Release 0.28.0

Release 0.28.0 (#9766 )
Fold the pending design format changes (browser-nested-groups, point-cloud-properties, print-faces) into format 45. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-03 10:35:58 +00:00 · 2026-10-30 19:50:14 -04:00 · 2026-10-30 19:50:02 -04:00 · 2026-10-30 23:45:03 +00:00 · 2026-10-30 23:03:40 +00:00 · 2026-10-30 23:01:28 +00:00
1493 changed files with 366505 additions and 15662 deletions
@@ -1,5 +1,6 @@
 # cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
-# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml).
+# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml),
+# except the GPU path tracer's tests (the gpu-path group below), which run in four shards of their own.

 [profile.ci]
 # Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
@@ -72,6 +73,7 @@ priority = 100
 # Each nextest test has its own process/device. Concurrent cold lavapipe path
 # compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
 # Serialize this module per CI shard; other tests retain their normal parallelism.
+# CI runs these in their own job (GPU path tests in ci.yml), split into count partitions.
 [test-groups.gpu-path]
 max-threads = 1

@@ -1,3 +1,6 @@
 # Preserve canonical source receipts and the runtime icon-discovery snapshot.
 .gitattributes text eol=lf
 /assets/icons/ui/design/requested_icons.txt text eol=lf
+# SolidCraft designs (.sc): a JSON document or a ZIP container, never Scala source, so they
+# stay out of GitHub's language statistics. Git's own text/binary detection handles both kinds.
+*.sc -linguist-detectable
@@ -6,6 +6,7 @@ body:
    attributes:
      value: |
        Thanks for taking the time to report this! Inside the app, **Report an Issue** fills most of this in for you, with the command, its settings and your environment.
+        Before reporting a boolean or modelling failure, please try to reproduce it on the latest nightly or a build from current `main`, and say which build you used.
  - type: textarea
    id: what
    attributes:
@@ -18,7 +19,8 @@ body:
    attributes:
      label: Steps to reproduce
      description: |
-        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.sc --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
      placeholder: |
        1. Sketch a circle on the XY plane
        2. Extrude it 10 mm
@@ -2,6 +2,12 @@

 Describe the problem and resulting behavior. Link the issue when applicable.

+Changes a default: no
+
+<!-- Required line, replace "no" if this changes what a user gets out of the box (a default value, key binding, setting, tool behaviour):
+Changes a default: yes — <what>, old behaviour kept behind preference <name>
+Docs-only and bot PRs are exempt. -->
+
 ## Validation

 What did you run, and what were the results? Include expected and measured values for geometry changes.
@@ -9,9 +9,10 @@ parameter to watch the timeline rebuild. [Documentation](https://docs.solidcraft
 [ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
 the known limitations. Designs from every earlier version open in this one.

-**Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
-`flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
-menu entry.
+**New app ID.** The app ID is now `io.tangencylabs.solidcraft` (it was `ai.storyteller.solidcraft`,
+and `ai.storyteller.solvecraft` up to 0.7): `flatpak update` offers to replace the old app, the
+`.deb`, `.rpm` and AppImage remove the old menu entry, and settings stay. On macOS the bundle ID
+changed too, so macOS asks once more for the permissions it had granted.

 **Upgrading from 0.5 or earlier.** 0.6 renamed SolveCraft to SolidCraft and made the zip
 container the default save format. `.solvecraft` designs, old settings folders and
@@ -42,16 +43,16 @@ installing SolidCraft; keep both remotes in the same user installation:
 ```sh
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --user --if-not-exists solidcraft https://docs.solidcraft.io/flatpak/solidcraft.flatpakrepo
-flatpak install --user solidcraft ai.storyteller.solidcraft
-flatpak run ai.storyteller.solidcraft
+flatpak install --user solidcraft io.tangencylabs.solidcraft
+flatpak run io.tangencylabs.solidcraft
 ```

 A remote added from the old `bherbruck.github.io` address no longer finds updates: run
 `flatpak remote-modify --user --url=https://docs.solidcraft.io/flatpak/repo/ solidcraft`, then
 `flatpak update --user`.

-Flatpak installs from 0.7 or earlier use the old ID `ai.storyteller.solvecraft`: `flatpak update --user`
-offers to replace it with `ai.storyteller.solidcraft`, and settings move along.
+Flatpak installs under an old ID (`ai.storyteller.solidcraft`, or `ai.storyteller.solvecraft` from 0.7 or
+earlier): `flatpak update --user` offers to replace it with `io.tangencylabs.solidcraft`, and settings move along.

 Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
 still need an internet connection. [Linux installation details](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).
@@ -9,12 +9,16 @@
 # Documentation, packaging, the other workflows and the GitHub bots' scripts select nothing:
 # no native job runs for them, on pull requests or on main.
 # Tests are built and run in one job on a big runner, slowest first, starting beside the repository
-# checks (no archive to upload and download). A few heavy tests (see .config/nextest.toml) are
-# skipped on pull requests and run on pushes to main and nightly. The Windows jobs (D3D12 shaders
-# and app startup), the reference tests and the doc tests run on main and nightly only, not on
-# pull requests (the fast lane, in Select checks); a break there is fixed forward on main. Only
-# main saves the build caches; pull requests restore them. sccache is on a Blacksmith sticky disk that
-# only main commits.
+# checks (no archive to upload and download). The GPU path tracer's tests run one at a time
+# (.config/nextest.toml), so they have a job of their own in four shards (GPU path tests). A few
+# heavy tests (see .config/nextest.toml) are skipped on pull requests and run on pushes to main and
+# nightly. The reference tests and the doc tests run in the merge queue, on main and nightly, not
+# on pull requests (the fast lane, in Select checks); a break there is fixed forward on main. The
+# Windows jobs (D3D12 shaders and app startup) run nightly, and in the merge queue only for a group
+# that changes what they exercise. The wasm compile check runs in the merge queue for a group that
+# touches the crates below the apps, the web app or the manifests. Dependency advisories run nightly
+# and on any pull request or merge group that changes Cargo.lock or a Cargo.toml. Only main saves the build caches; pull requests restore them.
+# sccache is on a Blacksmith sticky disk that only main commits.
 # A push to main runs only the repository checks when a passing merge-queue run tested that very
 # commit, or when nothing a build reads changed since the last push to main whose run passed.
 # Otherwise it runs everything.
@@ -30,7 +34,7 @@
 # reads `ci` from the newest run of a commit, so a run without it would block a PR that passed.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
 # Every Linux job runs on Blacksmith's Ubuntu 24.04 runners (blacksmith-<N>vcpu-ubuntu-2404), sized
-# per job: 32 vCPU for the tests, 16 for Clippy, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
+# per job: 32 vCPU for the tests, 16 for Clippy, the GPU path tests, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
 # The Windows shader job runs on Blacksmith's Windows Server 2025 runners (blacksmith-8vcpu-windows-2025);
 # the Windows app startup smoke stays on windows-latest, which has a desktop session that presents frames.
 # Pull requests, forks included, the merge queue, pushes to main and the nightly run all use them:
@@ -76,8 +80,13 @@ env:

 jobs:
  dependency-advisories:
+    # Nightly and by hand: advisories, bans and sources for everything. A pull request or merge
+    # group that changes Cargo.lock or a Cargo.toml (Select checks' `deps`) checks the advisories
+    # only, so a dependency with a known vulnerability is caught before it lands, not the next
+    # morning; other pull requests skip it. `ci` requires it whenever `deps` is true.
    name: Dependency advisories
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    needs: changes
+    if: ${{ !cancelled() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.deps == 'true') }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 20
    steps:
@@ -86,7 +95,12 @@ jobs:
      - name: Install advisory scanner
        run: cargo install cargo-deny --version 0.20.2 --locked
      - name: Check locked dependencies
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        run: cargo deny --locked check --warn unmaintained advisories bans sources
+      # deny.toml denies unmaintained crates; like the nightly, they are reported, not fatal.
+      - name: Check advisories for the changed dependencies
+        if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
+        run: cargo deny --locked check --warn unmaintained advisories

  changes:
    name: Select checks
@@ -96,19 +110,27 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      contents: read
-      # To ask whether the merge queue already tested a commit pushed to main.
+      # To ask whether the merge queue already tested a commit pushed to main, and which labels the
+      # pull requests of a merge group carry (the render-tests opt-in).
+      pull-requests: read
      actions: read
    outputs:
      native: ${{ steps.paths.outputs.native }}
      kernel: ${{ steps.paths.outputs.kernel }}
      goldens: ${{ steps.paths.outputs.goldens }}
      windows: ${{ steps.paths.outputs.windows }}
+      # The GPU path tests run (see the rule where it is computed). The job's `if` and the `ci` job's check both read this, so they cannot disagree.
+      gpu: ${{ steps.paths.outputs.gpu }}
      full: ${{ steps.paths.outputs.full }}
      # Code changed on a pull request that has no approved-for-ci label yet: only Quick compile.
      quick: ${{ steps.paths.outputs.quick }}
      packages: ${{ steps.paths.outputs.packages }}
      oracle: ${{ steps.paths.outputs.oracle }}
      doctests: ${{ steps.paths.outputs.doctests }}
+      # Cargo.lock or a Cargo.toml changed (pull requests and merge groups): Dependency advisories.
+      deps: ${{ steps.paths.outputs.deps }}
+      # A merge group reaches the wasm build: Compile WebAssembly.
+      wasm: ${{ steps.paths.outputs.wasm }}
      # The passing run a merge of main carries forward (its URL), when this push is only that.
      carried: ${{ steps.paths.outputs.carried }}
    steps:
@@ -122,8 +144,11 @@ jobs:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_SHA: ${{ github.sha }}
+          GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+          GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          RENDER_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'render-tests') }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          REPO: ${{ github.repository }}
          APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}
@@ -133,6 +158,9 @@ jobs:
          kernel=false
          goldens=false
          windows=false
+          gpu_paths=false
+          deps=false
+          wasm=false
          full=true
          packages=
          # Whether the NUL-separated paths in $1 reach any code: scripts/ci/affected.py selects
@@ -144,6 +172,61 @@ jobs:
            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
          }
+          # Whether the NUL-separated paths in $1 (the diff $2) reach what the Windows D3D12 jobs
+          # exercise: the GPU crate and its shaders, the app and its startup, the viewport's wgpu
+          # glue, the vendored egui-wgpu, their scripts, or a lockfile change that moves the
+          # graphics stack (wgpu, naga, egui, winit, windows). Pull requests and merge groups share it.
+          windows_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
+                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
+              esac
+            done < "$1"
+            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$1" \
+              && git diff "$2" -- Cargo.lock \
+                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
+              windows=true
+            fi
+          }
+          # Whether the NUL-separated paths in $1 are render code: the render crate, the path
+          # tracer and its shaders in the GPU crate, the render workspace UI, the render assets.
+          # Core, kernel and CI changes do not trigger the path tests (about 56 runner-minutes):
+          # the tracer reads the scene through interfaces the other tests cover, and the nightly
+          # runs them for everything.
+          gpu_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/render/*|crates/gpu/src/path/*|crates/ui-egui/src/render_workspace*|assets/render/*) gpu_paths=true ;;
+              esac
+            done < "$1"
+          }
+          # Whether the NUL-separated paths in $1 change the dependencies (Cargo.lock or any
+          # Cargo.toml: deps), and whether they reach what `cargo xtask wasm` compiles (wasm): the
+          # crates below the apps, the web app, the vendored crates, the manifests and lockfile, the
+          # toolchain and cargo config, and this workflow. #8227 put a native-only call in
+          # crates/ui-egui and the merge queue passed it, because nothing built for wasm there.
+          deps_wasm_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                Cargo.lock|Cargo.toml|*/Cargo.toml) deps=true ;;
+              esac
+              case "$path" in
+                crates/*|apps/solidcraft-web/*|vendor/*|Cargo.lock|Cargo.toml|rust-toolchain*|.cargo/*|.github/workflows/ci.yml) wasm=true ;;
+              esac
+            done < "$1"
+          }
+          # Opt-in for a big render change: a pull request labelled render-tests, or a merge group
+          # holding one (its pull requests are the (#N) of its squash commits), runs them whatever
+          # the paths say.
+          group_has_render_label() {
+            for pr in $(git log --format=%s "$1" | grep -o '(#[0-9]*)$' | tr -d '(#)'); do
+              if gh api "repos/$REPO/issues/$pr" --jq '.labels[].name' | grep -qx render-tests; then
+                return 0
+              fi
+            done
+            return 1
+          }
          if [ "$EVENT_NAME" = push ]; then
            # The queue lands the very commit its merge_group run tested. If that run passed,
            # testing the push again proves nothing new; otherwise (a merge that skipped the
@@ -164,15 +247,36 @@ jobs:
              # push before may never have run: a newer push cancels a waiting one).
              echo "$tested..$PUSH_SHA changes no code: repository checks only."
            else
-              # Code changed (or the push can't be compared): main runs everything.
+              # Code changed (or the push can't be compared): main runs everything but Windows.
+              # The merge queue ran Windows for the changes that reach it, and the nightly runs it
+              # for everything else (it passed 129 of 129 non-PR runs before this).
              full=true
              packages=
              native=true
-              windows=true
            fi
+          elif [ "$EVENT_NAME" = merge_group ]; then
+            native=true
+            # Windows (about 16 runner-minutes) only for a group that changes what it exercises;
+            # the nightly runs it whatever changed. A group that can't be compared runs it.
+            if git diff --no-renames --name-only -z "$GROUP_BASE_SHA...$GROUP_HEAD_SHA" > "$RUNNER_TEMP/ci-paths"; then
+              windows_paths "$RUNNER_TEMP/ci-paths" "$GROUP_BASE_SHA...$GROUP_HEAD_SHA"
+              gpu_paths "$RUNNER_TEMP/ci-paths"
+              deps_wasm_paths "$RUNNER_TEMP/ci-paths"
+              if [ "$gpu_paths" = false ] && group_has_render_label "$GROUP_BASE_SHA..$GROUP_HEAD_SHA"; then
+                gpu_paths=true
+              fi
+            else
+              windows=true
+              gpu_paths=true
+              deps=true
+              wasm=true
+            fi
+            echo "windows=$windows gpu_paths=$gpu_paths deps=$deps wasm=$wasm for $GROUP_BASE_SHA...$GROUP_HEAD_SHA"
          elif [ "$EVENT_NAME" != pull_request ]; then
+            # The nightly run and Run workflow: everything, Windows included.
            native=true
            windows=true
+            gpu_paths=true
          else
            # Compare both old and new paths of renames; unknown paths run native checks.
            git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
@@ -185,19 +289,13 @@ jobs:
              case "$path" in
                crates/kernel/*|vendor/truck-*|tests/robustness/*) goldens=true ;;
              esac
-              # What the Windows D3D12 jobs exercise: the GPU crate and its shaders, the app and
-              # its startup, the viewport's wgpu glue, the vendored egui-wgpu, their scripts.
-              case "$path" in
-                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
-                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
-              esac
            done < "$RUNNER_TEMP/ci-paths"
-            # A lockfile change that moves the graphics stack (wgpu, naga, egui, winit, windows).
-            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$RUNNER_TEMP/ci-paths" \
-              && git diff "$BASE_SHA...$HEAD_SHA" -- Cargo.lock \
-                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
-              windows=true
-            fi
+            # Computed as for a merge group, then turned off below (the fast lane).
+            windows_paths "$RUNNER_TEMP/ci-paths" "$BASE_SHA...$HEAD_SHA"
+            # The advisories run on the pull request itself (it builds nothing of ours: about two minutes, most of it installing cargo-deny);
+            # the wasm compile waits for the merge queue.
+            deps_wasm_paths "$RUNNER_TEMP/ci-paths"
+            wasm=false
            # Pull requests build and test the touched packages and their dependents; nothing
            # selected means no code changed.
            select_packages "$RUNNER_TEMP/ci-paths"
@@ -242,13 +340,35 @@ jobs:
              goldens=false
            fi
          fi
+          # The GPU path tests (their own job, about 56 runner-minutes) are for render changes only:
+          # - on a pull request, when it carries the render-tests label (opt-in for a big render
+          #   change) or touches render code (gpu_paths); no other pull request runs them;
+          # - in the merge queue, when the group's diff touches render code or one of its pull
+          #   requests carries render-tests;
+          # - in the nightly and by hand, always, so anything the above skipped is caught within a day;
+          # - not on a push to main: the queue tested that commit, or the nightly will.
+          gpu=false
+          if [ "$native" = true ]; then
+            case "$EVENT_NAME" in
+              pull_request)
+                gpu_paths "$RUNNER_TEMP/ci-paths"
+                gpu=$gpu_paths
+                if [ "$RENDER_LABEL" = true ]; then gpu=true; fi ;;
+              merge_group) gpu=$gpu_paths ;;
+              push) gpu=false ;;
+              *) gpu=true ;;
+            esac
+          fi
          {
            echo "native=$native"
+            echo "gpu=$gpu"
            echo "kernel=$kernel"
            echo "goldens=$goldens"
            echo "windows=$windows"
            echo "oracle=$oracle"
            echo "doctests=$doctests"
+            echo "deps=$deps"
+            echo "wasm=$wasm"
            echo "carried=$carried"
            echo "full=$full"
            echo "quick=$quick"
@@ -286,6 +406,13 @@ jobs:
          cargo test -p xtask ui_containers --locked
      - name: Sorted lists
        run: cargo xtask lists
+      # New UI text must reach every complete catalog; report it here, before review (#8542).
+      - name: Translations in the complete catalogs
+        run: cargo xtask i18n --check
+      - name: Agent router and skills cite real files
+        run: |
+          cargo xtask skills
+          cargo test -p xtask skills --locked
      - name: Design format pending changes
        run: bash scripts/test-format-pending.sh
      - name: Web app offline use and updates (headless Chrome)
@@ -295,7 +422,7 @@ jobs:
      - name: Merge-of-main detection self-test
        run: python3 -I scripts/ci/test_main_merge.py
      - name: Claim, triage and kernel-paused bot tests
-        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js scripts/kernel-paused/*.test.js
+        run: node --test scripts/claim/*.test.js scripts/triage/*.test.js scripts/kernel-paused/*.test.js scripts/pr-checks/*.test.js

  # Fast feedback for a pull request that has not been approved for the full CI yet.
  quick-compile:
@@ -487,8 +614,10 @@ jobs:
          scope=(--workspace)
          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
          status=0
+          # The GPU path tracer's tests run in their own job (GPU path tests): one at a time, they
+          # took about 36 of this job's 45 minutes.
          cargo nextest run "${scope[@]}" --cargo-profile ci --locked --profile ci --no-tests=pass \
-            --ignore-default-filter -E "$base" || status=1
+            --ignore-default-filter -E "($base) & not (package(=solidcraft-gpu) & test(/^path::/))" || status=1
          if [ "$status" != 0 ]; then
            # A failed golden gets the hint to re-record it (junit.xml lists the failures).
            if [ -f "$junit" ] && tr '\n' ' ' < "$junit" | grep -q '<testcase name="tests::robustness_goldens::[^"]*"[^>]*>[[:space:]]*<failure'; then
@@ -508,6 +637,96 @@ jobs:
          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
          retention-days: 7

+  gpu-path-tests:
+    name: GPU path tests (${{ matrix.shard }}/4)
+    # The GPU path tracer's tests (about 108) compile their pipelines on lavapipe, one test at a
+    # time (the gpu-path test group in .config/nextest.toml keeps them within the 600 s pipeline
+    # setup budget). Serial, they took about 36 minutes, the longest chain in Native Linux tests;
+    # here four shards run beside it. Their filter is the one Native Linux tests leaves out, so
+    # every test runs exactly once.
+    # 16 vCPU, not 8: lavapipe compiles on every core, and on 8 vCPU one test went past the 600 s
+    # budget (665 s, against 204 s for the same test in another run) and a shard took 35 minutes.
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.gpu == 'true' }}
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    env:
+      # As in Native Linux tests: lavapipe draws, and a test without an adapter fails.
+      SOLIDCRAFT_GPU: software
+      SOLIDCRAFT_REQUIRE_GPU: "1"
+      # lavapipe's own shader cache (below).
+      MESA_SHADER_CACHE_DIR: /home/runner/.cache/mesa-gpu
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install a software Vulkan driver (lavapipe)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      # The shards build the same thing, so only the first one commits it (and saves the cache).
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-gpu
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # The first test in a shard to build the path pipeline compiles it cold on lavapipe (335 to
+      # 665 s, against the 600 s setup budget); every later one reads Mesa's disk cache (about
+      # 30 s). Keeping that cache from main's last run lets the first test read it too, until the
+      # shaders change. Same sticky disk rules as the compiler cache.
+      - name: Mount lavapipe's shader cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-mesa-gpu
+          path: /home/runner/.cache/mesa-gpu
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-gpu
+          save-if: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 }}
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - name: Run one shard of the GPU path tests
+        env:
+          SHARD: ${{ matrix.shard }}
+        run: |
+          # None of these is in the default filter (the heavy tests), so pull requests, the merge
+          # queue, main and nightly all run every one of them, as before. `count` deals the tests
+          # out in turn (27 each); `hash` split them 41/40/27 across three shards.
+          cargo nextest run -p solidcraft-gpu --cargo-profile ci --locked --profile ci --no-tests=pass \
+            --ignore-default-filter -E 'test(/^path::/)' --partition "count:$SHARD/4"
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
+      - name: Upload test timings
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: junit-gpu-${{ matrix.shard }}
+          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
+          retention-days: 7
+
  action-matrix:
    # Every ordinary action on every face, edge, vertex and body of the design corpus, against
    # tests/action_matrix/baseline.json (docs/action-matrix.md). Every test run checks a sample;
@@ -769,7 +988,7 @@ jobs:
    # commit's real run instead: the merge queue reads `ci` from the newest run of a commit, so a
    # run without a passing `ci` would block a pull request that passed (#1850, #3182, #3252).
    name: ci
-    needs: [changes, checks, quick-compile, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
+    needs: [changes, checks, quick-compile, clippy, build-tests, tests, gpu-path-tests, doc-tests, oracle, windows-fxc, windows-startup, dependency-advisories, wasm]
    if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
@@ -817,10 +1036,16 @@ jobs:
          BUILD: ${{ needs.build-tests.result }}
          EVENT_NAME: ${{ github.event_name }}
          TESTS: ${{ needs.tests.result }}
+          GPU_RUN: ${{ needs.changes.outputs.gpu }}
+          GPU: ${{ needs.gpu-path-tests.result }}
          DOCS: ${{ needs.doc-tests.result }}
          ORACLE: ${{ needs.oracle.result }}
          WINDOWS_FXC: ${{ needs.windows-fxc.result }}
          WINDOWS_STARTUP: ${{ needs.windows-startup.result }}
+          DEPS_RUN: ${{ needs.changes.outputs.deps }}
+          ADVISORIES: ${{ needs.dependency-advisories.result }}
+          WASM_RUN: ${{ needs.changes.outputs.wasm }}
+          WASM: ${{ needs.wasm.result }}
        run: |
          test "$CHANGES" = success
          test "$CHECKS" = success
@@ -836,6 +1061,10 @@ jobs:
            fi
            test "$TESTS" = success
          fi
+          # The same output decides whether the GPU path tests run (their job's `if`).
+          if [ "$GPU_RUN" = true ]; then
+            test "$GPU" = success
+          fi
          if [ "$DOCTESTS" = true ]; then
            test "$DOCS" = success
          fi
@@ -846,6 +1075,14 @@ jobs:
            test "$WINDOWS_FXC" = success
            test "$WINDOWS_STARTUP" = success
          fi
+          # Cargo.lock or a Cargo.toml changed on a pull request or in a merge group.
+          if [ "$DEPS_RUN" = true ]; then
+            test "$ADVISORIES" = success
+          fi
+          # A merge group that reaches the wasm build.
+          if [ "$WASM_RUN" = true ]; then
+            test "$WASM" = success
+          fi
      - name: Note a carried result
        if: needs.changes.outputs.carried != ''
        env:
@@ -853,9 +1090,13 @@ jobs:
        run: |
          echo "This push only merges main into a change that already passed; the heavy checks were not repeated. Passing run: $CARRIED" >> "$GITHUB_STEP_SUMMARY"

+  # Every crate below the apps and the web app must build for the browser (`cargo xtask wasm`, a
+  # cargo check, no tests). In the merge queue for a group that reaches the wasm build (Select
+  # checks' `wasm`), where `ci` requires it; by hand with cross_compile.
  wasm:
-    name: Compile WebAssembly (manual)
-    if: github.event_name == 'workflow_dispatch' && inputs.cross_compile
+    name: Compile WebAssembly
+    needs: changes
+    if: ${{ !cancelled() && ((github.event_name == 'workflow_dispatch' && inputs.cross_compile) || needs.changes.outputs.wasm == 'true') }}
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 30
    steps:
@@ -916,3 +1157,49 @@ jobs:
          . "$HOME/.cargo/env"
          export CRAFT_FONTS_DIR="$PWD/craft-fonts"
          cargo check --all-targets --locked --target riscv64gc-unknown-linux-gnu
+
+  # Nobody watches the nightly run, and it failed every day from 2026-10-16 to 2026-10-28 before
+  # anyone noticed. When a nightly fails, open one issue, "Nightly CI is failing" (label `ci`), or
+  # comment on it if it is already open; when a nightly passes, close it. A nightly that neither
+  # failed nor fully passed (cancelled) leaves the issue as it is. The only job that may write issues.
+  nightly-alert:
+    name: Nightly alert
+    needs: [dependency-advisories, changes, checks, ci, build-tests, action-matrix, action-matrix-determinism, property-tests]
+    if: always() && github.event_name == 'schedule'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    permissions:
+      issues: write
+    steps:
+      - name: Open, update or close the nightly issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RESULTS: ${{ toJSON(needs) }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          SHA: ${{ github.sha }}
+        run: |
+          title="Nightly CI is failing"
+          failed=$(jq -r 'to_entries[] | select(.value.result == "failure") | .key' <<<"$RESULTS")
+          unfinished=$(jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "failure") | "\(.key) (\(.value.result))"' <<<"$RESULTS")
+          issue=$(gh issue list --state open --label ci --limit 100 --json number,title \
+            --jq "[.[] | select(.title == \"$title\")] | first | .number // empty")
+          if [ -n "$failed" ]; then
+            body="The nightly run on ${SHA:0:9} failed: $RUN_URL
+
+          Failed jobs: $(paste -sd , - <<<"$failed" | sed 's/,/, /g')."
+            if [ -n "$issue" ]; then
+              gh issue comment "$issue" --body "$body"
+            else
+              gh issue create --title "$title" --label ci --body "$body
+
+          This issue is opened and updated by the nightly run (the nightly-alert job in .github/workflows/ci.yml) and closed by the first nightly that passes."
+            fi
+          elif [ -z "$unfinished" ]; then
+            if [ -n "$issue" ]; then
+              gh issue close "$issue" --comment "The nightly run on ${SHA:0:9} passed: $RUN_URL"
+            fi
+            echo "The nightly passed."
+          else
+            echo "Nothing failed, but not every job finished: $unfinished. The issue is left as it is."
+          fi
@@ -0,0 +1,42 @@
+# Nightly import checks on real-world STEP files (#1397): the external corpus in
+# tests/external-corpus.toml is downloaded (hash-verified), imported headless, and checked
+# against tolerance-based expectations — body counts, total volume and area, time and memory
+# budgets. It is not part of `cargo xtask ci`: it downloads from the internet.
+#
+# Import results should improve over time (healing, edge merging, meshing). When a check fails
+# because the numbers moved for the better (or the source changed upstream), re-record with
+# `cargo xtask external-corpus --bless "why"` in a pull request, never by editing numbers.
+name: External corpus
+
+on:
+  schedule:
+    - cron: '40 3 * * *'
+  workflow_dispatch:
+    inputs:
+      only:
+        description: "Run only this corpus entry name (empty = every entry)"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  corpus:
+    name: Import the external STEP corpus
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build the CLI
+        run: cargo build --profile ci -p solidcraft-cli
+      - name: Import and check every entry
+        env:
+          ONLY: ${{ inputs.only }}
+        run: |
+          if [ -z "$ONLY" ]; then
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli
+          else
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli --only "$ONLY"
+          fi
@@ -1,6 +1,8 @@
 # Files generated from the code are rewritten here, on main, after each merge, so pull requests
 # never edit them (two pull requests that each regenerated one would always conflict):
 # THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
+# Pending files (assets/locales/pending, attribution/pending) are folded into the catalogs and
+# ATTRIBUTION.md by `cargo xtask fold-pending`.
 name: Generated files

 on:
@@ -17,6 +19,8 @@ on:
      - "crates/engine/**"
      - "apps/solidcraft-cli/**"
      - "xtask/**"
+      - "assets/locales/pending/*.json"
+      - "attribution/pending/*.md"
      - ".github/workflows/generated.yml"
  workflow_dispatch:

@@ -48,13 +52,15 @@ jobs:
        run: cargo xtask licences
      - name: docs/features.md
        run: cargo xtask features
+      - name: Pending locale strings and attribution rows
+        run: cargo xtask fold-pending
      - name: Commit if changed
        run: |
-          if git diff --quiet -- THIRD-PARTY-LICENSES.txt docs/features.md; then echo "unchanged"; exit 0; fi
+          if [ -z "$(git status --porcelain)" ]; then echo "unchanged"; exit 0; fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add THIRD-PARTY-LICENSES.txt docs/features.md
-          git commit -m "Regenerate THIRD-PARTY-LICENSES.txt and docs/features.md [skip ci]"
+          git add -A THIRD-PARTY-LICENSES.txt docs/features.md assets/locales ATTRIBUTION.md attribution
+          git commit -m "Regenerate generated files and fold pending files [skip ci]"
          for _ in 1 2 3; do
            git pull --rebase origin main && git push origin HEAD:main && exit 0
            sleep 10
@@ -16,7 +16,7 @@ on:
 permissions:
  contents: read # to check out scripts/kernel-paused
  issues: write
-  pull-requests: read # to list a PR's changed paths
+  pull-requests: write # to list a PR's changed paths and add its label
  discussions: write

 concurrency:
@@ -39,6 +39,8 @@ jobs:
        run: python3 packaging/tests/nightly_test.py
      - name: Windows executable icon validation regression
        run: python3 packaging/tests/windows_icon_test.py
+      - name: AppImage CLI wrapper regression
+        run: python3 packaging/tests/apprun_test.py
      - name: Flatpak desktop smoke validation regression
        run: python3 packaging/tests/flatpak_test.py
      - name: PowerShell
@@ -53,13 +55,15 @@ jobs:
      - name: XML, desktop entry, AppStream, Flatpak manifest
        run: |
          xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
-          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          # The window's X11 class is its app id; the old id stays only as the rename shims.
-          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
+          desktop-file-validate assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          # The window's X11 class is its app id; the old ids stay only as the rename shims.
+          grep -qx 'StartupWMClass=io.tangencylabs.solidcraft' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solidcraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -qx 'X-Flatpak-RenamedFrom=ai.storyteller.solidcraft.desktop;ai.storyteller.solvecraft.desktop;' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
          grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/io.tangencylabs.solidcraft.bundle.yml')); assert m['id'] == 'io.tangencylabs.solidcraft' and m['command'] == 'solidcraft'"
          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"
          python3 -m py_compile packaging/linux/snap-smoke.py
@@ -65,6 +65,7 @@ jobs:
        run: |
          mkdir -p site
          cp -r target/book/. site/
+          bash docs/book/seo.sh site  # canonical links, robots.txt, sitemap.xml
          cp -r dist/web site/app
      - uses: actions/configure-pages@v5
        id: pages
@@ -0,0 +1,70 @@
+# Two quick checks on every pull request (CONTRIBUTING.md, "Sending a change"): no second open PR
+# for an issue a lower-numbered one already closes, and the "Changes a default:" line is filled in.
+# Neither is a required status check. The logic is in scripts/pr-checks/pr-checks.js (tested in ci.yml).
+name: PR checks
+
+on:
+  # pull_request, never pull_request_target: nothing here checks out or runs the PR's code, and the
+  # token is read-only for fork PRs. Only scripts/pr-checks from the PR's own merge commit is run.
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  duplicate:
+    name: Duplicate PR check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDuplicate({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  defaults:
+    name: Defaults line check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            const r = await checks.checkDefaults({ github, context, core });
+            core.info(JSON.stringify(r));
+
+  # Labelling needs write access, which a fork PR's token never has, so it is its own job and best
+  # effort: a fork PR just doesn't get the `changes-default` label from here.
+  label:
+    name: Label changes-default
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/pr-checks
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const checks = require('./scripts/pr-checks/pr-checks.js');
+            await checks.syncDefaultLabel({ github, context, core });
@@ -4,11 +4,15 @@
 # comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
-# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
+# A version with a suffix (0.2.0-rc.1) is a pre-release.
+# The macOS app is signed and notarized when the APPLE_* secrets exist. The Windows binaries and
+# MSI are Authenticode-signed through SignPath Foundation when the SIGNPATH_API_TOKEN secret exists
+# (see the windows job). Nothing else is signed yet.
 #
 #   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
+#   Arch Linux x86_64, aarch64  .pkg.tar.zst, repackaged from the .tar.gz         the arch job
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
-#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
+#   macOS universal         .dmg, and the CLI as a .zip (both archs built in parallel)  packaging/macos
 #   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
 #   Web                     a .zip of the static site                              packaging/web
 #
@@ -17,6 +21,8 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+# A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
+#   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release

 on:
@@ -31,6 +37,10 @@ on:
        description: "Create/update a draft (release branch only; off: build artifacts only)"
        type: boolean
        default: false
+      signpath_signing_policy:
+        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
+        type: string
+        default: ""

 permissions:
  contents: read
@@ -197,6 +207,45 @@ jobs:
          path: dist/release/*.flatpak
          if-no-files-found: error

+  arch:
+    name: Arch Linux ${{ matrix.arch }}
+    needs: [version, linux]
+    if: needs.version.outputs.build == 'true'
+    # makepkg only repackages the tarball's prebuilt binaries, so both architectures build here.
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x86_64, aarch64]
+    env:
+      VERSION: ${{ needs.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      # The Craft apps' shared Arch packaging (storytold/craft-common-actions, MIT OR Apache-2.0):
+      # makepkg in an archlinux:base-devel container. The package is named after the tarball's
+      # .desktop file (io.tangencylabs.solidcraft) and written as
+      # dist/release/solidcraft-<version>-linux-<arch>.pkg.tar.zst.
+      - uses: storytold/craft-common-actions/actions/arch-package@fa5ef18780cf5e7d5d3b8de068de56cffc83cac5 # main
+        with:
+          tarball: dist/linux/solidcraft-${{ env.VERSION }}-linux-${{ matrix.arch }}.tar.gz
+          arch: ${{ matrix.arch }}
+      - name: Check the package
+        env:
+          PKG: dist/release/solidcraft-${{ env.VERSION }}-linux-${{ matrix.arch }}.pkg.tar.zst
+        run: |
+          tar --zstd -tf "$PKG" | grep -E '^usr/bin/solidcraft$|^usr/bin/solidcraft-cli$|^usr/share/applications/io\.tangencylabs\.solidcraft\.desktop$'
+          tar --zstd -xOf "$PKG" .PKGINFO | grep -E '^(pkgname|pkgver|arch) = '
+          tar --zstd -xOf "$PKG" .PKGINFO | grep -qx 'pkgname = io.tangencylabs.solidcraft'
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-arch-${{ matrix.arch }}
+          path: dist/release/*.pkg.tar.zst
+          if-no-files-found: error
+


  snap:
@@ -288,18 +337,26 @@ jobs:
            export CARGO_TARGET_DIR=/var/tmp/solidcraft-target CARGO_BUILD_JOBS=4
            bash packaging/freebsd/package.sh
            tar -tzf dist/release/solidcraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
+              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/io\.tangencylabs\.solidcraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-freebsd-x86_64
          path: dist/release/*
          if-no-files-found: error

-  macos:
-    name: macOS universal
+  # The two halves of the universal binary build in parallel on their own runners (each alone
+  # took about half of the old single job's 45 minutes); `macos` below joins and packages them.
+  macos-build:
+    name: macOS build ${{ matrix.arch }}
    needs: version
    if: needs.version.outputs.build == 'true'
    runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: aarch64, target: aarch64-apple-darwin }
+          - { arch: x86_64, target: x86_64-apple-darwin }
    env:
      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
@@ -307,12 +364,58 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@stable
        with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
+          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
-          key: release-macos-universal
-      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
-        run: packaging/macos/package.sh --arch universal
+          key: release-macos-${{ matrix.arch }}
+      - name: Build
+        run: packaging/macos/package.sh --build-only ${{ matrix.target }}
+      # Not named release-*: the release job collects every release-* artifact as an asset.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: macos-bin-${{ matrix.arch }}
+          path: |
+            target/${{ matrix.target }}/release/solidcraft
+            target/${{ matrix.target }}/release/solidcraft-cli
+            target/${{ matrix.target }}/release/solvecraft-cli
+          if-no-files-found: error
+
+  macos:
+    name: macOS universal
+    needs: [version, macos-build]
+    if: needs.version.outputs.build == 'true'
+    runs-on: macos-14
+    env:
+      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLIDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-aarch64
+          path: target/aarch64-apple-darwin/release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: macos-bin-x86_64
+          path: target/x86_64-apple-darwin/release
+      - name: Set up Developer ID signing and notarization
+        # Optional until the APPLE_* secrets exist (docs/releasing.md, "macOS signing"). Without
+        # them (forks, dry runs) the app keeps its ad-hoc signature and is not notarized.
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: packaging/macos/signing.sh --setup
+      - name: Join, sign, package and check (dmg, CLI zip; the dmg is mounted and checked)
+        run: |
+          # Artifacts don't keep the executable bit.
+          chmod +x target/*-apple-darwin/release/solidcraft target/*-apple-darwin/release/solidcraft-cli target/*-apple-darwin/release/solvecraft-cli
+          packaging/macos/package.sh --arch universal --skip-build ${MACOS_SIGN_IDENTITY:+--sign}
+      - name: Remove the signing keychain and API key
+        if: always()
+        run: packaging/macos/signing.sh --cleanup
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-macos
@@ -323,7 +426,14 @@ jobs:
    name: Windows ${{ matrix.arch }}
    needs: [version, icons]
    if: needs.version.outputs.build == 'true'
+    # Must stay a GitHub-hosted runner, like every job before it: SignPath's open-source policy
+    # only signs builds whose jobs all ran on GitHub-hosted runners.
    runs-on: windows-latest
+    # actions: read lets the SignPath action read this job's details and fetch the uploaded
+    # artifact with GITHUB_TOKEN (the workflow default above grants contents: read only).
+    permissions:
+      contents: read
+      actions: read
    strategy:
      fail-fast: false
      matrix:
@@ -334,6 +444,16 @@ jobs:
          - { arch: arm64, target: aarch64-pc-windows-msvc }
    env:
      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      # Authenticode signing through SignPath Foundation (docs/releasing.md, "Windows signing").
+      # Only when the API token secret exists: forks and repositories without it build unsigned,
+      # exactly as before. `if:` can't read secrets, so the check goes through this variable.
+      SIGN_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
+      # The one switch between the self-signed test certificate (test-signing) and the real one
+      # (release-signing): a dispatch input, else the SIGNPATH_SIGNING_POLICY repository variable,
+      # else test-signing.
+      SIGNPATH_SIGNING_POLICY: ${{ inputs.signpath_signing_policy || vars.SIGNPATH_SIGNING_POLICY || 'test-signing' }}
+      SIGNPATH_ORGANIZATION_ID: fa603ff4-c702-404b-8588-a524371c7a4e
+      SIGNPATH_PROJECT_SLUG: solidcraft
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -352,10 +472,109 @@ jobs:
          dotnet tool install --global wix --version 5.0.2
          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
      - name: Build and package (msi, portable zip)
+        if: env.SIGN_WINDOWS != 'true'
        shell: pwsh
        env:
          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+
+      # ---- signed path ---------------------------------------------------------------------------
+      # SignPath's GitHub integration (docs.signpath.io/trusted-build-systems/github): the files go
+      # up as a workflow artifact, SignPath fetches that artifact itself (so it can verify it came
+      # from this workflow run), signs it, and the action downloads the signed copy. GitHub stores
+      # artifacts as zips, so packaging/windows/signpath-artifact-configuration.xml (pasted into the
+      # SignPath project) describes a zip holding the files at its top level.
+      # Two rounds: the .exe files first, so the MSI, the portable zip and the plain .exe all carry
+      # signed binaries; then the MSI built from them.
+      - name: Build and stage the binaries for signing
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase stage
+      - name: Upload the unsigned binaries
+        id: unsigned-exes
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-exes-windows-${{ matrix.arch }}
+          path: target/windows-package/${{ matrix.arch }}/*.exe
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the binaries (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-exes.outputs.artifact-id }}
+          wait-for-completion: true
+          # release-signing requests wait for a person to approve them in SignPath; give that an
+          # hour instead of the default 10 minutes. test-signing requests finish in seconds.
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-exes-${{ matrix.arch }}
+      - name: Put the signed binaries in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $stage = "target/windows-package/${{ matrix.arch }}"
+          foreach ($exe in 'solidcraft.exe', 'solidcraft-cli.exe', 'solvecraft-cli.exe') {
+            $signed = "target/windows-package/signed-exes-${{ matrix.arch }}/$exe"
+            # The artifact configuration matches each file optionally, so check that every file
+            # actually came back signed rather than trusting the request's success.
+            $sig = Get-AuthenticodeSignature $signed
+            if (-not $sig.SignerCertificate) { throw "$exe came back from SignPath without a signature ($($sig.Status))" }
+            # The test certificate is self-signed, so Status is not Valid until release-signing.
+            Write-Output "$exe signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+            Copy-Item -Force $signed "$stage/$exe"
+          }
+      - name: Package the signed binaries (msi, portable zip)
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase package
+      - name: Upload the unsigned MSI
+        id: unsigned-msi
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-msi-windows-${{ matrix.arch }}
+          path: dist/release/*.msi
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the MSI (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
+          wait-for-completion: true
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-msi-${{ matrix.arch }}
+      - name: Put the signed MSI in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = Get-Item "dist/release/*.msi"
+          $signed = "target/windows-package/signed-msi-${{ matrix.arch }}/$($msi.Name)"
+          $sig = Get-AuthenticodeSignature $signed
+          if (-not $sig.SignerCertificate) { throw "$($msi.Name) came back from SignPath without a signature ($($sig.Status))" }
+          Write-Output "$($msi.Name) signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+          Copy-Item -Force $signed $msi.FullName
+          "Windows ${{ matrix.arch }}: Authenticode-signed through SignPath (policy $env:SIGNPATH_SIGNING_POLICY, $($sig.SignerCertificate.Subject))." >> $env:GITHUB_STEP_SUMMARY
+      - name: Note the unsigned build
+        if: env.SIGN_WINDOWS != 'true'
+        shell: pwsh
+        run: '"Windows ${{ matrix.arch }}: unsigned (no SIGNPATH_API_TOKEN secret)." >> $env:GITHUB_STEP_SUMMARY'
+
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-windows-${{ matrix.arch }}
@@ -392,7 +611,7 @@ jobs:

  release:
    name: GitHub Release or dry-run artifacts
-    needs: [version, linux, flatpak, snap, freebsd, macos, windows, web]
+    needs: [version, linux, flatpak, arch, snap, freebsd, macos, windows, web]
    if: needs.version.outputs.build == 'true'
    runs-on: ubuntu-latest
    permissions:
@@ -418,7 +637,7 @@ jobs:
          shopt -s nullglob
          for f in "solidcraft-$VERSION-"*; do
            case "$f" in
-              *.msi | *-portable.zip | *.dmg | *.AppImage | *.deb | *.rpm | *.flatpak | *.snap)
+              *.msi | *-portable.zip | *.dmg | *.AppImage | *.deb | *.rpm | *.flatpak | *.snap | *.pkg.tar.zst)
                cp -- "$f" "solidcraft-${f#"solidcraft-$VERSION-"}" ;;
            esac
          done
@@ -11,3 +11,7 @@ __pycache__/

 # cargo-mutants output (docs/mutation-testing.md)
 mutants.out*/
+
+# external corpus downloads (cargo xtask external-corpus, #1397): fetched at test time,
+# hash-pinned in tests/external-corpus.toml; never commit case data
+/corpus/
@@ -1,216 +1,47 @@
-# SolidCraft — instructions for agents
+# SolidCraft: instructions for agents

-SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
-sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Projects published by
-[storytold](https://github.com/storytold) can serve as references for implementation conventions.
-Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, pure-Rust parametric 3D CAD app (sketch solver, feature timeline, B-rep kernel, an egui UI that agents drive). This file is a router: the hard rules, then the skill to read for your task. Humans: CONTRIBUTING.md.

-## Product name
-SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
-`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
-settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
-survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
-new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
-`/solidcraft/`; do not add permanent old-name Pages aliases.
+## Start here
+Work: ROADMAP.md, "Where help is wanted most" in CONTRIBUTING.md, issues labelled `help wanted`, `good first issue`, `needs-triage`; architecture in `docs/architecture.md`. Act when the code, docs and rules settle a question; ask only when it changes what users see. Local `plan/` notes are optional.

-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section.
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
+## Hard rules (what enforces each)
+- Independent: never copy another product's code, icons, text or templates; never drive or take data from commercial CAD. `skills/solidcraft-ground-rules/SKILL.md`.
+- No GPL/LGPL/AGPL code, not even reading it (OpenCASCADE, FreeCAD, SolveSpace, CadQuery, LibreCAD, QCAD): `cargo xtask licences --check`.
+- Every asset is original or openly licensed with a row in ATTRIBUTION.md; read `assets/AGENTS.md` before icon work: `cargo xtask assets`, `cargo xtask icons`.
+- Never crash: no unwrap/expect/panic/unsafe in non-test code (unsafe allowlist in crash-safety), errors are `Result`, input is hostile: clippy `-D warnings`, `hostile_params_never_panic`.
+- Everything is a command and programmatic calls never open dialogs: `skills/solidcraft-commands/SKILL.md`.
+- Layering (geom, sketch/kernel/render, doc, io, engine, ui-egui, apps); only `crates/kernel` uses truck: `cargo xtask layers`.
+- One outer UI container, one camera path (`navigation::handle`), colours from theme tokens: `cargo xtask ui-containers`.
+- Application code is Rust only and builds for wasm: `cargo xtask wasm`, `cargo xtask web-offline-test`.
+- The product name is SolidCraft; the old name lives only in `docs/compatibility.md`.
+- Sorted lists (message catalogs, `mod` lines, languages) stay sorted: `cargo xtask lists`. Never edit generated files (`docs/features.md`, `THIRD-PARTY-LICENSES.txt`) in a PR.
+- A design-format change is ONE new file in `crates/doc/src/format/pending/`: `scripts/test-format-pending.sh`.
+- A command has input and output schemas (will become required; `schema/unconverted.txt` only shrinks): `skills/solidcraft-commands/SKILL.md`.
+- New UI strings go in `assets/locales/pending/<slug>.json`, ATTRIBUTION rows in `attribution/pending/<slug>.md`: `cargo xtask lists`.
+- A changed default keeps the old behaviour behind a preference and fills the PR's `Changes a default:` line, and no second PR for an issue a lower-numbered one closes: `pr-checks.yml`.
+- A regression test goes in the area's existing test file, never a per-bug file (#3226).
+- Look at open PRs first, claim with a draft PR (lowest number wins), one topic per PR, never force-push `main`, no pushes just to catch up with `main`: `skills/solidcraft-contributing/SKILL.md`.
+- Show observable changes with real screenshots or a recording, captured yourself.
+- Run `cargo xtask ci` before every commit, without switching branches while it runs. `cargo xtask skills` keeps this file and `skills/` honest.

-`plan/` is gitignored (local only).
-
-## Never crash
-People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The exceptions, in the app crate and in
-  `crates/threedx-client` (which deny it instead), have no safe API: the macOS-only
-  `crates/threedx-client/src/macos.rs` (loads the 3Dconnexion driver's client framework at run time
-  and calls through its function pointers), two functions in
-  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
-  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
-  records crashes inside native code such as graphics drivers), the Windows-only
-  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
-  test of the window without OS decorations) and the Windows-only
-  `apps/solidcraft/src/space_mouse/windows_hid.rs` (asks Plug and Play which HID interfaces are 3D
-  mice, so no other device is sent anything).
- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
-  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
-  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
-  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
-  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
- **Where tests go:** a regression test goes into the existing test file for its area (booleans, blends,
-  shell, sweep, STEP, naming…), never a new file named after the bug (#3226).
- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
-  general CAD conventions and user feedback. Reference tests use analytic values and open-source
-  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
-  materials. File formats come from public specifications.
- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
-  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
-  measurements, command lists, ids or files produced with them.
- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
-  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
-  runs FreeCAD as a separate program through its public scripting API to compute reference values;
-  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
-  operations are our own.
- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
-  artwork from commercial CAD products — ever.** Command icons are the original SVG masters in
-  `assets/icons/ui/design/svg/`, compiled through `crates/ui-egui/src/icon_svg.rs`.
-  **Before any icon, icon assignment or media edit, read `assets/AGENTS.md`,
-  `assets/icons/ui/AGENTS.md` and `assets/icons/ui/STYLE_GUIDE.md`.** Use the canonical
-  bases and named finished references there; never invent a parallel icon style. Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
- **One outer UI container**: all panels, floating sheets, menus, overlays and platform UI
-  windows use `ui_kit::Container` (directly or through `Panel`, `Window`, `Confirm`, `Menu`).
-  Declare the semantic `Surface`; workspace panels use its shared layout policy and chrome.
-  System/report windows use `ui_kit::Window`; its low-level host builder is kit-private.
-  Do not construct raw egui hosts, outer popup/window frames or shadows in feature modules.
-  `cargo xtask ui-containers` recursively checks source/examples in all current and future crates
-  and apps. It runs in the fast repository CI job and `cargo xtask ci`, with no caller allowances.
-  See `docs/ui-container-audit.md` for the inventory and legitimate content/native exceptions.
- **One set of camera controls**: every page or canvas with a camera (viewport, Render
-  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
-  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
-  camera input (a test rejects it).
- **Application code is Rust only.** Units are millimetres and radians internally; Z is up.
-  Local asset authoring, lint and review tools use Python 3.11+ as documented in
-  `assets/AGENTS.md`; Python is not an application runtime dependency. The application exception is
-  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
-  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
-  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
- **Publishing**: the repository is github.com/tangency-labs/solidcraft. Changes land through
-  **pull requests** and the **merge queue**: push a branch and open a PR. The heavy CI jobs start
-  when a maintainer adds `approved-for-ci` after reviewing the code. Approved PRs go into the queue
-  with `gh pr merge N -R tangency-labs/solidcraft --squash --auto`; the queue runs the full suite
-  on each group before it lands on `main`. Keep each PR to one topic and one issue, and never
-  force-push `main`. Never commit `plan/`, build dirs (`target*/`) or generated reference data;
-  check `git ls-files` before pushing.
- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Showing and following through on changes
-
- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
-  issues and PRs must include actual descriptive screenshots or a short recording from a
-  small reproduction. This includes kernel, geometry, assembly and backend changes whose
-  effects can be shown in the app. Coding agents should run the app and capture this evidence
-  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
-  or result, preferably before and after, with brief reproduction steps, expected/actual
-  behavior and annotations that point out the relevant detail.
- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
-  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
-  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
- Use a small public-safe example and check for private designs, paths, account details or
-  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
-  recording; do not commit generated screenshots or videos just to provide review evidence.
- Throughout the work and before handoff, check the relevant PR's merge status. Don't push to
-  an open PR only to catch up with `main` (no merge of `main`, no Update branch, no rebase for
-  that alone): every push restarts the whole CI run, and `main`'s own run catches what lands in
-  between, to be fixed forward. When you push a change anyway, or GitHub reports a conflict,
-  rebase onto the latest `main` (push your own branch with `--force-with-lease`); never merge
-  `main` into a PR. Resolve conflicts without discarding others' work; never force-push `main`.
-  Don't re-run CI on an unchanged commit: a real failure fails again. Re-run only a job that
-  runner trouble cancelled, with "Re-run failed jobs". Report the PR state you checked and any
-  conflicts resolved. If a PR remains open, keep monitoring it while the task is active and
-  make its pending status clear at handoff; do not claim it merged without checking.
-
-## Before you start: look at what is already open
- Work with an authenticated GitHub CLI (`gh auth status`) and `git`; the checks below need both.
- Pull the whole list, not one search: `gh pr list -R tangency-labs/solidcraft --state open --limit 500`
-  (drafts included) and `gh issue list -R tangency-labs/solidcraft --state open --limit 500`. Look for
-  work on the same issue, the same feature under another number, and PRs that change the files
-  you are about to change (`gh pr list ... --json number,title,files`).
- If someone already has it, comment on their PR or issue instead of opening a second one. Two
-  PRs for one change can't both land, and one of them is wasted work and CI.
-
-## Claim = a draft PR
- Before working on issue #N, check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
-  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
-  issue wins**; if yours lost, close it. Opening the PR is the claim: the bot assigns you and
-  labels the issue `in progress` (or says on your PR who holds it). Reference `#N` in the PR title
-  so the bot can find it. Don't claim by editing files; comment `/claim` on the issue only to stake
-  a claim before you have a branch.
- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
-  comment on it first, then open your own claim (you may start from its branch).
-  This takeover policy is separate from the bot's automatic cleanup deadlines in CONTRIBUTING.md.
- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
-  and wait while it is over 24; build with `nice`.
-
-## Design file format
-A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
-(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
-`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
-works out the number (the next one while anything is pending), and the release folds pending
-changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
-  request on a connection carries the launch's token as `"token"`: read it from
-  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
-  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solidcraft-cli snapshot`.
- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
-  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
-  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
-  values never come from a commercial CAD product.
- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
-`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
-workflow; never regenerate them in a PR.
-
-## Lists many PRs add to
-Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
-(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
-then by id, generated files left to `main`, and a design-format change as one new file.
+## Working on X: read the skill first
+| Working on | Read |
+|---|---|
+| A PR, a claim, review, CI or evidence | `skills/solidcraft-contributing/SKILL.md` |
+| Licences, assets, clean-room, the name | `skills/solidcraft-ground-rules/SKILL.md` |
+| Non-test Rust, hostile input, a crash report | `skills/solidcraft-crash-safety/SKILL.md` |
+| A command, a crate boundary | `skills/solidcraft-commands/SKILL.md` |
+| A dialog, panel, camera, icon, colour | `skills/solidcraft-ui/SKILL.md` |
+| Labels, messages, translations | `skills/solidcraft-ui-text/SKILL.md` |
+| Saving something new in a design, import, export | `skills/solidcraft-file-formats/SKILL.md` |
+| Preferences, a changed default | `skills/solidcraft-preferences/SKILL.md` |
+| Writing or running tests | `skills/solidcraft-tests/SKILL.md` |
+| Slow work, the window thread, wasm | `skills/solidcraft-performance/SKILL.md` |
+| Releases, installers, packages | `skills/solidcraft-packaging/SKILL.md` |
+| Running the app, control channel, MCP tools | `skills/solidcraft-agent-tools/SKILL.md` |
+| Building a part over MCP | `skills/solidcraft-modeling/SKILL.md` |
+| Changing an existing design | `skills/solidcraft-editing/SKILL.md` |
+| A bug report, a crash, a wrong result | `skills/solidcraft-reporting/SKILL.md` |
+| Checking, porting, designs in git | `skills/solidcraft-checking/SKILL.md` |
+| Assemblies, joints, motion | `skills/solidcraft-mechanisms/SKILL.md` |
@@ -51,10 +51,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/app/macos/exports/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/icons/app/macos/source/SolidCraft.icon composition | MIT OR Apache-2.0 |
 | assets/models/test_boat.bin | 3DBenchy.com | 3DBenchy.com | Public Domain |
 | assets/models/make_test_boat.py | SolidCraft contributors | original script that packs a model into the compact file above | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: two boxes bridged by `surface.blend` (a 40x10 sheet, `solidcraft-cli snapshot` of plan/evidence script ev_blend) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a saddle rim (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch through two sketch lines built by `surface.boundary` with `crown: 0.4` (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: a 24 mm and a 10 mm box bridged by a `surface.blend` sheet (G1 at both edges), rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a skew four-line rim, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a surface through two 3D sketch splines built by `surface.boundary`, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft 0.22.1 itself (`solidcraft --sample`, default dark theme, 1600x1000) | MIT OR Apache-2.0 |
 | assets/samples/exports/0.png | SolidCraft contributors | original Sample Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/1.png | SolidCraft contributors | original Sheet Metal Bracket from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/2.png | SolidCraft contributors | original Hinge Assembly from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
@@ -62,10 +62,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/samples/exports/4.png | SolidCraft contributors | original Bolted Flange from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/5.png | SolidCraft contributors | original Vent Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/scripts.json | SolidCraft contributors | SHA-256 fingerprints of the original sample scripts, generated with the shipped thumbnails | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (2× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
+| docs/screenshots/demo.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/demo.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (15× playback, idle pauses cut, constant-rate camera orbit) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-floating.png | SolidCraft contributors | original UX mockup (Model tab, floating layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-compact.png | SolidCraft contributors | original UX mockup (Model tab, compact docked layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/sketch.png | SolidCraft contributors | original UX mockup (Sketch tab) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
@@ -84,6 +84,8 @@ Editable drawing code, native projects and shipped exports are collected under `
 | docs/book/src/generated/tool-preview.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/tool-preview.json`; gitignored) | MIT OR Apache-2.0 |
 | assets/fonts/liberation-sans/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in assets/fonts/liberation-sans/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
 | assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf | The BIZ UDGothic Project Authors | https://github.com/googlefonts/morisawa-biz-ud-gothic (Google Fonts), unmodified; licence text in assets/fonts/biz-udp-gothic/OFL.txt; used for web UI Japanese font | SIL OFL 1.1 |
+| assets/fonts/craft-ui-sc/CraftUI-SC.otf | Adobe / Google Inc. (Noto Sans SC); SolidCraft subset | https://github.com/notofonts/noto-cjk Sans/SubsetOTF/SC Regular, glyph-subset for assets/locales/zh.json and renamed Craft UI SC (OFL reserved-name); licence text in assets/fonts/craft-ui-sc/OFL.txt; web UI Simplified Chinese | SIL OFL 1.1 |
+| assets/fonts/craft-ui-tc/CraftUI-TC.otf | Adobe / Google Inc. (Noto Sans TC); SolidCraft subset | https://github.com/notofonts/noto-cjk Sans/SubsetOTF/TC Regular, glyph-subset for assets/locales/zh-TW.json and renamed Craft UI TC (OFL reserved-name); licence text in assets/fonts/craft-ui-tc/OFL.txt; web UI Traditional Chinese | SIL OFL 1.1 |
 | tests/step-conformance/cone_point.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
 | tests/step-conformance/cone_point_vertex.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
 | tests/step-conformance/cylinder.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
@@ -101,6 +103,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | tests/step-conformance/tiny_pin.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
 | tests/step-conformance/torus_ring_nurbs.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
 | tests/step-conformance/washer.step | step-conformance contributors | generated from formulas by https://github.com/dan335/step-conformance (corpus/generated, 96f30bb); import regression fixture | CC0-1.0 |
+| tests/step-regressions/rod_doubled_edge.step | SolidCraft contributors | written by SolidCraft from the commands of #4598 (a bored rod moved 100 mm and exported); import regression fixture | MIT OR Apache-2.0 |
 | tests/oracle/17-loft/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/17-loft/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/23-bracket-multifeature/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/23-bracket-multifeature/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/28-blind-pocket-fillets/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/28-blind-pocket-fillets/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
@@ -124,17 +127,19 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/appearances/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/appearances/opaque_finishes.rs | SolidCraft contributors | original illustrative opaque finish values; no external dataset, textures or measured engineering data | MIT OR Apache-2.0 |
 | assets/fonts/biz-udp-gothic/OFL.txt | The BIZ UDGothic Project Authors | Unmodified accompanying font licence | SIL OFL 1.1 |
+| assets/fonts/craft-ui-sc/OFL.txt | Adobe / Google Inc. (Noto CJK); SolidCraft header | Accompanying OFL for CraftUI-SC.otf | SIL OFL 1.1 |
+| assets/fonts/craft-ui-tc/OFL.txt | Adobe / Google Inc. (Noto CJK); SolidCraft header | Accompanying OFL for CraftUI-TC.otf | SIL OFL 1.1 |
 | assets/fonts/ibm-plex-mono/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/ibm-plex-sans/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/liberation-sans/OFL.txt | Red Hat, Inc.; Liberation Fonts contributors | Unmodified accompanying font licence | SIL OFL 1.1 |
-| assets/icons/app/linux/exports/hicolor/128x128/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/16x16/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/24x24/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/48x48/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/64x64/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/128x128/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/16x16/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/24x24/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/48x48/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft drawing code: the borderless mark, drawn from the faces and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/windows_ico.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft-executable.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
@@ -157,6 +162,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ms.json | A.Hakim (a-hakim) | Malay translation of the English message catalog | MIT OR Apache-2.0 |
+| assets/locales/nb.json | SolidCraft contributors | Original Norwegian Bokmål translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/nl.json | SolidCraft contributors | Original Dutch translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pl.json | cyryllo | Polish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
@@ -169,9 +175,13 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/zh-TW.json | SolidCraft contributors | Original Traditional Chinese (Taiwan) translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/macos/dmg/background.tiff | SolidCraft contributors | original disk image window background (blueprint sheet: grid, double border, circles, centre lines, leader arrow, title block) drawn by assets/platforms/macos/dmg/make_background.py in IBM Plex Sans/Mono; 1x and 2x representations | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/make_background.py | SolidCraft contributors | authoring script that draws the disk image background (Pillow); not part of any build | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/layout.json | SolidCraft contributors | disk image window size, icon size and icon positions shared by the background script and settings.py | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/settings.py | SolidCraft contributors | dmgbuild settings (MIT, https://github.com/dmgbuild/dmgbuild) for the SolidCraft disk image; original settings, no dmgbuild code copied | MIT OR Apache-2.0 |
 | assets/platforms/macos/Info.plist.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/macos/README.txt | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/windows/solidcraft.en-us.wxl | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
@@ -198,6 +208,8 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/styles/ui/themes/graphite.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/nosferatu.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Dracula by Zeno Rocha and the Dracula Theme contributors, https://github.com/dracula/dracula-theme, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/catppuccin-mocha.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Catppuccin by the Catppuccin organisation, https://github.com/catppuccin/catppuccin, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/okibi.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Okibi palette (dark) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/akari.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Akari palette (light) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
 | assets/styles/web/loading-logo.svg | SolidCraft contributors | Animation of the SolidCraft mark, built from the paths and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg; original animation | MIT OR Apache-2.0 |
 | assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | crates/io/src/native_cad/fixtures/block.FCStd | SolidCraft contributors | original 10 × 20 × 30 mm test box saved by FreeCAD 1.1.4 run as an external program (`make_block_fcstd.py` beside it); no third-party geometry | MIT OR Apache-2.0 |
@@ -280,8 +292,57 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/circle_tt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/circle_ttt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/coil.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components_off.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/combine.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/component.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+
+### Render workspace icon drafts
+
+Original SolidCraft drawings, Open for owner review; no runtime assignments.
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/icons/ui/design/svg/model/render_all_shots.svg | SolidCraft contributors | original Camera icon master (64 grid): stacked camera bodies with a lower-right play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_appearance.svg | SolidCraft contributors | original Looks icon master (64 grid): shaded look sphere on the top corner of an accent-shaded cube | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_aspect_frame.svg | SolidCraft contributors | original Camera icon master (64 grid): wide rounded frame with two opposite corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_backdrop.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube in front of a tall upright accent panel | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_cancel.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round stop badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_check.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round check badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_compare.svg | SolidCraft contributors | original Output icon master (64 grid): two grey pictures split by a vertical slider with opposed arrows | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_copy_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere in a square frame offset from a second frame outline | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_execute.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_export_image.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a large outward diagonal arrow at the upper right | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_exposure.svg | SolidCraft contributors | original Camera icon master (64 grid): split light and accent disc with plus and minus marks | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_fit_product.svg | SolidCraft contributors | original Camera icon master (64 grid): grey cube inside four corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_frame_guides.svg | SolidCraft contributors | original Camera icon master (64 grid): rounded frame with a rule-of-thirds grid and four accent nodes | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_from_material.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere struck through above a plain grey slab | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_ground.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube on a slab with an accent contact patch | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lens.svg | SolidCraft contributors | original Camera icon master (64 grid): concentric lens rings around an accent centre | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_library.svg | SolidCraft contributors | original Studio icon master (64 grid): row of three look spheres, middle one accent, on a shelf bar | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_area.svg | SolidCraft contributors | original Lights icon master (64 grid): slanted flat panel above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_by_highlight.svg | SolidCraft contributors | original Lights icon master (64 grid): shaded sphere with a ringed highlight target and dotted stem arriving from above | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_point.svg | SolidCraft contributors | original Lights icon master (64 grid): round source disc with centre dot above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_spot.svg | SolidCraft contributors | original Lights icon master (64 grid): cone source with curved rim above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lighting_presets.svg | SolidCraft contributors | original Studio icon master (64 grid): two stacked cards, the front one holding a light bulb | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_output_size.svg | SolidCraft contributors | original Output icon master (64 grid): picture frame with a diagonal double-headed dimension arrow | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_paint.svg | SolidCraft contributors | original Looks icon master (64 grid): flat brush with an accent tip, light ferrule and slate handle | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_pick_up.svg | SolidCraft contributors | original Looks icon master (64 grid): eyedropper with a grey bulb, slate crossbar and accent sampling tip | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_quality.svg | SolidCraft contributors | original Output icon master (64 grid): three rising bars, the tallest in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_replace_all.svg | SolidCraft contributors | original Looks icon master (64 grid): grey sample sphere with an arrow to an accent sphere beside a second one | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_results.svg | SolidCraft contributors | original Output icon master (64 grid): stack of two pictures, the front one showing a landscape | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_same_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere and three cubes, the two matching cubes ringed | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right plus badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shots_strip.svg | SolidCraft contributors | original Camera icon master (64 grid): strip of three small frames, the middle one in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_solo_light.svg | SolidCraft contributors | original Lights icon master (64 grid): point source and dotted stem inside four corner focus brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_sun.svg | SolidCraft contributors | original Lights icon master (64 grid): source disc with eight short radial rays | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_transparent_background.svg | SolidCraft contributors | original Output icon master (64 grid): grey cube on a checker tile | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_update_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right refresh badge | MIT OR Apache-2.0 |
+
+### UI icon masters (continued)
+
+| File | Author | Source | Licence |
+|---|---|---|---|
 | assets/icons/ui/design/svg/model/compute.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/configuration_table.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/conic.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -371,6 +432,21 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/flat/shield.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/status_recovery.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/frame_member.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_environment.svg | SolidCraft contributors | original Studio icon master (64 grid): dome with a grey cube inside | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_shaded.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_wireframe.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_hidden_edges.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_translucent.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_faces_edges.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_bodies.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_features.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_parts.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_components.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_sketch.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/display.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/grid.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/ground_shadow.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/ambient_occlusion.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/placeholder.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane_angle.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -512,6 +588,52 @@ Editable drawing code, native projects and shipped exports are collected under `

 | docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |
 | docs/sponsors/blacksmith-ci-powered.png | Blacksmith (blacksmith.sh) | "CI powered by Blacksmith" sponsor banner supplied by Blacksmith for the sponsorship credit; used only to credit the sponsor, not part of the application | © Blacksmith, used with permission |
+| assets/icons/ui/design/svg/model/path_flange.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| docs/book/src/generated/hem.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/hem.json`; gitignored), original sheet metal demonstration | MIT OR Apache-2.0 |
+| docs/book/scripts/hem.json | SolidCraft contributors | original parametric recipe for an 80 × 50 mm sheet with an 8 mm returned edge, authored for the command guide | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay.json | SolidCraft contributors | original SolidCraft theme file (Clay, light): warm paper palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay-dark.json | SolidCraft contributors | original SolidCraft theme file (Clay Dark): warm charcoal palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/cone.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/locales/ar.json | Abdullah (A-AL-ANAZI) | Original Arabic translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/he.json | SolidCraft contributors | Original Hebrew translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/cga.json | SolidCraft contributors | original SolidCraft theme file using the 16 colours of the IBM Color Graphics Adapter (black, cyan, magenta, and white of its high-intensity palette 1 for the interface) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit-dark.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| `assets/locales/pending/navbar-customisation.json` | SolidCraft contributors | Original navigation bar editor translations | MIT OR Apache-2.0 |
+| `assets/locales/pending/navbar-slots.json` | SolidCraft contributors | Original navigation slot translations | MIT OR Apache-2.0 |
+| assets/locales/bs.json | Tarik Sijercic (tsijercic1) | Original Bosnian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/hr.json | Tarik Sijercic (tsijercic1) | Original Croatian translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/sr.json | Tarik Sijercic (tsijercic1) | Original Serbian (ekavian, Cyrillic) translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/finish_edit.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| `assets/locales/pending/sketch-tracking-guides.json` | SolidCraft contributors | Original alignment-guide preference labels and help text | MIT OR Apache-2.0 |
+| assets/locales/pending/point-clouds.json | SolidCraft contributors | Original point-cloud UI strings and translations | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/feature_group.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/mesh_body.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/timeline_play.svg | SolidCraft contributors | Original history playback icon; canonical grey_cube base and original action cue | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/timeline_stop.svg | SolidCraft contributors | Original history playback icon; canonical grey_cube base and original action cue | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/status_pin.svg | SolidCraft contributors | Original analytic pin icon for persistent viewport results | MIT OR Apache-2.0 |
+| assets/locales/pending/render-wear.json | SolidCraft contributors | Original UI labels and translations | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/equation_curve.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/locales/pending/sketch-recent-snap.json | SolidCraft contributors | Original preference messages for the recent centre and midpoint snap | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_horizontal.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_vertical.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_angle.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_parallel.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_perpendicular.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_tangent_external.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_tangent_at.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_tangent_two.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/construction_line_bisector.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-circle.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-circle.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-flower.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-flower.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-involute.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-involute.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-line.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-line.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-parabola.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-parabola.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-spiral.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-spiral.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/equation-wave.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/equation-wave.json`; gitignored) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/print_face.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/locales/fi.json | SolidCraft contributors | Original Finnish translation of SolidCraft's English catalog, AI-assisted (Claude Code) clean-room from the English and not yet reviewed line by line by a native speaker; no commercial CAD text used | MIT OR Apache-2.0 |

 ## Code adapted from sibling projects

@@ -571,6 +693,7 @@ copied into SolidCraft.

 | Directory | Source | Licence | Changes |
 |---|---|---|---|
+| vendor/accesskit_macos | accesskit_macos 0.26.3, https://github.com/AccessKit/accesskit (The AccessKit contributors) | MIT OR Apache-2.0 | the subclassing adapter and its tests from 0.27.2: dropping the adapter keeps AppKit's key-value observers (vendor/README.md) |
 | vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: bounded parameter searches, collapsed-boundary projection, subdivision and provisional fixed-grid previews (vendor/README.md) |
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
 | vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro; corner choice at vertices several intersection curves end on; reuse of an operand's meshes (vendor/README.md) |
@@ -1,8 +1,10 @@
 # Contributing to SolidCraft

+Agents: start from the router in [AGENTS.md](AGENTS.md), which points to a short skill in [`skills/`](skills/README.md) for each kind of work. This page stays the full human guide.
+
 SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
 You sketch on a plane, constrain the sketch, turn profiles into solids, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, macOS, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.

@@ -11,7 +13,7 @@ build it, how the code is laid out, the few rules that aren't negotiable, and wh
 needed most.

 Before choosing a task, check the [command inventory](docs/features.md) and
-[roadmap](ROADMAP.md) for implemented capabilities and current priorities.
+[roadmap](docs/roadmap-detail.md) for implemented capabilities and current priorities.

 Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).

@@ -115,7 +117,8 @@ The [architecture page](docs/architecture.md) has the layer table. The short ver
   not.) Permissive
   dependencies are fine. Note which one you're adding and why in the PR. THIRD-PARTY-LICENSES.txt
   lists it once the change lands: the Generated files workflow rewrites it on `main`.
-   Nightly/manual CI also scans advisories, bans and sources with cargo-deny; see
+   Nightly/manual CI also scans advisories, bans and sources with cargo-deny, and a PR that
+   changes Cargo.lock or a Cargo.toml checks the advisories; see
   [the local command and coverage limits](docs/book/src/dev/testing.md#dependency-advisories).
 3. **Every asset is original or openly licensed and has a row in
   [ATTRIBUTION.md](ATTRIBUTION.md).** Icons are drawn in code (`crates/ui-egui/src/icons.rs`).
@@ -130,8 +133,11 @@ The [architecture page](docs/architecture.md) has the layer table. The short ver
   - Every call into truck goes through `solidcraft_kernel::guard`.
   - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
-   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
+   `crates/engine/src/cmd/` with input and output schemas (see
+   [Adding a command](docs/book/src/dev/commands.md#adding-a-command); a test warns about a
+   command without them, and will fail it once required), engine tests that measure the result (volume, area,
   face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+   A command on the toolbar also ships with its help tooltip (step 6 of Adding a command).
 6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
   viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
   `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
@@ -190,9 +196,11 @@ in the PR. `cargo xtask test` builds the tests with it and then runs every test
 shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
 For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
 worker consumes one of those slots. Every binary and side check still runs after failures.
-Without the variable the existing concurrency is unchanged. `RUST_TEST_THREADS`,
-`ACTION_MATRIX_JOBS` and Cargo's build-job setting remain independent caller overrides;
-this limit does not choose their values or change test filters, timeouts or baselines.
+Without the variable the existing concurrency is unchanged. With it set, each test binary
+inherits `RUST_TEST_THREADS` and `ACTION_MATRIX_JOBS` of `max(1, cpus / jobs)` — the machine's
+parallelism shared between the binaries in flight — unless you set either one explicitly;
+explicit caller overrides always win. Cargo's build-job setting remains an independent caller
+override; this limit does not change test filters, timeouts or baselines.
 Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.

 **Ready pull requests test what they touch.** CI maps changed files to workspace packages and
@@ -261,7 +269,9 @@ a conflict. `crates/doc/src/format/pending/README.md` has an example.

 **At release time** the maintainer runs `scripts/fold-format-pending.sh`, which moves the pending
 files into `crates/doc/src/format/v<N>/` and fixes that number for good (see
-[docs/releasing.md](docs/releasing.md)). Never add a file to a `v<N>/` folder afterwards.
+[docs/releasing.md](docs/releasing.md)). Never add a file to a `v<N>/` folder afterwards. Drawings
+follow the same rules with their own numbers, from 1, in `crates/doc/src/drawing/format/` (see its
+`pending/README.md`), and the same script folds them.

 ## Lists many changes add to

@@ -269,17 +279,36 @@ Some files gain an item in many pull requests at once. They are kept so that two
 each add an item only meet when their items are neighbours, which spares everyone a conflict
 and a fresh CI run:

+- **Growing Rust lists**: use slices (`const ITEMS: &[Item] = &[...];`) without a written
+  length. `cargo xtask lists` rejects non-test const/static arrays with more than ten lines
+  of entries, except fixed standard or algorithm tables listed with reasons in `xtask/src/lists.rs`.
+  Built-in themes need only a JSON file in `assets/styles/ui/themes/`, with a unique nonnegative
+  integer `order` (the picker order) and its own `provenance` line; keep existing order values.
 - **Message catalogs** (`assets/locales/*.json`): one message per line, sorted by id. Add your
  message anywhere and run `cargo xtask lists --fix`; `cargo xtask lists` (in `cargo xtask ci`
  and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
 - **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
  sorted). Add a new module into the existing group, not as a new group at the end.
+- **Commands without schemas** (`crates/engine/src/schema/unconverted.txt`): sorted, one id per
+  line, and it only shrinks. Converting a command removes its line; a new command is never added
+  to it.
+- **Toolbar commands without help** (`BACKLOG` in `crates/ui-egui/src/command_help.rs`): sorted,
+  one id per line, and it only shrinks. Writing a command's help removes its line; a new command
+  is never added to it.
+- **`ui.prefs` settings** (`docs/control-protocol.md`): one line per setting, sorted by name, in
+  the list under the protocol table; add a new setting on its own line rather than editing a shared
+  row.
 - **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
  checks it).
 - **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
  after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
  features`). Don't regenerate or edit them in a pull request.
 - **Design format**: one file per change, never an edit to a shared number (above).
+- **New UI strings and attribution rows**: one new file per change, `assets/locales/pending/<slug>.json`
+  and `attribution/pending/<slug>.md`, instead of editing the catalogs or the ATTRIBUTION.md table;
+  `cargo xtask fold-pending` folds them on `main` (see the README in each folder). A new English
+  message also needs every catalog delivered complete (`COMPLETE` in `crates/ui-egui/src/i18n.rs`:
+  today ar, he, ja, vi, and zh) in the same pending file; `cargo xtask i18n --check` reports any gap.

 ## Sending a change

@@ -331,6 +360,16 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.

+To show a picture without committing it, attach the media to the PR (it goes to the PR's own
+attachment storage and renders inline in the comment). A gist is the better home for a log or
+another text file, and you link it; a gist does not render a picture inline. The review artifacts
+stay out of the diff that way, and nothing has to be pushed to a branch of its own.
+
+Attaching works in the browser for anyone who can comment: drag the file into a comment on the
+pull request. A command-line agent without a browser session usually cannot attach a file (the
+upload needs write access to this repository). Say so in the pull request, and the person running
+the agent or a maintainer can attach it.
+
 Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
 `main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
 run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
@@ -346,6 +385,10 @@ owning one area, with a human setting direction and reporting bugs. Their workin
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.

+Two quick checks run on every pull request (`.github/workflows/pr-checks.yml`, not required): it
+fails when a lower-numbered open PR by someone else already closes the same issue (the label
+`not-a-duplicate` skips it), or when the description lacks the `Changes a default: no` / `Changes a default: yes — <what>, old behaviour kept behind preference <name>` line (docs-only and bot PRs are exempt).
+
 ## Labels and triage

 The triage bot labels every new issue and PR (`.github/workflows/triage.yml`). It only adds labels;
@@ -382,7 +425,7 @@ In order of how much they'd help users:
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
   through without a kernel error. Each failing seed is a reproducible bug.
 3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
-   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
+   [ROADMAP.md](docs/roadmap-detail.md)), but anyone who wants to own one is welcome.

 ## Updating the generated feature list

@@ -60,8 +60,6 @@ dependencies = [
 [[package]]
 name = "accesskit_macos"
 version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
 dependencies = [
 "accesskit",
 "accesskit_consumer 0.38.0",
@@ -1692,9 +1690,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi 6.0.0",
 "rand_core 0.10.1",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -3771,9 +3771,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"

 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
 "ring",
 "rustls-pki-types",
@@ -4208,7 +4208,7 @@ dependencies = [

 [[package]]
 name = "solidcraft"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "block2 0.6.2",
 "eframe",
@@ -4217,6 +4217,7 @@ dependencies = [
 "getrandom 0.3.4",
 "hidapi",
 "keyring",
+ "libc",
 "log",
 "muda",
 "objc2 0.6.5",
@@ -4228,23 +4229,27 @@ dependencies = [
 "rfd",
 "ron",
 "rustls",
+ "serde",
 "serde_json",
 "solidcraft-3dx-client",
 "solidcraft-engine",
+ "solidcraft-gpu",
 "solidcraft-space-mouse",
 "solidcraft-ui-egui",
 "ureq",
 "windows-sys 0.61.2",
 "winit",
+ "x11rb",
+ "zbus 5.19.0",
 ]

 [[package]]
 name = "solidcraft-3dx-client"
-version = "0.22.0"
+version = "0.28.0"

 [[package]]
 name = "solidcraft-cli"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "image",
 "log",
@@ -4256,7 +4261,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-derive"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4265,7 +4270,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-doc"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "log",
 "serde",
@@ -4282,8 +4287,9 @@ dependencies = [

 [[package]]
 name = "solidcraft-engine"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
+ "image",
 "log",
 "schemars",
 "serde",
@@ -4296,12 +4302,13 @@ dependencies = [
 "solidcraft-render",
 "solidcraft-sketch",
 "thiserror 2.0.21",
+ "toml_edit",
 "web-time",
 ]

 [[package]]
 name = "solidcraft-geom"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "serde",
 "serde_json",
@@ -4310,7 +4317,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-gpu"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "image",
 "log",
@@ -4330,13 +4337,14 @@ dependencies = [

 [[package]]
 name = "solidcraft-io"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "cadmpeg-core",
 "cadmpeg-ir",
 "cadmpeg-registry",
 "chardetng",
 "encoding_rs",
+ "gethostname",
 "gltf",
 "log",
 "quick-xml",
@@ -4353,7 +4361,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-kernel"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "log",
 "proptest",
@@ -4373,7 +4381,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-mcp"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "serde_json",
 "solidcraft-engine",
@@ -4382,7 +4390,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-render"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "image",
 "moxcms",
@@ -4396,25 +4404,27 @@ dependencies = [

 [[package]]
 name = "solidcraft-sketch"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
+ "harfrust",
 "serde",
 "serde_json",
 "solidcraft-geom",
 "thiserror 2.0.21",
 "ttf-parser",
+ "unicode-bidi",
 ]

 [[package]]
 name = "solidcraft-space-mouse"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "solidcraft-ui-egui"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "arboard",
 "egui",
@@ -4436,6 +4446,7 @@ dependencies = [
 "tiny-skia",
 "toml",
 "ttf-parser",
+ "unicode-bidi",
 "web-time",
 "winreg",
 "zip",
@@ -4443,15 +4454,17 @@ dependencies = [

 [[package]]
 name = "solidcraft-web"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "eframe",
 "egui",
 "js-sys",
 "log",
+ "percent-encoding",
 "serde_json",
 "solidcraft-engine",
 "solidcraft-ui-egui",
+ "url",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -4552,7 +4565,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "once_cell",
 "rustix 1.1.5",
 "windows-sys 0.61.2",
@@ -4698,6 +4711,7 @@ dependencies = [
 "indexmap",
 "toml_datetime",
 "toml_parser",
+ "toml_writer",
 "winnow",
 ]

@@ -4909,9 +4923,9 @@ dependencies = [

 [[package]]
 name = "typed-path"
-version = "0.12.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"

 [[package]]
 name = "typeid"
@@ -4942,6 +4956,12 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"

+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-general-category"
 version = "1.1.0"
@@ -5342,9 +5362,9 @@ dependencies = [

 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
 "rustls-pki-types",
 ]
@@ -5825,8 +5845,6 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
 dependencies = [
 "ahash",
 "android-activity",
@@ -5979,12 +5997,15 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.22.0"
+version = "0.28.0"
 dependencies = [
 "proc-macro2",
+ "serde",
 "serde_json",
 "sha2 0.10.9",
 "syn 2.0.119",
+ "toml",
+ "zip",
 ]

 [[package]]
@@ -6274,16 +6295,18 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "9.0.4"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
 "crc32fast",
 "flate2",
+ "getrandom 0.4.3",
 "indexmap",
 "memchr",
 "nix 0.31.3",
 "typed-path",
+ "windows-sys 0.61.2",
 "zopfli",
 ]

@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]

 [workspace.package]
-version = "0.22.0"
+version = "0.28.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -67,6 +67,9 @@ encoding_rs = "0.8"
 # glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
 # read by crates/io itself, so no image decoding or file access comes with it.
 gltf = { version = "1.4", default-features = false, features = ["names"] }
+# The computer's name in a design's "open elsewhere" lock file (MIT OR Apache-2.0; already in the
+# tree through x11rb).
+gethostname = "1"

 # FreeCAD and Rhino import (Apache-2.0, pure Rust; native and browser builds).
 # Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
@@ -77,7 +80,7 @@ cadmpeg-ir = "=0.6.3"
 cadmpeg-registry = { version = "=0.6.3", default-features = false, features = ["fcstd", "rhino", "step"] }

 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
-ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
+ttf-parser = { version = "0.25", default-features = false, features = ["std", "variable-fonts"] }

 # Ends a process group with the system call (MIT; already in the tree through zip).
 nix = { version = "0.31", default-features = false, features = ["signal"] }
@@ -158,6 +161,13 @@ matext4cgmath = { path = "vendor/matext4cgmath" }
 # Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
 egui-wgpu = { path = "vendor/egui-wgpu" }

+# Deliver trackpad pinch and rotation gestures on Wayland (zwp_pointer_gestures_v1), which
+# winit 0.30 never binds and eframe 0.36 still requires winit 0.30.
+winit = { path = "vendor/winit" }
+
+# macOS: dropping the accessibility adapter leaves AppKit's key-value observers intact (#7535).
+accesskit_macos = { path = "vendor/accesskit_macos" }
+
 # Mutation testing (cargo-mutants, docs/mutation-testing.md): the ci profile with incremental
 # builds, since every mutant rebuilds the crates above the one it changes.
 [profile.mutants]
@@ -0,0 +1,44 @@
+# Disclaimer
+
+This disclaimer covers the software, models, data, documentation and every other file in this
+repository and in the releases built from it (together, "the files").
+
+## No warranty
+
+The files are provided "as is", without warranty of any kind, express or implied, including
+warranties of accuracy, merchantability, fitness for a particular purpose and non-infringement.
+Results produced with the files, such as geometry, meshes, analyses and simulations, can be
+wrong. A qualified person must check them before anyone relies on them for a design,
+manufacturing or safety decision.
+
+## No liability
+
+To the fullest extent permitted by law, Tangency Labs and the contributors are not liable for any
+claim, damage, loss or other liability arising from the files or from their use, modification or
+distribution, whether in contract, tort or otherwise.
+
+## No indemnity
+
+Neither Tangency Labs nor any contributor indemnifies, defends or holds harmless anyone who uses,
+modifies or distributes the files, including against claims that the files infringe someone
+else's rights.
+
+## Harmful or unlawful use
+
+Tangency Labs and the contributors do not authorise, endorse or accept any responsibility for use
+of the files to harm people, animals, property or the environment, or for any unlawful use.
+Whoever uses the files is solely responsible for how they use them, for what they make with them
+and for complying with the laws that apply to them. Tangency Labs and the contributors must not be
+named or held out as responsible for any such use.
+
+## No endorsement
+
+Using, modifying or distributing the files does not mean that Tangency Labs or any contributor
+endorses you, your product or your results. Do not use the name of Tangency Labs or of a
+contributor to suggest such an endorsement without written permission.
+
+## Relation to the licence
+
+This disclaimer adds to the warranty and liability terms of the licence the files are distributed
+under. It does not restrict any right that licence grants; where the two differ, the licence
+governs.
@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" width="96" height="96" alt="SolidCraft" />
+  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" width="96" height="96" alt="SolidCraft" />
 </p>

 <h1 align="center">SolidCraft</h1>
@@ -42,25 +42,25 @@
 </p>

 <p align="center">
-  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily" alt="tangency-labs%2Fsolidcraft | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily" alt="tangency-labs%2Fsolidcraft | Trendshift" width="250" height="55"/></a>
+  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
 </p>

-![SolidCraft 0.8: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo-0.8.gif)
+![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)

-*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 9× playback. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo-0.8.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*

 ## Download

- **Windows:** the [installer][windows-msi], or `winget install bherbruck.SolidCraft`.
+- **Windows:** the [installer][windows-msi].
 - **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
 - **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
 - **Web:** [try it in your browser][web-app], no install.

 ARM64 and 32-bit builds, portable zip, .deb, .rpm, Flatpak and the other packages are on the
-[downloads page](docs/downloads.md). The downloads aren't signed yet: on Windows choose
-**More info**, then **Run anyway** in SmartScreen; on macOS right-click SolidCraft and choose **Open**
-the first time. On SolidCraft 0.11 to 0.14, download once by hand; see
+[downloads page](docs/downloads.md). The macOS app is signed with a Developer ID and notarized by
+Apple. The Windows downloads aren't signed yet: choose **More info**, then **Run anyway** in
+SmartScreen. On SolidCraft 0.11 to 0.14, download once by hand; see
 [updating](https://docs.solidcraft.io/guide/updates.html#updating-from-011-to-014).

 ## What works
@@ -74,7 +74,7 @@ other is a tracked bug.
 - **Parameters and configurations** with unit-aware expressions.
 - **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
 - **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.solidcraft` designs.
+- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.sc` designs (`.solidcraft` files from earlier releases still open).
 - **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.

 The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
@@ -96,8 +96,10 @@ More commands, the Windows cross-build and the browser build are in [docs/buildi

 `solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
 runs its own design session, or with `--connect` it drives the running app so you can watch.
-Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Tools, access rules and an
-example session: [docs/mcp.md](docs/mcp.md).
+Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. If a terminal doesn't find
+`solidcraft-cli` (older Windows installers don't put it on `PATH`), give its full path (by default
+`"C:\\Program Files\\SolidCraft\\solidcraft-cli.exe"`). Tools, access rules and an example session:
+[docs/mcp.md](docs/mcp.md).

 ## Scripts

@@ -119,6 +121,12 @@ the clean-room and licence rules, and where help is wanted most. Open work is in
 SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
 sponsors its CI minutes.

+## Disclaimer
+
+The files in this repository are provided as is, without warranty, liability or indemnity, and
+Tangency Labs and the contributors accept no responsibility for any harmful or unlawful use of
+them: read [DISCLAIMER.md](DISCLAIMER.md).
+
 ## Licence

 MIT OR Apache-2.0, at your option. Developed under the
@@ -142,3 +150,4 @@ Tinkercad are trademarks of their respective owners, named only to describe comp
 [linux-appimage]: https://github.com/tangency-labs/solidcraft/releases/latest/download/solidcraft-linux-x86_64.AppImage
 [snap-store]: https://snapcraft.io/solidcraft
 [web-app]: https://solidcraft.io/app
+
@@ -1,5 +1,85 @@
 # SolidCraft roadmap

+The short version, for people who use SolidCraft. The detailed developer status (milestone
+tables, limitations, measurements) is in [docs/roadmap-detail.md](docs/roadmap-detail.md).
+
+## What SolidCraft is
+
+SolidCraft is open-source parametric 3D CAD written in Rust. You sketch, constrain, extrude, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app and in the browser
+([try it](https://solidcraft.io/app)), and it has a command-line tool and an MCP server so that
+scripts and AI agents can drive the same commands you use.
+
+## Works today
+
+- Sketching with a constraint solver, and the usual create and modify tools.
+- Extrude, revolve, loft, sweep, coil, fillet, chamfer, shell, draft, holes, threads,
+  patterns, mirror and split.
+- Parameters with units and expressions, and configurations.
+- Faces and edges keep their names through edits, so references survive changes.
+- Components, assemblies, joints, motion studies and exploded views.
+- Sheet metal with flat patterns and DXF export, and a plastic-enclosure subset.
+- A Render workspace with GPU rendering, studio lighting, materials and image export
+  (first release in 0.22.0).
+- Import and export of STEP, IGES, 3MF, STL, OBJ and DXF, and FreeCAD and Rhino files.
+- Autosave and crash recovery, and the browser build of the same app.
+
+The full list of commands is in [docs/features.md](docs/features.md). Release notes for each
+version are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
+
+## In progress now
+
+Each feature below is a [milestone](https://github.com/tangency-labs/solidcraft/milestones) holding
+the issues for it, so the count shows how far along it is. Counts are as of 2026-10-25, one per
+feature or request. Work merged on a feature branch (`drawings`, `render`) counts as built but
+reaches the app only when that branch merges. They are rough, not a promise.
+
+- **[Rendering & materials](https://github.com/tangency-labs/solidcraft/milestone/17)**: in progress, 9 of 34 pieces done, 3 of them built only on the `render` branch and in the app when it merges. The basic Render workspace is already in releases (0.22.0); the interface rework (#6281) and the material and light libraries are what is left.
+- **[Drawings](https://github.com/tangency-labs/solidcraft/milestone/8)**: in progress, 3 of 21 pieces built (2 in releases, 1 on the `drawings` branch), and 3 more partly built there (sheets and borders, bill-of-materials types, the paper scene). Not in the app yet: it lands when the `drawings` branch merges. Today you can export the current view as a DXF.
+- **[Sheet metal](https://github.com/tangency-labs/solidcraft/milestone/15)**: in progress, 1 of 30 requests done. Flanges, hems, unfold and flat patterns already work; the 30 are extensions, mostly the per-edge flange options (segments, miters, partial flanges, reliefs) and bend allowance.
+- **[Sketching](https://github.com/tangency-labs/solidcraft/milestone/14)**: in progress, 12 of 50 pieces done. Dimension types, selection and snapping options.
+- **[Solid modeling](https://github.com/tangency-labs/solidcraft/milestone/2)**: in progress, 9 of 50 pieces done. Blends, holes, threads and patterns.
+- **[Assemblies & joints](https://github.com/tangency-labs/solidcraft/milestone/3)**: in progress, 4 of 19 pieces done. Joints, motion studies and exploded views already work; placement rules, linked sub-assemblies, fastener stacks and weldment corners are the pieces left.
+- **[Import & export](https://github.com/tangency-labs/solidcraft/milestone/5)**: in progress, 7 of 39 pieces done. FreeCAD, SolidWorks and point-cloud import, and mesh export options.
+- **[AI agents & MCP](https://github.com/tangency-labs/solidcraft/milestone/18)**: in progress, 2 of 8 pieces done. Agent chat and the MCP server.
+- **[Interface, web app & plugins](https://github.com/tangency-labs/solidcraft/milestone/4)**: in progress, 31 of 96 pieces done. Ribbon redesign, navigation, themes, the web app and plugins.
+- **[SMLib kernel migration](https://github.com/tangency-labs/solidcraft/milestone/1)**: in progress, 1 tracking issue open. The kernel is moving from truck to NVIDIA's SMLib (usd-brep, Apache-2.0) on the `kernel-smlib` branch; it is not in releases yet. Tracked in [#4012](https://github.com/tangency-labs/solidcraft/issues/4012).
+
+## Next
+
+- **[Surfacing](https://github.com/tangency-labs/solidcraft/milestone/16)**: next, 6 of 14 pieces done. Patch, trim, blend and match exist; the rest of the surface toolset is planned.
+- **[Manufacturing / CAM](https://github.com/tangency-labs/solidcraft/milestone/9)**: next, 1 pieces tracked, none done. There is no CAM in SolidCraft yet. Send to Slicer and a first toolpath slice are in review; proposals are [#1153](https://github.com/tangency-labs/solidcraft/issues/1153) and [#1621](https://github.com/tangency-labs/solidcraft/issues/1621).
+
+Features are not tied to a release or a date. Work lands in the daily releases as it is finished.
+Anything without a milestone, such as bug fixes, is not a feature and is not listed here.
+
+## How releases work
+
+- Releases ship daily, as numbered versions (v0.22.0, v0.22.1) with nightly pre-releases in
+  between. They are delivered through the in-app updater.
+- SolidCraft tells you when a newer stable release exists and never updates without asking.
+  Where it can replace itself safely (AppImage, Windows installer and portable builds) there is
+  an **Update now** button; downloads are checked against the release's SHA-256 list. See
+  [updates and privacy](docs/book/src/guide/updates.md).
+- Design files carry a format number. A new version opens designs from older versions, but an
+  older version refuses a design saved by a newer one (0.22.0 writes format 35, and 0.21.0 and
+  earlier will not open it). Each release's notes say when the format changed. Keep a copy of
+  an important design before you move to a new version.
+
+## Licence
+
+SolidCraft is licensed MIT OR Apache-2.0, at your option; see [LICENSE-MIT](LICENSE-MIT) and
+[LICENSE-APACHE](LICENSE-APACHE). Versions already released stay available under those licences
+permanently.
+
+## How to follow along
+
+- Feature milestones: <https://github.com/tangency-labs/solidcraft/milestones>
+- Issues: <https://github.com/tangency-labs/solidcraft/issues> (area labels such as
+  `area:kernel`, `area:sketch` and `area:ui` group them)
+- Discord: <https://discord.gg/FtU4NQNVDH>
+- Releases: <https://github.com/tangency-labs/solidcraft/releases>
+- Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
 Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.

@@ -52,8 +132,10 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 | M0 | Vertical slice | done | — |
 | M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces, at distances from reference edges, and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
+| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), drawing snaps to where two lines, circles or arcs cross (#4967), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
+| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
 | M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks; tiny rim edges remain selected instead of nearby wall seams when filleting (#2498) | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop, browser and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
+| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop, browser and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import, PLY/XYZ point clouds as a modelling reference and PLY meshes (done — [docs/point-clouds.md](docs/point-clouds.md), #5151) | in progress | 6 |
 | M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
 | M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; responsive feature history with width-driven icons/names/title, snapping width resize, bottom/left/browser-stack docking, shared-column collapse, rollback bar, multi-selection and persistent folders), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; Browser Expand All / Collapse All (`browser.expand_all`, `browser.collapse_all`) on the design and component menus; preferences | in progress | 6 |
 | M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
@@ -204,6 +286,11 @@ completed drawings publish atomically. The browser still exports synchronously.

 ## Dimensioning and error reporting

+- Operation length fields share design-unit defaults and input evaluation, including secondary
+  distances, thin walls, blend controls, sheet/plastic rules, joints and motion keys. Canvas
+  handles and sketch previews use the same lengths as committed geometry. Existing stored
+  millimetre values retain their size when edited in a design using another unit (#3271).
+
 - MCP `execute` accepts `verbose: false`, sharing the compact reply helper used by
  `batch`: body changes and created sketch IDs stay, while repeated lists are omitted.
  Both tools retain full replies by default.
@@ -247,6 +334,9 @@ completed drawings publish atomically. The browser still exports synchronously.
 - Sketch Dimension takes a line and a circle or arc (#1803): it measures from the line to the
  circle's edge (the gap, 0 when tangent, or how far the edge reaches past a line that cuts
  it), drives it like any other dimension and keeps the circle on its side of the line.
+- Sketch Dimension takes a point and a circle or arc, or two circles or arcs (#4064): it
+  measures to the circle's edge (from the point, or between the two edges: the gap, 0 when
+  they touch, how far they overlap, or the narrowest gap between nested circles).
 - Sketch annotations, live drawing lengths and Measure use document units. Inches show
  three decimals and retain a meaningful fourth digit. Bare length dimension entry captures
  the current design unit; changing units leaves existing geometry and expressions intact.
@@ -1,6 +1,6 @@
 Third-party software in SolidCraft

-SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 559 crates below.
+SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 560 crates below.
 Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files.
 SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.

@@ -353,7 +353,7 @@ rustls-native-certs 0.8.5  (Apache-2.0 OR ISC OR MIT)
 rustls-pki-types 1.15.1  (MIT OR Apache-2.0)
 rustls-platform-verifier 0.7.1  (MIT OR Apache-2.0)
 rustls-platform-verifier-android 0.2.0  (MIT OR Apache-2.0)
-rustls-webpki 0.103.15  (ISC)
+rustls-webpki 0.103.16  (ISC)
 rustversion 1.0.23  (MIT OR Apache-2.0)
 ruzstd 0.9.1  (MIT)
 schannel 0.1.29  (MIT)
@@ -435,10 +435,11 @@ truck-topology 0.6.0  (Apache-2.0)
 ttf-parser 0.25.1  (MIT OR Apache-2.0)
 twox-hash 2.1.5  (MIT)
 type-map 0.5.1  (MIT/Apache-2.0)
-typed-path 0.12.3  (MIT OR Apache-2.0)
+typed-path 0.13.0  (MIT OR Apache-2.0)
 typeid 1.0.3  (MIT OR Apache-2.0)
 typenum 1.20.1  (MIT OR Apache-2.0)
 uds_windows 1.2.1  (MIT)
+unicode-bidi 0.3.18  (MIT OR Apache-2.0)
 unicode-general-category 1.1.0  (Apache-2.0)
 unicode-ident 1.0.26  ((MIT OR Apache-2.0) AND Unicode-3.0)
 unicode-segmentation 1.13.3  (MIT OR Apache-2.0)
@@ -473,7 +474,7 @@ wayland-sys 0.31.11  (MIT)
 web-sys 0.3.106  (MIT OR Apache-2.0)
 web-time 1.1.0  (MIT OR Apache-2.0)
 webbrowser 1.2.4  (MIT OR Apache-2.0)
-webpki-root-certs 1.0.9  (CDLA-Permissive-2.0)
+webpki-root-certs 1.0.10  (CDLA-Permissive-2.0)
 weezl 0.1.12  (MIT OR Apache-2.0)
 wgpu 30.0.1  (MIT OR Apache-2.0)
 wgpu-core 30.0.1  (MIT OR Apache-2.0)
@@ -551,7 +552,7 @@ zeroize_derive 1.5.0  (Apache-2.0 OR MIT)
 zerotrie 0.2.5  (Unicode-3.0)
 zerovec 0.11.8  (Unicode-3.0)
 zerovec-derive 0.11.6  (Unicode-3.0)
-zip 9.0.4  (MIT)
+zip 9.1.3  (MIT)
 zlib-rs 0.6.8  (Zlib)
 zmij 1.0.23  (MIT)
 zopfli 0.8.3  (Apache-2.0)
@@ -595,7 +596,7 @@ pin-project 1.1.13, pin-project-internal 1.1.13, pin-project-lite 0.2.17, piper
 rustix 0.38.44, rustix 1.1.5, rustversion 1.0.23, semver 1.0.28, serde 1.0.229, serde_core 1.0.229,
 serde_derive 1.0.229, serde_derive_internals 0.30.0, serde_json 1.0.151, serde_path_to_error 0.1.20,
 serde_repr 0.1.21, simd_cesu8 1.2.0, smol_str 0.2.2, syn 1.0.109, syn 2.0.119, syn 3.0.6, thiserror
-1.0.69, thiserror 2.0.21, thiserror-impl 1.0.69, thiserror-impl 2.0.21, typed-path 0.12.3, typeid
+1.0.69, thiserror 2.0.21, thiserror-impl 1.0.69, thiserror-impl 2.0.21, typed-path 0.13.0, typeid
 1.0.3, unicode-ident 1.0.26, utf8-zero 0.8.1, wasi 0.11.1+wasi-snapshot-preview1, wasip2
 1.0.4+wasi-0.2.12, wit-bindgen 0.57.1, x11-dl 2.21.0, xdg-home 1.3.0, zbus-lockstep 0.5.2,
 zbus-lockstep-macros 0.5.2, zbus_names 3.0.0, zmij 1.0.23, zvariant_utils 2.1.0, zvariant_utils
@@ -1123,9 +1124,9 @@ parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, plain 0.2.3, png 0
 rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0, secret-service 4.0.0,
 security-framework 2.11.1, security-framework 3.7.0, security-framework-sys 2.17.0,
 signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2, stable_deref_trait
-1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation 1.13.3, unicode-width
-0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12,
-wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
+1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-bidi 0.3.18, unicode-segmentation
+1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2
+1.0.4+wasi-0.2.12, wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
 wasm-bindgen-macro-support 0.2.129, wasm-bindgen-shared 0.2.129, web-sys 0.3.106, weezl 0.1.12,
 wit-bindgen 0.57.1
 ================================================================================
@@ -1338,7 +1339,7 @@ libc 0.2.190, litrs 1.0.0, num_enum 0.7.6, num_enum_derive 0.7.6, proc-macro2 1.
 ref-cast 1.0.27, ref-cast-impl 1.0.27, rustc-hash 2.1.3, rustversion 1.0.23, semver 1.0.28, serde
 1.0.229, serde_core 1.0.229, serde_derive 1.0.229, serde_derive_internals 0.30.0, serde_json
 1.0.151, serde_path_to_error 0.1.20, serde_repr 0.1.21, syn 2.0.119, syn 3.0.6, thiserror 1.0.69,
-thiserror 2.0.21, thiserror-impl 1.0.69, thiserror-impl 2.0.21, typed-path 0.12.3, typeid 1.0.3,
+thiserror 2.0.21, thiserror-impl 1.0.69, thiserror-impl 2.0.21, typed-path 0.13.0, typeid 1.0.3,
 unicode-ident 1.0.26, utf8-zero 0.8.1
 ================================================================================

@@ -12430,7 +12431,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

 ================================================================================
-rustls-webpki 0.103.15
+rustls-webpki 0.103.16
 ================================================================================

 Except as otherwise noted, this project is licensed under the following
@@ -14524,6 +14525,49 @@ MIT License
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE

+================================================================================
+unicode-bidi 0.3.18
+================================================================================
+
+This project is copyright 2015, The Servo Project Developers (given in the
+file AUTHORS).
+
+Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+http://www.apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+http://opensource.org/licenses/MIT>, at your option. All files in the project
+carrying such notice may not be copied, modified, or distributed except
+according to those terms.
+
+================================================================================
+unicode-bidi 0.3.18, unicode-segmentation 1.13.3, unicode-width 0.2.2
+================================================================================
+
+Copyright (c) 2015 The Rust Project Developers
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
 ================================================================================
 unicode-ident 1.0.26
 ================================================================================
@@ -14572,36 +14616,6 @@ authorization of the copyright holder.
 unicode-segmentation 1.13.3, unicode-width 0.2.2
 ================================================================================

-Copyright (c) 2015 The Rust Project Developers
-
-Permission is hereby granted, free of charge, to any
-person obtaining a copy of this software and associated
-documentation files (the "Software"), to deal in the
-Software without restriction, including without
-limitation the rights to use, copy, modify, merge,
-publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software
-is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice
-shall be included in all copies or substantial portions
-of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
-
-================================================================================
-unicode-segmentation 1.13.3, unicode-width 0.2.2
-================================================================================
-
 Licensed under the Apache License, Version 2.0
 <LICENSE-APACHE or
 http://www.apache.org/licenses/LICENSE-2.0> or the MIT
@@ -15260,7 +15274,7 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

 ================================================================================
-webpki-root-certs 1.0.9
+webpki-root-certs 1.0.10
 ================================================================================

 # Community Data License Agreement - Permissive - Version 2.0
@@ -16387,7 +16401,7 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

 ================================================================================
-zip 9.0.4
+zip 9.1.3
 ================================================================================

 The MIT License (MIT)
@@ -16785,6 +16799,14 @@ Bundled fonts (SIL Open Font License, Version 1.1)
  Copyright 2022 The BIZ UDGothic Project Authors (https://github.com/googlefonts/morisawa-biz-ud-mincho)
  Source: https://github.com/googlefonts/morisawa-biz-ud-gothic

+- CraftUI-SC.otf (assets/fonts/craft-ui-sc/CraftUI-SC.otf)
+  Copyright 2014-2021 Adobe / Google Inc. (Noto Sans SC subset for SolidCraft web zh)
+  Source: https://github.com/notofonts/noto-cjk (Sans SubsetOTF/SC)
+
+- CraftUI-TC.otf (assets/fonts/craft-ui-tc/CraftUI-TC.otf)
+  Copyright 2014-2021 Adobe / Google Inc. (Noto Sans TC subset for SolidCraft web zh-TW)
+  Source: https://github.com/notofonts/noto-cjk (Sans SubsetOTF/TC)
+
 - IBMPlexSans-Variable.ttf (assets/fonts/ibm-plex-sans/IBMPlexSans-Variable.ttf)
  Copyright 2017 IBM Corp. with Reserved Font Name "Plex"
  Source: https://github.com/IBM/plex
@@ -66,9 +66,9 @@ fn run() -> Result<(), String> {
    let mut session = Session::default();
    eprintln!("Generating original CAD scene from {recipe_path}");
    let generation_start = Instant::now();
-    let (commands, command_timings) = session.run_script_timed(&recipe, false).map_err(|e| e.to_string())?;
+    let (commands, command_timings) = session.run_script_timed(&recipe, false, &mut |_, _| {}).map_err(|e| e.to_string())?;
    let generation_seconds = generation_start.elapsed().as_secs_f64();
-    let design_path = output.with_extension("solidcraft");
+    let design_path = output.with_extension(solidcraft_engine::io::DESIGN_EXT);
    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
    let bodies: Vec<Value> = scene
@@ -87,7 +87,7 @@ fn run() -> Result<(), String> {
        let gpu_host_start = Instant::now();
        let policy = solidcraft_gpu::select::Policy::from_env().map_err(|e| e.to_string())?;
        let (adapter, report) =
-            solidcraft_gpu::select::pick_vulkan(policy, |_| true).ok_or("no Vulkan adapter satisfies the requested GPU policy")?;
+            solidcraft_gpu::select::pick_path(policy, |_| true).ok_or("no Vulkan or Metal adapter satisfies the requested GPU policy")?;
        session.register_render_job_host(solidcraft_gpu::path::host_on_adapter(&adapter).map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
        (Some(report), Some(gpu_host_start.elapsed().as_secs_f64()))
    } else {
@@ -8,7 +8,7 @@
 //! no fixture.
 //!
 //! ```text
-//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.sc]
 //! ```
 //! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
 //! build total, then the phases `bench-open` prints for the saved design.
@@ -205,7 +205,10 @@ pub fn run(args: &[String]) -> Result<(), String> {
    );
    let path = match flag("--save") {
        Some(p) => p.clone(),
-        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+        None => std::env::temp_dir()
+            .join(format!("bench-agent-{}.{}", std::process::id(), solidcraft_engine::io::DESIGN_EXT))
+            .to_string_lossy()
+            .into_owned(),
    };
    s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
    let r = crate::cmd_bench_open(std::slice::from_ref(&path));
@@ -419,7 +419,7 @@ fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: In
        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
        // A turn can start and end between two polls: then the conversation has its answer.
        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
-        if idle && (seen_busy || answered || matches!(state, "exited" | "auth" | "off") || began.elapsed() >= START_GRACE) {
+        if idle && (seen_busy || answered || matches!(state, "exited" | "failed" | "auth" | "off") || began.elapsed() >= START_GRACE) {
            return Ok((chat, false));
        }
        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
@@ -1,10 +1,11 @@
 //! SolidCraft headless command line.
 //!
 //! ```text
-//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
-//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
-//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
+//! solidcraft-cli run <script.json|design.sc|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
+//!                    [--param-check off|warn|strict]
+//! solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.sc> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
 //! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
 //! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N]
 //!                                 [--timeout-s 300] [--json out.json] [--markdown out.md]
@@ -18,10 +19,12 @@
 //! solidcraft-cli mcp [--headless] [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
 //!                    [--param-check off|warn|strict]
 //!                                                             MCP server on stdio (docs/mcp.md)
+//! solidcraft-cli mcp setup [--dry-run] [--client NAME] [--live] (alias: mcp install) add it to OpenCode, Claude Desktop, Claude Code, Cursor
 //! solidcraft-cli licences                                     SolidCraft's licence and the third-party licences
 //! solidcraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
 //!
 //! --debug (with any command)                                  SolidCraft's debug log on stderr (or RUST_LOG=LEVEL)
+//! --max-file-size SIZE (with any command)                     read STEP and design files up to SIZE (2GB, 1500MB; at most 16GB)
 //! ```
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
@@ -55,19 +58,19 @@ struct Command {
 }

 /// `run`'s lines in the usage.
-const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
+const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.sc|part.step> [--in design.sc|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n                     [--param-check off|warn|strict]\n  solidcraft-cli run --in <design.sc|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--param-check checks each step against its command's contract: warn reports on stderr, strict stops the run)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
 /// `eval`'s lines in the usage.
-const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
+const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE]     (alias: inspect)\n  solidcraft-cli eval --in <script.json|design.sc|part.step> [--json-out FILE]\n      (with both inputs, runs the positional script on --in before measuring; does not automatically save the modified design)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
 /// `script`'s lines in the usage.
-const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
+const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.sc|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
 /// `bench-open`'s lines in the usage.
-const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
+const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
 /// `bench-agent`'s lines in the usage.
-const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]\n";
+const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.sc] [--script-out script.json]\n";
 /// `bench-assistant`'s lines in the usage.
 const USAGE_BENCH_ASSISTANT: &str = "  solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N] [--timeout-s 300] [--json out.json] [--markdown out.md]\n";
 /// `snapshot`'s lines in the usage.
-const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
+const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.sc|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.sc|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
 /// `render`'s lines in the usage.
 const USAGE_RENDER: &str = "  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]\n      [--progressive] [--samples N] [--max-depth N] [--seed N] [--exposure EV] [--lighting FILE.json] [--environment FILE.json] [--tone-map reinhard|aces_fitted]\n";
 /// `exec`'s lines in the usage.
@@ -82,7 +85,7 @@ const USAGE_ORACLE: &str = "  solidcraft-cli oracle <case-dir>... [--json]\n";
 const USAGE_FUZZ: &str =
    "  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]\n";
 /// `mcp`'s lines in the usage.
-const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n";
+const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.sc|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
 /// `crashes`'s lines in the usage.
 const USAGE_CRASHES: &str = "  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]\n";
 /// `licences`'s lines in the usage.
@@ -98,7 +101,7 @@ const USAGE_BENCH_EDIT: &str = "  solidcraft-cli bench-edit <script.json|recipe.
 /// `save-stress`'s lines in the usage: the file saved over and over.
 const USAGE_SAVE_STRESS: &str = "  solidcraft-cli save-stress <path> <rounds>\n";
 /// The flags every command takes, at the end of the top-level usage.
-const USAGE_DEBUG: &str = "  --debug, with any command: what SolidCraft logs (why a body has no display plan, why a save left its\n      model cache out), on stderr; RUST_LOG=error|warn|info|debug|trace sets one level for every crate\n";
+const USAGE_DEBUG: &str = "  --debug, with any command: what SolidCraft logs (why a body has no display plan, why a save left its\n      model cache out), on stderr; RUST_LOG=error|warn|info|debug|trace sets one level for every crate\n  --max-file-size SIZE, with any command: read STEP and import files and design files up to SIZE for this run\n      (for example 2GB or 1500MB; at most 16GB; the defaults are 512 MB and 256 MB, and a smaller SIZE keeps them)\n";

 /// The commands the CLI takes, in the order the top-level usage lists them.
 const COMMANDS: &[Command] = &[
@@ -130,6 +133,10 @@ const COMMANDS: &[Command] = &[
 fn main() -> ExitCode {
    let mut args: Vec<String> = std::env::args().skip(1).collect();
    logger::init(&mut args);
+    if let Err(e) = max_file_size(&mut args) {
+        eprintln!("error: {e}");
+        return ExitCode::FAILURE;
+    }
    let r = match args.first().map(String::as_str) {
        // Asked-for help is not an error: the command's usage on stdout, exit 0. It is read
        // before the command runs, so `--help` never starts a run (a fuzz run, a server).
@@ -204,6 +211,28 @@ fn main() -> ExitCode {
    }
 }

+/// Take `--max-file-size SIZE` (or `--max-file-size=SIZE`), which any command takes, out of the
+/// arguments and raise the file size limits for this run (#4086). A bad size is an error.
+fn max_file_size(args: &mut Vec<String>) -> Result<(), String> {
+    let mut size = None;
+    let mut i = 0;
+    while let Some(arg) = args.get(i) {
+        if arg == "--max-file-size" {
+            let value = args.get(i + 1).cloned().ok_or("--max-file-size needs a size, for example --max-file-size 2GB")?;
+            args.drain(i..i + 2);
+            size = Some(value);
+        } else if let Some(value) = arg.strip_prefix("--max-file-size=") {
+            size = Some(value.to_string());
+            args.remove(i);
+        } else {
+            i += 1;
+        }
+    }
+    let Some(size) = size else { return Ok(()) };
+    let bytes = solidcraft_engine::io::limits::parse_flag(&size).map_err(|e| format!("--max-file-size: {e}"))?;
+    solidcraft_engine::io::limits::set_override(Some(bytes))
+}
+
 fn pretty(v: &Value) -> String {
    serde_json::to_string_pretty(v).unwrap_or_default()
 }
@@ -240,11 +269,12 @@ fn wants_help(args: &[String]) -> bool {
 pub fn read_json(path: &str) -> Result<Value, String> {
    // Through the engine's file access, which refuses anything that is not a regular file and
    // reads no more than the cap: a character device or a FIFO would otherwise never end.
-    let s = solidcraft_engine::io::vfs::read_to_string(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
+    let s = solidcraft_engine::io::vfs::read_to_string(path, solidcraft_engine::io::limits::max_design_bytes())
+        .map_err(|e| format!("{path}: {}", solidcraft_engine::io::limits::explain(solidcraft_engine::io::limits::Kind::Design, e)))?;
    serde_json::from_str(&s).map_err(|e| format!("{path}: {e}"))
 }

-/// A session from a design file, a STEP/3MF/STL file, a command script, or an oracle recipe.
+/// A session from a design file, a STEP/3MF/STL file, a point cloud, a command script, or an oracle recipe.
 pub fn load(path: &str) -> Result<Session, String> {
    load_checked(path, solidcraft_engine::schema::ParamCheck::Off)
 }
@@ -254,15 +284,14 @@ pub fn load(path: &str) -> Result<Session, String> {
 fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Result<Session, String> {
    let mut s = Session::default();
    s.param_check = check;
-    if solidcraft_engine::io::is_step_path(path) || solidcraft_engine::io::is_mesh_path(path) {
+    if solidcraft_engine::io::is_step_path(path) || solidcraft_engine::io::is_mesh_path(path) || solidcraft_engine::io::is_point_cloud_path(path) {
        s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
        return Ok(s);
    }
-    let bytes = solidcraft_engine::io::vfs::read(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
+    let bytes = solidcraft_engine::io::limits::read(path, solidcraft_engine::io::limits::Kind::Design).map_err(|e| format!("{path}: {e}"))?;
    if solidcraft_engine::io::is_design_container(&bytes) {
        let doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| format!("{path}: {e}"))?;
-        let mut session = Session::new(doc);
-        session.path = Some(path.to_owned());
+        let mut session = Session::opened_at(doc, None, Some(path));
        session.param_check = check;
        return Ok(session);
    }
@@ -271,18 +300,36 @@ fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Res
        s.execute("doc.open", &json!({"path": path})).map_err(|e| e.to_string())?;
    } else {
        let script = if v.get("features").is_some() && v.get("commands").is_none() { recipe::to_script(&v)? } else { v };
-        // Warn level: each step's `param_warnings` as it completes, even when a later step fails
-        // (stderr, so stdout stays the caller's).
-        let mut warn = |step: usize, r: &Value| {
-            for w in r.get("param_warnings").and_then(Value::as_array).into_iter().flatten() {
-                eprintln!("{path}: step {}: {}", step + 1, w.as_str().unwrap_or_default());
-            }
-        };
-        s.run_script_each(&script, &mut warn).map_err(|e| e.to_string())?;
+        run_script_warning(&mut s, path, &script)?;
    }
    Ok(s)
 }

+/// Run `script`, read from `path`, on `s`. At the warn level each step's `param_warnings` go to
+/// stderr as the step completes, even when a later step fails (stdout stays the caller's).
+fn run_script_warning(s: &mut Session, path: &str, script: &Value) -> Result<Vec<Value>, String> {
+    s.run_script_each(script, &mut |step, r| print_param_warnings(path, step, r)).map_err(|e| e.to_string())
+}
+
+/// Step `step`'s `param_warnings` on stderr, one per line, named after the script at `path`.
+fn print_param_warnings(path: &str, step: usize, r: &Value) {
+    for w in r.get("param_warnings").and_then(Value::as_array).into_iter().flatten() {
+        eprintln!("{path}: step {}: {}", step + 1, w.as_str().unwrap_or_default());
+    }
+}
+
+/// `--param-check off|warn|strict`: how calls that break a command's parameter contract are
+/// treated (docs/mcp.md); off when the option isn't given.
+fn parse_param_check(cmd: &str, args: &[String]) -> Result<solidcraft_engine::schema::ParamCheck, String> {
+    match flag(args, "--param-check") {
+        None if args.iter().any(|a| a == "--param-check") => Err(format!("{cmd}: --param-check wants off, warn or strict")),
+        None => Ok(solidcraft_engine::schema::ParamCheck::Off),
+        Some(v) => {
+            solidcraft_engine::schema::ParamCheck::parse(v).ok_or_else(|| format!("{cmd}: --param-check wants off, warn or strict, not `{v}`"))
+        }
+    }
+}
+
 fn flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
 }
@@ -339,6 +386,15 @@ fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
 fn cmd_run(args: &[String]) -> Result<(), String> {
    install_renderer();
    let json_out = json_out(args)?;
+    // Before the option check, so a bare `--param-check` gets the words `mcp` uses.
+    let check = parse_param_check("run", args)?;
+    known_args(
+        "run",
+        args,
+        &["--in", "--out", "--save", "--json-out", "--param-check"],
+        &["--quiet", "--results", "--timings", "--profile", "--allow-errors"],
+        true,
+    )?;
    let base = flag(args, "--in");
    let path = positional(args);
    if path.is_none() && base.is_none() {
@@ -351,23 +407,25 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
    let (mut s, results) = if want_results || timings {
        // Collect every command's result or time (scripts only), then process requested files too.
        let mut s = match base {
-            Some(b) => load(b)?,
+            Some(b) => load_checked(b, check)?,
            None => Session::default(),
        };
+        s.param_check = check;
        let needs = if want_results { "--results needs a script" } else { "--timings needs a script" };
-        let v = read_json(path.ok_or(needs)?)?;
+        let script = path.ok_or(needs)?;
+        let v = read_json(script)?;
        let out = if timings {
-            let (r, mut t) = s.run_script_timed(&v, profile).map_err(|e| e.to_string())?;
+            let (r, mut t) = s.run_script_timed(&v, profile, &mut |step, r| print_param_warnings(script, step, r)).map_err(|e| e.to_string())?;
            if want_results && let Some(o) = t.as_object_mut() {
                o.insert("results".into(), Value::Array(r));
            }
            t
        } else {
-            Value::Array(s.run_script(&v).map_err(|e| e.to_string())?)
+            Value::Array(run_script_warning(&mut s, script, &v)?)
        };
        (s, Some(out))
    } else {
-        (open(base, path)?, None)
+        (open(base, path, check)?, None)
    };
    // A feature that fails leaves the bodies as they were before it (a parameter change can
    // break a feature without failing the command that made it): writing them would hand out
@@ -391,17 +449,17 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
    Ok(())
 }

