_err(|_| format!("--connect: `{addr}` is not an IP address and port"))?;
+        if !addr.ip().is_loopback() || addr.port() == 0 {
+            return Err("--connect requires a loopback address and a nonzero port (the app listens on 127.0.0.1)".into());
+        }
+        let token = solidcraft_engine::control_auth::client_token(addr.port(), token)
+            .map(|t| t.token)
+            .ok_or("no control token: pass --token, set SOLIDCRAFT_CONTROL_TOKEN, or run on the app's computer (its token file)")?;
+        if token.len() > 4096 {
+            return Err("the control token is longer than 4096 bytes".into());
+        }
+        Self::open(addr, token)
+    }
+
+    fn open(addr: SocketAddr, token: String) -> Result<Self, String> {
+        let stream = TcpStream::connect_timeout(&addr, Duration::from_secs(5)).map_err(|e| format!("connecting to {addr}: {e}"))?;
+        Ok(Self { addr, token, reader: BufReader::new(stream), id: 0 })
+    }
+
+    /// A new connection to the same app: a request that outlived its deadline keeps the old one
+    /// busy until it is answered.
+    fn reopen(&self) -> Result<Self, String> {
+        Self::open(self.addr, self.token.clone())
+    }
+
+    fn call(&mut self, method: &str, params: Value, deadline: Instant) -> Result<Value, String> {
+        let left = || deadline.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()).ok_or_else(|| "timeout".to_string());
+        let io = |e: std::io::Error| match e.kind() {
+            std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => "timeout".to_string(),
+            _ => format!("control channel: {e}"),
+        };
+        self.reader.get_ref().set_write_timeout(Some(left()?)).map_err(io)?;
+        self.id += 1;
+        // The first request on a connection carries the token; sending it on every one is allowed.
+        let request = json!({"id": self.id, "method": method, "params": params, "token": self.token});
+        writeln!(self.reader.get_mut(), "{request}").map_err(io)?;
+        let mut line = Vec::new();
+        loop {
+            self.reader.get_ref().set_read_timeout(Some(left()?)).map_err(io)?;
+            let bytes = self.reader.fill_buf().map_err(io)?;
+            if bytes.is_empty() {
+                return Err("the app closed the control connection".into());
+            }
+            let newline = bytes.iter().position(|b| *b == b'\n');
+            let used = newline.map_or(bytes.len(), |n| n + 1);
+            if line.len() + used > MAX_REPLY {
+                return Err("a control reply is larger than 16 MiB".into());
+            }
+            line.extend_from_slice(bytes.get(..used).unwrap_or_default());
+            self.reader.consume(used);
+            if newline.is_some() {
+                break;
+            }
+        }
+        let reply: Value = serde_json::from_slice(&line).map_err(|e| format!("control reply: {e}"))?;
+        if reply["id"].as_u64() != Some(self.id) {
+            return Err("control reply for another request".into());
+        }
+        if reply["ok"] != true {
+            return Err(format!("{method}: {}", reply["error"].as_str().unwrap_or("failed")));
+        }
+        reply.get("result").cloned().ok_or_else(|| format!("{method}: reply without a result"))
+    }
+
+    fn execute(&mut self, command: &str, params: Value) -> Result<Value, String> {
+        self.call("engine.execute", json!({"command": command, "params": params, "animate": false}), Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn chat(&mut self, params: Value) -> Result<Value, String> {
+        self.call("ui.agent_chat", params, Instant::now() + REQUEST_TIMEOUT)
+    }
+
+    fn inspect(&mut self) -> Result<Value, String> {
+        let design = self.call("document.inspect", json!({"measure": true}), Instant::now() + REQUEST_TIMEOUT)?;
+        if design.is_object() { Ok(design) } else { Err("document.inspect returned no design".into()) }
+    }
+}
+
+fn tasks() -> Result<Vec<Value>, String> {
+    serde_json::from_str(TASKS).map_err(|e| format!("embedded tasks: {e}"))
+}
+
+fn triple(value: &Value) -> Option<[f64; 3]> {
+    match value.as_array()?.as_slice() {
+        [x, y, z] => {
+            let n = |v: &Value| v.as_f64().filter(|n| n.is_finite());
+            Some([n(x)?, n(y)?, n(z)?])
+        }
+        _ => None,
+    }
+}
+
+/// What the model said (thoughts left out).
+fn reply(items: &[Value]) -> String {
+    items.iter().filter(|i| i["thought"] != true).filter_map(|i| i["agent"].as_str()).collect::<Vec<_>>().join("\n")
+}
+
+/// v1's reply pattern `6[ ,. ]?000(?![0-9])|6(\.0+)? ?cm`: "6000", "6 000", "6,000", "6.000" not
+/// followed by a digit, or "6 cm", "6.0cm", … (a narrow no-break space also separates thousands).
+fn volume_reply(text: &str) -> bool {
+    text.match_indices('6').any(|(at, _)| {
+        let tail = text.get(at + 1..).unwrap_or_default();
+        let thousands = |t: &str| t.strip_prefix("000").is_some_and(|rest| !rest.starts_with(|c: char| c.is_ascii_digit()));
+        let separated = tail.strip_prefix([' ', ',', '.', '\u{202f}']).is_some_and(thousands);
+        let cm = {
+            let t = tail.strip_prefix(".0").map_or(tail, |t| t.trim_start_matches('0'));
+            t.strip_prefix(' ').unwrap_or(t).starts_with("cm")
+        };
+        thousands(tail) || separated || cm
+    })
+}
+
+/// The design as the user sees it, without what reading or saving changes (path, saved state,
+/// revision, selection, undo depth, evaluation timings).
+fn content(design: &Value) -> Value {
+    let mut v = design.clone();
+    if let Some(o) = v.as_object_mut() {
+        for key in ["path", "dirty", "revision", "selection", "undo", "redo"] {
+            o.remove(key);
+        }
+    }
+    for feature in v.get_mut("timeline").and_then(Value::as_array_mut).into_iter().flatten() {
+        if let Some(o) = feature.as_object_mut() {
+            o.remove("ms");
+            o.remove("boolean_diagnostics");
+        }
+    }
+    v
+}
+
+/// Whether the design changed: its content, or a step on the undo stack (a colour, say, that the
+/// inspection does not list).
+fn changed(before: &Value, after: &Value) -> bool {
+    content(before) != content(after) || after["undo"].as_u64() > before["undo"].as_u64()
+}
+
+/// The rules a task's result breaks (none: it passed). `before` and `after` are
+/// `document.inspect {measure: true}` before the prompt and after the turn.
+pub(super) fn check(rule: &Value, before: &Value, after: &Value, items: &[Value]) -> Vec<String> {
+    let Some(all) = after["bodies"].as_array() else { return vec!["the design could not be read".into()] };
+    // Bodies the user sees; a hidden one (a tool body, a hidden original) is not the result.
+    let bodies: Vec<&Value> = all.iter().filter(|b| b["visible"] != false).collect();
+    let mut errors = Vec::new();
+    if let Some(n) = rule["bodies"].as_u64()
+        && bodies.len() as u64 != n
+    {
+        errors.push(format!("{} bodies, expected {n}", bodies.len()));
+    }
+    if let Some(expected) = rule["volume"].as_f64() {
+        let tol = rule["tol"].as_f64().unwrap_or(0.01);
+        let volumes: Vec<f64> = bodies.iter().filter_map(|b| b["volume_mm3"].as_f64()).filter(|v| v.is_finite()).collect();
+        let total: f64 = volumes.iter().sum();
+        if volumes.len() != bodies.len() || (total - expected).abs() > expected * tol {
+            errors.push(format!("volume {total:.1} mm³, expected {expected} mm³ ±{}%", tol * 100.0));
+        }
+    }
+    let first = bodies.first().copied().unwrap_or(&Value::Null);
+    let min = triple(&first["bbox"]["min"]);
+    if let Some(mut expected) = triple(&rule["bbox_size"]) {
+        expected.sort_by(f64::total_cmp);
+        let size = min.zip(triple(&first["bbox"]["max"])).map(|(lo, hi)| {
+            let mut size = [hi[0] - lo[0], hi[1] - lo[1], hi[2] - lo[2]];
+            size.sort_by(f64::total_cmp);
+            size
+        });
+        if !size.is_some_and(|s| s.iter().zip(expected).all(|(a, e)| (a - e).abs() <= 0.01 * e.max(1.0))) {
+            errors.push(format!("size {size:?}, expected {expected:?} in any orientation"));
+        }
+    }
+    if let Some(expected) = triple(&rule["bbox_min"])
+        && !min.is_some_and(|m| m.iter().zip(expected).all(|(a, e)| (a - e).abs() <= MIN_CORNER_TOL))
+    {
+        errors.push(format!("lowest corner {min:?}, expected {expected:?}"));
+    }
+    if let Some(name) = rule["body_name"].as_str()
+        && !bodies.iter().any(|b| b["name"] == name)
+    {
+        errors.push(format!("no body named {name}"));
+    }
+    for kind in rule["feature_kinds"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        let live = |f: &&Value| f["suppressed"] != true && f["rolled_back"] != true && f["error"].is_null();
+        if !after["timeline"].as_array().into_iter().flatten().filter(live).any(|f| f["type"].as_str().is_some_and(|t| t.contains(kind))) {
+            errors.push(format!("no {kind} in the timeline"));
+        }
+    }
+    if rule["changed"] == true || rule["unchanged"] == true {
+        let changed = before.is_object() && changed(before, after);
+        if rule["changed"] == true && !changed {
+            errors.push("the design did not change".into());
+        }
+        if rule["unchanged"] == true && (changed || !before.is_object()) {
+            errors.push("the design changed".into());
+        }
+    }
+    if rule["reply_number"].is_string() && !volume_reply(&reply(items)) {
+        errors.push("the reply does not give the volume".into());
+    }
+    errors
+}
+
+/// A tool call written into the reply as JSON: `{"name": …`, `{"command": …`, `{"function": …`,
+/// `{"tool": …`.
+fn call_as_text(text: &str) -> bool {
+    text.match_indices('{').any(|(at, _)| {
+        let rest = text.get(at + 1..).unwrap_or_default().trim_start();
+        ["\"name\"", "\"command\"", "\"function\"", "\"tool\""]
+            .iter()
+            .any(|key| rest.strip_prefix(key).is_some_and(|r| r.trim_start().starts_with(':')))
+    })
+}
+
+/// How a failed task failed, in the issue's words, from the conversation's items.
+pub(super) fn classify(items: &[Value], timed_out: bool) -> &'static str {
+    if timed_out {
+        return "timeout";
+    }
+    let tools: Vec<&Value> = items.iter().filter(|i| i.get("tool").is_some()).collect();
+    // A failed call, or a batch whose answer reports a failed step (`"ok": false`).
+    let failed: Vec<String> = tools
+        .iter()
+        .map(|t| t["output"].as_str().unwrap_or_default())
+        .zip(&tools)
+        .filter(|(output, t)| t["status"] == "Failed" || serde_json::from_str::<Value>(output).is_ok_and(|v| v["ok"] == false))
+        .map(|(output, _)| output.to_lowercase())
+        .collect();
+    let notices: Vec<String> = items.iter().filter_map(|i| i["notice"].as_str()).map(str::to_lowercase).collect();
+    let answer = reply(items);
+    if notices.iter().any(|n| n.contains("http 400")) {
+        return "the endpoint refused tools (HTTP 400)";
+    }
+    if notices.iter().any(|n| n.contains("max_turn_requests")) || answer.contains("requests for one message") {
+        return "hit the request limit";
+    }
+    if call_as_text(&answer) {
+        return "wrote the call as text";
+    }
+    if failed.iter().any(|o| o.contains("unknown command") || o.starts_with("unknown tool")) {
+        return "wrong or unknown command";
+    }
+    if failed.iter().any(|o| o.contains("invalid parameters") || o.starts_with("not run:") || o.contains("not valid json")) {
+        return "wrong arguments";
+    }
+    if !failed.is_empty() || notices.iter().any(|n| n.starts_with("http ")) || items.iter().any(|i| i["error"] == true) {
+        return "gave up after errors";
+    }
+    if tools.is_empty() {
+        return if answer.trim().is_empty() { "an empty reply" } else { "only talked" };
+    }
+    "wrong result"
+}
+
+/// One run's results in the issue's comment template (`run`: which repetition).
+pub(super) fn markdown(model: &str, version: &str, results: &[Value], run: u64) -> String {
+    let clean = |s: &str| s.replace(['\n', '\r', '|'], " ");
+    let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+    let passed = rows.iter().filter(|r| r["passed"] == true).count();
+    let mut out = format!(
+        "### {} (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: {}\nResult: {passed}/11\n| # | pass/fail | how it failed |\n|---|---|---|\n",
+        clean(model),
+        clean(version)
+    );
+    for n in 1..=11 {
+        match rows.iter().find(|r| r["task"] == n) {
+            Some(r) if r["passed"] == true => out.push_str(&format!("| {n} | pass | |\n")),
+            Some(r) => out.push_str(&format!("| {n} | fail | {} |\n", clean(r["failure"].as_str().unwrap_or_default()))),
+            None => out.push_str(&format!("| {n} | | not run |\n")),
+        }
+    }
+    out.push_str(if rows.len() == 11 {
+        "Notes: <anything odd, e.g. very slow, needed a retry>\n"
+    } else {
+        "Notes: partial run; the tasks marked \"not run\" were left out.\n"
+    });
+    out
+}
+
+fn write(path: &str, text: &str) -> Result<(), String> {
+    solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"))
+}
+
+struct Options<'a> {
+    connect: &'a str,
+    token: Option<&'a str>,
+    base_url: &'a str,
+    model: &'a str,
+    tasks: Vec<usize>,
+    repeat: u64,
+    timeout: Duration,
+    json: Option<&'a str>,
+    markdown: Option<&'a str>,
+}
+
+fn options(args: &[String]) -> Result<Options<'_>, String> {
+    const FLAGS: [&str; 9] = ["--connect", "--token", "--base-url", "--model", "--tasks", "--repeat", "--timeout-s", "--json", "--markdown"];
+    let mut given = std::collections::BTreeMap::new();
+    let mut args = args.iter();
+    while let Some(flag) = args.next() {
+        let Some(flag) = FLAGS.iter().find(|f| **f == flag.as_str()) else { return Err(format!("unknown bench-assistant option: {flag}")) };
+        let value = args
+            .next()
+            .filter(|v| !v.starts_with("--") && !v.is_empty() && v.len() <= 4096)
+            .ok_or_else(|| format!("{flag} needs a value (at most 4096 bytes)"))?;
+        if given.insert(*flag, value.as_str()).is_some() {
+            return Err(format!("{flag} given twice"));
+        }
+    }
+    let required = |key: &str| given.get(key).copied().ok_or_else(|| format!("bench-assistant needs {key}"));
+    let number = |key: &str, default: u64, max: u64| -> Result<u64, String> {
+        given
+            .get(key)
+            .map_or(Ok(default), |s| s.parse::<u64>().ok().filter(|n| (1..=max).contains(n)).ok_or_else(|| format!("{key} must be 1 to {max}")))
+    };
+    let tasks = match given.get("--tasks") {
+        None => (1..=11).collect(),
+        Some(list) => {
+            let mut tasks = Vec::new();
+            for n in list.split(',') {
+                let n = n
+                    .trim()
+                    .parse::<usize>()
+                    .ok()
+                    .filter(|n| (1..=11).contains(n))
+                    .ok_or("--tasks takes task numbers 1 to 11, separated by commas")?;
+                if tasks.contains(&n) {
+                    return Err(format!("--tasks lists task {n} twice"));
+                }
+                tasks.push(n);
+            }
+            tasks
+        }
+    };
+    Ok(Options {
+        connect: required("--connect")?,
+        token: given.get("--token").copied(),
+        base_url: required("--base-url")?,
+        model: required("--model")?,
+        tasks,
+        repeat: number("--repeat", 1, 100)?,
+        timeout: Duration::from_secs(number("--timeout-s", 300, 3600)?),
+        json: given.get("--json").copied(),
+        markdown: given.get("--markdown").copied(),
+    })
+}
+
+/// Waits for the turn the prompt started to end. Returns the chat's last state and whether the
+/// deadline passed first.
+fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: Instant) -> Result<(Value, bool), String> {
+    let mut seen_busy = false;
+    loop {
+        let state = chat["state"].as_str().unwrap_or_default();
+        let turn = !chat["turn"].is_null();
+        let queued = chat["pending"].as_array().is_some_and(|p| !p.is_empty());
+        seen_busy |= state == "busy" || turn;
+        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
+        // A turn can start and end between two polls: then the conversation has its answer.
+        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
+        if idle && (seen_busy || answered || matches!(state, "exited" | "auth" | "off") || began.elapsed() >= START_GRACE) {
+            return Ok((chat, false));
+        }
+        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
+        std::thread::sleep(POLL.min(left));
+        match control.call("ui.agent_chat", json!({}), end) {
+            Ok(next) => chat = next,
+            Err(e) if e == "timeout" => return Ok((chat, true)),
+            Err(e) => return Err(e),
+        }
+    }
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let o = options(args)?;
+    let tasks = tasks()?;
+    let mut control = Control::connect(o.connect, o.token)?;
+    let help = control.call("ui.help", json!({}), Instant::now() + REQUEST_TIMEOUT)?;
+    let version = help["version"].as_str().filter(|s| !s.is_empty() && s.len() <= 256).ok_or("the app reported no version")?.to_string();
+    let config = control.chat(json!({
+        "features": true,
+        "add_agent": {"id": AGENT_ID, "name": AGENT_NAME, "kind": "api", "base_url": o.base_url, "model": o.model},
+    }))?;
+    if !config["agents"].as_array().into_iter().flatten().any(|a| a["id"] == AGENT_ID) {
+        return Err("the app did not add the benchmark's agent".into());
+    }
+    // Put the user's permission setting back afterwards.
+    let permissions = config["permissions"].as_str().map(str::to_string);
+    let result = run_tasks(&mut control, &o, &tasks, &version);
+    let _ = control.chat(json!({"stop": true}));
+    if let Some(p) = permissions {
+        let _ = control.chat(json!({"permissions": p}));
+    }
+    result
+}
+
+fn run_tasks(control: &mut Control, o: &Options, tasks: &[Value], version: &str) -> Result<(), String> {
+    let mut results: Vec<Value> = Vec::new();
+    let mut kept = 0;
+    let mut stdout = std::io::stdout().lock();
+    let mut say = |line: String| writeln!(stdout, "{line}").map_err(|e| format!("stdout: {e}"));
+    say(format!("bench-assistant v1: {} on SolidCraft {version}", o.model))?;
+    say("| run | # | task | pass/fail | how it failed | seconds |\n|---|---|---|---|---|---|".into())?;
+    for run in 1..=o.repeat {
+        for &n in &o.tasks {
+            let task = tasks.get(n - 1).ok_or("missing embedded task")?;
+            // A fresh design and a fresh chat, with nothing of the last task still running.
+            control.chat(json!({"stop": true}))?;
+            control.execute("file.new", json!({"name": "Benchmark"}))?;
+            for step in task["setup"].as_array().into_iter().flatten() {
+                control.execute(step["command"].as_str().ok_or("embedded setup without a command")?, step["params"].clone())?;
+            }
+            control.chat(json!({"agent": AGENT_ID, "permissions": "all", "new_chat": true, "attach_view": false}))?;
+            let before = control.inspect()?;
+            let began = Instant::now();
+            let end = began + o.timeout;
+            let (chat, timed_out) = match control.call("ui.agent_chat", json!({"send": task["prompt"]}), end) {
+                Ok(chat) => wait_for_turn(control, chat, began, end)?,
+                Err(e) if e == "timeout" => (json!({}), true),
+                Err(e) => return Err(e),
+            };
+            if timed_out {
+                // The late reply would arrive on the old connection; stop the model on a new one
+                // before reading the design.
+                *control = control.reopen()?;
+            }
+            // Stop the agent before reading the result, so nothing changes the design meanwhile.
+            let stopped = control.chat(json!({"stop": true}))?;
+            let items = stopped["items"].as_array().or(chat["items"].as_array()).cloned().unwrap_or_default();
+            let after = control.inspect()?;
+            let failed_rules = check(&task["check"], &before, &after, &items);
+            let passed = failed_rules.is_empty();
+            let failure = if passed { "" } else { classify(&items, timed_out) };
+            let seconds = began.elapsed().as_secs_f64();
+            say(format!(
+                "| {run} | {n} | {} | {} | {failure} | {seconds:.0} |",
+                task["id"].as_str().unwrap_or_default(),
+                if passed { "pass" } else { "fail" }
+            ))?;
+            let result = json!({
+                "task": n, "id": task["id"], "prompt": task["prompt"], "repeat": run, "passed": passed, "failure": failure,
+                "failed_rules": failed_rules, "timed_out": timed_out, "seconds": seconds, "check": task["check"],
+                "items": items, "before": before, "after": after,
+            });
+            kept += result.to_string().len();
+            if kept > MAX_RESULTS {
+                return Err("the results passed 64 MiB; run fewer tasks or repetitions".into());
+            }
+            results.push(result);
+            // Written after every task, so an interrupted run keeps what it measured.
+            if let Some(path) = o.json {
+                let all = json!({"test": "v1", "model": o.model, "base_url": o.base_url, "solidcraft": version, "results": results});
+                write(path, &serde_json::to_string_pretty(&all).map_err(|e| e.to_string())?)?;
+            }
+            if let Some(path) = o.markdown {
+                write(path, &(1..=run).map(|r| markdown(o.model, version, &results, r)).collect::<Vec<_>>().join("\n"))?;
+            }
+        }
+    }
+    for run in 1..=o.repeat {
+        let rows: Vec<&Value> = results.iter().filter(|r| r["repeat"] == run).collect();
+        say(format!("run {run}: {}/{} passed", rows.iter().filter(|r| r["passed"] == true).count(), rows.len()))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn design(bodies: Value, timeline: Value) -> Value {
+        json!({"name": "Benchmark", "params": [], "timeline": timeline, "bodies": bodies, "sketches": [], "undo": 1, "revision": 3, "dirty": true})
+    }
+
+    fn body(name: &str, volume: f64, min: [f64; 3], max: [f64; 3]) -> Value {
+        json!({"name": name, "volume_mm3": volume, "bbox": {"min": min, "max": max}, "visible": true})
+    }
+
+    #[test]
+    fn the_embedded_tasks_are_v1() {
+        let tasks = tasks().unwrap();
+        assert_eq!(tasks.len(), 11);
+        assert_eq!(tasks[0]["prompt"], "Make a 20 mm cube.");
+        assert_eq!(tasks[10]["prompt"], "can you use the software to make a change to the current shape, any change at all");
+        assert_eq!(tasks[5]["check"]["tol"], 0.003);
+        assert_eq!(tasks[6]["check"]["bbox_min"], json!([50, 0, 0]));
+        let boxes: Vec<_> = tasks.iter().filter(|t| t["setup"].is_array()).map(|t| t["id"].as_str().unwrap()).collect();
+        assert_eq!(boxes, ["06-fillet-box", "07-move-body", "08-rename-body", "09-volume-question", "11-any-change"]);
+    }
+
+    #[test]
+    fn pass_rules() {
+        let tasks = tasks().unwrap();
+        let rule = |n: usize| tasks[n - 1]["check"].clone();
+        let empty = design(json!([]), json!([]));
+        let pass = |n: usize, before: &Value, after: &Value, items: &[Value]| check(&rule(n), before, after, items);
+        // 3: any orientation, within 1%.
+        let block = design(json!([body("Body1", 24_100.0, [0.0; 3], [40.0, 10.0, 60.2])]), json!([{"type": "Box"}]));
+        assert!(pass(3, &empty, &block, &[]).is_empty());
+        let thick = design(json!([body("Body1", 24_000.0, [0.0; 3], [40.0, 12.0, 60.0])]), json!([]));
+        assert_eq!(pass(3, &empty, &thick, &[]).len(), 1);
+        let two = design(json!([body("A", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0]), body("B", 12_000.0, [0.0; 3], [60.0, 40.0, 5.0])]), json!([]));
+        assert!(!pass(3, &empty, &two, &[]).is_empty());
+        // A hidden body is not part of the result.
+        let mut hidden = two.clone();
+        hidden["bodies"][1]["visible"] = json!(false);
+        hidden["bodies"][0]["volume_mm3"] = json!(24_000.0);
+        hidden["bodies"][0]["bbox"]["max"] = json!([60.0, 40.0, 10.0]);
+        assert!(pass(3, &empty, &hidden, &[]).is_empty());
+        // 4: the timeline needs a working Extrude.
+        let plate = |kind: Value| design(json!([body("Body1", 22_500.0, [0.0; 3], [50.0, 30.0, 15.0])]), kind);
+        assert!(pass(4, &empty, &plate(json!([{"type": "Sketch"}, {"type": "Extrude"}])), &[]).is_empty());
+        assert!(!pass(4, &empty, &plate(json!([{"type": "Box"}])), &[]).is_empty());
+        for flag in [json!({"suppressed": true}), json!({"rolled_back": true}), json!({"error": "failed"})] {
+            let mut feature = json!({"type": "Extrude"});
+            feature.as_object_mut().unwrap().extend(flag.as_object().unwrap().clone());
+            assert!(!pass(4, &empty, &plate(json!([feature])), &[]).is_empty(), "{flag}");
+        }
+        // 6: the fillet's tolerance is 0.3%.
+        let start = design(json!([body("Body1", 64_000.0, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}]));
+        let filleted = |v: f64| design(json!([body("Body1", v, [0.0; 3], [40.0; 3])]), json!([{"type": "Box"}, {"type": "Fillet"}]));
+        assert!(pass(6, &start, &filleted(63_108.53 * 1.002), &[]).is_empty());
+        assert!(!pass(6, &start, &filleted(63_108.53 * 1.004), &[]).is_empty());
+        // 7: the lowest corner.
+        let moved = |x: f64| design(json!([body("Body1", 8000.0, [x, 0.0, 0.0], [x + 20.0, 20.0, 20.0])]), json!([]));
+        assert!(pass(7, &empty, &moved(50.0), &[]).is_empty());
+        assert!(!pass(7, &empty, &moved(0.0), &[]).is_empty());
+        // 8: the name.
+        let named = |name: &str| design(json!([body(name, 6000.0, [0.0; 3], [30.0, 20.0, 10.0])]), json!([]));
+        assert!(pass(8, &empty, &named("Bracket"), &[]).is_empty());
+        assert!(!pass(8, &empty, &named("Body1"), &[]).is_empty());
+        // 9: unchanged, and the reply gives the volume.
+        let start = named("Body1");
+        let said = |text: &str| [json!({"user": "What is the volume of the part?"}), json!({"agent": text, "thought": false})];
+        let mut read = start.clone();
+        read["revision"] = json!(7);
+        read["dirty"] = json!(false);
+        read["selection"] = json!([{"body": "Body1"}]);
+        assert!(pass(9, &start, &read, &said("The volume is 6000 mm³.")).is_empty());
+        assert!(!pass(9, &start, &read, &said("About 60 cm³.")).is_empty());
+        assert!(!pass(9, &start, &named("Bracket"), &said("6 000 mm³")).is_empty());
+        let mut undone = start.clone();
+        undone["undo"] = json!(2);
+        assert!(!pass(9, &start, &undone, &said("6000 mm³")).is_empty());
+        // 11: any change counts; reading does not.
+        assert!(pass(11, &start, &named("Bracket"), &[]).is_empty());
+        assert!(pass(11, &start, &undone, &[]).is_empty());
+        assert!(!pass(11, &start, &read, &[]).is_empty());
+        // An unreadable design passes nothing.
+        assert!(!pass(11, &start, &json!({}), &[]).is_empty());
+    }
+
+    #[test]
+    fn the_volume_reply() {
+        for yes in ["6000", "6 000 mm³", "6,000", "6.000", "6\u{202f}000", "6 cm³", "6.00cm3", "is 6000."] {
+            assert!(volume_reply(yes), "{yes}");
+        }
+        for no in ["60000", "6,0001", "60 cm³", "600", "6.01 cm³", ""] {
+            assert!(!volume_reply(no), "{no}");
+        }
+    }
+
+    #[test]
+    fn failure_categories() {
+        for (items, expected) in [
+            (
+                json!([{"user": "Make a 20 mm cube."}, {"agent": "{\"name\": \"execute\", \"arguments\": {}}", "thought": false}]),
+                "wrote the call as text",
+            ),
+            (
+                json!([{"notice": "HTTP 400: registry.ollama.ai/library/gemma3:4b does not support tools", "error": true}]),
+                "the endpoint refused tools (HTTP 400)",
+            ),
+            (json!([{"user": "Make a 20 mm cube."}, {"agent": "", "thought": false}]), "an empty reply"),
+            (json!([{"agent": "Let me think", "thought": true}]), "an empty reply"),
+            (json!([{"agent": "Sure, here is how to make a cube.", "thought": false}]), "only talked"),
+            (
+                json!([{"tool": "1", "status": "Failed", "output": "unknown command `solid.cube` (did you mean `solid.box`?)"}]),
+                "wrong or unknown command",
+            ),
+            (json!([{"tool": "1", "status": "Failed", "output": "unknown tool `make_cube`"}]), "wrong or unknown command"),
+            (json!([{"tool": "1", "status": "Failed", "output": "invalid parameters for `solid.box`: `length` is required"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "Not run: the tool arguments were not valid JSON"}]), "wrong arguments"),
+            (json!([{"tool": "1", "status": "Failed", "output": "no body `Box`"}]), "gave up after errors"),
+            (
+                json!([{"tool": "1", "status": "Completed", "output": "{\"ok\": false, \"failed\": {\"error\": \"unknown command `solid.delete`\"}}"}]),
+                "wrong or unknown command",
+            ),
+            (
+                json!([{"tool": "1", "status": "Completed"}, {"agent": "\n(stopped after 24 requests for one message; send another message to go on)"}]),
+                "hit the request limit",
+            ),
+            (json!([{"tool": "1", "status": "Completed", "output": "{}"}]), "wrong result"),
+        ] {
+            let items = items.as_array().unwrap();
+            assert_eq!(classify(items, false), expected, "{items:?}");
+            assert_eq!(classify(items, true), "timeout");
+        }
+    }
+
+    #[test]
+    fn markdown_is_the_comment_template() {
+        let rows: Vec<Value> =
+            (1..=11).map(|n| json!({"task": n, "repeat": 1, "passed": n != 2, "failure": if n == 2 { "an empty reply" } else { "" }})).collect();
+        let report = markdown("qwen2.5:7b", "0.19.0", &rows, 1);
+        assert!(report.starts_with(
+            "### qwen2.5:7b (<quant>, <download size>)\nRuntime: <Ollama/LM Studio/... version>, context <num_ctx if changed>\nSolidCraft: 0.19.0\nResult: 10/11\n| # | pass/fail | how it failed |\n|---|---|---|\n| 1 | pass | |\n| 2 | fail | an empty reply |\n"
+        ));
+        assert!(report.ends_with("| 11 | pass | |\nNotes: <anything odd, e.g. very slow, needed a retry>\n"));
+        let partial = markdown("m|x", "v", &rows[..1], 1);
+        assert!(partial.starts_with("### m x ("));
+        assert!(partial.contains("Result: 1/11") && partial.contains("| 2 | | not run |") && partial.contains("partial run"));
+    }
+
+    #[test]
+    fn options_are_checked_before_connecting() {
+        for extra in [
+            &["--repeat", "0"][..],
+            &["--repeat", "101"],
+            &["--timeout-s", "3601"],
+            &["--tasks", "0"],
+            &["--tasks", "12"],
+            &["--tasks", "1,1"],
+            &["--model", "again"],
+            &["--unexpected", "1"],
+            &["--token"],
+        ] {
+            let mut args: Vec<String> =
+                ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "http://127.0.0.1:11434/v1"].iter().map(|s| s.to_string()).collect();
+            args.extend(extra.iter().map(|s| s.to_string()));
+            assert!(options(&args).is_err(), "{extra:?}");
+        }
+        let args: Vec<String> =
+            ["--connect", "127.0.0.1:9", "--model", "m", "--base-url", "u", "--tasks", "2, 5"].iter().map(|s| s.to_string()).collect();
+        let o = options(&args).unwrap();
+        assert_eq!((o.tasks, o.repeat, o.timeout), (vec![2, 5], 1, Duration::from_secs(300)));
+        assert!(Control::connect("10.0.0.1:9271", Some("t")).is_err());
+        assert!(Control::connect("localhost", Some("t")).is_err());
+    }
+}