-/// The session `run` and `snapshot` start from: `--in` (a design or STEP file) with the
-/// positional script run on top of it, or either one alone.
-fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
+/// The session `run`, `eval` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// positional script run on top of it, or either one alone, with scripts run at `check`.
+fn open(base: Option<&str>, path: Option<&String>, check: solidcraft_engine::schema::ParamCheck) -> Result<Session, String> {
    match (base, path) {
        (Some(b), Some(p)) => {
-            let mut s = load(b)?;
-            s.run_script(&read_json(p)?).map_err(|e| e.to_string())?;
+            let mut s = load_checked(b, check)?;
+            run_script_warning(&mut s, p, &read_json(p)?)?;
            Ok(s)
        }
-        (Some(b), None) => load(b),
-        (None, Some(p)) => load(p),
+        (Some(b), None) => load_checked(b, check),
+        (None, Some(p)) => load_checked(p, check),
        (None, None) => Err(usage()),
    }
 }
@@ -443,8 +501,8 @@ fn timeline_ok(s: &Session) -> Result<(), String> {

 fn cmd_eval(args: &[String]) -> Result<(), String> {
    let json_out = json_out(args)?;
-    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(usage)?;
-    let mut s = load(path)?;
+    known_args("eval", args, &["--in", "--json-out"], &[], true)?;
+    let mut s = open(flag(args, "--in"), positional(args), solidcraft_engine::schema::ParamCheck::Off)?;
    let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
    let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
    let out = json!({
@@ -538,7 +596,7 @@ fn cmd_snapshot(args: &[String]) -> Result<(), String> {
        Some(x) => x.parse().ok().filter(|n| (16..=8192).contains(n)).ok_or_else(|| format!("{name} must be 16 to 8192 pixels, not `{x}`")),
    };
    let (w, h) = (size("--width", 1280)?, size("--height", 800)?);
-    let mut s = open(flag(args, "--in"), positional(args))?;
+    let mut s = open(flag(args, "--in"), positional(args), solidcraft_engine::schema::ParamCheck::Off)?;
    // How the bodies are drawn and where the model is cut, through the commands the app's
    // Appearance dialog and Section Analysis run (`preview`).
    preview::apply(&mut s, &flags(args, "--body"), &flags(args, "--tool"), flag(args, "--section"))?;
@@ -625,10 +683,23 @@ fn cmd_exec(args: &[String]) -> Result<(), String> {
    Ok(())
 }

+/// `mcp setup`: add the server to each installed AI client, with this program's own path.
+fn cmd_mcp_setup(args: &[String]) -> Result<(), String> {
+    use solidcraft_engine::agent_setup as setup;
+    let (lines, ok) = setup::setup(args, &setup::Env::from_process(), &setup::current_exe()?)?;
+    for l in lines {
+        println!("{l}");
+    }
+    if ok { Ok(()) } else { Err("mcp setup: some clients could not be configured".into()) }
+}
+
 /// MCP server on stdio: headless (optionally starting from a design or script) or bridged to
 /// a running app's control port. stdout carries only protocol messages. Files the agent's tool
 /// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
 fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    if matches!(args.first().map(String::as_str), Some("setup" | "install")) {
+        return cmd_mcp_setup(&args[1..]);
+    }
    let render_gpu = args.iter().any(|arg| arg == "--render-gpu");
    if render_gpu && flag(args, "--connect").is_some() {
        return Err("mcp: --render-gpu installs a headless image host; a connected application owns its own device".into());
@@ -639,7 +710,7 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
    if let Some(s) = &scope {
        let roots: Vec<String> = s.roots().iter().map(|r| r.display().to_string()).collect();
        eprintln!(
-            "solidcraft mcp: files limited to {} and the open design's folder (--allow-path DIR adds one, --allow-any-path lifts the limit)",
+            "solidcraft mcp: files limited to {} and the folders of designs opened or saved here (--allow-path DIR adds one, --allow-any-path lifts the limit)",
            roots.join(", ")
        );
        let design_dir = flag(args, "--in")
@@ -649,17 +720,8 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
            eprintln!("solidcraft mcp: the design's folder is left out because {why}; add it with --allow-path if you mean it");
        }
    }
-    // How a headless session treats calls that break a command's parameter contract (docs/mcp.md).
-    let param_check = match flag(args, "--param-check") {
-        None if args.iter().any(|a| a == "--param-check") => return Err("mcp: --param-check wants off, warn or strict".into()),
-        None => solidcraft_engine::schema::ParamCheck::Off,
-        Some(v) => {
-            solidcraft_engine::schema::ParamCheck::parse(v).ok_or_else(|| format!("mcp: --param-check wants off, warn or strict, not `{v}`"))?
-        }
-    };
-    if param_check != solidcraft_engine::schema::ParamCheck::Off && flag(args, "--connect").is_some() {
-        eprintln!("solidcraft mcp: --param-check applies to headless sessions; calls to the app are not checked yet");
-    }
+    // How calls that break a command's parameter contract are treated, headless or bridged.
+    let param_check = parse_param_check("mcp", args)?;
    let backend: Box<dyn solidcraft_mcp::Backend> = match (flag(args, "--connect"), flag(args, "--in")) {
        (Some(_), Some(_)) => return Err("mcp: use either --connect or --in, not both".into()),
        (Some(addr), None) => {
@@ -667,7 +729,7 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
                return Err(format!("mcp: --connect wants HOST:PORT, such as 127.0.0.1:7878, not `{addr}`"));
            };
            // Serve without the app too: the tools connect once it runs, and say it isn't until then.
-            let mut remote = solidcraft_mcp::Remote::new(addr, flag(args, "--token"));
+            let mut remote = solidcraft_mcp::Remote::new(addr, flag(args, "--token")).with_param_check(param_check);
            if let Err(e) = remote.try_connect() {
                eprintln!(
                    "solidcraft mcp: no SolidCraft app at {addr} yet ({e}); start it with `solidcraft --control {port}` \
@@ -684,18 +746,23 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
            Box::new(headless)
        }
        (None, None) => {
-            if !args.iter().any(|a| a == "--headless")
-                && let Some(port) = discover_app()
-            {
+            let auto = !args.iter().any(|a| a == "--headless");
+            if auto && let Some(port) = discover_app() {
                eprintln!("solidcraft mcp: bridged to the running app at 127.0.0.1:{port} (--headless starts a session of its own)");
-                return serve_mcp(Box::new(solidcraft_mcp::Remote::new(&format!("127.0.0.1:{port}"), flag(args, "--token"))), scope);
+                let remote = solidcraft_mcp::Remote::new(&format!("127.0.0.1:{port}"), flag(args, "--token")).with_param_check(param_check);
+                return serve_mcp(Box::new(remote), scope);
            }
            let mut headless = solidcraft_mcp::Headless::default();
            headless.session.param_check = param_check;
            if render_gpu {
                headless.session.register_render_job_host(solidcraft_gpu::path::host().map_err(|e| e.to_string())?).map_err(|e| e.to_string())?;
            }
-            Box::new(headless)
+            if auto {
+                // The app may start after the agent: look for it again until there is work here.
+                Box::new(solidcraft_mcp::Auto::new(headless, Box::new(discover_app), flag(args, "--token")))
+            } else {
+                Box::new(headless)
+            }
        }
    };
    serve_mcp(backend, scope)
@@ -799,11 +866,11 @@ fn bench_ops(mut s: Session, script: &str) -> Result<Session, String> {

 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
 pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
-    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
+    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.sc | part.step> [--parse-only]")?;
    let t = std::time::Instant::now();
    let step = solidcraft_engine::io::is_step_path(path);
-    let limit = if step { solidcraft_engine::io::MAX_STEP_BYTES } else { solidcraft_engine::io::MAX_DESIGN_BYTES };
-    let bytes = solidcraft_engine::io::vfs::read(path, limit).map_err(|e| format!("{path}: {e}"))?;
+    let kind = if step { solidcraft_engine::io::limits::Kind::Step } else { solidcraft_engine::io::limits::Kind::Design };
+    let bytes = solidcraft_engine::io::limits::read(path, kind).map_err(|e| format!("{path}: {e}"))?;
    let read_ms = t.elapsed().as_secs_f64() * 1000.0;
    println!("{}", json!({"step": "read", "ms": read_ms, "bytes": bytes.len()}));
    let t = std::time::Instant::now();
@@ -825,7 +892,7 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
        return Ok(());
    }
    let t = std::time::Instant::now();
-    let s = Session::opened(doc, saved.as_ref());
+    let s = Session::opened_at(doc, saved.as_ref(), (!step).then_some(path.as_str()));
    drop(read);
    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway), or
    // only the features whose state a thinned file left out.
@@ -845,13 +912,13 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
        json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "place_ms": place_ms, "bodies": st.bodies.len(), "triangles": triangles})
    );
    let flag = |name: &str| args.iter().position(|a| a == name);
-    // `--save PATH`: save the opened design without its model cache (to PATH.plain.solidcraft) and
+    // `--save PATH`: save the opened design without its model cache (to PATH.plain.sc) and
    // as the app does, with it, then read the cache back.
    let s = match flag("--save").and_then(|i| args.get(i + 1)) {
        Some(out) => {
            let mut s = s;
            // Without the cache first, for comparison.
-            let plain = format!("{out}.plain.solidcraft");
+            let plain = format!("{out}.plain.{}", solidcraft_engine::io::DESIGN_EXT);
            let t = std::time::Instant::now();
            s.execute("file.save_as", &json!({"path": plain, "cache": false})).map_err(|e| e.to_string())?;
            let plain_ms = t.elapsed().as_secs_f64() * 1000.0;
@@ -92,7 +92,7 @@ fn designs() -> Vec<(String, PathBuf)> {
    add("regressions", root.join("examples/regressions"), "json");
    add("demo", root.join("examples/demo"), "json");
    add("typical", root.join("tests/action_matrix/designs"), "json");
-    add("demo", root.join("tests/action_matrix/designs"), "solidcraft");
+    add("demo", root.join("tests/action_matrix/designs"), solidcraft_engine::io::DESIGN_EXT);
    let mut cases: Vec<PathBuf> =
        std::fs::read_dir(root.join("tests/oracle")).unwrap().flatten().map(|e| e.path()).filter(|p| p.join("recipe.json").is_file()).collect();
    cases.sort();
@@ -105,7 +105,7 @@ fn designs() -> Vec<(String, PathBuf)> {
 /// Build a design from its file.
 fn load(path: &Path) -> Result<Session, String> {
    let mut s = Session::default();
-    if path.extension().is_some_and(|x| x == "solidcraft") {
+    if solidcraft_engine::io::is_design_container_path(path) {
        s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
        return Ok(s);
    }
@@ -395,8 +395,10 @@ fn actions(s: &Session) -> Vec<Action> {
            let r = round3((shortest * 0.1).max(0.01));
            let mut add = |action, act| out.push(Action { entity: entity.clone(), action, act });
            if !smooth(e, mid) {
-                add("edge.fillet", Act::Run("solid.fillet", json!({"edges": [pt(mid)], "radius": r})));
-                add("edge.chamfer", Act::Run("solid.chamfer", json!({"edges": [pt(mid)], "distance": r})));
+                // The midpoint is interior to this edge, but other bodies (including component
+                // copies in their local frames) can have coincident edges. Retain the picked body.
+                add("edge.fillet", Act::Run("solid.fillet", json!({"body": world, "edges": [pt(mid)], "radius": r})));
+                add("edge.chamfer", Act::Run("solid.chamfer", json!({"body": world, "edges": [pt(mid)], "distance": r})));
            }
            let dir = straight(pts);
            if dir.is_some() {
@@ -1278,6 +1280,41 @@ fn rectangle(plane: Value, p0: [f64; 2], p1: [f64; 2]) -> [Value; 3] {
    ]
 }

+#[test]
+fn edge_round_actions_keep_the_picked_body() {
+    for (corner, length) in [([10, 0, 20], 4), ([0, 0, 0], 20)] {
+        let mut s = Session::default();
+        s.execute("solid.box", &json!({"length": 20, "width": 20, "height": 20, "body_name": "Plate"})).unwrap();
+        s.execute(
+            "solid.box",
+            &json!({"corner": corner, "length": length, "width": length, "height": length, "body_name": "Block", "operation": "new"}),
+        )
+        .unwrap();
+        let mut tried = 0;
+        for a in actions(&s) {
+            if !a.entity.starts_with("Plate/") || !matches!(a.action, "edge.chamfer" | "edge.fillet") {
+                continue;
+            }
+            let Act::Run(id, ref p) = a.act else { continue };
+            let q = &p["edges"][0];
+            let x = q[0].as_f64().unwrap();
+            if q[1] != 0.0 || q[2] != 20.0 || !(0.0..20.0).contains(&x) {
+                continue;
+            }
+            // Block either meets this midpoint or coincides with the whole edge.
+            assert_eq!(p["body"], "Plate", "{}: {p}", a.action);
+            assert_eq!(q, &json!([10.0, 0.0, 20.0]));
+            let mut unscoped = p.clone();
+            unscoped.as_object_mut().unwrap().remove("body");
+            let err = s.scratch().execute(id, &unscoped).unwrap_err().to_string();
+            assert!(err.contains("edges meet"), "{err}");
+            perform(&mut s.scratch(), &a.act, &errors(&s)).unwrap();
+            tried += 1;
+        }
+        assert_eq!(tried, 2);
+    }
+}
+
 #[test]
 fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
    for (cmd, size) in [("solid.fillet", "radius"), ("solid.chamfer", "distance")] {
@@ -1521,7 +1558,7 @@ fn sketches_on_loft_and_sweep_faces() {
 #[test]
 fn press_pull_on_the_pi_case_floor() {
    reproduces(
-        Some("tests/action_matrix/designs/pi-case.solidcraft"),
+        Some("tests/action_matrix/designs/pi-case.sc"),
        json!([{"command": "solid.press_pull", "params": {"face": [30, 20, 0], "distance": 1}}]),
    );
 }
@@ -157,3 +157,34 @@ fn render_help_keeps_the_registered_gpu_request_controls() {
        }
    }
 }
+
+/// `--max-file-size` (#4086), with any command: the usage names it, a bad size stops the run
+/// with the reason, and a design over the default limit opens once the flag raises it.
+#[test]
+fn max_file_size_raises_the_limit_and_refuses_bad_sizes() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("--help").output().unwrap();
+    assert!(String::from_utf8_lossy(&output.stdout).contains("--max-file-size"));
+    for size in ["17GB", "2", "lots"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["--max-file-size", size, "exec", "file.new"]).output().unwrap();
+        assert!(!output.status.success(), "{size} was accepted");
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(stderr.starts_with("error: --max-file-size"), "{size}: {stderr}");
+    }
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["exec", "file.new", "--max-file-size=2GB"]).output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+
+    // A sparse design file just over the default 256 MB: refused unread, then read with the flag
+    // (and refused for what it holds, which is no design).
+    let dir = std::env::temp_dir().join(format!("solidcraft-cli-4086-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("big.solidcraft");
+    std::fs::File::create(&path).unwrap().set_len((256 << 20) + 1).unwrap();
+    let path = path.to_string_lossy().to_string();
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["eval", &path]).output().unwrap();
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(!output.status.success() && stderr.contains("too large") && stderr.contains("--max-file-size"), "{stderr}");
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["--max-file-size", "1GB", "eval", &path]).output().unwrap();
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(!output.status.success() && !stderr.contains("too large"), "{stderr}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
@@ -139,11 +139,13 @@ fn eval_json_out_holds_what_stdout_would() {
 fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
    let dir = Scratch::new();
    let script = dir.script();
-    for cmd in ["run", "eval"] {
-        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
-        assert_eq!(output.status.code(), Some(1), "{cmd}");
-        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
-        assert!(output.stdout.is_empty(), "{cmd}");
+    for cmd in ["run", "eval", "inspect"] {
+        for trailing in [&[][..], &["--in"][..]] {
+            let output = cli().arg(cmd).arg(&script).arg("--json-out").args(trailing).output().unwrap();
+            assert_eq!(output.status.code(), Some(1), "{cmd}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+            assert!(output.stdout.is_empty(), "{cmd}");
+        }

        let missing = dir.0.join("missing").join("out.json");
        let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();
@@ -151,3 +151,115 @@ fn mcp_without_arguments_finds_the_running_app() {
    assert!(!String::from_utf8_lossy(&out.stderr).contains("bridged to the running app"), "{}", String::from_utf8_lossy(&out.stderr));
    std::fs::remove_dir_all(&control_dir).ok();
 }
+
+/// `mcp setup` against a temporary home: the client folders it finds are the only ones it writes.
+mod setup {
+    use serde_json::{Value, json};
+    use std::path::{Path, PathBuf};
+    use std::process::Command;
+
+    fn home(name: &str) -> PathBuf {
+        let h = std::env::temp_dir().join(format!("solidcraft-mcp-setup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&h);
+        std::fs::create_dir_all(&h).unwrap();
+        h
+    }
+
+    fn run(home: &Path, args: &[&str]) -> std::process::Output {
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .args(["mcp", "setup"])
+            .args(args)
+            .env_clear()
+            .env("HOME", home)
+            .env("USERPROFILE", home)
+            .env("APPDATA", home.join("AppData/Roaming"))
+            .env("LOCALAPPDATA", home.join("AppData/Local"))
+            .env("XDG_CONFIG_HOME", home.join(".config"))
+            .env("PATH", "")
+            .output()
+            .unwrap()
+    }
+
+    fn json_of(p: &Path) -> Value {
+        serde_json::from_str(&std::fs::read_to_string(p).unwrap()).unwrap()
+    }
+
+    fn exe() -> String {
+        let p = Path::new(env!("CARGO_BIN_EXE_solidcraft-cli")).canonicalize().unwrap();
+        p.to_string_lossy().trim_start_matches(r"\\?\").to_owned()
+    }
+
+    #[test]
+    fn merges_into_opencode_and_cursor_keeping_other_servers() {
+        let h = home("merge");
+        let oc = h.join(".config/opencode");
+        std::fs::create_dir_all(&oc).unwrap();
+        let old = json!({"$schema": "https://opencode.ai/config.json", "theme": "x", "mcp": {"other": {"type": "local", "command": ["o"]}}});
+        std::fs::write(oc.join("opencode.json"), old.to_string()).unwrap();
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), r#"{"mcpServers": {"other": {"command": "o"}}}"#).unwrap();
+
+        let out = run(&h, &["--live"]);
+        assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+        let v = json_of(&oc.join("opencode.json"));
+        assert_eq!(v["theme"], "x");
+        assert_eq!(v["mcp"]["other"], old["mcp"]["other"]);
+        assert_eq!(v["mcp"]["solidcraft"], json!({"type": "local", "command": [exe(), "mcp"], "enabled": true}));
+        assert_eq!(v["mcp"]["solidcraft-live"]["command"], json!([exe(), "mcp", "--connect", "127.0.0.1:7878"]));
+        assert_eq!(json_of(&oc.join("opencode.json.bak")), old);
+        let c = json_of(&h.join(".cursor/mcp.json"));
+        assert_eq!(c["mcpServers"]["other"], json!({"command": "o"}));
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"command": exe(), "args": ["mcp"]}));
+
+        // Codex (TOML) and Claude Code (a big file the CLI owns) are edited in place too.
+        std::fs::create_dir_all(h.join(".codex")).unwrap();
+        std::fs::write(h.join(".codex/config.toml"), "# mine\nmodel = \"x\"\n").unwrap();
+        let cc = "{\n  \"numStartups\": 3,\n  \"projects\": {}\n}\n";
+        std::fs::write(h.join(".claude.json"), cc).unwrap();
+        assert!(run(&h, &[]).status.success());
+        let toml = std::fs::read_to_string(h.join(".codex/config.toml")).unwrap();
+        assert!(toml.starts_with("# mine\nmodel = \"x\"\n") && toml.contains("[mcp_servers.solidcraft]"), "{toml}");
+        let c = json_of(&h.join(".claude.json"));
+        assert_eq!(c["numStartups"], 3);
+        assert_eq!(c["mcpServers"]["solidcraft"], json!({"type": "stdio", "command": exe(), "args": ["mcp"]}));
+        assert_eq!(std::fs::read_to_string(h.join(".claude.json.bak")).unwrap(), cc);
+
+        // Running again updates the same entries and leaves one of each.
+        assert!(run(&h, &[]).status.success());
+        assert_eq!(json_of(&h.join(".cursor/mcp.json"))["mcpServers"].as_object().unwrap().len(), 3);
+    }
+
+    #[test]
+    fn dry_run_writes_nothing_and_missing_clients_are_skipped() {
+        let h = home("dry");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        let out = run(&h, &["--dry-run"]);
+        assert!(out.status.success());
+        let text = String::from_utf8_lossy(&out.stdout);
+        assert!(text.contains("would write") && text.contains("solidcraft"), "{text}");
+        assert!(!h.join(".cursor/mcp.json").exists());
+        assert!(!h.join(".config/opencode").exists(), "OpenCode was not installed, so nothing is created for it");
+        let out = run(&h, &["--client", "claude-desktop"]);
+        assert!(String::from_utf8_lossy(&out.stdout).contains("not found"));
+    }
+
+    #[test]
+    fn a_file_that_is_not_json_is_left_alone() {
+        let h = home("bad");
+        std::fs::create_dir_all(h.join(".cursor")).unwrap();
+        std::fs::write(h.join(".cursor/mcp.json"), "{ // comment").unwrap();
+        let out = run(&h, &[]);
+        assert!(!out.status.success());
+        assert_eq!(std::fs::read_to_string(h.join(".cursor/mcp.json")).unwrap(), "{ // comment");
+    }
+
+    #[test]
+    fn claude_desktop_msix_folder_is_found() {
+        let h = home("msix");
+        let pkg = h.join("AppData/Local/Packages/Claude_abc/LocalCache/Roaming/Claude");
+        std::fs::create_dir_all(&pkg).unwrap();
+        // The MSIX folder is only read through LOCALAPPDATA, set for every platform here.
+        assert!(run(&h, &["--client", "claude-desktop"]).status.success());
+        assert!(json_of(&pkg.join("claude_desktop_config.json"))["mcpServers"]["solidcraft"].is_object());
+    }
+}
@@ -288,3 +288,47 @@ fn undoing_an_edit_after_opening_reuses_the_saved_results() {
    let _ = std::fs::remove_file(&path);
    let _ = std::fs::remove_file(format!("{}.bak", path.display()));
 }
+
+/// A design saved before body names were pinned (#6403) pins them as it opens, as its first
+/// command would, and opening it is no change. That command pinned them as part of itself, so
+/// undoing it went back to the unpinned design, which no evaluated result matched: the first
+/// undo after opening from the command line evaluated every feature again (82-93 s in a
+/// 5,484-feature design); `doc.open` pinned them after opening, which marked the design changed.
+#[test]
+fn a_design_saved_before_names_were_pinned_opens_pinned_and_unchanged() {
+    let plate = solidcraft_engine::sample::samples().into_iter().find(|s| s.name == "Sample Plate").unwrap();
+    let mut built = Session::default();
+    for c in (plate.script)()["commands"].as_array().unwrap() {
+        built.execute(c["command"].as_str().unwrap(), &c["params"]).unwrap();
+    }
+    let mut doc = built.design().into_owned();
+    for f in &mut doc.features {
+        f.body_names.clear();
+    }
+    doc.reserved_body_names.clear();
+    let unpinned = Session::new(doc);
+    let design = unpinned.design();
+    let saved = unpinned.model.saved(&design).unwrap();
+    let bytes = solidcraft_engine::io::write_design_container_with_cache(&design, solidcraft_engine::io::DesignCompression::Fast, None, Some(&saved))
+        .unwrap();
+    let path = temp("unpinned");
+    std::fs::write(&path, &bytes).unwrap();
+    let file = path.to_string_lossy().to_string();
+    // As the command line opens a design (`load`), and as the app does (`doc.open`).
+    let (doc, saved) = solidcraft_engine::io::read_design_file(&file, None::<fn(solidcraft_engine::io::DesignPreview)>).unwrap();
+    for (how, mut s) in [("opened_at", Session::opened_at(doc, saved.as_ref(), Some(&file))), ("doc.open", open(&path))] {
+        assert_eq!(s.model.last_recomputed, 0, "{how}: taken from the file");
+        assert!(s.doc.features.iter().any(|f| !f.body_names.is_empty()), "{how}: the names are pinned");
+        assert!(!s.is_dirty(), "{how}: opening is no change");
+        let read: Vec<Arc<ModelState>> = s.model.results.iter().map(|r| r.state.clone()).collect();
+        s.execute("solid.box", &json!({"length": 3, "width": 3, "height": 3, "operation": "new"})).unwrap();
+        // As in a large design, whose evaluation cache keeps only a few results: undo finds the
+        // results in the model itself or evaluates them again.
+        *s.model.cache.lock().unwrap() = Default::default();
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.model.last_recomputed, 0, "{how}: the first undo evaluates nothing");
+        assert!(s.model.results.iter().zip(&read).all(|(r, st)| Arc::ptr_eq(&r.state, st)), "{how}: the states read from the file");
+        assert!(!s.is_dirty(), "{how}: undone to the design as opened");
+    }
+    let _ = std::fs::remove_file(&path);
+}
@@ -75,12 +75,15 @@ fn designs() -> Vec<(String, Session)> {
            .unwrap()
            .flatten()
            .map(|e| e.path())
-            .filter(|p| p.extension().is_some_and(|x| x == "solidcraft" || x == "json") && !p.to_string_lossy().ends_with(".expected.json"))
+            .filter(|p| {
+                (solidcraft_engine::io::is_design_container_path(p) || p.extension().is_some_and(|x| x == "json"))
+                    && !p.to_string_lossy().ends_with(".expected.json")
+            })
            .collect();
        files.sort();
        for p in files {
            let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-            let s = if p.extension().is_some_and(|x| x == "solidcraft") {
+            let s = if solidcraft_engine::io::is_design_container_path(&p) {
                open(&p)
            } else {
                let mut s = Session::default();
@@ -150,7 +153,7 @@ fn pi_case_faces_per_step_at_both_heights() {
    const FACES: [(usize, usize); 13] =
        [(2, 6), (3, 10), (4, 19), (5, 19), (6, 25), (7, 43), (8, 43), (9, 55), (10, 55), (11, 59), (12, 59), (13, 63), (14, 79)];
    let dir = scratch_dir("pi");
-    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.solidcraft")).unwrap()).unwrap();
+    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.sc")).unwrap()).unwrap();
    let at = |height: &str, file: &str| {
        let mut d = design.clone();
        for p in d["params"].as_array_mut().unwrap() {
@@ -22,6 +22,19 @@ impl Scratch {
        std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
        path
    }
+
+    fn saving_script(&self) -> (PathBuf, PathBuf) {
+        let path = self.0.join("saving.json");
+        let saved = self.0.join("script-ran.solidcraft");
+        std::fs::write(
+            &path,
+            json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+                {"command": "file.save_as", "params": {"path": saved}}]})
+            .to_string(),
+        )
+        .unwrap();
+        (path, saved)
+    }
 }

 impl Drop for Scratch {
@@ -43,10 +56,96 @@ fn body_count(path: &Path) -> Value {
    json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
 }

+#[test]
+fn run_rejects_invalid_options_before_script_execution_or_output_writes() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--out"][..], "--out needs a value"),
+        (&["--save"][..], "--save needs a value"),
+        (&["--in"][..], "--in needs a value"),
+        (&["--out", "--quiet"][..], "--out needs a value"),
+        (&["--ouut", "part.step"][..], "doesn't take --ouut"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for existing in [false, true] {
+        let saved = dir.0.join(format!("{existing}.solidcraft"));
+        let exported = dir.0.join(format!("{existing}.step"));
+        let report = dir.0.join(format!("{existing}.json"));
+        let outputs = [&saved, &exported, &report];
+        if existing {
+            for path in outputs {
+                std::fs::write(path, b"existing output").unwrap();
+            }
+        }
+        for (extra, message) in cases {
+            let output = cli()
+                .arg("run")
+                .arg(&script)
+                .arg("--save")
+                .arg(&saved)
+                .arg("--out")
+                .arg(&exported)
+                .arg("--json-out")
+                .arg(&report)
+                .args(extra)
+                .output()
+                .unwrap();
+            assert_eq!(output.status.code(), Some(1), "{extra:?}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains(message), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+            assert!(output.stdout.is_empty());
+            assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+            for path in outputs {
+                if existing {
+                    assert_eq!(std::fs::read(path).unwrap(), b"existing output");
+                } else {
+                    assert!(!path.exists());
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_and_inspect_reject_invalid_options_before_script_execution_or_reporting() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--in"][..], "--in needs a value"),
+        (&["--in", "--quiet"][..], "--in needs a value"),
+        (&["--out", "part.step"][..], "doesn't take --out"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for command in ["eval", "inspect"] {
+        for existing in [false, true] {
+            let report = dir.0.join(format!("{command}-{existing}.json"));
+            if existing {
+                std::fs::write(&report, b"existing report").unwrap();
+            }
+            for (extra, message) in cases {
+                let output = cli().arg(command).arg(&script).arg("--json-out").arg(&report).args(extra).output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command} {extra:?}");
+                assert!(
+                    String::from_utf8_lossy(&output.stderr).contains(message),
+                    "{command} {extra:?}: {}",
+                    String::from_utf8_lossy(&output.stderr)
+                );
+                assert!(output.stdout.is_empty());
+                assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+                if existing {
+                    assert_eq!(std::fs::read(&report).unwrap(), b"existing report");
+                } else {
+                    assert!(!report.exists());
+                }
+            }
+        }
+    }
+}
+
 #[test]
 fn cli_loads_both_design_encodings_by_contents() {
    let dir = Scratch::new();
-    for extension in ["solidcraft", "solvecraft", "json"] {
+    for extension in ["sc", "solidcraft", "solvecraft", "json"] {
        let saved = dir.0.join(format!("box.{extension}"));
        json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&saved).output().unwrap());
        let bytes = std::fs::read(&saved).unwrap();
@@ -168,6 +267,110 @@ fn results_with_base_design_and_quiet_still_report_and_save() {
    assert_eq!(body_count(&base), 1);
 }

+/// `eval` and its alias must measure the script applied to the input design, rather than
+/// silently reporting the input alone (#6861).
+#[test]
+fn eval_runs_its_script_on_the_in_design() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solidcraft");
+    let script = dir.0.join("add.json");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let original = std::fs::read(&base).unwrap();
+    std::fs::write(
+        &script,
+        json!({"commands": [{"command": "solid.box", "params": {"length": 5, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
+    )
+    .unwrap();
+    for command in ["eval", "inspect"] {
+        // Both existing one-input forms still measure just the original body.
+        for input in [&base, &dir.script()] {
+            for named_input in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if named_input {
+                    c.arg("--in");
+                }
+                let measured = json_output(c.arg(input).output().unwrap());
+                assert_eq!(measured["body_count"], 1);
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 24.0).abs() < 1e-6);
+            }
+        }
+        for input_first in [false, true] {
+            for to_file in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if input_first {
+                    c.arg("--in").arg(&base).arg(&script);
+                } else {
+                    c.arg(&script).arg("--in").arg(&base);
+                }
+                let report = dir.0.join("measurement.json");
+                if to_file {
+                    c.arg("--json-out").arg(&report);
+                }
+                let output = c.output().unwrap();
+                let measured = if to_file {
+                    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+                    assert!(output.stdout.is_empty());
+                    serde_json::from_slice(&std::fs::read(&report).unwrap()).unwrap()
+                } else {
+                    json_output(output)
+                };
+                assert_eq!(measured["body_count"], 2, "{command}, input_first={input_first}, to_file={to_file}");
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 84.0).abs() < 1e-6);
+                assert_eq!(measured["timeline"].as_array().unwrap().len(), 2, "the script runs exactly once");
+                assert_eq!(std::fs::read(&base).unwrap(), original, "evaluation never saves its changes to the input");
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_propagates_script_errors_before_writing_a_report() {
+    let dir = Scratch::new();
+    let base = dir.script();
+    let script = dir.0.join("bad.json");
+    for command in ["eval", "inspect"] {
+        for contents in ["{", r#"{"commands":[{"command":"missing.command","params":{}}]}"#] {
+            std::fs::write(&script, contents).unwrap();
+            let report = dir.0.join("report.json");
+            let output = cli().arg(command).arg(&script).arg("--in").arg(&base).arg("--json-out").arg(&report).output().unwrap();
+            assert_eq!(output.status.code(), Some(1));
+            assert!(!output.stderr.is_empty());
+            assert!(output.stdout.is_empty());
+            assert!(!report.exists());
+        }
+    }
+}
+
+#[test]
+fn eval_rejects_unknown_options_and_missing_input_values_before_writing_a_report() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let report = dir.0.join("report.json");
+    for command in ["eval", "inspect"] {
+        for (options, message) in [(&["--frobnicate", "1"][..], "doesn't take --frobnicate"), (&["--in"][..], "--in needs a value")] {
+            for options_first in [false, true] {
+                std::fs::write(&report, b"previous report").unwrap();
+                let mut c = cli();
+                c.arg(command);
+                if options_first {
+                    c.args(options).arg("--json-out").arg(&report).arg(&script);
+                } else {
+                    c.arg(&script).args(options).arg("--json-out").arg(&report);
+                }
+                // A following option also proves that --in cannot consume a flag as its value.
+                let output = c.output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command}, {options:?}");
+                let error = String::from_utf8_lossy(&output.stderr);
+                assert!(error.contains(message), "{command}: {error}");
+                assert!(output.stdout.is_empty());
+                assert_eq!(std::fs::read(&report).unwrap(), b"previous report");
+            }
+        }
+    }
+}
+
 #[test]
 fn results_propagate_output_errors() {
    let dir = Scratch::new();
@@ -209,6 +412,11 @@ fn legacy_extension_and_format_tag_still_open() {
    assert_eq!(body_count(&resaved), 2);
    let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
    assert!(reopened.to_json().contains("\"solidcraft/"));
+    // `.solidcraft` (before `.sc`) opens as `--in` and as the design to evaluate; `.sc` too.
+    let current = dir.0.join("current.sc");
+    json_output(cli().args(["run", "--in"]).arg(&resaved).arg(dir.script()).arg("--save").arg(&current).output().unwrap());
+    assert_eq!(body_count(&current), 3);
+    assert!(solidcraft_engine::io::is_design_container(&std::fs::read(&current).unwrap()), "a .sc file is a design container");
 }

 /// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
@@ -288,6 +496,78 @@ fn timings_and_profile_report_each_command() {
    assert!(String::from_utf8_lossy(&output.stderr).contains("--timings needs a script"));
 }

+/// #6921: `--param-check` checks a script's steps against their contracts on every path `run`
+/// takes (a script alone, on an `--in` design or script, with `--results`, `--timings` or
+/// `--profile`), and a warning reaches stderr even when a later step fails.
+#[test]
+fn param_check_reaches_every_script_run_takes() {
+    let dir = Scratch::new();
+    let typo = dir.0.join("typo.json");
+    let step = json!({"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4, "operaton": "new"}});
+    std::fs::write(&typo, json!({"commands": [step.clone()]}).to_string()).unwrap();
+    let base = dir.0.join("base.solidcraft");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let saved = dir.0.join("saved.solidcraft");
+    let start = dir.script();
+    let (typo, base, saved_arg, start) = (typo.to_str().unwrap(), base.to_str().unwrap(), saved.to_str().unwrap(), start.to_str().unwrap());
+    let paths = [&[][..], &["--in", base], &["--in", start], &["--results"], &["--timings"], &["--timings", "--profile"]];
+    let run = |level: Option<&str>, extra: &[&str]| {
+        std::fs::remove_file(&saved).ok();
+        let check = level.map(|l| ["--param-check", l]).into_iter().flatten();
+        cli().args(["run", typo, "--save", saved_arg]).args(check).args(extra).output().unwrap()
+    };
+
+    // Off, the default: the step runs as it always has, without a word.
+    let off = run(None, &[]);
+    assert!(off.status.success() && !String::from_utf8_lossy(&off.stderr).contains("operaton"), "{off:?}");
+    assert_eq!(body_count(&saved), 1);
+
+    // Warn: each path runs the step, saves, and reports it on stderr; `--results` keeps it too.
+    for extra in paths {
+        let output = run(Some("warn"), extra);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(output.status.success(), "{extra:?}: {stderr}");
+        assert!(stderr.contains("step 1: unknown key `operaton`; did you mean `operation`?"), "{extra:?}: {stderr}");
+        assert!(saved.exists(), "{extra:?}");
+        if extra == ["--results"] {
+            let results: Value = serde_json::from_slice(&output.stdout).unwrap();
+            assert!(results[0]["param_warnings"][0].as_str().is_some_and(|w| w.contains("operaton")), "{results}");
+        }
+    }
+
+    // Strict: on each path the run stops at the step, and nothing is written.
+    for extra in paths {
+        let output = run(Some("strict"), extra);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
+        assert!(stderr.contains("unknown key `operaton`"), "{extra:?}: {stderr}");
+        assert!(!saved.exists(), "{extra:?}");
+    }
+
+    // Warn, with a later step that fails: the run fails, and the first step's warning is still
+    // reported, timed or not.
+    let failing = dir.0.join("failing.json");
+    let fail = json!({"command": "solid.extrude", "params": {"sketch": "Nope"}});
+    std::fs::write(&failing, json!({"commands": [step, fail]}).to_string()).unwrap();
+    for extra in [&[][..], &["--timings"]] {
+        let output = cli().arg("run").arg(&failing).args(["--param-check", "warn"]).args(extra).output().unwrap();
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
+        assert!(stderr.contains("step 1: unknown key `operaton`") && stderr.contains("no sketch `Nope`"), "{extra:?}: {stderr}");
+    }
+
+    // A level it doesn't know and a missing value fail.
+    for (bad, says) in [
+        (&["--param-check", "loud"][..], "--param-check wants off, warn or strict, not `loud`"),
+        (&["--param-check"], "run: --param-check wants off, warn or strict"),
+    ] {
+        let output = cli().args(["run", typo]).args(bad).output().unwrap();
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{bad:?}: {stderr}");
+        assert!(stderr.contains(says), "{bad:?}: {stderr}");
+    }
+}
+
 fn render_setup_script(dir: &Scratch, job: Value) -> PathBuf {
    let path = dir.0.join("render.json");
    std::fs::write(
@@ -1,5 +1,5 @@
 //! Straight edges stay one edge after many cuts (#1049). The owner's design
-//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
+//! (`tests/action_matrix/designs/crazy-geom-cuts.sc`, saved by 0.10.0): five extrudes,
 //! joins and cuts, over four sketches, three of them on faces of the body with the faces'
 //! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
 //! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
@@ -14,7 +14,7 @@ use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
 use solidcraft_engine::geom::Vec3;

 fn design() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.sc")
 }

 fn open(path: &Path) -> Session {
@@ -22,6 +22,8 @@ solidcraft-engine = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
+url = "2"
+percent-encoding = "2"

 [target.'cfg(target_arch = "wasm32")'.dependencies]
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
@@ -32,7 +34,8 @@ serde_json = { workspace = true }
 web-sys = { version = "0.3", features = [
    "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
-    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
+    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage", "StorageEvent",
    "IdbFactory", "IdbDatabase", "IdbObjectStore", "IdbOpenDbRequest", "IdbRequest", "IdbTransaction", "IdbTransactionMode",
-    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "MediaQueryList", "Gamepad", "Performance",
+    "Headers", "ReadableStream", "ReadableStreamDefaultReader",
+    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "FormData", "RequestInit", "MediaQueryList", "Gamepad", "Performance",
 ] }
@@ -22,17 +22,21 @@
  <link data-trunk rel="rust" data-bin="solidcraft-web" data-wasm-opt="z" data-weak-refs />
  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf" data-target-path="fonts" />
  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/OFL.txt" data-target-path="fonts" />
+  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-sc/CraftUI-SC.otf" data-target-path="fonts" />
+  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-sc/OFL.txt" data-target-path="fonts/craft-ui-sc" />
+  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-tc/CraftUI-TC.otf" data-target-path="fonts" />
+  <link data-trunk rel="copy-file" href="../../assets/fonts/craft-ui-tc/OFL.txt" data-target-path="fonts/craft-ui-tc" />
  <link data-trunk rel="css" href="../../assets/styles/web/loading.css" />
  <link data-trunk rel="copy-file" href="../../assets/styles/web/loading-logo.svg" />
  <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
  <meta name="theme-color" content="#343840">
  <link rel="manifest" href="manifest.webmanifest">
-  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
-  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/io.tangencylabs.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/io.tangencylabs.solidcraft.png">
  <link data-trunk rel="copy-file" href="manifest.webmanifest" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
  <canvas id="solidcraft_canvas"></canvas>
@@ -9,8 +9,8 @@
  "theme_color": "#343840",
  "categories": ["productivity", "utilities"],
  "icons": [
-    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
-    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
-    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+    { "src": "icons/32x32/io.tangencylabs.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/io.tangencylabs.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/io.tangencylabs.solidcraft.png", "sizes": "512x512", "type": "image/png" }
  ]
 }
@@ -114,10 +114,70 @@ pub fn opens_design(extensions: &[&str]) -> bool {
    extensions.is_empty() || extensions.iter().any(|e| solidcraft_engine::io::DESIGN_EXTS.contains(e))
 }

-/// The file type a Save As dialog offers for `name`: (description, MIME type, extension).
-pub fn save_type(name: &str) -> (&'static str, &'static str, &'static str) {
-    let json = std::path::Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case("json"));
-    if json { ("Plain JSON design", "application/json", ".json") } else { ("SolidCraft design", "application/octet-stream", ".solidcraft") }
+/// Where an Open for `extensions` (what the command reads; `&[]`: anything) is answered.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum OpenRoute {
+    /// The browser's open dialog for a design: the file keeps its handle, so Save writes back.
+    Disk,
+    /// The "Files in this browser" window, where the browser can't open a design from the disk.
+    Panel,
+    /// A plain file input that offers these types: the file is read into the engine's files and
+    /// the command runs on it (Insert DXF or SVG, images, meshes, imported settings).
+    Upload,
+}
+
+/// Choose how an Open for `extensions` asks for its file; `api`: the browser can open a file
+/// from the disk and keep its handle.
+pub fn open_route(api: bool, extensions: &[&str]) -> OpenRoute {
+    match (opens_design(extensions), api) {
+        (true, true) => OpenRoute::Disk,
+        (true, false) => OpenRoute::Panel,
+        (false, _) => OpenRoute::Upload,
+    }
+}
+
+/// The `accept` list of a file input for `extensions` (with or without their dot): ".dxf,.svg".
+pub fn accept_list(extensions: &[&str]) -> String {
+    let list: Vec<String> = extensions
+        .iter()
+        .map(|e| e.trim().trim_start_matches('.'))
+        .filter(|e| !e.is_empty())
+        .map(|e| format!(".{}", e.to_ascii_lowercase()))
+        .collect();
+    list.join(",")
+}
+
+/// The `accept` of a file input for `extensions` on this device (`apple_touch`: an iPhone or
+/// iPad). The picker there offers only files of a type the system knows from the list and greys
+/// out the rest, `.solidcraft` designs among them, since no system type has that extension
+/// (#6977). So it offers every file there, and the opener checks what it gets.
+pub fn input_accept(extensions: &[&str], apple_touch: bool) -> String {
+    if apple_touch { String::new() } else { accept_list(extensions) }
+}
+
+/// The browser runs on an iPhone or iPad (every browser there is WebKit), from its
+/// `navigator.userAgent` and `navigator.maxTouchPoints`. iPadOS presents itself as a Mac; only its
+/// touch screen tells them apart.
+pub fn apple_touch(user_agent: &str, touch_points: i32) -> bool {
+    ["iPhone", "iPad", "iPod"].iter().any(|d| user_agent.contains(d)) || (user_agent.contains("Macintosh") && touch_points > 1)
+}
+
+/// The largest file an upload for `extensions` reads: images go into a canvas, which has a size
+/// limit, so a bigger one is refused before it is read. `None`: the importer checks the file.
+pub fn upload_limit(extensions: &[&str]) -> Option<usize> {
+    let image = |e: &&str| ["png", "jpg", "jpeg"].contains(&e.trim_start_matches('.').to_ascii_lowercase().as_str());
+    (!extensions.is_empty() && extensions.iter().all(image)).then_some(solidcraft_engine::doc::canvas::MAX_CANVAS_BYTES)
+}
+
+/// The file type a Save As dialog offers for `name`: (description, MIME type, extension). A
+/// design is `.sc` unless the name already has an older design extension, which it keeps.
+pub fn save_type(name: &str) -> (&'static str, &'static str, String) {
+    let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+    match ext.as_deref() {
+        Some("json") => ("Plain JSON design", "application/json", ".json".into()),
+        Some(e) if solidcraft_engine::io::is_design_ext(e) => ("SolidCraft design", "application/octet-stream", format!(".{e}")),
+        _ => ("SolidCraft design", "application/octet-stream", format!(".{}", solidcraft_engine::io::DESIGN_EXT)),
+    }
 }

 /// Is this a cancelled dialog (the browser's `AbortError`)? Not an error to show.
@@ -140,7 +200,7 @@ mod web {
    use wasm_bindgen_futures::{JsFuture, spawn_local};
    use web_sys::{FileSystemFileHandle, IdbDatabase, IdbObjectStore, IdbOpenDbRequest, IdbRequest, IdbTransactionMode};

-    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, opens_design, parse, path, plan_prune, save_type};
+    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, parse, path, plan_prune, save_type};
    use crate::files::{Files, err, read_handle};

    const DB: &str = "solidcraft-disk-handles";
@@ -209,7 +269,7 @@ mod web {
        let options = Object::new();
        let _ = Reflect::set(&options, &"suggestedName".into(), &name.into());
        let (description, mime, extension) = save_type(name);
-        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, extension));
+        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, &extension));
        options
    }

@@ -294,7 +354,9 @@ mod web {
        let options = Object::new();
        let _ = Reflect::set(&options, &"multiple".into(), &JsValue::FALSE);
        let extensions = Array::new();
-        for e in [".solidcraft", ".solvecraft", ".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm"] {
+        let designs = solidcraft_engine::io::DESIGN_EXTS.iter().map(|e| format!(".{e}"));
+        let others = [".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm", ".dxf", ".svg"].map(String::from);
+        for e in designs.chain(others) {
            extensions.push(&e.into());
        }
        let accept = Object::new();
@@ -315,11 +377,6 @@ mod web {
        p
    }

-    /// Does an Open for `extensions` use the browser's open dialog?
-    pub fn handles_open(extensions: &[&str]) -> bool {
-        supported() && opens_design(extensions)
-    }
-
    // ---- writing ------------------------------------------------------------------------

    /// Queue what a command wrote to a disk path. Writes go one at a time; a newer write of the
@@ -577,6 +634,8 @@ mod tests {
        assert_eq!(route("/disk/18f-2a/Bracket.solidcraft"), WriteTo::Disk);
        assert_eq!(route("/downloads/part.step"), WriteTo::Download);
        assert_eq!(route("/upload/part.step"), WriteTo::Memory);
+        // The temporary folder (a screenshot without a path, #7192) stays in memory.
+        assert_eq!(route(&format!("{}/solidcraft-shot.png", solidcraft_engine::io::vfs::BROWSER_TEMP)), WriteTo::Memory);
    }

    #[test]
@@ -615,17 +674,55 @@ mod tests {
    #[test]
    fn only_design_opens_use_the_disk_dialog() {
        assert!(opens_design(&[]));
+        assert!(opens_design(&["sc"]));
        assert!(opens_design(&["solidcraft"]));
        assert!(opens_design(&["solvecraft"]));
        assert!(!opens_design(&["step", "stp"]));
        assert!(!opens_design(&["json"]));
    }

+    /// Insert DXF or SVG, images and other non-design files get a file input that offers their
+    /// types in every browser (#2052); designs keep the disk dialog or the browser's files.
+    #[test]
+    fn opens_of_other_files_use_a_file_input_for_their_types() {
+        assert_eq!(open_route(true, &["dxf"]), OpenRoute::Upload);
+        assert_eq!(open_route(false, &["png", "jpg", "jpeg"]), OpenRoute::Upload);
+        assert_eq!(open_route(true, &[]), OpenRoute::Disk);
+        assert_eq!(open_route(false, &["solidcraft"]), OpenRoute::Panel);
+        assert_eq!(accept_list(&["dxf"]), ".dxf");
+        assert_eq!(accept_list(&["png", ".JPG", "", "jpeg"]), ".png,.jpg,.jpeg");
+        assert_eq!(accept_list(&[]), "");
+        assert!(upload_limit(&["png", "jpg", "jpeg"]).is_some());
+        assert_eq!(upload_limit(&["dxf"]), None);
+    }
+
+    /// An iPhone or iPad greys out a `.solidcraft` design the `accept` list names, as it knows no
+    /// type for that extension, so its inputs offer every file; other devices keep the list (#6977).
+    #[test]
+    fn file_inputs_on_an_iphone_or_ipad_offer_every_file() {
+        let iphone =
+            "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1";
+        let mac = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15";
+        let chrome_ios = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/138.0.7204.156 Mobile/15E148 Safari/604.1";
+        let chrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36";
+        assert!(apple_touch(iphone, 5));
+        assert!(apple_touch(chrome_ios, 5), "every browser on iOS has the same picker");
+        assert!(apple_touch(mac, 5), "an iPad presents itself as a Mac");
+        assert!(!apple_touch(mac, 0), "a Mac has no touch screen");
+        assert!(!apple_touch(chrome, 10), "a touch screen elsewhere filters as before");
+        assert!(!apple_touch("", 0), "hostile input is just not an iPhone");
+        let designs = ["solidcraft", "json", "step"];
+        assert_eq!(input_accept(&designs, true), "");
+        assert_eq!(input_accept(&designs, false), ".solidcraft,.json,.step");
+    }
+
    #[test]
    fn the_save_dialog_offers_the_type_of_the_name() {
-        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
+        assert_eq!(save_type("Plate.sc").2, ".sc");
        assert_eq!(save_type("Plate.JSON").2, ".json");
-        assert_eq!(save_type("Plate").2, ".solidcraft");
+        assert_eq!(save_type("Plate").2, ".sc");
+        // A design opened under an older extension keeps it.
+        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
    }

    #[test]
@@ -0,0 +1,40 @@
+//! Open with EasyPrint in the browser: upload the model to Printables' import endpoint with
+//! `fetch` (it allows any origin) and answer with the address to open.
+
+use std::sync::mpsc::Sender;
+
+use js_sys::{Array, Uint8Array};
+use solidcraft_engine::easyprint::{IMPORT_URL, parse_import_response};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::files::err;
+
+/// Start the upload; the answer arrives on `done`.
+pub fn upload(name: &str, bytes: Vec<u8>, done: Sender<Result<String, String>>) {
+    let name = name.to_string();
+    spawn_local(async move {
+        let _ = done.send(post(&name, &bytes).await);
+    });
+}
+
+async fn post(name: &str, bytes: &[u8]) -> Result<String, String> {
+    let window = web_sys::window().ok_or("no window")?;
+    let parts = Array::new();
+    parts.push(&Uint8Array::from(bytes));
+    let blob = web_sys::Blob::new_with_u8_array_sequence(&parts).map_err(err)?;
+    let form = web_sys::FormData::new().map_err(err)?;
+    form.append_with_blob_and_filename("file", &blob, name).map_err(err)?;
+    form.append_with_str("file_name", name).map_err(err)?;
+    let headers = web_sys::Headers::new().map_err(err)?;
+    headers.set("Accept", "application/json").map_err(err)?;
+    let init = web_sys::RequestInit::new();
+    init.set_method("POST");
+    init.set_body(&form);
+    init.set_headers(&headers);
+    let response = JsFuture::from(window.fetch_with_str_and_init(IMPORT_URL, &init)).await.map_err(err)?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "response cast failed".to_string())?;
+    let status = response.status();
+    let text = JsFuture::from(response.text().map_err(err)?).await.map_err(err)?;
+    parse_import_response(status, text.as_string().unwrap_or_default().as_bytes())
+}
@@ -24,11 +24,13 @@ pub const OPFS: &str = disk::OPFS_PREFIX;
 pub const DOWNLOADS: &str = disk::DOWNLOADS_PREFIX;
 /// Files brought in from the computer.
 pub const UPLOAD: &str = "/upload/";
-/// The autosave of unsaved work (in OPFS: `recovery.solidcraft` and `recovery.json`).
-const RECOVERY: &str = "recovery.solidcraft";
-/// The autosave earlier releases kept (compatibility shim, docs/compatibility.md): recovered
-/// when there is no current one.
-const LEGACY_RECOVERY: &str = "recovery.solvecraft";
+/// The autosave of unsaved work (in OPFS: `recovery.sc` and `recovery.json`), named with
+/// `solidcraft_engine::io::DESIGN_EXT`.
+const RECOVERY: &str = "recovery.sc";
+/// The autosaves earlier releases kept, newest first, one per entry of
+/// `solidcraft_engine::io::LEGACY_DESIGN_EXTS` (compatibility shim, docs/compatibility.md): the
+/// newest is recovered when there is no current one.
+const LEGACY_RECOVERY: [&str; 2] = ["recovery.solidcraft", "recovery.solvecraft"];
 const RECOVERY_META: &str = "recovery.json";

 /// What to do with a file brought in from the computer.
@@ -38,6 +40,8 @@ pub enum Intent {
    Open,
    /// Add its bodies to the open design (STEP, 3MF, STL).
    Insert,
+    /// Import it as a theme: it was dropped on Preferences' Import tile (#8226).
+    Theme,
 }

 /// A stored design, as the file panel lists it.
@@ -282,9 +286,10 @@ pub fn start(files: &Rc<Files>) {
                }
                let mut entries = Vec::new();
                let has_recovery = all.iter().any(|(n, _, _)| n == RECOVERY);
+                let legacy = (!has_recovery).then(|| LEGACY_RECOVERY.into_iter().find(|l| all.iter().any(|(n, _, _)| n == l))).flatten();
                for (name, bytes, modified) in all {
-                    if name == LEGACY_RECOVERY {
-                        if !has_recovery {
+                    if LEGACY_RECOVERY.contains(&name.as_str()) {
+                        if legacy == Some(name.as_str()) {
                            vfs::insert(&format!("{OPFS}{RECOVERY}"), bytes);
                        }
                        continue;
@@ -424,7 +429,9 @@ pub fn autosave(files: &Rc<Files>, doc: Option<(&solidcraft_engine::doc::Documen
        }
        None => spawn_local(async move {
            let _ = remove_file(RECOVERY).await;
-            let _ = remove_file(LEGACY_RECOVERY).await;
+            for legacy in LEGACY_RECOVERY {
+                let _ = remove_file(legacy).await;
+            }
            let _ = remove_file(RECOVERY_META).await;
        }),
    }
@@ -448,6 +455,18 @@ pub fn recovery_path() -> String {
    format!("{OPFS}{RECOVERY}")
 }

+/// A recovery file lives in OPFS, but its relative links belong to the original design's
+/// folder (which can be on disk). Resolve them before Open sees the temporary file location.
+pub fn prepare_recovery(original_path: Option<&str>) -> Result<String, String> {
+    let path = recovery_path();
+    let bytes = vfs::read(&path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
+    let mut doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?;
+    solidcraft_engine::resolve_design_links(&mut doc, original_path);
+    let bytes = solidcraft_engine::io::write_design_container(&doc).map_err(|e| e.to_string())?;
+    vfs::insert(&path, bytes);
+    Ok(path)
+}
+
 /// Pick files on the computer: the File System Access picker where there is one, else an
 /// `<input type=file>`. Read files arrive in `files.incoming`.
 pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
@@ -500,9 +519,10 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
    let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
    input.set_type("file");
    // Everything the browser build imports, from the format registry: cadmpeg is pure Rust, so
-    // FreeCAD and Rhino files are part of it.
-    let accept = solidcraft_engine::io::formats::open_extensions(true).iter().map(|e| format!(".{e}")).collect::<Vec<_>>().join(",");
-    input.set_accept(&accept);
+    // FreeCAD and Rhino files are part of it; plus the DXF and SVG drawings Open and Insert take.
+    let mut extensions = solidcraft_engine::io::formats::open_extensions(true);
+    extensions.extend(["dxf", "svg"]);
+    input.set_accept(&disk::input_accept(&extensions, apple_touch()));
    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
    let _ = input.set_attribute("style", "display:none");
    if let Some(body) = doc.body() {
@@ -527,14 +547,85 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
    input.click();
 }