apps/solidcraft-cli/src/crashes.rs

@@ -0,0 +1,106 @@
+//! `solidcraft-cli crashes`: the crash reports the desktop app wrote on this computer
+//! (docs/crash-reports.md): list them, show one, replay one, delete them.
+
+use std::sync::Mutex;
+
+use serde_json::{Value, json};
+use solidcraft_engine::crash;
+
+/// The command's usage, from the same lines the top-level usage lists.
+fn usage() -> String {
+    crate::command_usage("crashes")
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let dir = crash::default_dir().ok_or("no crash folder on this system")?;
+    let id = || args.get(1).map(String::as_str).ok_or_else(usage);
+    match args.first().map(String::as_str) {
+        None | Some("list") => {
+            let reports = crash::list(&dir);
+            if args.iter().any(|a| a == "--json") {
+                println!("{}", super::pretty(&json!({ "dir": dir.to_string_lossy(), "reports": reports })));
+                return Ok(());
+            }
+            println!("crash reports in {}", dir.display());
+            if reports.is_empty() {
+                println!("  (none)");
+            }
+            for r in reports {
+                let times = if r.count > 1 { format!(" ×{}", r.count) } else { String::new() };
+                let cmd = r.command.map(|c| format!(" in {c}")).unwrap_or_default();
+                let replay = if r.replayable { "  [replayable]" } else { "" };
+                println!("  {}  {}{times}{cmd}  v{}{replay}\n      {}", r.id, r.kind, r.version, r.message);
+            }
+            Ok(())
+        }
+        Some("show") => {
+            println!("{}", super::pretty(&crash::read(&dir, id()?)?));
+            Ok(())
+        }
+        Some("replay") => replay(&crash::read(&dir, id()?)?),
+        Some("dir") => {
+            println!("{}", dir.display());
+            Ok(())
+        }
+        Some("clear") => {
+            println!("deleted {} report(s)", crash::clear(&dir, args.get(1).map(String::as_str)));
+            Ok(())
+        }
+        _ => Err(usage()),
+    }
+}
+
+/// Panics seen while replaying: (location, message).
+static PANICS: Mutex<Vec<(String, String)>> = Mutex::new(Vec::new());
+
+/// Run a report's commands on its design and say whether the crash happens again.
+fn replay(report: &Value) -> Result<(), String> {
+    let id = report["id"].as_str().unwrap_or_default();
+    let replay_path = report["replay_path"].as_str().ok_or_else(|| format!("report {id} cannot be replayed (see its notes)"))?;
+    let script = super::read_json(replay_path)?;
+    let commands = script["commands"].as_array().cloned().unwrap_or_default();
+    let mut s = match report["design_path"].as_str() {
+        Some(d) => super::load(d)?,
+        None => solidcraft_engine::Session::default(),
+    };
+    std::panic::set_hook(Box::new(|info| {
+        let loc = info.location().map_or_else(|| "(unknown)".to_string(), |l| format!("{}:{}", l.file(), l.line()));
+        let msg = info.payload_as_str().unwrap_or("(not a text message)").to_string();
+        if let Ok(mut p) = PANICS.lock() {
+            p.push((loc, msg));
+        }
+    }));
+    if report["kind"] == "unclean_exit" {
+        println!("this crash ended the app without a report: if this process ends abruptly, it reproduced");
+    }
+    println!(
+        "replaying {} command(s) on {}",
+        commands.len(),
+        report["design_path"].as_str().map_or_else(|| "a new design".to_string(), |d| d.to_string())
+    );
+    for (i, c) in commands.iter().enumerate() {
+        let cmd = c["command"].as_str().unwrap_or_default();
+        let r = s.execute(cmd, c.get("params").unwrap_or(&Value::Null));
+        match r {
+            Ok(_) => println!("  {:>3}. {cmd}: ok", i + 1),
+            Err(e) => println!("  {:>3}. {cmd}: {e}", i + 1),
+        }
+    }
+    let _ = std::panic::take_hook();
+    let seen = PANICS.lock().map(|p| p.clone()).unwrap_or_default();
+    let want = report["signature"].as_str().unwrap_or_default();
+    let same = seen.iter().any(|(l, m)| format!("{:016x}", crash::signature(l, m)) == want);
+    if same {
+        println!(
+            "reproduced: the same internal error ({}) at {}",
+            report["message"].as_str().unwrap_or_default(),
+            report["location"].as_str().unwrap_or_default()
+        );
+    } else if let Some((l, m)) = seen.first() {
+        println!("an internal error happened, but not the reported one: {m} at {l}");
+        println!("(the report says: {} at {})", report["message"].as_str().unwrap_or_default(), report["location"].as_str().unwrap_or_default());
+    } else {
+        println!("did not reproduce: no internal error (fixed, or it depends on something the replay does not have)");
+    }
+    Ok(())
+}

apps/solidcraft-cli/src/fuzz.rs

@@ -1,4 +1,4 @@
-//! `solvecraft-cli fuzz`: random modelling sessions and boolean checks (docs/robustness.md).
+//! `solidcraft-cli fuzz`: random modelling sessions and boolean checks (docs/robustness.md).
 //!
 //! Each seed runs in its own process (`fuzz-one`) with a time limit, so a hang or a hard crash
 //! is recorded like any other failure.
@@ -9,16 +9,23 @@ use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
 use serde_json::{Value, json};
-use solvecraft_engine::fuzz;
-use solvecraft_engine::fuzz::boolean_case;
+use solidcraft_engine::fuzz;
+use solidcraft_engine::fuzz::boolean_case;
 
 fn flag<T: std::str::FromStr>(args: &[String], name: &str, default: T) -> T {
     args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(default)
 }
 
+/// The options `fuzz` takes, and the ones that stand alone.
+const OPTIONS: &[&str] = &["--from", "--count", "--jobs", "--timeout", "--steps", "--out", "--report"];
+const SWITCHES: &[&str] = &["--minimise"];
+
 /// One seed: a design and a boolean case, as JSON on stdout (progress on stderr).
 pub fn one(args: &[String]) -> Result<(), String> {
     let seed: u64 = args.first().and_then(|s| s.parse().ok()).ok_or("fuzz-one <seed> [--steps N] [--minimise]")?;
+    // The seed is the first argument; the rest are options, and an option `fuzz-one` doesn't
+    // take is refused rather than ignored.
+    crate::known_args("fuzz-one", &args[1..], &["--steps"], SWITCHES, false)?;
     let steps = flag(args, "--steps", 8usize);
     let minimise = args.iter().any(|a| a == "--minimise");
     // Panics caught inside the kernel: harmless natively, fatal in the web build.
@@ -33,6 +40,8 @@ pub fn one(args: &[String]) -> Result<(), String> {
         "steps": run.steps.iter().map(|s| s.kind).collect::<Vec<_>>(),
         "unsupported": run.unsupported,
         "rejected": run.rejected,
+        "boolean_fallbacks": run.boolean_fallbacks,
+        "boolean_reports_truncated": run.boolean_reports_truncated,
         "panics": PANICS.swap(0, std::sync::atomic::Ordering::SeqCst),
     });
     if run.outcome.is_bug() {
@@ -43,7 +52,7 @@ pub fn one(args: &[String]) -> Result<(), String> {
             design["minimal"] = json!({"outcome": m.outcome, "steps": m.steps.iter().map(|s| s.kind).collect::<Vec<_>>(), "script": m.script()});
         }
     }
-    let (a, b) = solvecraft_engine::fuzz::boolean_shapes(seed);
+    let (a, b) = solidcraft_engine::fuzz::boolean_shapes(seed);
     eprintln!("boolean {seed} {} {}", serde_json::to_string(&a).unwrap_or_default(), serde_json::to_string(&b).unwrap_or_default());
     let b = boolean_case(seed);
     let bp = PANICS.swap(0, std::sync::atomic::Ordering::SeqCst);
@@ -62,6 +71,9 @@ struct Job {
 /// Run seeds `--from`…`--from + --count` in `--jobs` processes, `--timeout` seconds each;
 /// write failing scripts to `--out` and a summary to `--report`.
 pub fn run(args: &[String]) -> Result<(), String> {
+    // An option `fuzz` doesn't take is refused before a seed runs: it would otherwise be
+    // ignored, and the run would go on for minutes with the wrong settings.
+    crate::known_args("fuzz", args, OPTIONS, SWITCHES, false)?;
     let from = flag(args, "--from", 0u64);
     let count = flag(args, "--count", 100u64);
     let last = from.checked_add(count.saturating_sub(1)).ok_or("seed range exceeds u64::MAX: reduce --from or --count")?;
@@ -179,9 +191,23 @@ fn summarise(results: &[Value], took: Duration) -> String {
     let mut boolean: BTreeMap<String, usize> = BTreeMap::new();
     let mut at_step: BTreeMap<String, usize> = BTreeMap::new();
     let mut unsupported: BTreeMap<String, usize> = BTreeMap::new();
+    let mut fallbacks: BTreeMap<String, [u64; 2]> = BTreeMap::new();
+    let mut truncated = [0usize; 2];
     let mut steps = 0;
     let (mut dp, mut bp) = (0, 0);
     for v in results {
+        for (i, group) in ["design", "boolean"].into_iter().enumerate() {
+            if v[group]["boolean_reports_truncated"].as_bool().unwrap_or(false) {
+                truncated[i] += 1;
+            }
+            if let Some(counts) = v[group]["boolean_fallbacks"].as_object() {
+                for (strategy, count) in counts {
+                    if let Some(total) = fallbacks.entry(strategy.clone()).or_default().get_mut(i) {
+                        *total = total.saturating_add(count.as_u64().unwrap_or(0));
+                    }
+                }
+            }
+        }
         dp += usize::from(v["design"]["panics"].as_u64().unwrap_or(0) > 0);
         bp += usize::from(v["boolean_panics"].as_u64().unwrap_or(0) > 0);
         let k = if v.get("timeout").is_some() {
@@ -220,5 +246,28 @@ fn summarise(results: &[Value], took: Duration) -> String {
     for (k, c) in &boolean {
         s += &format!("- {k}: {}\n", pct(*c));
     }
+    s += "\nSuccessful Boolean retries (events, including nested operations):\n";
+    for (strategy, [designs, checks]) in &fallbacks {
+        s += &format!("- {strategy}: designs {designs}, boolean checks {checks}\n");
+    }
+    s += &format!("- Capped reports: designs {}, boolean checks {}\n", truncated[0], truncated[1]);
     s
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn report_counts_retry_events_separately_and_marks_incomplete_logs() {
+        let results = [
+            json!({"design":{"outcome":{"kind":"ok"},"boolean_fallbacks":{"shifted_operands":2}},"boolean":{"outcome":"ok","boolean_fallbacks":{"shifted_operands":3},"boolean_reports_truncated":true}}),
+            json!({"design":{"outcome":{"kind":"ok"},"boolean_fallbacks":{"shifted_operands":1}},"boolean":{"outcome":"ok"}}),
+            json!({"timeout":90}),
+        ];
+        let text = summarise(&results, Duration::ZERO);
+        assert!(text.contains("shifted_operands: designs 3, boolean checks 3"), "{text}");
+        assert!(text.contains("Capped reports: designs 0, boolean checks 1"), "{text}");
+        assert!(text.contains("timeout: 1 (33.3 %)"), "{text}");
+    }
+}

apps/solidcraft-cli/src/logger.rs

@@ -0,0 +1,49 @@
+//! What the engine logs (`log::info!`, `log::debug!`: why a body has no display plan, why a save
+//! left its model cache out), written to stderr. Off unless asked for, so the CLI's output and
+//! the scripts reading it stay as they are: `--debug` shows SolidCraft's own debug messages (and
+//! other crates' warnings, whose debug output is large), `RUST_LOG=error|warn|info|debug|trace`
+//! sets one level for every crate.
+
+use log::{LevelFilter, Log, Metadata, Record};
+
+struct Stderr {
+    /// The level for SolidCraft's crates.
+    ours: LevelFilter,
+    /// The level for every other crate.
+    others: LevelFilter,
+}
+
+impl Log for Stderr {
+    fn enabled(&self, m: &Metadata) -> bool {
+        m.level() <= if m.target().starts_with("solidcraft") { self.ours } else { self.others }
+    }
+
+    fn log(&self, r: &Record) {
+        if self.enabled(r.metadata()) {
+            use std::io::Write as _;
+            // A closed stderr is no reason to stop.
+            let _ = writeln!(std::io::stderr().lock(), "[{} {}] {}", r.level().as_str().to_ascii_lowercase(), r.target(), r.args());
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+/// Removes `--debug` from `args`, wherever it is (every subcommand takes it), and installs the
+/// logger when it or `RUST_LOG` asks for one.
+pub fn init(args: &mut Vec<String>) {
+    let before = args.len();
+    args.retain(|a| a != "--debug");
+    let debug = args.len() != before;
+    let env = std::env::var("RUST_LOG").ok().and_then(|v| v.trim().parse::<LevelFilter>().ok());
+    let (ours, others) = match (debug, env) {
+        (false, Some(all)) => (all, all),
+        (true, Some(all)) => (all.max(LevelFilter::Debug), all),
+        (true, None) => (LevelFilter::Debug, LevelFilter::Warn),
+        (false, None) => return,
+    };
+    // Installed once, for the life of the process.
+    if log::set_logger(Box::leak(Box::new(Stderr { ours, others }))).is_ok() {
+        log::set_max_level(ours.max(others));
+    }
+}