+/// Ask for one file of these types (`extensions`, e.g. `["dxf"]`) with a plain file input, the
+/// dialog every browser has. The answer is the file's path in the engine's files (under
+/// [`UPLOAD`], as for a file picked in the disk dialog), so the command that asked runs on it;
+/// `None` when the dialog was closed or the file could not be read.
+pub fn pick_upload(files: &Rc<Files>, extensions: &[&str]) -> impl std::future::Future<Output = Option<String>> + use<> {
+    // Shown now, in the click: a file dialog needs the user's gesture.
+    let chosen = choose_file(&disk::input_accept(extensions, apple_touch()));
+    let limit = disk::upload_limit(extensions);
+    let files = files.clone();
+    async move {
+        let read = async {
+            let value = JsFuture::from(chosen?).await.map_err(err)?;
+            // Closing the dialog answers no file: nothing to say.
+            let Ok(file) = value.dyn_into::<web_sys::File>() else { return Ok(None) };
+            let name = file.name();
+            if limit.is_some_and(|max| !file.size().is_finite() || file.size() > max as f64) {
+                return Err(format!("{name}: the file is too large"));
+            }
+            let bytes = blob_bytes(&file).await.map_err(|e| format!("{name}: {e}"))?;
+            let path = format!("{UPLOAD}{name}");
+            vfs::insert(&path, bytes);
+            Ok(Some(path))
+        };
+        match read.await {
+            Ok(path) => path,
+            Err(e) => {
+                files.say(format!("open: {e}"), true);
+                None
+            }
+        }
+    }
+}
+
+/// The page runs on an iPhone or iPad, whose file inputs offer every file (`disk::input_accept`).
+fn apple_touch() -> bool {
+    web_sys::window().is_some_and(|w| {
+        let nav = w.navigator();
+        disk::apple_touch(&nav.user_agent().unwrap_or_default(), nav.max_touch_points())
+    })
+}
+
+/// Show a hidden `<input type=file>` offering `accept` (call in the click). The promise answers
+/// the picked `File`, or `null` when the dialog is closed (the input's `cancel` event).
+fn choose_file(accept: &str) -> Result<js_sys::Promise, String> {
+    let doc = web_sys::window().and_then(|w| w.document()).ok_or("this page can't show a file dialog")?;
+    let input = doc.create_element("input").map_err(err)?.dyn_into::<web_sys::HtmlInputElement>().map_err(|_| "no file input".to_string())?;
+    input.set_type("file");
+    input.set_accept(accept);
+    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
+    input.set_attribute("style", "display:none").map_err(err)?;
+    doc.body().ok_or("this page has no body")?.append_child(&input).map_err(err)?;
+    let promise = js_sys::Promise::new(&mut |resolve: Function, _reject: Function| {
+        // One answer for a pick or a cancel; read from the event, so it does not keep the input.
+        let done = Closure::once_into_js(move |event: web_sys::Event| {
+            let file = event.target().and_then(|t| t.dyn_into::<web_sys::HtmlInputElement>().ok()).and_then(|input| {
+                input.set_onchange(None);
+                input.set_oncancel(None);
+                input.remove();
+                input.files().and_then(|list| list.get(0))
+            });
+            let _ = resolve.call1(&JsValue::UNDEFINED, &file.map_or(JsValue::NULL, JsValue::from));
+        });
+        input.set_onchange(Some(done.unchecked_ref()));
+        input.set_oncancel(Some(done.unchecked_ref()));
+    });
+    input.click();
+    Ok(promise)
+}
+
 /// Read files dropped on the page.
-pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput) {
+/// `theme`: the pointer is over Preferences' Import tile, so the files are themes.
+pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput, theme: bool) {
+    let intent = if theme { Intent::Theme } else { Intent::Insert };
    for f in std::mem::take(&mut raw.dropped_files) {
        let files = files.clone();
        spawn_local(async move {
            let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
            match f.bytes_async().await {
-                Ok(b) => files.arrive(name, b, Intent::Insert),
+                Ok(b) => files.arrive(name, b, intent),
                Err(e) => files.say(format!("{name}: {e}"), true),
            }
        });
@@ -0,0 +1,142 @@
+//! Bounded HTTPS or same-origin downloads, handed to the normal design-open command as unsaved copies.
+use std::{cell::RefCell, rc::Rc};
+
+use js_sys::{Reflect, Uint8Array};
+use solidcraft_engine::io::vfs;
+use solidcraft_ui_egui::{SolveApp, ui_kit};
+use wasm_bindgen::{JsCast as _, JsValue};
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::{check_download_size, design_url};
+
+type Reply = Result<(String, Vec<u8>), String>;
+
+#[derive(Default)]
+pub struct Download {
+    reply: Rc<RefCell<Option<Reply>>>,
+    pending: Option<(String, Vec<u8>)>,
+}
+
+impl Download {
+    pub fn start(url: Option<&str>, ctx: &egui::Context) -> Self {
+        let download = Self::default();
+        if let Some(url) = url {
+            let url = url.to_owned();
+            let slot = download.reply.clone();
+            let ctx = ctx.clone();
+            spawn_local(async move {
+                *slot.borrow_mut() = Some(fetch(&url).await);
+                ctx.request_repaint();
+            });
+        }
+        download
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        if let Some(reply) = self.reply.borrow_mut().take() {
+            match reply {
+                Ok(file) => self.pending = Some(file),
+                Err(error) => app.set_status(format!("Could not open design link: {error}"), true),
+            }
+        }
+        if self.pending.is_none() || app.file_picker_busy() {
+            return;
+        }
+        if solidcraft_ui_egui::documents::any_dirty(app) {
+            let mut answer = None;
+            let closed = ui_kit::Window::new(egui::Id::new("open_link"), "status_warning", solidcraft_ui_egui::i18n::tr("web.open_link"))
+                .required()
+                .show_body(ctx, |ui| {
+                    ui.label(solidcraft_ui_egui::i18n::tr("web.open_link_confirm"));
+                    ui.horizontal(|ui| {
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.open"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(true);
+                        }
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.cancel"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(false);
+                        }
+                    });
+                });
+            match answer {
+                Some(true) => {}
+                Some(false) => {
+                    self.pending = None;
+                    return;
+                }
+                None if closed => {
+                    self.pending = None;
+                    return;
+                }
+                None => return,
+            }
+        }
+        let Some((name, bytes)) = self.pending.take() else { return };
+        // The extension selects the design loader even when the URL has no extension.
+        let path = &format!("/linked/design.{}", solidcraft_engine::io::DESIGN_EXT);
+        vfs::insert(path, bytes);
+        app.open_path(path);
+        if app.session.path.as_deref() == Some(path.as_str()) {
+            app.session.path = None;
+            app.session.doc_mut().name = name;
+            app.session.mark_unsaved();
+        } else {
+            app.set_status("Could not open design link: the downloaded file is not a valid SolidCraft design", true);
+        }
+        let _ = vfs::remove(path);
+    }
+}
+
+async fn fetch(value: &str) -> Reply {
+    let window = web_sys::window().ok_or("No browser window")?;
+    let page_origin = window.location().origin().map_err(|_| "Cannot read page origin")?;
+    let url = design_url(value, &page_origin)?;
+    let name = url.path_segments().and_then(|mut segments| segments.next_back()).filter(|name| !name.is_empty()).unwrap_or("Design");
+    let decoded = js_sys::decode_uri_component(name).ok().and_then(|name| name.as_string()).unwrap_or_else(|| name.to_owned());
+    // `arm.sc` (or a legacy `arm.solidcraft`) is named `arm`.
+    let stem = match decoded.rsplit_once('.') {
+        Some((stem, ext)) if !stem.is_empty() && solidcraft_engine::io::is_design_ext(ext) => stem,
+        _ => decoded.as_str(),
+    };
+    let name: String = stem.chars().take(255).collect();
+    let response = JsFuture::from(window.fetch_with_str(url.as_str())).await.map_err(|_| "Network request failed or the host refused CORS access")?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "Invalid download response")?;
+    design_url(&response.url(), &page_origin).map_err(|_| "Design redirected to a URL that does not use HTTPS or the page's own origin")?;
+    if !response.ok() {
+        return Err(format!("HTTP {} {}", response.status(), response.status_text()));
+    }
+    let length = response
+        .headers()
+        .get("Content-Length")
+        .map_err(|_| "Cannot read download size")?
+        .map(|value| value.parse::<u64>().map_err(|_| "Invalid Content-Length"))
+        .transpose()?;
+    if let Some(length) = length {
+        check_download_size(0, length)?;
+    }
+    let stream = response.body().ok_or("Download has no body")?;
+    let reader: web_sys::ReadableStreamDefaultReader = stream.get_reader().dyn_into().map_err(|_| "Cannot read download stream")?;
+    let result = read(&reader).await;
+    if result.is_err() {
+        let _ = JsFuture::from(reader.cancel()).await;
+    }
+    // Fetch rejects interrupted HTTP bodies and decodes Content-Encoding. Content-Length
+    // can describe compressed bytes, so the streamed limit also checks the decoded size.
+    let bytes = result?;
+    Ok((name, bytes))
+}
+
+async fn read(reader: &web_sys::ReadableStreamDefaultReader) -> Result<Vec<u8>, String> {
+    let mut bytes = Vec::new();
+    // Bound even a stream which keeps returning empty chunks.
+    for _ in 0..1_000_000 {
+        let chunk = JsFuture::from(reader.read()).await.map_err(|_| "Download interrupted")?;
+        if Reflect::get(&chunk, &JsValue::from_str("done")).map_err(|_| "Invalid download stream")?.as_bool() == Some(true) {
+            return Ok(bytes);
+        }
+        let value = Reflect::get(&chunk, &JsValue::from_str("value")).map_err(|_| "Invalid download chunk")?;
+        let chunk: Uint8Array = value.dyn_into().map_err(|_| "Invalid download bytes")?;
+        check_download_size(bytes.len(), u64::from(chunk.length()))?;
+        bytes.extend_from_slice(&chunk.to_vec());
+    }
+    Err("Download returned too many chunks".into())
+}
@@ -11,9 +11,13 @@ mod api;
 #[cfg(any(target_arch = "wasm32", test))]
 mod disk;
 #[cfg(target_arch = "wasm32")]
+mod easyprint;
+#[cfg(target_arch = "wasm32")]
 mod files;
 #[cfg(target_arch = "wasm32")]
 mod install;
+#[cfg(target_arch = "wasm32")]
+mod linked;
 #[cfg(any(target_arch = "wasm32", test))]
 mod space_mouse;

@@ -25,6 +29,133 @@ fn browser_switches_tabs(key: &str, ctrl: bool) -> bool {
    ctrl && key == "Tab"
 }

+#[cfg(any(target_arch = "wasm32", test))]
+fn query_flag(query: &str, name: &str) -> bool {
+    url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()).any(|(key, _)| key == name)
+}
+
+/// Launch options use exact query keys; URL values are decoded only once.
+#[cfg(any(target_arch = "wasm32", test))]
+#[derive(Default, Debug)]
+struct Launch {
+    open: Option<String>,
+    embed: bool,
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+impl Launch {
+    fn parse(query: &str) -> Self {
+        let mut launch = Self::default();
+        let mut embed = false;
+        for (key, value) in url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()) {
+            match key.as_ref() {
+                "open" if launch.open.is_none() => launch.open = Some(value.into_owned()),
+                "embed" => embed = true,
+                _ => {}
+            }
+        }
+        launch.embed = embed && launch.open.is_some();
+        launch
+    }
+
+    fn persists(&self) -> bool {
+        !self.embed
+    }
+
+    fn full_app_url(&self, mut url: url::Url) -> String {
+        url.set_query(None);
+        url.set_fragment(None);
+        if let Some(open) = &self.open {
+            url.query_pairs_mut().append_pair("open", open);
+        }
+        url.to_string()
+    }
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn design_url(value: &str, page_origin: &str) -> Result<url::Url, String> {
+    if value.len() > 16_384 {
+        return Err("Design URL is too long".into());
+    }
+    let decoded = percent_encoding::percent_decode_str(value).decode_utf8().map_err(|_| "Invalid design URL encoding")?;
+    if decoded.chars().any(|ch| ch.is_control() || ch == '\\') {
+        return Err("Design links must not contain backslashes or control characters".into());
+    }
+    // Check before URL parsing normalizes away dot segments. Decode escaped slashes too.
+    let path = value.split(['?', '#']).next().unwrap_or_default();
+    let path = percent_encoding::percent_decode_str(path).collect::<Vec<_>>();
+    if path.split(|byte| *byte == b'/').any(|segment| segment == b"..") {
+        return Err("Design links must not contain parent path segments".into());
+    }
+    let page = url::Url::parse(page_origin).map_err(|_| "Invalid page origin")?;
+    let url = if value.starts_with('/') && !value.starts_with("//") {
+        page.join(value).map_err(|_| "Invalid design path")?
+    } else {
+        url::Url::parse(value).map_err(|_| "Invalid design URL")?
+    };
+    if (url.scheme() != "https" && url.origin() != page.origin())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+    {
+        return Err("Design links must use HTTPS or the page's own origin without credentials".into());
+    }
+    Ok(url)
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn check_download_size(current: usize, incoming: u64) -> Result<(), String> {
+    let cap = solidcraft_engine::io::MAX_DESIGN_BYTES as u64;
+    if current as u64 > cap || incoming > cap.saturating_sub(current as u64) {
+        return Err(format!("Design exceeds the {} MB size limit", cap / (1024 * 1024)));
+    }
+    Ok(())
+}
+
+/// Ctrl+W (⌘W, without Shift or Alt) while a design is shown closes it in the app, so the
+/// browser must not close the tab (#5366). On the start page the browser closes the tab.
+#[cfg(any(target_arch = "wasm32", test))]
+fn closes_design(key: &str, command: bool, shift: bool, alt: bool, design_shown: bool) -> bool {
+    design_shown && command && !shift && !alt && key.eq_ignore_ascii_case("w")
+}
+
+/// The settings a tab last wrote to the browser's storage, or loaded from another tab (#8644).
+/// Every open tab of the app shares that storage, and eframe saves each tab's whole copy every
+/// 30 s and when the page loses focus, so a tab still holding old settings put them back over a
+/// change made in another. A change is now written in the frame it is made, and the other tabs
+/// load it ([`settings_written`]).
+#[cfg(any(target_arch = "wasm32", test))]
+#[derive(Default, Debug)]
+struct PrefsWriter {
+    written: Option<String>,
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+impl PrefsWriter {
+    /// `prefs` if they are not the settings written or loaded last (they count as written from
+    /// now on).
+    fn take(&mut self, prefs: String) -> Option<String> {
+        if self.written.as_deref() == Some(prefs.as_str()) {
+            return None;
+        }
+        self.written = Some(prefs.clone());
+        Some(prefs)
+    }
+
+    /// The settings the tab holds after loading another tab's: the tab doesn't write them back.
+    fn loaded(&mut self, prefs: String) {
+        self.written = Some(prefs);
+    }
+}
+
+/// The settings another tab wrote, from a `storage` event (the browser sends one to every other
+/// tab of the page when one tab writes). Other keys, and settings taken away (clearing the site's
+/// data), leave this tab's settings as they are.
+#[cfg(any(target_arch = "wasm32", test))]
+fn settings_written(key: Option<&str>, value: Option<String>) -> Option<String> {
+    value.filter(|_| key == Some(solidcraft_ui_egui::prefs::STORAGE_KEY))
+}
+
 #[cfg(target_arch = "wasm32")]
 mod web {
    use std::rc::Rc;
@@ -76,6 +207,23 @@ mod web {
    thread_local! {
        /// An open design has unsaved changes: leaving the page asks first.
        static UNSAVED: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+        /// A design is shown (not the start page): Ctrl+W closes it, not the browser tab.
+        static DESIGN_SHOWN: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+    }
+
+    /// Ctrl+W (⌘W) closes the design shown, as on the desktop; on the start page it is left to
+    /// the browser, which closes the tab (#5366). Browsers that keep Ctrl+W to themselves still
+    /// close the tab, after asking when a design is unsaved ([`ask_before_unload`]).
+    fn keep_ctrl_w_for_the_design(window: &web_sys::Window) {
+        let on_key = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::KeyboardEvent)>::new(|e: web_sys::KeyboardEvent| {
+            let command = e.ctrl_key() || e.meta_key();
+            if crate::closes_design(&e.key(), command, e.shift_key(), e.alt_key(), DESIGN_SHOWN.with(std::cell::Cell::get)) {
+                e.prevent_default();
+            }
+        });
+        let _ = window.add_event_listener_with_callback_and_bool("keydown", on_key.as_ref().unchecked_ref(), true);
+        // The listener lives as long as the page.
+        on_key.forget();
    }

    /// The browser's "leave site? changes you made may not be saved" prompt while a design has
@@ -106,12 +254,35 @@ mod web {
        on_key.forget();
    }

-    const JAPANESE_FONT_PATH: &str = "./fonts/BIZUDPGothic-Regular.ttf";
+    /// Settings another tab wrote, waiting for this tab's next frame (#8644).
+    type PrefsInbox = Rc<std::cell::Cell<Option<String>>>;

-    type FontLoadResult = Rc<std::cell::RefCell<Option<Result<Vec<u8>, String>>>>;
+    /// Settings another tab of the app writes go to `inbox`, and this tab draws a frame, which
+    /// loads them.
+    fn hear_settings_from_other_tabs(window: &web_sys::Window, ctx: &egui::Context, inbox: PrefsInbox) {
+        let ctx = ctx.clone();
+        let on_storage = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::StorageEvent)>::new(move |e: web_sys::StorageEvent| {
+            if let Some(prefs) = crate::settings_written(e.key().as_deref(), e.new_value()) {
+                inbox.set(Some(prefs));
+                ctx.request_repaint();
+            }
+        });
+        let _ = window.add_event_listener_with_callback("storage", on_storage.as_ref().unchecked_ref());
+        // The listener lives as long as the page.
+        on_storage.forget();
+    }
+
+    const JAPANESE_FONT_PATH: &str = "./fonts/BIZUDPGothic-Regular.ttf";
+    const CHINESE_SC_FONT_PATH: &str = "./fonts/CraftUI-SC.otf";
+    const CHINESE_TC_FONT_PATH: &str = "./fonts/CraftUI-TC.otf";
+
+    type FontLoadResult = Rc<std::cell::RefCell<Option<Result<(String, Vec<u8>), String>>>>;

    struct Shell {
        app: SolveApp,
+        launch: crate::Launch,
+        linked: crate::linked::Download,
+        full_url: Option<String>,
        api: Api,
        files: Rc<Files>,
        /// When the last autosave was (seconds), and the revision it holds (none stored: `None`).
@@ -123,20 +294,68 @@ mod web {
        rename_focus: bool,
        /// The start page's recent designs were filled from the stored ones.
        recents_synced: bool,
-        /// On-demand CJK font: fetched only when a CJK language is selected.
+        /// On-demand script fonts: fetched only when a CJK language is selected.
        font: solidcraft_ui_egui::fonts::CjkFontLoader,
        font_result: FontLoadResult,
-        /// The fetched CJK font's bytes: kept so a language change can re-order the fallbacks.
+        /// The fetched Japanese font's bytes: kept so a language change can re-order the fallbacks.
        cjk_bytes: Option<Vec<u8>>,
+        /// The fetched Chinese font's bytes (Simplified or Traditional for this session).
+        chinese_bytes: Option<Vec<u8>>,
+        /// Which Chinese face `chinese_bytes` is: `"zh"` or `"zh-TW"`.
+        chinese_kind: Option<&'static str>,
+        /// Kind requested by the in-flight fetch (`"ja"`, `"zh"`, or `"zh-TW"`).
+        font_fetch_kind: Option<&'static str>,
        /// The language the fonts were last set up for (a CJK UI leads with the CJK face).
        font_language: String,
        space_mouse: SpaceMouse,
        wheel_gestures: solidcraft_ui_egui::WebWheelGestures,
+        /// The settings this tab wrote or loaded last, and those another tab wrote since (#8644).
+        prefs_writer: crate::PrefsWriter,
+        other_tab_prefs: PrefsInbox,
    }

    impl Shell {
+        /// The settings as they are kept between visits: with the user's own language, not a
+        /// session-only English fallback.
+        fn persisted_prefs(&mut self) -> String {
+            let saved = self.font.persisted_language(&self.app.preferences.language).to_owned();
+            let live = std::mem::replace(&mut self.app.preferences.language, saved);
+            let prefs = self.app.prefs();
+            self.app.preferences.language = live;
+            prefs
+        }
+
+        /// A settings change goes to the browser's storage in the frame it is made, and from
+        /// there to the other open tabs (#8644). Input is what changes settings, so a frame
+        /// without any is skipped; eframe's own save still catches anything else.
+        fn store_prefs(&mut self, ctx: &egui::Context) {
+            if !self.launch.persists() || ctx.input(|i| i.events.is_empty()) {
+                return;
+            }
+            let prefs = self.persisted_prefs();
+            let Some(prefs) = self.prefs_writer.take(prefs) else { return };
+            let stored =
+                web_sys::window().and_then(|w| w.local_storage().ok().flatten()).map(|s| s.set_item(solidcraft_ui_egui::prefs::STORAGE_KEY, &prefs));
+            if !matches!(stored, Some(Ok(()))) {
+                log::warn!("settings: the browser's storage did not take them; they are saved again later");
+                self.prefs_writer = crate::PrefsWriter::default();
+            }
+        }
+
+        /// Settings another tab wrote replace this tab's, so this tab's own saves keep them
+        /// instead of putting its older copy back (#8644).
+        fn load_other_tabs_prefs(&mut self) {
+            let Some(prefs) = self.other_tab_prefs.take() else { return };
+            self.app.load_prefs(&prefs);
+            let held = self.persisted_prefs();
+            self.prefs_writer.loaded(held);
+        }
+
        /// Files from the computer, writes to store, messages and the autosave.
        fn files_tick(&mut self, ctx: &egui::Context) {
+            if !self.launch.persists() {
+                return;
+            }
            if self.files.ctx.borrow().is_none() {
                *self.files.ctx.borrow_mut() = Some(ctx.clone());
            }
@@ -178,6 +397,10 @@ mod web {
                !companion
            });
            for (name, bytes, intent) in incoming {
+                if intent == Intent::Theme {
+                    solidcraft_ui_egui::prefs::import_theme_bytes(&mut self.app, bytes);
+                    continue;
+                }
                let design = solidcraft_engine::io::is_design_path(&name);
                let path = if design && intent == Intent::Open {
                    // A design from the computer is kept in the browser (a copy), so Save works.
@@ -194,7 +417,7 @@ mod web {
                };
                match intent {
                    Intent::Open => self.app.open_path(&path),
-                    Intent::Insert => self.app.drop_path(&path),
+                    Intent::Insert | Intent::Theme => self.app.drop_path(&path),
                }
                self.files.panel.set(false);
            }
@@ -230,13 +453,15 @@ mod web {
        fn sync_recents(&mut self) {
            let mut entries = self.files.entries.borrow().clone();
            entries.sort_by(|a, b| b.modified.total_cmp(&a.modified));
+            let forgotten = self.app.home.forgotten.clone();
            let recent = &mut self.app.home.recent;
            let known = self.files.disk_known.borrow().clone();
            // A design on the computer's disk stays listed while its file is remembered.
            recent.retain(|p| vfs::exists(p) || disk::parse(p).is_some_and(|(id, _)| known.contains(id)));
            for e in entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)) {
                let p = format!("{}{}", files::OPFS, e.name);
-                if !recent.contains(&p) {
+                // A design the user removed from the list is not added back while it is stored.
+                if !recent.contains(&p) && !forgotten.contains(&p) {
                    recent.push(p);
                }
            }
@@ -245,6 +470,10 @@ mod web {
            let recovered = self.files.recovery.borrow().as_ref().and_then(|(_, p)| p.clone());
            let keep = recent.iter().chain(recovered.as_ref()).filter_map(|p| disk::parse(p)).map(|(id, _)| id.to_string()).collect();
            disk::prune(keep);
+            // Drop forgotten entries whose stored design is gone, so the set does not grow without bound.
+            let stored: std::collections::BTreeSet<String> =
+                entries.iter().filter(|e| solidcraft_engine::io::is_design_path(&e.name)).map(|e| format!("{}{}", files::OPFS, e.name)).collect();
+            self.app.home.forgotten.retain(|p| stored.contains(p));
        }

        /// The stored designs: open, insert, rename, delete, download; open from the computer.
@@ -254,14 +483,15 @@ mod web {
            }
            let mut act: Option<(&'static str, String)> = None;
            let closed = solidcraft_ui_egui::ui_kit::Window::new(egui::Id::new("sc_browser_files"), "folder", "Files in this browser")
-                .cards(3.0)
+                // Room for long names; the kit still caps the window at the browser's width.
+                .cards(4.0)
                .show_body(ctx, |ui| {
                    ui.horizontal(|ui| {
                        if ui_kit::button(ui, "Open from computer…", ui_kit::Button::Normal).clicked() {
                            files::pick_from_disk(&self.files, Intent::Open);
                        }
                        if ui_kit::button(ui, "Insert from computer…", ui_kit::Button::Normal)
-                            .on_hover_text("STEP, 3MF or STL into the open design")
+                            .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_drawings_hint"))
                            .clicked()
                        {
                            files::pick_from_disk(&self.files, Intent::Insert);
@@ -282,61 +512,62 @@ mod web {
                        return;
                    }
                    let entries = self.files.entries.borrow().clone();
-                    if entries.is_empty() {
-                        ui.label("Designs you save appear here. They stay in this browser.");
-                    }
                    egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
-                        egui::Grid::new("opfs_files").num_columns(3).spacing([12.0, 6.0]).show(ui, |ui| {
+                        // The name takes the width the size and the actions leave (#8097).
+                        let empty = "Designs you save appear here. They stay in this browser.";
+                        ui_kit::name_list(ui, "opfs_files", &["Name", "Size", "Actions"], empty, |list| {
                            for e in &entries {
-                                match &mut self.renaming {
-                                    Some((from, to)) if *from == e.name => {
-                                        let r = ui_kit::cell_editor(ui, ui.make_persistent_id(("stored_file_name", from.as_str())), to, "", false);
-                                        if std::mem::take(&mut self.rename_focus) {
-                                            r.request_focus();
-                                        }
-                                        if r.lost_focus() {
-                                            act = Some(if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-                                                ("rename", to.clone())
-                                            } else {
-                                                ("rename_cancel", String::new())
-                                            });
+                                list.row(&e.name, |row| {
+                                    match &mut self.renaming {
+                                        Some((from, to)) if *from == e.name => row.cell(|ui| {
+                                            let r =
+                                                ui_kit::cell_editor(ui, ui.make_persistent_id(("stored_file_name", from.as_str())), to, "", false);
+                                            if std::mem::take(&mut self.rename_focus) {
+                                                r.request_focus();
+                                            }
+                                            if r.lost_focus() {
+                                                act = Some(if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                                                    ("rename", to.clone())
+                                                } else {
+                                                    ("rename_cancel", String::new())
+                                                });
+                                            }
+                                        }),
+                                        _ => {
+                                            row.name(&e.name);
                                        }
                                    }
-                                    _ => {
-                                        ui.label(&e.name);
-                                    }
-                                }
-                                ui.label(format!("{:.1} KB", e.size as f64 / 1024.0));
-                                ui.horizontal(|ui| {
-                                    if ui_kit::button(ui, "Open", ui_kit::Button::Small).clicked() {
-                                        act = Some(("open", e.name.clone()));
-                                    }
-                                    let design = solidcraft_engine::io::is_design_path(&e.name);
-                                    if !design
-                                        && ui_kit::button(ui, "Insert", ui_kit::Button::Small)
-                                            .on_hover_text("Into the open design (STEP, 3MF, STL)")
+                                    row.cell(|ui| ui.label(format!("{:.1} KB", e.size as f64 / 1024.0)));
+                                    row.cell(|ui| {
+                                        if ui_kit::button(ui, "Open", ui_kit::Button::Small).clicked() {
+                                            act = Some(("open", e.name.clone()));
+                                        }
+                                        let design = solidcraft_engine::io::is_design_path(&e.name);
+                                        if !design
+                                            && ui_kit::button(ui, "Insert", ui_kit::Button::Small)
+                                                .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_stored_drawings_hint"))
+                                                .clicked()
+                                        {
+                                            act = Some(("insert", e.name.clone()));
+                                        }
+                                        if ui_kit::button(ui, "Rename", ui_kit::Button::Small).clicked() {
+                                            self.renaming = Some((e.name.clone(), e.name.clone()));
+                                            self.rename_focus = true;
+                                        }
+                                        if ui_kit::button(ui, "Save to computer…", ui_kit::Button::Small)
+                                            .on_hover_text("A copy in a file you choose; the stored design stays here")
                                            .clicked()
-                                    {
-                                        act = Some(("insert", e.name.clone()));
-                                    }
-                                    if ui_kit::button(ui, "Rename", ui_kit::Button::Small).clicked() {
-                                        self.renaming = Some((e.name.clone(), e.name.clone()));
-                                        self.rename_focus = true;
-                                    }
-                                    if ui_kit::button(ui, "Save to computer…", ui_kit::Button::Small)
-                                        .on_hover_text("A copy in a file you choose; the stored design stays here")
-                                        .clicked()
-                                    {
-                                        act = Some(("save_copy", e.name.clone()));
-                                    }
-                                    if ui_kit::button(ui, "Download", ui_kit::Button::Small).clicked() {
-                                        act = Some(("download", e.name.clone()));
-                                    }
-                                    if ui_kit::button(ui, "Delete", ui_kit::Button::Small).clicked() {
-                                        act = Some(("delete", e.name.clone()));
-                                    }
+                                        {
+                                            act = Some(("save_copy", e.name.clone()));
+                                        }
+                                        if ui_kit::button(ui, "Download", ui_kit::Button::Small).clicked() {
+                                            act = Some(("download", e.name.clone()));
+                                        }
+                                        if ui_kit::button(ui, "Delete", ui_kit::Button::Small).clicked() {
+                                            act = Some(("delete", e.name.clone()));
+                                        }
+                                    });
                                });
-                                ui.end_row();
                            }
                        });
                    });
@@ -383,6 +614,8 @@ mod web {
                "delete" => {
                    files::delete(&self.files, &name);
                    self.app.home.recent.retain(|r| *r != path);
+                    // The file is gone, so there is nothing left to keep forgotten.
+                    self.app.home.forgotten.remove(&path);
                }
                "rename_cancel" => self.renaming = None,
                "rename" => {
@@ -396,6 +629,10 @@ mod web {
                                        *r = new.clone();
                                    }
                                }
+                                // A forgotten design follows its new name.
+                                if self.app.home.forgotten.remove(&old) {
+                                    self.app.home.forgotten.insert(new);
+                                }
                            }
                            Err(e) => self.app.set_status(e, true),
                        }
@@ -423,44 +660,82 @@ mod web {
                    });
                });
            let Some(recover) = answer else { return };
-            *self.files.recovery.borrow_mut() = None;
            if recover {
-                self.app.open_path(&files::recovery_path());
+                let recovery = match files::prepare_recovery(path.as_deref()) {
+                    Ok(recovery) => recovery,
+                    Err(error) => {
+                        self.app.set_status(error, true);
+                        return;
+                    }
+                };
+                self.app.open_path(&recovery);
+                if self.app.session.path.as_deref() != Some(recovery.as_str()) {
+                    return;
+                }
                // It belongs to its own file again (saving goes there); it is unsaved.
                self.app.session.path = path;
                self.app.session.doc_mut().name = name;
                self.app.session.mark_unsaved();
                self.app.home.open = false;
            }
+            *self.files.recovery.borrow_mut() = None;
            files::autosave(&self.files, None);
        }

-        /// Fetch and install the CJK font when a CJK language is selected. If that fails, this
+        /// Whether the shell already has the on-demand face the live language needs.
+        fn script_font_ready(&self) -> bool {
+            match solidcraft_ui_egui::fonts::web_script_font_kind(&self.app.preferences.language) {
+                Some("zh") => self.chinese_bytes.is_some() && self.chinese_kind == Some("zh"),
+                Some("zh-TW") => self.chinese_bytes.is_some() && self.chinese_kind == Some("zh-TW"),
+                Some("ja") => self.cjk_bytes.is_some(),
+                _ => true,
+            }
+        }
+
+        /// Fetch and install a script font when a CJK language is selected. If that fails, this
        /// session falls back to English (no tofu); the saved language preference is kept.
        fn tick_font(&mut self, ctx: &egui::Context) {
            let done = self.font_result.borrow_mut().take();
            if let Some(res) = done {
+                let kind = self.font_fetch_kind.take();
                let installed = match res {
-                    Ok(bytes) => {
-                        self.cjk_bytes = Some(bytes);
+                    Ok((path, bytes)) => {
+                        match kind {
+                            Some("zh") => {
+                                self.chinese_bytes = Some(bytes);
+                                self.chinese_kind = Some("zh");
+                            }
+                            Some("zh-TW") => {
+                                self.chinese_bytes = Some(bytes);
+                                self.chinese_kind = Some("zh-TW");
+                            }
+                            _ => {
+                                self.cjk_bytes = Some(bytes);
+                            }
+                        }
+                        log::info!("loaded web script font from {path}");
                        true
                    }
                    Err(err) => {
-                        log::warn!("failed to fetch CJK font from {JAPANESE_FONT_PATH}: {err}");
+                        let path = match kind {
+                            Some("zh") => CHINESE_SC_FONT_PATH,
+                            Some("zh-TW") => CHINESE_TC_FONT_PATH,
+                            _ => JAPANESE_FONT_PATH,
+                        };
+                        log::warn!("failed to fetch script font from {path}: {err}");
                        false
                    }
                };
-                if installed {
-                    log::info!("loaded web CJK font from {JAPANESE_FONT_PATH}");
-                } else if solidcraft_ui_egui::fonts::needs_cjk_font(&self.app.preferences.language) {
-                    log::warn!("CJK font unavailable; showing English for this session");
+                if !installed && solidcraft_ui_egui::fonts::needs_cjk_font(&self.app.preferences.language) {
+                    log::warn!("script font unavailable; showing English for this session");
                }
                self.font.finished(installed, &mut self.app.preferences.language);
                self.apply_fonts(ctx);
                ctx.request_repaint();
            }
-            if self.font.tick(&mut self.app.preferences.language) {
-                self.fetch_font(ctx);
+            let ready = self.script_font_ready();
+            if self.font.tick(&mut self.app.preferences.language, ready) {
+                self.fetch_font(ctx, solidcraft_ui_egui::fonts::web_script_font_kind(&self.app.preferences.language).unwrap_or("ja"));
            }
            // The CJK face leads only a CJK UI: its Cyrillic glyphs are full-width, so switching
            // to Ukrainian (or English) must put the Latin face back in front.
@@ -469,31 +744,42 @@ mod web {
            }
        }

-        /// Set up the UI fonts for the live language, keeping the fetched CJK font as a fallback
-        /// (it leads only for a CJK UI, see [`solidcraft_ui_egui::fonts::install_cjk_font_for`]).
+        /// Set up the UI fonts for the live language, keeping fetched script fonts as fallbacks
+        /// (Chinese leads a Chinese UI; see [`solidcraft_ui_egui::fonts::install_web_script_fonts`]).
        fn apply_fonts(&mut self, ctx: &egui::Context) {
-            match self.cjk_bytes.clone() {
-                Some(bytes) => {
-                    solidcraft_ui_egui::fonts::install_cjk_font_for(ctx, bytes, &self.app.preferences.language);
-                }
-                None => solidcraft_ui_egui::fonts::setup_fonts(ctx),
+            if self.cjk_bytes.is_none() && self.chinese_bytes.is_none() {
+                solidcraft_ui_egui::fonts::setup_fonts(ctx);
+            } else {
+                solidcraft_ui_egui::fonts::install_web_script_fonts(
+                    ctx,
+                    self.cjk_bytes.clone(),
+                    self.chinese_bytes.clone(),
+                    &self.app.preferences.language,
+                );
            }
            self.font_language.clone_from(&self.app.preferences.language);
        }

-        /// CJK text on screen with no CJK font yet (an English UI showing a Japanese name):
-        /// fetch the font, so the text does not stay tofu (#720).
+        /// CJK text on screen with no Japanese font yet (an English UI showing a Japanese name):
+        /// fetch the Japanese font, so the text does not stay tofu (#720).
        fn watch_text_for_font(&mut self, ctx: &egui::Context) {
            if self.font.watching_text() && solidcraft_ui_egui::fonts::painted_cjk(ctx) && self.font.text_needs_font() {
-                self.fetch_font(ctx);
+                self.fetch_font(ctx, "ja");
            }
        }

-        fn fetch_font(&self, ctx: &egui::Context) {
+        fn fetch_font(&mut self, ctx: &egui::Context, kind: &'static str) {
+            let path = match kind {
+                "zh" => CHINESE_SC_FONT_PATH,
+                "zh-TW" => CHINESE_TC_FONT_PATH,
+                _ => JAPANESE_FONT_PATH,
+            };
+            self.font_fetch_kind = Some(kind);
            let slot = self.font_result.clone();
            let ctx = ctx.clone();
+            let path = path.to_owned();
            wasm_bindgen_futures::spawn_local(async move {
-                let res = fetch_font_bytes(JAPANESE_FONT_PATH).await;
+                let res = fetch_font_bytes(&path).await.map(|bytes| (path, bytes));
                *slot.borrow_mut() = Some(res);
                ctx.request_repaint();
            });
@@ -502,36 +788,61 @@ mod web {

    impl eframe::App for Shell {
        fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+            // First: a language another tab chose fetches its font this frame.
+            self.load_other_tabs_prefs();
            self.tick_font(ctx);
            self.app.logic(ctx);
            self.api.poll();
            self.space_mouse.logic(&mut self.app, ctx);
            self.files_tick(ctx);
            UNSAVED.with(|u| u.set(solidcraft_ui_egui::documents::any_dirty(&self.app)));
+            DESIGN_SHOWN.with(|d| d.set(solidcraft_ui_egui::toolbar::design_shown(&self.app)));
        }
        fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
            let now = raw.time.unwrap_or_else(|| ctx.input(|i| i.time));
            if let Some(delay) = self.wheel_gestures.update(raw, now) {
                ctx.request_repaint_after(delay);
            }
-            files::take_drops(&self.files, raw);
+            if self.launch.persists() {
+                let theme = solidcraft_ui_egui::prefs::theme_drop_target(&self.app, ctx);
+                files::take_drops(&self.files, raw, theme);
+            } else {
+                raw.dropped_files.clear();
+            }
            // Before the app's own hook, which adds the control channel's events.
            self.space_mouse.raw_input_hook(ctx, self.app.preferences.space_mouse_enabled, raw);
            self.app.raw_input_hook(raw);
        }
        fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+            self.linked.tick(&mut self.app, ui.ctx());
+            UNSAVED.with(|u| u.set(self.launch.persists() && solidcraft_ui_egui::documents::any_dirty(&self.app)));
+            if self.launch.embed {
+                ui_kit::Container::new(ui.ctx(), ui_kit::Surface::Chrome).edge("embed_header", ui_kit::Edge::Top).show(ui, |ui| {
+                    if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("web.open_full"), ui_kit::Button::Normal).clicked()
+                        && let (Some(window), Some(url)) = (web_sys::window(), &self.full_url)
+                    {
+                        let _ = window.open_with_url_and_target_and_features(url, "_blank", "noopener");
+                    }
+                });
+            }
            self.app.ui(ui);
            let ctx = ui.ctx().clone();
-            self.file_panel(&ctx);
-            self.recovery_prompt(&ctx);
+            if self.launch.persists() {
+                self.file_panel(&ctx);
+                self.recovery_prompt(&ctx);
+            }
            self.watch_text_for_font(&ctx);
+            self.store_prefs(&ctx);
+        }
+        fn persist_egui_memory(&self) -> bool {
+            self.launch.persists()
        }
        fn save(&mut self, storage: &mut dyn eframe::Storage) {
-            // Persist the user's own language, not a session-only English fallback.
-            let saved = self.font.persisted_language(&self.app.preferences.language).to_owned();
-            let live = std::mem::replace(&mut self.app.preferences.language, saved);
-            storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, self.app.prefs());
-            self.app.preferences.language = live;
+            if !self.launch.persists() {
+                return;
+            }
+            let prefs = self.persisted_prefs();
+            storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, prefs);
        }
    }

@@ -545,15 +856,15 @@ mod web {

    /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
    fn webgl() -> bool {
-        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let storage = crate::Launch::parse(&query()).persists().then(|| web_sys::window().and_then(|w| w.local_storage().ok().flatten())).flatten();
        let q = query();
-        if q.contains("webgl") {
+        if crate::query_flag(&q, "webgl") {
            if let Some(s) = &storage {
                let _ = s.set_item(WEBGL_KEY, "1");
            }
            return true;
        }
-        if q.contains("webgpu") {
+        if crate::query_flag(&q, "webgpu") {
            if let Some(s) = &storage {
                let _ = s.remove_item(WEBGL_KEY);
            }
@@ -579,8 +890,12 @@ mod web {
        eframe::WebLogger::init(log::LevelFilter::Info).ok();
        wasm_bindgen_futures::spawn_local(async {
            let Some(window) = web_sys::window() else { return };
-            ask_before_unload(&window);
+            let launch = crate::Launch::parse(&query());
+            if launch.persists() {
+                ask_before_unload(&window);
+            }
            leave_tab_switching_to_browser(&window);
+            keep_ctrl_w_for_the_design(&window);
            let Some(document) = window.document() else { return };
            let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
                log::error!("missing <canvas id=\"{CANVAS_ID}\">");
@@ -599,19 +914,24 @@ mod web {
                    Box::new(move |cc| {
                        solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
                        let files = Rc::new(Files::default());
-                        files::start(&files);
+                        if launch.persists() {
+                            files::start(&files);
+                        }
                        let (panel, opener, saver, shown) = (files.clone(), files.clone(), files.clone(), files.clone());
                        let (restorable, restorer) = (files.clone(), files.clone());
-                        let services = Services {
+                        let services = if launch.embed { Services::default() } else { Services {
                            // Open shows the browser's open dialog for a design where it has one
-                            // (the file keeps its handle, so Save writes back to it); otherwise,
-                            // and for inserting STEP or meshes, the browser's files window.
-                            pick_open: Some(Box::new(move |exts: &[&str]| {
-                                if disk::handles_open(exts) {
-                                    return Box::pin(disk::pick_open(&opener));
+                            // (the file keeps its handle, so Save writes back to it), else the
+                            // browser's files window. A command that reads another kind of file
+                            // (Insert DXF or SVG, an image, a mesh, settings) gets a file dialog
+                            // offering that kind, and runs on the picked file.
+                            pick_open: Some(Box::new(move |exts: &[&str]| match disk::open_route(disk::supported(), exts) {
+                                disk::OpenRoute::Disk => Box::pin(disk::pick_open(&opener)),
+                                disk::OpenRoute::Upload => Box::pin(files::pick_upload(&opener, exts)),
+                                disk::OpenRoute::Panel => {
+                                    panel.panel.set(true);
+                                    Box::pin(std::future::ready(None))
                                }
-                                panel.panel.set(true);
-                                Box::pin(std::future::ready(None))
                            })),
                            // A design is saved to a file the user picks, or kept in the browser
                            // where the browser can't pick one; everything else is downloaded.
@@ -633,29 +953,37 @@ mod web {
                            })),
                            restore_file: Some(Box::new(move |path: &str| disk::restore(&restorer, path))),
                            download_design: Some(Box::new(files::download)),
+                            easyprint_upload: Some(std::sync::Arc::new(crate::easyprint::upload)),
                            browser_files: Some(Box::new(move || shown.panel.set(true))),
                            install_app: Some(crate::install::service(&cc.egui_ctx)),
                            ..Default::default()
-                        };
+                        }};
                        // Thumbnails of saves and start-page cards.
                        solidcraft_ui_egui::gpu::install_cpu_picture_renderer();
                        let (sender, receiver) = std::sync::mpsc::channel();
                        let mut app = SolveApp::new(Session::default(), services).with_control(receiver);
-                        if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+                        app.embedded = launch.embed;
+                        // Listening before reading: settings another tab writes from now on are
+                        // newer than those read here.
+                        let other_tab_prefs = PrefsInbox::default();
+                        if launch.persists() {
+                            hear_settings_from_other_tabs(&window, &cc.egui_ctx, other_tab_prefs.clone());
+                        }
+                        if launch.persists() && let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
                            app.load_prefs(&p);
                        }
                        if let Some(rs) = &cc.wgpu_render_state {
                            // eframe's web painter has no stencil buffer.
                            app.set_wgpu(rs, DEPTH_BITS, 0, 1);
                        }
-                        if query().contains("sample") {
+                        if launch.open.is_none() && crate::query_flag(&query(), "sample") {
                            if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                                app.set_status(format!("sample: {e}"), true);
                            }
                            app.session.doc_mut().name = "Sample Plate".into();
                            app.session.mark_saved();
                        }
-                        if !query().contains("sample") {
+                        if launch.open.is_none() && !crate::query_flag(&query(), "sample") {
                            // The empty design takes Units of new designs (#1205). The sample
                            // part is built in millimetres and is left that way.
                            solidcraft_ui_egui::prefs::apply_new_design(&mut app);
@@ -664,8 +992,13 @@ mod web {
                        }
                        let api = Api::install(sender, cc.egui_ctx.clone()).map_err(|e| format!("SolidCraft browser API: {e:?}"))?;
                        let font_language = app.preferences.language.clone();
+                        let linked = crate::linked::Download::start(launch.open.as_deref(), &cc.egui_ctx);
+                        let full_url = window.location().href().ok().and_then(|value| url::Url::parse(&value).ok()).map(|url| launch.full_app_url(url));
                        Ok(Box::new(Shell {
                            app,
+                            launch,
+                            linked,
+                            full_url,
                            api,
                            files,
                            autosaved_at: f64::NEG_INFINITY,
@@ -676,9 +1009,14 @@ mod web {
                            font: Default::default(),
                            font_result: Rc::new(std::cell::RefCell::new(None)),
                            cjk_bytes: None,
+                            chinese_bytes: None,
+                            chinese_kind: None,
+                            font_fetch_kind: None,
                            font_language,
                            space_mouse: SpaceMouse::default(),
                            wheel_gestures: solidcraft_ui_egui::WebWheelGestures::default(),
+                            prefs_writer: crate::PrefsWriter::default(),
+                            other_tab_prefs,
                        }))
                    }),
                )
@@ -709,6 +1047,90 @@ fn main() {
 mod tests {
    use super::*;

+    #[test]
+    fn link_query_decodes_once_and_embed_disables_persistence() {
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "webgl"));
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "sample"));
+        assert!(query_flag("?embed&webgl", "webgl"));
+        let launch = Launch::parse("?embed&open=https%3A%2F%2Fexample.org%2Farm.solidcraft%3Fx%3Da%2520b%26y%3D1");
+        assert_eq!(launch.open.as_deref(), Some("https://example.org/arm.solidcraft?x=a%20b&y=1"));
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        assert!(!Launch::parse("?embed").embed);
+        assert!(!Launch::parse("?other=embed&reopen=https://example.org").embed);
+        assert!(Launch::parse("?open=https://example.org/a").persists());
+        assert_eq!(Launch::parse("?open=first&open=second").open.as_deref(), Some("first"));
+        let launch = Launch::parse("?embed&open=/dutchman/jobs/abc/part.solidcraft%3Fx%3Da%2520b");
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        let page = url::Url::parse("http://solidcraft.io/?embed#view").expect("synthetic page");
+        let full = url::Url::parse(&launch.full_app_url(page)).expect("full app URL");
+        let reopened = Launch::parse(full.query().unwrap_or_default());
+        assert_eq!(reopened.open, launch.open);
+        assert_eq!(reopened.open.as_deref(), Some("/dutchman/jobs/abc/part.solidcraft?x=a%20b"));
+        assert!(!reopened.embed);
+        assert!(reopened.persists());
+        assert!(full.fragment().is_none());
+    }
+
+    #[test]
+    fn design_links_refuse_hostile_schemes_credentials_and_sizes() {
+        assert!(design_url("https://example.org/arm.solidcraft?download=1", "http://solidcraft.io").is_ok());
+        for value in [
+            "http://example.org/a",
+            "data:application/json,{}",
+            "blob:https://example.org/a",
+            "javascript:alert(1)",
+            "https://user:secret@example.org/a",
+            "//evil.example/x",
+            "/../x",
+            "/%2e%2e/x",
+            "/a/%2E./x",
+            "/a%2f..%2fx",
+            "/a\\x",
+            "/a%5cx",
+            "/a\nx",
+            "/a%00x",
+            "/a%7fx",
+            "/a%C2%85x",
+            "/a%3f/../x",
+            "/a/..#view",
+            "/a/..?download=1",
+            "https://solidcraft.io/a/../x",
+            "http://user:secret@solidcraft.io/x",
+            "http://solidcraft.io.evil.example/x",
+            "http://solidcraft.io:8080/x",
+            "relative.solidcraft",
+            "",
+        ] {
+            assert!(design_url(value, "http://solidcraft.io").is_err(), "{value}");
+        }
+        assert!(design_url(&format!("https://example.org/{}", "x".repeat(16_384)), "http://solidcraft.io").is_err());
+        assert!(design_url("http://redirect.example.org/a", "http://solidcraft.io").is_err());
+
+        let cap = solidcraft_engine::io::MAX_DESIGN_BYTES;
+        assert!(check_download_size(0, cap as u64).is_ok());
+        assert!(check_download_size(0, cap as u64 + 1).is_err());
+        assert!(check_download_size(cap - 2, 2).is_ok());
+        assert!(check_download_size(cap - 2, 3).is_err());
+        assert!(check_download_size(0, u64::MAX).is_err());
+        assert!(check_download_size(cap, 1).is_err());
+        assert!(check_download_size(usize::MAX, 0).is_err());
+    }
+
+    #[test]
+    fn design_links_allow_same_origin_paths_and_redirects() {
+        for origin in ["http://solidcraft.io", "https://solidcraft.io", "http://solidcraft.io:8080"] {
+            assert_eq!(design_url("/a/b.solidcraft", origin).map(|url| url.to_string()), Ok(format!("{origin}/a/b.solidcraft")));
+            assert!(design_url(&format!("{origin}/x"), origin).is_ok());
+            // Final response URLs follow the same origin and scheme rules as the request.
+            assert!(design_url("https://docs.solidcraft.io/x", origin).is_ok());
+            assert!(design_url("http://other/x", origin).is_err());
+        }
+        assert!(design_url("http://solidcraft.io/x", "https://solidcraft.io").is_err());
+        assert!(design_url("http://SOLIDCRAFT.io:80/x", "http://solidcraft.io").is_ok());
+    }
+
    #[test]
    fn only_ctrl_tab_is_left_to_the_browser() {
        // Ctrl+Tab and Ctrl+Shift+Tab (the event's key is "Tab" either way) switch browser tabs.
@@ -717,4 +1139,42 @@ mod tests {
        assert!(!browser_switches_tabs("Tab", false));
        assert!(!browser_switches_tabs("s", true));
    }
+
+    #[test]
+    fn ctrl_w_closes_the_design_not_the_tab() {
+        // Ctrl+W and ⌘W (either case of the key) close the design shown.
+        assert!(closes_design("w", true, false, false, true));
+        assert!(closes_design("W", true, false, false, true));
+        // On the start page the browser closes the tab.
+        assert!(!closes_design("w", true, false, false, false));
+        // Ctrl+Shift+W (close the window), plain W and other keys stay the browser's or the app's.
+        assert!(!closes_design("W", true, true, false, true));
+        assert!(!closes_design("w", true, false, true, true));
+        assert!(!closes_design("w", false, false, false, true));
+        assert!(!closes_design("s", true, false, false, true));
+    }
+
+    /// A tab writes its settings when they change, and not again while they stay the same; the
+    /// settings it loaded from another tab aren't written back (#8644).
+    #[test]
+    fn changed_settings_are_written_once_and_loaded_ones_not_at_all() {
+        let mut writer = PrefsWriter::default();
+        assert_eq!(writer.take(r#"{"a":1}"#.into()).as_deref(), Some(r#"{"a":1}"#), "the first settings are written");
+        assert_eq!(writer.take(r#"{"a":1}"#.into()), None, "the same settings are not written again");
+        assert_eq!(writer.take(r#"{"a":2}"#.into()).as_deref(), Some(r#"{"a":2}"#), "a change is written at once");
+        writer.loaded(r#"{"a":3}"#.into());
+        assert_eq!(writer.take(r#"{"a":3}"#.into()), None, "settings from another tab are not written back");
+        assert_eq!(writer.take(r#"{"a":4}"#.into()).as_deref(), Some(r#"{"a":4}"#), "this tab's next change is written");
+    }
+
+    /// Only the settings another tab wrote are loaded: not other keys, and not settings taken
+    /// away by clearing the site's data (#8644).
+    #[test]
+    fn only_settings_another_tab_wrote_are_loaded() {
+        let key = solidcraft_ui_egui::prefs::STORAGE_KEY;
+        assert_eq!(settings_written(Some(key), Some("{}".into())).as_deref(), Some("{}"));
+        assert_eq!(settings_written(Some("solidcraft.webgl"), Some("1".into())), None);
+        assert_eq!(settings_written(Some(key), None), None, "removed settings leave this tab's");
+        assert_eq!(settings_written(None, None), None, "clearing all storage leaves this tab's settings");
+    }
 }
@@ -13,8 +13,9 @@ bundled-render-library = ["solidcraft-engine/bundled-render-library"]
 raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]

 # The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
-# (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
-# (Windows resize border) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+# (macOS file-open events), src/native_crash.rs (Windows exception filter), src/native_crash_macos.rs
+# (macOS crash signal handler) and src/native_frame.rs (Windows resize border, taskbar icon) can
+# allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
 [lints.rust]
 unsafe_code = "deny"

@@ -27,10 +28,13 @@ neg_cmp_op_on_partial_ord = "allow"

 [dependencies]
 solidcraft-engine = { workspace = true }
+# The D3D12 shader compiler the window starts with (#6756).
+solidcraft-gpu = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
 solidcraft-space-mouse = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links"] }
 egui = { workspace = true }
+serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
@@ -54,7 +58,8 @@ hidapi = { version = "2.6.7", default-features = false, features = ["windows-nat
 # The main window's handle for src/native_frame.rs (already in the tree through eframe and winit).
 raw-window-handle = "0.6"
 # Native crash capture (src/native_crash.rs): the exception filter, the faulting module, a minidump.
-# The window's resize border and DPI size (src/native_frame.rs): the window procedure, hit test, DPI.
+# The window's resize border, DPI size and class icon (src/native_frame.rs): the window procedure, hit
+# test, DPI, the exe's icon.
 # Finding 3D mice through Plug and Play without asking other devices anything (src/space_mouse/windows_hid.rs).
 windows-sys = { version = "0.61", features = [
    "Win32_Devices_DeviceAndDriverInstallation",
@@ -81,14 +86,28 @@ solidcraft-3dx-client = { workspace = true }
 # The 3D mouse (src/space_mouse.rs), in the shared-device open mode so that a running 3DxWare
 # driver does not shut the app out.
 hidapi = { version = "2.6.7", default-features = false, features = ["macos-shared-device"] }
-# Files opened from Finder and the Dock (src/open_documents.rs); all already come with eframe and rfd.
+# Files opened from Finder and the Dock (src/open_documents.rs), and the fullscreen title-bar
+# inset (src/main.rs); all already come with eframe and rfd.
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder", "NSWindow"] }
 objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSProcessInfo", "NSString", "NSURL"] }
 block2 = "0.6"
+# Native crash capture (src/native_crash_macos.rs): the signal handler, the faulting module
+# (already in the tree through many crates).
+libc = "0.2"

 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }
+# Bringing the window forward on X11 when a close asks about unsaved designs (src/come_forward.rs):
+# the window's id, and the window manager request winit doesn't send (MIT OR Apache-2.0; both
+# already in the tree through eframe and winit).
+raw-window-handle = "0.6"
+x11rb = { version = "0.13", default-features = false }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# The desktop's dark or light preference through the XDG Desktop Portal (src/desktop_theme.rs,
+# #7944); already in the tree through eframe's accessibility support (accesskit_unix).
+zbus = { version = "5", default-features = false, features = ["async-io", "blocking-api"] }

 [build-dependencies]
 embed-resource = "3.0.11"
@@ -4,6 +4,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
    let icon = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../assets/icons/app/windows/exports/solidcraft-executable.ico");
    println!("cargo:rerun-if-changed={}", icon.display());
    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-env-changed=CARGO_PKG_VERSION");
    if std::env::var("CARGO_CFG_TARGET_OS")? != "windows" {
        return Ok(());
    }
@@ -11,7 +12,21 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
    let copy = out.join("solidcraft.ico");
    std::fs::copy(icon, &copy)?;
    let rc = out.join("solidcraft.rc");
-    std::fs::write(&rc, format!("1 ICON \"{}\"\n", copy.display().to_string().replace('\\', "/")))?;
+    let icon_line = format!("1 ICON \"{}\"\n", copy.display().to_string().replace('\\', "/"));
+    std::fs::write(&rc, format!("{icon_line}{}", version_resource(&std::env::var("CARGO_PKG_VERSION")?)))?;
    embed_resource::compile_for(&rc, ["solidcraft"], embed_resource::NONE).manifest_required()?;
    Ok(())
 }
+
+/// The Windows version resource (what Explorer's Details tab shows and what a launcher reads).
+/// `FileVersion` and `ProductVersion` are the package version verbatim (`0.25.1`, `0.26.0-rc.1`):
+/// ArtCraft's launcher parses the `ProductVersion` string as semver, so a fourth `.0` would not
+/// read. The binary `FILEVERSION` fields need four numbers and take the leading `major.minor.patch`.
+fn version_resource(version: &str) -> String {
+    let mut numbers = version.split(['-', '+']).next().unwrap_or("").split('.').map(|p| p.parse::<u16>().unwrap_or(0));
+    let mut next = || numbers.next().unwrap_or(0);
+    let (major, minor, patch) = (next(), next(), next());
+    format!(
+        "1 VERSIONINFO\nFILEVERSION {major},{minor},{patch},0\nPRODUCTVERSION {major},{minor},{patch},0\nFILEOS 0x40004\nFILETYPE 0x1\n{{\nBLOCK \"StringFileInfo\"\n{{\nBLOCK \"040904B0\"\n{{\nVALUE \"CompanyName\", \"SolidCraft contributors\"\nVALUE \"FileDescription\", \"SolidCraft, parametric 3D CAD\"\nVALUE \"FileVersion\", \"{version}\"\nVALUE \"InternalName\", \"solidcraft\"\nVALUE \"OriginalFilename\", \"solidcraft.exe\"\nVALUE \"ProductName\", \"SolidCraft\"\nVALUE \"ProductVersion\", \"{version}\"\n}}\n}}\nBLOCK \"VarFileInfo\"\n{{\nVALUE \"Translation\", 0x0409, 1200\n}}\n}}\n"
+    )
+}
@@ -0,0 +1,234 @@
+//! Bringing the window forward when a close stops at "save changes?".
+//!
+//! A close from the taskbar or a window switcher reaches the window while another app has the
+//! focus. The prompt it opens is only seen once the window comes forward, so the window asks for
+//! the focus then. A window the user is already in is left alone.
+//!
+//! winit's Focus asks as an application, which a window manager with focus-stealing prevention
+//! (KWin's default) refuses for a window used before the switch away: it only marks the taskbar
+//! entry. On X11 the request is sent again with the source EWMH gives "direct user actions"
+//! (`_NET_ACTIVE_WINDOW`, source 2), which is what this is: the prompt is the rest of the user's
+//! close. Native Wayland has no way for a window to raise itself, so there the attention request
+//! (xdg-activation) lets the compositor raise it or mark its taskbar entry.
+//!
+//! When: not at once. KWin raises the window, then the taskbar's closing context menu hands the
+//! focus back to the app that had it, a few milliseconds later, and the window would flicker
+//! forward and back. So the window asks once the menu is gone, `FIRST_AFTER` the close. It asks
+//! again only if the focus is taken back right after it came (a slow menu) or never came; a later
+//! switch is the user's own, and the window stays where the user put it.
+
+use std::time::{Duration, Instant};
+
+/// From the close to the first request: past the taskbar menu's focus hand-back (2 to 11 ms on
+/// KDE Plasma 6), too short to notice.
+const FIRST_AFTER: Duration = Duration::from_millis(120);
+/// After the first request, how long the window asks again when it loses the focus: short of
+/// anything the user does next.
+const KEEP_ASKING: Duration = Duration::from_millis(400);
+/// The least time between two requests.
+const AGAIN_AFTER: Duration = Duration::from_millis(100);
+/// Focus lost this soon after a request was taken back by the taskbar menu; later, by the user.
+const TAKEN_BACK_WITHIN: Duration = Duration::from_millis(50);
+
+/// The window coming forward after a close that asks about unsaved designs.
+#[derive(Default)]
+pub struct ComeForward {
+    /// The first request and the end of asking; `None`: not asking.
+    window: Option<(Instant, Instant)>,
+    /// The last request.
+    last: Option<Instant>,
+    /// The window has had the focus since the last request.
+    held: bool,
+}
+
+/// What a frame does while the window is coming forward.
+#[derive(Debug, PartialEq)]
+enum Step {
+    /// Ask for the focus now.
+    Ask,
+    /// Look again after this long.
+    Wait(Duration),
+    /// Done asking.
+    Done,
+}
+
+impl ComeForward {
+    /// A close stopped at the prompt: ask for the focus shortly.
+    pub fn start(&mut self, now: Instant) {
+        let first = now + FIRST_AFTER;
+        self.window = Some((first, first + KEEP_ASKING));
+        self.last = None;
+        self.held = false;
+    }
+
+    /// Every frame: ask once the taskbar menu is gone, and again while the focus is taken back.
+    pub fn tick(&mut self, ctx: &egui::Context, frame: &eframe::Frame) {
+        if self.window.is_none() {
+            return;
+        }
+        let (focused, minimized) = ctx.input(|i| (i.viewport().focused, i.viewport().minimized));
+        // The app may be idle: a frame to look again.
+        match self.step(Instant::now(), focused) {
+            Step::Ask => {
+                bring(ctx, frame, minimized);
+                ctx.request_repaint_after(AGAIN_AFTER);
+            }
+            Step::Wait(after) => ctx.request_repaint_after(after),
+            Step::Done => {}
+        }
+    }
+
+    fn step(&mut self, now: Instant, focused: Option<bool>) -> Step {
+        let Some((first, until)) = self.window else { return Step::Done };
+        if now >= until {
+            self.window = None;
+            return Step::Done;
+        }
+        if now < first {
+            return Step::Wait(first - now);
+        }
+        let Some(last) = self.last else {
+            if focused == Some(true) {
+                // The user went back to the window already.
+                self.window = None;
+                return Step::Done;
+            }
+            self.last = Some(now);
+            return Step::Ask;
+        };
+        if focused == Some(true) {
+            self.held = true;
+            return Step::Wait(until - now);
+        }
+        if self.held {
+            if now.duration_since(last) >= TAKEN_BACK_WITHIN {
+                // The user switched away: leave the window there.
+                self.window = None;
+                return Step::Done;
+            }
+            self.held = false;
+        }
+        let next = last + AGAIN_AFTER;
+        if now < next {
+            return Step::Wait(next - now);
+        }
+        self.last = Some(now);
+        Step::Ask
+    }
+}
+
+/// Ask for the focus once.
+fn bring(ctx: &egui::Context, frame: &eframe::Frame, minimized: Option<bool>) {
+    #[cfg(all(unix, not(target_os = "macos")))]
+    let raised = match x11_activate(frame) {
+        Ok(sent) => sent,
+        Err(e) => {
+            log::warn!("bringing the window forward through X11: {e}");
+            false
+        }
+    };
+    #[cfg(not(all(unix, not(target_os = "macos"))))]
+    let raised = {
+        let _ = frame;
+        false
+    };
+    for c in commands(minimized, raised) {
+        ctx.send_viewport_cmd(c);
+    }
+}
+
+/// The viewport commands for a window in the background; `raised`: the X11 request went out,
+/// which also restores a minimized window.
+fn commands(minimized: Option<bool>, raised: bool) -> Vec<egui::ViewportCommand> {
+    if raised {
+        return vec![egui::ViewportCommand::Focus];
+    }
+    let mut commands = Vec::new();
+    if minimized == Some(true) {
+        commands.push(egui::ViewportCommand::Minimized(false));
+    }
+    commands.push(egui::ViewportCommand::Focus);
+    commands.push(egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Informational));
+    commands
+}
+
+/// Ask the X11 window manager to activate the window as a user action. `Ok(false)`: the window
+/// isn't an X11 window (native Wayland).
+#[cfg(all(unix, not(target_os = "macos")))]
+fn x11_activate(frame: &eframe::Frame) -> Result<bool, String> {
+    use raw_window_handle::{HasWindowHandle, RawWindowHandle};
+    use x11rb::connection::Connection;
+    use x11rb::protocol::xproto::{ClientMessageEvent, ConnectionExt, EventMask};
+
+    let handle = frame.window_handle().map_err(|e| e.to_string())?;
+    let window = match handle.as_raw() {
+        RawWindowHandle::Xlib(h) => u32::try_from(h.window).map_err(|e| e.to_string())?,
+        RawWindowHandle::Xcb(h) => h.window.get(),
+        _ => return Ok(false),
+    };
+    // A connection of its own: winit's isn't reachable, and a close that asks is rare.
+    let (conn, screen) = x11rb::connect(None).map_err(|e| e.to_string())?;
+    let root = conn.setup().roots.get(screen).ok_or("no X11 screen")?.root;
+    let atom = conn.intern_atom(false, b"_NET_ACTIVE_WINDOW").map_err(|e| e.to_string())?.reply().map_err(|e| e.to_string())?.atom;
+    // Source 2: a direct user action; the time is the server's current time.
+    let event = ClientMessageEvent::new(32, window, atom, [2, x11rb::CURRENT_TIME, 0, 0, 0]);
+    conn.send_event(false, root, EventMask::SUBSTRUCTURE_REDIRECT | EventMask::SUBSTRUCTURE_NOTIFY, event).map_err(|e| e.to_string())?;
+    conn.flush().map_err(|e| e.to_string())?;
+    Ok(true)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{AGAIN_AFTER, ComeForward, FIRST_AFTER, KEEP_ASKING, Step};
+    use eframe::egui::{UserAttentionType, ViewportCommand as C};
+    use std::time::{Duration, Instant};
+
+    /// The first request waits until the taskbar menu has handed the focus back. The window asks
+    /// again when the focus is taken back right after it came, or never came, no more often than
+    /// every `AGAIN_AFTER` and only for `KEEP_ASKING`; a later switch away is the user's.
+    #[test]
+    fn the_window_asks_once_the_taskbar_menu_is_gone() {
+        let t0 = Instant::now();
+        let ms = |n: u64| Duration::from_millis(n);
+        let at = |n: u64| t0 + ms(n);
+        let (first, again, keep) = (FIRST_AFTER.as_millis() as u64, AGAIN_AFTER.as_millis() as u64, KEEP_ASKING.as_millis() as u64);
+        let mut f = ComeForward::default();
+        assert_eq!(f.step(t0, Some(false)), Step::Done, "not started");
+        f.start(t0);
+        assert_eq!(f.step(t0, Some(false)), Step::Wait(FIRST_AFTER), "the menu is still closing");
+        assert_eq!(f.step(at(5), Some(false)), Step::Wait(ms(first - 5)));
+        assert_eq!(f.step(at(first), Some(false)), Step::Ask);
+        assert_eq!(f.step(at(first + 3), Some(true)), Step::Wait(ms(keep - 3)), "raised");
+        // A slow menu takes the focus back 10 ms later: ask again, not before AGAIN_AFTER.
+        assert_eq!(f.step(at(first + 10), Some(false)), Step::Wait(ms(again - 10)));
+        assert_eq!(f.step(at(first + again), Some(false)), Step::Ask);
+        assert_eq!(f.step(at(first + again + 3), Some(true)), Step::Wait(ms(keep - again - 3)));
+        // The user clicks another app 200 ms later: the window stays behind.
+        assert_eq!(f.step(at(first + again + 200), Some(false)), Step::Done);
+        assert_eq!(f.step(at(first + again + 300), Some(false)), Step::Done);
+
+        // Never raised (the request was refused): ask again every AGAIN_AFTER, for KEEP_ASKING.
+        f.start(t0);
+        assert_eq!(f.step(at(first), None), Step::Ask, "unknown focus counts as out of focus");
+        assert_eq!(f.step(at(first + again), Some(false)), Step::Ask);
+        assert_eq!(f.step(at(first + keep), Some(false)), Step::Done);
+
+        // Back in the window before the first request: nothing to do.
+        f.start(t0);
+        assert_eq!(f.step(at(first), Some(true)), Step::Done);
+    }
+
+    /// Without the X11 request: focus, and the attention mark where focus is refused; a minimized
+    /// window is restored first.
+    #[test]
+    fn a_window_closed_from_the_background_comes_forward() {
+        let forward = [C::Focus, C::RequestUserAttention(UserAttentionType::Informational)];
+        assert_eq!(super::commands(Some(false), false), forward);
+        assert_eq!(super::commands(None, false), forward, "unknown counts as not minimized");
+        let minimized = super::commands(Some(true), false);
+        assert_eq!(minimized.first(), Some(&C::Minimized(false)));
+        assert_eq!(minimized.get(1..), Some(&forward[..]));
+        // The window manager took the X11 request: nothing left to mark.
+        assert_eq!(super::commands(Some(true), true), [C::Focus]);
+    }
+}
@@ -13,16 +13,20 @@ use solidcraft_engine::MAX_LINE;
 use solidcraft_engine::control_auth;
 use solidcraft_engine::control_pending;
 use solidcraft_ui_egui::ControlRequest;
+use solidcraft_ui_egui::control::{DESIGN_WATCH, DesignWatch, Subscriber};

 /// Connections served at once, so a flood must not be able to spawn threads without end.
 const MAX_CONNECTIONS: usize = 16;
 /// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
 const MAX_BAD_LINES: usize = 8;
+/// How long a subscribed connection waits after a `design.changed` line before the next: what
+/// changes meanwhile (a parameter dragged) goes out as one line, the latest (#6985).
+const EVENT_GAP: Duration = Duration::from_millis(100);

 static OPEN: AtomicUsize = AtomicUsize::new(0);
-/// The token files this launch wrote (its control port, the agent chat's endpoint), removed
-/// when the app ends.
-static TOKEN_FILES: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());
+/// The token files this launch wrote (its control port, the agent chat's endpoint) and the
+/// token in each, removed when the app ends unless another launch has written the file since.
+static TOKEN_FILES: std::sync::Mutex<Vec<(std::path::PathBuf, String)>> = std::sync::Mutex::new(Vec::new());

 /// A new random token: 32 bytes from the operating system, as hex.
 fn new_token() -> Option<String> {
@@ -31,20 +35,21 @@ fn new_token() -> Option<String> {
    Some(bytes.iter().map(|b| format!("{b:02x}")).collect())
 }

-/// Remove this launch's token file (at exit).
+/// Remove this launch's token files and discovery file (at exit), leaving any that another
+/// launch has written since (#8794).
 pub fn remove_token_file() {
    if let Ok(files) = TOKEN_FILES.lock() {
-        for p in files.iter() {
-            control_auth::remove_token_file(p);
+        for (path, token) in files.iter() {
+            control_auth::remove_token_file(path, token);
        }
    }
-    if let Some(port) = APP_PORT.lock().ok().and_then(|p| *p) {
-        control_auth::remove_current_port(port);
+    if let Some((port, token)) = APP_PORT.lock().ok().and_then(|p| p.clone()) {
+        control_auth::remove_current_port(port, &token);
    }
 }

-/// The port the app's own channel listens on, for removing the discovery file at exit.
-static APP_PORT: std::sync::Mutex<Option<u16>> = std::sync::Mutex::new(None);
+/// The port the app's own channel listens on and its token, for removing the discovery file at exit.
+static APP_PORT: std::sync::Mutex<Option<(u16, String)>> = std::sync::Mutex::new(None);

 pub fn start(listen_on: control_auth::Listen, ctx: egui::Context) -> Receiver<ControlRequest> {
    let (tx, rx) = channel::<ControlRequest>();
@@ -57,7 +62,7 @@ pub fn start(listen_on: control_auth::Listen, ctx: egui::Context) -> Receiver<Co
            };
            match listener {
                Ok(l) => {
-                    if let Some(port) = listen_on_listener(l, token, tx, ctx, false) {
+                    if let Some(port) = listen_on_listener(l, token.clone(), tx, ctx, false) {
                        if matches!(listen_on, control_auth::Listen::Default) {
                            eprintln!("solidcraft: control channel on the default port 127.0.0.1:{port} (Preferences > Assistant turns it off)");
                        }
@@ -65,7 +70,7 @@ pub fn start(listen_on: control_auth::Listen, ctx: egui::Context) -> Receiver<Co
                        match control_auth::write_current_port(port) {
                            Ok(_) => {
                                if let Ok(mut p) = APP_PORT.lock() {
-                                    *p = Some(port);
+                                    *p = Some((port, token));
                                }
                            }
                            Err(e) => eprintln!("solidcraft: could not write the control discovery file ({e})"),
@@ -108,7 +113,7 @@ fn listen_on_listener(listener: TcpListener, token: String, tx: Sender<ControlRe
            Ok(()) => {
                eprintln!("solidcraft: control server listening on 127.0.0.1:{port} (token in {})", path.display());
                if let Ok(mut files) = TOKEN_FILES.lock() {
-                    files.push(path);
+                    files.push((path, token.clone()));
                }
            }
            Err(e) => eprintln!(
@@ -127,7 +132,7 @@ fn listen_on_listener(listener: TcpListener, token: String, tx: Sender<ControlRe
            if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
                OPEN.fetch_sub(1, Ordering::Relaxed);
                let mut refused = stream;
-                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                let _ = send(&mut refused, &json!({"ok": false, "error": "too many connections"}));
                continue;
            }
            let tx = tx.clone();
@@ -174,6 +179,44 @@ fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>
    }
 }

+/// A reply line, written to the socket at once. `writeln!` with a JSON value hands the socket each
+/// of its pieces apart, a system call for every string, number and comma: half a second for a
+/// design's component tree when it has thousands of components.
+fn send(out: &mut impl Write, reply: &Value) -> std::io::Result<()> {
+    let mut line = serde_json::to_vec(reply).map_err(std::io::Error::other)?;
+    line.push(b'\n');
+    out.write_all(&line)
+}
+
+/// The `"token"` of a request line that is a JSON object, read without building the rest of it.
+/// Until a connection shows the token, a line costs only its own bytes: parsed whole, a 16 MiB
+/// line of `[0,0,…]` is hundreds of MB, and 16 such connections could exhaust memory before any
+/// token was checked.
+fn token_of(line: &str) -> Option<String> {
+    struct Token;
+    impl<'de> serde::de::Visitor<'de> for Token {
+        type Value = Option<String>;
+        fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+            f.write_str("a request object")
+        }
+        fn visit_map<A: serde::de::MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+            let mut token = None;
+            while let Some(key) = map.next_key::<String>()? {
+                if key == "token" {
+                    token = Some(map.next_value::<String>()?);
+                } else {
+                    map.next_value::<serde::de::IgnoredAny>()?;
+                }
+            }
+            Ok(token)
+        }
+    }
+    let mut de = serde_json::Deserializer::from_str(line);
+    let token = serde::Deserializer::deserialize_map(&mut de, Token).ok()?;
+    de.end().ok()?;
+    token
+}
+
 /// The reply to a connection that didn't show the token; the connection is then closed.
 fn unauthorized() -> Value {
    json!({"ok": false, "error": "unauthorized: send the control token as \"token\" (see docs/control-protocol.md)"})
@@ -184,7 +227,7 @@ fn unauthorized() -> Value {
 /// the connection, and a reset can reach the client before it has read the refusal.
 fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
    use std::io::Read;
-    let _ = writeln!(out, "{}", unauthorized());
+    let _ = send(out, &unauthorized());
    let _ = out.shutdown(std::net::Shutdown::Write);
    let _ = reader.get_ref().set_read_timeout(Some(Duration::from_millis(500)));
    let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
@@ -356,10 +399,137 @@ fn busy_message(p: &Pending, method: &str) -> String {
    )
 }

-fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
-    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING);
+/// A subscribed connection's socket, for its replies and its events: each line is written whole
+/// and alone, so an event never lands inside a reply (#6985).
+struct Lines {
+    socket: TcpStream,
+    turn: Mutex<()>,
 }

+impl Lines {
+    fn send(&self, line: &Value) -> std::io::Result<()> {
+        let _turn = self.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        send(&mut &self.socket, line)
+    }
+}
+
+/// A subscribed connection's seat on the watch: it leaves exactly once, whichever thread sees
+/// the connection's end first — the connection's own thread at the end of the stream, or the
+/// events thread at the first write a closed client refuses. The seat used to wait for the
+/// events thread alone, and that thread only leaves its wait when the design moves, so the
+/// count could outlive the connection by a second or more (#8315).
+struct Seat(Mutex<Option<Subscriber>>);
+
+impl Seat {
+    fn new(counted: Subscriber) -> Self {
+        Seat(Mutex::new(Some(counted)))
+    }
+
+    /// Leave the watch now: the seat goes once, whoever gets here first.
+    fn release(&self) {
+        let counted = self.0.lock().unwrap_or_else(PoisonError::into_inner).take();
+        drop(counted);
+    }
+}
+
+impl Drop for Seat {
+    fn drop(&mut self) {
+        self.release();
+    }
+}
+
+/// A connection's `control.subscribe` (#6985): its `design.changed` lines, sent from a thread of
+/// their own until the connection ends.
+struct Subscription {
+    lines: Arc<Lines>,
+    stop: Arc<AtomicBool>,
+    seat: Arc<Seat>,
+}
+
+impl Subscription {
+    /// Write `reply`, the window's answer to `control.subscribe` naming the design `seen`, on
+    /// `out`, then send `design`'s changes after it: the reply goes out before any event. `None`,
+    /// with nothing written, when no thread or socket was left for the events.
+    fn start(
+        design: &'static DesignWatch,
+        counted: Subscriber,
+        out: &TcpStream,
+        seen: (String, u64),
+        reply: &Value,
+    ) -> Option<(Self, std::io::Result<()>)> {
+        let lines = Arc::new(Lines { socket: out.try_clone().ok()?, turn: Mutex::new(()) });
+        let stop = Arc::new(AtomicBool::new(false));
+        let seat = Arc::new(Seat::new(counted));
+        let first = lines.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        let (l, s, watch_seat) = (lines.clone(), stop.clone(), Arc::clone(&seat));
+        // The connection's seat on the watch rides the events thread: it leaves when the thread
+        // does, so the next failed write to a closed client retires it even while the connection's
+        // own thread is slow to see the end of the stream (#7226). The connection's own thread
+        // leaves it too, so a closed connection stops counting at once (#8315).
+        std::thread::Builder::new().stack_size(64 * 1024).spawn(move || send_events(design, &l, &s, seen, watch_seat)).ok()?;
+        let sent = send(&mut &lines.socket, reply);
+        drop(first);
+        Some((Subscription { lines, stop, seat }, sent))
+    }
+}
+
+/// The design a `control.subscribe` reply names.
+fn design_of(reply: &Value) -> Option<(String, u64)> {
+    let result = reply.get("result")?;
+    Some((result.get("document_id")?.as_str()?.to_string(), result.get("revision")?.as_u64()?))
+}
+
+impl Drop for Subscription {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+        // The seat on the watch goes now: the connection is over, and nothing counts it any more
+        // (#8315).
+        self.seat.release();
+        // The socket closes now, not when the thread next looks; a line blocked on a client that
+        // stopped reading ends too.
+        let _ = self.lines.socket.shutdown(std::net::Shutdown::Both);
+    }
+}
+
+/// The `design.changed` lines of a subscribed connection, each time the design differs from the
+/// last one it was told of (`seen`), until `stop`. Holds the connection's seat on the watch
+/// (`seat`), which it leaves when the thread ends: on `stop`, or on the first write a closed
+/// client refuses (#7226).
+fn send_events(design: &DesignWatch, lines: &Lines, stop: &AtomicBool, mut seen: (String, u64), seat: Arc<Seat>) {
+    while !stop.load(Ordering::Relaxed) {
+        let Some(now) = design.wait(&seen, stop, Duration::from_secs(1)).filter(|now| *now != seen) else { continue };
+        if lines.send(&json!({"event": "design.changed", "params": {"document_id": now.0, "revision": now.1}})).is_err() {
+            break;
+        }
+        seen = now;
+        std::thread::sleep(EVENT_GAP);
+    }
+    // The client is gone: it is not counted on the watch any more, whatever the connection's own
+    // thread still has to notice (#8315).
+    seat.release();
+}
+
+/// What this app's control channel does beyond the methods every version has, for a client to
+/// find out before it relies on it (an older app answers `control.capabilities` with "unknown
+/// method"). `param_check`: the levels `engine.execute`, `engine.batch` and `engine.script` take
+/// as a request's own parameter check (#9184).
+fn capabilities() -> Value {
+    json!({"param_check": solidcraft_engine::schema::ParamCheck::ALL.map(|l| l.name())})
+}
+
+/// Write `reply` on the connection: through its subscription once it has one.
+fn answer(out: &mut TcpStream, events: Option<&Subscription>, reply: &Value) -> std::io::Result<()> {
+    match events {
+        Some(e) => e.lines.send(reply),
+        None => send(out, reply),
+    }
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
+    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING, &DESIGN_WATCH);
+}
+
+#[allow(clippy::too_many_arguments)]
 fn serve_with(
    stream: TcpStream,
    token: &str,
@@ -368,6 +538,7 @@ fn serve_with(
    patient: bool,
    waits: Waits,
    running: &'static Running,
+    design: &'static DesignWatch,
 ) {
    let connection = running.connections.fetch_add(1, Ordering::Relaxed) + 1;
    let Ok(read) = stream.try_clone() else { return };
@@ -376,42 +547,50 @@ fn serve_with(
    let mut bad = 0usize;
    let mut authenticated = false;
    let mut pending: Option<Pending> = None;
+    let mut events: Option<Subscription> = None;
    loop {
+        // A first `control.subscribe` on its way to the window (#6985).
+        let mut joining = None;
        let line = match read_line(&mut reader, MAX_LINE) {
            Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
            Ok(None) => break,
            Err(e) => {
-                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                let _ = answer(&mut out, events.as_ref(), &json!({"ok": false, "error": e.to_string()}));
                break;
            }
        };
        if line.trim().is_empty() {
            continue;
        }
+        // The first request must carry the token; later ones on the same connection may.
+        if !authenticated {
+            match token_of(&line) {
+                Some(t) if control_auth::tokens_match(&t, token) => authenticated = true,
+                _ => {
+                    refuse(&mut out, &mut reader);
+                    break;
+                }
+            }
+        }
        let reply = match serde_json::from_str::<Value>(&line) {
            Ok(msg) => {
-                // The first request must carry the token; later ones on the same connection may.
-                if !authenticated {
-                    match msg.get("token").and_then(Value::as_str) {
-                        Some(t) if control_auth::tokens_match(t, token) => authenticated = true,
-                        _ => {
-                            refuse(&mut out, &mut reader);
-                            break;
-                        }
-                    }
-                }
                let id = msg.get("id").cloned().unwrap_or(Value::Null);
                let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                let params = msg.get("params").cloned().unwrap_or(json!({}));
-                // A request that timed out may have finished since (#1618). `control.running` only
-                // looks, so it leaves that reply where it is.
-                let late = pending.as_ref().filter(|_| method != "control.running").and_then(|p| match p.reply.try_recv() {
+                // A request that timed out may have finished since (#1618). `control.running` and
+                // `control.capabilities` only look, so they leave that reply where it is.
+                let late = pending.as_ref().filter(|_| !matches!(method.as_str(), "control.running" | "control.capabilities")).and_then(|p| match p
+                    .reply
+                    .try_recv()
+                {
                    Ok(reply) => Some(reply),
                    Err(TryRecvError::Disconnected) => Some(json!({"ok": false, "error": "the app ended the request without a reply"})),
                    Err(TryRecvError::Empty) => None,
                });
                let mut r = if method == "control.running" {
                    json!({"ok": true, "result": running.result(connection)})
+                } else if method == "control.capabilities" {
+                    json!({"ok": true, "result": capabilities()})
                } else if method == "control.pending" {
                    match (pending.take(), late) {
                        (None, _) => json!({"ok": true, "result": {"pending": null}}),
@@ -425,6 +604,14 @@ fn serve_with(
                } else if let Some(p) = pending.as_ref().filter(|_| late.is_none()) {
                    // Nothing more is queued behind it, to run unseen when it ends.
                    json!({"ok": false, "busy": true, "error": busy_message(p, &method)})
+                } else if method == "control.subscribe" && events.is_some() {
+                    if late.is_some() {
+                        // As below: finished, and the client moved on without asking.
+                        pending = None;
+                    }
+                    // Its events already say how the design moves; a second answer could only
+                    // arrive behind a newer one.
+                    json!({"ok": false, "error": "already subscribed: this connection is sent design.changed lines; ask document.revision for the design now"})
                } else {
                    if late.is_some() {
                        // Finished, and the client moved on without asking: it is dropped.
@@ -434,6 +621,9 @@ fn serve_with(
                    let wait = if patient || method == "engine.batch" { waits.long } else { waits.short };
                    let what = control_pending::describe(&method, &params);
                    let effect = control_pending::effect(&method, &params);
+                    // Counted before the window answers, so it publishes every change from its
+                    // answer on.
+                    joining = (method == "control.subscribe").then(|| design.join());
                    let (req, rrx) = ControlRequest::new(method.clone(), params);
                    let ticket = running.add(connection, &id, &req);
                    if tx.send(req).is_err() {
@@ -454,16 +644,25 @@ fn serve_with(
                }
                r
            }
-            Err(_) if !authenticated => {
-                refuse(&mut out, &mut reader);
-                break;
-            }
            Err(e) => {
                bad += 1;
                json!({"ok": false, "error": format!("bad JSON: {e}")})
            }
        };
-        if writeln!(out, "{reply}").is_err() {
+        // Subscribed once the window named the design (not when it refused or timed out).
+        let sent = match joining.and_then(|counted| design_of(&reply).map(|seen| (counted, seen))) {
+            Some((counted, seen)) => match Subscription::start(design, counted, &out, seen, &reply) {
+                Some((subscription, sent)) => {
+                    events = Some(subscription);
+                    sent
+                }
+                None => {
+                    send(&mut out, &json!({"id": reply.get("id"), "ok": false, "error": "not subscribed: no thread or socket left for the events"}))
+                }
+            },
+            None => answer(&mut out, events.as_ref(), &reply),
+        };
+        if sent.is_err() {
            break;
        }
        if bad >= MAX_BAD_LINES {
@@ -503,7 +702,7 @@ mod tests {
        static RUNNING: Running = Running::new();
        std::thread::spawn(move || {
            if let Some(stream) = listener.incoming().flatten().next() {
-                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING);
+                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH);
            }
        });
        let s = TcpStream::connect(addr).unwrap();
@@ -569,7 +768,7 @@ mod tests {
        std::thread::spawn(move || {
            for stream in listener.incoming().flatten() {
                let tx = tx.clone();
-                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING));
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH));
            }
        });
        let open = || {
@@ -598,6 +797,9 @@ mod tests {
        let mut watcher = open();
        let (r, rows) = running(&mut watcher, &|_| true);
        assert!(r["ok"] == true && rows.is_empty(), "idle: {r}");
+        // What the app's control channel does beyond the methods every version has (#9184).
+        let r = watcher(json!({"id": 0, "method": "control.capabilities", "token": token}));
+        assert_eq!((&r["ok"], &r["result"]["param_check"]), (&json!(true), &json!(["off", "warn", "strict"])), "{r}");

        let mut export = open();
        let path = "/private/part.step";
@@ -629,6 +831,9 @@ mod tests {
        let own: Vec<&Value> = r["result"]["running"].as_array().unwrap().iter().filter(|row| row["self"] == true).collect();
        assert_eq!(own.len(), 1, "{r}");
        assert_eq!(own[0]["command"], "file.export", "{r}");
+        // So may it ask what the app can do: answered at once, not refused as busy.
+        let r = export(json!({"id": 8, "method": "control.capabilities"}));
+        assert_eq!(r["result"]["param_check"], json!(["off", "warn", "strict"]), "{r}");

        gate_tx.send(()).unwrap();
        assert_eq!(queued.join().unwrap()["result"], "engine.batch");
@@ -639,6 +844,153 @@ mod tests {
        assert_eq!((&r["result"]["pending"], &r["result"]["done"]), (&json!(7), &json!(true)), "{r}");
    }

+    /// #6985: a connection that sends `control.subscribe` gets the design in the reply, then a
+    /// `design.changed` line each time the window publishes another: never before the reply,
+    /// none for the same design, the latest after a burst, each line whole between its replies.
+    /// A second subscribe is refused without reaching the window. A connection that did not
+    /// subscribe gets no events, and one that closed is no longer counted.
+    #[test]
+    fn subscribed_connections_are_told_of_design_changes() {
+        static RUNNING: Running = Running::new();
+        static WATCH: DesignWatch = DesignWatch::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window: it answers `control.subscribe` as the app does, publishing the design first;
+        // then the design changes at once, before the reply may have been written.
+        std::thread::spawn(move || {
+            for req in rx {
+                if req.method == "control.subscribe" {
+                    WATCH.publish("d-1", 3);
+                    let _ = req.reply.send(json!({"ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+                    WATCH.publish("d-1", 4);
+                } else {
+                    let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+                }
+            }
+        });
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, WAITS, &RUNNING, &WATCH));
+            }
+        });
+        let open = || {
+            let s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            (s.try_clone().unwrap(), BufReader::new(s))
+        };
+        let next = |lines: &mut BufReader<TcpStream>| -> Value {
+            let mut l = String::new();
+            lines.read_line(&mut l).unwrap();
+            serde_json::from_str(&l).unwrap()
+        };
+        let changed = |id: &str, revision: u64| json!({"event": "design.changed", "params": {"document_id": id, "revision": revision}});
+
+        let (mut quiet_out, mut quiet) = open();
+        writeln!(quiet_out, "{}", json!({"id": 1, "method": "ui.view", "token": token})).unwrap();
+        assert_eq!(next(&mut quiet)["id"], 1);
+
+        let (mut out, mut lines) = open();
+        writeln!(out, "{}", json!({"id": 1, "method": "control.subscribe", "token": token})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 1, "ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+        assert_eq!(next(&mut lines), changed("d-1", 4), "the change after the window's answer comes after the reply");
+        assert!(WATCH.subscribed());
+        // The design it was told of is no news; another revision is.
+        WATCH.publish("d-1", 4);
+        WATCH.publish("d-1", 5);
+        assert_eq!(next(&mut lines), changed("d-1", 5));
+        // A burst ends with its latest.
+        for revision in 6..=10 {
+            WATCH.publish("d-1", revision);
+        }
+        let mut last = 5;
+        while last < 10 {
+            let e = next(&mut lines);
+            let revision = e["params"]["revision"].as_u64().unwrap();
+            assert!(e["event"] == "design.changed" && revision > last, "{e} after {last}");
+            last = revision;
+        }
+        // Another tab: another id, whatever its revision.
+        WATCH.publish("d-2", 2);
+        assert_eq!(next(&mut lines), changed("d-2", 2));
+        // Subscribed already: refused here (the window would have published d-1 again).
+        writeln!(out, "{}", json!({"id": 2, "method": "control.subscribe"})).unwrap();
+        let r = next(&mut lines);
+        assert!(r["id"] == 2 && r["ok"] == false && r["error"].as_str().is_some_and(|e| e.starts_with("already subscribed")), "{r}");
+        // Replies still come, whole, and nothing else was sent meanwhile.
+        writeln!(out, "{}", json!({"id": 3, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 3, "ok": true, "result": "ui.view"}));
+        writeln!(quiet_out, "{}", json!({"id": 2, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut quiet), json!({"id": 2, "ok": true, "result": "ui.view"}), "no events without subscribing");
+        // Closed, it is no longer counted. Each publish asks the events thread for one more line,
+        // and its write to the closed connection is what retires the seat; that keeps the wait off
+        // the connection's own thread, which anything else this process is doing may hold up past
+        // the deadline (#7226).
+        drop((out, lines));
+        let mut revision = 11;
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while WATCH.subscribed() && Instant::now() < deadline {
+            WATCH.publish("d-1", revision);
+            revision += 1;
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        assert!(!WATCH.subscribed());
+    }
+
+    /// #8315: a closed connection leaves the watch at once. The seat of a subscribed connection
+    /// goes when the connection's own thread sees the end of the stream, not only when the
+    /// events thread notices: that thread waits for the design to move, so a connection that
+    /// closed while the design stood still kept the watch counting it for a second or more.
+    #[test]
+    fn a_closed_connection_leaves_the_watch_at_once() {
+        static RUNNING: Running = Running::new();
+        static WATCH: DesignWatch = DesignWatch::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window names the design once and then leaves it alone: nothing moves it, so the
+        // events thread has nothing to write and only the end of the connection can retire it.
+        std::thread::spawn(move || {
+            for req in rx {
+                if req.method == "control.subscribe" {
+                    WATCH.publish("d-1", 3);
+                    let _ = req.reply.send(json!({"ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+                } else {
+                    let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+                }
+            }
+        });
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, WAITS, &RUNNING, &WATCH));
+            }
+        });
+        let s = TcpStream::connect(addr).unwrap();
+        s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+        let mut out = s.try_clone().unwrap();
+        let mut lines = BufReader::new(s);
+        writeln!(out, "{}", json!({"id": 1, "method": "control.subscribe", "token": token})).unwrap();
+        let mut l = String::new();
+        lines.read_line(&mut l).unwrap();
+        let reply: Value = serde_json::from_str(&l).unwrap();
+        assert!(reply["ok"] == true, "{reply}");
+        assert!(WATCH.subscribed(), "the connection is subscribed");
+        // Let the events thread settle into its wait: the design stands still, so it has nothing
+        // to write, and only the end of the connection can retire it.
+        std::thread::sleep(Duration::from_millis(200));
+        // The client goes away without asking anything else.
+        drop((out, lines));
+        let deadline = Instant::now() + Duration::from_millis(400);
+        while WATCH.subscribed() && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        assert!(!WATCH.subscribed(), "a closed connection is not counted on the watch");
+    }
+
    /// A timed-out request that only reads is not said to "still apply", nor is one that only
    /// writes a file (an export, #1989); a change is, by name.
    #[test]
@@ -658,6 +1010,19 @@ mod tests {
        assert!(render.contains("will still write the file"), "{render}");
    }

+    /// The token is read from a request object without building the rest of it: other fields,
+    /// however large or nested, are only skipped. Anything but an object with a string token is
+    /// no token.
+    #[test]
+    fn token_is_read_without_parsing_the_request() {
+        assert_eq!(token_of(r#"{"id":1,"token":"abc","params":{"a":[1,[2,{"b":null}]]}}"#).as_deref(), Some("abc"));
+        let flood = format!(r#"{{"params":[{}0],"token":"t"}}"#, "0,".repeat(1 << 20));
+        assert_eq!(token_of(&flood).as_deref(), Some("t"));
+        for no in [r#"["abc"]"#, r#"{"token":5}"#, r#"{"token":"a"} x"#, r#"{"id":1}"#, "GET / HTTP/1.1", r#""token""#] {
+            assert_eq!(token_of(no), None, "{no}");
+        }
+    }
+
    /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
    /// missing token, or garbage, is refused and the connection closed. Once shown, the token
    /// need not be repeated on that connection.
@@ -750,4 +1115,31 @@ mod tests {
        let mut r = BufReader::with_capacity(64, text.as_slice());
        assert!(read_line(&mut r, 1000).is_err());
    }
+
+    /// A large reply reaches the socket in one write, not one per JSON piece (a component tree of
+    /// thousands of components took half a second to send), and reads back as it was.
+    #[test]
+    fn a_large_reply_is_written_at_once() {
+        struct Counted {
+            writes: usize,
+            bytes: Vec<u8>,
+        }
+        impl Write for Counted {
+            fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+                self.writes += 1;
+                self.bytes.extend_from_slice(buf);
+                Ok(buf.len())
+            }
+            fn flush(&mut self) -> std::io::Result<()> {
+                Ok(())
+            }
+        }
+        let components: Vec<Value> = (0..2000).map(|i| json!({"id": i, "name": format!("Part {i}"), "bodies": ["a", "b"], "parent": 0})).collect();
+        let reply = json!({"ok": true, "id": 7, "result": {"components": components}});
+        let mut out = Counted { writes: 0, bytes: Vec::new() };
+        send(&mut out, &reply).unwrap();
+        assert_eq!(out.writes, 1);
+        assert_eq!(out.bytes.last(), Some(&b'\n'));
+        assert_eq!(serde_json::from_slice::<Value>(&out.bytes).unwrap(), reply);
+    }
 }
@@ -0,0 +1,195 @@
+//! Linux: the desktop's dark or light preference, for Theme: System (#7944).
+//!
+//! The window toolkit does not pass it on everywhere: on GNOME (Wayland, or X11 through XWayland)
+//! the window never learns it, nor when it changes, so the app kept its colours. This reads the
+//! freedesktop setting through the XDG Desktop Portal's Settings interface on the session bus
+//! (`org.freedesktop.appearance color-scheme`, then GNOME's `color-scheme` and `gtk-theme`), the
+//! same setting other applications follow, and inside a Flatpak too. It runs on a thread of its
+//! own: the first reading, then the portal's `SettingChanged` signal; where the signal can't be
+//! had, a reading every few seconds. Without a portal it asks `gsettings` instead, on the same
+//! thread. The window reads the last answer with an atomic load
+//! (`solidcraft_ui_egui::Services::desktop_dark`), and the decision from the raw values is
+//! `solidcraft_ui_egui::prefs::desktop_prefers_dark`.
+
+use std::io::Read;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU8, Ordering};
+use std::time::Duration;
+
+use zbus::zvariant::{OwnedValue, Value};
+
+const UNKNOWN: u8 = 0;
+const DARK: u8 = 1;
+const LIGHT: u8 = 2;
+
+/// How often to read again where the portal's change signal is not available.
+const POLL: Duration = Duration::from_secs(5);
+/// How long one `gsettings` reading may take before it is given up.
+const GSETTINGS_TIMEOUT: Duration = Duration::from_secs(2);
+
+const PORTAL: &str = "org.freedesktop.portal.Desktop";
+const PORTAL_PATH: &str = "/org/freedesktop/portal/desktop";
+const SETTINGS: &str = "org.freedesktop.portal.Settings";
+const APPEARANCE: &str = "org.freedesktop.appearance";
+const GNOME: &str = "org.gnome.desktop.interface";
+
+/// Start following the desktop's preference; the closure answers the latest reading (`None`
+/// until there is one, or when the desktop says nothing).
+pub fn start(ctx: &egui::Context) -> Box<dyn Fn() -> Option<bool>> {
+    let state = Arc::new(AtomicU8::new(UNKNOWN));
+    let (thread_state, ctx) = (state.clone(), ctx.clone());
+    if let Err(e) = std::thread::Builder::new().name("desktop-theme".into()).spawn(move || follow(&thread_state, &ctx)) {
+        log::warn!("desktop theme: no thread to follow it: {e}");
+    }
+    Box::new(move || match state.load(Ordering::Relaxed) {
+        DARK => Some(true),
+        LIGHT => Some(false),
+        _ => None,
+    })
+}
+
+/// Keep `state` on the desktop's preference, asking for a frame whenever it changes.
+fn follow(state: &AtomicU8, ctx: &egui::Context) {
+    let publish = |dark: Option<bool>| {
+        let code = match dark {
+            Some(true) => DARK,
+            Some(false) => LIGHT,
+            None => UNKNOWN,
+        };
+        if state.swap(code, Ordering::Relaxed) != code {
+            ctx.request_repaint();
+        }
+    };
+    let portal = match portal() {
+        Ok(p) => Some(p),
+        Err(e) => {
+            log::info!("desktop theme: no settings portal ({e}); asking gsettings");
+            None
+        }
+    };
+    // The portal first; gsettings where there is none or it says nothing (its backend missing).
+    let read = |portal: Option<&zbus::blocking::Proxy<'static>>| portal.and_then(read_portal).or_else(read_gsettings);
+    let from_portal = portal.as_ref().and_then(read_portal);
+    let first = from_portal.or_else(read_gsettings);
+    publish(first);
+    // Wait for the portal's signal only when the portal answers: else the reading is gsettings',
+    // which only a new reading notices.
+    if let Some(p) = portal.as_ref().filter(|_| from_portal.is_some()) {
+        match p.receive_signal("SettingChanged") {
+            Ok(changes) => {
+                for message in changes {
+                    if relevant(&message) {
+                        publish(read(Some(p)));
+                    }
+                }
+                log::info!("desktop theme: the portal's change signal ended; reading every few seconds");
+            }
+            Err(e) => log::info!("desktop theme: no change signal ({e}); reading every few seconds"),
+        }
+    } else if portal.is_none() && first.is_none() && !gsettings_available() {
+        // Neither the portal nor gsettings: nothing to follow; the window toolkit's theme stays.
+        return;
+    }
+    loop {
+        std::thread::sleep(POLL);
+        publish(read(portal.as_ref()));
+    }
+}
+
+/// The portal's Settings interface on the session bus.
+fn portal() -> zbus::Result<zbus::blocking::Proxy<'static>> {
+    let connection = zbus::blocking::Connection::session()?;
+    zbus::blocking::Proxy::new(&connection, PORTAL, PORTAL_PATH, SETTINGS)
+}
+
+/// One reading through the portal.
+fn read_portal(portal: &zbus::blocking::Proxy<'static>) -> Option<bool> {
+    let appearance = read_setting(portal, APPEARANCE, "color-scheme").and_then(|v| as_u32(&v));
+    // The GNOME settings only matter when the freedesktop one has no preference.
+    if matches!(appearance, Some(1 | 2)) {
+        return solidcraft_ui_egui::prefs::desktop_prefers_dark(appearance, None, None);
+    }
+    let gnome = read_setting(portal, GNOME, "color-scheme").and_then(|v| as_string(&v));
+    let gtk_theme = read_setting(portal, GNOME, "gtk-theme").and_then(|v| as_string(&v));
+    solidcraft_ui_egui::prefs::desktop_prefers_dark(appearance, gnome.as_deref(), gtk_theme.as_deref())
+}
+
+/// A setting through `ReadOne` (portal version 2), else the older `Read`.
+fn read_setting(portal: &zbus::blocking::Proxy<'static>, namespace: &str, key: &str) -> Option<OwnedValue> {
+    let one: zbus::Result<OwnedValue> = portal.call("ReadOne", &(namespace, key));
+    one.or_else(|_| -> zbus::Result<OwnedValue> { portal.call("Read", &(namespace, key)) }).ok()
+}
+
+/// Whether a `SettingChanged` signal is about a setting the preference is read from.
+fn relevant(message: &zbus::Message) -> bool {
+    let body = message.body();
+    let Ok((namespace, key, _)) = body.deserialize::<(String, String, OwnedValue)>() else { return false };
+    matches!((namespace.as_str(), key.as_str()), (APPEARANCE, "color-scheme") | (GNOME, "color-scheme" | "gtk-theme"))
+}
+
+/// The value inside the variants `Read` wraps it in (a portal answers one or two deep).
+fn unwrap_variants<'v, 'a>(value: &'v Value<'a>) -> &'v Value<'a> {
+    let mut value = value;
+    for _ in 0..4 {
+        match value {
+            Value::Value(inner) => value = &**inner,
+            _ => break,
+        }
+    }
+    value
+}
+
+fn as_u32(value: &Value<'_>) -> Option<u32> {
+    match unwrap_variants(value) {
+        Value::U32(n) => Some(*n),
+        Value::I32(n) => u32::try_from(*n).ok(),
+        Value::U8(n) => Some(u32::from(*n)),
+        _ => None,
+    }
+}
+
+fn as_string(value: &Value<'_>) -> Option<String> {
+    match unwrap_variants(value) {
+        Value::Str(s) => Some(s.as_str().to_string()),
+        _ => None,
+    }
+}
+
+/// Without a portal: GNOME's settings through `gsettings` (`None` when it is not there).
+fn read_gsettings() -> Option<bool> {
+    let gnome = gsettings("color-scheme");
+    let gtk_theme = gsettings("gtk-theme");
+    solidcraft_ui_egui::prefs::desktop_prefers_dark(None, gnome.as_deref(), gtk_theme.as_deref())
+}
+
+fn gsettings_available() -> bool {
+    gsettings("gtk-theme").is_some()
+}
+
+/// `gsettings get org.gnome.desktop.interface <key>`, its quoted answer, or `None` when the
+/// program is missing, fails or does not answer in time.
+fn gsettings(key: &str) -> Option<String> {
+    let mut child = std::process::Command::new("gsettings")
+        .args(["get", GNOME, key])
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::null())
+        .spawn()
+        .ok()?;
+    let started = std::time::Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) if status.success() => break,
+            Ok(None) if started.elapsed() < GSETTINGS_TIMEOUT => std::thread::sleep(Duration::from_millis(20)),
+            _ => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+        }
+    }
+    let mut out = String::new();
+    child.stdout.take()?.take(4096).read_to_string(&mut out).ok()?;
+    let value = out.trim().trim_matches('\'').to_string();
+    (!value.is_empty()).then_some(value)
+}
@@ -5,12 +5,25 @@
 //! for recovery as a forced quit does, and starts again ([`restart`]), and the new start says what
 //! happened ([`note`]). A device lost again soon after such a restart starts the next one on the
 //! software renderer, which doesn't depend on the graphics driver.
+//!
+//! The old process ends without tearing down its GPU objects ([`end`]): on a lost NVIDIA device
+//! destroying the window's swap chain busy-waits in the driver and never returns (#9044).

 use crate::startup;

 /// Set on the start after a lost device: when the device was lost (seconds since 1970).
 pub const LOST_ENV: &str = "SOLIDCRAFT_DEVICE_LOST";

+/// Set on the start after a lost device: why it was lost, as wgpu said it. The old process's
+/// session journal, which recorded it, is gone by then.
+pub const REASON_ENV: &str = "SOLIDCRAFT_DEVICE_LOST_REASON";
+
+/// The longest reason passed on ([`REASON_ENV`]) and shown, in characters.
+const REASON_CHARS: usize = 300;
+
+/// How long the process may take to end ([`end`]) before it is aborted.
+const END_GRACE: std::time::Duration = std::time::Duration::from_secs(3);
+
 /// A loss this recent (seconds) counts for the start after it: its note, and a second loss
 /// within it starts on the software renderer. Inherited by later starts, an older stamp is
 /// ignored.
@@ -32,27 +45,54 @@ pub fn restart_on_software(after_recent_loss: bool, cpu_renderer: bool) -> bool
    after_recent_loss || cpu_renderer
 }

+/// `reason` on one line, at most [`REASON_CHARS`] long; None when there is nothing to say.
+pub fn reason(reason: Option<&str>) -> Option<String> {
+    let line = reason?.split_whitespace().collect::<Vec<_>>().join(" ");
+    (!line.is_empty()).then(|| line.chars().take(REASON_CHARS).collect())
+}
+
 /// What the start after a lost device tells the user, `software` when it runs on the software
-/// renderer.
-pub fn note(software: bool) -> String {
+/// renderer, with what the driver reported ([`REASON_ENV`]).
+pub fn note(software: bool, reason: Option<&str>) -> String {
    let mut note = String::from(
        "The graphics device was reset (the graphics driver stopped responding), so SolidCraft closed and started again. Unsaved changes were kept for recovery.",
    );
    if software {
        note.push_str(" This start uses software rendering, which doesn't depend on the graphics driver.");
    }
+    if let Some(reason) = self::reason(reason) {
+        note.push_str(&format!(" The graphics driver reported: {reason}"));
+    }
    note
 }

-/// Start SolidCraft again with the same arguments, the loss stamped at `lost_at`, on the software
-/// renderer when `software`.
-pub fn restart(software: bool, lost_at: u64) {
-    let Ok(exe) = std::env::current_exe() else { return };
+/// The command that starts `exe` again with `args`, the loss stamped at `lost_at` and its
+/// `reason`, on the software renderer when `software`.
+fn command(
+    exe: std::path::PathBuf,
+    args: impl IntoIterator<Item = std::ffi::OsString>,
+    software: bool,
+    lost_at: u64,
+    reason: &str,
+) -> std::process::Command {
    let mut command = std::process::Command::new(exe);
-    command.args(std::env::args_os().skip(1)).env(LOST_ENV, lost_at.to_string());
+    command.args(args).env(LOST_ENV, lost_at.to_string());
+    match self::reason(Some(reason)) {
+        Some(reason) => command.env(REASON_ENV, reason),
+        // Not one inherited from an earlier loss.
+        None => command.env_remove(REASON_ENV),
+    };
    if software {
        command.env(startup::RENDERER_ENV, "cpu");
    }
+    command
+}
+
+/// Start SolidCraft again with the same arguments, the loss stamped at `lost_at` and its `reason`,
+/// on the software renderer when `software`.
+pub fn restart(software: bool, lost_at: u64, reason: &str) {
+    let Ok(exe) = std::env::current_exe() else { return };
+    let mut command = command(exe, std::env::args_os().skip(1), software, lost_at, reason);
    #[cfg(windows)]
    {
        use std::os::windows::process::CommandExt;
@@ -64,6 +104,23 @@ pub fn restart(software: bool, lost_at: u64) {
    }
 }

+/// End the process now, without tearing down what is left on the lost device: the window's swap
+/// chain, the viewport's buffers and pipelines. On NVIDIA's Vulkan driver destroying the swap
+/// chain of a lost device busy-waits forever, which left the old window frozen at 100% of a core
+/// beside the new one (#9044). Should the exit itself get stuck in a library's exit handler, the
+/// process is aborted after [`END_GRACE`].
+pub fn end() -> ! {
+    let watchdog = std::thread::Builder::new().name("solidcraft-exit".into()).spawn(|| {
+        std::thread::sleep(END_GRACE);
+        eprintln!("SolidCraft graphics: still closing after the device was lost; aborting");
+        std::process::abort();
+    });
+    if let Err(e) = watchdog {
+        log::warn!("graphics: no exit watchdog: {e}");
+    }
+    std::process::exit(0)
+}
+
 #[cfg(test)]
 mod tests {
    /// Only a recent, well-formed stamp counts: a later start that inherited it says nothing.
@@ -84,8 +141,34 @@ mod tests {
        assert!(!super::restart_on_software(false, false));
        assert!(super::restart_on_software(true, false));
        assert!(super::restart_on_software(false, true));
-        assert!(super::note(true).contains("software rendering"));
-        assert!(!super::note(false).contains("software rendering"));
-        assert!(super::note(false).contains("kept for recovery"));
+        assert!(super::note(true, None).contains("software rendering"));
+        assert!(!super::note(false, None).contains("software rendering"));
+        assert!(super::note(false, None).contains("kept for recovery"));
+    }
+
+    /// The start after a loss is told why (#9044): the old process's journal held the reason, and
+    /// it is deleted as that process closes.
+    #[test]
+    fn the_next_start_is_told_why_the_device_was_lost() {
+        let exe = std::path::PathBuf::from("solidcraft");
+        let args = ["--control".into(), "7979".into()];
+        let command = super::command(exe.clone(), args, true, 1_000, "Lost: Device lost\n  (vkQueueSubmit)");
+        let env = |command: &std::process::Command, name: &str| {
+            command.get_envs().find(|(k, _)| *k == name).map(|(_, v)| v.map(|v| v.to_string_lossy().into_owned()))
+        };
+        assert_eq!(env(&command, super::LOST_ENV), Some(Some("1000".into())));
+        assert_eq!(env(&command, super::REASON_ENV), Some(Some("Lost: Device lost (vkQueueSubmit)".into())), "on one line");
+        assert_eq!(env(&command, crate::startup::RENDERER_ENV), Some(Some("cpu".into())));
+        assert_eq!(command.get_args().collect::<Vec<_>>(), ["--control", "7979"]);
+        // No reason: none inherited from an earlier loss either.
+        let command = super::command(exe, Vec::new(), false, 1_000, "  ");
+        assert_eq!(env(&command, super::REASON_ENV), Some(None));
+        assert_eq!(env(&command, crate::startup::RENDERER_ENV), None);
+
+        let note = super::note(false, Some("Lost: Device lost"));
+        assert!(note.ends_with("The graphics driver reported: Lost: Device lost"), "{note}");
+        assert!(!super::note(false, Some(" \n ")).contains("reported"));
+        let long = "x".repeat(1_000);
+        assert_eq!(super::reason(Some(&long)).map(|r| r.chars().count()), Some(300));
    }
 }
@@ -1,6 +1,6 @@
 //! SolidCraft desktop app.
 //!
-//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]`
+//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.sc | part.step]`
 //!
 //! `--safe-mode` (or `SOLIDCRAFT_SAFE_MODE=1`) starts with default settings, no recovery offer and
 //! the software renderer; see `startup` and docs/book/src/guide/troubleshooting.md.
@@ -20,14 +20,20 @@
 #[cfg(not(target_os = "macos"))]
 #[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
 mod app_icon;
+mod come_forward;
 mod control_server;
+#[cfg(target_os = "linux")]
+mod desktop_theme;
 mod device_lost;
 #[cfg(target_os = "windows")]
 mod native_crash;
+#[cfg(target_os = "macos")]
+mod native_crash_macos;
 #[cfg(target_os = "windows")]
 mod native_frame;
 #[cfg(target_os = "macos")]
 mod native_menu;
+mod nav_bridge;
 #[cfg(target_os = "macos")]
 mod open_documents;
 #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
@@ -81,12 +87,18 @@ struct App {
    frames: u32,
    /// Started over the control channel: the window doesn't ask for the foreground.
    take_focus_unwanted: bool,
+    /// Coming forward after a close that asks about unsaved designs.
+    come_forward: come_forward::ComeForward,
    /// The graphics device: lost, it can't draw again (`App::watch_device`, #4172).
    gpu: Option<LostWatch>,
    #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
    space_mouse: space_mouse::SpaceMouse,
    #[cfg(target_os = "macos")]
    native_menu: Option<native_menu::NativeMenu>,
+    /// A device's own app moving the view (Preferences › Navigation, off by default).
+    nav_bridge: nav_bridge::NavBridge,
+    /// Where the next file dialog opens: it follows the open design (#7756).
+    dialog_folder: DialogFolder,
 }

 impl eframe::App for App {
@@ -111,6 +123,14 @@ impl eframe::App for App {
                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
                }
                solidcraft_engine::crash::phase(solidcraft_engine::crash::RUNNING);
+                // A DMG install has no installer step: put solidcraft-cli on PATH, quietly.
+                #[cfg(target_os = "macos")]
+                std::thread::spawn(solidcraft_ui_egui::cli_link::install_on_launch);
+                // Automation runs (a control port was asked for) leave the user's AI apps alone.
+                if !self.take_focus_unwanted {
+                    solidcraft_ui_egui::ai_connect::begin(&mut self.solve);
+                    solidcraft_ui_egui::agent_chat::begin(&mut self.solve);
+                }
                if let Some(dir) = self.starting.take() {
                    startup::started(&dir);
                }
@@ -124,7 +144,13 @@ impl eframe::App for App {
        if ctx.input(|i| i.viewport().close_requested()) && !self.solve.quit_requested {
            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
            solidcraft_ui_egui::documents::request_quit(&mut self.solve);
+            // Closed from the taskbar or a window switcher while another app had the focus: the
+            // "save changes?" prompt is only seen once the window comes forward.
+            if !self.solve.quit_requested {
+                self.come_forward.start(std::time::Instant::now());
+            }
        }
+        self.come_forward.tick(ctx, _frame);
        #[cfg(target_os = "macos")]
        for f in if self.solve.file_picker_busy() { Vec::new() } else { open_documents::take() } {
            self.solve.open_path_async(&f);
@@ -134,10 +160,13 @@ impl eframe::App for App {
            menu.tick(&mut self.solve, ctx);
        }
        self.solve.logic(ctx);
+        self.dialog_folder.design(self.solve.session.path.as_deref());
        #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
        if !self.solve.file_picker_busy() {
            self.space_mouse.tick(&mut self.solve, ctx);
        }
+        // Every frame, so switching the bridge off reaches the reader while a picker is open too.
+        self.nav_bridge.tick(&mut self.solve, ctx);
        if self.solve.quit_requested {
            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
        }
@@ -147,6 +176,8 @@ impl eframe::App for App {
        if let Some(menu) = &mut self.native_menu {
            menu.raw_input_hook(&mut self.solve, ctx, raw);
        }
+        #[cfg(target_os = "macos")]
+        macos_fullscreen_content(ctx, raw);
        // Before the app's own hook, which adds the control channel's events.
        #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
        self.space_mouse.raw_input_hook(self.solve.preferences.space_mouse_enabled, raw);
@@ -156,7 +187,7 @@ impl eframe::App for App {
        self.solve.raw_input_hook(raw);
    }
    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.solve.ui(ui);
+        content_ui(&mut self.solve, ui);
    }
    fn save(&mut self, storage: &mut dyn eframe::Storage) {
        storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, self.solve.prefs());
@@ -166,10 +197,36 @@ impl eframe::App for App {
        solidcraft_ui_egui::agent_chat::shutdown(&mut self.solve);
        // A save still being written ends before the app does.
        solidcraft_ui_egui::save_job::tick(&mut self.solve, true);
+        // Pictures still being drawn off the window thread (Home cards, file previews) end
+        // before the GPU is torn down: one drawn while the process exits can crash the driver.
+        if !solidcraft_engine::capture::close(std::time::Duration::from_secs(5)) {
+            log::warn!("a picture was still being drawn as the app closed");
+        }
        solidcraft_ui_egui::recovery_ui::close(&mut self.solve);
+        solidcraft_ui_egui::open_elsewhere::close(&mut self.solve);
+        // Before a restart (`Drop for App`) starts the next instance, which would otherwise get
+        // nothing from the 3D mouse driver (`solidcraft_3dx_client::stop`).
+        #[cfg(target_os = "macos")]
+        solidcraft_3dx_client::stop();
        solidcraft_engine::crash::end_session();
-        if let Some(lost_at) = self.gpu.as_ref().and_then(|g| g.lost_at) {
-            device_lost::restart(self.gpu.as_ref().is_some_and(|g| g.restart_on_software), lost_at);
+        // The next start (after a lost device, or into an update) begins once the app is dropped
+        // (`Drop for App`), when the settings are on disk.
+    }
+}
+
+impl Drop for App {
+    /// eframe drops its settings storage first, which waits for `app.ron` to be written, then the
+    /// app, then the window and its GPU surface. So the next start begins here: started from
+    /// `on_exit`, it read `app.ron` while the old process was still writing it, found it
+    /// unreadable and moved it aside, resetting every setting (#9044).
+    fn drop(&mut self) {
+        if let Some(gpu) = &self.gpu
+            && let Some(lost_at) = gpu.lost_at
+        {
+            device_lost::restart(gpu.restart_on_software, lost_at, &gpu.reason);
+            // The window's GPU surface is still to be dropped, and on a lost device that may
+            // never return (#9044).
+            device_lost::end();
        }
        // An update asked to restart into the new version or to run its installer.
        if let Some((program, args)) = solidcraft_ui_egui::update::take_launch(&mut self.solve) {
@@ -197,6 +254,8 @@ struct LostWatch {
    restart_on_software: bool,
    /// When the loss was seen: the app is closing to start again.
    lost_at: Option<u64>,
+    /// Why, as wgpu said it: passed to the next start ([`device_lost::REASON_ENV`]).
+    reason: String,
 }

 impl App {
@@ -210,10 +269,65 @@ impl App {
        eprintln!("SolidCraft graphics: the device was lost ({reason}); starting again");
        solidcraft_engine::crash::phase(&format!("graphics device lost: {reason}"));
        gpu.lost_at = Some(device_lost::now_secs());
+        gpu.reason = reason;
        self.solve.quit_requested = true;
    }
 }

+/// Where the next file dialog opens (#7756): the folder of the file last chosen in one, or of the
+/// design last opened or saved, whichever came last. Linux dialogs otherwise open in the home
+/// folder every time; macOS and Windows remember a folder of their own, which this agrees with.
+#[derive(Clone, Default)]
+struct DialogFolder(std::sync::Arc<std::sync::Mutex<DialogFolderState>>);
+
+#[derive(Default)]
+struct DialogFolderState {
+    folder: Option<std::path::PathBuf>,
+    /// The open design's path when last looked at, to notice another design opened or saved.
+    design: Option<String>,
+}
+
+impl DialogFolder {
+    /// A file was chosen in a dialog: the next one opens in its folder.
+    fn chosen(&self, file: &std::path::Path) {
+        if let (Some(folder), Ok(mut state)) = (file.parent().filter(|f| !f.as_os_str().is_empty()), self.0.lock()) {
+            state.folder = Some(folder.to_path_buf());
+        }
+    }
+
+    /// The open design's path, every frame: a design opened or saved somewhere else moves the
+    /// next dialog to its folder; the same design again leaves a folder chosen since alone.
+    fn design(&self, path: Option<&str>) {
+        let Ok(mut state) = self.0.lock() else { return };
+        if state.design.as_deref() == path {
+            return;
+        }
+        state.design = path.map(str::to_string);
+        if let Some(folder) = path.and_then(|p| std::path::Path::new(p).parent()).filter(|f| !f.as_os_str().is_empty()) {
+            state.folder = Some(folder.to_path_buf());
+        }
+    }
+
+    /// A dialog's answer as a path, its folder remembered for the next dialog.
+    fn answer(&self, picked: Option<rfd::FileHandle>) -> Option<String> {
+        let picked = picked?;
+        self.chosen(picked.path());
+        Some(picked.path().to_string_lossy().into_owned())
+    }
+
+    fn folder(&self) -> Option<std::path::PathBuf> {
+        self.0.lock().ok().and_then(|state| state.folder.clone())
+    }
+
+    /// The dialog, opening in the remembered folder when there is one.
+    fn start(&self, dialog: rfd::AsyncFileDialog) -> rfd::AsyncFileDialog {
+        match self.folder() {
+            Some(folder) => dialog.set_directory(folder),
+            None => dialog,
+        }
+    }
+}
+
 /// Linux file dialogs match patterns by case, so each extension goes in as lower and upper
 /// case, plus FreeCAD's own mixed casing.
 fn case_variants(exts: &[&str]) -> Vec<String> {
@@ -232,26 +346,61 @@ fn case_variants(exts: &[&str]) -> Vec<String> {
    all
 }

-fn services(cc: &eframe::CreationContext<'_>) -> Services {
+/// egui's root Ui spans the whole viewport, including native safe areas. Lay out the app
+/// inside the unobscured rectangle so its application bar can receive native pointer input.
+fn content_ui(app: &mut SolveApp, ui: &mut egui::Ui) {
+    let content = ui.ctx().content_rect();
+    let above = egui::Rect::from_min_max(ui.max_rect().min, egui::pos2(ui.max_rect().right(), content.top()));
+    ui.painter().rect_filled(above, 0.0, solidcraft_ui_egui::theme::Tokens::get().app_bar);
+    ui.scope_builder(egui::UiBuilder::new().max_rect(content), |ui| app.ui(ui));
+}
+
+/// A transparent macOS title bar still intercepts clicks at the top in fullscreen (#3643).
+/// `contentLayoutRect` reports the whole content view once that bar auto-hides, so reserve
+/// the native titled-window height even then. AppKit supplies the height in logical points;
+/// egui's UI zoom is separate from the display's Retina scale.
+#[cfg(target_os = "macos")]
+fn macos_fullscreen_content(ctx: &egui::Context, raw: &mut egui::RawInput) {
+    let Some(mtm) = objc2::MainThreadMarker::new() else { return };
+    let frame = objc2_app_kit::NSWindow::frameRectForContentRect_styleMask(Default::default(), objc2_app_kit::NSWindowStyleMask::Titled, mtm);
+    fullscreen_content_insets(raw, frame.size.height as f32, ctx.zoom_factor());
+}
+
+#[cfg(any(target_os = "macos", test))]
+fn fullscreen_content_insets(raw: &mut egui::RawInput, title_height: f32, zoom: f32) {
+    let fullscreen = raw.viewports.get(&raw.viewport_id).and_then(|v| v.fullscreen).unwrap_or(false);
+    let mut insets = raw.safe_area_insets.unwrap_or_default();
+    if fullscreen && title_height.is_finite() && title_height > 0.0 && zoom.is_finite() && zoom > 0.0 {
+        insets.0.top = insets.0.top.max(title_height / zoom);
+    }
+    // Explicitly reset on leaving fullscreen: None would retain the preceding frame's inset.
+    raw.safe_area_insets = Some(insets);
+}
+
+fn services(cc: &eframe::CreationContext<'_>, folder: &DialogFolder) -> Services {
    let parent = rfd::AsyncFileDialog::new().set_parent(cc);
    let open_parent = parent.clone();
    let program_parent = parent.clone();
    let file_parent = parent.clone();
+    let (open_folder, file_folder, save_folder) = (folder.clone(), folder.clone(), folder.clone());
    Services {
        pick_open: Some(Box::new(move |first: &[&str]| {
            // The file type the command reads comes first, so the picker opens on it (#1801).
-            let mut dialog = open_parent.clone();
+            let mut dialog = open_folder.start(open_parent.clone());
            if !first.is_empty() {
                let label = first.iter().map(|e| e.to_uppercase()).collect::<Vec<_>>().join(", ");
                dialog = dialog.add_filter(label, &case_variants(first));
            }
            // The groups come from the format registry, so a new format joins this dialog by itself.
-            dialog = dialog.add_filter("Designs, CAD files and meshes", &case_variants(&io::formats::open_extensions(true)));
+            let mut everything = io::formats::open_extensions(true);
+            everything.extend(["dxf", "svg"]);
+            dialog = dialog.add_filter(solidcraft_ui_egui::i18n::tr("file.open.drawing_filter"), &case_variants(&everything));
            for (label, exts) in io::formats::import_filters(true) {
                dialog = dialog.add_filter(label, &case_variants(&exts));
            }
            let future = dialog.add_filter("All files", &["*"]).pick_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let folder = open_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
        // One kind of file (the agent chat's attachments): only the types it names, as given and in
        // lower and upper case (Linux dialogs match case; macOS allows just the listed types).
@@ -266,8 +415,9 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
            }
            let all: Vec<&str> = all.iter().map(String::as_str).collect();
            // Any other file attaches by reference, so the list is not the only choice.
-            let future = file_parent.clone().add_filter(label, &all).add_filter("All files", &["*"]).pick_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let future = file_folder.start(file_parent.clone()).add_filter(label, &all).add_filter("All files", &["*"]).pick_file();
+            let folder = file_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
        pick_program: Some(Box::new(move || {
            let dialog = program_parent.clone().set_title("Choose your slicer");
@@ -276,7 +426,7 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
        })),
        pick_save: Some(Box::new(move |name: &str, exts: &[&str]| {
-            let dialog = parent.clone().set_file_name(name);
+            let dialog = save_folder.start(parent.clone()).set_file_name(name);
            let dialog = if exts == [io::DESIGN_EXT, "json"] {
                if name.ends_with(".json") {
                    dialog.add_filter("Plain JSON design", &["json"]).add_filter("SolidCraft container", &[io::DESIGN_EXT])
@@ -287,10 +437,18 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
                dialog.add_filter("File", exts)
            };
            let future = dialog.save_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let folder = save_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
+        graphics_adapters: Vec::new(),
        graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
        window_system: window_system_now(),
+        // Linux: the desktop's dark or light setting, which the window is not told on every
+        // desktop (#7944). Windows and macOS: the window's own theme.
+        #[cfg(target_os = "linux")]
+        desktop_dark: Some(desktop_theme::start(&cc.egui_ctx)),
+        #[cfg(not(target_os = "linux"))]
+        desktop_dark: None,
        http_get: Some(std::sync::Arc::new(http_get)),
        http_download: Some(std::sync::Arc::new(http_download)),
        // Already an installed app: only the browser build offers to install.
@@ -298,6 +456,7 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
        can_restore: None,
        restore_file: None,
        download_design: None,
+        easyprint_upload: Some(std::sync::Arc::new(easyprint_upload)),
        browser_files: None,
        agent_http: Some(std::sync::Arc::new(agent_http)),
        secrets: Some(std::sync::Arc::new(Keychain)),
@@ -369,7 +528,7 @@ fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Resul
    let agent: ureq::Agent = ureq::Agent::config_builder()
        .tls_config(tls)
        .http_status_as_error(false)
-        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 900))))
+        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 3600))))
        .timeout_connect(Some(Duration::from_secs(10)))
        .user_agent("SolidCraft")
        .max_redirects(0)
@@ -394,6 +553,24 @@ fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Resul
    Ok((status, body))
 }