apps/solidcraft-cli/src/main.rs

@@ -0,0 +1,937 @@
+//! SolidCraft headless command line.
+//!
+//! ```text
+//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
+//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
+//! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
+//! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N]
+//!                                 [--timeout-s 300] [--json out.json] [--markdown out.md]
+//!                                                             the standard Assistant model test (#4851) on a running app
+//! solidcraft-cli snapshot <script|design> [--in design|part.step] --out shot.png [--width W] [--height H] [--view iso|front|top|…|NAME | --camera JSON] [--no-grid] [--no-axes]
+//!                                                             [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]
+//! solidcraft-cli exec <command> [json-params]                 run one command on an empty design
+//! solidcraft-cli commands                                     the command registry as JSON
+//! solidcraft-cli recipe <recipe.json>                         translate an oracle recipe to a script
+//! solidcraft-cli oracle <case-dir>...                         replay recipes and compare with expected.json
+//! solidcraft-cli mcp [--headless] [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
+//!                    [--param-check off|warn|strict]
+//!                                                             MCP server on stdio (docs/mcp.md)
+//! solidcraft-cli mcp setup [--dry-run] [--client NAME] [--live] (alias: mcp install) add it to OpenCode, Claude Desktop, Claude Code, Cursor
+//! solidcraft-cli licences                                     SolidCraft's licence and the third-party licences
+//! solidcraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
+//!
+//! --debug (with any command)                                  SolidCraft's debug log on stderr (or RUST_LOG=LEVEL)
+//! ```
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+mod bench_agent;
+mod bench_assistant;
+mod crashes;
+mod fuzz;
+mod logger;
+mod oracle;
+mod preview;
+mod recipe;
+mod render;
+mod spatial;
+
+use std::process::ExitCode;
+
+use serde_json::{Value, json};
+#[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
+mod app_icon;
+
+use solidcraft_engine::Session;
+use solidcraft_engine::view::Guides;
+
+/// One command the CLI takes: the name to type, the usage it prints for `--help`,
+/// and whether the top-level usage lists it (an alias answers to another command's name).
+struct Command {
+    name: &'static str,
+    usage: &'static str,
+    listed: bool,
+}
+
+/// `run`'s lines in the usage.
+const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
+/// `eval`'s lines in the usage.
+const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--json-out FILE]     (alias: inspect)\n  solidcraft-cli eval --in <script.json|design.solidcraft|part.step> [--json-out FILE]\n      (with both inputs, runs the positional script on --in before measuring; does not automatically save the modified design)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
+/// `script`'s lines in the usage.
+const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
+/// `bench-open`'s lines in the usage.
+const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
+/// `bench-agent`'s lines in the usage.
+const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]\n";
+/// `bench-assistant`'s lines in the usage.
+const USAGE_BENCH_ASSISTANT: &str = "  solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N] [--timeout-s 300] [--json out.json] [--markdown out.md]\n";
+/// `snapshot`'s lines in the usage.
+const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
+/// `render`'s lines in the usage.
+const USAGE_RENDER: &str = "  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]\n      [--progressive] [--samples N] [--max-depth N] [--seed N] [--exposure EV] [--lighting FILE.json] [--environment FILE.json] [--tone-map reinhard|aces_fitted]\n";
+/// `exec`'s lines in the usage.
+const USAGE_EXEC: &str = "  solidcraft-cli exec <command> [json-params]\n";
+/// `commands`'s lines in the usage.
+const USAGE_COMMANDS: &str = "  solidcraft-cli commands\n";
+/// `recipe`'s lines in the usage.
+const USAGE_RECIPE: &str = "  solidcraft-cli recipe <recipe.json>\n";
+/// `oracle`'s lines in the usage.
+const USAGE_ORACLE: &str = "  solidcraft-cli oracle <case-dir>... [--json]\n";
+/// `fuzz`'s lines in the usage.
+const USAGE_FUZZ: &str =
+    "  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]\n";
+/// `mcp`'s lines in the usage.
+const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
+/// `crashes`'s lines in the usage.
+const USAGE_CRASHES: &str = "  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]\n";
+/// `licences`'s lines in the usage.
+const USAGE_LICENCES: &str = "  solidcraft-cli licences\n";
+/// `gpu`'s lines in the usage.
+const USAGE_GPU: &str = "  solidcraft-cli gpu [--policy auto|hardware|software|cpu]\n      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it\n       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults\n       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)\n";
+/// `icon`'s lines in the usage.
+const USAGE_ICON: &str = "  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico\n";
+/// `fuzz-one`'s lines in the usage: a seed and the flags of one fuzz run.
+const USAGE_FUZZ_ONE: &str = "  solidcraft-cli fuzz-one <seed> [--steps N] [--minimise]\n";
+/// `bench-edit`'s lines in the usage: the parameter a script changes.
+const USAGE_BENCH_EDIT: &str = "  solidcraft-cli bench-edit <script.json|recipe.json> <param> <expr>\n";
+/// `save-stress`'s lines in the usage: the file saved over and over.
+const USAGE_SAVE_STRESS: &str = "  solidcraft-cli save-stress <path> <rounds>\n";
+/// The flags every command takes, at the end of the top-level usage.
+const USAGE_DEBUG: &str = "  --debug, with any command: what SolidCraft logs (why a body has no display plan, why a save left its\n      model cache out), on stderr; RUST_LOG=error|warn|info|debug|trace sets one level for every crate\n";
+
+/// The commands the CLI takes, in the order the top-level usage lists them.
+const COMMANDS: &[Command] = &[
+    Command { name: "run", usage: USAGE_RUN, listed: true },
+    Command { name: "eval", usage: USAGE_EVAL, listed: true },
+    Command { name: "inspect", usage: USAGE_EVAL, listed: false },
+    Command { name: "script", usage: USAGE_SCRIPT, listed: true },
+    Command { name: "bench-open", usage: USAGE_BENCH_OPEN, listed: true },
+    Command { name: "bench-agent", usage: USAGE_BENCH_AGENT, listed: true },
+    Command { name: "bench-assistant", usage: USAGE_BENCH_ASSISTANT, listed: true },
+    Command { name: "snapshot", usage: USAGE_SNAPSHOT, listed: true },
+    Command { name: "render", usage: USAGE_RENDER, listed: true },
+    Command { name: "exec", usage: USAGE_EXEC, listed: true },
+    Command { name: "commands", usage: USAGE_COMMANDS, listed: true },
+    Command { name: "recipe", usage: USAGE_RECIPE, listed: true },
+    Command { name: "oracle", usage: USAGE_ORACLE, listed: true },
+    Command { name: "fuzz", usage: USAGE_FUZZ, listed: true },
+    Command { name: "fuzz-one", usage: USAGE_FUZZ_ONE, listed: false },
+    Command { name: "mcp", usage: USAGE_MCP, listed: true },
+    Command { name: "crashes", usage: USAGE_CRASHES, listed: true },
+    Command { name: "licences", usage: USAGE_LICENCES, listed: true },
+    Command { name: "licenses", usage: USAGE_LICENCES, listed: false },
+    Command { name: "gpu", usage: USAGE_GPU, listed: true },
+    Command { name: "icon", usage: USAGE_ICON, listed: true },
+    Command { name: "bench-edit", usage: USAGE_BENCH_EDIT, listed: false },
+    Command { name: "save-stress", usage: USAGE_SAVE_STRESS, listed: false },
+];
+
+fn main() -> ExitCode {
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    logger::init(&mut args);
+    let r = match args.first().map(String::as_str) {
+        // Asked-for help is not an error: the command's usage on stdout, exit 0. It is read
+        // before the command runs, so `--help` never starts a run (a fuzz run, a server).
+        Some(cmd) if wants_help(&args[1..]) && is_command(cmd) => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(command_usage(cmd).as_bytes());
+            Ok(())
+        }
+        Some("run") => cmd_run(&args[1..]),
+        Some("eval" | "inspect") => cmd_eval(&args[1..]),
+        Some("script") => cmd_script(&args[1..]),
+        Some("snapshot") => cmd_snapshot(&args[1..]),
+        Some("render") => render::run(&args[1..]),
+        Some("exec") => cmd_exec(&args[1..]),
+        Some("gpu") => cmd_gpu(&args[1..]),
+        Some("commands") => {
+            use std::io::Write as _;
+            let mut s = Session::default();
+            s.execute("engine.commands", &json!({})).map_err(|e| e.to_string()).and_then(|v| {
+                // A pipeline consumer may stop early (e.g. `commands | head`).
+                // Unlike println!, writing explicitly lets us handle that without a panic.
+                match writeln!(std::io::stdout().lock(), "{}", pretty(&v)) {
+                    Ok(()) => Ok(()),
+                    Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => Ok(()),
+                    Err(e) => Err(format!("stdout: {e}")),
+                }
+            })
+        }
+        Some("recipe") => args.get(1).ok_or_else(usage).and_then(|p| {
+            let v = read_json(p)?;
+            recipe::to_script(&v).map(|s| println!("{}", pretty(&s)))
+        }),
+        Some("oracle") => oracle::run(&args[1..]),
+        Some("fuzz") => fuzz::run(&args[1..]),
+        Some("fuzz-one") => fuzz::one(&args[1..]),
+        Some("mcp") => cmd_mcp(&args[1..]),
+        Some("crashes") => crashes::run(&args[1..]),
+        Some("icon") => cmd_icon(&args[1..]),
+        Some("licences" | "licenses") => {
+            // Written, not print!ed: a closed pipe (`| head`) is not a crash.
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(solidcraft_engine::licences::all().as_bytes());
+            Ok(())
+        }
+        // Hidden, for the kill-mid-save test: save a large design over and over.
+        Some("save-stress") => cmd_save_stress(&args[1..]),
+        // Hidden: time recomputes after parameter edits (docs/perf.md).
+        Some("bench-edit") => cmd_bench_edit(&args[1..]),
+        Some("bench-open") => cmd_bench_open(&args[1..]),
+        // A ~1,300-body design built command by command, as an agent builds one over MCP.
+        Some("bench-agent") => bench_agent::run(&args[1..]),
+        // The standard Assistant model test (#4851), run against a desktop app over its control channel.
+        Some("bench-assistant") => bench_assistant::run(&args[1..]),
+        Some("--version" | "-V") => {
+            println!("solidcraft-cli {}", env!("CARGO_PKG_VERSION"));
+            Ok(())
+        }
+        // Asked-for help is not an error: usage on stdout, exit 0.
+        Some("--help" | "-h" | "help") => {
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(usage().as_bytes());
+            Ok(())
+        }
+        _ => Err(usage()),
+    };
+    match r {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(e) => {
+            eprintln!("error: {e}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn pretty(v: &Value) -> String {
+    serde_json::to_string_pretty(v).unwrap_or_default()
+}
+
+/// The whole usage: every command's lines under one `usage:` line. The lines come from the
+/// same place a command's own `--help` prints, so the two cannot drift apart.
+fn usage() -> String {
+    let mut s = String::from("usage:\n");
+    for c in COMMANDS.iter().filter(|c| c.listed) {
+        s.push_str(c.usage);
+    }
+    s.push_str(USAGE_DEBUG);
+    s
+}
+
+/// A command's own usage: its lines under a `usage:` line.
+fn command_usage(cmd: &str) -> String {
+    match COMMANDS.iter().find(|c| c.name == cmd) {
+        Some(c) => format!("usage:\n{}", c.usage),
+        None => usage(),
+    }
+}
+
+/// Whether the name is a command the CLI takes.
+fn is_command(cmd: &str) -> bool {
+    COMMANDS.iter().any(|c| c.name == cmd)
+}
+
+/// Whether the arguments ask for help.
+fn wants_help(args: &[String]) -> bool {
+    args.iter().any(|a| a == "--help" || a == "-h")
+}
+
+pub fn read_json(path: &str) -> Result<Value, String> {
+    // Through the engine's file access, which refuses anything that is not a regular file and
+    // reads no more than the cap: a character device or a FIFO would otherwise never end.
+    let s = solidcraft_engine::io::vfs::read_to_string(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
+    serde_json::from_str(&s).map_err(|e| format!("{path}: {e}"))
+}
+
+/// A session from a design file, a STEP/3MF/STL file, a command script, or an oracle recipe.
+pub fn load(path: &str) -> Result<Session, String> {
+    load_checked(path, solidcraft_engine::schema::ParamCheck::Off)
+}
+
+/// `load`, with scripts and recipes run at the parameter-check level `check`, which the
+/// session keeps.
+fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Result<Session, String> {
+    let mut s = Session::default();
+    s.param_check = check;
+    if solidcraft_engine::io::is_step_path(path) || solidcraft_engine::io::is_mesh_path(path) {
+        s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
+        return Ok(s);
+    }
+    let bytes = solidcraft_engine::io::vfs::read(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
+    if solidcraft_engine::io::is_design_container(&bytes) {
+        let doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| format!("{path}: {e}"))?;
+        let mut session = Session::opened_at(doc, None, Some(path));
+        session.param_check = check;
+        return Ok(session);
+    }
+    let v: Value = serde_json::from_slice(&bytes).map_err(|e| format!("{path}: {e}"))?;
+    if v.get("format").and_then(Value::as_str).is_some_and(|f| solidcraft_engine::doc::format::version_of(f).is_some()) {
+        s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
+    } else {
+        let script = if v.get("features").is_some() && v.get("commands").is_none() { recipe::to_script(&v)? } else { v };
+        // Warn level: each step's `param_warnings` as it completes, even when a later step fails
+        // (stderr, so stdout stays the caller's).
+        let mut warn = |step: usize, r: &Value| {
+            for w in r.get("param_warnings").and_then(Value::as_array).into_iter().flatten() {
+                eprintln!("{path}: step {}: {}", step + 1, w.as_str().unwrap_or_default());
+            }
+        };
+        s.run_script_each(&script, &mut warn).map_err(|e| e.to_string())?;
+    }
+    Ok(s)
+}
+
+fn flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
+}
+
+fn flags<'a>(args: &'a [String], name: &str) -> Vec<&'a str> {
+    args.windows(2).filter(|w| w[0] == name).map(|w| w[1].as_str()).collect()
+}
+
+/// The first argument that is not an option or an option's value.
+fn positional(args: &[String]) -> Option<&String> {
+    let mut i = 0;
+    while let Some(a) = args.get(i) {
+        if a.starts_with("--") {
+            i += if matches!(a.as_str(), "--quiet" | "--results" | "--timings" | "--profile" | "--allow-errors" | "--no-grid" | "--no-axes") {
+                1
+            } else {
+                2
+            };
+            continue;
+        }
+        return Some(a);
+    }
+    None
+}
+
+/// `--json-out FILE`: where the JSON a command prints goes instead of stdout.
+fn json_out(args: &[String]) -> Result<Option<&str>, String> {
+    if !args.iter().any(|a| a == "--json-out") {
+        return Ok(None);
+    }
+    match flag(args, "--json-out") {
+        Some(file) if !file.starts_with("--") => Ok(Some(file)),
+        _ => Err("--json-out needs a FILE".to_string()),
+    }
+}
+
+/// `v` as indented JSON with a final newline: on stdout, or in `file`. The file is plain UTF-8
+/// with no byte-order mark, whatever the platform's shell does to redirected output (Windows
+/// PowerShell's `>` writes UTF-16, or UTF-8 with a BOM), so strict JSON readers take it.
+fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
+    match file {
+        Some(file) => {
+            let mut text = pretty(v);
+            text.push('\n');
+            std::fs::write(file, text).map_err(|e| format!("{file}: {e}"))
+        }
+        None => {
+            println!("{}", pretty(v));
+            Ok(())
+        }
+    }
+}
+
+fn cmd_run(args: &[String]) -> Result<(), String> {
+    install_renderer();
+    let json_out = json_out(args)?;
+    known_args("run", args, &["--in", "--out", "--save", "--json-out"], &["--quiet", "--results", "--timings", "--profile", "--allow-errors"], true)?;
+    let base = flag(args, "--in");
+    let path = positional(args);
+    if path.is_none() && base.is_none() {
+        return Err(usage());
+    }
+    let want_results = args.iter().any(|a| a == "--results");
+    // `--profile` times each command and splits out its kernel time; it implies `--timings`.
+    let profile = args.iter().any(|a| a == "--profile");
+    let timings = profile || args.iter().any(|a| a == "--timings");
+    let (mut s, results) = if want_results || timings {
+        // Collect every command's result or time (scripts only), then process requested files too.
+        let mut s = match base {
+            Some(b) => load(b)?,
+            None => Session::default(),
+        };
+        let needs = if want_results { "--results needs a script" } else { "--timings needs a script" };
+        let v = read_json(path.ok_or(needs)?)?;
+        let out = if timings {
+            let (r, mut t) = s.run_script_timed(&v, profile).map_err(|e| e.to_string())?;
+            if want_results && let Some(o) = t.as_object_mut() {
+                o.insert("results".into(), Value::Array(r));
+            }
+            t
+        } else {
+            Value::Array(s.run_script(&v).map_err(|e| e.to_string())?)
+        };
+        (s, Some(out))
+    } else {
+        (open(base, path)?, None)
+    };
+    // A feature that fails leaves the bodies as they were before it (a parameter change can
+    // break a feature without failing the command that made it): writing them would hand out
+    // the wrong part with success, so fail the run unless asked to write it anyway.
+    if !args.iter().any(|a| a == "--allow-errors") {
+        timeline_ok(&s)?;
+    }
+    for out in flags(args, "--out") {
+        s.execute("file.export", &json!({"path": out})).map_err(|e| e.to_string())?;
+    }
+    if let Some(p) = flag(args, "--save") {
+        s.execute("file.save_as", &json!({"path": p})).map_err(|e| e.to_string())?;
+    }
+    if let Some(results) = results {
+        print_json(&results, json_out)?;
+    } else if json_out.is_some() || !args.iter().any(|a| a == "--quiet") {
+        // `--quiet` silences stdout; a file that was asked for is still written.
+        let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
+        print_json(&m, json_out)?;
+    }
+    Ok(())
+}
+
+/// The session `run`, `eval` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// positional script run on top of it, or either one alone.
+fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
+    match (base, path) {
+        (Some(b), Some(p)) => {
+            let mut s = load(b)?;
+            s.run_script(&read_json(p)?).map_err(|e| e.to_string())?;
+            Ok(s)
+        }
+        (Some(b), None) => load(b),
+        (None, Some(p)) => load(p),
+        (None, None) => Err(usage()),
+    }
+}
+
+/// Refuses an option `cmd` doesn't take, and one missing its value: a typo, or another
+/// command's option, would otherwise be ignored without a word. `positionals` says whether the
+/// command takes a word of its own (a file, a seed): `fuzz` takes none, and would start a run.
+fn known_args(cmd: &str, args: &[String], valued: &[&str], switches: &[&str], positionals: bool) -> Result<(), String> {
+    let mut i = 0;
+    while let Some(a) = args.get(i) {
+        if valued.contains(&a.as_str()) {
+            match args.get(i + 1) {
+                Some(v) if !v.starts_with("--") => i += 2,
+                _ => return Err(format!("{cmd}: {a} needs a value")),
+            }
+        } else if switches.contains(&a.as_str()) {
+            i += 1;
+        } else if a.starts_with("--") || !positionals {
+            return Err(format!("{cmd} doesn't take {a} (it takes {})", [valued, switches].concat().join(", ")));
+        } else {
+            i += 1;
+        }
+    }
+    Ok(())
+}
+
+/// Every failing timeline feature, one per line, as an error; Ok when none fails.
+fn timeline_ok(s: &Session) -> Result<(), String> {
+    let failed: Vec<String> = s.model.results.iter().filter_map(|r| r.error.as_ref().map(|e| format!("  {}: {e}", r.name))).collect();
+    if failed.is_empty() {
+        return Ok(());
+    }
+    Err(format!(
+        "{} timeline feature(s) failed, so nothing was written (--allow-errors writes the bodies anyway):\n{}",
+        failed.len(),
+        failed.join("\n")
+    ))
+}
+
+fn cmd_eval(args: &[String]) -> Result<(), String> {
+    let json_out = json_out(args)?;
+    known_args("eval", args, &["--in", "--json-out"], &[], true)?;
+    let mut s = open(flag(args, "--in"), positional(args))?;
+    let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
+    let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
+    let out = json!({
+        "body_count": m["body_count"],
+        "bodies": m["bodies"],
+        "total": m["total"],
+        "timeline": d["timeline"],
+        "params": d["params"],
+        "sketches": d["sketches"],
+    });
+    print_json(&out, json_out)
+}
+
+/// A design's history as a command script (`timeline.export_script`): printed, or written to
+/// `--out`; what the script leaves out goes to stderr.
+fn cmd_script(args: &[String]) -> Result<(), String> {
+    let path = positional(args).ok_or_else(usage)?;
+    let s = &mut load(path)?;
+    let out = flag(args, "--out");
+    let r = s.execute("timeline.export_script", &json!({"path": out})).map_err(|e| e.to_string())?;
+    for what in r["omitted"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        eprintln!("note: the script leaves out {what}");
+    }
+    match out {
+        Some(out) => eprintln!("{out}: {} steps", r["steps"]),
+        None => println!("{}", pretty(&r["script"])),
+    }
+    Ok(())
+}
+
+/// `gpu`: the headless adapter survey and the policy's pick.
+fn cmd_gpu(args: &[String]) -> Result<(), String> {
+    use solidcraft_gpu::select::{Policy, survey};
+    let policy = match args {
+        [] => Policy::from_env()?,
+        [flag, v] if flag == "--policy" => Policy::parse(v).ok_or_else(|| format!("--policy must be auto, hardware, software or cpu, not `{v}`"))?,
+        _ => return Err("usage: solidcraft-cli gpu [--policy auto|hardware|software|cpu]".into()),
+    };
+    let s = survey(policy);
+    let chosen = s.chosen.and_then(|i| s.adapters.get(i)).cloned();
+    // The tier pictures land on: a hardware GPU, a software adapter, or the CPU rasterizer.
+    let renderer = s.lands_on.map(|l| l.renderer());
+    println!(
+        "{}",
+        pretty(&json!({
+            "policy": policy.name(),
+            "backends": s.backends,
+            "adapters": s.adapters,
+            "chosen": chosen,
+            "lands_on": s.lands_on,
+            "renderer": renderer,
+        }))
+    );
+    match s.lands_on {
+        Some(solidcraft_gpu::select::Landing::Cpu) => {
+            eprintln!("warning: {}", solidcraft_engine::capture::CPU_WARNING);
+            Ok(())
+        }
+        Some(_) => Ok(()),
+        None => Err(format!("no adapter qualifies under the {} policy", policy.name())),
+    }
+}
+
+/// Draw this process's pictures (snapshots, MCP screenshots, saved thumbnails) on the GPU with the
+/// viewport's pipelines: the headless device the `SOLIDCRAFT_GPU` policy picks, opened on the first
+/// picture; under `auto` with no qualifying adapter (or `cpu`), the CPU rasterizer, and the
+/// picture says so. Under `hardware` or `software` with no such adapter a picture fails with an
+/// error that names the policy.
+fn install_renderer() {
+    solidcraft_engine::capture::install(std::sync::Arc::new(|scene, cam, w, h| {
+        let (rgba, renderer) = solidcraft_gpu::capture::headless_rgba(scene, cam, w, h)?;
+        Ok(solidcraft_engine::capture::Picture { rgba, renderer })
+    }));
+}
+
+fn cmd_snapshot(args: &[String]) -> Result<(), String> {
+    install_renderer();
+    known_args(
+        "snapshot",
+        args,
+        &["--in", "--out", "--width", "--height", "--view", "--camera", "--body", "--tool", "--section"],
+        &["--no-grid", "--no-axes"],
+        true,
+    )?;
+    if positional(args).is_none() && flag(args, "--in").is_none() {
+        return Err(usage());
+    }
+    let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
+    let size = |name: &str, default: u32| match flag(args, name) {
+        None => Ok(default),
+        Some(x) => x.parse().ok().filter(|n| (16..=8192).contains(n)).ok_or_else(|| format!("{name} must be 16 to 8192 pixels, not `{x}`")),
+    };
+    let (w, h) = (size("--width", 1280)?, size("--height", 800)?);
+    let mut s = open(flag(args, "--in"), positional(args))?;
+    // How the bodies are drawn and where the model is cut, through the commands the app's
+    // Appearance dialog and Section Analysis run (`preview`).
+    preview::apply(&mut s, &flags(args, "--body"), &flags(args, "--tool"), flag(args, "--section"))?;
+    // The camera choices of the MCP `screenshot`, through the same command (`view.apply`): a
+    // standard view, a view saved in the design, or an explicit camera. A script that applies a
+    // view itself sets the camera too; without any, the iso view framing the model.
+    match (flag(args, "--view"), flag(args, "--camera")) {
+        (Some(_), Some(_)) => return Err("snapshot: give --view or --camera, not both".into()),
+        (Some(v), None) => {
+            let hint = "standard views: iso, front, back, top, bottom, left, right";
+            s.execute("view.apply", &json!({"view": v})).map_err(|e| format!("--view {v}: {e} ({hint}; or a view saved with view.save)"))?;
+        }
+        (None, Some(c)) => {
+            let camera: Value = serde_json::from_str(c).map_err(|e| format!("--camera: not JSON: {e}"))?;
+            s.execute("view.apply", &json!({"camera": camera})).map_err(|e| format!("--camera: {e}"))?;
+        }
+        (None, None) => {}
+    }
+    let cam = s.camera.unwrap_or_else(|| solidcraft_engine::view::home_camera(&s));
+    let guides = Guides { grid: !args.iter().any(|a| a == "--no-grid"), axes: !args.iter().any(|a| a == "--no-axes") };
+    let scene = solidcraft_engine::view::scene_with_guides(&s, &cam, s.section, guides);
+    let png = solidcraft_engine::capture::png(&scene, &cam, w, h)?;
+    std::fs::write(out, &png.bytes).map_err(|e| format!("{out}: {e}"))?;
+    let mut reply = json!({"path": out, "width": w, "height": h, "bytes": png.bytes.len(), "renderer": png.renderer});
+    if let Some(w) = solidcraft_engine::capture::warning(png.renderer) {
+        eprintln!("warning: {w}");
+        reply["warning"] = json!(w);
+    }
+    println!("{}", pretty(&reply));
+    Ok(())
+}
+
+/// The app icon: the SolidCraft logo, drawn in code on a transparent background
+/// (so packages need no committed image). `.ico` holds the Windows sizes as PNGs.
+fn cmd_icon(args: &[String]) -> Result<(), String> {
+    let out = flag(args, "--out").ok_or("icon needs --out FILE.png or FILE.ico")?;
+    let size: usize = flag(args, "--size").and_then(|x| x.parse().ok()).unwrap_or(256).clamp(8, 2048);
+    let bytes = if out.to_ascii_lowercase().ends_with(".ico") {
+        let pngs: Vec<(usize, Vec<u8>)> =
+            [16, 20, 24, 32, 40, 48, 64, 128, 256].into_iter().map(|s| icon_png(s).map(|p| (s, p))).collect::<Result<_, _>>()?;
+        ico(&pngs)?
+    } else {
+        icon_png(size)?
+    };
+    std::fs::write(out, &bytes).map_err(|e| format!("{out}: {e}"))?;
+    println!("{}", pretty(&json!({"path": out, "bytes": bytes.len()})));
+    Ok(())
+}
+
+fn icon_png(size: usize) -> Result<Vec<u8>, String> {
+    solidcraft_engine::render::png(size, size, app_icon::rgba(size)?).ok_or_else(|| "icon: PNG encoding failed".to_string())
+}
+
+/// A Windows icon file holding PNG images (Vista and later read these).
+fn ico(images: &[(usize, Vec<u8>)]) -> Result<Vec<u8>, String> {
+    let n = u16::try_from(images.len()).map_err(|_| "too many icon sizes")?;
+    let mut out = Vec::new();
+    out.extend_from_slice(&[0, 0, 1, 0]);
+    out.extend_from_slice(&n.to_le_bytes());
+    let mut offset = 6 + 16 * images.len();
+    for (size, data) in images {
+        let dim = if *size >= 256 { 0 } else { *size as u8 };
+        out.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
+        out.extend_from_slice(&u32::try_from(data.len()).map_err(|_| "icon too large")?.to_le_bytes());
+        out.extend_from_slice(&u32::try_from(offset).map_err(|_| "icon too large")?.to_le_bytes());
+        offset += data.len();
+    }
+    for (_, data) in images {
+        out.extend_from_slice(data);
+    }
+    Ok(out)
+}
+
+fn cmd_exec(args: &[String]) -> Result<(), String> {
+    install_renderer();
+    let id = args.first().ok_or_else(usage)?;
+    let p: Value = match args.get(1) {
+        Some(t) => serde_json::from_str(t).map_err(|e| format!("params: {e}"))?,
+        None => json!({}),
+    };
+    let mut s = Session::default();
+    let v = s.execute(id, &p).map_err(|e| e.to_string())?;
+    println!("{}", pretty(&v));
+    Ok(())
+}
+
+/// `mcp setup`: add the server to each installed AI client, with this program's own path.
+fn cmd_mcp_setup(args: &[String]) -> Result<(), String> {
+    use solidcraft_engine::agent_setup as setup;
+    let (lines, ok) = setup::setup(args, &setup::Env::from_process(), &setup::current_exe()?)?;
+    for l in lines {
+        println!("{l}");
+    }
+    if ok { Ok(()) } else { Err("mcp setup: some clients could not be configured".into()) }
+}
+
+/// MCP server on stdio: headless (optionally starting from a design or script) or bridged to
+/// a running app's control port. stdout carries only protocol messages. Files the agent's tool
+/// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
+fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    if matches!(args.first().map(String::as_str), Some("setup" | "install")) {
+        return cmd_mcp_setup(&args[1..]);
+    }
+    let render_gpu = args.iter().any(|arg| arg == "--render-gpu");
+    if render_gpu && flag(args, "--connect").is_some() {
+        return Err("mcp: --render-gpu installs a headless image host; a connected application owns its own device".into());
+    }
+    install_renderer();
+    let scope = (!args.iter().any(|a| a == "--allow-any-path"))
+        .then(|| solidcraft_mcp::agent_scope(flags(args, "--allow-path").into_iter().map(std::path::PathBuf::from)));
+    if let Some(s) = &scope {
+        let roots: Vec<String> = s.roots().iter().map(|r| r.display().to_string()).collect();
+        eprintln!(
+            "solidcraft mcp: files limited to {} and the open design's folder (--allow-path DIR adds one, --allow-any-path lifts the limit)",
+            roots.join(", ")
+        );
+        let design_dir = flag(args, "--in")
+            .and_then(|p| std::path::Path::new(p).parent())
+            .map(|d| if d.as_os_str().is_empty() { std::path::Path::new(".") } else { d });
+        if let Some(why) = design_dir.and_then(solidcraft_engine::io::vfs::design_folder_refusal) {
+            eprintln!("solidcraft mcp: the design's folder is left out because {why}; add it with --allow-path if you mean it");
+        }
+    }
+    // How a headless session treats calls that break a command's parameter contract (docs/mcp.md).
+    let param_check = match flag(args, "--param-check") {
+        None if args.iter().any(|a| a == "--param-check") => return Err("mcp: --param-check wants off, warn or strict".into()),
+        None => solidcraft_engine::schema::ParamCheck::Off,
+        Some(v) => {
+            solidcraft_engine::schema::ParamCheck::parse(v).ok_or_else(|| format!("mcp: --param-check wants off, warn or strict, not `{v}`"))?
+        }
+    };
+    if param_check != solidcraft_engine::schema::ParamCheck::Off && flag(args, "--connect").is_some() {
+        eprintln!("solidcraft mcp: --param-check applies to headless sessions; calls to the app are not checked yet");
+    }
+    let backend: Box<dyn solidcraft_mcp::Backend> = match (flag(args, "--connect"), flag(args, "--in")) {
+        (Some(_), Some(_)) => return Err("mcp: use either --connect or --in, not both".into()),
+        (Some(addr), None) => {
+            let Some(port) = addr.rsplit_once(':').and_then(|(_, p)| p.parse::<u16>().ok()).filter(|p| *p != 0) else {
+                return Err(format!("mcp: --connect wants HOST:PORT, such as 127.0.0.1:7878, not `{addr}`"));
+            };
+            // Serve without the app too: the tools connect once it runs, and say it isn't until then.
+            let mut remote = solidcraft_mcp::Remote::new(addr, flag(args, "--token"));
+            if let Err(e) = remote.try_connect() {
+                eprintln!(
+                    "solidcraft mcp: no SolidCraft app at {addr} yet ({e}); start it with `solidcraft --control {port}` \
+                     (or SOLIDCRAFT_CONTROL_PORT={port}), tool calls connect once it runs"
+                );
+            }
+            Box::new(remote)
+        }
+        (None, Some(path)) => {
+            let mut headless = solidcraft_mcp::Headless::new(load_checked(path, param_check)?);
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
+            Box::new(headless)
+        }
+        (None, None) => {
+            let auto = !args.iter().any(|a| a == "--headless");
+            if auto && let Some(port) = discover_app() {
+                eprintln!("solidcraft mcp: bridged to the running app at 127.0.0.1:{port} (--headless starts a session of its own)");
+                return serve_mcp(Box::new(solidcraft_mcp::Remote::new(&format!("127.0.0.1:{port}"), flag(args, "--token"))), scope);
+            }
+            let mut headless = solidcraft_mcp::Headless::default();
+            headless.session.param_check = param_check;
+            if render_gpu {
+                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+            }
+            if auto {
+                // The app may start after the agent: look for it again until there is work here.
+                Box::new(solidcraft_mcp::Auto::new(headless, Box::new(discover_app), flag(args, "--token")))
+            } else {
+                Box::new(headless)
+            }
+        }
+    };
+    serve_mcp(backend, scope)
+}
+
+fn serve_mcp(backend: Box<dyn solidcraft_mcp::Backend>, scope: Option<solidcraft_engine::io::vfs::PathScope>) -> Result<(), String> {
+    let stdin = std::io::stdin();
+    let stdout = std::io::stdout();
+    solidcraft_mcp::Server::new(backend).with_path_scope(scope).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
+}
+
+/// The port of the running desktop app: the one its discovery file names, if something listens
+/// there (a file left by an app that crashed names a closed port).
+fn discover_app() -> Option<u16> {
+    let port = solidcraft_engine::control_auth::read_current_port()?;
+    let addr = std::net::SocketAddr::from(([127, 0, 0, 1], port));
+    std::net::TcpStream::connect_timeout(&addr, std::time::Duration::from_millis(500)).ok().map(|_| port)
+}
+
+/// `save-stress <path> <rounds>`: save a design of a few hundred kilobytes `rounds` times, its
+/// parameter `save_round` set to the round number each time.
+fn cmd_save_stress(args: &[String]) -> Result<(), String> {
+    let (Some(path), Some(rounds)) = (args.first(), args.get(1).and_then(|n| n.parse::<u64>().ok())) else {
+        return Err("usage: solidcraft-cli save-stress <path> <rounds>".into());
+    };
+    let mut s = Session::default();
+    let filler = (0..3000).map(|i| solidcraft_engine::doc::Param {
+        name: format!("p{i}"),
+        expr: format!("{i} mm + 0.5 mm"),
+        unit: "mm".into(),
+        comment: "filler to make the file large".into(),
+        model: false,
+    });
+    s.doc_mut().params.extend(filler);
+    for r in 0..rounds {
+        s.doc_mut().set_param("save_round", &r.to_string(), None, None).map_err(|e| e.to_string())?;
+        s.execute("file.save", &json!({ "path": path })).map_err(|e| e.to_string())?;
+    }
+    Ok(())
+}
+
+/// `bench-edit <script.json|recipe.json> <param> <expr>`: build the design, then time a
+/// parameter edit, setting it back, undo and redo (ms and features recomputed each).
+fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
+    let (Some(path), Some(param), Some(expr)) = (args.first(), args.get(1), args.get(2)) else {
+        return Err("usage: solidcraft-cli bench-edit <script.json|recipe.json> <param> <expr>".into());
+    };
+    let v = read_json(path)?;
+    let script = if v.get("features").is_some() { recipe::to_script(&v)? } else { v };
+    let mut s = Session::default();
+    let t = std::time::Instant::now();
+    s.run_script(&script).map_err(|e| e.to_string())?;
+    let build = t.elapsed().as_secs_f64() * 1000.0;
+    let old = s.doc.all_param_exprs().into_iter().find(|(n, _, _)| n == param).map(|(_, e, _)| e).ok_or(format!("no parameter `{param}`"))?;
+    let mut out = vec![json!({"step": "build", "ms": build, "features": s.doc.features.len()})];
+    let mut time = |s: &mut Session, step: &str, id: &str, p: Value| -> Result<(), String> {
+        let t = std::time::Instant::now();
+        let r = s.execute(id, &p).map_err(|e| format!("{step}: {e}"))?;
+        let n = r.get("recomputed").cloned().unwrap_or_else(|| json!(s.model.last_recomputed));
+        out.push(json!({"step": step, "ms": t.elapsed().as_secs_f64() * 1000.0, "recomputed": n}));
+        Ok(())
+    };
+    let expr = expr.replace("{old}", &old);
+    time(&mut s, "edit", "parameters.change", json!({"name": param, "expression": expr}))?;
+    time(&mut s, "set back", "parameters.change", json!({"name": param, "expression": old}))?;
+    time(&mut s, "undo", "edit.undo", json!({}))?;
+    time(&mut s, "redo", "edit.redo", json!({}))?;
+    println!("{}", pretty(&json!(out)));
+    Ok(())
+}
+
+/// `bench-open --ops`: each command of `script` (a JSON array of `{command, params}`), then its
+/// undo, each timed as the command and the view it leaves (the placed model, its meshes warmed
+/// as the desktop does after a change).
+fn bench_ops(mut s: Session, script: &str) -> Result<Session, String> {
+    let text = std::fs::read_to_string(script).map_err(|e| format!("{script}: {e}"))?;
+    let ops: Value = serde_json::from_str(&text).map_err(|e| format!("{script}: {e}"))?;
+    let ops = ops.as_array().ok_or("--ops: a JSON array of {command, params}")?;
+    let time = |s: &mut Session, id: &str, p: &Value| -> Result<Value, String> {
+        let t = std::time::Instant::now();
+        let r = s.execute(id, p).map_err(|e| format!("{id}: {e}"))?;
+        let ms = t.elapsed().as_secs_f64() * 1000.0;
+        let t = std::time::Instant::now();
+        s.world_state().warm_meshes(|| true);
+        let view_ms = t.elapsed().as_secs_f64() * 1000.0;
+        println!("{}", json!({"step": "op", "command": id, "ms": ms, "view_ms": view_ms}));
+        Ok(r)
+    };
+    for op in ops {
+        let id = op.get("command").and_then(Value::as_str).ok_or("--ops: each step needs a `command`")?;
+        let p = op.get("params").cloned().unwrap_or(Value::Null);
+        let steps = s.undo.len();
+        time(&mut s, id, &p)?;
+        // Commands that are no undo step (showing and hiding) have nothing to undo.
+        if op.get("undo").and_then(Value::as_bool) != Some(false) && s.undo.len() > steps {
+            time(&mut s, "edit.undo", &json!({}))?;
+        }
+    }
+    Ok(s)
+}
+
+/// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
+pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
+    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
+    let t = std::time::Instant::now();
+    let step = solidcraft_engine::io::is_step_path(path);
+    let limit = if step { solidcraft_engine::io::MAX_STEP_BYTES } else { solidcraft_engine::io::MAX_DESIGN_BYTES };
+    let bytes = solidcraft_engine::io::vfs::read(path, limit).map_err(|e| format!("{path}: {e}"))?;
+    let read_ms = t.elapsed().as_secs_f64() * 1000.0;
+    println!("{}", json!({"step": "read", "ms": read_ms, "bytes": bytes.len()}));
+    let t = std::time::Instant::now();
+    // The file as read, held until the timeline has evaluated it (as the import command does).
+    let mut read = None;
+    let (doc, saved) = if step {
+        let imported = solidcraft_engine::io::step_import_feature(&bytes, path).map_err(|e| e.to_string())?;
+        let mut doc = solidcraft_engine::doc::Document::new(&imported.name);
+        doc.add_feature(imported.kind, Some(&imported.name)).map_err(|e| e.to_string())?;
+        read = Some(imported.import);
+        (doc, None)
+    } else {
+        // As Open reads it: with the model the file keeps.
+        solidcraft_engine::io::read_design_file(path, None::<fn(solidcraft_engine::io::DesignPreview)>).map_err(|e| e.to_string())?
+    };
+    let parse_ms = t.elapsed().as_secs_f64() * 1000.0;
+    println!("{}", json!({"step": "parse", "ms": parse_ms, "features": doc.features.len(), "saved_model": saved.is_some()}));
+    if args.iter().any(|a| a == "--parse-only") {
+        return Ok(());
+    }
+    let t = std::time::Instant::now();
+    let s = Session::opened_at(doc, saved.as_ref(), (!step).then_some(path.as_str()));
+    drop(read);
+    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway), or
+    // only the features whose state a thinned file left out.
+    let adopted = saved.is_some() && s.model.last_recomputed == 0;
+    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0, "adopted": adopted, "recomputed": s.model.last_recomputed}));
+    for r in &s.model.results {
+        println!("{}", json!({"step": "feature", "id": r.id, "name": r.name, "ms": r.ms, "error": r.error}));
+    }
+    let t = std::time::Instant::now();
+    let st = s.world_state();
+    let place_ms = t.elapsed().as_secs_f64() * 1000.0;
+    // As the desktop app prepares a design it opened.
+    st.warm_meshes(|| true);
+    let triangles: usize = st.bodies.iter().map(|b| b.mesh().triangles.len()).sum();
+    println!(
+        "{}",
+        json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "place_ms": place_ms, "bodies": st.bodies.len(), "triangles": triangles})
+    );
+    let flag = |name: &str| args.iter().position(|a| a == name);
+    // `--save PATH`: save the opened design without its model cache (to PATH.plain.solidcraft) and
+    // as the app does, with it, then read the cache back.
+    let s = match flag("--save").and_then(|i| args.get(i + 1)) {
+        Some(out) => {
+            let mut s = s;
+            // Without the cache first, for comparison.
+            let plain = format!("{out}.plain.solidcraft");
+            let t = std::time::Instant::now();
+            s.execute("file.save_as", &json!({"path": plain, "cache": false})).map_err(|e| e.to_string())?;
+            let plain_ms = t.elapsed().as_secs_f64() * 1000.0;
+            let plain_bytes = std::fs::metadata(&plain).map(|m| m.len()).unwrap_or(0);
+            let t = std::time::Instant::now();
+            s.execute("file.save_as", &json!({"path": out})).map_err(|e| e.to_string())?;
+            let save_ms = t.elapsed().as_secs_f64() * 1000.0;
+            let bytes = std::fs::read(out).map_err(|e| format!("{out}: {e}"))?;
+            let t = std::time::Instant::now();
+            let cached = solidcraft_engine::io::read_design_geometry(&bytes).map(|m| m.bodies.len());
+            let read_ms = t.elapsed().as_secs_f64() * 1000.0;
+            // Why bodies could not be kept exactly, when the cache was left out.
+            let mut refused = std::collections::BTreeMap::<String, usize>::new();
+            if cached.is_none() {
+                for b in &s.model.state().bodies {
+                    if let Err(e) = solidcraft_engine::kernel::encode_native_body(&b.body) {
+                        *refused.entry(e.to_string()).or_default() += 1;
+                    }
+                }
+            }
+            println!(
+                "{}",
+                json!({"step": "save", "ms": save_ms, "bytes": bytes.len(), "plain_ms": plain_ms, "plain_bytes": plain_bytes, "cached_bodies": cached, "cache_read_ms": read_ms, "refused": refused})
+            );
+            s
+        }
+        None => s,
+    };
+    // `--display LEVEL`: the display plans the viewport draws at that display quality, made as
+    // the GPU viewport makes them; `--edit NAME EXPR` then changes a parameter and times the
+    // evaluation and the plans of the bodies it changed.
+    let s = match flag("--ops").and_then(|i| args.get(i + 1)) {
+        Some(ops) => bench_ops(s, ops)?,
+        None => s,
+    };
+    let Some(level) = flag("--display").and_then(|i| args.get(i + 1)) else { return Ok(()) };
+    let q = solidcraft_engine::doc::display_quality::DisplayQuality::parse(level).ok_or("--display: coarse, normal, fine or ultra")?;
+    let plans = |st: &solidcraft_engine::doc::ModelState| {
+        let t = std::time::Instant::now();
+        solidcraft_engine::kernel::for_each_on_threads(&st.bodies, 16, |b| {
+            let _ = b.plan_mesh_at(q);
+        });
+        let triangles: usize = st.bodies.iter().filter_map(|b| b.plan_mesh_at(q)).map(|m| m.triangles.len()).sum();
+        (t.elapsed().as_secs_f64() * 1000.0, triangles)
+    };
+    let (ms, triangles) = plans(&st);
+    println!("{}", json!({"step": "display", "quality": q.id(), "ms": ms, "triangles": triangles}));
+    if let Some(i) = flag("--edit") {
+        let (Some(name), Some(expr)) = (args.get(i + 1), args.get(i + 2)) else { return Err("--edit NAME EXPR".into()) };
+        let mut s = s;
+        let t = std::time::Instant::now();
+        s.execute("parameters.change", &json!({"name": name, "expression": expr})).map_err(|e| e.to_string())?;
+        let eval_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let st = s.world_state();
+        let t = std::time::Instant::now();
+        st.warm_meshes(|| true);
+        let mesh_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let (ms, triangles) = plans(&st);
+        println!(
+            "{}",
+            json!({"step": "edit", "quality": q.id(), "evaluate_ms": eval_ms, "mesh_ms": mesh_ms, "display_ms": ms, "triangles": triangles})
+        );
+    }
+    Ok(())
+}

apps/solidcraft-cli/src/oracle.rs

@@ -0,0 +1,263 @@
+//! Reference tests: replay `tests/oracle/<case>/recipe.json` through the command engine and
+//! compare the part with `expected.json` (closed-form values, or values from an independent
+//! kernel; see tests/oracle/README.md), and with `reference.stl` where one exists.
+
+#![allow(clippy::needless_range_loop)]
+
+use serde_json::{Value, json};
+use solidcraft_engine::geom::Vec3;
+
+use crate::spatial::{self, Tri};
+use crate::{read_json, recipe};
+
+/// Default relative tolerance for volume and area (our curved-face tessellation is within ~2e-4).
+pub const REL_TOL: f64 = 1e-3;
+/// Default tolerance for centre of mass and bounding box, as a fraction of the bbox diagonal.
+const ABS_FRAC: f64 = 1e-3;
+/// Chord tolerance used to triangulate our part for the surface-distance check (mm).
+const MESH_TOL: f64 = 0.01;
+/// Relative tolerance on the principal second moments of the two triangulations.
+const INERTIA_REL: f64 = 2e-3;
+
+/// What SolidCraft built: totals over every body.
+struct Got {
+    body_count: usize,
+    volume: f64,
+    area: f64,
+    com: [f64; 3],
+    bbox: ([f64; 3], [f64; 3]),
+    faces: u64,
+}
+
+fn v3(v: &Value) -> Option<[f64; 3]> {
+    let a = v.as_array()?;
+    Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?, a.get(2)?.as_f64()?])
+}
+
+fn totals(m: &Value) -> Got {
+    let bodies = m["bodies"].as_array().cloned().unwrap_or_default();
+    let (mut volume, mut area, mut faces) = (0.0, 0.0, 0);
+    let mut moment = [0.0; 3];
+    let mut lo = [f64::INFINITY; 3];
+    let mut hi = [f64::NEG_INFINITY; 3];
+    for b in &bodies {
+        let v = b["volume_mm3"].as_f64().unwrap_or(f64::NAN);
+        volume += v;
+        area += b["area_mm2"].as_f64().unwrap_or(f64::NAN);
+        faces += b["faces"].as_u64().unwrap_or(0);
+        let c = v3(&b["center_of_mass"]).unwrap_or([f64::NAN; 3]);
+        let (bl, bh) = (v3(&b["bbox"]["min"]).unwrap_or([f64::NAN; 3]), v3(&b["bbox"]["max"]).unwrap_or([f64::NAN; 3]));
+        for k in 0..3 {
+            moment[k] += v * c[k];
+            lo[k] = lo[k].min(bl[k]);
+            hi[k] = hi[k].max(bh[k]);
+        }
+    }
+    let com = moment.map(|x| x / volume);
+    Got { body_count: bodies.len(), volume, area, com, bbox: (lo, hi), faces }
+}
+
+struct Checks {
+    list: Vec<Value>,
+    pass: bool,
+}
+
+impl Checks {
+    fn push(&mut self, what: &str, got: Value, want: Value, ok: bool) {
+        self.pass &= ok;
+        self.list.push(json!({"check": what, "got": got, "want": want, "ok": ok}));
+    }
+    fn rel(&mut self, what: &str, g: f64, w: Option<f64>, rel: f64) {
+        let ok = w.is_some_and(|w| g.is_finite() && (g - w).abs() <= rel * w.abs().max(1.0));
+        self.push(what, json!(g), json!(w), ok);
+    }
+    fn vec(&mut self, what: &str, g: [f64; 3], w: Option<[f64; 3]>, tol: f64) {
+        let ok = w.is_some_and(|w| g.iter().zip(w).all(|(g, w)| g.is_finite() && (g - w).abs() <= tol));
+        self.push(what, json!(g), json!(w), ok);
+    }
+}
+
+fn check_case(dir: &str) -> Value {
+    let name = std::path::Path::new(dir).file_name().map(|x| x.to_string_lossy().to_string()).unwrap_or_default();
+    let recipe = match read_json(&format!("{dir}/recipe.json")) {
+        Ok(r) => r,
+        Err(e) => return json!({"case": name, "pass": false, "error": e}),
+    };
+    let want = read_json(&format!("{dir}/expected.json")).ok();
+    let script = match recipe::to_script(&recipe) {
+        Ok(s) => s,
+        Err(e) => return json!({"case": name, "pass": false, "skipped": true, "error": e}),
+    };
+    let mut s = solidcraft_engine::Session::default();
+    if let Err(e) = s.run_script(&script) {
+        return json!({"case": name, "pass": false, "error": e.to_string(), "source": want.as_ref().map(|w| w["source"].clone())});
+    }
+    let got = match s.execute("inspect.measure", &json!({})) {
+        Ok(m) => totals(&m),
+        Err(e) => return json!({"case": name, "pass": false, "error": e.to_string()}),
+    };
+    let got_json = json!({
+        "body_count": got.body_count, "volume_mm3": got.volume, "area_mm2": got.area,
+        "center_of_mass": got.com, "bbox": {"min": got.bbox.0, "max": got.bbox.1}, "faces": got.faces,
+    });
+    let Some(want) = want else {
+        return json!({"case": name, "pass": false, "skipped": true, "error": "no expected.json yet", "got": got_json});
+    };
+    let only: Option<Vec<String>> = want["compare"].as_array().map(|a| a.iter().filter_map(|x| x.as_str().map(str::to_string)).collect());
+    let wanted = |k: &str| want.get(k).is_some_and(|v| !v.is_null()) && only.as_ref().is_none_or(|o| o.iter().any(|x| x == k));
+    let rel = want["tolerance"]["rel"].as_f64().unwrap_or(REL_TOL);
+    let diag = |b: ([f64; 3], [f64; 3])| ((b.1[0] - b.0[0]).powi(2) + (b.1[1] - b.0[1]).powi(2) + (b.1[2] - b.0[2]).powi(2)).sqrt();
+    let want_bbox = v3(&want["bbox"]["min"]).zip(v3(&want["bbox"]["max"]));
+    let abs = want["tolerance"]["abs_mm"].as_f64().unwrap_or_else(|| ABS_FRAC * want_bbox.map(diag).unwrap_or_else(|| diag(got.bbox)).max(1.0));
+    let mut c = Checks { list: Vec::new(), pass: true };
+    if wanted("body_count") {
+        let ok = want["body_count"].as_u64() == Some(got.body_count as u64);
+        c.push("body_count", json!(got.body_count), want["body_count"].clone(), ok);
+    }
+    if wanted("volume_mm3") {
+        c.rel("volume_mm3", got.volume, want["volume_mm3"].as_f64(), rel);
+    }
+    if wanted("area_mm2") {
+        c.rel("area_mm2", got.area, want["area_mm2"].as_f64(), rel);
+    }
+    if wanted("center_of_mass") {
+        c.vec("center_of_mass", got.com, v3(&want["center_of_mass"]), abs);
+    }
+    if wanted("bbox") {
+        c.vec("bbox.min", got.bbox.0, want_bbox.map(|b| b.0), abs);
+        c.vec("bbox.max", got.bbox.1, want_bbox.map(|b| b.1), abs);
+    }
+    if wanted("faces") {
+        let ok = want["faces"].as_u64() == Some(got.faces);
+        c.push("faces", json!(got.faces), want["faces"].clone(), ok);
+    }
+    let stl = format!("{dir}/reference.stl");
+    if std::path::Path::new(&stl).is_file() && only.as_ref().is_none_or(|o| o.iter().any(|x| x == "surface")) {
+        let tol = want["tolerance"]["surface_mm"].as_f64().unwrap_or(0.05);
+        reference_checks(&s, &stl, tol, &mut c);
+    }
+    // Our STEP export of the rebuilt part: well formed, and read back with no warnings and the
+    // same volume.
+    let (ok, note) = step_export_check(&s, got.volume);
+    c.push("step_export", json!(note), json!("valid, re-imports cleanly"), ok);
+    let mut out = json!({"case": name, "pass": c.pass, "source": want["source"], "checks": c.list, "got": got_json});
+    if let Some(n) = want["note"].as_str() {
+        out["note"] = json!(n);
+    }
+    out
+}
+
+/// Export the session's bodies as STEP, validate the file and import it again.
+fn step_export_check(s: &solidcraft_engine::Session, volume: f64) -> (bool, String) {
+    let st = s.model.state();
+    let bytes = match solidcraft_engine::io::export(&st, &[], solidcraft_engine::io::Format::Step, "oracle") {
+        Ok(b) => b,
+        Err(e) => return (false, format!("export: {e}")),
+    };
+    let text = String::from_utf8_lossy(&bytes);
+    if let Err(e) = solidcraft_engine::kernel::step_validate(&text) {
+        return (false, format!("invalid: {e}"));
+    }
+    match solidcraft_engine::kernel::step_orientation_errors(&text) {
+        Ok(errs) if !errs.is_empty() => return (false, format!("faces inside out: {}", errs.join("; "))),
+        Err(e) => return (false, format!("orientation check: {e}")),
+        Ok(_) => {}
+    }
+    match solidcraft_engine::kernel::step_import(&text) {
+        Ok(imp) if !imp.warnings.is_empty() => (false, format!("warnings: {}", imp.warnings.join("; "))),
+        Ok(imp) if imp.bodies.len() != st.bodies.len() => (false, format!("{} bodies back of {}", imp.bodies.len(), st.bodies.len())),
+        Ok(imp) => {
+            let m: Vec<_> = imp.bodies.iter().filter_map(|b| solidcraft_engine::kernel::measure(&b.body).ok()).collect();
+            let m0: Vec<_> = st.bodies.iter().filter_map(|b| solidcraft_engine::kernel::measure(&b.body).ok()).collect();
+            let v: f64 = m.iter().map(|x| x.volume).sum();
+            let (a, a0): (f64, f64) = (m.iter().map(|x| x.area).sum(), m0.iter().map(|x| x.area).sum());
+            let faces: usize = imp.bodies.iter().map(|b| b.file_faces).sum();
+            let faces0: usize = m0.iter().map(|x| x.merged.faces).sum();
+            let close = |x: f64, y: f64| (x - y).abs() <= REL_TOL * y.abs().max(1.0);
+            let faces_raw: usize = st.bodies.iter().map(|b| b.body.face_count()).sum();
+            // (Fewer is fine: pieces of one plane, cylinder, cone, sphere or torus are written as one face.)
+            let ok = close(v, volume) && close(a, a0) && faces <= faces_raw;
+            (ok, format!("re-imported volume {v:.3} (was {volume:.3}), area {a:.3} (was {a0:.3}), faces {faces} (was {faces0})"))
+        }
+        Err(e) => (false, format!("import: {e}")),
+    }
+}
+
+/// Our part as a triangle soup (curved faces refined onto the surface).
+fn our_mesh(s: &solidcraft_engine::Session) -> Result<Vec<Tri>, String> {
+    let mut ours: Vec<Tri> = Vec::new();
+    for b in &s.world_state().bodies {
+        let m = b.body.tessellate_with(MESH_TOL, true).map_err(|e| e.to_string())?;
+        let p = |i: u32| m.positions.get(i as usize).map(|v: &Vec3| [v.x, v.y, v.z]);
+        for t in &m.triangles {
+            if let (Some(a), Some(b), Some(c)) = (p(t[0]), p(t[1]), p(t[2])) {
+                ours.push([a, b, c]);
+            }
+        }
+    }
+    if ours.is_empty() { Err("empty mesh".into()) } else { Ok(ours) }
+}
+
+/// Compare our part with the reference triangulation: the symmetric surface distance, and the
+/// principal second moments of volume of both meshes (the shape's inertia, independent of how it
+/// sits in space).
+fn reference_checks(s: &solidcraft_engine::Session, stl: &str, tol: f64, c: &mut Checks) {
+    let (ours, reference) = match (our_mesh(s), spatial::read_stl(stl)) {
+        (Ok(o), Ok(r)) if !r.is_empty() => (o, r),
+        (Err(e), _) | (_, Err(e)) => return c.push("surface_distance_mm", json!(e), json!(format!("<= {tol}")), false),
+        _ => return c.push("surface_distance_mm", json!("empty reference.stl"), json!(format!("<= {tol}")), false),
+    };
+    let (lo, hi) = spatial::bounds(&reference);
+    let size = (0..3).map(|k| hi[k] - lo[k]).fold(0.0, f64::max);
+    let h = spatial::hausdorff(&ours, &reference, size.max(1.0));
+    let worst = h.a_to_b.max(h.b_to_a);
+    c.push(
+        "surface_distance_mm",
+        json!({"max": worst, "mean": h.mean, "ours_to_reference": h.a_to_b, "reference_to_ours": h.b_to_a, "worst_at": h.worst_at}),
+        json!(format!("<= {tol}")),
+        worst <= tol,
+    );
+    let ((_, _, pa), (_, _, pb)) = (spatial::mass_properties(&ours), spatial::mass_properties(&reference));
+    let ok = pa.iter().zip(pb).all(|(a, b)| (a - b).abs() <= INERTIA_REL * b.abs().max(1.0));
+    c.push("principal_moments_mm5", json!(pa), json!(pb), ok);
+}
+
+fn report(args: &[String], results: &[Value]) {
+    if args.iter().any(|a| a == "--json") {
+        println!("{}", serde_json::to_string_pretty(&Value::Array(results.to_vec())).unwrap_or_default());
+        return;
+    }
+    for r in results {
+        let status = if r["pass"].as_bool().unwrap_or(false) {
+            "PASS"
+        } else if r["skipped"].as_bool().unwrap_or(false) {
+            "SKIP"
+        } else {
+            "FAIL"
+        };
+        let detail: Vec<String> = r["checks"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .filter(|c| !c["ok"].as_bool().unwrap_or(false))
+            .map(|c| format!("{} got {} want {}", c["check"].as_str().unwrap_or(""), c["got"], c["want"]))
+            .collect();
+        let err = r["error"].as_str().map(|e| format!(" ({e})")).unwrap_or_default();
+        println!(
+            "{status} {}{err}{}",
+            r["case"].as_str().unwrap_or(""),
+            if detail.is_empty() { String::new() } else { format!(": {}", detail.join("; ")) }
+        );
+    }
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let dirs: Vec<&String> = args.iter().filter(|a| !a.starts_with("--")).collect();
+    if dirs.is_empty() {
+        return Err("oracle: give one or more case directories (each with recipe.json and expected.json)".into());
+    }
+    let results: Vec<Value> = dirs.iter().map(|d| check_case(d)).collect();
+    report(args, &results);
+    let failed = results.iter().filter(|r| !r["pass"].as_bool().unwrap_or(false) && !r["skipped"].as_bool().unwrap_or(false)).count();
+    if failed > 0 { Err(format!("{failed} oracle case(s) failed")) } else { Ok(()) }
+}

apps/solidcraft-cli/src/preview.rs

@@ -0,0 +1,286 @@
+//! What a `snapshot` draws see-through, what it draws in a colour of its own, and where it cuts
+//! the model: the `--body`, `--tool` and `--section` options.
+//!
+//! None of this is a renderer of its own. Each option turns into the command the app itself runs
+//! — `appearance.assign` for the Appearance dialog, `inspect.section` for Section Analysis — so
+//! a picture of a tool body inside a translucent target is the picture the window would show
+//! with the same appearances assigned, and a script can do the same thing without the options.
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+/// How see-through the bodies around a `--tool` are drawn: enough to read the tool through them,
+/// solid enough to keep the shape of the material it meets.
+pub const TARGET_OPACITY: f64 = 0.3;
+
+/// A `--tool` body's colour: the hue the viewport's feature preview uses for removed material,
+/// so a cut's tool looks in a picture the way the preview looks in the window.
+pub const TOOL_COLOR: &str = "#e8542c";
+
+/// The colour of a body with no appearance of its own ([`solidcraft_engine::view::colors::BODY`]),
+/// as `appearance.assign` takes it. Giving a body an opacity means giving it a look, and a look
+/// carries a colour: this keeps the one it is already drawn in.
+fn default_body_hex() -> String {
+    let c = solidcraft_engine::view::colors::BODY;
+    format!("#{:02x}{:02x}{:02x}", c.0, c.1, c.2)
+}
+
+/// How one body is drawn: `--body NAME:opacity=0.3,color=#cc3333`. Either key alone is enough;
+/// the other keeps what the design already says.
+#[derive(Debug, PartialEq)]
+pub struct BodyLook {
+    pub name: String,
+    pub opacity: Option<f64>,
+    pub color: Option<String>,
+}
+
+/// `NAME:key=value[,key=value]`, or `NAME` on its own (which says nothing and is an error:
+/// a body is named here to change how it is drawn).
+pub fn parse_body(spec: &str) -> Result<BodyLook, String> {
+    let (name, rest) = spec
+        .split_once(':')
+        .ok_or_else(|| format!("--body `{spec}` must be NAME:key=value (`Target:opacity=0.3`, `Tool:color=#cc3333`, keys separated by commas)"))?;
+    let name = name.trim();
+    if name.is_empty() {
+        return Err(format!("--body `{spec}` names no body"));
+    }
+    let mut look = BodyLook { name: name.to_owned(), opacity: None, color: None };
+    for part in rest.split(',') {
+        let part = part.trim();
+        if part.is_empty() {
+            continue;
+        }
+        let (key, value) = part.split_once('=').ok_or_else(|| format!("--body {name}: `{part}` must be key=value (opacity, color)"))?;
+        let value = value.trim();
+        match key.trim().to_ascii_lowercase().as_str() {
+            "opacity" => {
+                let o: f64 = value.parse().map_err(|_| format!("--body {name}: opacity must be a number 0 to 1, not `{value}`"))?;
+                if !o.is_finite() || !(0.0..=1.0).contains(&o) {
+                    return Err(format!("--body {name}: opacity must be 0 to 1, not `{value}`"));
+                }
+                look.opacity = Some(o);
+            }
+            "color" => {
+                let digits = value.strip_prefix('#').filter(|h| h.len() == 6 && h.chars().all(|c| c.is_ascii_hexdigit()));
+                let digits = digits.ok_or_else(|| format!("--body {name}: color must be #rrggbb, not `{value}`"))?;
+                look.color = Some(format!("#{}", digits.to_ascii_lowercase()));
+            }
+            other => return Err(format!("--body {name}: unknown key `{other}` (opacity, color)")),
+        }
+    }
+    if look.opacity.is_none() && look.color.is_none() {
+        return Err(format!("--body `{spec}` asks for nothing: give opacity, color, or both"));
+    }
+    Ok(look)
+}
+
+/// The `inspect.section` parameters a `--section` spec asks for: `z=27` (the plane through that
+/// world coordinate, its normal along +Z), `XY` (a named plane through the origin), either with
+/// `,flip` to keep the other side, or the command's own JSON object.
+pub fn parse_section(spec: &str) -> Result<Value, String> {
+    let spec = spec.trim();
+    if spec.starts_with('{') {
+        return serde_json::from_str(spec).map_err(|e| format!("--section: not JSON: {e}"));
+    }
+    let mut parts = spec.split(',').map(str::trim);
+    let plane = parts.next().unwrap_or_default();
+    let mut flip = false;
+    for p in parts {
+        match p.to_ascii_lowercase().as_str() {
+            "" => {}
+            "flip" => flip = true,
+            other => return Err(format!("--section: unknown `{other}` (only `flip` follows the plane)")),
+        }
+    }
+    // A named plane through the world origin, as `inspect.section` takes it.
+    let mut params = match plane.to_ascii_uppercase().as_str() {
+        p @ ("XY" | "XZ" | "YZ") => json!({"plane": p}),
+        _ => {
+            // AXIS=VALUE: the plane whose normal is that axis, cutting at that world coordinate.
+            let (axis, at) = plane.split_once('=').ok_or_else(|| {
+                format!("--section `{spec}` must be z=27 (a world coordinate on an axis), XY, XZ, YZ, or the JSON inspect.section takes")
+            })?;
+            let at: f64 = at.trim().parse().map_err(|_| format!("--section {axis}: `{}` is not a number", at.trim()))?;
+            if !at.is_finite() {
+                return Err(format!("--section {axis}: `{at}` is not a finite coordinate"));
+            }
+            // The plane normal to each axis: Z is XY, Y is XZ, X is YZ.
+            let named = match axis.trim().to_ascii_lowercase().as_str() {
+                "x" => "YZ",
+                "y" => "XZ",
+                "z" => "XY",
+                other => return Err(format!("--section: unknown axis `{other}` (x, y or z)")),
+            };
+            json!({"plane": named, "at": at})
+        }
+    };
+    if flip {
+        params["flip"] = json!(true);
+    }
+    Ok(params)
+}
+
+/// The design's body names, for an error that says which ones there are.
+fn body_names(s: &Session) -> Vec<String> {
+    s.model.state().bodies.iter().map(|b| b.name.clone()).collect()
+}
+
+/// The colour and opacity a body is drawn with now, as `appearance.assign` takes them: its own
+/// appearance, else its component's or material's, else the default body colour.
+fn current_look(s: &mut Session, name: &str) -> Result<(String, f64), String> {
+    let reply = s.execute("appearance.list", &json!({"body": name})).map_err(|e| e.to_string())?;
+    let body = reply.get("body");
+    let look = body.and_then(|b| b.get("appearance")).filter(|a| !a.is_null());
+    let hex = look
+        .and_then(|a| a.get("color"))
+        .and_then(Value::as_str)
+        .map(str::to_owned)
+        // No appearance, but an imported colour: `body.color` is that colour, 0..1 per channel.
+        .or_else(|| {
+            let c = body?.get("color")?.as_array()?;
+            let ch = |i: usize| -> Option<u8> { Some((c.get(i)?.as_f64()?.clamp(0.0, 1.0) * 255.0).round() as u8) };
+            Some(format!("#{:02x}{:02x}{:02x}", ch(0)?, ch(1)?, ch(2)?))
+        })
+        .unwrap_or_else(default_body_hex);
+    let opacity = look.and_then(|a| a.get("opacity")).and_then(Value::as_f64).filter(|o| o.is_finite()).unwrap_or(1.0);
+    Ok((hex, opacity))
+}
+
+/// Draw `name` with `look`, keeping whichever of colour and opacity it does not give.
+fn assign(s: &mut Session, look: &BodyLook) -> Result<(), String> {
+    let name = &look.name;
+    if !body_names(s).iter().any(|b| b == name) {
+        return Err(format!("no body `{name}` in the design (it has {})", body_list(s)));
+    }
+    let (hex, opacity) = current_look(s, name)?;
+    let params = json!({
+        "bodies": [name],
+        "color": look.color.clone().unwrap_or(hex),
+        "opacity": look.opacity.unwrap_or(opacity),
+    });
+    s.execute("appearance.assign", &params).map(|_| ()).map_err(|e| format!("drawing `{name}`: {e}"))
+}
+
+/// The design's bodies, named, for an error message.
+fn body_list(s: &Session) -> String {
+    let names = body_names(s);
+    if names.is_empty() { "no bodies".to_owned() } else { names.join(", ") }
+}
+
+/// Apply the options to the session, in the order a later one overrides an earlier: the `--tool`
+/// preview first (it speaks for every body), then each `--body`, then the section.
+pub fn apply(s: &mut Session, bodies: &[&str], tools: &[&str], section: Option<&str>) -> Result<(), String> {
+    // Everything is read before anything is drawn, so a misspelt option is an error rather than
+    // half a picture.
+    let looks: Vec<BodyLook> = bodies.iter().map(|spec| parse_body(spec)).collect::<Result<_, _>>()?;
+    let section = section.map(parse_section).transpose()?;
+    if !tools.is_empty() {
+        let names = body_names(s);
+        for t in tools {
+            if !names.iter().any(|b| b == t) {
+                return Err(format!("--tool: no body `{t}` in the design (it has {})", body_list(s)));
+            }
+        }
+        // Everything but the tool see-through, in the colour it already has, so the tool reads
+        // against the material it meets. Bodies that share a colour are assigned together: a
+        // design of many bodies then costs a command or two rather than one for each.
+        let mut around: std::collections::BTreeMap<String, Vec<String>> = std::collections::BTreeMap::new();
+        for name in names.iter().filter(|n| !tools.contains(&n.as_str())) {
+            around.entry(current_look(s, name)?.0).or_default().push(name.clone());
+        }
+        for (hex, sharing_it) in around {
+            let params = json!({"bodies": sharing_it, "color": hex, "opacity": TARGET_OPACITY});
+            s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
+        }
+        // Then the tool itself, solid in the tool colour.
+        let params = json!({"bodies": tools, "color": TOOL_COLOR, "opacity": 1.0});
+        s.execute("appearance.assign", &params).map_err(|e| format!("--tool: {e}"))?;
+    }
+    for look in &looks {
+        assign(s, look)?;
+    }
+    if let Some(params) = section {
+        s.execute("inspect.section", &params).map_err(|e| format!("--section: {e}"))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `--body` names a body and says how it is drawn. Either key alone is enough.
+    #[test]
+    fn a_body_spec_is_a_name_and_the_keys_appearance_assign_takes() {
+        let look = |s: &str| parse_body(s).unwrap();
+        assert_eq!(look("Target:opacity=0.3"), BodyLook { name: "Target".into(), opacity: Some(0.3), color: None });
+        assert_eq!(look("Tool:color=#CC3333"), BodyLook { name: "Tool".into(), opacity: None, color: Some("#cc3333".into()) });
+        assert_eq!(look("Tool: opacity = 1 , color = #00ff00 "), BodyLook { name: "Tool".into(), opacity: Some(1.0), color: Some("#00ff00".into()) });
+        // A body name with a space in it, as the browser shows them.
+        assert_eq!(look("Bracket arm:opacity=0").name, "Bracket arm");
+        assert_eq!(look("A:opacity=0").opacity, Some(0.0));
+    }
+
+    /// Every way of getting `--body` wrong is an error that says what it takes, never a panic
+    /// and never a silently ignored option.
+    #[test]
+    fn a_bad_body_spec_says_what_it_takes() {
+        for (spec, expect) in [
+            ("Target", "NAME:key=value"),
+            (":opacity=0.3", "names no body"),
+            ("Target:", "asks for nothing"),
+            ("Target:opacity", "key=value"),
+            ("Target:opacity=high", "0 to 1"),
+            ("Target:opacity=1.5", "0 to 1"),
+            ("Target:opacity=-0.2", "0 to 1"),
+            ("Target:opacity=NaN", "0 to 1"),
+            ("Target:opacity=inf", "0 to 1"),
+            ("Target:color=red", "#rrggbb"),
+            ("Target:color=#ccc", "#rrggbb"),
+            ("Target:color=#gggggg", "#rrggbb"),
+            ("Target:alpha=0.3", "unknown key `alpha`"),
+        ] {
+            let e = parse_body(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
+            assert!(e.contains(expect), "{spec}: {e}");
+        }
+    }
+
+    /// A `--section` spec is the plane `inspect.section` cuts with: an axis and a world
+    /// coordinate, a named plane, `flip` for the other side, or the command's own JSON.
+    #[test]
+    fn a_section_spec_is_the_plane_inspect_section_takes() {
+        let p = |s: &str| parse_section(s).unwrap();
+        // The plane normal to each axis, cutting at that coordinate.
+        assert_eq!(p("z=27"), json!({"plane": "XY", "at": 27.0}));
+        assert_eq!(p("y=-5.5"), json!({"plane": "XZ", "at": -5.5}));
+        assert_eq!(p("X=0"), json!({"plane": "YZ", "at": 0.0}));
+        assert_eq!(p("z=27,flip"), json!({"plane": "XY", "at": 27.0, "flip": true}));
+        // A named plane through the origin, and the command's own parameters.
+        assert_eq!(p("XY"), json!({"plane": "XY"}));
+        assert_eq!(p("yz,flip"), json!({"plane": "YZ", "flip": true}));
+        assert_eq!(p("{\"plane\": \"XY\", \"offset\": 4}"), json!({"plane": "XY", "offset": 4}));
+    }
+
+    #[test]
+    fn a_bad_section_spec_says_what_it_takes() {
+        for (spec, expect) in [
+            ("27", "z=27"),
+            ("w=4", "unknown axis `w`"),
+            ("z=high", "is not a number"),
+            ("z=inf", "not a finite coordinate"),
+            ("z=27,upside-down", "unknown `upside-down`"),
+            ("{\"plane\":", "not JSON"),
+        ] {
+            let e = parse_section(spec).err().unwrap_or_else(|| panic!("{spec} was accepted"));
+            assert!(e.contains(expect), "{spec}: {e}");
+        }
+    }
+
+    /// The tool colour is the one the options document, in the form `appearance.assign` takes.
+    #[test]
+    fn the_tool_colour_is_a_hex_colour_the_command_takes() {
+        assert_eq!(parse_body(&format!("Tool:color={TOOL_COLOR}")).unwrap().color, Some(TOOL_COLOR.to_owned()));
+        assert!((0.0..1.0).contains(&TARGET_OPACITY), "a target must be see-through: {TARGET_OPACITY}");
+        assert_eq!(default_body_hex(), "#b0bac6");
+    }
+}

apps/solidcraft-cli/src/recipe.rs

@@ -1,4 +1,4 @@
-//! Oracle recipes (`plan/fusion/oracle/*/recipe.json`) → SolveCraft command scripts.
+//! Reference-test recipes (`tests/oracle/*/recipe.json`) → SolidCraft command scripts.
 //!
 //! A recipe lists features with sketch entities in sketch-local coordinates; point references
 //! (`l1.end`) share points. Each feature becomes one or more commands.
@@ -85,14 +85,6 @@ fn sketch_cmds(f: &Value, out: &mut Vec<Value>) -> Result<(), String> {
 
 /// Extent parameters for the Extrude command.
 fn extent(f: &Value, p: &mut Value) {
-    // Where Fusion's own result differs from the geometric meaning (its through-all is sized
-    // from vertices), the recipe records the extent Fusion actually used: replay that.
-    if let Some(fx) = f.get("fusion_effective_extent").filter(|x| x.get("type").and_then(Value::as_str) == Some("distance")) {
-        let dir = fx.get("direction").and_then(Value::as_str).unwrap_or("positive");
-        p["distance"] = fx.get("distance").cloned().unwrap_or(Value::Null);
-        p["direction"] = json!(if dir.starts_with("negative") { "negative" } else { "positive" });
-        return;
-    }
     let e = f.get("extent").cloned().unwrap_or(Value::Null);
     let ty = e.get("type").and_then(Value::as_str).unwrap_or("distance");
     let dist = e.get("distance").cloned().or_else(|| f.get("distance").cloned()).unwrap_or(Value::Null);
@@ -100,7 +92,7 @@ fn extent(f: &Value, p: &mut Value) {
         "symmetric" => {
             let full = e.get("is_full_length").and_then(Value::as_bool).unwrap_or(false);
             p["direction"] = json!("symmetric");
-            p["distance"] = if full { json!(format!("({}) / 2", expr_text(&dist))) } else { dist };
+            p["distance"] = if full { dist } else { json!(format!("({}) * 2", expr_text(&dist))) };
         }
         "two_sides" => {
             p["distance"] = e.get("side1").cloned().unwrap_or(Value::Null);
@@ -304,6 +296,17 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
             Some("sketch") => sketch_cmds(f, &mut out)?,
             Some("extrude") => {
                 let mut p = json!({"sketch": profile_sketch(f), "profiles": profiles_of(f), "operation": op(f), "name": name, "body_names": bodies});
+                // Thin: {sketch, curves, thickness, side?, thickness2?} instead of profiles.
+                if let (Some(thin), Some(params)) = (f.get("thin"), p.as_object_mut()) {
+                    params.remove("profiles");
+                    params.insert("thin".into(), json!(true));
+                    params.insert("sketch".into(), thin.get("sketch").cloned().unwrap_or(Value::Null));
+                    for key in ["curves", "thickness", "side", "thickness2"] {
+                        if let Some(v) = thin.get(key) {
+                            params.insert(key.into(), v.clone());
+                        }
+                    }
+                }
                 extent(f, &mut p);
                 out.push(json!({"command": "solid.extrude", "params": p}));
             }
@@ -420,6 +423,24 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                     "sketch": profile_sketch(f), "profiles": profiles_of(f), "path_sketch": path.get("sketch"), "path": path.get("curves"),
                     "operation": op(f), "name": name, "body_names": bodies}}));
             }
+            // A boundary surface: a loop of one sketch's curves (`sketch`, `curves`), or a network
+            // (`u`, `v`), as `surface.boundary` takes them.
+            Some("boundary_surface") => {
+                let mut p = json!({"name": name});
+                for k in ["sketch", "curves", "continuity", "u", "v", "operation"] {
+                    if let Some(v) = f.get(k) {
+                        p[k] = v.clone();
+                    }
+                }
+                if let Some(b) = bodies.as_array().and_then(|a| a.first()) {
+                    p["body_name"] = b.clone();
+                }
+                out.push(json!({"command": "surface.boundary", "params": p}));
+            }
+            Some("thicken") => out.push(json!({"command": "surface.thicken", "params": {
+                "bodies": f.get("bodies"), "thickness": f.get("thickness"), "symmetric": f.get("symmetric").cloned().unwrap_or(json!(false)),
+                "operation": op(f), "name": name}})),
+            Some("remove") => out.push(json!({"command": "solid.remove", "params": {"bodies": f.get("bodies"), "name": name}})),
             Some("shell") => {
                 let faces: Vec<Value> = f.get("faces_removed").and_then(Value::as_array).into_iter().flatten().filter_map(|x| x.get("point").cloned()).collect();
                 out.push(json!({"command": "solid.shell", "params": {"faces": faces, "thickness": f.get("inside_thickness"), "name": name}}));
@@ -522,7 +543,23 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 out.push(json!({"command": "solid.mirror", "params": p}));
             }
             Some("fillet") => {
-                out.push(json!({"command": "solid.fillet", "params": {"edges": edge_points(f), "radius": f.get("radius"), "name": name}}))
+                let mut p = json!({"edges": edge_points(f), "radius": f.get("radius"), "name": name});
+                // Constant radius (the default), chord length, or a radius varying along each edge
+                // (`radius` at the end nearest `start`, `radius2` at the other, `mid` between,
+                // `smooth`), or a B-spline along each edge (`radius` its first control radius,
+                // `radii` the rest, `knots`); `fit` for a radius too large for the geometry.
+                match f.get("type").and_then(Value::as_str) {
+                    Some("chord_length") => p["type"] = json!("chord"),
+                    Some("variable_radius") => p["type"] = json!("variable"),
+                    Some("spline_radius") => p["type"] = json!("spline"),
+                    _ => {}
+                }
+                for key in ["radius2", "start", "mid", "smooth", "fit", "radii", "knots"] {
+                    if let Some(v) = f.get(key) {
+                        p[key] = v.clone();
+                    }
+                }
+                out.push(json!({"command": "solid.fillet", "params": p}))
             }
             Some("chamfer") => {
                 out.push(json!({"command": "solid.chamfer", "params": {"edges": edge_points(f), "distance": f.get("distance"), "name": name}}))
@@ -545,8 +582,8 @@ fn edge_points(f: &Value) -> Value {
     )
 }
 