+/// Open with EasyPrint: upload the model to Printables' import endpoint on a worker and answer on
+/// `done` with the address to open. Through [`agent_http`]: no redirects, a timeout, no cookies.
+fn easyprint_upload(name: &str, bytes: Vec<u8>, done: std::sync::mpsc::Sender<Result<String, String>>) {
+    use solidcraft_engine::easyprint;
+    let name = name.to_string();
+    std::thread::spawn(move || {
+        let (content_type, body) = easyprint::multipart(&name, &bytes);
+        let request = solidcraft_ui_egui::agent_chat::backend::HttpRequest {
+            method: "POST",
+            url: easyprint::IMPORT_URL.into(),
+            headers: vec![("Content-Type".into(), content_type), ("Accept".into(), "application/json".into())],
+            body: Some(body),
+            timeout_s: 180,
+        };
+        let _ = done.send(agent_http(&request).and_then(|(status, body)| easyprint::parse_import_response(status, &body)));
+    });
+}
+
 /// API keys in the system keychain (service "SolidCraft agent chat", one entry per agent).
 struct Keychain;

@@ -474,26 +651,26 @@ fn graphics_path() -> Option<std::path::PathBuf> {
 /// Compatibility shim (docs/compatibility.md): on the first launch after the rename, copy the
 /// settings of earlier releases into the new folder. They kept `graphics.json` (and, on Linux
 /// and macOS, the recovery folder) under the old product name, and eframe's `app.ron` under the
-/// window's old app id. In the Flatpak sandbox, releases before 0.8 kept everything under the
-/// old app id's `~/.var/app` folder; that copy comes first, as it is the newest. The old folders
+/// window's old app id. In the Flatpak sandbox, earlier releases kept everything under an
+/// old app id's `~/.var/app` folder; those copies come first, newest first. The old folders
 /// are never changed.
 fn adopt_legacy_settings() {
    let (Some(current), Some(legacy)) = (settings_dir().ok().flatten(), eframe::storage_dir("SolveCraft")) else { return };
    let legacy_eframe = eframe::storage_dir(solidcraft_engine::io::LEGACY_APP_ID);
-    let old_flatpak = solidcraft_engine::io::legacy_flatpak_path(&current);
-    if let Err(e) = adopt_settings(&current, old_flatpak.as_deref(), &legacy, legacy_eframe.as_deref()) {
+    let old_flatpak = solidcraft_engine::io::legacy_flatpak_paths(&current);
+    if let Err(e) = adopt_settings(&current, &old_flatpak, &legacy, legacy_eframe.as_deref()) {
        log::warn!("settings: could not copy the previous release's settings into {}: {e}", current.display());
    }
 }

 fn adopt_settings(
    current: &std::path::Path,
-    old_flatpak: Option<&std::path::Path>,
+    old_flatpak: &[std::path::PathBuf],
    legacy: &std::path::Path,
    legacy_eframe: Option<&std::path::Path>,
 ) -> std::io::Result<()> {
    let fresh = !current.exists();
-    if let Some(old) = old_flatpak {
+    for old in old_flatpak {
        solidcraft_engine::io::adopt_legacy_dir(current, old)?;
    }
    solidcraft_engine::io::adopt_legacy_dir(current, legacy)?;
@@ -529,13 +706,22 @@ fn scene_samples(backend: eframe::wgpu::Backend, samples: u32, supported: &[u32]
    }
 }

-/// Anti-aliasing samples from Preferences (4 when unset).
-fn msaa() -> u16 {
+/// Keep the default until the installed renderer's startup check proves a fallback is needed.
+fn scene_msaa_request(saved: Option<u16>) -> u16 {
+    saved.unwrap_or(MSAA)
+}
+
+/// Query the scene's colour/depth intersection, rather than the depthless window's counts.
+fn scene_sample_choices(depth_bits: u8, stencil_bits: u8, query: impl FnOnce(Option<eframe::wgpu::TextureFormat>) -> Vec<u32>) -> Vec<u32> {
+    query(eframe::egui_wgpu::depth_format_from_bits(depth_bits, stencil_bits))
+}
+
+/// An explicitly saved anti-aliasing choice, absent until Graphics changes it.
+fn msaa() -> Option<u16> {
    graphics()
        .and_then(|v| v.get("msaa").and_then(serde_json::Value::as_u64))
        .and_then(|m| u16::try_from(m).ok())
        .filter(|m| [1, 2, 4, 8].contains(m))
-        .unwrap_or(MSAA)
 }

 /// Windows and Linux: no OS title bar; the application bar is the title bar
@@ -551,7 +737,8 @@ const FLOAT_DEPTH_BITS: u8 = 32;
 const STENCIL_BITS: u8 = 8;
 const MSAA: u16 = 4;

-fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
+/// `custom_titlebar`: no OS decorations, the application bar is the title bar.
+fn app_viewport(custom_titlebar: bool) -> Result<egui::ViewportBuilder, eframe::Error> {
    // Let macOS use the bundle's layered icon; eframe's default bitmap would replace it.
    #[cfg(target_os = "macos")]
    let icon = egui::IconData::default();
@@ -564,7 +751,7 @@ fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
        .with_inner_size([1600.0, 1000.0])
        .with_min_inner_size([960.0, 600.0])
        .with_drag_and_drop(true)
-        .with_decorations(!CUSTOM_TITLEBAR)
+        .with_decorations(!custom_titlebar)
        .with_fullsize_content_view(true)
        .with_titlebar_shown(false)
        .with_title_shown(false)
@@ -574,10 +761,32 @@ fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
 /// The window's app id: it names the desktop entry, so it is the packages' reverse-DNS id.
 const APP_ID: &str = solidcraft_engine::io::APP_ID;

+/// Disconnects from the 3D mouse driver when dropped, as `main` returns or a panic unwinds out
+/// of it (`solidcraft_3dx_client::stop`).
+#[cfg(target_os = "macos")]
+struct DriverClient;
+
+#[cfg(target_os = "macos")]
+impl Drop for DriverClient {
+    fn drop(&mut self) {
+        solidcraft_3dx_client::stop();
+    }
+}
+
 fn main() -> eframe::Result {
    #[cfg(target_os = "macos")]
    objc2_foundation::NSProcessInfo::processInfo().setProcessName(objc2_foundation::ns_string!("SolidCraft"));
    mark("main");
+    // On OCLP-patched Macs, wgpu picks a Metal Shading Language standard that the system's
+    // compiler refuses (`invalid value 'metal3.2'`), because the patched OS reports a newer
+    // macOS version than the GPU's Metal compiler supports. Re-launching with
+    // SYSTEM_VERSION_COMPAT=1 makes the OS report the real (older) version so wgpu selects
+    // a standard the compiler accepts. The variable must be set before the process starts, so
+    // we detect OCLP here and re-exec immediately, before any macOS framework call (#3080, #4605).
+    #[cfg(target_os = "macos")]
+    if let Err(e) = startup::relaunch_with_version_compat() {
+        log::warn!("startup: OCLP check failed (continuing normally): {e}");
+    }
    // Validate before legacy adoption, crash markers or any user preference read.
    let settings = settings_dir().map_err(|error| eframe::Error::AppCreation(error.into()))?;
    if std::env::var_os("SOLIDCRAFT_SETTINGS_DIR").is_none() {
@@ -587,11 +796,17 @@ fn main() -> eframe::Result {
    let mut control_port: Option<u16> = solidcraft_engine::geom::env::var("CONTROL_PORT").and_then(|p| p.parse().ok());
    let mut files = Vec::new();
    let mut sample = false;
+    // `--theme-file PATH`: follow that theme file for this run without saving it (#7573).
+    let mut theme_file: Option<String> = None;
+    let mut max_file_size = None;
    let mut args = std::env::args().skip(1);
    while let Some(a) = args.next() {
        match a.as_str() {
            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
            "--sample" => sample = true,
+            "--theme-file" => theme_file = args.next(),
+            "--max-file-size" => max_file_size = Some(args.next()),
+            s if s.starts_with("--max-file-size=") => max_file_size = Some(s.strip_prefix("--max-file-size=").map(str::to_string)),
            "--safe-mode" => safe_mode = true,
            "--version" | "-V" => {
                println!("solidcraft {}", env!("CARGO_PKG_VERSION"));
@@ -611,12 +826,22 @@ fn main() -> eframe::Result {
                return Ok(());
            }
            "--help" | "-h" => {
-                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]");
+                println!(
+                    "usage: solidcraft [--control PORT] [--sample] [--theme-file THEME.json] [--crash-log] [--safe-mode] [--max-file-size SIZE] [design.sc | part.step]"
+                );
                return Ok(());
            }
            _ => files.push(a),
        }
    }
+    // `--max-file-size 2GB`: the largest files this run reads, over Preferences, never saved (#4086).
+    if let Some(value) = max_file_size {
+        let applied = startup::max_file_size(value.as_deref()).and_then(|bytes| solidcraft_engine::io::limits::set_override(Some(bytes)));
+        if let Err(error) = applied {
+            eprintln!("SolidCraft: {error}");
+            return Err(eframe::Error::AppCreation(std::io::Error::other(error).into()));
+        }
+    }
    // Settings that don't read are moved aside; launches that never got a window are counted,
    // and after a few in a row this one starts in safe mode (docs/book/src/guide/troubleshooting.md).
    let mut notes: Vec<String> = Vec::new();
@@ -633,12 +858,22 @@ fn main() -> eframe::Result {
    // The launch before this one closed because its graphics device was lost (`App::watch_device`).
    let after_loss = device_lost::recent(std::env::var(device_lost::LOST_ENV).ok().as_deref(), device_lost::now_secs());
    if after_loss {
-        notes.push(device_lost::note(cpu_renderer));
+        let reason = std::env::var(device_lost::REASON_ENV).ok();
+        if let Some(reason) = device_lost::reason(reason.as_deref()) {
+            log::warn!("graphics: the last launch lost its device ({reason})");
+        }
+        notes.push(device_lost::note(cpu_renderer, reason.as_deref()));
    }
    if safe_mode {
        notes.push("Safe mode: default settings (yours are kept for the next normal start), no recovery offer, software rendering.".into());
    }
-    let samples = if safe_mode { MSAA } else { msaa() };
+    let fallback_note = std::env::var(startup::FALLBACK_NOTE_ENV).ok().map(|s| s.chars().take(4096).collect::<String>());
+    if let Some(note) = &fallback_note {
+        log::warn!("{note}");
+        eprintln!("SolidCraft: {note}");
+        notes.push(note.clone());
+    }
+    let saved_samples = if safe_mode { None } else { msaa() };
    let wgpu_options = wgpu_options(cpu_renderer, if safe_mode { None } else { backend_preference() }.as_deref());
    let depth_bits = if !safe_mode && startup::float_depth_everywhere(&wgpu_options) { FLOAT_DEPTH_BITS } else { DEPTH_BITS };
    // Crashes leave a report in the crash folder (solidcraft_engine::crash, docs/crash-reports.md).
@@ -652,14 +887,22 @@ fn main() -> eframe::Result {
            solidcraft_engine::crash::install(dir, build)
        })
        .unwrap_or_default();
-    // A crash in native code (a graphics driver) says where it happened: the exception and the
-    // module on Windows, and on every system the startup step the app was in.
+    // A crash in native code (a graphics driver) says where it happened: the exception or signal
+    // and the module on Windows and macOS, and on every system the startup step the app was in.
    #[cfg(target_os = "windows")]
    native_crash::install();
+    #[cfg(target_os = "macos")]
+    native_crash_macos::install();
+    // Windows with only OpenGL to start: the system title bar instead of ours (#2063).
+    let started = match &wgpu_options.wgpu_setup {
+        eframe::egui_wgpu::WgpuSetup::CreateNew(setup) => setup.instance_descriptor.backends,
+        _ => eframe::wgpu::Backends::all(),
+    };
+    let custom_titlebar = CUSTOM_TITLEBAR && !startup::system_title_bar(cfg!(target_os = "windows"), started);
    eframe::egui_wgpu::set_startup_hook(startup_step);
    solidcraft_engine::crash::phase("window");
    let options = eframe::NativeOptions {
-        viewport: app_viewport()?,
+        viewport: app_viewport(custom_titlebar)?,
        // The window's pass (egui's) has no depth and one sample: the viewport draws its scene
        // offscreen with its own depth and MSAA, then blits it, so the UI pass pays for neither.
        depth_buffer: 0,
@@ -710,6 +953,10 @@ fn main() -> eframe::Result {
    let created = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
    let created_in_app = created.clone();
    let starting = settings.clone();
+    // A panic on the window's thread ends the app without `on_exit`; this disconnects from the
+    // 3D mouse driver then too.
+    #[cfg(target_os = "macos")]
+    let _driver_client = DriverClient;
    mark("run_native");
    let result = eframe::run_native(
        "SolidCraft",
@@ -721,42 +968,73 @@ fn main() -> eframe::Result {
            solidcraft_ui_egui::fonts::setup_bundled_fonts(&cc.egui_ctx);
            solidcraft_ui_egui::fonts::load_system_fonts_in_background(&cc.egui_ctx);
            mark("fonts");
-            let mut app = SolveApp::new(Session::default(), services(cc));
+            let dialog_folder = DialogFolder::default();
+            let mut app = SolveApp::new(Session::default(), services(cc, &dialog_folder));
            app.apply_off_thread = Some(solidcraft_ui_egui::dialogs::APPLY_AT_ONCE);
-            app.custom_titlebar = CUSTOM_TITLEBAR;
-            // Windows: the OS hit test offers the resize border, at the window's DPI, from the
-            // first message (#1381).
+            app.custom_titlebar = custom_titlebar;
            #[cfg(target_os = "windows")]
            {
-                app.native_resize_border = CUSTOM_TITLEBAR && native_frame::install(cc);
-                if CUSTOM_TITLEBAR && !app.native_resize_border {
+                // Windows: the taskbar button shows the mark even when slow first frames keep the
+                // taskbar waiting for the window's icon.
+                if !native_frame::set_class_icon(cc) {
+                    eprintln!("SolidCraft window: no class icon; the taskbar may show a generic one");
+                }
+                // The OS hit test offers the resize border, at the window's DPI, from the first
+                // message (#1381).
+                app.native_resize_border = custom_titlebar && native_frame::install(cc);
+                if custom_titlebar && !app.native_resize_border {
                    eprintln!("SolidCraft window: no native resize border; egui edge zones instead");
                }
            }
            app.integrated_titlebar = cfg!(target_os = "macos");
            app.cpu_meshing = safe_mode;
+            app.graphics_fallback = fallback_note.clone();
            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))).filter(|_| !safe_mode) {
                app.load_prefs(&p);
            }
+            if let Some(path) = &theme_file
+                && let Err(e) = solidcraft_ui_egui::prefs::follow_theme_file_for_run(&mut app, path)
+            {
+                app.set_status(format!("--theme-file: {e}"), true);
+            }
            mark("app state and prefs");
            let gpu = cc.wgpu_render_state.as_ref().map(|rs| LostWatch {
                lost: rs.device_lost.clone(),
                restart_on_software: device_lost::restart_on_software(after_loss, cpu_renderer),
                lost_at: None,
+                reason: String::new(),
            });
+            if !safe_mode {
+                app.preferences.graphics_adapter =
+                    graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string)).unwrap_or_default();
+            }
            if let Some(rs) = &cc.wgpu_render_state {
-                let scene_samples = scene_samples(rs.adapter.get_info().backend, u32::from(samples), &rs.msaa_supported);
+                app.services.graphics_adapters = rs
+                    .available_adapters
+                    .iter()
+                    .map(|adapter| {
+                        let info = adapter.get_info();
+                        (info.name.clone(), format!("{} ({:?}, {:?})", info.name, info.device_type, info.backend))
+                    })
+                    .collect();
+                let info = rs.adapter.get_info();
+                let samples = scene_msaa_request(saved_samples);
+                let supported = scene_sample_choices(depth_bits, STENCIL_BITS, |depth| {
+                    eframe::egui_wgpu::supported_msaa_samples(&rs.adapter, &rs.device, rs.target_format, depth)
+                });
+                let scene_samples = scene_samples(info.backend, u32::from(samples), &supported);
                eprintln!("SolidCraft graphics: {:?}, MSAA {scene_samples}x (requested {}x)", rs.adapter.get_info().backend, samples);
                solidcraft_engine::crash::phase("viewport pipelines (shader compile)");
-                app.set_wgpu_split(rs, depth_bits, STENCIL_BITS, scene_samples);
+                let scene_samples = app.set_wgpu_split(rs, depth_bits, STENCIL_BITS, scene_samples);
+                app.msaa_supported = supported;
+                app.preferences.msaa = u32::from(samples);
                solidcraft_ui_egui::gpu::install_picture_renderer(rs);
                // The graphics driver is loaded now; it may have put its own exception filter
                // in front of ours.
                #[cfg(target_os = "windows")]
                native_crash::reinstall();
-                // A saved anti-aliasing the device can't do: back to the default, with a notice.
+                // Reflect a confirmed probe fallback or an unsupported saved count in Graphics.
                solidcraft_ui_egui::prefs::check_msaa(&mut app, u32::from(samples));
-                let info = rs.adapter.get_info();
                solidcraft_engine::crash::set_environment(&format!(
                    "Renderer: {:?} {} ({}), MSAA {scene_samples}x",
                    info.backend, info.name, info.driver
@@ -780,13 +1058,24 @@ fn main() -> eframe::Result {
                app.session.doc_mut().name = "Sample Plate".into();
                app.session.mark_saved();
                app.session.undo.clear();
+                // Built straight into the session, so nothing asked for a fit: frame it at the
+                // home view as any opened design is (#9195). The fit waits for the first layout.
+                app.cam.set_view(solidcraft_engine::render::StandardView::Iso);
+                app.fit_view();
            }
+            // Lock files next to open designs: a design open on another computer says so (#5467),
+            // the files given at launch included.
+            solidcraft_ui_egui::open_elsewhere::start(&mut app);
            // A launch from Finder: its files arrived before the window.
            #[cfg(target_os = "macos")]
            let files = {
                open_documents::set_ui(&cc.egui_ctx);
                [files, open_documents::take()].concat()
            };
+            // No design given: the designs open at the last quit, when the preference asks (#5542).
+            // Not when driven over the control channel, whose clients expect a fresh design.
+            let files =
+                if files.is_empty() && !sample && control_port.is_none() { solidcraft_ui_egui::documents::designs_to_reopen(&app) } else { files };
            for f in &files {
                app.open_path_async(f);
            }
@@ -815,8 +1104,9 @@ fn main() -> eframe::Result {
            if !notes.is_empty() {
                app.set_status(notes.join(" "), true);
            }
+            let nav_bridge = nav_bridge::NavBridge::start(&cc.egui_ctx);
            #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
-            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx, nav_bridge.claim());
            #[cfg(target_os = "macos")]
            let native_menu = match native_menu::NativeMenu::new(&app, &cc.egui_ctx) {
                Ok(menu) => Some(menu),
@@ -836,28 +1126,32 @@ fn main() -> eframe::Result {
                starting,
                frames: 0,
                take_focus_unwanted: control_port.is_some(),
+                come_forward: come_forward::ComeForward::default(),
                gpu,
                #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
                space_mouse,
                #[cfg(target_os = "macos")]
                native_menu,
+                nav_bridge,
+                dialog_folder,
            }))
        }),
    );
    control_server::remove_token_file();
    match result {
-        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, settings.as_deref()),
+        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, started, settings.as_deref()),
        r => r,
    }
 }

 /// egui-wgpu is about to start a step of getting the graphics device and the window's surface up:
-/// the crash journal keeps it, and the adapter once it is picked.
+/// the crash journal keeps it until the app runs (a window opened later goes through the same
+/// steps), and the adapter once it is picked.
 fn startup_step(step: &'static str, detail: &str) {
    if step == eframe::egui_wgpu::STEP_ADAPTER_CHOSEN {
        solidcraft_engine::crash::set_environment(&format!("Renderer: {detail}"));
    }
-    solidcraft_engine::crash::phase(step);
+    solidcraft_engine::crash::startup_step(step);
 }

 /// The renderer settings: with `cpu`, the software adapter (WARP, lavapipe, llvmpipe). The
@@ -867,13 +1161,21 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
    let mut options = eframe::egui_wgpu::WgpuConfiguration::default();
    if let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &mut options.wgpu_setup {
        let env_set = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+        // A retry applies only to this launch. WGPU_BACKEND always has priority.
+        let retry = std::env::var(startup::RETRY_BACKEND_ENV).ok();
+        let preference = if cpu { preference } else { retry.as_deref().or(preference) };
        if let Some(backends) = startup::choose_backends(cfg!(target_os = "windows"), env_set, cpu, preference, startup::has_hardware_adapter) {
            eprintln!("SolidCraft graphics: starting {backends:?}");
            setup.instance_descriptor.backends = backends;
        }
-        if cpu {
-            setup.native_adapter_selector = Some(std::sync::Arc::new(startup::pick_cpu_adapter));
-        }
+        let intel_mac = cfg!(all(target_os = "macos", target_arch = "x86_64"));
+        let indirect = std::env::var(startup::INDIRECT_VALIDATION_ENV).ok();
+        setup.instance_descriptor.flags = startup::window_instance_flags(setup.instance_descriptor.flags, intel_mac, indirect.as_deref());
+        // Never a `dxcompiler.dll` another program put on PATH (#6756).
+        setup.instance_descriptor.backend_options.dx12.shader_compiler = solidcraft_gpu::dx12_compiler();
+        let environment = std::env::var("WGPU_ADAPTER_NAME").ok();
+        let adapter = graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string));
+        startup::configure_adapter(setup, cpu, environment, adapter);
        // A float depth buffer with a stencil, wherever the adapter has it (see `FLOAT_DEPTH_BITS`).
        let base = setup.device_descriptor.clone();
        setup.device_descriptor = std::sync::Arc::new(move |adapter| {
@@ -885,24 +1187,47 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
    options
 }

-/// The window never opened (no graphics adapter, a device that wouldn't start): once more on
-/// the software renderer, else a message box saying what failed instead of a silent exit.
-fn no_window(error: eframe::Error, tried_cpu: bool, settings: Option<&std::path::Path>) -> eframe::Result {
+/// A failed renderer returns here before app creation. A fresh process avoids reusing winit's
+/// event loop or a failed device; each retry advances through the APIs, then software once.
+fn no_window(error: eframe::Error, tried_cpu: bool, failed: eframe::wgpu::Backends, settings: Option<&std::path::Path>) -> eframe::Result {
    log::error!("the window could not open: {error}");
    eprintln!("SolidCraft: the window could not open: {error}");
-    if !tried_cpu && let Ok(exe) = std::env::current_exe() {
-        eprintln!("SolidCraft: trying again with the software renderer ({}=cpu)", startup::RENDERER_ENV);
-        match std::process::Command::new(exe).args(std::env::args_os().skip(1)).env(startup::RENDERER_ENV, "cpu").status() {
+    // This failure was handled, so neither the marker nor the journal should call it a crash.
+    if let Some(dir) = settings {
+        startup::started(dir);
+    }
+    solidcraft_engine::crash::end_session();
+    let explicit = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+    if let Some(next) = startup::fallback_backend(cfg!(target_os = "windows"), explicit, tried_cpu, failed)
+        && let Ok(exe) = std::env::current_exe()
+    {
+        let previous = std::env::var(startup::FALLBACK_NOTE_ENV).unwrap_or_default();
+        let note = startup::fallback_note(&previous, failed, next, &error.to_string());
+        log::warn!("{note}");
+        eprintln!("SolidCraft: {note}");
+        let mut command = std::process::Command::new(exe);
+        command.args(std::env::args_os().skip(1)).env(startup::FALLBACK_NOTE_ENV, note);
+        if next == "cpu" {
+            command.env(startup::RENDERER_ENV, "cpu").env_remove(startup::RETRY_BACKEND_ENV);
+        } else {
+            command.env(startup::RETRY_BACKEND_ENV, next);
+        }
+        match command.status() {
            Ok(status) if status.success() => return Ok(()),
-            // The second try showed its own message.
+            // The final try showed its own message.
            Ok(_) => return Err(error),
-            Err(e) => log::error!("could not start again with the software renderer: {e}"),
+            Err(e) => log::error!("could not start again on {next}: {e}"),
        }
    }
+    let message = if explicit {
+        format!("SolidCraft could not open its window with WGPU_BACKEND.\n\n{error}\n\nChange or remove WGPU_BACKEND to try another graphics API.")
+    } else {
+        startup::no_window_message(&error.to_string(), settings)
+    };
    let _ = rfd::MessageDialog::new()
        .set_level(rfd::MessageLevel::Error)
        .set_title("SolidCraft could not start")
-        .set_description(startup::no_window_message(&error.to_string(), settings))
+        .set_description(message)
        .set_buttons(rfd::MessageButtons::Ok)
        .show();
    Err(error)
@@ -991,11 +1316,45 @@ mod backend_tests {
 }

 #[cfg(test)]
-mod icon_tests {
+mod dialog_folder_tests {
+    use super::DialogFolder;
+    use std::path::{Path, PathBuf};
+
+    /// #7756: a file dialog opens where the last one left off, not in the home folder.
+    #[test]
+    fn the_next_dialog_opens_in_the_folder_of_the_file_chosen_last() {
+        let folder = DialogFolder::default();
+        assert_eq!(folder.folder(), None, "before any choice the system decides");
+        folder.chosen(Path::new("/work/prints/bracket.stl"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/prints")));
+        // A bare file name has no folder to remember.
+        folder.chosen(Path::new("bracket.step"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/prints")));
+    }
+
+    /// Save As starts beside the open design (#7756), and a folder chosen since wins until another
+    /// design is opened or saved.
+    #[test]
+    fn the_open_design_moves_the_folder_only_when_it_changes() {
+        let folder = DialogFolder::default();
+        folder.design(Some("/work/lid/lid.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/lid")));
+        folder.chosen(Path::new("/exports/lid.3mf"));
+        folder.design(Some("/work/lid/lid.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/exports")), "the same design again leaves the export folder");
+        folder.design(None);
+        assert_eq!(folder.folder(), Some(PathBuf::from("/exports")), "a new, unsaved design has no folder of its own");
+        folder.design(Some("/work/base/base.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/base")));
+    }
+}
+
+#[cfg(test)]
+mod viewport_tests {
    #[cfg(target_os = "macos")]
    #[test]
    fn macos_preserves_the_bundle_icon_instead_of_setting_a_runtime_bitmap() {
-        let viewport = super::app_viewport().expect("viewport");
+        let viewport = super::app_viewport(super::CUSTOM_TITLEBAR).expect("viewport");
        assert_eq!(viewport.icon.as_deref(), Some(&eframe::egui::IconData::default()));
        assert_eq!(viewport.app_id.as_deref(), Some(super::APP_ID));
    }
@@ -1003,12 +1362,89 @@ mod icon_tests {
    #[cfg(not(target_os = "macos"))]
    #[test]
    fn desktop_viewport_supplies_the_original_mark_to_the_window() {
-        let viewport = super::app_viewport().expect("viewport");
+        let viewport = super::app_viewport(super::CUSTOM_TITLEBAR).expect("viewport");
        let icon = viewport.icon.expect("running window must have an icon");
        assert_eq!((icon.width, icon.height), (64, 64));
        assert_eq!(icon.rgba, super::app_icon::rgba(64).expect("original mark"));
        assert_eq!(viewport.app_id.as_deref(), Some(super::APP_ID));
    }
+
+    #[test]
+    fn fullscreen_bar_clears_native_chrome_and_undo_redo_keep_working() {
+        use egui::{Event, PointerButton, Pos2, RawInput, Rect, ViewportId, vec2};
+        use serde_json::json;
+        use solidcraft_ui_egui::scenario::handle_at;
+
+        // AppKit points are independent of Retina scale and of the user's UI zoom.
+        for (zoom, retina) in [(1.0, 1.0), (1.0, 2.0), (1.5, 2.0), (2.0, 2.0)] {
+            let ctx = egui::Context::default();
+            solidcraft_ui_egui::fonts::setup_bundled_fonts(&ctx);
+            ctx.set_zoom_factor(zoom);
+            let mut app = super::SolveApp::new(super::Session::default(), Default::default());
+            app.integrated_titlebar = true;
+            for (command, params) in [
+                ("sketch.create", json!({"plane":"XY"})),
+                ("sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[40,30]})),
+                ("sketch.finish", json!({})),
+                ("solid.extrude", json!({"distance":15})),
+            ] {
+                app.run(command, params).unwrap();
+            }
+            let mut time = 0.0;
+            let mut frame = |app: &mut super::SolveApp, fullscreen, events| {
+                time += 0.05;
+                let mut raw = RawInput {
+                    screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(1600.0, 1000.0))),
+                    time: Some(time),
+                    events,
+                    ..Default::default()
+                };
+                let viewport = raw.viewports.get_mut(&ViewportId::ROOT).unwrap();
+                viewport.fullscreen = Some(fullscreen);
+                viewport.native_pixels_per_point = Some(retina);
+                super::fullscreen_content_insets(&mut raw, 32.0, zoom);
+                let _ = ctx.run_ui(raw, |ui| super::content_ui(app, ui));
+            };
+            // Enter, leave, and enter again: no stale inset when returning to a normal window.
+            for fullscreen in [false, true, false, true] {
+                frame(&mut app, fullscreen, vec![]);
+                frame(&mut app, fullscreen, vec![]);
+                let top = if fullscreen { 32.0 / zoom } else { 0.0 };
+                for name in ["appbar:file", "appbar:undo", "appbar:redo", "appbar:help"] {
+                    let at = handle_at(name).unwrap();
+                    assert!((at.y - top - 17.0).abs() < 0.1, "{name}: {at:?}, fullscreen={fullscreen}, zoom={zoom}");
+                }
+                for (handle, bodies) in [("appbar:undo", 0), ("appbar:redo", 1)] {
+                    let at = handle_at(handle).unwrap();
+                    frame(&mut app, fullscreen, vec![Event::PointerMoved(at)]);
+                    for pressed in [true, false] {
+                        frame(
+                            &mut app,
+                            fullscreen,
+                            vec![Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Default::default() }],
+                        );
+                    }
+                    assert_eq!(app.session.model.state().bodies.len(), bodies, "{handle}, fullscreen={fullscreen}, zoom={zoom}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn fullscreen_inset_preserves_existing_safe_areas_and_resets_on_exit() {
+        use egui::epaint::MarginF32;
+        use egui::{RawInput, SafeAreaInsets, ViewportId};
+        let mut raw = RawInput::default();
+        raw.viewports.get_mut(&ViewportId::ROOT).unwrap().fullscreen = Some(true);
+        raw.safe_area_insets = Some(SafeAreaInsets(MarginF32 { top: 40.0, left: 5.0, right: 6.0, bottom: 7.0 }));
+        super::fullscreen_content_insets(&mut raw, 32.0, 2.0);
+        assert_eq!(raw.safe_area_insets.unwrap().0, MarginF32 { top: 40.0, left: 5.0, right: 6.0, bottom: 7.0 });
+
+        raw.viewports.get_mut(&ViewportId::ROOT).unwrap().fullscreen = Some(false);
+        raw.safe_area_insets = None;
+        super::fullscreen_content_insets(&mut raw, 32.0, 1.0);
+        assert_eq!(raw.safe_area_insets, Some(SafeAreaInsets::default()));
+    }
 }

 #[cfg(test)]
@@ -1022,14 +1458,14 @@ mod msaa_tests {
        std::fs::create_dir_all(&legacy_eframe).unwrap();
        std::fs::write(legacy.join("graphics.json"), r#"{"msaa":8}"#).unwrap();
        std::fs::write(legacy_eframe.join("app.ron"), "(prefs)").unwrap();
-        super::adopt_settings(&current, None, &legacy, Some(&legacy_eframe)).unwrap();
+        super::adopt_settings(&current, &[], &legacy, Some(&legacy_eframe)).unwrap();
        assert_eq!(std::fs::read_to_string(current.join("graphics.json")).unwrap(), r#"{"msaa":8}"#);
        assert_eq!(std::fs::read_to_string(current.join("app.ron")).unwrap(), "(prefs)");
        assert!(legacy.join("graphics.json").is_file() && legacy_eframe.join("app.ron").is_file());
        // Later launches leave the current settings alone.
        std::fs::write(current.join("app.ron"), "(mine)").unwrap();
        std::fs::remove_file(current.join("graphics.json")).unwrap();
-        super::adopt_settings(&current, None, &legacy, Some(&legacy_eframe)).unwrap();
+        super::adopt_settings(&current, &[], &legacy, Some(&legacy_eframe)).unwrap();
        assert_eq!(std::fs::read_to_string(current.join("app.ron")).unwrap(), "(mine)");
        assert!(!current.join("graphics.json").exists());
        let _ = std::fs::remove_dir_all(&d);
@@ -1046,6 +1482,34 @@ mod msaa_tests {
        }
    }

+    #[test]
+    fn scene_sample_choices_include_the_scene_depth_format() {
+        use eframe::wgpu::TextureFormat;
+        for (bits, expected) in [(24, TextureFormat::Depth24PlusStencil8), (32, TextureFormat::Depth32FloatStencil8)] {
+            // A synthetic colour target supports 8x, but the scene depth supports only 1x/4x.
+            let supported = super::scene_sample_choices(bits, 8, |depth| match depth {
+                Some(format) if format == expected => vec![1, 4],
+                None => vec![1, 4, 8],
+                other => panic!("unexpected scene depth: {other:?}"),
+            });
+            assert_eq!(supported, [1, 4]);
+            assert_eq!(super::scene_samples(eframe::wgpu::Backend::Dx12, 8, &supported), 4);
+        }
+    }
+
+    #[test]
+    fn scene_msaa_keeps_four_samples_by_default_and_explicit_choices() {
+        use eframe::wgpu::Backend;
+        let default = super::scene_msaa_request(None);
+        assert_eq!(default, 4);
+        for backend in [Backend::Dx12, Backend::Vulkan, Backend::Metal] {
+            assert_eq!(super::scene_samples(backend, u32::from(default), &[1, 4]), 4);
+        }
+        for saved in [1, 2, 4, 8] {
+            assert_eq!(super::scene_msaa_request(Some(saved)), saved);
+        }
+    }
+
    #[test]
    fn the_scene_follows_the_backend_policy_too() {
        use eframe::wgpu::Backend;
@@ -0,0 +1,879 @@
+//! macOS: what a crash in native code leaves behind (docs/crash-reports.md).
+//!
+//! A crash inside a graphics driver or another library (a segfault, an `abort()`, a stack
+//! overflow) is no Rust panic: the panic hook never runs and the next start only found "an
+//! unclean exit". A signal handler for SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP (how a trap
+//! instruction arrives on Apple silicon) and SIGABRT now writes, before the process goes, the
+//! same small JSON file as the Windows filter (`native_crash.rs`): the signal, the faulting
+//! module and the offset into it, and a short frame-pointer walk, next to the run's crash journal
+//! (`solidcraft_engine::crash::native_paths`). The next start puts it into the unclean exit's
+//! report. The signal then goes on to the handler that was there before (the standard library's
+//! stack overflow message) or to the default action, so the process still dies of it and macOS
+//! still writes its own crash report (`~/Library/Logs/DiagnosticReports`; the file names the
+//! `pid` the JSON records).
+//!
+//! Installing a signal handler and asking dyld which image holds an address have no safe API,
+//! hence the `unsafe_code` allowance on this module (the app crate denies it). The handler runs
+//! on a thread that may have a broken heap, or on the small alternate stack after a stack
+//! overflow: it doesn't allocate, formats into a buffer on the stack, and only reads memory on
+//! the thread's own stack. It writes what it knows from the signal first and only then calls
+//! `dladdr` (not on POSIX's async-signal-safe list; it takes dyld's recursive reader lock and
+//! doesn't allocate) to name the modules, rewriting the file, so a hang or a fault in there
+//! still leaves a record.
+#![allow(unsafe_code)]
+
+use std::ffi::{CStr, CString, c_int, c_void};
+use std::fmt::Write as _;
+use std::os::unix::ffi::OsStrExt;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicI32, AtomicUsize, Ordering};
+
+use libc::{SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP, siginfo_t};
+
+/// The signals a crash arrives as, in the order of [`PREVIOUS`].
+const SIGNALS: [c_int; 6] = [SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP, SIGABRT];
+/// Frames the walk records (the faulting instruction first).
+const MAX_FRAMES: usize = 24;
+/// A fault this far below a thread's stack is taken for a stack overflow.
+const GUARD: usize = 64 << 10;
+
+/// Where the handler writes (NUL-terminated), set once by [`install`].
+static PATH: OnceLock<CString> = OnceLock::new();
+/// The handler that was installed before ours for each of [`SIGNALS`] (called after ours), as an
+/// address (`SIG_DFL` is 0, `SIG_IGN` 1), and its `sa_flags`.
+static PREVIOUS: [AtomicUsize; 6] = [const { AtomicUsize::new(libc::SIG_DFL) }; 6];
+static PREVIOUS_FLAGS: [AtomicI32; 6] = [const { AtomicI32::new(0) }; 6];
+/// The handler has started writing (a second signal while it does is only passed on).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+/// Catch native crashes from now on (after `solidcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, _)) = solidcraft_engine::crash::native_paths() else { return };
+    let Ok(path) = CString::new(info.as_os_str().as_bytes()) else { return };
+    if PATH.set(path).is_err() {
+        return;
+    }
+    for (slot, &signal) in SIGNALS.iter().enumerate() {
+        // SAFETY: `sigaction` is plain data; all zeros is a valid (empty) value.
+        let mut ours: libc::sigaction = unsafe { std::mem::zeroed() };
+        ours.sa_sigaction = handler as *const () as usize;
+        // On the alternate stack the standard library gives each of its threads, so that a stack
+        // overflow can still be recorded.
+        ours.sa_flags = libc::SA_SIGINFO | libc::SA_ONSTACK;
+        // SAFETY: as above.
+        let mut old: libc::sigaction = unsafe { std::mem::zeroed() };
+        // SAFETY: `handler` has the signature SA_SIGINFO calls it with and stays valid for the
+        // process's life; both structs are valid for the call.
+        if unsafe { libc::sigaction(signal, &ours, &mut old) } == 0
+            && old.sa_sigaction != ours.sa_sigaction
+            && let (Some(p), Some(f)) = (PREVIOUS.get(slot), PREVIOUS_FLAGS.get(slot))
+        {
+            f.store(old.sa_flags, Ordering::SeqCst);
+            p.store(old.sa_sigaction, Ordering::SeqCst);
+        }
+    }
+}
+
+/// The signal handler: record, then pass the signal on.
+unsafe extern "C" fn handler(signal: c_int, info: *mut siginfo_t, context: *mut c_void) {
+    // SAFETY: `__error` is this thread's errno, restored for whatever runs after us.
+    let errno = unsafe { *libc::__error() };
+    let slot = SIGNALS.iter().position(|&s| s == signal).unwrap_or(0);
+    let previous = PREVIOUS.get(slot).map_or(libc::SIG_DFL, |p| p.load(Ordering::SeqCst));
+    // SAFETY: the system passes a valid siginfo and the interrupted thread's context for the
+    // duration of an SA_SIGINFO handler.
+    let f = unsafe { fault(signal, info, context) };
+    // Someone sent a signal the app ignored before: still nothing to record.
+    let ignored = previous == libc::SIG_IGN && !f.fault;
+    if !ignored && !BUSY.swap(true, Ordering::SeqCst) {
+        record(&f);
+    }
+    // SAFETY: as above.
+    unsafe { pass_on(signal, slot, previous, f.fault, info, context) };
+    // SAFETY: as above.
+    unsafe { *libc::__error() = errno };
+}
+
+/// The signal comes from the faulting instruction itself (not `kill`, `raise` or `abort`), so
+/// returning runs it again: on arm64, the exception the thread last took matches the signal.
+/// macOS gives a SIGSEGV sent with `kill` the same `si_code` as a real one (SEGV_ACCERR), but
+/// the exception is then the thread's last system call (or something long past, whose fault
+/// address doesn't match).
+#[cfg(any(target_arch = "aarch64", test))]
+fn arm64_fault(signal: c_int, si_code: c_int, addr: usize, esr: u32, far: u64) -> bool {
+    const ABORTS: [u32; 4] = [0x20, 0x21, 0x24, 0x25];
+    const SVC: u32 = 0x15;
+    let class = esr >> 26;
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => ABORTS.contains(&class) && far as usize == addr,
+            _ => class != SVC && !ABORTS.contains(&class),
+        }
+}
+
+/// As [`arm64_fault`], from the x86 trap number and page-fault address.
+#[cfg(any(target_arch = "x86_64", test))]
+fn x86_fault(signal: c_int, si_code: c_int, addr: usize, trapno: u16, faultvaddr: u64) -> bool {
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => (trapno == 14 && faultvaddr as usize == addr) || matches!(trapno, 12 | 13),
+            SIGILL => trapno == 6,
+            SIGFPE => matches!(trapno, 0 | 16 | 19),
+            SIGTRAP => matches!(trapno, 1 | 3),
+            _ => false,
+        }
+}
+
+/// Hand the signal to the previous handler, or to the default action. A crash signal that was
+/// only sent goes to the default action: the handler before ours (the standard library's, for
+/// SIGSEGV and SIGBUS) expects a fault that happens again when it returns.
+unsafe fn pass_on(signal: c_int, slot: usize, previous: usize, fault: bool, info: *mut siginfo_t, context: *mut c_void) {
+    let ours = handler as *const () as usize;
+    if previous != libc::SIG_DFL && previous != libc::SIG_IGN && previous != ours && (fault || signal == SIGABRT) {
+        let flags = PREVIOUS_FLAGS.get(slot).map_or(0, |f| f.load(Ordering::SeqCst));
+        if flags & libc::SA_SIGINFO != 0 {
+            // SAFETY: the address came from `sigaction` as an SA_SIGINFO handler.
+            let previous: unsafe extern "C" fn(c_int, *mut siginfo_t, *mut c_void) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal, info, context) };
+        } else {
+            // SAFETY: the address came from `sigaction` as a plain handler.
+            let previous: unsafe extern "C" fn(c_int) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal) };
+        }
+        return;
+    }
+    if previous == libc::SIG_IGN && !fault {
+        return;
+    }
+    // SAFETY: as in `install`.
+    let mut default: libc::sigaction = unsafe { std::mem::zeroed() };
+    default.sa_sigaction = libc::SIG_DFL;
+    // SAFETY: a valid struct; restoring the default action is async-signal-safe.
+    unsafe { libc::sigaction(signal, &default, std::ptr::null_mut()) };
+    // A fault happens again when we return, now with the default action, so macOS reports it at
+    // the instruction; anything else is raised again, and arrives once this handler returns.
+    if !fault {
+        // SAFETY: async-signal-safe.
+        unsafe { libc::raise(signal) };
+    }
+}
+
+/// The darwin `ucontext_t`, up to the pointer to the machine context (`<sys/_types/_ucontext.h>`).
+#[repr(C)]
+struct UContext {
+    _onstack: c_int,
+    _sigmask: u32,
+    _stack: libc::stack_t,
+    _link: *mut c_void,
+    _mcsize: usize,
+    mcontext: *const MContext,
+}
+
+/// The darwin arm64 machine context: exception state, then the general registers
+/// (`<mach/arm/_structs.h>`; the floating-point state that follows isn't read).
+#[cfg(target_arch = "aarch64")]
+#[repr(C)]
+struct MContext {
+    far: u64,
+    esr: u32,
+    _exception: u32,
+    _x: [u64; 29],
+    fp: u64,
+    _lr: u64,
+    _sp: u64,
+    pc: u64,
+}
+
+/// The darwin x86_64 machine context: exception state, then the general registers
+/// (`<mach/i386/_structs.h>`; rax rbx rcx rdx rdi rsi rbp rsp r8–r15, then rip).
+#[cfg(target_arch = "x86_64")]
+#[repr(C)]
+struct MContext {
+    trapno: u16,
+    _cpu: u16,
+    err: u32,
+    faultvaddr: u64,
+    gpr: [u64; 16],
+    rip: u64,
+}
+
+/// What the faulting instruction did to its address, when the processor says.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Access {
+    Unknown,
+    Read,
+    Write,
+    Execute,
+}
+
+/// What a crash signal says, read out of the signal before anything is looked up.
+#[derive(Clone, Copy, Debug)]
+struct Fault {
+    signal: c_int,
+    si_code: c_int,
+    /// `si_addr`: the address that faulted (for SIGILL, SIGFPE and SIGTRAP, the instruction).
+    addr: usize,
+    pc: usize,
+    fp: usize,
+    access: Access,
+    /// It comes from the faulting instruction (not `kill`, `raise` or `abort`).
+    fault: bool,
+    /// The process that sent the signal (0 or our own for a fault or an `abort()`).
+    sender: i32,
+    pid: i32,
+    thread: u64,
+    thread_name: [u8; 64],
+    /// The thread's stack, `[low, high)` (0, 0 when unknown).
+    stack: (usize, usize),
+}
+
+impl Fault {
+    /// The fault hit just below the thread's stack: the stack ran out.
+    fn overflow(&self) -> bool {
+        let (low, high) = self.stack;
+        matches!(self.signal, SIGSEGV | SIGBUS) && high > low && self.addr < low.saturating_add(4096) && self.addr >= low.saturating_sub(GUARD)
+    }
+
+    fn signal_name(&self) -> &'static str {
+        match self.signal {
+            SIGSEGV => "SIGSEGV",
+            SIGBUS => "SIGBUS",
+            SIGILL => "SIGILL",
+            SIGFPE => "SIGFPE",
+            SIGTRAP => "SIGTRAP",
+            SIGABRT => "SIGABRT",
+            _ => "signal",
+        }
+    }
+
+    fn name(&self) -> &'static str {
+        if self.overflow() {
+            return "stack overflow";
+        }
+        match self.signal {
+            SIGSEGV => "segmentation fault",
+            SIGBUS => "bus error",
+            SIGILL => "illegal instruction",
+            SIGFPE => "arithmetic exception",
+            SIGTRAP => "trap",
+            SIGABRT => "abort",
+            _ => "signal",
+        }
+    }
+
+    /// The `si_code` names that say something about a crash.
+    fn code_name(&self) -> Option<&'static str> {
+        Some(match (self.signal, self.si_code) {
+            (SIGSEGV, 1) => "SEGV_MAPERR",
+            (SIGSEGV, 2) => "SEGV_ACCERR",
+            (SIGBUS, 1) => "BUS_ADRALN",
+            (SIGBUS, 2) => "BUS_ADRERR",
+            (SIGBUS, 3) => "BUS_OBJERR",
+            (SIGFPE, 7) => "FPE_INTDIV",
+            (SIGFPE, 8) => "FPE_INTOVF",
+            _ => return None,
+        })
+    }
+
+    /// One line on what happened: the address read or written, a stack overflow, who sent it.
+    fn detail(&self, b: &mut Buf) {
+        if self.sender != 0 && self.sender != self.pid {
+            let _ = write!(b, "sent by process {}", self.sender);
+            return;
+        }
+        if !self.fault {
+            if self.signal != SIGABRT {
+                let _ = b.write_str("sent with kill or raise, not a fault");
+            }
+            return;
+        }
+        let what = match self.access {
+            Access::Read => "read of",
+            Access::Write => "write to",
+            Access::Execute => "execution at",
+            Access::Unknown => "access to",
+        };
+        if self.overflow() {
+            let _ = write!(b, "{what} 0x{:016X}, below the thread's stack", self.addr);
+        } else if matches!(self.signal, SIGSEGV | SIGBUS) {
+            let _ = write!(b, "{what} 0x{:016X}", self.addr);
+        } else {
+            let _ = write!(b, "at 0x{:016X}", self.addr);
+        }
+        if let Some(c) = self.code_name() {
+            let _ = write!(b, " ({c})");
+        }
+    }
+}
+
+/// An image that holds an address, as `dladdr` names it.
+struct Module<'a> {
+    path: &'a [u8],
+    base: usize,
+    symbol: Option<(&'a [u8], usize)>,
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 8192],
+    len: usize,
+}
+
+impl Buf {
+    fn new() -> Buf {
+        Buf { bytes: [0; 8192], len: 0 }
+    }
+
+    fn room(&self) -> usize {
+        self.bytes.len().saturating_sub(self.len)
+    }
+
+    fn as_bytes(&self) -> &[u8] {
+        self.bytes.get(..self.len).unwrap_or_default()
+    }
+
+    /// `s` as the inside of a JSON string, at most `max` bytes of it (bytes that aren't UTF-8
+    /// and control characters become `?`).
+    fn escaped(&mut self, s: &[u8], max: usize) {
+        for chunk in s.get(..s.len().min(max)).unwrap_or_default().utf8_chunks() {
+            for c in chunk.valid().chars() {
+                let _ = match c {
+                    '"' => self.write_str("\\\""),
+                    '\\' => self.write_str("\\\\"),
+                    c if (c as u32) < 0x20 => self.write_str("?"),
+                    c => self.write_char(c),
+                };
+            }
+            if !chunk.invalid().is_empty() {
+                let _ = self.write_str("?");
+            }
+        }
+    }
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let n = s.len().min(self.room());
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The last part of a path.
+fn file_name(path: &[u8]) -> &[u8] {
+    path.rsplit(|&c| c == b'/').next().unwrap_or(path)
+}
+
+/// The report: what the signal says, then (with `resolve`) the module of the faulting
+/// instruction and the `frames`. Always valid JSON: frames stop while there is room to close it.
+fn json(b: &mut Buf, f: &Fault, frames: &[usize], resolve: impl Fn(usize, bool) -> Option<Module<'static>>) {
+    let signal = f.signal_name();
+    let _ = write!(b, "{{\"signal\":\"{signal}\",\"number\":{},\"code\":\"{signal}\",\"name\":\"{}\"", f.signal, f.name());
+    let _ = write!(b, ",\"si_code\":{},\"address\":\"0x{:016X}\",\"thread\":{},\"pid\":{}", f.si_code, f.pc, f.thread, f.pid);
+    let name = f.thread_name.split(|&c| c == 0).next().unwrap_or_default();
+    if !name.is_empty() {
+        let _ = b.write_str(",\"thread_name\":\"");
+        b.escaped(name, 64);
+        let _ = b.write_str("\"");
+    }
+    let mark = b.len;
+    let _ = b.write_str(",\"detail\":\"");
+    let start = b.len;
+    f.detail(b);
+    if b.len == start {
+        b.len = mark;
+    } else {
+        let _ = b.write_str("\"");
+    }
+    if let Some(m) = resolve(f.pc, false) {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", f.pc.wrapping_sub(m.base));
+        b.escaped(m.path, 300);
+        let _ = b.write_str("\"");
+    }
+    if !frames.is_empty() {
+        let _ = b.write_str(",\"frames\":[");
+        for (i, &at) in frames.iter().enumerate() {
+            // A frame is at most ~300 bytes; keep room for it and the closing `]}`.
+            if b.room() < 400 {
+                break;
+            }
+            if i > 0 {
+                let _ = b.write_str(",");
+            }
+            let _ = b.write_str("\"");
+            // A return address points after the call: look up the call itself.
+            match resolve(at, i > 0) {
+                Some(m) => {
+                    b.escaped(file_name(m.path), 100);
+                    let _ = write!(b, "+0x{:X}", at.wrapping_sub(m.base));
+                    if let Some((symbol, start)) = m.symbol {
+                        let _ = b.write_str(" ");
+                        b.escaped(symbol, 160);
+                        let _ = write!(b, "+0x{:X}", at.wrapping_sub(start));
+                    }
+                }
+                None => {
+                    let _ = write!(b, "0x{at:016X}");
+                }
+            }
+            let _ = b.write_str("\"");
+        }
+        let _ = b.write_str("]");
+    }
+    let _ = b.write_str("}");
+}
+
+/// The return addresses up the frame-pointer chain from `fp`, after `pc`. `read` gives the word
+/// at an address; frames outside `stack`, misaligned or not going up end the walk.
+fn walk(pc: usize, fp: usize, stack: (usize, usize), read: impl Fn(usize) -> Option<usize>, out: &mut [usize; MAX_FRAMES]) -> usize {
+    let (low, high) = stack;
+    let mut n = 0;
+    if let Some(slot) = out.get_mut(n) {
+        *slot = pc;
+        n += 1;
+    }
+    let mut fp = fp;
+    while n < MAX_FRAMES {
+        let in_stack = fp >= low && fp.checked_add(16).is_some_and(|end| end <= high);
+        if !fp.is_multiple_of(8) || !in_stack {
+            break;
+        }
+        let (Some(next), Some(ret)) = (read(fp), read(fp + 8)) else { break };
+        let ret = strip_pointer_auth(ret);
+        if ret == 0 {
+            break;
+        }
+        if let Some(slot) = out.get_mut(n) {
+            *slot = ret;
+            n += 1;
+        }
+        if next <= fp {
+            break;
+        }
+        fp = next;
+    }
+    n
+}
+
+/// Return addresses saved by arm64e code carry a signature in their top bits.
+fn strip_pointer_auth(addr: usize) -> usize {
+    if cfg!(target_arch = "aarch64") { addr & 0x0000_7FFF_FFFF_FFFF } else { addr }
+}
+
+/// Read what the signal and the interrupted thread's registers say.
+unsafe fn fault(signal: c_int, info: *const siginfo_t, context: *const c_void) -> Fault {
+    let mut f = Fault {
+        signal,
+        si_code: 0,
+        addr: 0,
+        pc: 0,
+        fp: 0,
+        access: Access::Unknown,
+        fault: false,
+        sender: 0,
+        // SAFETY: async-signal-safe.
+        pid: unsafe { libc::getpid() },
+        thread: 0,
+        thread_name: [0; 64],
+        stack: (0, 0),
+    };
+    if !info.is_null() {
+        // SAFETY: the system passes a valid siginfo for the duration of the handler.
+        let info = unsafe { &*info };
+        f.si_code = info.si_code;
+        f.addr = info.si_addr as usize;
+        f.sender = info.si_pid;
+        // Without registers (never seen), the signal's own code has to do.
+        f.fault = signal != SIGABRT && (1..0x10000).contains(&f.si_code);
+    }
+    let context = context as *const UContext;
+    // SAFETY: an SA_SIGINFO handler's third argument is the interrupted thread's ucontext, whose
+    // machine context pointer the kernel fills in.
+    let mcontext = if context.is_null() { std::ptr::null() } else { unsafe { (*context).mcontext } };
+    if !mcontext.is_null() {
+        // SAFETY: as above.
+        let m = unsafe { &*mcontext };
+        #[cfg(target_arch = "aarch64")]
+        {
+            f.pc = strip_pointer_auth(m.pc as usize);
+            f.fp = m.fp as usize;
+            f.fault = arm64_fault(signal, f.si_code, f.addr, m.esr, m.far);
+            // A data abort says whether it was a write (WnR); an instruction abort is execution.
+            f.access = match m.esr >> 26 {
+                0x24 | 0x25 if m.esr & (1 << 6) != 0 => Access::Write,
+                0x24 | 0x25 => Access::Read,
+                0x20 | 0x21 => Access::Execute,
+                _ => Access::Unknown,
+            };
+        }
+        #[cfg(target_arch = "x86_64")]
+        {
+            f.pc = m.rip as usize;
+            f.fp = m.gpr.get(6).copied().unwrap_or(0) as usize;
+            f.fault = x86_fault(signal, f.si_code, f.addr, m.trapno, m.faultvaddr);
+            // A page fault's error code: bit 4 instruction fetch, bit 1 write.
+            f.access = match (m.trapno, m.err) {
+                (14, e) if e & 0x10 != 0 => Access::Execute,
+                (14, e) if e & 0x2 != 0 => Access::Write,
+                (14, _) => Access::Read,
+                _ => Access::Unknown,
+            };
+        }
+    }
+    if f.pc == 0 && matches!(signal, SIGILL | SIGFPE | SIGTRAP) {
+        f.pc = f.addr;
+    }
+    // SAFETY: these read the calling thread's own pthread structure; the buffers are as long as
+    // we say.
+    unsafe {
+        let me = libc::pthread_self();
+        libc::pthread_threadid_np(me, &mut f.thread);
+        libc::pthread_getname_np(me, f.thread_name.as_mut_ptr().cast(), f.thread_name.len());
+        let high = libc::pthread_get_stackaddr_np(me) as usize;
+        let size = libc::pthread_get_stacksize_np(me);
+        if let Some(low) = high.checked_sub(size) {
+            f.stack = (low, high);
+        }
+    }
+    f
+}
+
+/// The image that holds `addr` (the call before it, for a return address).
+fn resolve(addr: usize, return_address: bool) -> Option<Module<'static>> {
+    let at = if return_address { addr.saturating_sub(1) } else { addr };
+    // SAFETY: `Dl_info` is plain data; all zeros is a valid value.
+    let mut info: libc::Dl_info = unsafe { std::mem::zeroed() };
+    // SAFETY: `dladdr` only reads dyld's image list; the strings it returns live as long as the
+    // image, which a crashing process never unloads.
+    unsafe {
+        if libc::dladdr(at as *const c_void, &mut info) == 0 || info.dli_fname.is_null() {
+            return None;
+        }
+        let symbol = (!info.dli_sname.is_null()).then(|| (CStr::from_ptr(info.dli_sname).to_bytes(), info.dli_saddr as usize));
+        Some(Module { path: CStr::from_ptr(info.dli_fname).to_bytes(), base: info.dli_fbase as usize, symbol })
+    }
+}
+
+/// Write what the signal says into the info file, then again with the modules and frames.
+fn record(f: &Fault) {
+    let Some(path) = PATH.get() else { return };
+    // SAFETY: NUL-terminated path; the descriptor is closed below.
+    let fd = unsafe { libc::open(path.as_ptr(), libc::O_WRONLY | libc::O_CREAT | libc::O_TRUNC | libc::O_CLOEXEC, 0o600) };
+    if fd < 0 {
+        return;
+    }
+    let mut b = Buf::new();
+    json(&mut b, f, &[], |_, _| None);
+    let bytes = b.as_bytes();
+    // SAFETY: the buffer is as long as we say.
+    unsafe { libc::write(fd, bytes.as_ptr().cast(), bytes.len()) };
+    let mut frames = [0usize; MAX_FRAMES];
+    // SAFETY: `walk` only reads inside the thread's own stack, 8-byte aligned.
+    let n = walk(f.pc, f.fp, f.stack, |at| Some(unsafe { (at as *const usize).read() }), &mut frames);
+    b.len = 0;
+    json(&mut b, f, frames.get(..n).unwrap_or_default(), resolve);
+    let bytes = b.as_bytes();
+    // SAFETY: as above.
+    unsafe {
+        if libc::pwrite(fd, bytes.as_ptr().cast(), bytes.len(), 0) == bytes.len() as isize {
+            libc::ftruncate(fd, bytes.len() as libc::off_t);
+        }
+        libc::close(fd);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::process::ExitStatusExt;
+    use std::path::{Path, PathBuf};
+
+    use super::*;
+
+    fn fault(signal: c_int, si_code: c_int, addr: usize) -> Fault {
+        let mut thread_name = [0u8; 64];
+        thread_name[..4].copy_from_slice(b"main");
+        Fault {
+            signal,
+            si_code,
+            addr,
+            pc: 0x1_0000_1234,
+            fp: 0,
+            access: Access::Read,
+            fault: true,
+            sender: 0,
+            pid: 77,
+            thread: 4242,
+            thread_name,
+            stack: (0x7000_0000, 0x7080_0000),
+        }
+    }
+
+    fn report(f: &Fault, frames: &[usize]) -> serde_json::Value {
+        let mut b = Buf::new();
+        json(&mut b, f, frames, |at, _| {
+            (at >= 0x1_0000_0000).then_some(Module {
+                path: b"/Applications/SolidCraft.app/Contents/MacOS/solidcraft",
+                base: 0x1_0000_0000,
+                symbol: Some((b"_ZN4main17h0123456789abcdefE", 0x1_0000_1200)),
+            })
+        });
+        serde_json::from_slice(b.as_bytes()).unwrap()
+    }
+
+    #[test]
+    fn a_segfault_says_the_signal_the_address_read_and_the_module() {
+        let v = report(&fault(SIGSEGV, 1, 0x10), &[0x1_0000_1234, 0x1_0000_2000, 0x5000]);
+        assert_eq!(v["signal"], "SIGSEGV");
+        assert_eq!(v["code"], "SIGSEGV");
+        assert_eq!(v["name"], "segmentation fault");
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_MAPERR)");
+        assert_eq!(v["address"], "0x0000000100001234");
+        assert_eq!(v["module"], "/Applications/SolidCraft.app/Contents/MacOS/solidcraft");
+        assert_eq!(v["offset"], "0x1234");
+        assert_eq!(v["thread"], 4242);
+        assert_eq!(v["thread_name"], "main");
+        assert_eq!(v["pid"], 77);
+        let frames: Vec<&str> = v["frames"].as_array().unwrap().iter().map(|f| f.as_str().unwrap()).collect();
+        assert_eq!(
+            frames,
+            ["solidcraft+0x1234 _ZN4main17h0123456789abcdefE+0x34", "solidcraft+0x2000 _ZN4main17h0123456789abcdefE+0xE00", "0x0000000000005000"]
+        );
+    }
+
+    #[test]
+    fn a_fault_below_the_stack_is_a_stack_overflow() {
+        let mut f = fault(SIGBUS, 2, 0x7000_0000 - 0x100);
+        f.access = Access::Write;
+        let v = report(&f, &[]);
+        assert_eq!(v["name"], "stack overflow");
+        assert_eq!(v["code"], "SIGBUS");
+        assert_eq!(v["detail"], "write to 0x000000006FFFFF00, below the thread's stack (BUS_ADRERR)");
+        // Far below it, or inside it, it is not.
+        assert_eq!(report(&fault(SIGBUS, 2, 0x10), &[])["name"], "bus error");
+        assert_eq!(report(&fault(SIGSEGV, 2, 0x7040_0000), &[])["name"], "segmentation fault");
+        // Nor without knowing the stack.
+        let mut f = fault(SIGSEGV, 1, 0x7000_0000 - 0x100);
+        f.stack = (0, 0);
+        assert_eq!(report(&f, &[])["name"], "segmentation fault");
+    }
+
+    #[test]
+    fn an_abort_or_a_signal_sent_by_another_process_has_no_address_detail() {
+        let mut f = fault(SIGABRT, 0, 0);
+        f.fault = false;
+        f.sender = 77;
+        let v = report(&f, &[]);
+        assert_eq!(v["signal"], "SIGABRT");
+        assert_eq!(v["name"], "abort");
+        assert!(v.get("detail").is_none(), "{v}");
+        let mut f = fault(SIGSEGV, 0x10001, 0);
+        f.fault = false;
+        f.sender = 501;
+        assert_eq!(report(&f, &[])["detail"], "sent by process 501");
+        // `kill` without a sender, or `raise`.
+        f.sender = 0;
+        assert_eq!(report(&f, &[])["detail"], "sent with kill or raise, not a fault");
+        // A trap names the instruction.
+        assert_eq!(report(&fault(SIGTRAP, 1, 0x1_0000_1234), &[])["detail"], "at 0x0000000100001234");
+    }
+
+    #[test]
+    fn only_a_fault_runs_again_when_the_handler_returns() {
+        // Measured on an M5 Pro, macOS 27: a read of address 16, then `kill -SEGV` while the
+        // thread waits in a system call. Both have si_code 2.
+        assert!(arm64_fault(SIGSEGV, 2, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x5600_0080, 0));
+        assert!(!arm64_fault(SIGBUS, 1, 0, 0x5600_0080, 0));
+        // A data abort long past, while the signal names no address.
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x9200_0046, 0x10));
+        // A trap instruction (BRK) or an undefined one; but not a system call.
+        assert!(arm64_fault(SIGTRAP, 1, 0x1000, 0xF200_0001, 0));
+        assert!(arm64_fault(SIGILL, 1, 0x1000, 0x0200_0000, 0));
+        assert!(!arm64_fault(SIGILL, 1, 0x1000, 0x5600_0080, 0));
+        // Sent: SI_USER, no code, or an abort.
+        assert!(!arm64_fault(SIGSEGV, 0x10001, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGTRAP, 0, 0, 0xF200_0001, 0));
+        assert!(!arm64_fault(SIGABRT, 1, 0, 0x5600_0080, 0));
+        // x86_64: a page fault at its address, a general protection fault, ud2, int3.
+        assert!(x86_fault(SIGSEGV, 1, 0x10, 14, 0x10));
+        assert!(!x86_fault(SIGSEGV, 1, 0, 14, 0x10));
+        assert!(x86_fault(SIGSEGV, 1, 0, 13, 0));
+        assert!(x86_fault(SIGILL, 1, 0x1000, 6, 0));
+        assert!(x86_fault(SIGTRAP, 1, 0x1000, 3, 0));
+        assert!(!x86_fault(SIGILL, 1, 0x1000, 14, 0));
+    }
+
+    #[test]
+    fn names_with_quotes_control_characters_or_bad_utf8_stay_valid_json() {
+        let mut f = fault(SIGILL, 1, 0x1_0000_1234);
+        f.thread_name = [0; 64];
+        f.thread_name[..7].copy_from_slice(b"a\"b\\\n\xFFc");
+        let v = report(&f, &[]);
+        assert_eq!(v["thread_name"], "a\"b\\??c");
+    }
+
+    #[test]
+    fn a_report_with_long_names_still_closes_its_json() {
+        let long: &'static [u8] = Box::leak(vec![b'x'; 4000].into_boxed_slice());
+        let f = fault(SIGSEGV, 1, 0x10);
+        let mut b = Buf::new();
+        json(&mut b, &f, &[0x1_0000_1234; MAX_FRAMES], |_, _| Some(Module { path: long, base: 0x1_0000_0000, symbol: Some((long, 0x1_0000_0000)) }));
+        let v: serde_json::Value = serde_json::from_slice(b.as_bytes()).unwrap();
+        assert_eq!(v["module"].as_str().unwrap().len(), 300);
+        let frames = v["frames"].as_array().unwrap();
+        assert!(!frames.is_empty() && frames.len() <= MAX_FRAMES, "{}", frames.len());
+    }
+
+    #[test]
+    fn the_frame_walk_stays_on_the_stack_and_goes_up() {
+        let stack = (0x1000, 0x2000);
+        // Three frames: 0x1100 -> 0x1200 -> 0x1300 -> 0 (end).
+        let memory = |at: usize| match at {
+            0x1100 => Some(0x1200),
+            0x1108 => Some(0xA),
+            0x1200 => Some(0x1300),
+            0x1208 => Some(0xB),
+            0x1300 => Some(0),
+            0x1308 => Some(0xC),
+            _ => None,
+        };
+        let mut out = [0; MAX_FRAMES];
+        let n = walk(0x9, 0x1100, stack, memory, &mut out);
+        assert_eq!(&out[..n], &[0x9, 0xA, 0xB, 0xC]);
+        // A frame pointer off the stack, misaligned, or one that doesn't go up ends the walk.
+        assert_eq!(walk(0x9, 0x3000, stack, memory, &mut out), 1);
+        assert_eq!(walk(0x9, 0x1101, stack, memory, &mut out), 1);
+        let looping = |at: usize| if at.is_multiple_of(16) { Some(at) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1100, stack, looping, &mut out), 2);
+        // A chain that never ends stops at MAX_FRAMES.
+        let endless = |at: usize| if at.is_multiple_of(16) { Some(at + 16) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1000, stack, endless, &mut out), MAX_FRAMES);
+    }
+
+    /// The child half: install crash reporting and the handler, then crash the way
+    /// `SOLIDCRAFT_NATIVE_CRASH_FAULT` says.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = solidcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234", built: "2026-10-25" };
+        let fresh = solidcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        let Some(fault) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_FAULT") else {
+            solidcraft_engine::crash::end_session();
+            return;
+        };
+        super::install();
+        solidcraft_engine::crash::phase("device creation");
+        match fault.to_str() {
+            Some("abort") => std::process::abort(),
+            Some("overflow") => println!("unreachable {}", recurse(0)),
+            Some("raise") => {
+                // SAFETY: none needed; this is the crash under test.
+                unsafe { libc::raise(SIGSEGV) };
+                println!("survived");
+            }
+            _ => segfault(),
+        }
+    }
+
+    /// Runs out of stack.
+    #[inline(never)]
+    fn recurse(n: u64) -> u64 {
+        let a = std::hint::black_box([n; 64]);
+        if n == u64::MAX { 0 } else { recurse(n + 1).wrapping_add(a[0]) }
+    }
+
+    /// The crash under test: a read of address 16, as a null struct pointer's field would be.
+    #[inline(never)]
+    fn segfault() {
+        // SAFETY: none; this is the crash under test.
+        let v = unsafe { std::ptr::read_volatile(std::hint::black_box(16usize) as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &Path, fault: Option<&str>) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash_macos::tests::child", "--test-threads=1", "--nocapture"]).env("SOLIDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if let Some(f) = fault {
+            c.env("SOLIDCRAFT_NATIVE_CRASH_FAULT", f);
+        }
+        c.output().unwrap()
+    }
+
+    /// Crash a child the way `fault` says; returns what the handler wrote and the next start's report.
+    fn crash(name: &str, fault: &str, signal: c_int) -> (serde_json::Value, serde_json::Value, String) {
+        let dir = std::env::temp_dir().join(format!("solidcraft-native-crash-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, Some(fault));
+        assert_eq!(out.status.signal(), Some(signal), "the child died of the signal itself: {out:?}");
+        let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+        let info =
+            std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).find(|p| p.to_string_lossy().ends_with(".native.json"));
+        let info = info.expect("the handler wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        // The next start reports it.
+        let out = run(&dir, None);
+        assert!(out.status.success(), "{out:?}");
+        let reports = solidcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = solidcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+        (v, r, stderr)
+    }
+
+    #[test]
+    fn a_segfault_is_reported_with_its_signal_module_frames_and_step() {
+        let (v, r, _) = crash("segv", "segv", SIGSEGV);
+        assert_eq!(v["signal"], "SIGSEGV", "{v}");
+        // Address 16 is in __PAGEZERO, mapped without access: SEGV_ACCERR.
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_ACCERR)", "{v}");
+        assert!(v["module"].as_str().unwrap().contains("solidcraft"), "the fault is in the test binary: {v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.len() >= 3, "{v}");
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("child")), "the walk reaches the test that crashed: {v}");
+        let message = r["message"].as_str().unwrap();
+        assert!(message.contains("segmentation fault (SIGSEGV) in solidcraft"), "{r}");
+        assert!(message.contains("during startup (device creation"), "{r}");
+        assert_eq!(r["kind"], "unclean_exit");
+        assert_eq!(r["native"]["signal"], "SIGSEGV");
+        assert!(r["backtrace"].as_array().unwrap().iter().any(|f| f.as_str().unwrap().contains("segfault")), "{r}");
+    }
+
+    #[test]
+    fn an_abort_is_reported_as_sigabrt_with_the_code_that_called_it() {
+        let (v, r, _) = crash("abrt", "abort", SIGABRT);
+        assert_eq!(v["signal"], "SIGABRT", "{v}");
+        assert!(v.get("detail").is_none(), "{v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("abort")), "{v}");
+        assert!(r["message"].as_str().unwrap().contains("abort (SIGABRT)"), "{r}");
+    }
+
+    #[test]
+    fn a_stack_overflow_is_recorded_and_the_standard_library_still_says_so() {
+        // The fault on the guard page is recorded on the alternate stack; the standard library's
+        // handler, called after ours, prints its message and aborts.
+        let (v, r, stderr) = crash("overflow", "overflow", SIGABRT);
+        assert!(matches!(v["signal"].as_str(), Some("SIGSEGV" | "SIGBUS")), "{v}");
+        assert_eq!(v["name"], "stack overflow", "{v}");
+        assert!(v["detail"].as_str().unwrap().contains("below the thread's stack"), "{v}");
+        assert!(stderr.contains("has overflowed its stack"), "{stderr}");
+        assert!(r["message"].as_str().unwrap().contains("stack overflow ("), "{r}");
+    }
+
+    #[test]
+    fn a_segfault_signal_that_was_only_sent_still_ends_the_app() {
+        // The standard library's handler, which comes before ours, returns expecting the fault
+        // to happen again; a sent signal never does, so it goes to the default action instead.
+        let (v, r, _) = crash("raise", "raise", SIGSEGV);
+        assert_eq!(v["detail"], "sent with kill or raise, not a fault", "{v}");
+        assert!(r["message"].as_str().unwrap().contains("(SIGSEGV)"), "{r}");
+    }
+}
@@ -15,10 +15,14 @@
 //! window rescales once at the crossing and stays under the pointer, instead of the OS's move
 //! loop and winit disagreeing about a frame the window doesn't have.
 //!
-//! Replacing a window procedure has no safe API, hence the `unsafe_code` allowance on this
-//! module (the app crate denies it; see `native_crash.rs` and `open_documents.rs` for the others).
+//! Replacing a window procedure and setting a window class's icon have no safe API, hence the
+//! `unsafe_code` allowance on this module (the app crate denies it; see `native_crash.rs` and
+//! `open_documents.rs` for the others).
 //! The procedure is installed once, on the thread that owns the window, for the main window only,
 //! and calls the previous one (winit's) for everything it doesn't answer.
+//!
+//! [`set_class_icon`] gives the window's class the exe's icon, so the taskbar button shows the
+//! mark even when the window is too busy to answer the taskbar's request for its icon.
 #![allow(unsafe_code)]