-/// Fusion names a pattern's source features with an occurrence suffix ("Hole1 (1)"); the
-/// features are the recipe's own names.
+/// A pattern's source features may carry an occurrence suffix ("Hole1 (1)"); the features are
+/// the recipe's own names.
 fn feature_refs(v: Option<&Value>) -> Value {
     let list: Vec<Value> = v
         .and_then(Value::as_array)

apps/solidcraft-cli/src/render.rs

@@ -0,0 +1,169 @@
+//! Complete headless image-job workflow through the same engine commands as the UI/MCP.
+use serde_json::{Value, json};
+use solidcraft_engine::{
+    Session,
+    doc::render_settings::{RenderJob, RenderSetup},
+    render::job::{CpuHost, JobId, Phase, ToneMap},
+};
+
+/// Only explicit runtime CLI flags are stored here. A typed setup owns these
+/// values even when a supplied flag happens to match the saved value.
+#[derive(Default)]
+struct RuntimeOptions {
+    progressive: bool,
+    transparent: bool,
+    samples: Option<u32>,
+    max_depth: Option<u32>,
+    seed: Option<u32>,
+    lighting: Option<String>,
+    tone_map: Option<ToneMap>,
+    environment: Option<String>,
+}
+
+impl RuntimeOptions {
+    fn explicit_flag(&self) -> Option<&'static str> {
+        [
+            (self.progressive, "--progressive"),
+            (self.transparent, "--transparent"),
+            (self.samples.is_some(), "--samples"),
+            (self.max_depth.is_some(), "--max-depth"),
+            (self.seed.is_some(), "--seed"),
+            (self.lighting.is_some(), "--lighting"),
+            (self.tone_map.is_some(), "--tone-map"),
+            (self.environment.is_some(), "--environment"),
+        ]
+        .into_iter()
+        .find_map(|(present, flag)| present.then_some(flag))
+    }
+
+    fn request(&self, session: &Session, settings: RenderSetup) -> Result<(Value, bool), String> {
+        if let Some(job) = &settings.job {
+            if let Some(flag) = self.explicit_flag() {
+                return Err(format!("{flag} cannot accompany a typed saved render setup; change the saved job options instead"));
+            }
+            settings.validate().map_err(|e| e.to_string())?;
+            session.doc.render.validate_resources(&settings).map_err(|e| e.to_string())?;
+            let needs_gpu = matches!(job, RenderJob::GpuPath { .. });
+            return Ok((json!({"settings":settings}), needs_gpu));
+        }
+        // Legacy setups and unnamed requests retain their runtime wire contract.
+        settings.validate().map_err(|e| e.to_string())?;
+        let mut params = json!({"settings":settings,"transparent_background":self.transparent,
+            "progressive":self.progressive,"samples":self.samples,"max_depth":self.max_depth,"seed":self.seed});
+        if let Some(path) = &self.lighting {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read lighting: {e}"))?;
+            let lighting: solidcraft_engine::render::job::StudioLighting = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+            params["lighting"] = json!(lighting);
+        }
+        if let Some(tone_map) = self.tone_map {
+            params["tone_map"] = json!(tone_map);
+        }
+        if let Some(path) = &self.environment {
+            let text = solidcraft_engine::io::vfs::read_to_string(path, 65536).map_err(|e| format!("could not read environment: {e}"))?;
+            params["environment"] = serde_json::from_str(&text).map_err(|e| e.to_string())?;
+        }
+        Ok((params, self.progressive))
+    }
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
+    let mut out = None;
+    let mut setup = None;
+    let mut width = None;
+    let mut height = None;
+    let mut exposure = None;
+    let mut runtime = RuntimeOptions::default();
+    let mut overwrite = false;
+    let mut timeout = 120u64;
+    let mut i = 1;
+    while let Some(arg) = args.get(i) {
+        match arg.as_str() {
+            "--progressive" => runtime.progressive = true,
+            "--transparent" => runtime.transparent = true,
+            "--overwrite" => overwrite = true,
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" | "--samples" | "--max-depth" | "--seed" | "--exposure" | "--lighting"
+            | "--tone-map" | "--environment" => {
+                i += 1;
+                let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
+                match arg.as_str() {
+                    "--out" => out = Some(value.clone()),
+                    "--setup" => setup = Some(value.clone()),
+                    "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
+                    "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
+                    "--samples" => runtime.samples = Some(value.parse::<u32>().map_err(|_| "invalid samples")?),
+                    "--max-depth" => runtime.max_depth = Some(value.parse::<u32>().map_err(|_| "invalid depth")?),
+                    "--seed" => runtime.seed = Some(value.parse::<u32>().map_err(|_| "invalid seed")?),
+                    "--exposure" => exposure = Some(value.parse::<f64>().map_err(|_| "invalid exposure")?),
+                    // Defer file reads until a saved job has rejected conflicting controls.
+                    "--environment" => runtime.environment = Some(value.clone()),
+                    "--lighting" => runtime.lighting = Some(value.clone()),
+                    "--tone-map" => {
+                        runtime.tone_map = Some(match value.as_str() {
+                            "reinhard" => ToneMap::Reinhard,
+                            "aces_fitted" => ToneMap::AcesFitted,
+                            _ => return Err("tone-map must be reinhard or aces_fitted".into()),
+                        })
+                    }
+                    _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
+                }
+            }
+            _ => return Err(format!("unknown render option: {arg}")),
+        }
+        i += 1;
+    }
+    if !(1..=3600).contains(&timeout) {
+        return Err("render timeout must be 1..3600 seconds".into());
+    }
+    let out = out.ok_or("render requires --out FILE.png")?;
+    let mut session = crate::load(input)?;
+    let mut settings = if let Some(name) = setup.as_deref() {
+        session.doc.render.setups.get(name).cloned().ok_or("no saved render setup with that name")?
+    } else {
+        RenderSetup::default()
+    };
+    if let Some(width) = width {
+        settings.width = width;
+    }
+    if let Some(height) = height {
+        settings.height = height;
+    }
+    if let Some(exposure) = exposure {
+        settings.exposure_ev = exposure;
+    }
+    // Resolve saved intent before opening a GPU or explicitly settling geometry.
+    // Width/height/exposure only change this validated inline settings clone.
+    let (mut params, needs_gpu) = runtime.request(&session, settings)?;
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    if needs_gpu {
+        session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
+    }
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    if setup.is_none() {
+        let camera = if let Some(camera) = session.camera {
+            camera
+        } else {
+            let mut camera = RenderSetup::default().camera;
+            camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+            camera
+        };
+        params["settings"]["camera"] = json!(camera);
+    }
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    let status = match handle.wait_timeout(std::time::Duration::from_secs(timeout)) {
+        Ok(status) => status,
+        Err(e) => {
+            let _ = session.execute("render.cancel", &json!({"job":id}));
+            return Err(e.to_string());
+        }
+    };
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render cancelled".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":out,"overwrite":overwrite})).map_err(|e| e.to_string())?;
+    println!("{}", crate::pretty(&json!({"preflight":preflight,"export":exported})));
+    Ok(())
+}

apps/solidcraft-cli/src/spatial.rs

@@ -0,0 +1,333 @@
+//! Geometry comparison helpers: an STL reader, bounding boxes, volume, centre of mass and principal
+//! second moments of a closed triangle mesh, and a sampled symmetric Hausdorff distance between two
+//! triangle meshes.
+
+use std::collections::HashMap;
+
+/// A triangle soup in mm.
+pub type Tri = [[f64; 3]; 3];
+
+fn sub(a: [f64; 3], b: [f64; 3]) -> [f64; 3] {
+    [a[0] - b[0], a[1] - b[1], a[2] - b[2]]
+}
+fn add(a: [f64; 3], b: [f64; 3]) -> [f64; 3] {
+    [a[0] + b[0], a[1] + b[1], a[2] + b[2]]
+}
+fn scale(a: [f64; 3], s: f64) -> [f64; 3] {
+    [a[0] * s, a[1] * s, a[2] * s]
+}
+fn dot(a: [f64; 3], b: [f64; 3]) -> f64 {
+    a[0] * b[0] + a[1] * b[1] + a[2] * b[2]
+}
+fn cross(a: [f64; 3], b: [f64; 3]) -> [f64; 3] {
+    [a[1] * b[2] - a[2] * b[1], a[2] * b[0] - a[0] * b[2], a[0] * b[1] - a[1] * b[0]]
+}
+
+/// Read a binary (or ASCII) STL file.
+pub fn read_stl(path: &str) -> Result<Vec<Tri>, String> {
+    let b = std::fs::read(path).map_err(|e| format!("{path}: {e}"))?;
+    if b.len() >= 84 {
+        let n = u32::from_le_bytes([b[80], b[81], b[82], b[83]]) as usize;
+        if b.len() == 84 + 50 * n {
+            let f = |o: usize| f64::from(f32::from_le_bytes([b[o], b[o + 1], b[o + 2], b[o + 3]]));
+            return Ok((0..n)
+                .map(|i| {
+                    let o = 84 + 50 * i + 12;
+                    let v = |k: usize| [f(o + 12 * k), f(o + 12 * k + 4), f(o + 12 * k + 8)];
+                    [v(0), v(1), v(2)]
+                })
+                .collect());
+        }
+    }
+    let text = String::from_utf8_lossy(&b);
+    let mut verts = Vec::new();
+    for line in text.lines() {
+        let mut it = line.split_whitespace();
+        if it.next() == Some("vertex") {
+            let c: Vec<f64> = it.filter_map(|x| x.parse().ok()).collect();
+            if c.len() == 3 {
+                verts.push([c[0], c[1], c[2]]);
+            }
+        }
+    }
+    if verts.is_empty() || verts.len() % 3 != 0 {
+        return Err(format!("{path}: not an STL file"));
+    }
+    Ok(verts.chunks(3).map(|c| [c[0], c[1], c[2]]).collect())
+}
+
+/// Volume, centre of mass and the principal second moments of volume (mm^5, sorted ascending) of a
+/// closed, outward-oriented triangle soup, by signed tetrahedra from the origin.
+pub fn mass_properties(tris: &[Tri]) -> (f64, [f64; 3], [f64; 3]) {
+    let (mut v6, mut m1) = (0.0, [0.0; 3]);
+    let mut c = [[0.0; 3]; 3]; // ∫ x xᵀ dV
+    for t in tris {
+        let d = dot(t[0], cross(t[1], t[2]));
+        v6 += d;
+        let s = add(add(t[0], t[1]), t[2]);
+        m1 = add(m1, scale(s, d / 24.0));
+        for (i, row) in c.iter_mut().enumerate() {
+            for (j, cell) in row.iter_mut().enumerate() {
+                let vv: f64 = t.iter().map(|p| p[i] * p[j]).sum::<f64>() + s[i] * s[j];
+                *cell += d / 120.0 * vv;
+            }
+        }
+    }
+    let vol = v6 / 6.0;
+    if vol.abs() < 1e-12 {
+        return (0.0, [0.0; 3], [0.0; 3]);
+    }
+    let com = scale(m1, 1.0 / vol);
+    // Central covariance and inertia tensor I = tr(C)·1 − C.
+    let mut cc = c;
+    for (i, row) in cc.iter_mut().enumerate() {
+        for (j, cell) in row.iter_mut().enumerate() {
+            *cell -= vol * com[i] * com[j];
+        }
+    }
+    let tr = cc[0][0] + cc[1][1] + cc[2][2];
+    let mut inertia = [[0.0; 3]; 3];
+    for i in 0..3 {
+        for j in 0..3 {
+            inertia[i][j] = if i == j { tr - cc[i][j] } else { -cc[i][j] };
+        }
+    }
+    let mut ev = eigen_sym3(inertia);
+    ev.sort_by(f64::total_cmp);
+    (vol, com, ev)
+}
+
+/// Eigenvalues of a symmetric 3×3 matrix (Jacobi rotations).
+fn eigen_sym3(mut a: [[f64; 3]; 3]) -> [f64; 3] {
+    for _ in 0..50 {
+        let (mut p, mut q, mut big) = (0, 1, 0.0);
+        for (i, j) in [(0, 1), (0, 2), (1, 2)] {
+            if a[i][j].abs() > big {
+                (p, q, big) = (i, j, a[i][j].abs());
+            }
+        }
+        if big <= 1e-15 * (a[0][0].abs() + a[1][1].abs() + a[2][2].abs()).max(1e-300) {
+            break;
+        }
+        let theta = (a[q][q] - a[p][p]) / (2.0 * a[p][q]);
+        let t = theta.signum() / (theta.abs() + (theta * theta + 1.0).sqrt());
+        let t = if theta == 0.0 { 1.0 } else { t };
+        let (cs, sn) = (1.0 / (t * t + 1.0).sqrt(), t / (t * t + 1.0).sqrt());
+        let mut b = a;
+        for k in 0..3 {
+            b[k][p] = cs * a[k][p] - sn * a[k][q];
+            b[k][q] = sn * a[k][p] + cs * a[k][q];
+        }
+        let mut c2 = b;
+        for k in 0..3 {
+            c2[p][k] = cs * b[p][k] - sn * b[q][k];
+            c2[q][k] = sn * b[p][k] + cs * b[q][k];
+        }
+        a = c2;
+    }
+    [a[0][0], a[1][1], a[2][2]]
+}
+
+/// Axis-aligned bounds of a triangle soup.
+pub fn bounds(tris: &[Tri]) -> ([f64; 3], [f64; 3]) {
+    let (mut lo, mut hi) = ([f64::INFINITY; 3], [f64::NEG_INFINITY; 3]);
+    for p in tris.iter().flatten() {
+        for k in 0..3 {
+            lo[k] = lo[k].min(p[k]);
+            hi[k] = hi[k].max(p[k]);
+        }
+    }
+    (lo, hi)
+}
+
+/// Distance from a point to a triangle (Ericson, Real-Time Collision Detection 5.1.5).
+fn point_tri(p: [f64; 3], t: &Tri) -> f64 {
+    let (a, b, c) = (t[0], t[1], t[2]);
+    let (ab, ac, ap) = (sub(b, a), sub(c, a), sub(p, a));
+    let (d1, d2) = (dot(ab, ap), dot(ac, ap));
+    let q = if d1 <= 0.0 && d2 <= 0.0 {
+        a
+    } else {
+        let bp = sub(p, b);
+        let (d3, d4) = (dot(ab, bp), dot(ac, bp));
+        if d3 >= 0.0 && d4 <= d3 {
+            b
+        } else {
+            let vc = d1 * d4 - d3 * d2;
+            if vc <= 0.0 && d1 >= 0.0 && d3 <= 0.0 {
+                add(a, scale(ab, d1 / (d1 - d3)))
+            } else {
+                let cp = sub(p, c);
+                let (d5, d6) = (dot(ab, cp), dot(ac, cp));
+                if d6 >= 0.0 && d5 <= d6 {
+                    c
+                } else {
+                    let vb = d5 * d2 - d1 * d6;
+                    if vb <= 0.0 && d2 >= 0.0 && d6 <= 0.0 {
+                        add(a, scale(ac, d2 / (d2 - d6)))
+                    } else {
+                        let va = d3 * d6 - d5 * d4;
+                        if va <= 0.0 && (d4 - d3) >= 0.0 && (d5 - d6) >= 0.0 {
+                            add(b, scale(sub(c, b), (d4 - d3) / ((d4 - d3) + (d5 - d6))))
+                        } else {
+                            let den = va + vb + vc;
+                            if den.abs() < 1e-300 { a } else { add(a, add(scale(ab, vb / den), scale(ac, vc / den))) }
+                        }
+                    }
+                }
+            }
+        }
+    };
+    let d = sub(p, q);
+    dot(d, d).sqrt()
+}
+
+/// Uniform grid of triangles for distance queries up to `cap`.
+struct Grid<'a> {
+    tris: &'a [Tri],
+    cell: f64,
+    cells: HashMap<(i64, i64, i64), Vec<u32>>,
+}
+
+impl<'a> Grid<'a> {
+    fn new(tris: &'a [Tri], cell: f64) -> Self {
+        let mut cells: HashMap<(i64, i64, i64), Vec<u32>> = HashMap::new();
+        let key = |x: f64| (x / cell).floor() as i64;
+        for (i, t) in tris.iter().enumerate() {
+            let (lo, hi) = bounds(std::slice::from_ref(t));
+            for x in key(lo[0])..=key(hi[0]) {
+                for y in key(lo[1])..=key(hi[1]) {
+                    for z in key(lo[2])..=key(hi[2]) {
+                        cells.entry((x, y, z)).or_default().push(i as u32);
+                    }
+                }
+            }
+        }
+        Grid { tris, cell, cells }
+    }
+
+    /// Distance from `p` to the nearest triangle, or `cap` if none is that close. Searches shells
+    /// of cells outwards and stops once the nearest hit is closer than the unsearched shells.
+    fn distance(&self, p: [f64; 3], cap: f64, seen: &mut [u32], stamp: u32) -> f64 {
+        let rmax = (cap / self.cell).ceil() as i64;
+        let k = |x: f64| (x / self.cell).floor() as i64;
+        let (cx, cy, cz) = (k(p[0]), k(p[1]), k(p[2]));
+        let mut best = cap;
+        for r in 0..=rmax {
+            for x in cx - r..=cx + r {
+                for y in cy - r..=cy + r {
+                    for z in cz - r..=cz + r {
+                        // only the shell at Chebyshev distance r
+                        if (x - cx).abs() != r && (y - cy).abs() != r && (z - cz).abs() != r {
+                            continue;
+                        }
+                        let Some(list) = self.cells.get(&(x, y, z)) else { continue };
+                        for &i in list {
+                            let Some(slot) = seen.get_mut(i as usize) else { continue };
+                            if *slot == stamp {
+                                continue;
+                            }
+                            *slot = stamp;
+                            if let Some(t) = self.tris.get(i as usize) {
+                                best = best.min(point_tri(p, t));
+                            }
+                        }
+                    }
+                }
+            }
+            // Everything not yet searched is at least r·cell away from p.
+            if best <= r as f64 * self.cell {
+                break;
+            }
+        }
+        best
+    }
+}
+
+/// At most this many sample points per side (larger meshes are sampled with an even stride).
+const MAX_SAMPLES: usize = 250_000;
+
+/// Sample points of a triangle soup: its vertices and triangle centroids (every k-th triangle for
+/// very large meshes).
+fn samples(tris: &[Tri]) -> Vec<[f64; 3]> {
+    let stride = (tris.len() * 4).div_ceil(MAX_SAMPLES).max(1);
+    let mut out: Vec<[f64; 3]> = Vec::with_capacity(tris.len() * 4 / stride + 4);
+    for t in tris.iter().step_by(stride) {
+        out.extend_from_slice(t);
+        out.push(scale(add(add(t[0], t[1]), t[2]), 1.0 / 3.0));
+    }
+    out
+}
+
+/// One-sided sampled distance from `from` to `to`: (max, mean, worst sample point). Distances are
+/// capped at `cap`.
+fn one_sided(from: &[Tri], to: &[Tri], cap: f64) -> (f64, f64, [f64; 3]) {
+    let (lo, hi) = bounds(to);
+    let diag = dot(sub(hi, lo), sub(hi, lo)).sqrt();
+    // Cells about twice the typical triangle size (so a cell holds a handful of triangles), but no
+    // finer than diag/400 (so big flat triangles don't fill too many cells).
+    let area: f64 = to.iter().map(|t| dot(cross(sub(t[1], t[0]), sub(t[2], t[0])), cross(sub(t[1], t[0]), sub(t[2], t[0]))).sqrt() / 2.0).sum();
+    let typical = (area / to.len().max(1) as f64).sqrt();
+    let grid = Grid::new(to, (2.0 * typical).max(diag / 400.0).max(1e-3));
+    let mut seen = vec![0u32; to.len()];
+    let (mut max, mut sum, mut worst, mut n) = (0.0f64, 0.0, [0.0; 3], 0usize);
+    for (i, p) in samples(from).into_iter().enumerate() {
+        let d = grid.distance(p, cap, &mut seen, i as u32 + 1);
+        sum += d;
+        n += 1;
+        if d > max {
+            max = d;
+            worst = p;
+        }
+    }
+    (max, if n > 0 { sum / n as f64 } else { 0.0 }, worst)
+}
+
+/// Sampled symmetric Hausdorff distance between two triangle soups (distances capped at `cap`).
+pub struct Hausdorff {
+    pub a_to_b: f64,
+    pub b_to_a: f64,
+    pub mean: f64,
+    /// Where the larger one-sided distance was found (mm, world).
+    pub worst_at: [f64; 3],
+}
+
+pub fn hausdorff(a_mesh: &[Tri], b_mesh: &[Tri], cap: f64) -> Hausdorff {
+    let (a, am, ap) = one_sided(a_mesh, b_mesh, cap);
+    let (b, bm, bp) = one_sided(b_mesh, a_mesh, cap);
+    Hausdorff { a_to_b: a, b_to_a: b, mean: (am + bm) / 2.0, worst_at: if a >= b { ap } else { bp } }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn cube(s: f64, o: [f64; 3]) -> Vec<Tri> {
+        let v = |x: f64, y: f64, z: f64| [o[0] + x * s, o[1] + y * s, o[2] + z * s];
+        let q = |a: [f64; 3], b: [f64; 3], c: [f64; 3], d: [f64; 3]| vec![[a, b, c], [a, c, d]];
+        let mut t = Vec::new();
+        t.extend(q(v(0., 0., 0.), v(0., 1., 0.), v(1., 1., 0.), v(1., 0., 0.)));
+        t.extend(q(v(0., 0., 1.), v(1., 0., 1.), v(1., 1., 1.), v(0., 1., 1.)));
+        t.extend(q(v(0., 0., 0.), v(1., 0., 0.), v(1., 0., 1.), v(0., 0., 1.)));
+        t.extend(q(v(0., 1., 0.), v(0., 1., 1.), v(1., 1., 1.), v(1., 1., 0.)));
+        t.extend(q(v(0., 0., 0.), v(0., 0., 1.), v(0., 1., 1.), v(0., 1., 0.)));
+        t.extend(q(v(1., 0., 0.), v(1., 1., 0.), v(1., 1., 1.), v(1., 0., 1.)));
+        t
+    }
+
+    #[test]
+    fn box_moments_and_distance() {
+        let c = cube(10.0, [5.0, -3.0, 2.0]);
+        let (v, com, pm) = mass_properties(&c);
+        assert!((v - 1000.0).abs() < 1e-9 && (com[0] - 10.0).abs() < 1e-9 && (com[2] - 7.0).abs() < 1e-9);
+        // V·(a²+b²)/12 for a cube of side 10: 1000·200/12.
+        for m in pm {
+            assert!((m - 1000.0 * 200.0 / 12.0).abs() < 1e-6, "{pm:?}");
+        }
+        let moved = cube(10.0, [5.0, -3.0, 2.3]);
+        let h = hausdorff(&c, &moved, 1.0);
+        assert!((h.a_to_b - 0.3).abs() < 1e-9 && (h.b_to_a - 0.3).abs() < 1e-9);
+        let same = hausdorff(&c, &c, 1.0);
+        assert!(same.a_to_b < 1e-12);
+    }
+}

apps/solidcraft-cli/tests/bracket_example.rs

@@ -0,0 +1,62 @@
+//! The bracket example must cut two through holes, rather than successfully cutting empty
+//! space beside the body. Check the shipped script and rebuild its saved design from scratch.
+
+use std::f64::consts::PI;
+
+use serde_json::Value;
+use solidcraft_engine::geom::Vec3;
+use solidcraft_engine::{Session, io, kernel};
+
+fn assert_two_through_holes(session: &Session, stage: &str) {
+    let errors: Vec<_> = session.model.results.iter().filter_map(|r| r.error.as_ref().map(|e| (&r.name, e))).collect();
+    assert!(errors.is_empty(), "{stage}: every example feature evaluates: {errors:?}");
+
+    let cut = session.doc.features.last().expect("the example ends with the hole cut");
+    let before = session.model.state_before(cut.id);
+    let after = session.model.state();
+    assert_eq!(before.bodies.len(), 1, "{stage}: one bracket before cutting the holes");
+    assert_eq!(after.bodies.len(), 1, "{stage}: the holes leave one bracket");
+    let uncut = &before.body("Bracket").expect("the uncut bracket").body;
+    let bracket = &after.body("Bracket").expect("the finished bracket").body;
+
+    // Measure the actual state before the final cut so the existing edge fillet cancels out.
+    // Both holes have diameter 8 mm and pass through the 6 mm base. Kernel measurements are
+    // tessellated, so the relative tolerance applies to the removed material, not the body.
+    let removed = kernel::measure(uncut).unwrap().volume - kernel::measure(bracket).unwrap().volume;
+    let expected = 2.0 * PI * 4.0_f64.powi(2) * 6.0;
+    assert!((removed - expected).abs() < expected * 1e-3, "{stage}: the two holes remove {removed} mm³, expected {expected} mm³");
+
+    let before_mesh = uncut.tessellate(0.01).unwrap();
+    let after_mesh = bracket.tessellate(0.01).unwrap();
+    let down = Vec3::new(0.0, 0.0, -1.0);
+    for y in [-15.0, -45.0] {
+        let center = Vec3::new(25.0, y, 1.0);
+        assert_eq!(before_mesh.ray_crossings(center, down), 2, "{stage}: hole at y={y} starts over the solid base");
+        // Rays through each opening must miss the entire bracket, including its top and
+        // bottom caps. Points away from the centre guard against a narrow slit or shifted cut.
+        for (dx, dy) in [(0.0, 0.0), (3.0, 0.0), (-3.0, 0.0), (0.0, 3.0), (0.0, -3.0)] {
+            let ray = center + Vec3::new(dx, dy, 0.0);
+            assert_eq!(after_mesh.ray_crossings(ray, down), 0, "{stage}: the hole at y={y} is open through both caps at ({dx}, {dy})");
+        }
+        // Material just outside each radius remains, so neither opening is an edge notch.
+        for (dx, dy) in [(5.0, 0.0), (-5.0, 0.0), (0.0, 5.0), (0.0, -5.0)] {
+            let ray = center + Vec3::new(dx, dy, 0.0);
+            assert_eq!(after_mesh.ray_crossings(ray, down), 2, "{stage}: material remains around the hole at y={y}, offset ({dx}, {dy})");
+        }
+    }
+}
+
+#[test]
+fn bracket_example_cuts_two_through_holes_and_reopens() {
+    let script: Value = serde_json::from_str(include_str!("../../../examples/bracket.json")).unwrap();
+    let mut session = Session::default();
+    session.run_script(&script).unwrap();
+    assert_two_through_holes(&session, "script");
+
+    // No geometry cache is supplied: reopening the container re-evaluates the saved timeline.
+    let saved = io::write_design_container(&session.doc).unwrap();
+    let document = io::read_design(&saved).unwrap();
+    assert_eq!(document.features, session.doc.features, "saving preserves the example's feature parameters");
+    let reopened = Session::new(document);
+    assert_two_through_holes(&reopened, "reopened");
+}

apps/solidcraft-cli/tests/commands_output.rs

@@ -0,0 +1,26 @@
+//! The registry remains valid JSON and a closed pipeline reader must not cause a panic.
+
+use std::process::{Command, Stdio};
+
+#[test]
+fn registry_output_is_complete_json() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("commands").output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    let registry: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    let commands = registry.as_array().unwrap();
+    assert!(commands.iter().any(|command| command["id"] == "solid.box"));
+    assert!(commands.iter().any(|command| command["id"] == "engine.commands"));
+    assert!(output.stdout.ends_with(b"\n"));
+    assert!(output.stderr.is_empty());
+}
+
+#[test]
+fn closed_registry_pipe_exits_without_panicking() {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("commands").stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    // Close our read end before waiting. No sleeps or timing threshold are needed:
+    // the registry is larger than the pipe buffer, so it cannot all be written first.
+    drop(child.stdout.take());
+    let output = child.wait_with_output().unwrap();
+    assert!(output.status.success(), "status: {}; stderr: {}", output.status, String::from_utf8_lossy(&output.stderr));
+    assert!(output.stderr.is_empty(), "{}", String::from_utf8_lossy(&output.stderr));
+}

apps/solidcraft-cli/tests/corpus/README.md

@@ -0,0 +1,28 @@
+# Design file corpus
+
+Designs saved by older SolidCraft builds. `tests/design_corpus.rs` opens each one with the
+current build and checks that it evaluates as it did when saved (the `.expected.json` next to
+it is `solidcraft-cli eval` of that file by the build that saved it: bodies, volumes, areas,
+world bounding boxes), that it is upgraded to the current file format, and that damaged and
+hostile variants of it never panic.
+
+| File | Saved by | Era |
+|---|---|---|
+| `m0-box-fillet-hole` | 3714342 | M0: sketch, parameters, extrude, fillet, cut |
+| `m0-revolve-primitives` | 3714342 | M0: revolve, primitives, combine, chamfer, timeline edit |
+| `components-arm` | 97d03e3 | components and occurrences: move, copy, Paste New, ground |
+| `joints-hinge` | c2309eb | joints: revolute hinge driven by a parameter |
+| `modern-sheet-metal` | bd98035 | sheet metal contour flange (oracle 72) |
+| `modern-path-pattern` | bd98035 | pattern on path (oracle 53) |
+| `modern-plastic` | bd98035 | shell, lip, boss, rest, snap fit, plastic rule |
+| `naming-split-pieces` | 9a979cf | format 13 names: a slot splits the top; fillet, chamfer and offset face name its pieces by number (`F2:top#2`) |
+| `move-bodies` | 00baf1d | `solid.move` before it could copy: two bodies, one translated in place, one translated and turned 90 deg about Z (no `copy` key anywhere in the file) |
+| `split-body-pieces` | v0.3.2 (07e263d) | a slot along X cuts a block into two bodies; a fillet, a chamfer and an appearance refer to the pieces by body name (`Body1`, `Body1 (1)`) |
+| `issue-489-stacked-join` | v0.6.0 (809ecf7), desktop | a 70 × 84 extrude, then a 70 × 62 strip joined on its top face, sketched partly over the face's projected edges (issue #489; expected values from main at 2880525) |
+| `issue-616-lid-ribs` | v0.7.0 (a9879fa), CLI | a rounded lid with a skirt ring, a window and a slot cut through, then four ribs joined on the plate over the skirt, flush with the window's sides; v0.7.0 displaced the ribs and left a slit through the skirt and plate (issue #616; script `examples/regressions/lid_ribs_flush_with_window.json`, expected values from the fix) |
+
+The scripts that made them are in `scripts/` (`issue-489-stacked-join` was drawn in the desktop
+app and has none; `issue-616-lid-ribs` is made by its regression script). Every flat face of every final body must also take an attached sketch and an
+offset plane; the faces that can't yet are listed with their issues in `design_corpus.rs`.
+
+Never regenerate a file with a newer build: the point is that it was written by the old one. Add new files for new eras instead.

apps/solidcraft-cli/tests/corpus/components-arm.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [],

apps/solidcraft-cli/tests/corpus/issue-489-stacked-join.expected.json

@@ -0,0 +1,157 @@
+{
+  "bodies": [
+    {
+      "area_mm2": 25751.999999999945,
+      "bbox": {
+        "max": [
+          35.0,
+          42.0,
+          48.00000000000001
+        ],
+        "min": [
+          -35.0,
+          -42.000000000000014,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        5.524909928104648e-14,
+        -1.0945382096961234e-12,
+        22.366336633663238
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 24,
+      "face_types": {
+        "plane": 10
+      },
+      "faces": 10,
+      "kernel": {
+        "edges": 24,
+        "faces": 10,
+        "shells": 1,
+        "vertices": 16
+      },
+      "mass_g": 328.33079999999734,
+      "material": "Default",
+      "name": "Body1",
+      "vertices": 16,
+      "volume_mm3": 254519.9999999979
+    }
+  ],
+  "body_count": 1,
+  "params": [
+    {
+      "comment": "",
+      "error": null,
+      "expression": "84",
+      "model": true,
+      "name": "d1",
+      "unit": "mm",
+      "value": 84.0
+    },
+    {
+      "comment": "",
+      "error": null,
+      "expression": "70",
+      "model": true,
+      "name": "d2",
+      "unit": "mm",
+      "value": 70.0
+    },
+    {
+      "comment": "",
+      "error": null,
+      "expression": "62",
+      "model": true,
+      "name": "d4",
+      "unit": "mm",
+      "value": 62.0
+    }
+  ],
+  "sketches": [
+    {
+      "curves": 6,
+      "dof": 0,
+      "id": 1,
+      "name": "Sketch1",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    },
+    {
+      "curves": 10,
+      "dof": 1,
+      "id": 3,
+      "name": "Sketch2",
+      "profiles": 3,
+      "status": "solved",
+      "visible": false
+    }
+  ],
+  "timeline": [
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 1,
+      "ms": 0.131943,
+      "name": "Sketch1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 2,
+      "ms": 1.0812709999999999,
+      "name": "Extrude1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 3,
+      "ms": 0.450002,
+      "name": "Sketch2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 4,
+      "ms": 5.191514000000001,
+      "name": "Extrude2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    }
+  ],
+  "total": {
+    "area_mm2": 25751.999999999945,
+    "edges": 24,
+    "faces": 10,
+    "mass_g": 328.33079999999734,
+    "vertices": 16,
+    "volume_mm3": 254519.9999999979
+  }
+}

apps/solidcraft-cli/tests/corpus/issue-489-stacked-join.solidcraft

@@ -0,0 +1,539 @@
+{
+  "features": [
+    {
+      "id": 1,
+      "name": "Sketch1",
+      "plane": {
+        "name": "XY",
+        "type": "origin"
+      },
+      "sketch": {
+        "constraints": [
+          {
+            "id": "k1",
+            "l": 0,
+            "type": "horizontal"
+          },
+          {
+            "id": "k2",
+            "l": 2,
+            "type": "horizontal"
+          },
+          {
+            "id": "k3",
+            "l": 1,
+            "type": "vertical"
+          },
+          {
+            "id": "k4",
+            "l": 3,
+            "type": "vertical"
+          },
+          {
+            "id": "k5",
+            "l": 4,
+            "p": 5,
+            "type": "midpoint"
+          },
+          {
+            "id": "k6",
+            "p": 0,
+            "q": 5,
+            "type": "coincident"
+          },
+          {
+            "id": "k7",
+            "l": 1,
+            "param": "d1",
+            "type": "length",
+            "value": 84.0
+          },
+          {
+            "id": "k8",
+            "l": 0,
+            "param": "d2",
+            "type": "length",
+            "value": 70.0
+          }
+        ],
+        "counters": {
+          "k": 8,
+          "l": 6,
+          "p": 5
+        },
+        "curves": [
+          {
+            "a": 1,
+            "b": 2,
+            "construction": false,
+            "id": "l1",
+            "type": "line"
+          },
+          {
+            "a": 2,
+            "b": 3,
+            "construction": false,
+            "id": "l2",
+            "type": "line"
+          },
+          {
+            "a": 3,
+            "b": 4,
+            "construction": false,
+            "id": "l3",
+            "type": "line"
+          },
+          {
+            "a": 4,
+            "b": 1,
+            "construction": false,
+            "id": "l4",
+            "type": "line"
+          },
+          {
+            "a": 1,
+            "b": 3,
+            "construction": true,
+            "id": "l5",
+            "type": "line"
+          },
+          {
+            "a": 2,
+            "b": 4,
+            "construction": true,
+            "id": "l6",
+            "type": "line"
+          }
+        ],
+        "points": [
+          {
+            "fixed": true,
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p1",
+            "pos": [
+              -35.0,
+              -42.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p2",
+            "pos": [
+              35.0,
+              -42.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p3",
+            "pos": [
+              35.0,
+              42.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p4",
+            "pos": [
+              -35.0,
+              42.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p5",
+            "pos": [
+              0.0,
+              0.0
+            ]
+          }
+        ]
+      },
+      "suppressed": false,
+      "type": "sketch"
+    },
+    {
+      "extent": {
+        "direction": "positive",
+        "distance": "30"
+      },
+      "id": 2,
+      "name": "Extrude1",
+      "operation": "new_body",
+      "param_names": [
+        "d3"
+      ],
+      "profiles": {
+        "loops": [
+          [
+            "l1",
+            "l2",
+            "l3",
+            "l4"
+          ]
+        ],
+        "type": "curves"
+      },
+      "sketch": 1,
+      "suppressed": false,
+      "type": "extrude"
+    },
+    {
+      "id": 3,
+      "name": "Sketch2",
+      "plane": {
+        "anchor": {
+          "author_path": [],
+          "component": 0,
+          "coordinates": [
+            0.0,
+            0.0
+          ],
+          "path": [],
+          "target": {
+            "body": "Body1",
+            "certificate": {
+              "high": true,
+              "holes": [],
+              "kind": "extrude_cap",
+              "outer": [
+                "l1",
+                "l2",
+                "l3",
+                "l4"
+              ],
+              "sketch": 1
+            },
+            "name": "F2:cap:high:ed6121d9bed14d3fd103f347231990d103349f33b7874ad292d3c4d3539266c3",
+            "origin_feature": 2,
+            "point": [
+              0.0,
+              0.0,
+              30.0
+            ]
+          },
+          "x_axis": [
+            1.0,
+            0.0
+          ]
+        },
+        "at": [
+          2.012802880253332,
+          7.4635742926698185,
+          30.000000000000114
+        ],
+        "name": "F2:top",
+        "plane": {
+          "origin": [
+            0.0,
+            0.0,
+            30.0
+          ],
+          "x_dir": [
+            1.0,
+            0.0,
+            0.0
+          ],
+          "y_dir": [
+            0.0,
+            1.0,
+            0.0
+          ]
+        },
+        "type": "face"
+      },
+      "sketch": {
+        "constraints": [
+          {
+            "id": "k1",
+            "l": 4,
+            "type": "horizontal"
+          },
+          {
+            "id": "k2",
+            "l": 6,
+            "type": "horizontal"
+          },
+          {
+            "id": "k3",
+            "l": 5,
+            "type": "vertical"
+          },
+          {
+            "id": "k4",
+            "l": 7,
+            "type": "vertical"
+          },
+          {
+            "id": "k5",
+            "l": 8,
+            "p": 9,
+            "type": "midpoint"
+          },
+          {
+            "id": "k6",
+            "p": 0,
+            "q": 9,
+            "type": "coincident"
+          },
+          {
+            "id": "k7",
+            "p": 7,
+            "param": "d4",
+            "q": 6,
+            "text": [
+              -0.2,
+              9.200000000000003
+            ],
+            "type": "distance",
+            "value": 62.0
+          }
+        ],
+        "counters": {
+          "j": 1,
+          "k": 7,
+          "l": 10,
+          "p": 9
+        },
+        "curves": [
+          {
+            "a": 1,
+            "b": 2,
+            "construction": false,
+            "id": "l1",
+            "link": "j1",
+            "type": "line"
+          },
+          {
+            "a": 3,
+            "b": 1,
+            "construction": false,
+            "id": "l2",
+            "link": "j1",
+            "type": "line"
+          },
+          {
+            "a": 2,
+            "b": 4,
+            "construction": false,
+            "id": "l3",
+            "link": "j1",
+            "type": "line"
+          },
+          {
+            "a": 4,
+            "b": 3,
+            "construction": false,
+            "id": "l4",
+            "link": "j1",
+            "type": "line"
+          },
+          {
+            "a": 5,
+            "b": 6,
+            "construction": false,
+            "id": "l5",
+            "type": "line"
+          },
+          {
+            "a": 6,
+            "b": 7,
+            "construction": false,
+            "id": "l6",
+            "type": "line"
+          },
+          {
+            "a": 7,
+            "b": 8,
+            "construction": false,
+            "id": "l7",
+            "type": "line"
+          },
+          {
+            "a": 8,
+            "b": 5,
+            "construction": false,
+            "id": "l8",
+            "type": "line"
+          },
+          {
+            "a": 5,
+            "b": 7,
+            "construction": true,
+            "id": "l9",
+            "type": "line"
+          },
+          {
+            "a": 6,
+            "b": 8,
+            "construction": true,
+            "id": "l10",
+            "type": "line"
+          }
+        ],
+        "links": [
+          {
+            "auto_face": true,
+            "face_name": "F2:cap:high:ed6121d9bed14d3fd103f347231990d103349f33b7874ad292d3c4d3539266c3",
+            "id": "j1",
+            "kind": "project",
+            "source": {
+              "at": [
+                11.666666666666666,
+                -13.999999999999995,
+                30.0
+              ],
+              "body": "Body1",
+              "type": "face"
+            }
+          }
+        ],
+        "points": [
+          {
+            "fixed": true,
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ]
+          },
+          {
+            "fixed": true,
+            "id": "p1",
+            "link": "j1",
+            "pos": [
+              -35.0,
+              -42.0
+            ]
+          },
+          {
+            "fixed": true,
+            "id": "p2",
+            "link": "j1",
+            "pos": [
+              -35.0,
+              42.0
+            ]
+          },
+          {
+            "fixed": true,
+            "id": "p3",
+            "link": "j1",
+            "pos": [
+              35.0,
+              -42.0
+            ]
+          },
+          {
+            "fixed": true,
+            "id": "p4",
+            "link": "j1",
+            "pos": [
+              35.0,
+              42.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p5",
+            "pos": [
+              -35.0,
+              -31.000000000002185
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p6",
+            "pos": [
+              35.0,
+              -31.00000000000349
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p7",
+            "pos": [
+              35.0,
+              30.99999999999603
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p8",
+            "pos": [
+              -35.0,
+              30.999999999995318
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p9",
+            "pos": [
+              0.0,
+              0.0
+            ]
+          }
+        ]
+      },
+      "suppressed": false,
+      "type": "sketch"
+    },
+    {
+      "extent": {
+        "direction": "positive",
+        "distance": "18"
+      },
+      "id": 4,
+      "name": "Extrude2",
+      "operation": "join",
+      "param_names": [
+        "d5"
+      ],
+      "profiles": {
+        "loops": [
+          [
+            "l1",
+            "l5",
+            "l4",
+            "l7"
+          ]
+        ],
+        "type": "curves"
+      },
+      "sketch": 3,
+      "suppressed": false,
+      "type": "extrude"
+    }
+  ],
+  "format": "solidcraft/14",
+  "name": "Untitled",
+  "next_id": 6,
+  "params": [
+    {
+      "expr": "84",
+      "model": true,
+      "name": "d1",
+      "unit": "mm"
+    },
+    {
+      "expr": "70",
+      "model": true,
+      "name": "d2",
+      "unit": "mm"
+    },
+    {
+      "expr": "62",
+      "model": true,
+      "name": "d4",
+      "unit": "mm"
+    }
+  ],
+  "units": "mm"
+}

apps/solidcraft-cli/tests/corpus/issue-616-lid-ribs.expected.json

@@ -0,0 +1,227 @@
+{
+  "bodies": [
+    {
+      "area_mm2": 8430.29544246263,
+      "bbox": {
+        "max": [
+          176.8000000000002,
+          89.30000000000001,
+          14.100000000000001
+        ],
+        "min": [
+          99.99999999999991,
+          -1.820765760385257e-14,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        138.3999999716193,
+        51.04392591016203,
+        2.0990634391586322
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 156,
+      "face_types": {
+        "cylinder": 4,
+        "plane": 50
+      },
+      "faces": 54,
+      "kernel": {
+        "edges": 156,
+        "faces": 54,
+        "shells": 1,
+        "vertices": 104
+      },
+      "mass_g": 9.101726874183207,
+      "material": "Default",
+      "name": "Lid",
+      "vertices": 104,
+      "volume_mm3": 7055.602228048997
+    }
+  ],
+  "body_count": 1,
+  "params": [],
+  "sketches": [
+    {
+      "curves": 8,
+      "dof": 8,
+      "id": 3,
+      "name": "Skirt",
+      "profiles": 2,
+      "status": "solved",
+      "visible": false
+    }
+  ],
+  "timeline": [
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 1,
+      "ms": 1.178957,
+      "name": "Box1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 2,
+      "ms": 83.24342399999999,
+      "name": "Fillet1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "FilletFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 3,
+      "ms": 0.150889,
+      "name": "Skirt",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 4,
+      "ms": 94.465481,
+      "name": "Extrude1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 5,
+      "ms": 50.426736,
+      "name": "Box2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 6,
+      "ms": 40.383005,
+      "name": "Box3",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 7,
+      "ms": 59.041461000000005,
+      "name": "Box4",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [
+          {
+            "face_shift_mm": 0.0,
+            "rotation_rad": 0.0,
+            "strategy": "planar_fallback",
+            "tolerance_mm": 0.0,
+            "translation_mm": 0.0
+          }
+        ],
+        "truncated": false
+      },
+      "error": null,
+      "id": 8,
+      "ms": 562.5477970000001,
+      "name": "Rib1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": "Boolean retry: exact planar fallback (no displacement)"
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 9,
+      "ms": 89.56076,
+      "name": "Rib2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 10,
+      "ms": 65.330634,
+      "name": "Rib3",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 11,
+      "ms": 97.229403,
+      "name": "Rib4",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "BoxFeature",
+      "warning": null
+    }
+  ],
+  "total": {
+    "area_mm2": 8430.29544246263,
+    "edges": 156,
+    "faces": 54,
+    "mass_g": 9.101726874183207,
+    "vertices": 104,
+    "volume_mm3": 7055.602228048997
+  }
+}

apps/solidcraft-cli/tests/corpus/issue-616-lid-ribs.solidcraft

@@ -0,0 +1,507 @@
+{
+  "features": [
+    {
+      "body_names": [
+        "Lid"
+      ],
+      "corner": [
+        100.0,
+        0.0,
+        0.0
+      ],
+      "height": "2.4",
+      "id": 1,
+      "length": "76.8",
+      "name": "Box1",
+      "operation": "new_body",
+      "param_names": [
+        "d1",
+        "d2",
+        "d3"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "89.3"
+    },
+    {
+      "edge_names": [
+        "F1:-x|F1:-y",
+        "F1:+x|F1:-y",
+        "F1:+y|F1:-x",
+        "F1:+x|F1:+y"
+      ],
+      "edge_refs": [
+        {
+          "dir": [
+            0.0,
+            0.0,
+            -1.0
+          ],
+          "max": [
+            176.8,
+            89.3,
+            2.4
+          ],
+          "min": [
+            100.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "dir": [
+            0.0,
+            0.0,
+            1.0
+          ],
+          "max": [
+            176.8,
+            89.3,
+            2.4
+          ],
+          "min": [
+            100.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "dir": [
+            0.0,
+            0.0,
+            1.0
+          ],
+          "max": [
+            176.8,
+            89.3,
+            2.4
+          ],
+          "min": [
+            100.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "dir": [
+            0.0,
+            0.0,
+            1.0
+          ],
+          "max": [
+            176.8,
+            89.3,
+            2.4
+          ],
+          "min": [
+            100.0,
+            0.0,
+            0.0
+          ]
+        }
+      ],
+      "edges": [
+        [
+          100.0,
+          0.0,
+          1.2
+        ],
+        [
+          176.8,
+          0.0,
+          1.2
+        ],
+        [
+          100.0,
+          89.3,
+          1.2
+        ],
+        [
+          176.8,
+          89.3,
+          1.2
+        ]
+      ],
+      "id": 2,
+      "name": "Fillet1",
+      "param_names": [
+        "d4"
+      ],
+      "radius": "3",
+      "suppressed": false,
+      "type": "fillet"
+    },
+    {
+      "id": 3,
+      "name": "Skirt",
+      "param_names": [
+        "d5"
+      ],
+      "plane": {
+        "base": {
+          "name": "XY",
+          "type": "origin"
+        },
+        "distance": "2.4",
+        "type": "offset"
+      },
+      "sketch": {
+        "constraints": [
+          {
+            "id": "k1",
+            "l": 0,
+            "type": "horizontal"
+          },
+          {
+            "id": "k2",
+            "l": 2,
+            "type": "horizontal"
+          },
+          {
+            "id": "k3",
+            "l": 1,
+            "type": "vertical"
+          },
+          {
+            "id": "k4",
+            "l": 3,
+            "type": "vertical"
+          },
+          {
+            "id": "k5",
+            "l": 4,
+            "type": "horizontal"
+          },
+          {
+            "id": "k6",
+            "l": 6,
+            "type": "horizontal"
+          },
+          {
+            "id": "k7",
+            "l": 5,
+            "type": "vertical"
+          },
+          {
+            "id": "k8",
+            "l": 7,
+            "type": "vertical"
+          }
+        ],
+        "counters": {
+          "k": 8,
+          "l": 8,
+          "p": 8
+        },
+        "curves": [
+          {
+            "a": 1,
+            "b": 2,
+            "construction": false,
+            "id": "l1",
+            "type": "line"
+          },
+          {
+            "a": 2,
+            "b": 3,
+            "construction": false,
+            "id": "l2",
+            "type": "line"
+          },
+          {
+            "a": 3,
+            "b": 4,
+            "construction": false,
+            "id": "l3",
+            "type": "line"
+          },
+          {
+            "a": 4,
+            "b": 1,
+            "construction": false,
+            "id": "l4",
+            "type": "line"
+          },
+          {
+            "a": 5,
+            "b": 6,
+            "construction": false,
+            "id": "l5",
+            "type": "line"
+          },
+          {
+            "a": 6,
+            "b": 7,
+            "construction": false,
+            "id": "l6",
+            "type": "line"
+          },
+          {
+            "a": 7,
+            "b": 8,
+            "construction": false,
+            "id": "l7",
+            "type": "line"
+          },
+          {
+            "a": 8,
+            "b": 5,
+            "construction": false,
+            "id": "l8",
+            "type": "line"
+          }
+        ],
+        "points": [
+          {
+            "fixed": true,
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p1",
+            "pos": [
+              102.65,
+              2.65
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p2",
+            "pos": [
+              174.15,
+              2.65
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p3",
+            "pos": [
+              174.15,
+              86.65
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p4",
+            "pos": [
+              102.65,
+              86.65
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p5",
+            "pos": [
+              104.15,
+              4.15
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p6",
+            "pos": [
+              172.65,
+              4.15
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p7",
+            "pos": [
+              172.65,
+              85.15
+            ]
+          },
+          {
+            "fixed": false,
+            "id": "p8",
+            "pos": [
+              104.15,
+              85.15
+            ]
+          }
+        ]
+      },
+      "suppressed": false,
+      "type": "sketch"
+    },
+    {
+      "extent": {
+        "direction": "positive",
+        "distance": "3"
+      },
+      "id": 4,
+      "name": "Extrude1",
+      "operation": "join",
+      "param_names": [
+        "d6"
+      ],
+      "profiles": {
+        "loops": [
+          [
+            "l1",
+            "l2",
+            "l3",
+            "l4"
+          ]
+        ],
+        "type": "curves"
+      },
+      "sketch": 3,
+      "suppressed": false,
+      "targets": [
+        "Lid"
+      ],
+      "type": "extrude"
+    },
+    {
+      "corner": [
+        104.4,
+        5.4,
+        -1.0
+      ],
+      "height": "8",
+      "id": 5,
+      "length": "68",
+      "name": "Box2",
+      "operation": "cut",
+      "param_names": [
+        "d7",
+        "d8",
+        "d9"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "61"
+    },
+    {
+      "corner": [
+        116.4,
+        72.0,
+        -1.0
+      ],
+      "height": "8",
+      "id": 6,
+      "length": "44",
+      "name": "Box3",
+      "operation": "cut",
+      "param_names": [
+        "d10",
+        "d11",
+        "d12"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "10"
+    },
+    {
+      "corner": [
+        127.4,
+        84.0,
+        2.4
+      ],
+      "height": "4",
+      "id": 7,
+      "length": "22",
+      "name": "Box4",
+      "operation": "cut",
+      "param_names": [
+        "d13",
+        "d14",
+        "d15"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "6"
+    },
+    {
+      "corner": [
+        102.8,
+        14.0,
+        2.4
+      ],
+      "height": "11.7",
+      "id": 8,
+      "length": "1.6",
+      "name": "Rib1",
+      "operation": "join",
+      "param_names": [
+        "d16",
+        "d17",
+        "d18"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "6"
+    },
+    {
+      "corner": [
+        102.8,
+        48.0,
+        2.4
+      ],
+      "height": "11.7",
+      "id": 9,
+      "length": "1.6",
+      "name": "Rib2",
+      "operation": "join",
+      "param_names": [
+        "d19",
+        "d20",
+        "d21"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "6"
+    },
+    {
+      "corner": [
+        172.4,
+        14.0,
+        2.4
+      ],
+      "height": "11.7",
+      "id": 10,
+      "length": "1.6",
+      "name": "Rib3",
+      "operation": "join",
+      "param_names": [
+        "d22",
+        "d23",
+        "d24"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "6"
+    },
+    {
+      "corner": [
+        172.4,
+        48.0,
+        2.4
+      ],
+      "height": "11.7",
+      "id": 11,
+      "length": "1.6",
+      "name": "Rib4",
+      "operation": "join",
+      "param_names": [
+        "d25",
+        "d26",
+        "d27"
+      ],
+      "suppressed": false,
+      "type": "box",
+      "width": "6"
+    }
+  ],
+  "format": "solidcraft/15",
+  "name": "issue-616-lid-ribs",
+  "next_id": 12,
+  "params": [],
+  "units": "mm"
+}

apps/solidcraft-cli/tests/corpus/joints-hinge.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [

apps/solidcraft-cli/tests/corpus/m0-box-fillet-hole.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [

apps/solidcraft-cli/tests/corpus/m0-revolve-primitives.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [],

apps/solidcraft-cli/tests/corpus/modern-path-pattern.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [],

apps/solidcraft-cli/tests/corpus/modern-plastic.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [

apps/solidcraft-cli/tests/corpus/modern-sheet-metal.solidcraft

@@ -1,5 +1,5 @@
 {
-  "format": "solvecraft/1",
+  "format": "solidcraft/1",
   "name": "Untitled",
   "units": "mm",
   "params": [],

apps/solidcraft-cli/tests/corpus/move-bodies.expected.json

@@ -0,0 +1,194 @@
+{
+  "bodies": [
+    {
+      "area_mm2": 2400.0,
+      "bbox": {
+        "max": [
+          50.0,
+          20.0,
+          20.0
+        ],
+        "min": [
+          30.0,
+          0.0,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        40.0,
+        10.0,
+        10.0
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 12,
+      "face_types": {
+        "plane": 6
+      },
+      "faces": 6,
+      "kernel": {
+        "edges": 12,
+        "faces": 6,
+        "shells": 1,
+        "vertices": 8
+      },
+      "mass_g": 10.32,
+      "material": "Default",
+      "name": "Block",
+      "vertices": 8,
+      "volume_mm3": 8000.0
+    },
+    {
+      "area_mm2": 600.0,
+      "bbox": {
+        "max": [
+          3.552713678800501e-15,
+          90.0,
+          10.0
+        ],
+        "min": [
+          -9.999999999999998,
+          80.0,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        -4.999999999999999,
+        85.0,
+        5.000000000000001
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 12,
+      "face_types": {
+        "plane": 6
+      },
+      "faces": 6,
+      "kernel": {
+        "edges": 12,
+        "faces": 6,
+        "shells": 1,
+        "vertices": 8
+      },
+      "mass_g": 1.29,
+      "material": "Default",
+      "name": "Peg",
+      "vertices": 8,
+      "volume_mm3": 1000.0
+    }
+  ],
+  "body_count": 2,
+  "params": [],
+  "sketches": [
+    {
+      "curves": 4,
+      "dof": 2,
+      "id": 1,
+      "name": "Base",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    },
+    {
+      "curves": 4,
+      "dof": 4,
+      "id": 3,
+      "name": "Peg",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    }
+  ],
+  "timeline": [
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 1,
+      "ms": 0.204585,
+      "name": "Base",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 2,
+      "ms": 2.318662,
+      "name": "Extrude1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 3,
+      "ms": 0.109196,
+      "name": "Peg",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 4,
+      "ms": 0.338859,
+      "name": "Extrude2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 5,
+      "ms": 0.312259,
+      "name": "Move1",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "MoveFeature",
+      "warning": null
+    },
+    {
+      "boolean_diagnostics": {
+        "events": [],
+        "truncated": false
+      },
+      "error": null,
+      "id": 6,
+      "ms": 0.23144699999999999,
+      "name": "Move2",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "MoveFeature",
+      "warning": null
+    }
+  ],
+  "total": {
+    "area_mm2": 3000.0,
+    "edges": 24,
+    "faces": 12,
+    "mass_g": 11.61,
+    "vertices": 16,
+    "volume_mm3": 9000.0
+  }
+}

apps/solidcraft-cli/tests/corpus/move-bodies.solidcraft

@@ -0,0 +1 @@
+{"features":[{"id":1,"name":"Base","plane":{"name":"XY","type":"origin"},"sketch":{"constraints":[{"id":"k1","l":0,"type":"horizontal"},{"id":"k2","l":2,"type":"horizontal"},{"id":"k3","l":1,"type":"vertical"},{"id":"k4","l":3,"type":"vertical"},{"id":"k5","p":0,"q":1,"type":"coincident"}],"counters":{"k":5,"l":4,"p":4},"curves":[{"a":1,"b":2,"construction":false,"id":"l1","type":"line"},{"a":2,"b":3,"construction":false,"id":"l2","type":"line"},{"a":3,"b":4,"construction":false,"id":"l3","type":"line"},{"a":4,"b":1,"construction":false,"id":"l4","type":"line"}],"points":[{"fixed":true,"id":"origin","pos":[0.0,0.0]},{"fixed":false,"id":"p1","pos":[0.0,0.0]},{"fixed":false,"id":"p2","pos":[20.0,0.0]},{"fixed":false,"id":"p3","pos":[20.0,20.0]},{"fixed":false,"id":"p4","pos":[0.0,20.0]}]},"suppressed":false,"type":"sketch"},{"body_names":["Block"],"extent":{"direction":"positive","distance":"20"},"id":2,"name":"Extrude1","operation":"new_body","param_names":["d1"],"profiles":{"type":"all"},"sketch":1,"suppressed":false,"type":"extrude"},{"id":3,"name":"Peg","plane":{"name":"XY","type":"origin"},"sketch":{"constraints":[{"id":"k1","l":0,"type":"horizontal"},{"id":"k2","l":2,"type":"horizontal"},{"id":"k3","l":1,"type":"vertical"},{"id":"k4","l":3,"type":"vertical"}],"counters":{"k":4,"l":4,"p":4},"curves":[{"a":1,"b":2,"construction":false,"id":"l1","type":"line"},{"a":2,"b":3,"construction":false,"id":"l2","type":"line"},{"a":3,"b":4,"construction":false,"id":"l3","type":"line"},{"a":4,"b":1,"construction":false,"id":"l4","type":"line"}],"points":[{"fixed":true,"id":"origin","pos":[0.0,0.0]},{"fixed":false,"id":"p1","pos":[40.0,0.0]},{"fixed":false,"id":"p2","pos":[50.0,0.0]},{"fixed":false,"id":"p3","pos":[50.0,10.0]},{"fixed":false,"id":"p4","pos":[40.0,10.0]}]},"suppressed":false,"type":"sketch"},{"body_names":["Peg"],"extent":{"direction":"positive","distance":"10"},"id":4,"name":"Extrude2","operation":"new_body","param_names":["d2"],"profiles":{"type":"all"},"sketch":3,"suppressed":false,"type":"extrude"},{"bodies":["Block"],"id":5,"name":"Move1","param_names":["d3","d4","d5"],"suppressed":false,"translate":["30","0","0"],"type":"move"},{"angle":"90 deg","bodies":["Peg"],"id":6,"name":"Move2","param_names":["d6","d7","d8","d9"],"rotate_axis":[0.0,0.0,1.0],"suppressed":false,"translate":["0","40","0"],"type":"move"}],"format":"solidcraft/15","name":"old-move-bodies","next_id":7,"params":[],"units":"mm"}

apps/solidcraft-cli/tests/corpus/naming-split-pieces.expected.json

@@ -0,0 +1,144 @@
+{
+  "bodies": [
+    {
+      "area_mm2": 4078.7680390666596,
+      "bbox": {
+        "max": [
+          40.0,
+          30.000000000000014,
+          12.000000000000002
+        ],
+        "min": [
+          0.0,
+          0.0,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        19.25890231218174,
+        15.000000010054242,
+        5.04117761026949
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 30,
+      "face_types": {
+        "cylinder": 1,
+        "plane": 11
+      },
+      "faces": 12,
+      "kernel": {
+        "edges": 30,
+        "faces": 12,
+        "shells": 1,
+        "vertices": 20
+      },
+      "mass_g": 14.435720327850033,
+      "material": "Default",
+      "name": "Body1",
+      "vertices": 20,
+      "volume_mm3": 11190.480874302351
+    }
+  ],
+  "body_count": 1,
+  "params": [],
+  "sketches": [
+    {
+      "curves": 4,
+      "dof": 2,
+      "id": 1,
+      "name": "Base",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    },
+    {
+      "curves": 4,
+      "dof": 4,
+      "id": 3,
+      "name": "SlotSketch",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    }
+  ],
+  "timeline": [
+    {
+      "error": null,
+      "id": 1,
+      "ms": 0.09895799999999999,
+      "name": "Base",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 2,
+      "ms": 20.768292000000002,
+      "name": "Block",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 3,
+      "ms": 0.057,
+      "name": "SlotSketch",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 4,
+      "ms": 136.28875,
+      "name": "Slot",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 5,
+      "ms": 153.58625,
+      "name": "Round",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "FilletFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 6,
+      "ms": 169.174375,
+      "name": "Bevel",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ChamferFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 7,
+      "ms": 47.772166,
+      "name": "Raise",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "OffsetFacesFeature",
+      "warning": null
+    }
+  ],
+  "total": {
+    "area_mm2": 4078.7680390666596,
+    "edges": 30,
+    "faces": 12,
+    "mass_g": 14.435720327850033,
+    "vertices": 20,
+    "volume_mm3": 11190.480874302351
+  }
+}

apps/solidcraft-cli/tests/corpus/naming-split-pieces.solidcraft

@@ -0,0 +1,373 @@
+{
+  "format": "solidcraft/13",
+  "name": "Untitled",
+  "units": "mm",
+  "params": [],
+  "features": [
+    {
+      "id": 1,
+      "name": "Base",
+      "suppressed": false,
+      "type": "sketch",
+      "plane": {
+        "type": "origin",
+        "name": "XY"
+      },
+      "sketch": {
+        "points": [
+          {
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": true
+          },
+          {
+            "id": "p1",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p2",
+            "pos": [
+              40.0,
+              0.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p3",
+            "pos": [
+              40.0,
+              30.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p4",
+            "pos": [
+              0.0,
+              30.0
+            ],
+            "fixed": false
+          }
+        ],
+        "curves": [
+          {
+            "id": "l1",
+            "type": "line",
+            "a": 1,
+            "b": 2,
+            "construction": false
+          },
+          {
+            "id": "l2",
+            "type": "line",
+            "a": 2,
+            "b": 3,
+            "construction": false
+          },
+          {
+            "id": "l3",
+            "type": "line",
+            "a": 3,
+            "b": 4,
+            "construction": false
+          },
+          {
+            "id": "l4",
+            "type": "line",
+            "a": 4,
+            "b": 1,
+            "construction": false
+          }
+        ],
+        "constraints": [
+          {
+            "id": "k1",
+            "type": "horizontal",
+            "l": 0
+          },
+          {
+            "id": "k2",
+            "type": "horizontal",
+            "l": 2
+          },
+          {
+            "id": "k3",
+            "type": "vertical",
+            "l": 1
+          },
+          {
+            "id": "k4",
+            "type": "vertical",
+            "l": 3
+          },
+          {
+            "id": "k5",
+            "type": "coincident",
+            "p": 0,
+            "q": 1
+          }
+        ],
+        "counters": {
+          "k": 5,
+          "l": 4,
+          "p": 4
+        }
+      }
+    },
+    {
+      "id": 2,
+      "name": "Block",
+      "suppressed": false,
+      "param_names": [
+        "d1"
+      ],
+      "type": "extrude",
+      "sketch": 1,
+      "profiles": {
+        "type": "all"
+      },
+      "extent": {
+        "distance": "10",
+        "direction": "positive"
+      },
+      "operation": "new_body"
+    },
+    {
+      "id": 3,
+      "name": "SlotSketch",
+      "suppressed": false,
+      "type": "sketch",
+      "plane": {
+        "type": "origin",
+        "name": "XY"
+      },
+      "sketch": {
+        "points": [
+          {
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": true
+          },
+          {
+            "id": "p1",
+            "pos": [
+              15.0,
+              -5.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p2",
+            "pos": [
+              25.0,
+              -5.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p3",
+            "pos": [
+              25.0,
+              35.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p4",
+            "pos": [
+              15.0,
+              35.0
+            ],
+            "fixed": false
+          }
+        ],
+        "curves": [
+          {
+            "id": "l1",
+            "type": "line",
+            "a": 1,
+            "b": 2,
+            "construction": false
+          },
+          {
+            "id": "l2",
+            "type": "line",
+            "a": 2,
+            "b": 3,
+            "construction": false
+          },
+          {
+            "id": "l3",
+            "type": "line",
+            "a": 3,
+            "b": 4,
+            "construction": false
+          },
+          {
+            "id": "l4",
+            "type": "line",
+            "a": 4,
+            "b": 1,
+            "construction": false
+          }
+        ],
+        "constraints": [
+          {
+            "id": "k1",
+            "type": "horizontal",
+            "l": 0
+          },
+          {
+            "id": "k2",
+            "type": "horizontal",
+            "l": 2
+          },
+          {
+            "id": "k3",
+            "type": "vertical",
+            "l": 1
+          },
+          {
+            "id": "k4",
+            "type": "vertical",
+            "l": 3
+          }
+        ],
+        "counters": {
+          "k": 4,
+          "l": 4,
+          "p": 4
+        }
+      }
+    },
+    {
+      "id": 4,
+      "name": "Slot",
+      "suppressed": false,
+      "param_names": [
+        "d2",
+        "d3"
+      ],
+      "type": "extrude",
+      "sketch": 3,
+      "profiles": {
+        "type": "all"
+      },
+      "extent": {
+        "distance": "10",
+        "direction": "positive",
+        "start_offset": "5"
+      },
+      "operation": "cut"
+    },
+    {
+      "id": 5,
+      "name": "Round",
+      "suppressed": false,
+      "param_names": [
+        "d4"
+      ],
+      "edge_refs": [
+        {
+          "dir": [
+            0.0,
+            -1.0,
+            0.0
+          ],
+          "min": [
+            0.0,
+            0.0,
+            0.0
+          ],
+          "max": [
+            40.0,
+            30.0,
+            10.0
+          ]
+        }
+      ],
+      "edge_names": [
+        "F2:side:l2|F2:top#2"
+      ],
+      "type": "fillet",
+      "edges": [
+        [
+          40.0,
+          15.0,
+          10.0
+        ]
+      ],
+      "radius": "2"
+    },
+    {
+      "id": 6,
+      "name": "Bevel",
+      "suppressed": false,
+      "param_names": [
+        "d5"
+      ],
+      "edge_refs": [
+        {
+          "dir": [
+            0.0,
+            1.0,
+            0.0
+          ],
+          "min": [
+            0.0,
+            0.0,
+            0.0
+          ],
+          "max": [
+            40.0,
+            30.000000000000007,
+            10.0
+          ]
+        }
+      ],
+      "edge_names": [
+        "F2:side:l4|F2:top#1"
+      ],
+      "type": "chamfer",
+      "edges": [
+        [
+          0.0,
+          15.0,
+          10.0
+        ]
+      ],
+      "distance": "1.5"
+    },
+    {
+      "id": 7,
+      "name": "Raise",
+      "suppressed": false,
+      "param_names": [
+        "d6"
+      ],
+      "face_names": [
+        "F2:top#1"
+      ],
+      "type": "offset_face",
+      "faces": [
+        [
+          7.0,
+          15.0,
+          10.0
+        ]
+      ],
+      "distance": "2"
+    }
+  ],
+  "next_id": 8
+}