 use std::sync::atomic::{AtomicIsize, Ordering};
@@ -27,12 +31,18 @@ use raw_window_handle::{HasWindowHandle, RawWindowHandle};
 use solidcraft_ui_egui::titlebar;
 use windows_sys::Win32::Foundation::{HWND, LPARAM, LRESULT, RECT, SIZE, WPARAM};
 use windows_sys::Win32::Graphics::Gdi::{GetMonitorInfoW, MONITOR_DEFAULTTONEAREST, MONITORINFO, MonitorFromWindow};
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleW;
 use windows_sys::Win32::UI::HiDpi::{GetDpiForWindow, GetSystemMetricsForDpi};
 use windows_sys::Win32::UI::WindowsAndMessaging::{
-    CallWindowProcW, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTLEFT,
-    HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IsIconic, IsZoomed, SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SetWindowLongPtrW, WM_GETDPISCALEDSIZE,
-    WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
+    CallWindowProcW, GCLP_HICON, GCLP_HICONSM, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT,
+    HTBOTTOMRIGHT, HTLEFT, HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IMAGE_ICON, IsIconic, IsZoomed, LR_DEFAULTCOLOR, LoadImageW, SM_CXICON,
+    SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SM_CXSMICON, SetWindowLongPtrW, WM_GETDPISCALEDSIZE, WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
 };
+// windows-sys has SetClassLongPtrW only on 64-bit targets; on 32-bit Windows it is SetClassLongW.
+#[cfg(target_pointer_width = "64")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongPtrW;
+#[cfg(target_pointer_width = "32")]
+use windows_sys::Win32::UI::WindowsAndMessaging::SetClassLongW as SetClassLongPtrW;

 /// The work area (the monitor without the taskbar) of the monitor nearest the window, in physical
 /// pixels: left, top, width, height.
@@ -54,6 +64,48 @@ pub fn work_area(window: &impl HasWindowHandle) -> Option<(i32, i32, i32, i32)>
    Some((rc.left, rc.top, rc.right - rc.left, rc.bottom - rc.top))
 }

+/// The exe's icon resource (`build.rs` embeds it as `1 ICON`).
+const ICON_RESOURCE: usize = 1;
+
+/// Give the main window's class the exe's icon, big and small. Call it before the window is
+/// shown (eframe's app creator).
+///
+/// The taskbar asks a window for its icon when the window appears. eframe sets the window's
+/// icon before that, while the window is still hidden, and then shows the window at the end of
+/// its first frame; if that frame is slow, or startup kept the thread busy long enough for
+/// Windows to mark the window as not responding, the request isn't answered in time. The taskbar then
+/// takes the window class's icon and doesn't ask again. winit registers its class without one,
+/// so the button showed Windows' generic icon for as long as the window was open.
+/// `false` if it isn't a Win32 window or the exe's icon doesn't load; SetClassLongPtrW's own
+/// failure can't be told from a class that had no icon (both return 0), so it isn't reported.
+pub fn set_class_icon(window: &impl HasWindowHandle) -> bool {
+    let Ok(handle) = window.window_handle() else { return false };
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return false };
+    let hwnd = w.hwnd.get() as HWND;
+    // SAFETY: a plain query on the live main window.
+    let dpi = unsafe { GetDpiForWindow(hwnd) };
+    let (Some(big), Some(small)) = (exe_icon(SM_CXICON, dpi), exe_icon(SM_CXSMICON, dpi)) else { return false };
+    // SAFETY: `hwnd` is the live main window and both icons are valid handles. The class keeps
+    // them for the rest of the process, so they are never destroyed. `as _`: on 32-bit Windows
+    // this is SetClassLongW (see the imports), which takes an i32.
+    unsafe {
+        SetClassLongPtrW(hwnd, GCLP_HICON, big as _);
+        SetClassLongPtrW(hwnd, GCLP_HICONSM, small as _);
+    }
+    true
+}
+
+/// The exe's icon at the size of system metric `metric` (`SM_CXICON`, `SM_CXSMICON`) at `dpi`.
+fn exe_icon(metric: i32, dpi: u32) -> Option<windows_sys::Win32::Foundation::HANDLE> {
+    // SAFETY: GetModuleHandleW(null) is this exe, loaded for the life of the process; the name
+    // is an integer resource id (MAKEINTRESOURCE), which LoadImageW accepts in place of a string.
+    let icon = unsafe {
+        let size = GetSystemMetricsForDpi(metric, dpi);
+        LoadImageW(GetModuleHandleW(std::ptr::null()), std::ptr::without_provenance(ICON_RESOURCE), IMAGE_ICON, size, size, LR_DEFAULTCOLOR)
+    };
+    (!icon.is_null()).then_some(icon)
+}
+
 /// The window procedure ours replaced (winit's), as an address; 0 before [`install`].
 static PREVIOUS: AtomicIsize = AtomicIsize::new(0);

@@ -101,10 +101,12 @@ impl NativeMenu {
        ])?;
        for (action, label) in [
            ("docs", "Documentation"),
+            ("updates", app.tr("update.check_for_updates")),
            ("shortcuts", "Keyboard Shortcuts"),
            ("messages", "Messages\u{2026}"),
            ("report", "Report an Issue\u{2026}"),
            ("crashes", "Crash Reports\u{2026}"),
+            ("install_cli", "Install solidcraft-cli command"),
        ] {
            let item = MenuItem::new(app.tr_label(label), true, None);
            help.append(&item)?;
@@ -145,8 +147,7 @@ impl NativeMenu {
    }

    fn action_enabled(action: &FileAction, app: &SolveApp, ctx: &egui::Context) -> bool {
-        action.enabled(app)
-            || (matches!(action, FileAction::Undo | FileAction::Redo) && ctx.egui_wants_keyboard_input() && FileAction::Settings.enabled(app))
+        action.menu_enabled(app, ctx.egui_wants_keyboard_input())
    }

    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
@@ -156,6 +157,12 @@ impl NativeMenu {
                item.set_enabled(enabled);
            }
        }
+        for (item, action) in &self.help_actions {
+            let enabled = solidcraft_ui_egui::help::available(app, action);
+            if item.is_enabled() != enabled {
+                item.set_enabled(enabled);
+            }
+        }
        if !self.recent_paths.iter().eq(app.home.recent.iter().take(32))
            && let Err(error) = self.update_recent(app)
        {
@@ -0,0 +1,463 @@
+//! The navigation bridge: a 3D input device's own program (a homemade device's driver app) moves
+//! the view over a loopback connection, the way a 3D mouse driver hands its axes to the programs
+//! it supports, so the device emulates no mouse and the pointer stays the user's.
+//!
+//! The device app listens on `127.0.0.1:<port>`; with Preferences › Navigation › "Navigate with a
+//! device app" on (off by default), SolidCraft connects to it, says hello and reads one JSON
+//! object per line (docs/3d-mouse.md). The reader thread only sums the motion; the egui thread
+//! hands it to the view once per frame (`space_mouse::bridge_frame`). A device the app says it
+//! reads is left to it by the 3D mouse reader ([`Claim`]), so the view doesn't move twice.
+
+use std::io::{ErrorKind, Read, Write};
+use std::net::{Ipv4Addr, SocketAddr, TcpStream};
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::Duration;
+
+use egui::Context;
+use serde_json::{Value, json};
+use solidcraft_ui_egui::SolveApp;
+use solidcraft_ui_egui::space_mouse::{BRIDGE_VIEWS, BridgeMotion, bridge_frame, bridge_step};
+
+/// The longest line read; a longer one is skipped to its end.
+const MAX_LINE: usize = 4096;
+/// Standard views waiting for the next frame; past this many, more are a flood and dropped.
+const MAX_VIEWS: usize = 8;
+/// The longest name a device app may give for itself or its device, in characters.
+const MAX_NAME: usize = 64;
+/// How long a connection attempt waits.
+const CONNECT_TIMEOUT: Duration = Duration::from_millis(500);
+/// How long a read waits for data before the reader looks at the preferences again.
+const READ_WAKE: Duration = Duration::from_millis(250);
+/// The wait before connecting again when no device app answered or one went away.
+const RETRY_AFTER: Duration = Duration::from_secs(1);
+/// In zoom mode, a motion of this many points along Y is one zoom step: with 8 % a step, the 1 %
+/// a point that a zoom drag moves.
+const POINTS_PER_ZOOM_STEP: f64 = 8.0;
+
+/// What the device's motion drives, as the device app last said (`mode`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum Mode {
+    #[default]
+    Orbit,
+    Pan,
+    Zoom,
+}
+
+/// What the reader thread and the egui thread share.
+#[derive(Debug, Default)]
+struct Shared {
+    /// The port the preferences ask to connect to; none while the bridge is off.
+    wanted: Option<u16>,
+    /// The device app connected, by the name it gave ("?" until it gives one).
+    connected: Option<String>,
+    /// The device the connected app reads, as it named it: the 3D mouse reader leaves that one alone.
+    device: Option<String>,
+    /// Motion since the egui thread last took it.
+    motion: BridgeMotion,
+    /// Standard views asked for since then.
+    views: Vec<String>,
+}
+
+fn lock(shared: &Mutex<Shared>) -> Option<MutexGuard<'_, Shared>> {
+    shared.lock().ok()
+}
+
+/// A name a device app gave, without control characters and cut to [`MAX_NAME`]; none when empty.
+fn name(value: Option<&Value>) -> Option<String> {
+    let name: String = value?.as_str()?.chars().filter(|c| !c.is_control()).take(MAX_NAME).collect();
+    let name = name.trim();
+    (!name.is_empty()).then(|| name.to_string())
+}
+
+/// A number of a message, finite and in range; none when it isn't one.
+fn number(msg: &Value, key: &str) -> f64 {
+    bridge_step(msg.get(key).and_then(Value::as_f64).unwrap_or(0.0))
+}
+
+/// Takes one line from the device app into `shared`. Lines that aren't a message this version
+/// knows are ignored. Returns whether the view has something new to show.
+fn consume(line: &[u8], mode: &mut Mode, shared: &mut Shared) -> bool {
+    let Ok(msg) = serde_json::from_slice::<Value>(line) else { return false };
+    let add = |shared: &mut Shared, motion: BridgeMotion| {
+        shared.motion = shared.motion.plus(motion);
+        !motion.is_still()
+    };
+    match msg.get("t").and_then(Value::as_str) {
+        Some("axis") => {
+            let (x, y) = (number(&msg, "x"), number(&msg, "y"));
+            let motion = match mode {
+                Mode::Orbit => BridgeMotion { orbit: [x, y], ..Default::default() },
+                Mode::Pan => BridgeMotion { pan: [x, y], ..Default::default() },
+                // Up zooms in, as a zoom drag does.
+                Mode::Zoom => BridgeMotion { zoom: -y / POINTS_PER_ZOOM_STEP, ..Default::default() },
+            };
+            add(shared, motion)
+        }
+        Some("zoom") => add(shared, BridgeMotion { zoom: number(&msg, "d"), ..Default::default() }),
+        Some("mode") => {
+            let on = msg.get("on").and_then(Value::as_bool).unwrap_or(false);
+            *mode = match msg.get("mode").and_then(Value::as_str) {
+                Some("pan") if on => Mode::Pan,
+                Some("zoom") if on => Mode::Zoom,
+                _ => Mode::Orbit,
+            };
+            false
+        }
+        Some("view") => {
+            let view = msg.get("name").and_then(Value::as_str).and_then(|n| BRIDGE_VIEWS.iter().find(|v| **v == n));
+            match view {
+                Some(view) if shared.views.len() < MAX_VIEWS => {
+                    shared.views.push((*view).to_string());
+                    true
+                }
+                _ => false,
+            }
+        }
+        Some("hello") => {
+            shared.connected = name(msg.get("server")).or_else(|| shared.connected.clone());
+            shared.device = name(msg.get("device"));
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Splits what arrives into lines, across reads. A line longer than [`MAX_LINE`] is dropped up to
+/// its newline, so a peer that never sends one can't make the reader hold more than that.
+#[derive(Default)]
+struct Lines {
+    line: Vec<u8>,
+    skipping: bool,
+}
+
+impl Lines {
+    fn feed(&mut self, mut data: &[u8], mut each: impl FnMut(&[u8])) {
+        while !data.is_empty() {
+            let end = data.iter().position(|b| *b == b'\n');
+            let (part, rest) = match end {
+                Some(i) => (data.get(..i).unwrap_or_default(), data.get(i + 1..).unwrap_or_default()),
+                None => (data, &[][..]),
+            };
+            if !self.skipping {
+                let room = (MAX_LINE + 1).saturating_sub(self.line.len());
+                self.line.extend_from_slice(part.get(..room.min(part.len())).unwrap_or_default());
+                if self.line.len() > MAX_LINE {
+                    self.line.clear();
+                    self.skipping = true;
+                }
+            }
+            if end.is_some() {
+                if !self.skipping {
+                    each(self.line.strip_suffix(b"\r").unwrap_or(&self.line));
+                }
+                self.line.clear();
+                self.skipping = false;
+            }
+            data = rest;
+        }
+    }
+}
+
+/// What SolidCraft says first, so the device app knows which program it is driving.
+fn hello() -> Value {
+    json!({"t": "hello", "app": "solidcraft", "version": env!("CARGO_PKG_VERSION")})
+}
+
+/// Reads one connection until the device app closes it, it fails, or the preferences no longer
+/// ask for this port; then forgets what it had.
+fn serve(mut stream: TcpStream, port: u16, ctx: &Context, shared: &Mutex<Shared>) {
+    // Without a read timeout the reader couldn't notice the bridge being switched off.
+    if stream.set_read_timeout(Some(READ_WAKE)).is_err() || writeln!(stream, "{}", hello()).is_err() {
+        return;
+    }
+    let _ = stream.set_nodelay(true);
+    log::info!("navigation bridge: connected to 127.0.0.1:{port}");
+    if let Some(mut shared) = lock(shared) {
+        shared.connected = Some("?".into());
+    }
+    ctx.request_repaint();
+    let (mut lines, mut mode) = (Lines::default(), Mode::default());
+    let mut chunk = [0_u8; 4096];
+    while lock(shared).is_some_and(|shared| shared.wanted == Some(port)) {
+        match stream.read(&mut chunk) {
+            Ok(0) => break,
+            Ok(size) => {
+                let mut news = false;
+                if let Some(mut shared) = lock(shared) {
+                    lines.feed(chunk.get(..size).unwrap_or_default(), |line| news |= consume(line, &mut mode, &mut shared));
+                }
+                if news {
+                    ctx.request_repaint();
+                }
+            }
+            Err(error) if matches!(error.kind(), ErrorKind::WouldBlock | ErrorKind::TimedOut | ErrorKind::Interrupted) => {}
+            Err(error) => {
+                log::info!("navigation bridge: connection lost: {error}");
+                break;
+            }
+        }
+    }
+    if let Some(mut shared) = lock(shared) {
+        *shared = Shared { wanted: shared.wanted, ..Shared::default() };
+    }
+    ctx.request_repaint();
+}
+
+/// Connects to the device app while the preferences ask for it, again whenever it goes away.
+fn reader(ctx: Context, shared: Arc<Mutex<Shared>>) {
+    loop {
+        let Some(port) = lock(&shared).and_then(|shared| shared.wanted) else {
+            std::thread::sleep(READ_WAKE);
+            continue;
+        };
+        if let Ok(stream) = TcpStream::connect_timeout(&SocketAddr::from((Ipv4Addr::LOCALHOST, port)), CONNECT_TIMEOUT) {
+            serve(stream, port, &ctx, &shared);
+        }
+        std::thread::sleep(RETRY_AFTER);
+    }
+}
+
+/// Which 3D mouse the connected device app reads, for the 3D mouse reader to leave alone. Only
+/// the Windows and macOS readers know a device's strings to compare.
+#[derive(Clone)]
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+pub struct Claim(Arc<Mutex<Shared>>);
+
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+impl Claim {
+    /// Whether a device with these manufacturer and product strings is the one the connected
+    /// device app reads (its name appears in one, ignoring case).
+    pub fn claims(&self, strings: &[String]) -> bool {
+        let Some(device) = lock(&self.0).and_then(|shared| shared.device.clone()) else { return false };
+        let device = device.to_lowercase();
+        strings.iter().any(|s| s.to_lowercase().contains(&device))
+    }
+}
+
+pub struct NavBridge {
+    shared: Arc<Mutex<Shared>>,
+}
+
+impl NavBridge {
+    pub fn start(ctx: &Context) -> Self {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let (worker_ctx, worker_state) = (ctx.clone(), Arc::clone(&shared));
+        if let Err(error) = std::thread::Builder::new().name("solidcraft-nav-bridge".into()).spawn(move || reader(worker_ctx, worker_state)) {
+            log::warn!("navigation bridge: reader could not start: {error}");
+        }
+        Self { shared }
+    }
+
+    #[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+    pub fn claim(&self) -> Claim {
+        Claim(Arc::clone(&self.shared))
+    }
+
+    /// Each frame: passes the preferences to the reader, and the motion and views since the last
+    /// frame to the view. Motion that arrived while the window had no focus is dropped with it.
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
+        let wanted = Some(app.preferences.nav_bridge_port).filter(|port| app.preferences.nav_bridge_enabled && *port != 0);
+        let Some((motion, views, connected)) = lock(&self.shared).map(|mut shared| {
+            shared.wanted = wanted;
+            (std::mem::take(&mut shared.motion), std::mem::take(&mut shared.views), shared.connected.clone())
+        }) else {
+            return;
+        };
+        app.space_mouse.bridge = connected.filter(|_| wanted.is_some());
+        if !motion.is_still() || !views.is_empty() {
+            bridge_frame(app, ctx, motion, &views);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{BufRead, BufReader};
+    use std::net::TcpListener;
+    use std::time::Instant;
+
+    fn feed(shared: &mut Shared, mode: &mut Mode, text: &str) -> bool {
+        let mut news = false;
+        Lines::default().feed(text.as_bytes(), |line| news |= consume(line, mode, shared));
+        news
+    }
+
+    #[test]
+    fn axis_motion_orbits_pans_or_zooms_as_the_mode_says() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"axis\",\"x\":3,\"y\":-2}\n{\"t\":\"axis\",\"x\":1.5,\"y\":0}\n"));
+        assert_eq!(shared.motion, BridgeMotion { orbit: [4.5, -2.0], ..Default::default() });
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":true}\n{\"t\":\"axis\",\"x\":5,\"y\":6}\n");
+        assert_eq!(mode, Mode::Pan);
+        assert_eq!(shared.motion.pan, [5.0, 6.0]);
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"zoom\",\"on\":true}\n{\"t\":\"axis\",\"x\":0,\"y\":-16}\n");
+        assert_eq!(shared.motion.zoom, 2.0, "up zooms in, 8 points a step");
+        // Off, whichever mode it names, is back to orbit.
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":false}\n");
+        assert_eq!(mode, Mode::Orbit);
+        // The ring's steps add up with the zoom mode's.
+        feed(&mut shared, &mut mode, "{\"t\":\"zoom\",\"d\":-0.5}\n");
+        assert_eq!(shared.motion.zoom, 1.5);
+    }
+
+    #[test]
+    fn views_are_queued_by_their_known_names_only() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"iso\"}\n{\"t\":\"view\",\"name\":\"fit\"}\n"));
+        assert!(!feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"ISO\"}\n{\"t\":\"view\",\"name\":\"../etc\"}\n{\"t\":\"view\"}\n"));
+        assert_eq!(shared.views, ["iso", "fit"]);
+        let flood = "{\"t\":\"view\",\"name\":\"top\"}\n".repeat(100);
+        feed(&mut shared, &mut mode, &flood);
+        assert_eq!(shared.views.len(), MAX_VIEWS);
+    }
+
+    #[test]
+    fn hostile_lines_never_move_the_view_out_of_range() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        let lines = [
+            "not json",
+            "{\"t\":\"axis\",\"x\":\"5\",\"y\":null}",
+            "{\"t\":\"axis\",\"x\":1e308,\"y\":-1e308}",
+            "{\"t\":\"axis\",\"x\":1e999}",
+            "{\"t\":\"zoom\",\"d\":[1]}",
+            "{\"t\":42}",
+            "[1,2,3]",
+            "{\"t\":\"mode\",\"mode\":{\"x\":1},\"on\":\"yes\"}",
+            "\u{0}\u{1}\u{2}",
+        ];
+        for line in lines {
+            Lines::default().feed(format!("{line}\n").as_bytes(), |l| {
+                consume(l, &mut mode, &mut shared);
+            });
+        }
+        let limit = solidcraft_ui_egui::space_mouse::BRIDGE_MAX_STEP;
+        let values = shared.motion.orbit.into_iter().chain(shared.motion.pan).chain([shared.motion.zoom]);
+        for value in values {
+            assert!(value.is_finite() && value.abs() <= limit, "{value}");
+        }
+        assert_eq!(mode, Mode::Orbit);
+        // Invalid UTF-8 is no message either.
+        assert!(!consume(&[0xff, 0xfe, b'{', b'}'], &mut mode, &mut shared));
+    }
+
+    #[test]
+    fn lines_split_across_reads_and_long_ones_are_skipped_to_their_end() {
+        let mut got = Vec::new();
+        let mut lines = Lines::default();
+        for part in ["{\"t\":", "\"zoom\"}\r\n{\"a\"", ":1}\n"] {
+            lines.feed(part.as_bytes(), |line| got.push(String::from_utf8_lossy(line).to_string()));
+        }
+        assert_eq!(got, ["{\"t\":\"zoom\"}", "{\"a\":1}"]);
+        got.clear();
+        let long = vec![b'x'; MAX_LINE * 3];
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert!(lines.line.len() <= MAX_LINE + 1, "never holds more than one line");
+        lines.feed(b"tail\nnext\n", |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert_eq!(got, ["next"], "the long line is dropped to its newline, the next one read");
+    }
+
+    #[test]
+    fn the_device_app_names_itself_and_the_device_it_leaves_alone() {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let claim = Claim(Arc::clone(&shared));
+        let strings = ["STMicroelectronics".to_string(), "MAKMOUSE 3D".to_string()];
+        assert!(!claim.claims(&strings), "nothing is claimed before an app says so");
+        let mut mode = Mode::default();
+        if let Ok(mut shared) = shared.lock() {
+            let hello = format!("{{\"t\":\"hello\",\"server\":\"Dev\\u0007App {}\",\"device\":\"makmouse\"}}\n", "x".repeat(200));
+            feed(&mut shared, &mut mode, &hello);
+            assert_eq!(shared.connected.as_deref().map(|n| n.chars().count()), Some(MAX_NAME));
+            assert!(shared.connected.as_deref().is_some_and(|n| n.starts_with("DevApp")));
+        }
+        assert!(claim.claims(&strings), "the name matches ignoring case");
+        assert!(!claim.claims(&["3Dconnexion".to_string(), "SpaceMouse Compact".to_string()]), "another 3D mouse stays the reader's");
+    }
+
+    /// Waits until `check` holds, or fails after a few seconds.
+    fn wait_for(what: &str, mut check: impl FnMut() -> bool) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !check() {
+            assert!(Instant::now() < deadline, "timed out waiting for {what}");
+            std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+
+    #[test]
+    fn a_connection_says_hello_reads_the_stream_and_ends_when_the_bridge_is_switched_off() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (mut server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        let mut hello_line = String::new();
+        BufReader::new(server.try_clone().unwrap()).read_line(&mut hello_line).unwrap();
+        let hello: Value = serde_json::from_str(&hello_line).unwrap();
+        assert_eq!((hello["t"].as_str(), hello["app"].as_str()), (Some("hello"), Some("solidcraft")));
+        server
+            .write_all(b"{\"t\":\"hello\",\"server\":\"MAKMOUSE\",\"device\":\"MAKMOUSE\"}\n{\"t\":\"axis\",\"x\":2,\"y\":1}\n{\"t\":\"view\",\"name\":\"top\"}\n")
+            .unwrap();
+        wait_for("the stream", || shared.lock().is_ok_and(|s| s.motion.orbit == [2.0, 1.0] && s.views == ["top"]));
+        assert_eq!(shared.lock().unwrap().connected.as_deref(), Some("MAKMOUSE"));
+        // Switched off: the connection ends and what it had is forgotten.
+        shared.lock().unwrap().wanted = None;
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert!(after.connected.is_none() && after.device.is_none() && after.motion.is_still() && after.views.is_empty());
+    }
+
+    #[test]
+    fn a_closed_connection_forgets_the_app() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        wait_for("the connection", || shared.lock().is_ok_and(|s| s.connected.is_some()));
+        drop(server);
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert_eq!((after.connected.as_deref(), after.wanted), (None, Some(port)), "still wanted, so the reader connects again");
+    }
+
+    #[test]
+    fn each_frame_hands_the_view_the_motion_and_passes_the_preferences_on() {
+        let mut app = SolveApp::new(solidcraft_engine::Session::default(), solidcraft_ui_egui::Services::default());
+        app.home.open = false;
+        let ctx = Context::default();
+        let _ = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |_| {});
+        let mut bridge = NavBridge { shared: Arc::new(Mutex::new(Shared::default())) };
+        let queue = |bridge: &NavBridge| {
+            let mut shared = bridge.shared.lock().unwrap();
+            shared.connected = Some("MAKMOUSE".into());
+            shared.motion = BridgeMotion { orbit: [10.0, 0.0], ..Default::default() };
+        };
+        // Off (the default): nothing is wanted, nothing reaches the view.
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+        assert!(app.viewport.bridge_motion.is_none() && app.space_mouse.bridge.is_none());
+        // On: the port is passed to the reader and the motion to the view, once.
+        app.preferences.nav_bridge_enabled = true;
+        app.preferences.nav_bridge_port = 9123;
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, Some(9123));
+        assert_eq!(app.space_mouse.bridge.as_deref(), Some("MAKMOUSE"));
+        assert_eq!(app.viewport.bridge_motion.map(|m| m.orbit), Some([10.0, 0.0]));
+        assert!(bridge.shared.lock().unwrap().motion.is_still(), "taken, not handed over twice");
+        // Port 0 is no port.
+        app.preferences.nav_bridge_port = 0;
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+    }
+}
@@ -521,43 +521,175 @@ fn hid_api() -> hidapi::HidResult<HidApi> {
    HidApi::new()
 }

+/// An open 3D-mouse interface: the device, how its reports are laid out, and its vendor and
+/// product ids.
+#[cfg(any(target_os = "windows", target_os = "macos", test))]
+struct Candidate<D> {
+    device: D,
+    layout: Layout,
+    ids: (u16, u16),
+    /// The device's manufacturer and product strings ([`device_strings`]).
+    #[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+    strings: Vec<String>,
+}
+
+/// Input reports read with a timeout in milliseconds: hidapi's devices, and the tests' simulated
+/// ones. `Ok(0)` is a timeout; an error means the device is gone.
+#[cfg(any(target_os = "windows", target_os = "macos", test))]
+trait ReportSource {
+    fn read_report(&self, report: &mut [u8], timeout_ms: i32) -> Result<usize, String>;
+}
+
 #[cfg(any(target_os = "windows", target_os = "macos"))]
-fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
+impl ReportSource for hidapi::HidDevice {
+    fn read_report(&self, report: &mut [u8], timeout_ms: i32) -> Result<usize, String> {
+        self.read_timeout(report, timeout_ms).map_err(|error| error.to_string())
+    }
+}
+
+/// What following the candidates tells the reader.
+#[cfg(any(target_os = "windows", target_os = "macos", test))]
+enum Followed<'a> {
+    /// This device is the one read now, so its calibration applies. With the buttons it last
+    /// reported down, when it reported them while another was read: they are its baseline, so a
+    /// press that makes it the device in use counts as a press, not as a button already held.
+    Device((u16, u16), Option<u32>),
+    /// An input report from it.
+    Report(&'a Layout, &'a [u8]),
+    /// It is gone.
+    Gone,
+}
+
+/// Whether a report shows its device in use: an axis off zero or a button down. A cap at rest
+/// sends zeros at most, and an idle 3Dconnexion Universal Receiver sends nothing at all.
+#[cfg(any(target_os = "windows", target_os = "macos", test))]
+fn shows_use(layout: Layout, report: &[u8]) -> bool {
+    layout.decode(report).is_some_and(|decoded| decoded.axes.iter().flatten().any(|axis| *axis != 0) || decoded.buttons.is_some_and(|down| down != 0))
+}
+
+/// Reads every candidate and follows the one in use (#3988). The first is followed from the start,
+/// as when it was the only one read. Another takes over once it shows use while the followed one
+/// has shown none for `STALE_AFTER`, so two devices moved together don't hand the reading back
+/// and forth. An idle Universal Receiver opens fine and never fails; read on its own it kept a
+/// SpaceMouse next to it from ever being read. A candidate that fails is dropped. If it was the
+/// followed one, the reading is reset and the next takes over. Returns when none is left.
+#[cfg(any(target_os = "windows", target_os = "macos", test))]
+fn follow<D: ReportSource>(mut candidates: Vec<Candidate<D>>, now: impl Fn() -> Instant, mut emit: impl FnMut(Followed<'_>)) {
+    let Some(first) = candidates.first() else { return };
+    emit(Followed::Device(first.ids, None));
+    let mut followed = 0;
+    // When the followed device last showed use.
+    let mut used_at: Option<Instant> = None;
+    // The buttons each candidate last reported down, by index, as long as it has reported them.
+    let mut buttons: Vec<Option<u32>> = candidates.iter().map(|_| None).collect();
+    let mut report = [0_u8; REPORT_BUFFER_BYTES];
+    while !candidates.is_empty() {
+        // One device is waited on as before; several take turns, briefly, so none waits behind
+        // an idle one. Reports queue in the system meanwhile, so none is lost.
+        let timeout_ms = if candidates.len() == 1 { 100 } else { 10 };
+        let mut index = 0;
+        while let Some(candidate) = candidates.get(index) {
+            match candidate.device.read_report(&mut report, timeout_ms) {
+                Ok(0) => {}
+                Ok(size) => {
+                    let bytes = report.get(..size).unwrap_or_default();
+                    let before = buttons.get(index).copied().flatten();
+                    if let (Some(seen), Some(down)) = (buttons.get_mut(index), candidate.layout.decode(bytes).and_then(|decoded| decoded.buttons)) {
+                        *seen = Some(down);
+                    }
+                    if shows_use(candidate.layout, bytes) {
+                        let at = now();
+                        if index != followed && used_at.is_none_or(|used| at.duration_since(used) >= STALE_AFTER) {
+                            let (vendor, product) = candidate.ids;
+                            log::info!("3D mouse: reading {vendor:04x}:{product:04x}, the device in use");
+                            followed = index;
+                            emit(Followed::Device(candidate.ids, before));
+                        }
+                        if index == followed {
+                            used_at = Some(at);
+                        }
+                    }
+                    if index == followed {
+                        emit(Followed::Report(&candidate.layout, bytes));
+                    }
+                }
+                Err(error) => {
+                    log::info!("3D mouse disconnected: {error}");
+                    candidates.remove(index);
+                    if index < buttons.len() {
+                        buttons.remove(index);
+                    }
+                    if index == followed {
+                        emit(Followed::Gone);
+                        followed = 0;
+                        used_at = None;
+                        if let Some(next) = candidates.first() {
+                            emit(Followed::Device(next.ids, buttons.first().copied().flatten()));
+                        }
+                    } else if index < followed {
+                        followed -= 1;
+                    }
+                    continue;
+                }
+            }
+            index += 1;
+        }
+    }
+}
+
+/// The device's manufacturer and product strings, which say whether a device app has it
+/// ([`crate::nav_bridge::Claim`]). Asked of the opened 3D mouse only.
+#[cfg(any(target_os = "windows", target_os = "macos"))]
+fn device_strings(device: &hidapi::HidDevice) -> Vec<String> {
+    [device.get_manufacturer_string(), device.get_product_string()].into_iter().filter_map(|s| s.ok().flatten()).collect()
+}
+
+#[cfg(any(target_os = "windows", target_os = "macos"))]
+fn reader(ctx: Context, shared: Arc<Mutex<Reading>>, bridge: crate::nav_bridge::Claim) {
    let Ok(mut api) = hid_api() else {
        log::warn!("3D mouse: HID initialization failed");
        return;
    };
    loop {
-        if let Some((device, layout, ids)) = candidates(&mut api).into_iter().find_map(|path| {
-            let device = api
-                .open_path(&path)
-                .inspect_err(|error| {
-                    // On macOS: missing Input Monitoring permission, or the 3DxWare helper holding the device.
-                    // The driver having the device is the reason it cannot be opened, not a problem.
-                    if !DRIVER_CONNECTED.load(Ordering::Relaxed) && !DRIVER_REGISTERED.load(Ordering::Relaxed) {
-                        log::warn!("3D mouse: cannot open the device: {error}");
-                    }
-                })
-                .ok()?;
-            // Read when the device was opened, from this device alone.
-            let info = device.get_device_info().ok()?;
-            let layout = device_layout(&device, info.vendor_id())?;
-            Some((device, layout, (info.vendor_id(), info.product_id())))
-        }) {
-            connected(&ctx, &shared, Source::Hid(Some(ids)));
-            let mut report = [0_u8; REPORT_BUFFER_BYTES];
-            loop {
-                match device.read_timeout(&mut report, 100) {
-                    Ok(0) => {}
-                    Ok(size) => publish(&ctx, &shared, layout, report.get(..size).unwrap_or_default()),
-                    Err(error) => {
-                        log::info!("3D mouse disconnected: {error}");
-                        break;
-                    }
+        let open: Vec<_> = candidates(&mut api)
+            .into_iter()
+            .filter_map(|path| {
+                let device = api
+                    .open_path(&path)
+                    .inspect_err(|error| {
+                        // On macOS: missing Input Monitoring permission, or the 3DxWare helper holding the device.
+                        // The driver having the device is the reason it cannot be opened, not a problem.
+                        if !DRIVER_CONNECTED.load(Ordering::Relaxed) && !DRIVER_REGISTERED.load(Ordering::Relaxed) {
+                            log::warn!("3D mouse: cannot open the device: {error}");
+                        }
+                    })
+                    .ok()?;
+                // Read when the device was opened, from this device alone.
+                let info = device.get_device_info().ok()?;
+                let layout = device_layout(&device, info.vendor_id())?;
+                let strings = device_strings(&device);
+                Some(Candidate { device, layout, ids: (info.vendor_id(), info.product_id()), strings })
+            })
+            .collect();
+        let names: Vec<_> = open.iter().map(|candidate| (candidate.ids, candidate.strings.clone())).collect();
+        // Whether the device read now is one a device app has: it moves the view over the navigation
+        // bridge, so read here as well the device would move it twice. What was read before ages out.
+        let mut strings: &[String] = &[];
+        follow(open, Instant::now, |event| match event {
+            Followed::Device(ids, buttons) => {
+                strings = names.iter().find(|(known, _)| *known == ids).map_or(&[][..], |(_, strings)| strings.as_slice());
+                connected(&ctx, &shared, Source::Hid(Some(ids)));
+                // Taken over from another device: what it reported meanwhile is its baseline.
+                if let Some(buttons) = buttons
+                    && let Ok(mut reading) = shared.lock()
+                {
+                    reading.set_buttons(buttons);
                }
            }
-            reset(&ctx, &shared);
-        }
+            Followed::Report(..) if bridge.claims(strings) => {}
+            Followed::Report(layout, report) => publish(&ctx, &shared, *layout, report),
+            Followed::Gone => reset(&ctx, &shared),
+        });
        std::thread::sleep(RETRY_AFTER);
    }
 }
@@ -939,7 +1071,8 @@ pub struct SpaceMouse {
 }

 impl SpaceMouse {
-    pub fn start(ctx: &Context) -> Self {
+    /// Starts the reader. A device that `bridge` says its own app reads is left to that app.
+    pub fn start(ctx: &Context, bridge: crate::nav_bridge::Claim) -> Self {
        let now = Instant::now();
        let shared = Arc::new(Mutex::new(Reading::new(now)));
        let worker_state = Arc::clone(&shared);
@@ -948,11 +1081,14 @@ impl SpaceMouse {
        let drivers = Arc::new(Drivers::default());
        #[cfg(target_os = "linux")]
        let worker_drivers = Arc::clone(&drivers);
+        // hidraw names no device's strings to compare (`Claim`).
+        #[cfg(target_os = "linux")]
+        let _ = bridge;
        let spawned = std::thread::Builder::new().name("solidcraft-3d-mouse".into()).spawn(move || {
            #[cfg(target_os = "linux")]
            reader(worker_ctx, worker_state, worker_drivers, Machine);
            #[cfg(not(target_os = "linux"))]
-            reader(worker_ctx, worker_state);
+            reader(worker_ctx, worker_state, bridge);
        });
        if let Err(error) = spawned {
            log::warn!("3D mouse: reader could not start: {error}");
@@ -1294,6 +1430,175 @@ mod tests {
        assert!(shared.lock().unwrap().arrived, "but the report did arrive");
    }

+    /// A simulated 3D-mouse interface. Each read takes the next scripted step, a report or a
+    /// timeout (empty), and sets the shared clock to the step's time. Once the script runs out,
+    /// the device is unplugged.
+    struct Simulated<'a> {
+        clock: &'a std::cell::Cell<Instant>,
+        start: Instant,
+        steps: std::cell::RefCell<std::collections::VecDeque<(u64, Vec<u8>)>>,
+    }
+
+    impl ReportSource for Simulated<'_> {
+        fn read_report(&self, report: &mut [u8], _timeout_ms: i32) -> Result<usize, String> {
+            let (ms, bytes) = self.steps.borrow_mut().pop_front().ok_or_else(|| "unplugged".to_string())?;
+            self.clock.set(self.start + Duration::from_millis(ms));
+            report.get_mut(..bytes.len()).ok_or_else(|| "report too long".to_string())?.copy_from_slice(&bytes);
+            Ok(bytes.len())
+        }
+    }
+
+    #[derive(Debug, PartialEq)]
+    enum Seen {
+        /// The product id now read.
+        Device(u16),
+        /// The buttons it had reported down before it was read, its baseline.
+        Baseline(u32),
+        /// A report published, the product id read when it was, and whether it showed use.
+        Report(u16, Vec<u8>, bool),
+        Gone,
+    }
+
+    /// Follows simulated devices, given as (product id, scripted steps in ms), and returns what
+    /// the reader was told.
+    fn follow_simulated(devices: &[(u16, &[(u64, &[u8])])]) -> Vec<Seen> {
+        follow_simulated_with(Layout::default(), devices)
+    }
+
+    /// As `follow_simulated`, with every device's reports laid out as `layout`.
+    fn follow_simulated_with(layout: Layout, devices: &[(u16, &[(u64, &[u8])])]) -> Vec<Seen> {
+        let start = Instant::now();
+        let clock = std::cell::Cell::new(start);
+        let candidates = devices
+            .iter()
+            .map(|(product, steps)| Candidate {
+                device: Simulated {
+                    clock: &clock,
+                    start,
+                    steps: std::cell::RefCell::new(steps.iter().map(|(ms, bytes)| (*ms, bytes.to_vec())).collect()),
+                },
+                layout,
+                ids: (0x256f, *product),
+                strings: Vec::new(),
+            })
+            .collect();
+        let (mut seen, mut read) = (Vec::new(), 0);
+        follow(
+            candidates,
+            || clock.get(),
+            |event| match event {
+                Followed::Device((_, product), buttons) => {
+                    read = product;
+                    seen.push(Seen::Device(product));
+                    seen.extend(buttons.map(Seen::Baseline));
+                }
+                Followed::Report(layout, bytes) => seen.push(Seen::Report(read, bytes.to_vec(), shows_use(*layout, bytes))),
+                Followed::Gone => seen.push(Seen::Gone),
+            },
+        );
+        seen
+    }
+
+    const RECEIVER: u16 = 0xc652;
+    const SPACEMOUSE: u16 = 0xc63a;
+    const PUSH_X: &[u8] = &[1, 100, 0, 0, 0, 0, 0];
+    const AT_REST: &[u8] = &[1, 0, 0, 0, 0, 0, 0];
+    const TILT: &[u8] = &[2, 0, 0, 50, 0, 0, 0];
+
+    /// #3988: a Universal Receiver with nothing paired is found first and never fails, and a wired
+    /// SpaceMouse next to it was never read. The receiver is followed only until the SpaceMouse
+    /// moves; the SpaceMouse's reports, its zeros included, are read from then on.
+    #[test]
+    fn an_idle_receiver_does_not_keep_a_spacemouse_from_being_read() {
+        let receiver: &[(u64, &[u8])] = &[(0, &[]), (10, &[]), (20, &[]), (30, &[])];
+        let spacemouse: &[(u64, &[u8])] = &[(5, &[]), (15, PUSH_X), (25, AT_REST), (35, TILT)];
+        assert_eq!(
+            follow_simulated(&[(RECEIVER, receiver), (SPACEMOUSE, spacemouse)]),
+            [
+                Seen::Device(RECEIVER),
+                Seen::Device(SPACEMOUSE),
+                Seen::Report(SPACEMOUSE, PUSH_X.to_vec(), true),
+                Seen::Report(SPACEMOUSE, AT_REST.to_vec(), false),
+                Seen::Report(SPACEMOUSE, TILT.to_vec(), true),
+                // The receiver is unplugged first, then the SpaceMouse, the one being read.
+                Seen::Gone,
+            ]
+        );
+    }
+
+    /// Two devices in use at once don't trade the reading: the other takes over only after the
+    /// followed one has shown no use for `STALE_AFTER`. A report at rest or with an id the layout
+    /// doesn't know shows no use, and only the followed device's reports are published.
+    #[test]
+    fn another_device_takes_over_only_once_the_followed_one_is_still() {
+        let unknown_id: &[u8] = &[0x17, 80];
+        let first: &[(u64, &[u8])] = &[(0, PUSH_X), (100, AT_REST), (200, &[])];
+        let second: &[(u64, &[u8])] = &[(50, PUSH_X), (150, unknown_id), (250, TILT)];
+        assert_eq!(
+            follow_simulated(&[(0xc635, first), (SPACEMOUSE, second)]),
+            [
+                Seen::Device(0xc635),
+                Seen::Report(0xc635, PUSH_X.to_vec(), true),
+                // The second moves 50 ms after the first did: not yet. The first's own rest
+                // report is read, and the second's unknown report is not.
+                Seen::Report(0xc635, AT_REST.to_vec(), false),
+                // 250 ms after the first last moved, the second takes over.
+                Seen::Device(SPACEMOUSE),
+                Seen::Report(SPACEMOUSE, TILT.to_vec(), true),
+                Seen::Gone,
+            ]
+        );
+    }
+
+    /// One device is read as before: every report, until it fails. When the followed one of
+    /// several fails, the reading is reset and the next one is read.
+    #[test]
+    fn a_device_that_fails_hands_the_reading_to_the_next() {
+        let only: &[(u64, &[u8])] = &[(0, &[]), (1, AT_REST), (2, &[0x17, 80])];
+        assert_eq!(
+            follow_simulated(&[(SPACEMOUSE, only)]),
+            [
+                Seen::Device(SPACEMOUSE),
+                Seen::Report(SPACEMOUSE, AT_REST.to_vec(), false),
+                Seen::Report(SPACEMOUSE, vec![0x17, 80], false),
+                Seen::Gone
+            ]
+        );
+        let unplugged: &[(u64, &[u8])] = &[];
+        let next: &[(u64, &[u8])] = &[(1, PUSH_X)];
+        assert_eq!(
+            follow_simulated(&[(SPACEMOUSE, unplugged), (RECEIVER, next)]),
+            [Seen::Device(SPACEMOUSE), Seen::Gone, Seen::Device(RECEIVER), Seen::Report(RECEIVER, PUSH_X.to_vec(), true), Seen::Gone]
+        );
+        assert_eq!(follow_simulated(&[]), []);
+    }
+
+    /// A button press that makes a device the one in use is a press. The buttons it reported while
+    /// another was read are its baseline; the reader keeps them, so the press isn't taken for a
+    /// button already held, as a device's first button report is.
+    #[test]
+    fn a_press_that_takes_over_counts_as_a_press() {
+        let mut layout = Layout::default();
+        layout.buttons[0] =
+            Some(solidcraft_space_mouse::Field { report_id: 3, bit_offset: 0, bits: 1, logical_min: 0, logical_max: 1, relative: false });
+        let (none_down, first_down): (&[u8], &[u8]) = (&[3, 0], &[3, 1]);
+        let receiver: &[(u64, &[u8])] = &[(0, &[]), (10, &[]), (20, &[])];
+        let spacemouse: &[(u64, &[u8])] = &[(5, none_down), (15, first_down), (25, &[])];
+        assert_eq!(
+            follow_simulated_with(layout, &[(RECEIVER, receiver), (SPACEMOUSE, spacemouse)]),
+            [Seen::Device(RECEIVER), Seen::Device(SPACEMOUSE), Seen::Baseline(0), Seen::Report(SPACEMOUSE, first_down.to_vec(), true), Seen::Gone,]
+        );
+        // What the reader does with that: the press after the baseline is a tap.
+        let mut reading = Reading { buttons_known: false, ..Reading::new(Instant::now()) };
+        reading.set_buttons(0);
+        assert!(decode_report(first_down, layout, &mut reading, Instant::now()));
+        assert_eq!((reading.buttons, reading.taps), (1, 1));
+        // Without one, the same report is the baseline: held, not pressed.
+        let mut unseen = Reading { buttons_known: false, ..Reading::new(Instant::now()) };
+        assert!(decode_report(first_down, layout, &mut unseen, Instant::now()));
+        assert_eq!((unseen.buttons, unseen.taps), (1, 0));
+    }
+
    #[test]
    fn a_held_reading_stays_until_the_next_one_and_a_hid_reading_goes_stale() {
        let now = Instant::now();
@@ -8,8 +8,9 @@
 //!   row the next launch starts in safe mode by itself.
 //! - **Safe mode** (`--safe-mode` or `SOLIDCRAFT_SAFE_MODE=1`): default settings (the saved ones
 //!   are left untouched), no recovery offer, the software renderer and CPU meshing.
-//! - **No usable graphics device**: one retry on the software renderer
-//!   (`SOLIDCRAFT_RENDERER=cpu`), then a message box saying what failed and what to try.
+//! - **A renderer that cannot start**: on Windows, try the remaining graphics APIs in order,
+//!   then the software renderer (`SOLIDCRAFT_RENDERER=cpu`). An explicit `WGPU_BACKEND` fails
+//!   cleanly without switching. Exhausted retries show a message box with the error.