apps/solidcraft-cli/tests/corpus/scripts/components-arm.json

@@ -1,6 +1,6 @@
 {"commands": [
  {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
- {"command": "component.create", "params": {"name": "Arm"}},
+ {"command": "component.create", "params": {"name": "Arm", "grounded": false}},
  {"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
  {"command": "solid.fillet", "params": {"edges": [[25, 4, 4]], "radius": 1}},
  {"command": "component.activate", "params": {"component": 0}},

apps/solidcraft-cli/tests/corpus/scripts/move-bodies.json

@@ -0,0 +1,14 @@
+{
+ "commands": [
+  {"command": "sketch.create", "params": {"plane": "XY", "name": "Base"}},
+  {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [20, 20]}},
+  {"command": "sketch.finish", "params": {}},
+  {"command": "solid.extrude", "params": {"distance": 20, "body_name": "Block"}},
+  {"command": "sketch.create", "params": {"plane": "XY", "name": "Peg"}},
+  {"command": "sketch.rectangle.two_point", "params": {"p0": [40, 0], "p1": [50, 10]}},
+  {"command": "sketch.finish", "params": {}},
+  {"command": "solid.extrude", "params": {"distance": 10, "operation": "new", "body_name": "Peg"}},
+  {"command": "solid.move", "params": {"bodies": ["Block"], "translate": [30, 0, 0]}},
+  {"command": "solid.move", "params": {"bodies": ["Peg"], "translate": [0, 40, 0], "axis": [0, 0, 1], "angle": "90 deg"}}
+ ]
+}

apps/solidcraft-cli/tests/corpus/scripts/naming-split-pieces.json

@@ -0,0 +1,111 @@
+{
+ "commands": [
+  {
+   "command": "sketch.create",
+   "params": {
+    "plane": "XY",
+    "name": "Base"
+   }
+  },
+  {
+   "command": "sketch.rectangle.two_point",
+   "params": {
+    "p0": [
+     0,
+     0
+    ],
+    "p1": [
+     40,
+     30
+    ]
+   }
+  },
+  {
+   "command": "sketch.finish",
+   "params": {}
+  },
+  {
+   "command": "solid.extrude",
+   "params": {
+    "distance": 10,
+    "name": "Block"
+   }
+  },
+  {
+   "command": "sketch.create",
+   "params": {
+    "plane": "XY",
+    "name": "SlotSketch"
+   }
+  },
+  {
+   "command": "sketch.rectangle.two_point",
+   "params": {
+    "p0": [
+     15,
+     -5
+    ],
+    "p1": [
+     25,
+     35
+    ]
+   }
+  },
+  {
+   "command": "sketch.finish",
+   "params": {}
+  },
+  {
+   "command": "solid.extrude",
+   "params": {
+    "sketch": "SlotSketch",
+    "distance": 10,
+    "start_offset": 5,
+    "operation": "cut",
+    "name": "Slot"
+   }
+  },
+  {
+   "command": "solid.fillet",
+   "params": {
+    "edges": [
+     [
+      40,
+      15,
+      10
+     ]
+    ],
+    "radius": 2,
+    "name": "Round"
+   }
+  },
+  {
+   "command": "solid.chamfer",
+   "params": {
+    "edges": [
+     [
+      0,
+      15,
+      10
+     ]
+    ],
+    "distance": 1.5,
+    "name": "Bevel"
+   }
+  },
+  {
+   "command": "solid.offset_face",
+   "params": {
+    "faces": [
+     [
+      7,
+      15,
+      10
+     ]
+    ],
+    "distance": 2,
+    "name": "Raise"
+   }
+  }
+ ]
+}

apps/solidcraft-cli/tests/corpus/scripts/split-body-pieces.json

@@ -0,0 +1,107 @@
+{
+ "commands": [
+  {
+   "command": "sketch.create",
+   "params": {
+    "plane": "XY",
+    "name": "Base"
+   }
+  },
+  {
+   "command": "sketch.rectangle.two_point",
+   "params": {
+    "p0": [
+     0,
+     0
+    ],
+    "p1": [
+     40,
+     30
+    ]
+   }
+  },
+  {
+   "command": "sketch.finish",
+   "params": {}
+  },
+  {
+   "command": "solid.extrude",
+   "params": {
+    "distance": 10,
+    "name": "Block"
+   }
+  },
+  {
+   "command": "sketch.create",
+   "params": {
+    "plane": "XY",
+    "name": "SlotSketch"
+   }
+  },
+  {
+   "command": "sketch.rectangle.two_point",
+   "params": {
+    "p0": [
+     -5,
+     12
+    ],
+    "p1": [
+     45,
+     18
+    ]
+   }
+  },
+  {
+   "command": "sketch.finish",
+   "params": {}
+  },
+  {
+   "command": "solid.extrude",
+   "params": {
+    "sketch": "SlotSketch",
+    "distance": 10,
+    "operation": "cut",
+    "name": "Slot"
+   }
+  },
+  {
+   "command": "solid.fillet",
+   "params": {
+    "edges": [
+     [
+      20,
+      0,
+      10
+     ]
+    ],
+    "radius": 2,
+    "body": "Body1 (1)",
+    "name": "NearRound"
+   }
+  },
+  {
+   "command": "solid.chamfer",
+   "params": {
+    "edges": [
+     [
+      20,
+      30,
+      10
+     ]
+    ],
+    "distance": 1.5,
+    "body": "Body1",
+    "name": "FarBevel"
+   }
+  },
+  {
+   "command": "appearance.assign",
+   "params": {
+    "bodies": [
+     "Body1 (1)"
+    ],
+    "color": "#cc3333"
+   }
+  }
+ ]
+}

apps/solidcraft-cli/tests/corpus/split-body-pieces.expected.json

@@ -0,0 +1,171 @@
+{
+  "bodies": [
+    {
+      "area_mm2": 1962.6028137423857,
+      "bbox": {
+        "max": [
+          40.0,
+          30.0,
+          10.0
+        ],
+        "min": [
+          0.0,
+          18.0,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        20.0,
+        23.94794952681388,
+        4.957413249211356
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 15,
+      "face_types": {
+        "plane": 7
+      },
+      "faces": 7,
+      "kernel": {
+        "edges": 15,
+        "faces": 7,
+        "shells": 1,
+        "vertices": 10
+      },
+      "mass_g": 6.13395,
+      "material": "Default",
+      "name": "Body1",
+      "vertices": 10,
+      "volume_mm3": 4755.0
+    },
+    {
+      "area_mm2": 1963.9401350108699,
+      "bbox": {
+        "max": [
+          40.00000000000002,
+          12.000000000000002,
+          10.0
+        ],
+        "min": [
+          -8.881784197001252e-15,
+          0.0,
+          0.0
+        ]
+      },
+      "center_of_mass": [
+        20.00000000000079,
+        6.040035701025577,
+        4.967173993940324
+      ],
+      "density_g_cm3": 1.29,
+      "edges": 15,
+      "face_types": {
+        "cylinder": 1,
+        "plane": 6
+      },
+      "faces": 7,
+      "kernel": {
+        "edges": 15,
+        "faces": 7,
+        "shells": 1,
+        "vertices": 10
+      },
+      "mass_g": 6.147677129601969,
+      "material": "Default",
+      "name": "Body1 (1)",
+      "vertices": 10,
+      "volume_mm3": 4765.64118573796
+    }
+  ],
+  "body_count": 2,
+  "params": [],
+  "sketches": [
+    {
+      "curves": 4,
+      "dof": 2,
+      "id": 1,
+      "name": "Base",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    },
+    {
+      "curves": 4,
+      "dof": 4,
+      "id": 3,
+      "name": "SlotSketch",
+      "profiles": 1,
+      "status": "solved",
+      "visible": false
+    }
+  ],
+  "timeline": [
+    {
+      "error": null,
+      "id": 1,
+      "ms": 0.07066700000000001,
+      "name": "Base",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 2,
+      "ms": 0.7462909999999999,
+      "name": "Block",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 3,
+      "ms": 0.035125,
+      "name": "SlotSketch",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "Sketch",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 4,
+      "ms": 9.647208000000001,
+      "name": "Slot",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ExtrudeFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 5,
+      "ms": 3.443708,
+      "name": "NearRound",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "FilletFeature",
+      "warning": null
+    },
+    {
+      "error": null,
+      "id": 6,
+      "ms": 3.947834,
+      "name": "FarBevel",
+      "rolled_back": false,
+      "suppressed": false,
+      "type": "ChamferFeature",
+      "warning": null
+    }
+  ],
+  "total": {
+    "area_mm2": 3926.5429487532556,
+    "edges": 30,
+    "faces": 14,
+    "mass_g": 12.281627129601969,
+    "vertices": 20,
+    "volume_mm3": 9520.64118573796
+  }
+}

apps/solidcraft-cli/tests/corpus/split-body-pieces.solidcraft

@@ -0,0 +1,366 @@
+{
+  "format": "solidcraft/13",
+  "name": "Untitled",
+  "units": "mm",
+  "params": [],
+  "features": [
+    {
+      "id": 1,
+      "name": "Base",
+      "suppressed": false,
+      "type": "sketch",
+      "plane": {
+        "type": "origin",
+        "name": "XY"
+      },
+      "sketch": {
+        "points": [
+          {
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": true
+          },
+          {
+            "id": "p1",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p2",
+            "pos": [
+              40.0,
+              0.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p3",
+            "pos": [
+              40.0,
+              30.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p4",
+            "pos": [
+              0.0,
+              30.0
+            ],
+            "fixed": false
+          }
+        ],
+        "curves": [
+          {
+            "id": "l1",
+            "type": "line",
+            "a": 1,
+            "b": 2,
+            "construction": false
+          },
+          {
+            "id": "l2",
+            "type": "line",
+            "a": 2,
+            "b": 3,
+            "construction": false
+          },
+          {
+            "id": "l3",
+            "type": "line",
+            "a": 3,
+            "b": 4,
+            "construction": false
+          },
+          {
+            "id": "l4",
+            "type": "line",
+            "a": 4,
+            "b": 1,
+            "construction": false
+          }
+        ],
+        "constraints": [
+          {
+            "id": "k1",
+            "type": "horizontal",
+            "l": 0
+          },
+          {
+            "id": "k2",
+            "type": "horizontal",
+            "l": 2
+          },
+          {
+            "id": "k3",
+            "type": "vertical",
+            "l": 1
+          },
+          {
+            "id": "k4",
+            "type": "vertical",
+            "l": 3
+          },
+          {
+            "id": "k5",
+            "type": "coincident",
+            "p": 0,
+            "q": 1
+          }
+        ],
+        "counters": {
+          "k": 5,
+          "l": 4,
+          "p": 4
+        }
+      }
+    },
+    {
+      "id": 2,
+      "name": "Block",
+      "suppressed": false,
+      "param_names": [
+        "d1"
+      ],
+      "type": "extrude",
+      "sketch": 1,
+      "profiles": {
+        "type": "all"
+      },
+      "extent": {
+        "distance": "10",
+        "direction": "positive"
+      },
+      "operation": "new_body"
+    },
+    {
+      "id": 3,
+      "name": "SlotSketch",
+      "suppressed": false,
+      "type": "sketch",
+      "plane": {
+        "type": "origin",
+        "name": "XY"
+      },
+      "sketch": {
+        "points": [
+          {
+            "id": "origin",
+            "pos": [
+              0.0,
+              0.0
+            ],
+            "fixed": true
+          },
+          {
+            "id": "p1",
+            "pos": [
+              -5.0,
+              12.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p2",
+            "pos": [
+              45.0,
+              12.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p3",
+            "pos": [
+              45.0,
+              18.0
+            ],
+            "fixed": false
+          },
+          {
+            "id": "p4",
+            "pos": [
+              -5.0,
+              18.0
+            ],
+            "fixed": false
+          }
+        ],
+        "curves": [
+          {
+            "id": "l1",
+            "type": "line",
+            "a": 1,
+            "b": 2,
+            "construction": false
+          },
+          {
+            "id": "l2",
+            "type": "line",
+            "a": 2,
+            "b": 3,
+            "construction": false
+          },
+          {
+            "id": "l3",
+            "type": "line",
+            "a": 3,
+            "b": 4,
+            "construction": false
+          },
+          {
+            "id": "l4",
+            "type": "line",
+            "a": 4,
+            "b": 1,
+            "construction": false
+          }
+        ],
+        "constraints": [
+          {
+            "id": "k1",
+            "type": "horizontal",
+            "l": 0
+          },
+          {
+            "id": "k2",
+            "type": "horizontal",
+            "l": 2
+          },
+          {
+            "id": "k3",
+            "type": "vertical",
+            "l": 1
+          },
+          {
+            "id": "k4",
+            "type": "vertical",
+            "l": 3
+          }
+        ],
+        "counters": {
+          "k": 4,
+          "l": 4,
+          "p": 4
+        }
+      }
+    },
+    {
+      "id": 4,
+      "name": "Slot",
+      "suppressed": false,
+      "param_names": [
+        "d2"
+      ],
+      "type": "extrude",
+      "sketch": 3,
+      "profiles": {
+        "type": "all"
+      },
+      "extent": {
+        "distance": "10",
+        "direction": "positive"
+      },
+      "operation": "cut"
+    },
+    {
+      "id": 5,
+      "name": "NearRound",
+      "suppressed": false,
+      "param_names": [
+        "d3"
+      ],
+      "edge_refs": [
+        {
+          "dir": [
+            -1.0,
+            0.0,
+            0.0
+          ],
+          "min": [
+            0.0,
+            0.0,
+            0.0
+          ],
+          "max": [
+            40.0,
+            12.000000000000002,
+            10.0
+          ]
+        }
+      ],
+      "edge_names": [
+        "F2:side:l1|F2:top"
+      ],
+      "type": "fillet",
+      "edges": [
+        [
+          20.0,
+          0.0,
+          10.0
+        ]
+      ],
+      "radius": "2",
+      "body": "Body1 (1)"
+    },
+    {
+      "id": 6,
+      "name": "FarBevel",
+      "suppressed": false,
+      "param_names": [
+        "d4"
+      ],
+      "edge_refs": [
+        {
+          "dir": [
+            1.0,
+            0.0,
+            0.0
+          ],
+          "min": [
+            0.0,
+            18.0,
+            0.0
+          ],
+          "max": [
+            40.0,
+            30.0,
+            10.0
+          ]
+        }
+      ],
+      "edge_names": [
+        "F2:side:l3|F2:top"
+      ],
+      "type": "chamfer",
+      "edges": [
+        [
+          20.0,
+          30.0,
+          10.0
+        ]
+      ],
+      "distance": "1.5",
+      "body": "Body1"
+    }
+  ],
+  "next_id": 7,
+  "appearances": {
+    "bodies": {
+      "Body1 (1)": {
+        "name": "Custom",
+        "color": [
+          204,
+          51,
+          51
+        ],
+        "opacity": 1.0
+      }
+    }
+  }
+}

apps/solidcraft-cli/tests/design_corpus.rs

@@ -0,0 +1,423 @@
+//! Designs saved by older SolidCraft builds (tests/corpus, see its README) open and evaluate as
+//! they did when they were saved; damaged and hostile design files never panic.
+
+use std::path::{Path, PathBuf};
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+fn corpus() -> Vec<PathBuf> {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
+    let mut v: Vec<PathBuf> =
+        std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "solidcraft")).collect();
+    v.sort();
+    assert!(v.len() >= 7, "corpus files in {}", dir.display());
+    v
+}
+
+fn open(path: &Path) -> Session {
+    let mut s = Session::default();
+    s.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+    s
+}
+
+/// Differences that are deliberate behaviour changes made before the file format had versions
+/// (no migration can tell those files apart): (file, check, why).
+const KNOWN: [(&str, &str, &str); 2] = [
+    (
+        "m0-revolve-primitives",
+        "Body1 bbox",
+        "partial revolves turn toward the sketch normal since ac43365 (as most parametric CAD tools do); M0 turned them the other way",
+    ),
+    ("components-arm", "body_count", "Measure counted only the root component's bodies then; it measures every placed body now"),
+];
+
+fn known(file: &str, check: &str) -> bool {
+    KNOWN.iter().any(|(f, c, _)| *f == file && *c == check)
+}
+
+/// Volumes and areas then came from coarser tessellation (and curved booleans and fillets have
+/// become exact since): the same part within this relative tolerance (the oracle's).
+const REL: f64 = 1e-3;
+
+fn close(a: f64, b: f64, rel: f64) -> bool {
+    (a - b).abs() <= rel * b.abs().max(1.0)
+}
+
+#[test]
+fn old_designs_open_and_evaluate_as_saved() {
+    let mut problems = Vec::new();
+    for p in corpus() {
+        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let want: Value = serde_json::from_slice(&std::fs::read(p.with_extension("expected.json")).unwrap()).unwrap();
+        let mut s = open(&p);
+        for r in &s.model.results {
+            if let Some(e) = &r.error {
+                problems.push(format!("{name}: feature {}: {e}", r.id));
+            }
+        }
+        assert_eq!(s.doc.format, solidcraft_engine::doc::format::format_string(solidcraft_engine::doc::format::FORMAT), "{name}: upgraded");
+        let got = s.execute("inspect.measure", &json!({})).unwrap();
+        if got["body_count"] != want["body_count"] && !known(&name, "body_count") {
+            problems.push(format!("{name}: {} bodies, saved with {}", got["body_count"], want["body_count"]));
+        }
+        for w in want["bodies"].as_array().into_iter().flatten() {
+            let bname = w["name"].as_str().unwrap_or_default();
+            let Some(g) = got["bodies"].as_array().into_iter().flatten().find(|g| g["name"] == w["name"]) else {
+                problems.push(format!("{name}: body {bname} missing"));
+                continue;
+            };
+            for k in ["volume_mm3", "area_mm2"] {
+                let (a, b) = (g[k].as_f64().unwrap_or(f64::NAN), w[k].as_f64().unwrap_or(f64::NAN));
+                if !close(a, b, REL) {
+                    problems.push(format!("{name}: {bname} {k} {a} (saved {b})"));
+                }
+            }
+            if known(&name, &format!("{bname} bbox")) {
+                continue;
+            }
+            for (end, i) in [("min", 0), ("min", 1), ("min", 2), ("max", 0), ("max", 1), ("max", 2)] {
+                let (a, b) = (g["bbox"][end][i].as_f64().unwrap_or(f64::NAN), w["bbox"][end][i].as_f64().unwrap_or(f64::NAN));
+                if (a - b).abs() > 1e-3 * b.abs().max(1.0) {
+                    problems.push(format!("{name}: {bname} bbox {end}[{i}] {a} (saved {b})"));
+                }
+            }
+        }
+        // Saved again, it reads back the same.
+        let again = solidcraft_engine::doc::Document::from_json(&s.doc.to_json()).unwrap();
+        assert_eq!(again, *s.doc, "{name}: round trip");
+        let package = solidcraft_engine::io::write_design_container(&s.doc).unwrap();
+        let packaged = solidcraft_engine::io::read_design(&package).unwrap();
+        assert_eq!(packaged, *s.doc, "{name}: container round trip after migration");
+    }
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+/// Names saved before format 14 were worked out from geometry, pieces of a split face numbered by
+/// where their centres lay (`F2:top#2`). They keep naming the faces they named: marked as such,
+/// they are found as the build that saved them found them, without new notes.
+#[test]
+fn names_saved_before_exact_history_find_the_faces_they_named() {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/naming-split-pieces.solidcraft");
+    let s = open(&path);
+    let feature = |name: &str| s.doc.features.iter().find(|f| f.name == name).unwrap_or_else(|| panic!("{name}"));
+    assert_eq!(feature("Round").edge_names, vec!["?F2:side:l2|F2:top#2".to_string()]);
+    assert_eq!(feature("Bevel").edge_names, vec!["?F2:side:l4|F2:top#1".to_string()]);
+    assert_eq!(feature("Raise").face_names, vec!["?F2:top#1".to_string()]);
+    for r in &s.model.results {
+        assert!(r.error.is_none() && r.warning.is_none(), "{}: {:?} {:?}", r.name, r.error, r.warning);
+    }
+    // The raised piece is the left one, as saved (the stored point is on it).
+    let state = s.model.state();
+    let solid = |p: [f64; 3]| state.bodies.iter().any(|b| b.body.contains(solidcraft_engine::geom::Vec3::new(p[0], p[1], p[2])));
+    assert!(solid([7.0, 15.0, 11.0]) && !solid([32.0, 15.0, 11.0]));
+}
+
+/// Body names saved before format 14 name the pieces of a split body in the kernel's shell order.
+/// The features after the split that refer to a piece by its body name still find that piece:
+/// the far one stays `Body1` (chamfered), the near one `Body1 (1)` (filleted, coloured).
+#[test]
+fn body_names_saved_before_exact_history_keep_their_pieces() {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus/split-body-pieces.solidcraft");
+    let s = open(&path);
+    assert!(s.doc.features.iter().all(|f| f.shell_piece_order), "every saved feature keeps the shell order");
+    for r in &s.model.results {
+        assert!(r.error.is_none() && r.warning.is_none(), "{}: {:?} {:?}", r.name, r.error, r.warning);
+    }
+    let state = s.model.state();
+    let piece = |name: &str| state.bodies.iter().find(|b| b.name == name).unwrap_or_else(|| panic!("{name}"));
+    let solid = |name: &str, p: [f64; 3]| piece(name).body.contains(solidcraft_engine::geom::Vec3::new(p[0], p[1], p[2]));
+    assert!(solid("Body1", [20.0, 24.0, 5.0]) && solid("Body1 (1)", [20.0, 6.0, 5.0]));
+    assert!(s.doc.appearances.bodies.contains_key("Body1 (1)"));
+}
+
+/// Flat faces that can't take an attached sketch yet, by cause: (design, body, the faces'
+/// planes as outward normal and distance from the origin, or every flat face of the body,
+/// issue). Face indices are not used: they can change between builds. Each issue has an
+/// ignored test below that checks its faces; a listed plane whose face attaches fails the main
+/// check until it is removed from here.
+type Planes = &'static [([f64; 3], f64)];
+const NO_ATTACHMENT_YET: [(&str, &str, Option<Planes>, u32); 1] = [("issue-616-lid-ribs", "Lid", None, 628)];
+
+/// The issue a face is listed under, and whether it is listed by its plane (not as every face).
+fn known_without_attachment(design: &str, body: &str, normal: [f64; 3], distance: f64) -> Option<(u32, bool)> {
+    let same = |(n, d): &([f64; 3], f64)| (0..3).all(|i| (n[i] - normal[i]).abs() < 1e-6) && (d - distance).abs() < 1e-4;
+    NO_ATTACHMENT_YET.iter().find_map(|(d, b, planes, issue)| {
+        if *d != design || *b != body {
+            return None;
+        }
+        match planes {
+            None => Some((*issue, false)),
+            Some(planes) => planes.iter().any(same).then_some((*issue, true)),
+        }
+    })
+}
+
+fn undo_to(s: &mut Session, features: usize) {
+    for _ in 0..4 {
+        if s.doc.features.len() <= features {
+            return;
+        }
+        s.execute("edit.undo", &json!({})).unwrap();
+    }
+    assert_eq!(s.doc.features.len(), features, "undo did not remove the added feature");
+}
+
+/// Try a sketch and an offset plane on every flat face of every final body of every corpus
+/// design, through the same face pick the desktop sends (body, face index, occurrence path, a
+/// point on it), without `fixed`. Undo leaves the design as it was for the next face. Returns
+/// (design, body, face, issue it is known under, what went wrong or None).
+fn flat_face_attachments() -> Vec<(String, String, usize, Option<(u32, bool)>, Option<String>)> {
+    use solidcraft_engine::doc::{FaceAttachmentStatus, apply_point};
+    let mut out = Vec::new();
+    for p in corpus() {
+        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let mut s = open(&p);
+        let state = s.model.state();
+        let placed = s.placed_document();
+        let mut picks = Vec::new();
+        for (world, definition, component, path, frame) in placed.body_frames_with_source(&state) {
+            let Some(body) = state.bodies.iter().find(|b| b.definition_name() == definition && placed.model_body_component(b) == component) else {
+                continue;
+            };
+            let mesh = body.body.tessellate(0.01).unwrap();
+            for index in 0..body.body.face_count() {
+                if body.body.planar_face(index).is_none() {
+                    continue;
+                }
+                // The middle of the face's largest triangle: well inside the face.
+                let point = mesh
+                    .triangles
+                    .iter()
+                    .zip(&mesh.tri_face)
+                    .filter(|(_, f)| **f as usize == index)
+                    .filter_map(|(t, _)| mesh.tri(t))
+                    .max_by(|[a, b, c], [d, e, f]| (*b - *a).cross(*c - *a).len().total_cmp(&(*e - *d).cross(*f - *d).len()))
+                    .map(|[a, b, c]| (a + b + c) * (1.0 / 3.0));
+                let Some(point) = point else { continue };
+                let point = apply_point(&frame, point);
+                let normal =
+                    body.body.planar_face(index).map(|plane| solidcraft_engine::doc::apply_vector(&frame, plane.normal())).unwrap_or_default();
+                let key = ([normal.x, normal.y, normal.z], normal.dot(point));
+                picks.push((world.clone(), index, key, json!({"face": point, "body": world, "index": index, "path": path})));
+            }
+        }
+        let before = s.doc.features.len();
+        for (body, index, (normal, distance), plane) in picks {
+            let mut problem = None;
+            match s.execute("sketch.create", &json!({"plane": plane})) {
+                Ok(created) => {
+                    let id = created["sketch"].as_u64().unwrap_or(0);
+                    match s.placed_document().sketch_face_attachment(id, &s.model) {
+                        FaceAttachmentStatus::Healthy { .. } | FaceAttachmentStatus::Sheet { .. } => {}
+                        other => problem = Some(format!("sketch attachment {other:?}")),
+                    }
+                    s.execute("sketch.finish", &json!({})).unwrap();
+                    undo_to(&mut s, before);
+                }
+                Err(e) => problem = Some(format!("sketch.create: {e}")),
+            }
+            match s.execute("construct.plane.offset", &json!({"base": plane, "offset": 5})) {
+                Ok(_) => undo_to(&mut s, before),
+                Err(e) => problem = Some(problem.map_or(String::new(), |p| p + "; ") + &format!("construct.plane.offset: {e}")),
+            }
+            let known = known_without_attachment(&name, &body, normal, distance);
+            out.push((name.clone(), body, index, known, problem));
+        }
+        assert!(s.model.results.iter().all(|r| r.error.is_none()), "{name}: left with errors after undo");
+    }
+    out
+}
+
+/// Every flat face of every corpus design takes a durable attachment (issue #489: the top face
+/// of an extrude sketched over a face's projected boundary had "no exact planar source"),
+/// except the faces listed in [`NO_ATTACHMENT_YET`] under their open issues.
+#[test]
+fn every_flat_face_of_every_corpus_design_takes_an_attached_sketch() {
+    let all = flat_face_attachments();
+    assert!(all.len() > 50, "only {} faces checked", all.len());
+    let problems: Vec<String> = all
+        .iter()
+        .filter_map(|(design, body, face, known, problem)| match (known, problem) {
+            (None, Some(problem)) => Some(format!("{design}: {body} face {face}: {problem}")),
+            (Some((issue, true)), None) => Some(format!("{design}: {body} face {face} attaches now: remove it from NO_ATTACHMENT_YET (#{issue})")),
+            _ => None,
+        })
+        .collect();
+    assert!(problems.is_empty(), "{} of {} faces:\n{}", problems.len(), all.len(), problems.join("\n"));
+}
+
+fn known_faces_attach(issue: u32) {
+    let problems: Vec<String> = flat_face_attachments()
+        .into_iter()
+        .filter(|(.., known, problem)| known.is_some_and(|(known, _)| known == issue) && problem.is_some())
+        .map(|(design, body, face, _, problem)| format!("{design}: {body} face {face}: {}", problem.unwrap_or_default()))
+        .collect();
+    assert!(problems.is_empty(), "{}", problems.join("\n"));
+}
+
+#[test]
+#[ignore = "fails until #628 is fixed"]
+fn faces_of_a_lid_with_joined_ribs_take_an_attached_sketch() {
+    known_faces_attach(628);
+}
+
+/// A small deterministic generator (xorshift).
+struct Rng(u64);
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+}
+
+const HOSTILE: [&str; 14] =
+    ["0", "-1", "1e308", "-1e308", "1e9", "4294967297", "\"\"", "\"1/0\"", "\"((((1\"", "null", "true", "[]", "{}", "\"nope\""];
+
+/// Every JSON value in a document, as a path of keys and indices.
+fn paths(v: &Value, at: &mut Vec<Value>, out: &mut Vec<Vec<Value>>) {
+    out.push(at.clone());
+    match v {
+        Value::Object(m) => {
+            for (k, x) in m {
+                at.push(json!(k));
+                paths(x, at, out);
+                at.pop();
+            }
+        }
+        Value::Array(a) => {
+            for (i, x) in a.iter().enumerate() {
+                at.push(json!(i));
+                paths(x, at, out);
+                at.pop();
+            }
+        }
+        _ => {}
+    }
+}
+
+fn at_mut<'a>(v: &'a mut Value, path: &[Value]) -> Option<&'a mut Value> {
+    let mut cur = v;
+    for k in path {
+        cur = match k {
+            Value::String(s) => cur.get_mut(s.as_str())?,
+            Value::Number(n) => cur.get_mut(n.as_u64()? as usize)?,
+            _ => return None,
+        };
+    }
+    Some(cur)
+}
+
+/// Open a file's bytes as File → Open does and evaluate them; any panic is a failure.
+fn try_bytes(bytes: &[u8]) {
+    if let Ok(doc) = solidcraft_engine::io::read_design(bytes) {
+        let mut s = Session::new(doc);
+        let _ = s.execute("inspect.measure", &json!({}));
+        let _ = s.execute("document.inspect", &json!({}));
+    }
+}
+
+/// Hostile shapes that no mutation of a saved file produces: plane references that close a
+/// cycle, which resolve through the model and back into the document.
+fn generated() -> Vec<(String, Vec<u8>)> {
+    let to = |name: &str| json!({"type": "plane", "plane": {"type": "construction", "name": name}});
+    let plane = |id: u64, name: &str, side: Value| {
+        json!({"id": id, "name": name, "suppressed": false, "type": "construction_plane",
+               "plane": {"type": "midplane", "a": side, "b": {"type": "plane", "plane": {"type": "origin", "name": "XZ"}}}})
+    };
+    let design = |name: &str, features: Value| {
+        json!({"format": "solidcraft/11", "name": name, "units": "mm", "params": [], "next_id": 9, "features": features}).to_string().into_bytes()
+    };
+    // A sketch past the caps interactive editing enforces: solving it would size dense matrices
+    // by the point count and abort on the allocation.
+    let point = json!({"id": "p1", "pos": [0.0, 0.0], "fixed": false});
+    let oversized = json!([{"id": 1, "name": "Sketch1", "suppressed": false, "type": "sketch",
+                            "plane": {"type": "origin", "name": "XY"},
+                            "sketch": {"points": vec![point; 200_000], "curves": [], "constraints": []}}]);
+    vec![
+        ("construction plane is its own side".into(), design("selfplane", json!([plane(1, "P1", to("P1"))]))),
+        ("two construction planes refer to each other".into(), design("twoplanes", json!([plane(1, "P1", to("P2")), plane(2, "P2", to("P1"))]))),
+        ("sketch with 200,000 points".into(), design("bigsketch", oversized)),
+    ]
+}
+
+#[test]
+fn damaged_and_hostile_design_files_never_panic() {
+    let mut rng = Rng(0x5eed_cafe_f00d_d00d);
+    // The cases come from one seeded sequence; trying them is independent, so threads share it.
+    let mut all_cases: Vec<(String, String, Vec<u8>)> = Vec::new();
+    for p in corpus() {
+        let name = p.file_name().unwrap_or_default().to_string_lossy().to_string();
+        let bytes = std::fs::read(&p).unwrap();
+        let doc: Value = serde_json::from_slice(&bytes).unwrap();
+        let mut all = Vec::new();
+        paths(&doc, &mut Vec::new(), &mut all);
+        let mut cases: Vec<(String, Vec<u8>)> = Vec::new();
+        // Truncated and bit-flipped files.
+        for _ in 0..8 {
+            let cut = rng.below(bytes.len());
+            cases.push((format!("truncated at {cut}"), bytes[..cut].to_vec()));
+            let mut b = bytes.clone();
+            let i = rng.below(b.len());
+            b[i] ^= 1 << rng.below(8);
+            cases.push((format!("bit flip at {i}"), b));
+        }
+        // Values replaced by hostile ones, and keys removed.
+        for _ in 0..25 {
+            let path = &all[rng.below(all.len())];
+            let mut v = doc.clone();
+            let h = HOSTILE[rng.below(HOSTILE.len())];
+            if let Some(slot) = at_mut(&mut v, path) {
+                *slot = serde_json::from_str(h).unwrap();
+            }
+            cases.push((format!("{path:?} = {h}"), v.to_string().into_bytes()));
+            let mut v = doc.clone();
+            if let Some((last, parent)) = path.split_last()
+                && let (Some(Value::Object(m)), Value::String(k)) = (at_mut(&mut v, parent), last)
+            {
+                m.remove(k);
+            }
+            cases.push((format!("{path:?} removed"), v.to_string().into_bytes()));
+        }
+        // Features repeated many times; deep nesting; not JSON at all.
+        let mut v = doc.clone();
+        if let Some(Value::Array(fs)) = v.get_mut("features") {
+            let copy = fs.clone();
+            for _ in 0..2 {
+                fs.extend(copy.iter().cloned());
+            }
+        }
+        cases.push(("features repeated".into(), v.to_string().into_bytes()));
+        cases.push(("deep nesting".into(), format!("{}{}", "[".repeat(100_000), "]".repeat(100_000)).into_bytes()));
+        cases.push(("binary".into(), (0..4096u32).map(|i| (i.wrapping_mul(2_654_435_761) >> 24) as u8).collect()));
+        all_cases.extend(cases.into_iter().map(|(what, b)| (name.clone(), what, b)));
+    }
+    all_cases.extend(generated().into_iter().map(|(what, b)| ("generated".to_string(), what, b)));
+    let next = std::sync::atomic::AtomicUsize::new(0);
+    let threads = std::thread::available_parallelism().map_or(4, |n| n.get());
+    let failures: Vec<String> = std::thread::scope(|scope| {
+        let workers: Vec<_> = (0..threads)
+            .map(|_| {
+                scope.spawn(|| {
+                    let mut failures = Vec::new();
+                    while let Some((name, what, b)) = all_cases.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
+                        if std::env::var_os("CORPUS_TRACE").is_some() {
+                            eprintln!("{name}: {what}");
+                        }
+                        if std::panic::catch_unwind(|| try_bytes(b)).is_err() {
+                            failures.push(format!("{name}: {what}"));
+                        }
+                    }
+                    failures
+                })
+            })
+            .collect();
+        workers.into_iter().flat_map(|w| w.join().unwrap()).collect()
+    });
+    assert!(failures.is_empty(), "panics:\n{}", failures.join("\n"));
+}