 use std::path::{Path, PathBuf};

@@ -129,6 +130,48 @@ pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&efr
        })
 }

+/// Adapter properties used to choose a card without opening a device.
+#[derive(Clone, Debug)]
+pub struct AdapterChoice {
+    pub name: String,
+    pub compatible: bool,
+}
+
+/// Choose only surface-compatible adapters. Names saved in preferences are exact; the
+/// environment override follows wgpu's case-insensitive substring convention.
+/// No match leaves selection to the normal wgpu request.
+pub fn choose_adapter(adapters: &[AdapterChoice], environment: Option<&str>, preference: Option<&str>) -> Option<usize> {
+    // wgpu's environment helper panics on a missing name; an override must remain recoverable.
+    let compatible = || adapters.iter().enumerate().filter(|(_, a)| a.compatible);
+    if let Some(name) = environment.filter(|s| !s.is_empty()) {
+        let name = name.to_lowercase();
+        if let Some((index, _)) = compatible().find(|(_, a)| a.name.to_lowercase().contains(&name)) {
+            return Some(index);
+        }
+    }
+    if let Some(name) = preference.filter(|s| !s.is_empty())
+        && let Some((index, _)) = compatible().find(|(_, a)| a.name == name)
+    {
+        return Some(index);
+    }
+    None
+}
+
+/// Leave Automatic on wgpu's normal request path; named choices may defer to it too.
+pub fn configure_adapter(setup: &mut eframe::egui_wgpu::WgpuSetupCreateNew, cpu: bool, environment: Option<String>, preference: Option<String>) {
+    if cpu {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(|adapters, surface| pick_cpu_adapter(adapters, surface).map(Some)));
+    } else if environment.as_deref().is_some_and(|s| !s.is_empty()) || preference.as_deref().is_some_and(|s| !s.is_empty()) {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let choices: Vec<_> = adapters
+                .iter()
+                .map(|a| AdapterChoice { name: a.get_info().name, compatible: surface.is_none_or(|s| a.is_surface_supported(s)) })
+                .collect();
+            Ok(choose_adapter(&choices, environment.as_deref(), preference.as_deref()).and_then(|i| adapters.get(i)).cloned())
+        }));
+    }
+}
+
 /// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
 pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";

@@ -176,6 +219,34 @@ pub fn choose_backends(
    Some(WINDOWS_ORDER.into_iter().find(|b| has_hardware(*b)).unwrap_or(Backends::DX12))
 }

+/// Internal, process-local retry choice; never written to the graphics preference.
+pub const RETRY_BACKEND_ENV: &str = "SOLIDCRAFT_STARTUP_BACKEND";
+/// Why this launch is using a fallback, carried to the new process for status and Preferences.
+pub const FALLBACK_NOTE_ENV: &str = "SOLIDCRAFT_GRAPHICS_FALLBACK";
+
+/// A handled startup failure tries each remaining Windows API once, then software rendering.
+/// An explicit environment choice is final, including when software rendering was requested.
+pub fn fallback_backend(windows: bool, explicit: bool, cpu: bool, failed: eframe::wgpu::Backends) -> Option<&'static str> {
+    if explicit || cpu {
+        return None;
+    }
+    if windows {
+        let last = WINDOWS_ORDER.iter().rposition(|backend| failed.intersects(*backend));
+        if let Some(next) = last.and_then(|i| WINDOWS_ORDER.get(i + 1)) {
+            return Some(if *next == eframe::wgpu::Backends::VULKAN { "vulkan" } else { "gl" });
+        }
+    }
+    Some("cpu")
+}
+
+/// Keep driver diagnostics on one bounded line, including across the finite retry chain.
+pub fn fallback_note(previous: &str, failed: eframe::wgpu::Backends, next: &str, error: &str) -> String {
+    let previous: String = previous.chars().take(2048).collect();
+    let error: String = error.chars().take(1024).collect();
+    let line = format!("{previous} Graphics fallback: {failed:?} failed ({error}); trying {next}.");
+    line.split_whitespace().collect::<Vec<_>>().join(" ").chars().take(4096).collect()
+}
+
 /// The device feature for a 32-bit float depth buffer with a stencil (reversed depth, #1434).
 pub const FLOAT_DEPTH_STENCIL: eframe::wgpu::Features = eframe::wgpu::Features::DEPTH32FLOAT_STENCIL8;

@@ -184,7 +255,7 @@ pub const FLOAT_DEPTH_STENCIL: eframe::wgpu::Features = eframe::wgpu::Features::
 /// asks for a float one only when whichever it picks has it.
 pub fn float_depth_everywhere(options: &eframe::egui_wgpu::WgpuConfiguration) -> bool {
    let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &options.wgpu_setup else { return false };
-    let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle_from_env();
+    let mut desc = solidcraft_gpu::instance_descriptor_from_env();
    desc.backends = setup.instance_descriptor.backends;
    let instance = eframe::wgpu::Instance::new(desc);
    let adapters = pollster::block_on(instance.enumerate_adapters(setup.instance_descriptor.backends));
@@ -201,6 +272,7 @@ pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
    let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle();
    desc.backends = backends;
    desc.flags = eframe::wgpu::InstanceFlags::from_build_config().with_env();
+    desc.backend_options.dx12.shader_compiler = solidcraft_gpu::dx12_compiler();
    let instance = eframe::wgpu::Instance::new(desc);
    let adapters = pollster::block_on(instance.enumerate_adapters(backends));
    let found: Vec<String> = adapters.iter().map(|a| format!("{} ({:?})", a.get_info().name, a.get_info().device_type)).collect();
@@ -208,6 +280,102 @@ pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
    adapters.iter().any(|a| a.get_info().device_type != eframe::wgpu::DeviceType::Cpu)
 }

+/// The environment variable that switches wgpu's indirect-call validation on or off.
+pub const INDIRECT_VALIDATION_ENV: &str = "WGPU_VALIDATION_INDIRECT_CALL";
+
+/// The instance flags for the window. wgpu's indirect-call validation compiles a compute shader
+/// when the device is created, and on Intel Macs (macOS 12 with Intel Iris graphics, #3024,
+/// #3080, #4605) the Metal compiler refuses it: the device is lost and the window never opens.
+/// So on an Intel Mac the validation is left off, unless the user turned it on or off with
+/// `WGPU_VALIDATION_INDIRECT_CALL` themselves.
+pub fn window_instance_flags(flags: eframe::wgpu::InstanceFlags, intel_mac: bool, env: Option<&str>) -> eframe::wgpu::InstanceFlags {
+    if intel_mac && env.map(str::trim).is_none_or(str::is_empty) { flags - eframe::wgpu::InstanceFlags::VALIDATION_INDIRECT_CALL } else { flags }
+}
+
+/// The environment variable that makes the macOS compatibility shim report an older OS
+/// version to wgpu's Metal backend. On OCLP-patched machines the Metal compiler accepts
+/// only up to the MSL standard of the original GPU, not the one the patched OS reports,
+/// so wgpu picks a standard that the compiler refuses (`invalid value 'metal3.2'`).
+/// Setting this variable before the process starts causes the OS to report the older
+/// version and wgpu selects a supported MSL standard (#3080, #4605).
+#[cfg(target_os = "macos")]
+pub const SYSTEM_VERSION_COMPAT_ENV: &str = "SYSTEM_VERSION_COMPAT";
+
+/// The NVRAM variable that OpenCore Legacy Patcher writes on every OCLP-booted system.
+/// Its presence is the primary signal that `SYSTEM_VERSION_COMPAT=1` is needed.
+#[cfg(target_os = "macos")]
+pub const OCLP_NVRAM_KEY: &str = "4D1FDA02-38C7-4A6A-9CC6-4BCCA8B30102:OCLP-Version";
+
+/// `true` if the OCLP NVRAM key is present on this system.
+///
+/// Runs `nvram <key>` and treats exit 0 as present. Any error (missing binary,
+/// permission denied, key absent) returns `false` — this is a best-effort probe.
+#[cfg(target_os = "macos")]
+pub fn oclp_nvram_present() -> bool {
+    std::process::Command::new("nvram").arg(OCLP_NVRAM_KEY).output().map(|o| o.status.success()).unwrap_or(false)
+}
+
+/// Whether to re-launch with `SYSTEM_VERSION_COMPAT=1`: it is not set yet and OCLP shows through
+/// the NVRAM key. The probe runs only when it is needed, so a re-launched process (variable
+/// set) never starts `nvram`.
+#[cfg(target_os = "macos")]
+fn compat_wanted(compat_set: bool, nvram: impl FnOnce() -> bool) -> bool {
+    !compat_set && nvram()
+}
+
+/// If this process is running under OCLP and `SYSTEM_VERSION_COMPAT` has not been set,
+/// re-launch the current binary with `SYSTEM_VERSION_COMPAT=1` added to the environment,
+/// then exit with the child's status code.
+///
+/// `SYSTEM_VERSION_COMPAT=1` must be present **before** the process starts: setting it
+/// with `std::env::set_var` inside `main` is too late because the macOS frameworks have
+/// already queried the OS version by then. Re-launching is the only safe approach that
+/// works without `unsafe` (a true `execve` replacement would require it).
+///
+/// Returns `Ok(false)` immediately when:
+/// - `SYSTEM_VERSION_COMPAT` is already set (re-launched process, no loop), or
+/// - the OCLP NVRAM key is absent.
+///
+/// Returns `Err` only when `std::env::current_exe()` fails or the child process cannot
+/// be spawned; the caller should log the error and continue normally.
+///
+/// Never returns `Ok(true)`: a successful re-launch exits the current process.
+#[cfg(target_os = "macos")]
+pub fn relaunch_with_version_compat() -> Result<bool, String> {
+    // A set variable means this is the re-launched process: no loop.
+    if !compat_wanted(std::env::var_os(SYSTEM_VERSION_COMPAT_ENV).is_some(), oclp_nvram_present) {
+        return Ok(false);
+    }
+    log::info!("startup: OCLP detected; re-launching with {}=1", SYSTEM_VERSION_COMPAT_ENV);
+    eprintln!("SolidCraft: OCLP detected; re-launching with {}=1", SYSTEM_VERSION_COMPAT_ENV);
+    let exe = std::env::current_exe().map_err(|e| format!("could not find own executable: {e}"))?;
+    let status = std::process::Command::new(&exe)
+        .args(std::env::args_os().skip(1))
+        .env(SYSTEM_VERSION_COMPAT_ENV, "1")
+        .status()
+        .map_err(|e| format!("could not re-launch with {}: {e}", SYSTEM_VERSION_COMPAT_ENV))?;
+    std::process::exit(status.code().unwrap_or(1));
+}
+
+/// Windows with OpenGL: the window keeps the system title bar (#2063). The window without OS
+/// decorations keeps its caption style while having no frame, and some OpenGL drivers (older
+/// Intel HD/UHD) then show the picture a caption's height lower than the window, so it no longer
+/// lines up with the pointer. Direct3D 12 and Vulkan draw it in place and keep the application bar
+/// as the title bar. `backends` are the ones wgpu starts: OpenGL alone is decided before the
+/// window opens.
+pub fn system_title_bar(windows: bool, backends: eframe::wgpu::Backends) -> bool {
+    use eframe::wgpu::Backends;
+    windows && backends.contains(Backends::GL) && !backends.intersects(Backends::DX12 | Backends::VULKAN)
+}
+
+/// The `--max-file-size` value (#4086): a size such as `2GB` or `1500MB`, at most 16 GB. It raises
+/// the largest STEP/import and design file this run reads, over the saved preference, without
+/// saving anything. A missing or bad value stops the start with this error.
+pub fn max_file_size(value: Option<&str>) -> Result<u64, String> {
+    let value = value.ok_or("--max-file-size needs a size, for example --max-file-size 2GB")?;
+    solidcraft_engine::io::limits::parse_flag(value).map_err(|e| format!("--max-file-size: {e}"))
+}
+
 /// The message shown when no window could be opened at all.
 pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
    let folder = settings.map(|d| d.display().to_string()).unwrap_or_else(|| "the SolidCraft settings folder".into());
@@ -226,6 +394,58 @@ pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
 mod tests {
    use super::*;

+    fn cards() -> Vec<AdapterChoice> {
+        ["Integrated", "Discrete small", "Discrete large"].into_iter().map(|name| AdapterChoice { name: name.into(), compatible: true }).collect()
+    }
+
+    #[test]
+    fn max_file_size_parses_sizes_and_refuses_bad_ones() {
+        assert_eq!(max_file_size(Some("2GB")), Ok(2 << 30));
+        assert_eq!(max_file_size(Some("1500MB")), Ok(1500 << 20));
+        for bad in [None, Some(""), Some("2"), Some("17GB"), Some("lots"), Some("-1GB")] {
+            let error = max_file_size(bad).unwrap_err();
+            assert!(error.contains("--max-file-size"), "{bad:?}: {error}");
+        }
+    }
+
+    #[test]
+    fn adapter_names_environment_override_and_missing_card_fallback() {
+        let cards = cards();
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some("LARGE"), Some("Discrete small")), Some(2));
+        assert_eq!(choose_adapter(&cards, None, Some("removed")), None);
+        assert_eq!(choose_adapter(&cards, Some("missing"), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some(""), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete")), None, "saved names are exact");
+    }
+
+    #[test]
+    fn automatic_adapter_leaves_selection_to_wgpu() {
+        let mut cards = cards();
+        assert_eq!(choose_adapter(&cards, None, None), None);
+        assert_eq!(choose_adapter(&cards, Some(""), Some("")), None);
+        cards[2].compatible = false;
+        assert_eq!(choose_adapter(&cards, Some("large"), Some("Discrete large")), None);
+        assert_eq!(choose_adapter(&cards, Some("small"), None), Some(1));
+        assert_eq!(choose_adapter(&[], None, None), None);
+    }
+
+    #[test]
+    fn automatic_adapter_preserves_the_previous_request_configuration() {
+        use eframe::egui_wgpu::WgpuSetupCreateNew;
+        let previous = WgpuSetupCreateNew::without_display_handle();
+        for preference in [None, Some(String::new())] {
+            let mut setup = WgpuSetupCreateNew::without_display_handle();
+            configure_adapter(&mut setup, false, None, preference);
+            assert!(setup.native_adapter_selector.is_none(), "Automatic must use the normal wgpu request");
+            assert_eq!(setup.power_preference, previous.power_preference);
+            assert_eq!(setup.instance_descriptor.backends, previous.instance_descriptor.backends);
+        }
+        let mut setup = WgpuSetupCreateNew::without_display_handle();
+        configure_adapter(&mut setup, false, Some("missing".into()), Some("removed".into()));
+        assert!(setup.native_adapter_selector.unwrap()(&[], None).unwrap().is_none(), "missing names must use the normal request too");
+    }
+
    fn scratch(name: &str) -> PathBuf {
        let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&d);
@@ -246,6 +466,40 @@ mod tests {
        assert!(settings_directory(Some(file.as_os_str()), Some(default)).is_err());
    }

+    #[test]
+    fn intel_macs_start_without_indirect_call_validation() {
+        use eframe::wgpu::InstanceFlags as F;
+        let on = F::VALIDATION | F::VALIDATION_INDIRECT_CALL;
+        assert_eq!(window_instance_flags(on, true, None), F::VALIDATION);
+        assert_eq!(window_instance_flags(on, true, Some("  ")), F::VALIDATION);
+        // The user's own choice stands, on or off.
+        assert_eq!(window_instance_flags(on, true, Some("1")), on);
+        assert_eq!(window_instance_flags(F::VALIDATION, true, Some("0")), F::VALIDATION);
+        // Every other machine keeps what it had.
+        assert_eq!(window_instance_flags(on, false, None), on);
+    }
+
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn oclp_relaunch_needs_the_signal_and_no_compat_variable() {
+        use super::compat_wanted;
+        let probed = std::cell::Cell::new(false);
+        let probe = |found: bool| {
+            let probed = &probed;
+            move || {
+                probed.set(true);
+                found
+            }
+        };
+        // The re-launched process has the variable: no probe, no second re-launch.
+        assert!(!compat_wanted(true, probe(true)));
+        assert!(!probed.get());
+        // The OCLP NVRAM key is the signal.
+        assert!(compat_wanted(false, probe(true)));
+        // No signal: an ordinary Mac starts as it is.
+        assert!(!compat_wanted(false, probe(false)));
+    }
+
    #[test]
    fn switches_read_from_the_environment() {
        assert!(env_on(Some("1")) && env_on(Some("yes")) && !env_on(Some("0")) && !env_on(Some(" ")) && !env_on(None) && !env_on(Some("false")));
@@ -322,6 +576,54 @@ mod tests {
        assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
    }

+    #[test]
+    fn failed_windows_backends_fall_back_in_order_and_stop_after_software() {
+        use eframe::wgpu::Backends as B;
+        assert_eq!(fallback_backend(true, false, false, B::DX12), Some("vulkan"));
+        assert_eq!(fallback_backend(true, false, false, B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(true, false, false, B::GL), Some("cpu"));
+        assert_eq!(fallback_backend(true, false, true, B::DX12), None);
+        assert_eq!(fallback_backend(true, false, false, B::DX12 | B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(false, false, false, B::VULKAN), Some("cpu"));
+        let note = fallback_note("", B::DX12, "vulkan", "egui_pipeline\n0x80070057");
+        assert!(note.contains("egui_pipeline 0x80070057") && note.contains("vulkan") && !note.contains('\n'));
+        let long = fallback_note(&"x".repeat(5000), B::VULKAN, "gl", &"y".repeat(5000));
+        assert!(long.chars().count() <= 4096 && long.ends_with("trying gl."));
+    }
+
+    #[test]
+    fn explicit_backend_failure_never_switches_api_or_retries_software() {
+        use eframe::wgpu::Backends as B;
+        for windows in [false, true] {
+            for cpu in [false, true] {
+                for backend in [B::DX12, B::VULKAN, B::GL, B::all()] {
+                    assert_eq!(fallback_backend(windows, true, cpu, backend), None);
+                    let mut probed = false;
+                    assert_eq!(
+                        choose_backends(windows, true, cpu, Some("vulkan"), |_| {
+                            probed = true;
+                            false
+                        }),
+                        None
+                    );
+                    assert!(!probed);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn only_opengl_on_windows_gets_the_system_title_bar() {
+        use eframe::wgpu::Backends;
+        assert!(system_title_bar(true, Backends::GL));
+        for b in [Backends::DX12, Backends::VULKAN, Backends::DX12 | Backends::GL, Backends::VULKAN | Backends::GL, Backends::all()] {
+            assert!(!system_title_bar(true, b), "{b:?}");
+        }
+        for b in [Backends::GL, Backends::VULKAN, Backends::METAL] {
+            assert!(!system_title_bar(false, b), "{b:?}");
+        }
+    }
+
    #[test]
    fn wgpu_backend_the_preference_and_the_software_renderer_override_the_order() {
        use eframe::wgpu::Backends;
@@ -346,9 +648,16 @@ mod tests {

    #[test]
    fn probing_a_backend_alone_never_panics() {
-        // Whatever this machine has (often nothing): an answer, not a crash.
-        for b in WINDOWS_ORDER {
-            let _ = has_hardware_adapter(b);
+        // Whatever this machine has (often nothing): an answer, not a crash. On Windows the probe
+        // goes the way the app's does, stopping at the first backend with a GPU: a machine with
+        // D3D12 never loads its OpenGL driver into the test process, and AMD's (`atio6axx.dll`)
+        // aborted the process as it exited (#1156).
+        if cfg!(target_os = "windows") {
+            let _ = choose_backends(true, false, false, None, has_hardware_adapter);
+        } else {
+            for b in WINDOWS_ORDER {
+                let _ = has_hardware_adapter(b);
+            }
        }
    }

@@ -361,8 +670,18 @@ mod tests {
    #[test]
    fn the_software_adapter_is_preferred_and_its_absence_is_an_error_not_a_panic() {
        assert!(pick_cpu_adapter(&[], None).unwrap_err().contains("none"));
-        let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
-        let adapters = pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all()));
+        // The adapters the software renderer chooses among: it starts D3D12 alone on Windows
+        // (WARP), not every backend, so the test doesn't load the OpenGL driver either (#1156).
+        let options = crate::wgpu_options(true, None);
+        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &options.wgpu_setup else { panic!("the software renderer makes its own device") };
+        let backends = setup.instance_descriptor.backends;
+        if cfg!(target_os = "windows") && std::env::var_os(WGPU_BACKEND_ENV).is_none() {
+            assert_eq!(backends, eframe::wgpu::Backends::DX12);
+        }
+        let mut desc = solidcraft_gpu::instance_descriptor_from_env();
+        desc.backends = backends;
+        let instance = eframe::wgpu::Instance::new(desc);
+        let adapters = pollster::block_on(instance.enumerate_adapters(backends));
        if adapters.is_empty() {
            return;
        }
@@ -25,6 +25,7 @@ assets/
  fonts/{liberation-sans,biz-udp-gothic}/ # unmodified fonts and OFL licences
  locales/{en,de,ja,ko}.json          # shared offline catalogs
  platforms/{macos,linux,windows}/    # bundle, freedesktop and WiX templates
+  platforms/macos/dmg/                # disk image window: layout, dmgbuild settings, background art
  archive/icons/macos-v1/
    source/icon.vectorcraft          # earlier editable work, retained
                                     # redundant historical exports are retired
@@ -75,7 +76,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 | macOS | Composer master and paired exports; bundle installs `Assets.car` and `SolidCraft.icns` |
 | Windows executable | `solidcraft-executable.ico`: original DIB/mask representations at 16/24/32/48/64/128/256 px |
 | Windows installer | `solidcraft.ico`: PNG representations at 16/20/24/32/40/48/64/128/256 px; `SOLIDCRAFT_ICONS` override retained |
-| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `ai.storyteller.solidcraft` |
+| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `io.tangencylabs.solidcraft` |
 | AppImage | Uses the Linux 256 px image and `.DirIcon` alias |
 | FreeBSD | Shares Linux hicolor images and freedesktop metadata |
 | Web | HTML/Trunk and `manifest.webmanifest` stay in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/`, uses the collected CSS, and copies the Linux 32/256/512 px images to `icons/` for the favicon and installed app |
@@ -1,5 +1,5 @@
 //! Built-in model appearances: names, sRGB colours and metalness.
-pub const LIBRARY: [(&str, [u8; 3], f64); 20] = [
+pub const LIBRARY: &[(&str, [u8; 3], f64)] = &[
    ("Aluminum - Satin", [204, 208, 214], 1.0),
    ("Aluminum - Anodized Black", [44, 46, 50], 1.0),
    ("Aluminum - Anodized Blue", [52, 92, 160], 1.0),
@@ -1,7 +1,7 @@
 //! Original illustrative opaque finishes; not measured optical or engineering data.
 //! (name, sRGB color, metal fraction, perceptual roughness). IOR is an illustrative 1.5.
 //! Separate names preserve the scalar library's appearance and saved assignments.
-pub const OPAQUE_FINISHES: [(&str, [u8; 3], f64, f64); 6] = [
+pub const OPAQUE_FINISHES: &[(&str, [u8; 3], f64, f64)] = &[
    ("Steel - Satin PBR", [158, 164, 172], 1.0, 0.4),
    ("Aluminum - Satin PBR", [204, 208, 214], 1.0, 0.3),
    ("Copper - Clean PBR", [204, 122, 80], 1.0, 0.25),
@@ -16,7 +16,7 @@ const fn glass(transmission_linear_rgb: [f64; 3], ior: f64, reference_path_mm: f
    GlassRecipe { transmission_linear_rgb, dielectric_ior: ior, reference_path_mm, boundary }
 }

-pub const STARTER_PACK: [VisualPreset; 40] = [
+pub const STARTER_PACK: &[VisualPreset] = &[
    VisualPreset::opaque(
        "starter.wood.oak-honey",
        "Wood - Honey Oak Uniform Preview",
@@ -0,0 +1,96 @@
+Copyright 2014-2021 Adobe (http://www.adobe.com/), with Reserved Font Name 'Source'.
+Copyright 2014-2021 Google Inc. with Reserved Font Name 'Noto'.
+Subset for SolidCraft web UI (glyphs used by the zh locale); renamed Craft UI SC (no Reserved Font Name).
+
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
@@ -0,0 +1,96 @@
+Copyright 2014-2021 Adobe (http://www.adobe.com/), with Reserved Font Name 'Source'.
+Copyright 2014-2021 Google Inc. with Reserved Font Name 'Noto'.
+Subset for SolidCraft web UI (glyphs used by the zh-TW locale); renamed Craft UI TC (no Reserved Font Name).
+
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
@@ -0,0 +1,93 @@
+# Render workspace icon drafts
+
+All ids below are **Open** for owner review, except `render_scene` and `render_image`,
+which are existing accepted icons used only as references. No commands, toolbar
+entries, browser selectors or runtime request manifests are changed by this draft set.
+`render_remove_override` is the one remaining alias (of `render_from_material`);
+`render_execute`, `render_environment` and `render_fit_product` now have their own
+masters in `design/svg/model/`. Accepted source masters stay unchanged.
+
+Review with `python3 -B assets/icons/ui/design/tools/icon_status.py --serve`,
+search `render_`, and select Open. See [STYLE_GUIDE.md](STYLE_GUIDE.md) for
+acceptance; drafts do not imply implemented commands.
+
+The finished references in each row were read and previewed in both themes
+before authoring. Draft contact sheets (96, 24 and 16 px, both themes) are local
+review evidence, not shipped assets. The icons are grouped in five families, each
+with one shared design rule.
+
+## Lights
+
+Rule: a slate source glyph with light passive fill, 2.55-unit outlines and a dotted
+accent stem (three dots, 4.25 diameter, 7 units apart) showing the direction.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Light area | `render_light_area` | `box`, `camera` | Slanted flat panel on the canonical axes above the dotted stem. |
+| Light spot | `render_light_spot` | `camera`, `material` | Cone with a curved rim above the dotted stem. |
+| Light point | `render_light_point` | `camera`, `material` | Round source disc with a centre dot above the dotted stem. |
+| Sun | `render_sun` | `sphere`, `camera` | Source disc of the same size with eight short radial rays instead of a stem. |
+| Light by highlight | `render_light_by_highlight` | `sphere`, `material` | Shaded sphere with a ringed highlight target; the dotted stem arrives from above. |
+| Solo light | `render_solo_light` | `fit`, `camera` | Point source and stem inside four corner focus brackets. |
+
+## Looks
+
+Rule: the lit look sphere (top-left highlight, bottom-right shade) plus one cue that
+says what happens to it; receiving bodies stay canonical grey or cube shapes.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Appearance | `render_appearance` | `material`, `box` | Shaded look sphere on the top corner of an accent-shaded cube: a look assigned to a body. |
+| Paint | `render_paint` | `material`, `paste` | Flat brush with an accent tip, light ferrule and slate handle. |
+| Pick up | `render_pick_up` | `material`, `copy` | Eyedropper with a grey bulb, slate crossbar and accent sampling tip. |
+| Replace all | `render_replace_all` | `copy`, `box` | Grey sample sphere with an arrow to an accent sphere, beside a second accent sphere. |
+| Copy look | `render_copy_look` | `material`, `copy` | Look sphere in a square frame, offset from a second frame outline. |
+| Remove override | `render_remove_override` | `appearance`, `box` | Alias of `render_from_material`: the custom look is crossed off. |
+| Same look | `render_same_look` | `select`, `box` | Look sphere and three cubes; the two matching cubes are ringed. |
+| From material | `render_from_material` | `material`, `extrude` | Look sphere struck through above a plain grey slab, so the material shows. |
+
+## Studio
+
+Rule: the standard grey cube stands in the set-up it is lit or placed in.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Library | `render_library` | `library`, `copy` | Row of three look spheres, the middle one accent, on a shelf bar. |
+| Lighting presets | `render_lighting_presets` | `new`, `render_scene` | Two stacked cards, the front one holding a light bulb. |
+| Environment | `render_environment` | `environment_map`, `render_scene` | Dome with a grey cube inside. |
+| Ground | `render_ground` | `box`, `render_scene` | Grey cube on a slab with an accent contact patch. |
+| Backdrop | `render_backdrop` | `render_scene`, `render_image` | Grey cube in front of a tall upright accent panel. |
+
+## Camera and shots
+
+Rule: one chunky camera body with a lower-right round badge for shot actions; the
+other camera icons are simple frames.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Shot | `render_shot` | `camera`, `new` | Camera body with a plus badge: save a shot. |
+| Update shot | `render_update_shot` | `camera`, `undo` | Camera body with a refresh badge. |
+| Render all shots | `render_all_shots` | `copy`, `render_image` | Stacked camera bodies with a play badge. |
+| Shots strip | `render_shots_strip` | `camera`, `copy` | Strip of three small frames, the middle one in accent. |
+| Fit product | `render_fit_product` | `fit`, `camera` | Grey cube inside four corner brackets. |
+| Lens / field of view | `render_lens` | `camera`, `fit` | Concentric lens rings around an accent centre. |
+| Exposure | `render_exposure` | `material`, `environment_map` | Disc split light and accent, with plus and minus marks. |
+| Aspect frame | `render_aspect_frame` | `render_image`, `fit` | Wide rounded frame with two opposite corner brackets. |
+| Frame guides | `render_frame_guides` | `render_image`, `fit` | Rounded frame with a rule-of-thirds grid and four accent nodes. |
+
+## Output and result
+
+Rule: one picture base (frame with landscape) with a lower-right round badge; the
+size, background and quality icons draw their own simple subject.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Render image | `render_execute` | `render_image`, `camera` | Picture with a play badge: create a rendered image. |
+| Render output size | `render_output_size` | `render_image`, `fit` | Picture frame with a diagonal double-headed dimension arrow. |
+| Transparent background | `render_transparent_background` | `material`, `render_image` | Grey cube on a checker tile. |
+| Quality | `render_quality` | `list`, `library` | Three rising bars, the tallest in accent. |
+| Check render | `render_check` | `render_image`, `new` | Picture with a check badge. |
+| Cancel render | `render_cancel` | `render_image`, `delete` | Picture with a square stop badge. |
+| Export image | `render_export_image` | `render_image`, `copy` | Picture with a large outward diagonal arrow at the upper right. |
+| Compare | `render_compare` | `render_image`, `material` | Two grey pictures split by a vertical slider with opposed arrows. |
+| Results | `render_results` | `render_image`, `copy` | Stack of two pictures, the front one showing a landscape. |
@@ -27,6 +27,9 @@ error = { master = "status_error", accent = "surface" }
 warning = { master = "status_warning", accent = "mesh" }
 ground = "c_fix"

+# Visual style: Shaded with edges is the generic style icon.
+style_shaded_edges = "style"
+
 # Same finished drawing, different semantic operation. Colours live only in palette.toml.
 sketch_break = { master = "break", accent = "sketch" }
 sketch_cancel = { master = "close", accent = "sketch" }
@@ -45,3 +48,7 @@ sketch_chamfer_equal = { master = "sketch_chamfer", accent = "sketch" }
 sketch_chamfer_two = { master = "sketch_chamfer_two_distances", accent = "sketch" }
 offset_one_side = { master = "offset", accent = "sketch" }
 bom = "list"
+
+# Render workspace drafts: shared meanings; owner review remains Open.
+# Removing a look override returns the body to its material look.
+render_remove_override = "render_from_material"
@@ -48,6 +48,38 @@ source = "#236ead"
 light = "#236ead"
 dark  = "#2976b8"

+# Simultaneous component colours for inspection icons; existing workspace ramps stay unchanged.
+
+[roles.component-orange-1]
+source = "#f1d2af"
+light = "#f1d2af"
+dark = "#ba8f6a"
+
+[roles.component-orange-2]
+source = "#c06f00"
+light = "#c06f00"
+dark = "#b86f04"
+
+[roles.component-orange-3]
+source = "#a45000"
+light = "#a45000"
+dark = "#95682d"
+
+[roles.component-yellow-1]
+source = "#e5d99b"
+light = "#e5d99b"
+dark = "#a9985f"
+
+[roles.component-yellow-2]
+source = "#a28200"
+light = "#a28200"
+dark = "#9a8100"
+
+[roles.component-yellow-3]
+source = "#826700"
+light = "#826700"
+dark = "#857100"
+
 [strokes]          # on the 64 grid
 geometry = 2.55
 action = 4.25
@@ -156,7 +188,7 @@ surface = [
 sketch = [
  "arc3", "arc_center", "arc_slot", "arc_slot_center", "arc_tangent",
  "blend", "circle", "circle2", "circle3", "circle_tt",
-  "circle_ttt", "conic", "constrainer", "dimension", "ellipse",
+  "circle_ttt", "conic", "constrainer", "dimension", "ellipse", "equation_curve",
  "extend", "finish", "fit_section", "include",
  "intersect", "intersection_curve", "iso_curve", "line", "line_mid",
  "offset", "offset_two_sides", "offset_symmetric", "point", "polygon", "polygon_circumscribed", "polygon_edge",
@@ -172,5 +204,11 @@ constraint = [
  "c_polygon", "c_smooth", "c_symmetry", "c_tangent",
 ]
 construction = [
-  "centerline", "construction", "infinite",
+  "centerline", "construction", "construction_line", "construction_line_angle",
+  "construction_line_bisector", "construction_line_horizontal", "construction_line_parallel",
+  "construction_line_perpendicular", "construction_line_tangent_at", "construction_line_tangent_external",
+  "construction_line_tangent_two", "construction_line_vertical", "infinite",
+]
+mesh = [
+  "mesh_body",
 ]
@@ -1,6 +1,8 @@
 accessibility	false
 activate	false
+agent_chat	false
 align	false
+ambient_occlusion	false
 appearance	false
 arc3	false
 arc_center	false
@@ -57,14 +59,27 @@ circle_tt	false
 circle_ttt	false
 close	false
 coil	false
+colored_components	false
+colored_components_off	false
 combine	false
 compare	false
 component	false
 compute	false
+cone	false
 configuration_table	false
 conic	false
 constrainer	false
 construction	false
+construction_line	false
+construction_line_angle	false
+construction_line_bisector	false
+construction_line_horizontal	false
+construction_line_parallel	false
+construction_line_perpendicular	false
+construction_line_tangent_at	false
+construction_line_tangent_external	false
+construction_line_tangent_two	false
+construction_line_vertical	false
 contact_all	false
 contact_new	false
 contact_off	false
@@ -80,6 +95,8 @@ decal	false
 delete	false
 delete_face	false
 dimension	false
+display	false
+dots	false
 draft	false
 draft_analysis	false
 drive	false
@@ -88,6 +105,7 @@ edit	false
 ellipse	false
 emboss	false
 environment_map	false
+equation_curve	false
 error	false
 explode	false
 export	false
@@ -96,8 +114,10 @@ extend	false
 extrude	false
 eye	false
 fastener	false
+feature_group	false
 fillet	false
 finish	false
+finish_edit	false
 fit	false
 fit_section	false
 flange	false
@@ -107,7 +127,9 @@ folder	false
 frame_member	false
 gear	false
 graph	false
+grid	false
 ground	false
+ground_shadow	false
 help	false
 hem	false
 hole	false
@@ -133,6 +155,7 @@ loft	false
 lookat	false
 material	false
 measure	false
+mesh_body	false
 mesh_export	false
 min_radius	false
 mirror	false
@@ -148,6 +171,7 @@ origin	false
 pan	false
 params	false
 paste	false
+path_flange	false
 pattern_circ	false
 pattern_path	false
 pattern_rect	false
@@ -177,6 +201,7 @@ polygon	false
 polygon_circumscribed	false
 polygon_edge	false
 presspull	false
+print_face	false
 project	false
 project_surface	false
 rack_pinion	false
@@ -206,6 +231,12 @@ section	false
 select	false
 send	false
 settings	false
+settings_keyboard	false
+settings_monitor	false
+settings_mouse	false
+settings_palette	false
+settings_plug	false
+sheet	false
 sheet_rules	false
 shell	false
 shield	false
@@ -241,9 +272,16 @@ split_face	false
 spun	false
 star	false
 status_error	false
+status_pin	false
 status_recovery	false
 style	false
+style_hidden_edges	false
+style_shaded	false
+style_shaded_edges	false
+style_translucent	false
+style_wireframe	false
 suppress	false
+surface	false
 surface_blend	false
 surface_boundary	false
 surface_extend	false
@@ -266,6 +304,8 @@ svg	false
 sweep	false
 text	false
 thread	false
+timeline_play	false
+timeline_stop	false
 torus	false
 trace	false
 trim	false
@@ -6,6 +6,7 @@
  "agent_chat": "4a9ae0e7e2c360b4858b3175674c93d096705c92318fecd481e849f3ae650bf4",
  "agent_link": "2f20d89a0e3e9b28744910dddf7f282a1099ccd91aa160c9841c5b1d9ea9ed0f",
  "align": "05615db7dd9e4be56ae898e59a68c548b8a8447794442a9a394940651204bc4f",
+  "ambient_occlusion": "973f8ef2326aeaf0face576e5a2c79c7ef3d13638b2c51a5aad199e4ef7edb02",
  "appearance": "b3162edd92291a5ef402e8499cd52be05beb2fa7eda641163c3f6e98325de2bf",
  "arc3": "fdca3d501fd557ac989376a12e9c4fa8231fde2b455c20724d1079a466153e9c",
  "arc_center": "3a5fdeb1d64fc6741f944c4435870b05fccab62293e270da692c6681155cbc51",
@@ -88,6 +89,7 @@
  "dimension": "a926b7c64bc8ca99d8d6dcbb81b95235bd3fc34fbed049aca8b01b4d1147c15d",
  "disclosure_closed": "49a350c6f2efae78de0be96c524ebee1fd1291ea449a84224b88d37164a4e807",
  "disclosure_open": "d13ce3f97e3e362a9904fa2bf3412f3f00e4136bc23538b92d41483961d280de",
+  "display": "58b45e5e2230eaf2c80f74b3be2e02a23714c90d6fb03b59ed093a1949993163",
  "dots": "600f7ff209d93145fc938bc4f6a1e34473e6b9ee22a5b4718f133bc7da5ee58d",
  "draft": "9c0fc361cacd0ad95ccd54794f4825dfc9901a83a3de752a588faec365d0ee09",
  "draft_analysis": "eb39c0f90e9cf226da6307365a76015e900dd692dc3f0fdc8f02fe717226261f",
@@ -101,6 +103,7 @@
  "error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
  "explode": "2aecb05d5f05aff1ab629066cb9bea8718ea213ac70948ef71a3ced3321f4cb2",
  "export": "c8c2abf007e43e896479d78798e3976ba9eda809507c820bb38538f77db696ac",
+  "export_tray": "f18606e1f63726c57a0787dced4fb8a221b4a4fc18b88b0bbdee743e546cb489",
  "extend": "28c63df352c77d02feffe44cf09fb0fc1d48f7905aaabbfa6dba601dbb70f8e8",
  "extrude": "9cc1538971c5d25467aaed23f739899d9d102fd07f86472ac3197c54ca2e1144",
  "eye": "2449167c8410826dc1106b687c12a309d5bea8f7817b897943e80f182a163c2d",
@@ -116,12 +119,15 @@
  "folder": "c19f5230df45a1bda1e92e89de38bba21c91e6eca0517eb15847a7712012d1e5",
  "gear": "25a1ca48a587850da1104a46005a330873ed196246e3d04e12cf61f26ad2b0d5",
  "graph": "7156caedd2dbfa2ae53da18b7a2204b8db66c45126859d36caf049a3fd4335a4",
+  "grid": "084b5040d57e9d5183b3db1fad0d17a13ab5bae64676eef703cc06622f9c7438",
  "ground": "23e2471a9d6872e83028e0e219e330cef1930a4d89456a0fefa1bda8a7e3eb81",
+  "ground_shadow": "a96809ed87f5047c2d7f1274908ed7b65b180613322ac9c10eb0f9d6296c1b66",
  "help": "8ce4060577483dbdb510be147d2827de50ac20029354008fca55abc0c7edf05d",
  "hem": "f9b1aafbedcf3dc90c26be308814638e0095fbe31b0647092507343fa60af011",
  "hole": "f82d47751f826e08682db847a270897474661bfe9f35b6d3678f49a203172563",
  "home": "ab5f1c41d377687e4c5a808dfdccf2757b33dd43f934d44df43d6e9118176853",
  "import": "e343540eb49fdb1e53c4d54b9e60ae513b3103df6c9133048bed878e58067455",
+  "import_tray": "c6aec9556dc8ecb6c953d6bf1f384f220c68167a92e444950c24ded81f66a0b6",
  "include": "f5b80ad3e06e3b863fcfbe415ec912e4e09653dd519f9ac207819339fe34730f",
  "infinite": "53fb781131078d2f8e71be23aa610d9f9d9c8bb79ba5f97fa397475e9ff8c3bd",
  "inspect": "d2b4644b2d5f1aa50cb576b9265e275fa91201e296c2bc79865f810067d538e9",
@@ -206,8 +212,45 @@
  "redo": "28e925493fa9e5f52e2c8e3beeb288af13fdb4f85f3cd92270096a10561e7a1a",
  "refold": "1fa6a8604af7d04c01bc31d0e5875eb2cc91f5fa6bfc5491dd6680d3299eb26f",
  "rename": "6887c5467101dca1d213154020d3b03be9b2704ac310de9d0a8ebde62c013bf5",
+  "render_all_shots": "9c04f49624cc2685472041cb3f3e95da2c5f32deeebb9723f4a8e3c369680a5b",
+  "render_appearance": "53287b30915a266d8a3858d5bef24b93ed11f8d612c20c445d3032f400a925cc",
+  "render_aspect_frame": "5d74b263eeb03eb0494b3774817135b8f119caff205a8b31c480d7dd0e5a8554",
+  "render_backdrop": "d27f7d6da7a31c5944dd0ff67c21838690f000f2d87b0bf5274bef0744de34ce",
+  "render_cancel": "2f1d8b3039007ccfc224390758e05d6202fa2eabf63724c744217dcab5d58e5e",
+  "render_check": "65ccf0407d80937c6931cbf87b6d0e628cfb62ca3e841483d02dd9de19c3717c",
+  "render_compare": "1b2d3f3920782490b96b4d14a7cc9506eff98ff2efae00f86d911fabcabc7cb0",
+  "render_copy_look": "25e9138a839a7e6b8225b48cd2f36daba42a928eff541fe616f3df39a1bc82b7",
+  "render_environment": "50cb18380d9310f6e04084c24ac85529599966b1d90c6bef514f4e63f9b30854",
+  "render_execute": "e4d9a66f4569e00c4b4b2ac05a80a9f3eba4e59802c62d3af5bb951ba9153cbf",
+  "render_export_image": "2456f55fa3b50ab84ae871963d4a6b6e92f486cf6ed3039f3a2f07f11192a655",
+  "render_exposure": "60eb5fa040aefe872ab2de66099493513a494ab758a23d443753d033eaf3a05d",
+  "render_fit_product": "8e58b293a39a06fca4cda0543adc2afef3d0041fe34b0bc0c800afb2d5635123",
+  "render_frame_guides": "cb1df01051de42047e38de9dd2a96fcb5b67bd5979cb5756412890400b69e5bc",
+  "render_from_material": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_ground": "2b900b433870cbc4bd0282e54c604ec696aa28354c753a13b09806f5e87d99c3",
  "render_image": "e3dd622591de4fdc211f9bd3c6dcb54b01a308e8bcebd02bb80dd6b3982ce2a5",
+  "render_lens": "79bb615d46a05ea5ffc9e2e905cc25f266b3b7e761c160f7d25bbdb3dea0a430",
+  "render_library": "828af74034a62616c774ab0cbe70b7cf9fd42778b574febfb1812f8aa17fd49b",
+  "render_light_area": "b1f3ee596ee1d35f6e8444b54e94f36a34c2129697c88e5286dbf38565f50816",
+  "render_light_by_highlight": "5b37c8c6aa27ac2002dd8c8094e415c64e9eb315a55c4f146e328314e8f639a2",
+  "render_light_point": "a602cb5fa26f04f1bb9be7c14e5a9a9ce52b37550dfd3211a55e915f941f5803",
+  "render_light_spot": "a9413de906266bec0165b4cb06ecac8e36dce0b6ddec4bc4cc6ff4f152601483",
+  "render_lighting_presets": "e0a08433f548a9dd139296107b04b1d4c57ff04303c9bee32d896e2ea06a8d07",
+  "render_output_size": "f08fe354e4d5a6dd21af29cb077ceed96c413c68f48d9f72548ae1614337f88b",
+  "render_paint": "e3d3202205a5a90906348cae519340d38f475e42039a7f60c835cf7a21081da1",
+  "render_pick_up": "df67d10f333a3c9e367897d599a4be510f10ed36c24763c26817f22d24ff35b7",
+  "render_quality": "28fe44cdd2b2f58b91d91dcf20a6dfbd22cf3db6008e1db179717523ecc4889e",
+  "render_remove_override": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_replace_all": "3bbf830619a91be186b9dc91726b8e47c293556d2ac8c93d87c71014c9f3abcd",
+  "render_results": "94e78898d88eef415e56ca5ec1e056089a2a5aa709abc69e5b8103d6096a019c",
+  "render_same_look": "2b5c69c523a1c949c22638c378803e77123095fddd36cfa58e94b2fd91ca61d7",
  "render_scene": "1c4d7350f6f17ad637a7d633cb65a64c298af20321b1dbdac01b51d47a0e2822",
+  "render_shot": "4428080faa94f276c8a1d20eb38d04835ee5ae9d6337402371a5edf09f97ddc5",
+  "render_shots_strip": "1dcf5cc8e704691985284e0ca06e03b22540ea9d4cd23f4fb8675801ae7e69ec",
+  "render_solo_light": "abb9f8993be108a79d491bfaca32cde59d07a69db3ead58195e8ca0d8e8d909b",
+  "render_sun": "d86b51f3d4d83df4e932a22bb20d567513529a2eaaa42b93f744412eed2be901",
+  "render_transparent_background": "71dab4763516053734d4eec964b0899716d617597fe0d09e3bfa0cc36224dd7a",
+  "render_update_shot": "22d82ad332f8325395596c4bec4c1ec9bbb72d9fc4cd62ad658a93d7f5f803b9",
  "reorder": "c45755c8f23575415397bffb316eed9f2d8c014f451ab6f8c3123aca1a99b675",
  "replace_face": "fcee556c684a1138a30a2574ea565c98ff29f9368c2e861d0fb861155a57d28b",
  "rest": "eab64961b5340bdbbd92affe0c9b8477dc297a3b49e05e39d5fa71c0f2fda66c",
@@ -224,10 +267,23 @@
  "screw": "5e30570785360d6a591ea22862a82f1cf62228385c1e96382536db8a453ac791",
  "section": "cdd13f99f15f6d59bfa21c747810608d6afd00cb8207faf0337928c8521e7eae",
  "select": "fdf6431270006ca7409c60c37cfed59572de04229f104ec723e6010ffa2b7163",
+  "select_bodies": "8e6e61e083e6097535da3b98d41b607b40fc81b72bbd8c7fb903618c5b35c568",
+  "select_components": "3e6cc847b334e92ce7ec5e5f35dfa929572e0974239790d76563ca4e20b26789",
+  "select_faces_edges": "7b99b5370b1647bf8cea57df7a1053caab641c2f4a94c4d797b9679e6f38d6f1",
+  "select_features": "b050bc19ce86d135cbe50998be681555110e92e179c4c7b101170c6b62c19943",
+  "select_parts": "569adc5595a64187411d8ffeea69eab3b76ddfa33aeead6fd728efdd993bcccc",
+  "select_sketch": "b0605b34a14d4173f7ed80d877109ec0b891a1b395bcab5743a603ed2eae240a",
+  "send": "f83b6cdab792f9567a81d46d7828ed20795513c57a2c7d00fbbe6bd14d2f5848",
  "settings": "9193dd3a1007c43660d0d47b6499cb2571338b67949e1a99df112057b9bf2b8a",
+  "settings_keyboard": "4968c70788094365af9c6e2b1c15b2aac45cf21212a14b8a256daf1ffe17f41a",
+  "settings_monitor": "6fcea26e2fc1673c76c6e7fadac4a91812ed43250cfb363c4f40c0cacfbd7aa5",
+  "settings_mouse": "47754752ea6fb37ec9686c0460740935a4db30fb267f1136a9246aec9a17b3f1",
+  "settings_palette": "a060015a750ff4367c65c04b83bf43720e13a38d8dee35330e1d8880f89eaa22",
+  "settings_plug": "79c00b84b2d1d28e3bf6096639c75476b7e1ee0a326c34ad76a79ad866c0102e",
  "sheet": "774e30923ef6f37dd9c0b2bc3e45705e83b3a76700bf071cd41155a365d0daa4",
  "sheet_rules": "5d3a2f37d3b4a4262b3ddbdae53d61f29e0f8e284dd54006da25a7acebfa1114",
  "shell": "a1959ea0d0441a479bf654b6e549e2e44a0bfdc9cda4eb46fe1fbfd884de7e38",
+  "shield": "5e2d2d157309e0daa72f7c53073dfdb0a474def972a041cd172567f1d1e485ec",
  "silhouette": "2a848aed2f247b1c0439f830a34a513c93bc5493c40044c821d493d863ad996e",
  "sketch": "b52e5862b1709a9a7e3ca00d7436d126fbfc01b38080006fa4e17dc581dfa103",
  "sketch_break": "67a5fab332616e6d6a9aeae3bedc04ee0768179143ba34b795bdd98cea04bb24",
@@ -261,7 +317,13 @@
  "status_error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
  "status_warning": "1ac4f0ccfac2c01f6f66cb42188f9ae053c4aef9c5bbd249f1fb09611eb4d825",
  "stitch": "6c3205d64007b771ed78d6f8055867578439fb25d591563b32dbd3343c98732d",
+  "stop": "36967eb4d423370d0d6c679b0a71f8d09f4fb2c73eed3e8cc50c604c44b0c32b",
  "style": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
+  "style_hidden_edges": "a707dfc0bdcabe9144865f569abfcb478e493143cbd4331efc1404cf3082f6d2",
+  "style_shaded": "6e5f8f9a9030ab3717f8b2192bbfd3f6b515ad398acf6cb41bc24f1298bc73b4",
+  "style_shaded_edges": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
+  "style_translucent": "c46b0cd485cfb9023514908357048b5cba9017a0c4976239da1e98f50e4ab5f9",
+  "style_wireframe": "af7e575d378b5b6850bee9d3ca384efab95c8d4c876c5e3524f3ea771c4380a3",
  "suppress": "c54fbc01c12c0175d78cd63f692e8aaf73fc2cac79752b2a3ad821ac32734343",
  "surface": "ba0e839ce0ee03e7ff95a2389a5ecb20bd80c713064d9b1bd5f461f4a80d1921",
  "surface_blend": "0642f3b4af7d22f379a3c74f54c7b1c9eef0bdda19372ce4df73c0e56bdd7bbc",
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Ambient occlusion</title>
+  <g opacity="0.22"><path d="M13 51L51 51A38 38 0 0 0 13 13Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.38"><path d="M13 51L40 51A27 27 0 0 0 13 24Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.62"><path d="M13 51L29 51A16 16 0 0 0 13 35Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M13 10L13 51L54 51" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Display</title>
+  <path d="M10 22L54 22M10 42L54 42" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="24" cy="22" r="10.5" fill="#ffffff"/>
+  <circle cx="42" cy="42" r="10.5" fill="#ffffff"/>
+  <circle cx="24" cy="22" r="6.4" fill="currentColor"/>
+  <circle cx="42" cy="42" r="6.4" fill="currentColor"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Grid</title>
+  <path d="M12 12L52 12L52 52L12 52Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M25.3 12L25.3 52M38.7 12L38.7 52M12 25.3L52 25.3M12 38.7L52 38.7" fill="none" stroke="currentColor" stroke-width="4" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Ground shadow</title>
+  <path d="M32 4.8 L48.1 13.9 L48.1 32.1 L32 41.2 L15.9 32.1 L15.9 13.9Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M9.34 31.35A25 11 0 1 0 54.66 31.35" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Bodies</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Components</title>
+  <path d="M22.91 5.75 L41.09 16.25 L22.91 26.75 L4.72 16.25ZM4.72 16.25 L22.91 26.75 L22.91 47.75 L4.72 37.25ZM41.09 16.25 L59.28 26.75 L41.09 37.25 L22.91 26.75ZM22.91 26.75 L41.09 37.25 L41.09 58.25 L22.91 47.75ZM59.28 26.75 L41.09 37.25 L41.09 58.25 L59.28 47.75Z" fill="currentColor" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M37.46 18.35L22.91 26.75L22.91 43.55" fill="none" stroke="#ffffff" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Faces and edges</title>
+  <path d="M32 6 L55 19 L32 32 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="4.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L9 19M32 32L55 19M32 32L32 58" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Features</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="4.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M9 19L32 32M32 32L55 19M32 32L32 58" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M42 19C42 22.2 37.52 24.8 32 24.8C26.48 24.8 22 22.2 22 19C22 15.8 26.48 13.2 32 13.2C37.52 13.2 42 15.8 42 19Z" fill="currentColor" stroke="currentColor" stroke-width="0.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Parts</title>
+  <path d="M22.91 5.75 L41.09 16.25 L22.91 26.75 L4.72 16.25ZM4.72 16.25 L22.91 26.75 L22.91 47.75 L4.72 37.25Z" fill="none" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M41.09 16.25 L59.28 26.75 L41.09 37.25 L22.91 26.75ZM22.91 26.75 L41.09 37.25 L41.09 58.25 L22.91 47.75ZM59.28 26.75 L41.09 37.25 L41.09 58.25 L59.28 47.75Z" fill="currentColor" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Sketch features</title>
+  <path d="M10 46C18 14 46 14 54 46" fill="none" stroke="currentColor" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="10" cy="46" r="8.6" fill="#ffffff"/>
+  <circle cx="54" cy="46" r="8.6" fill="#ffffff"/>
+  <circle cx="32" cy="22.5" r="8.6" fill="#ffffff"/>
+  <circle cx="10" cy="46" r="5.8" fill="currentColor"/>
+  <circle cx="54" cy="46" r="5.8" fill="currentColor"/>
+  <circle cx="32" cy="22.5" r="5.8" fill="currentColor"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Pinned result</title>
+  <path d="M32 57C25 48 14 35 14 24A18 18 0 0 1 50 24C50 35 39 48 32 57Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M25 24A7 7 0 1 0 39 24A7 7 0 1 0 25 24Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Shaded with hidden edges</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L15.44 22.64M32 32L48.56 22.64M32 32L32 50.72" fill="none" stroke="#ffffff" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L32 13.28M32 32L48.56 41.36M32 32L15.44 41.36" fill="none" stroke="#ffffff" stroke-width="3.2" stroke-linejoin="round" stroke-linecap="round" stroke-dasharray="4.5 4"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Shaded</title>
+  <g opacity="0.5"><path d="M32 6 L55 19 L32 32 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.8"><path d="M9 19 L32 32 L32 58 L9 45Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M32 32 L55 19 L55 45 L32 58Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Translucent</title>
+  <defs>
+    <clipPath id="tr-clip"><path d="M32 8.6 L52.7 20.3 L52.7 43.7 L32 55.4 L11.3 43.7 L11.3 20.3Z"/></clipPath>
+  </defs>
+  <g clip-path="url(#tr-clip)"><path d="M-71 72L9 -8M-60.5 72L19.5 -8M-50 72L30 -8M-39.5 72L40.5 -8M-29 72L51 -8M-18.5 72L61.5 -8M-8 72L72 -8M2.5 72L82.5 -8M13 72L93 -8M23.5 72L103.5 -8M34 72L114 -8M44.5 72L124.5 -8M55 72L135 -8" fill="none" stroke="currentColor" stroke-width="2.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L11.76 20.56M32 32L52.24 20.56M32 32L32 54.88" fill="none" stroke="#ffffff" stroke-width="6.4" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L11.3 20.3M32 32L52.7 20.3M32 32L32 55.4" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Wireframe</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L32 6M32 32L55 19M32 32L55 45M32 32L32 58M32 32L9 45M32 32L9 19" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Colored components</title>
+  <path d="M9.235 17.706L15.059 20.882L15.059 48.941L9.235 44.926Z" fill="#c06f00"/>
+  <path d="M35.176 9.235L15.059 20.882L15.059 48.941L36.765 35.139Z" fill="#a45000"/>
+  <path d="M29.046 5L35.176 8.176L15.196 19.718L9.066 16.541Z" fill="#f1d2af"/>
+  <path d="M29.046 5.529L35.176 8.706L35.176 36.235L15.059 49.471L9.235 45.765L9.066 17.071Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9.066 17.6L15.059 20.882L34.647 9.235" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M15.059 20.882L15.059 47.067" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L44.949 51.122L32.222 43.774Z" fill="#328bd3"/>
+  <path d="M54.934 20.173L44.949 25.944L44.949 51.122L54.934 45.352Z" fill="#236ead"/>
+  <path d="M42.059 12.412L54.934 20.173L44.949 25.944L32 17.706Z" fill="#b9ddf8"/>
+  <path d="M41.159 11.766L54.934 20.173L54.934 45.352L44.949 51.122L31.164 42.715L31.164 17.536Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L54.934 20.173" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M44.949 25.944L44.949 51.122" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L31.015 59L18.299 51.652Z" fill="#a28200"/>
+  <path d="M41.921 40.121L31.015 46.411L31.015 59L41.921 52.711Z" fill="#826700"/>
+  <path d="M29.194 32.773L41.921 40.121L31.015 46.411L18.299 39.062Z" fill="#e5d99b"/>
+  <path d="M29.194 32.773L41.921 40.121L41.921 52.711L31.015 59L18.299 51.652L18.299 39.062Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L41.921 40.121" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M31.015 46.411L31.015 59" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Disable component colors</title>
+  <path d="M9.235 17.706L15.059 20.882L15.059 48.941L9.235 44.926Z" fill="#328bd3"/>
+  <path d="M35.176 9.235L15.059 20.882L15.059 48.941L36.765 35.139Z" fill="#236ead"/>
+  <path d="M29.046 5L35.176 8.176L15.196 19.718L9.066 16.541Z" fill="#b9ddf8"/>
+  <path d="M29.046 5.529L35.176 8.706L35.176 36.235L15.059 49.471L9.235 45.765L9.066 17.071Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9.066 17.6L15.059 20.882L34.647 9.235" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M15.059 20.882L15.059 47.067" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L44.949 51.122L32.222 43.774Z" fill="#328bd3"/>
+  <path d="M54.934 20.173L44.949 25.944L44.949 51.122L54.934 45.352Z" fill="#236ead"/>
+  <path d="M42.059 12.412L54.934 20.173L44.949 25.944L32 17.706Z" fill="#b9ddf8"/>
+  <path d="M41.159 11.766L54.934 20.173L54.934 45.352L44.949 51.122L31.164 42.715L31.164 17.536Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L54.934 20.173" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M44.949 25.944L44.949 51.122" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L31.015 59L18.299 51.652Z" fill="#328bd3"/>
+  <path d="M41.921 40.121L31.015 46.411L31.015 59L41.921 52.711Z" fill="#236ead"/>
+  <path d="M29.194 32.773L41.921 40.121L31.015 46.411L18.299 39.062Z" fill="#b9ddf8"/>
+  <path d="M29.194 32.773L41.921 40.121L41.921 52.711L31.015 59L18.299 51.652L18.299 39.062Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L41.921 40.121" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M31.015 46.411L31.015 59" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Cone</title>
+  <path d="M32 5L12.7 45.97A20 11.55 0 1 0 51.3 45.97Z" fill="#328bd3"/>
+  <path d="M32 5L39 59.82A20 11.55 0 0 0 51.3 45.97Z" fill="#236ead"/>
+  <path d="M32 5L12.7 45.97A20 11.55 0 1 0 51.3 45.97Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Construction line through two points</title>
+  <path d="M8 52L56 12" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round" stroke-dasharray="10 5"/>
+  <circle cx="20" cy="42" r="5.8" fill="#ffffff"/>
+  <circle cx="20" cy="42" r="3.4" fill="#236ead"/>
+  <circle cx="44" cy="22" r="5.8" fill="#ffffff"/>
+  <circle cx="44" cy="22" r="3.4" fill="#236ead"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Construction line at an angle</title>
+  <path d="M10.26 48.66L58.26 48.66" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M28.65 33.23A24 24 0 0 1 34.26 48.66" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M10.26 48.66L54.26 11.66" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="10.26" cy="48.66" r="5.8" fill="#ffffff"/>
+  <circle cx="10.26" cy="48.66" r="3.4" fill="#236ead"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Angle bisector</title>
+  <path d="M13.92 12.18L9.92 52.17L54.92 44.17" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M12.11 30.29A22 22 0 0 1 31.58 48.33" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M9.92 52.17L47.3 11.83" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Horizontal construction line</title>
+  <path d="M8 32L56 32" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round" stroke-dasharray="10 5"/>
+  <circle cx="32" cy="32" r="5.8" fill="#ffffff"/>
+  <circle cx="32" cy="32" r="3.4" fill="#236ead"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Parallel construction line</title>
+  <path d="M9 37L41 9" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M23 55L55 27" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round" stroke-dasharray="10 5"/>
+</svg>
--- a/Show More
+++ b/Show More