apps/solidcraft-cli/tests/fuzz_range.rs

@@ -5,7 +5,7 @@ use std::process::Command;
 #[test]
 fn overflowing_seed_range_is_an_error_not_a_panic() {
     let output =
-        Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "2"]).output().unwrap();
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "2"]).output().unwrap();
     assert_eq!(output.status.code(), Some(1));
     let stderr = String::from_utf8_lossy(&output.stderr);
     assert!(stderr.contains("seed range exceeds u64::MAX"), "{stderr}");
@@ -15,14 +15,14 @@ fn overflowing_seed_range_is_an_error_not_a_panic() {
 #[test]
 fn empty_seed_range_at_maximum_is_valid() {
     let output =
-        Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "0"]).output().unwrap();
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "0"]).output().unwrap();
     assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
     assert!(String::from_utf8_lossy(&output.stdout).starts_with("0 seeds, 0 design steps,"));
 }
 
 #[test]
 fn maximum_seed_runs_once_without_wrapping() {
-    let output = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli"))
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
         .args(["fuzz", "--from", "18446744073709551615", "--count", "1", "--steps", "0", "--timeout", "0"])
         .output()
         .unwrap();

apps/solidcraft-cli/tests/help_output.rs

@@ -0,0 +1,159 @@
+//! An explicit help request prints usage to stdout and succeeds; an unknown command still fails.
+
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// Every command the CLI takes, with the name its own usage names: `inspect` is `eval`, and
+/// `licenses` is `licences`.
+const COMMANDS: &[(&str, &str)] = &[
+    ("run", "run"),
+    ("eval", "eval"),
+    ("inspect", "eval"),
+    ("script", "script"),
+    ("bench-open", "bench-open"),
+    ("bench-agent", "bench-agent"),
+    ("snapshot", "snapshot"),
+    ("render", "render"),
+    ("exec", "exec"),
+    ("commands", "commands"),
+    ("recipe", "recipe"),
+    ("oracle", "oracle"),
+    ("fuzz", "fuzz"),
+    ("fuzz-one", "fuzz-one"),
+    ("mcp", "mcp"),
+    ("crashes", "crashes"),
+    ("licences", "licences"),
+    ("licenses", "licences"),
+    ("gpu", "gpu"),
+    ("icon", "icon"),
+    ("bench-edit", "bench-edit"),
+    ("save-stress", "save-stress"),
+];
+
+/// The commands the usage lists: the aliases answer to another command's name.
+const LISTED: &[&str] = &[
+    "run",
+    "eval",
+    "script",
+    "bench-open",
+    "bench-agent",
+    "snapshot",
+    "render",
+    "exec",
+    "commands",
+    "recipe",
+    "oracle",
+    "fuzz",
+    "mcp",
+    "crashes",
+    "licences",
+    "gpu",
+    "icon",
+];
+
+/// The command names a text mentions after `solidcraft-cli `, each one only once.
+fn mentioned(text: &str) -> Vec<&str> {
+    let mut names: Vec<&str> = text.split("solidcraft-cli ").skip(1).filter_map(|rest| rest.split_whitespace().next()).collect();
+    names.sort_unstable();
+    names.dedup();
+    names
+}
+
+/// Runs the binary and waits at most `limit` for it to finish. `None` means it was still
+/// running and was killed: the fuzz run `fuzz --help` used to start goes on for minutes.
+fn run_within(limit: Duration, args: &[&str]) -> Option<(Option<i32>, String, String)> {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(args).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    let started = Instant::now();
+    loop {
+        match child.try_wait().unwrap() {
+            Some(status) => {
+                let out = child.wait_with_output().unwrap();
+                return Some((status.code(), String::from_utf8_lossy(&out.stdout).into_owned(), String::from_utf8_lossy(&out.stderr).into_owned()));
+            }
+            None if started.elapsed() >= limit => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+            None => std::thread::sleep(Duration::from_millis(25)),
+        }
+    }
+}
+
+#[test]
+fn help_prints_usage_and_succeeds() {
+    for arg in ["--help", "-h", "help"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg(arg).output().unwrap();
+        assert!(output.status.success(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        assert!(stdout.starts_with("usage:"), "{arg}: {stdout}");
+        assert!(stdout.contains("solidcraft-cli run"), "{arg}: {stdout}");
+        assert!(output.stderr.is_empty(), "{arg}: {}", String::from_utf8_lossy(&output.stderr));
+    }
+}
+
+#[test]
+fn unknown_command_still_fails_with_usage() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--not-a-command").output().unwrap();
+    assert!(!output.status.success());
+    assert!(output.stdout.is_empty());
+    assert!(String::from_utf8_lossy(&output.stderr).starts_with("error: usage:"));
+}
+
+#[test]
+fn every_command_prints_its_own_usage() {
+    for (cmd, named) in COMMANDS {
+        for flag in ["--help", "-h"] {
+            let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args([*cmd, flag]).output().unwrap();
+            assert!(output.status.success(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            assert!(stdout.starts_with("usage:"), "{cmd} {flag}: {stdout}");
+            assert_eq!(mentioned(&stdout), vec![*named], "{cmd} {flag} printed another command's usage: {stdout}");
+            assert!(output.stderr.is_empty(), "{cmd} {flag}: {}", String::from_utf8_lossy(&output.stderr));
+        }
+    }
+}
+
+#[test]
+fn the_top_level_usage_still_lists_every_command() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    for cmd in LISTED {
+        assert!(stdout.contains(&format!("solidcraft-cli {cmd}")), "{cmd}: {stdout}");
+    }
+}
+
+#[test]
+fn fuzz_help_does_not_start_a_fuzz_run() {
+    let Some((code, stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", "--help"]) else {
+        panic!("`fuzz --help` kept running: it started a fuzz run instead of printing the usage");
+    };
+    assert_eq!(code, Some(0), "{stderr}");
+    assert!(stdout.starts_with("usage:"), "{stdout}");
+    assert_eq!(mentioned(&stdout), vec!["fuzz"], "{stdout}");
+    assert!(stderr.is_empty(), "{stderr}");
+}
+
+#[test]
+fn fuzz_refuses_an_argument_it_does_not_take() {
+    for arg in ["--not-a-flag", "stray"] {
+        let Some((code, _stdout, stderr)) = run_within(Duration::from_secs(20), &["fuzz", arg]) else {
+            panic!("`fuzz {arg}` kept running: it started a fuzz run instead of refusing the argument");
+        };
+        assert_ne!(code, Some(0), "`fuzz {arg}` succeeded");
+        assert!(stderr.contains(arg), "`fuzz {arg}`: {stderr}");
+    }
+}
+
+#[test]
+fn render_help_keeps_the_registered_gpu_request_controls() {
+    for args in [vec!["--help"], vec!["render", "--help"]] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(&args).output().unwrap();
+        assert!(output.status.success(), "{args:?}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stderr.is_empty());
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        for flag in ["--progressive", "--samples", "--max-depth", "--seed", "--exposure", "--lighting", "--environment", "--tone-map"] {
+            assert!(stdout.contains(flag), "{args:?} lost {flag}: {stdout}");
+        }
+    }
+}

apps/solidcraft-cli/tests/json_out.rs

@@ -0,0 +1,170 @@
+//! `--json-out FILE` writes the JSON `run` and `eval` would print to a file the CLI makes
+//! itself. A shell's `>` can re-encode stdout (Windows PowerShell writes UTF-16, or UTF-8 with a
+//! byte-order mark), which strict JSON readers refuse; the file is plain UTF-8.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solidcraft-json-out-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A box, and a parameter whose comment has a character outside ASCII.
+    fn script(&self) -> PathBuf {
+        let path = self.0.join("box.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "bore", "expression": "5 mm", "comment": "\u{d8} of the bore"}},
+            {"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+
+    /// A filleted box whose fillet a later parameter change makes impossible: every command
+    /// succeeds, the timeline ends with a failing feature.
+    fn broken_script(&self) -> PathBuf {
+        let path = self.0.join("broken.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "r", "expression": "2 mm"}},
+            {"command": "solid.box", "params": {"length": 20, "width": 20, "height": 10}},
+            {"command": "solid.fillet", "params": {"edges": [[10, 0, 10]], "radius": "r"}},
+            {"command": "parameters.change", "params": {"name": "r", "expression": "50 mm"}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn cli() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+}
+
+fn stdout_of(output: Output) -> Vec<u8> {
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    output.stdout
+}
+
+/// Timings differ from one run to the next.
+fn without_timings(v: &mut Value) {
+    match v {
+        Value::Object(map) => {
+            map.remove("ms");
+            map.values_mut().for_each(without_timings);
+        }
+        Value::Array(items) => items.iter_mut().for_each(without_timings),
+        _ => {}
+    }
+}
+
+/// The file holds what stdout carried in the same command without `--json-out`: the same JSON,
+/// laid out the same way, in UTF-8 with no byte-order mark (UTF-8's or UTF-16's), so a strict
+/// reader accepts it.
+fn assert_plain_utf8_json(file: &Path, stdout: &[u8]) -> Value {
+    let bytes = std::fs::read(file).unwrap();
+    assert!(matches!(bytes.first(), Some(b'{' | b'[')), "the file starts with the JSON itself, not a mark");
+    assert_eq!(bytes.last(), Some(&b'\n'), "like stdout, the file ends with a newline");
+    let lines = |b: &[u8]| b.iter().filter(|c| **c == b'\n').count();
+    assert_eq!(lines(&bytes), lines(stdout), "laid out like stdout");
+    let mut value: Value = serde_json::from_str(std::str::from_utf8(&bytes).unwrap()).unwrap();
+    let mut printed: Value = serde_json::from_slice(stdout).unwrap();
+    without_timings(&mut value);
+    without_timings(&mut printed);
+    assert_eq!(value, printed, "the file is what stdout would have carried");
+    value
+}
+
+#[test]
+fn run_results_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let file = dir.0.join("results.json");
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).arg("--results").output().unwrap());
+    let output = cli().arg("run").arg(&script).arg("--results").arg("--json-out").arg(&file).output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    assert!(output.stdout.is_empty(), "the JSON goes to the file, not to stdout");
+    let results = assert_plain_utf8_json(&file, &on_stdout);
+    assert_eq!(results.as_array().map(Vec::len), Some(2));
+}
+
+#[test]
+fn run_json_out_without_results_holds_the_measurement_even_when_quiet() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).output().unwrap());
+    for (name, extra) in [("plain", &[][..]), ("quiet", &["--quiet"][..])] {
+        let file = dir.0.join(format!("measure-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measure = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measure["body_count"], 1, "{name}");
+    }
+}
+
+#[test]
+fn eval_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("eval").arg(&script).output().unwrap());
+    // The option may come before the file to evaluate, and `inspect` is the same command.
+    for name in ["eval", "inspect"] {
+        let file = dir.0.join(format!("{name}.json"));
+        let output = cli().arg(name).arg("--json-out").arg(&file).arg(&script).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measured = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measured["body_count"], 1, "{name}");
+        // A character outside ASCII is written as it is, in UTF-8.
+        assert!(std::fs::read_to_string(&file).unwrap().contains("\u{d8} of the bore"), "{name}");
+    }
+}
+
+#[test]
+fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    for cmd in ["run", "eval", "inspect"] {
+        for trailing in [&[][..], &["--in"][..]] {
+            let output = cli().arg(cmd).arg(&script).arg("--json-out").args(trailing).output().unwrap();
+            assert_eq!(output.status.code(), Some(1), "{cmd}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+            assert!(output.stdout.is_empty(), "{cmd}");
+        }
+
+        let missing = dir.0.join("missing").join("out.json");
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(!output.stderr.is_empty(), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
+        assert!(!missing.exists(), "{cmd}");
+    }
+}
+
+#[test]
+fn run_json_out_is_not_written_when_a_feature_fails() {
+    let dir = Scratch::new();
+    let script = dir.broken_script();
+    for (name, extra) in [("plain", &[][..]), ("results", &["--results"][..])] {
+        let file = dir.0.join(format!("failed-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{name}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("nothing was written"), "{name}");
+        assert!(!file.exists(), "{name}");
+    }
+}

apps/solidcraft-cli/tests/kill_mid_save.rs

@@ -6,17 +6,17 @@ use std::time::Duration;
 
 fn round_of(path: &std::path::Path) -> Option<String> {
     let bytes = std::fs::read(path).ok()?;
-    let doc = solvecraft_engine::io::read_design(&bytes).ok()?;
+    let doc = solidcraft_engine::io::read_design(&bytes).ok()?;
     doc.params.iter().find(|p| p.name == "save_round").map(|p| p.expr.clone())
 }
 
 #[test]
 fn killed_mid_save_the_old_file_survives() {
-    let exe = env!("CARGO_BIN_EXE_solvecraft-cli");
-    let dir = std::env::temp_dir().join(format!("solvecraft-kill-mid-save-{}", std::process::id()));
+    let exe = env!("CARGO_BIN_EXE_solidcraft-cli");
+    let dir = std::env::temp_dir().join(format!("solidcraft-kill-mid-save-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("design.solvecraft");
+    let path = dir.join("design.solidcraft");
     let ok = Command::new(exe).args(["save-stress", &path.to_string_lossy(), "1"]).status().unwrap();
     assert!(ok.success());
     assert_eq!(round_of(&path).as_deref(), Some("0"));
@@ -44,7 +44,7 @@ fn killed_mid_save_the_old_file_survives() {
         let round = round_of(&path);
         assert!(round.is_some(), "after kill {i} the design file is torn or missing");
         seen.insert(round);
-        let bak = solvecraft_engine::io::backup_path(&path);
+        let bak = solidcraft_engine::io::backup_path(&path);
         if bak.exists() {
             assert!(round_of(&bak).is_some(), "after kill {i} the backup is torn");
         }

apps/solidcraft-cli/tests/legacy_alias.rs

@@ -0,0 +1,20 @@
+//! The `solvecraft-cli` compatibility alias forwards to `solidcraft-cli`.
+use std::process::Command;
+
+#[test]
+fn legacy_alias_forwards_with_a_deprecation_note() {
+    let out = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("--version").output().unwrap();
+    assert!(out.status.success(), "{out:?}");
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    assert_eq!(stdout.trim(), format!("solidcraft-cli {}", env!("CARGO_PKG_VERSION")));
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(stderr.contains("deprecated") && stderr.contains("solidcraft-cli"), "{stderr}");
+}
+
+#[test]
+fn legacy_alias_passes_the_exit_status_through() {
+    let alias = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("no-such-command").output().unwrap();
+    let real = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("no-such-command").output().unwrap();
+    assert_eq!(alias.status.code(), real.status.code());
+    assert_eq!(alias.stdout, real.stdout);
+}

apps/solidcraft-cli/tests/mcp_connect.rs

@@ -0,0 +1,265 @@
+//! `mcp --connect` to a port where no app listens yet (#270): the server still starts, its tools
+//! say how to start the app, and once the app runs they reach it with that launch's token.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::TcpListener;
+use std::process::{Command, Stdio};
+
+use serde_json::{Value, json};
+
+#[test]
+fn mcp_connect_serves_before_the_app_runs_and_reaches_it_once_it_does() {
+    // This test needs the port closed until its second phase. A port obtained
+    // with bind(:0) and released can immediately be reused by another parallel
+    // test's mock server. Stay below the usual ephemeral ranges,
+    // with a process-specific starting point, and skip any occupied ports.
+    let port = (0..512u32)
+        .find_map(|offset| {
+            let port = 16000 + (std::process::id() + offset) % 16000;
+            TcpListener::bind(("127.0.0.1", port as u16)).ok().map(|listener| listener.local_addr().unwrap().port())
+        })
+        .expect("an unused non-ephemeral test port");
+    let addr = format!("127.0.0.1:{port}");
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-connect-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--connect", &addr, "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    let mut ask = |id: u64, method: &str, params: Value| -> Value {
+        writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": id, "method": method, "params": params})).unwrap();
+        let mut line = String::new();
+        stdout.read_line(&mut line).unwrap();
+        serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"))
+    };
+    let measure = json!({"name": "measure", "arguments": {}});
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // The server answers without the app, and its instructions say the app isn't running.
+    let init = ask(1, "initialize", json!({"protocolVersion": "2025-06-18"}));
+    let instructions = init["result"]["instructions"].as_str().unwrap_or_default();
+    assert!(instructions.contains("not running") && instructions.contains(&format!("--control {port}")), "{instructions}");
+    let tools = ask(2, "tools/list", json!({}));
+    assert!(tools["result"]["tools"].as_array().is_some_and(|t| !t.is_empty()), "{tools}");
+
+    // A tool call says the app is not running and how to start it.
+    let r = ask(3, "tools/call", measure.clone());
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("not running") && text(&r).contains(&format!("solidcraft --control {port}")), "{r}");
+
+    // The app starts: a token file for this launch, and its control port.
+    let token = "0123456789abcdef".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    let listener = TcpListener::bind(&addr).unwrap();
+    let app = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        let mut line = String::new();
+        BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let reply = if req["token"] == json!(token) {
+            json!({"id": req["id"], "ok": true, "result": {"bodies": [], "method": req["method"]}})
+        } else {
+            json!({"id": req["id"], "ok": false, "error": format!("unauthorized: token {}", req["token"])})
+        };
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let r = ask(4, "tools/call", measure);
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("engine.execute"), "{r}");
+    app.join().unwrap();
+
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+#[test]
+fn mcp_connect_without_a_port_is_refused_at_start() {
+    for addr in ["localhost", "127.0.0.1:0"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--connect", addr]).stdin(Stdio::null()).output().unwrap();
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(!output.status.success(), "{addr}: {stderr}");
+        assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
+    }
+}
+
+/// `mcp` with no arguments finds the running app through the discovery file and uses that
+/// launch's token; with no app behind the file it stays a headless session.
+#[test]
+fn mcp_without_arguments_finds_the_running_app() {
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-discover-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let token = "fedcba9876543210".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    std::fs::write(control_dir.join("current.port"), format!("{port}\n")).unwrap();
+    let app = std::thread::spawn(move || {
+        // The discovery probe connects and leaves without a request; the tool call follows.
+        let (stream, line) = loop {
+            let (stream, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+            if !line.is_empty() {
+                break (stream, line);
+            }
+        };
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let ok = req["token"] == json!(token);
+        let reply = json!({"id": req["id"], "ok": ok, "result": {"bodies": [], "method": req["method"]}, "error": "unauthorized"});
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "measure", "arguments": {}}})).unwrap();
+    let mut line = String::new();
+    stdout.read_line(&mut line).unwrap();
+    let r: Value = serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"));
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(r["result"]["content"][0]["text"].as_str().unwrap_or_default().contains("engine.execute"), "{r}");
+    app.join().unwrap();
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+
+    // The file names a port nothing listens on (the app crashed): a headless session instead.
+    let closed = TcpListener::bind("127.0.0.1:0").unwrap();
+    let dead = closed.local_addr().unwrap().port();
+    drop(closed);
+    std::fs::write(control_dir.join("current.port"), format!("{dead}\n")).unwrap();
+    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .stdin(Stdio::null())
+        .output()
+        .unwrap();
+    assert!(!String::from_utf8_lossy(&out.stderr).contains("bridged to the running app"), "{}", String::from_utf8_lossy(&out.stderr));
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+/// `mcp setup` against a temporary home: the client folders it finds are the only ones it writes.
+mod setup {
+    use serde_json::{Value, json};
+    use std::path::{Path, PathBuf};
+    use std::process::Command;
+
+    fn home(name: &str) -> PathBuf {
+        let h = std::env::temp_dir().join(format!("solidcraft-mcp-setup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&h);
+        std::fs::create_dir_all(&h).unwrap();
+        h
+    }
+
+    fn run(home: &Path, args: &[&str]) -> std::process::Output {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "setup"])
+            .args(args)
+            .env_clear()
+            .env("HOME", home)
+            .env("USERPROFILE", home)
+            .env("APPDATA", home.join("AppData/Roaming"))
+            .env("LOCALAPPDATA", home.join("AppData/Local"))
+            .env("XDG_CONFIG_HOME", home.join(".config"))
+            .env("PATH", "")
+            .output()
+            .unwrap()
+    }
+
+    fn json_of(p: &Path) -> Value {
+        serde_json::from_str(&std::fs::read_to_string(p).unwrap()).unwrap()
+    }
+
+    fn exe() -> String {
+        let p = Path::new(env!("CARGO_BIN_EXE_solidcraft-cli")).canonicalize().unwrap();
+        p.to_string_lossy().trim_start_matches(r"\\?\").to_owned()
+    }
+
+    #[test]
+    fn merges_into_opencode_and_cursor_keeping_other_servers() {
+        let h = home("merge");
+        let oc = h.join(".config/opencode");
+        std::fs::create_dir_all(&oc).unwrap();
+        let old = json!({"$schema": "https://opencode.ai/config.json", "theme": "x", "mcp": {"other": {"type": "local", "command": ["o"]}}});
+        std::fs::write(oc.join("opencode.json"), old.to_string()).unwrap();
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), r#"{"mcpServers": {"other": {"command": "o"}}}"#).unwrap();
+
+        let out = run(&h, &["--live"]);
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        let v = json_of(&oc.join("opencode.json"));
+        assert_eq!(v["theme"], "x");
+        assert_eq!(v["mcp"]["other"], old["mcp"]["other"]);
+        assert_eq!(v["mcp"]["solidcraft"], json!({"type": "local", "command": [exe(), "mcp"], "enabled": true}));
+        assert_eq!(v["mcp"]["solidcraft-live"]["command"], json!([exe(), "mcp", "--connect", "127.0.0.1:7878"]));
+        assert_eq!(json_of(&oc.join("opencode.json.bak")), old);
+        let c = json_of(&h.join(".cursor/mcp.json"));
+        assert_eq!(c["mcpServers"]["other"], json!({"command": "o"}));
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"command": exe(), "args": ["mcp"]}));
+
+        // Codex (TOML) and Claude Code (a big file the CLI owns) are edited in place too.
+        std::fs::create_dir_all(h.join(".codex")).unwrap();
+        std::fs::write(h.join(".codex/config.toml"), "# mine\nmodel = \"x\"\n").unwrap();
+        let cc = "{\n  \"numStartups\": 3,\n  \"projects\": {}\n}\n";
+        std::fs::write(h.join(".claude.json"), cc).unwrap();
+        assert!(run(&h, &[]).status.success());
+        let toml = std::fs::read_to_string(h.join(".codex/config.toml")).unwrap();
+        assert!(toml.starts_with("# mine\nmodel = \"x\"\n") && toml.contains("[mcp_servers.solidcraft]"), "{toml}");
+        let c = json_of(&h.join(".claude.json"));
+        assert_eq!(c["numStartups"], 3);
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"type": "stdio", "command": exe(), "args": ["mcp"]}));
+        assert_eq!(std::fs::read_to_string(h.join(".claude.json.bak")).unwrap(), cc);
+
+        // Running again updates the same entries and leaves one of each.
+        assert!(run(&h, &[]).status.success());
+        assert_eq!(json_of(&h.join(".cursor/mcp.json"))["mcpServers"].as_object().unwrap().len(), 3);
+    }
+
+    #[test]
+    fn dry_run_writes_nothing_and_missing_clients_are_skipped() {
+        let h = home("dry");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        let out = run(&h, &["--dry-run"]);
+        assert!(out.status.success());
+        let text = String::from_utf8_lossy(&out.stdout);
+        assert!(text.contains("would write") && text.contains("solidcraft"), "{text}");
+        assert!(!h.join(".cursor/mcp.json").exists());
+        assert!(!h.join(".config/opencode").exists(), "OpenCode was not installed, so nothing is created for it");
+        let out = run(&h, &["--client", "claude-desktop"]);
+        assert!(String::from_utf8_lossy(&out.stdout).contains("not found"));
+    }
+
+    #[test]
+    fn a_file_that_is_not_json_is_left_alone() {
+        let h = home("bad");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), "{ // comment").unwrap();
+        let out = run(&h, &[]);
+        assert!(!out.status.success());
+        assert_eq!(std::fs::read_to_string(h.join(".cursor/mcp.json")).unwrap(), "{ // comment");
+    }
+
+    #[test]
+    fn claude_desktop_msix_folder_is_found() {
+        let h = home("msix");
+        let pkg = h.join("AppData/Local/Packages/Claude_abc/LocalCache/Roaming/Claude");
+        std::fs::create_dir_all(&pkg).unwrap();
+        // The MSIX folder is only read through LOCALAPPDATA, set for every platform here.
+        assert!(run(&h, &["--client", "claude-desktop"]).status.success());
+        assert!(json_of(&pkg.join("claude_desktop_config.json"))["mcpServers"]["solidcraft"].is_object());
+    }
+}

apps/solidcraft-cli/tests/mcp_param_check.rs

@@ -0,0 +1,50 @@
+//! `mcp --in script --param-check <level>`: the level applies to the script the session starts
+//! from too, so a misspelled key in it is refused (strict) or reported on stderr (warn) instead of
+//! silently ignored.
+
+use std::process::{Command, Stdio};
+
+#[test]
+fn param_check_applies_to_the_starting_script() {
+    let dir = std::env::temp_dir().join(format!("solidcraft-mcp-param-check-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let script = dir.join("typo.json");
+    let box_ = r#"{"command": "solid.box", "params": {"length": 5, "width": 5, "height": 5, "operaton": "cut"}}"#;
+    std::fs::write(&script, format!(r#"{{"commands": [{box_}]}}"#)).unwrap();
+    let run = |level: &str| {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "--in", script.to_str().unwrap(), "--param-check", level])
+            .stdin(Stdio::null())
+            .output()
+            .unwrap()
+    };
+    let strict = run("strict");
+    let stderr = String::from_utf8_lossy(&strict.stderr);
+    assert!(!strict.status.success(), "{stderr}");
+    assert!(stderr.contains("unknown key `operaton`; did you mean `operation`?"), "{stderr}");
+    // Warn: the script runs, and its warnings go to stderr.
+    let warn = run("warn");
+    let stderr = String::from_utf8_lossy(&warn.stderr);
+    assert!(warn.status.success(), "{stderr}");
+    assert!(stderr.contains("step 1: unknown key `operaton`; did you mean `operation`?"), "{stderr}");
+    // A warned step's warning is printed even when a later step fails.
+    let failing = dir.join("typo_then_failure.json");
+    std::fs::write(&failing, format!(r#"{{"commands": [{box_}, {{"command": "no.such_command"}}]}}"#)).unwrap();
+    let out = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--in", failing.to_str().unwrap(), "--param-check", "warn"])
+        .stdin(Stdio::null())
+        .output()
+        .unwrap();
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(!out.status.success(), "{stderr}");
+    assert!(stderr.contains("step 1: unknown key `operaton`") && stderr.contains("step 2"), "{stderr}");
+    // Off: the script runs as before, and the server ends with its input.
+    let off = run("off");
+    assert!(off.status.success(), "{}", String::from_utf8_lossy(&off.stderr));
+    assert!(!String::from_utf8_lossy(&off.stderr).contains("operaton"));
+    // A bare flag is an error, not off.
+    let bare = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--param-check"]).stdin(Stdio::null()).output().unwrap();
+    assert!(!bare.status.success());
+    assert!(String::from_utf8_lossy(&bare.stderr).contains("--param-check wants off, warn or strict"));
+    std::fs::remove_dir_all(&dir).ok();
+}

apps/solidcraft-cli/tests/mcp_render_host.rs

@@ -0,0 +1,9 @@
+//! Explicit native GPU registration must not change bridged MCP ownership.
+use std::process::Command;
+#[test]
+fn connected_application_rejects_headless_gpu_installation_before_connecting() {
+    let result = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--render-gpu", "--connect", "127.0.0.1:1"]).output().unwrap();
+    assert!(!result.status.success());
+    let message = String::from_utf8_lossy(&result.stderr);
+    assert!(message.contains("connected application owns its own device"), "{message}");
+}