Prepare SolidCraft 0.3.2 patch release

feat(ui): allow disabling wheel zoom smoothing

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,21 @@
+---
+name: Bug report
+about: Help reproduce and fix a SolveCraft problem
+title: ''
+labels: ''
+assignees: ''
+---
+
+## Behavior
+
+What did you expect, and what happened instead?
+
+## Reproduction
+
+Include steps, SolveCraft version/commit and relevant environment details. Prefer a small example without private design data.
+
+## Screenshots of the behavior (when observable)
+
+For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
+
+Flowcharts and Mermaid diagrams cannot substitute for evidence of visible behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate the point. Changes with no useful observable behavior may omit screenshot/video evidence. Exclude private designs and sensitive details; attach media or link to an accessible recording rather than committing generated review artifacts.

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+## Change
+
+Describe the problem and resulting behavior. Link the issue when applicable.
+
+## Validation
+
+What did you run, and what were the results? Include expected and measured values for geometry changes.
+
+## Screenshots of the behavior (when observable)
+
+For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
+
+Flowcharts and Mermaid diagrams cannot substitute for evidence of visible behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate the point. Changes with no useful observable behavior may omit screenshot/video evidence. Exclude private designs and sensitive details; attach media or link to an accessible recording rather than committing generated review artifacts.
+
+## Integration status
+
+Record the upstream commit and PR status checked before handoff, any conflicts resolved, and validation after integration. Keep up with upstream merges and monitor this PR while the task is active; rebase before pushing and never force-push.

.github/release-notes.md

@@ -0,0 +1,43 @@
+SolidCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
+parameter to watch the timeline rebuild. [Documentation](https://bherbruck.github.io/solidcraft/)
+· [try it in the browser](https://bherbruck.github.io/solidcraft/app/) ·
+[contributing](https://github.com/bherbruck/solidcraft/blob/main/CONTRIBUTING.md) ·
+[issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
+`solvecraft-cli mcp` ([how](https://bherbruck.github.io/solidcraft/guide/mcp.html)).
+
+Compatibility names are unchanged: existing `.solvecraft` designs, `solvecraft-cli`, package
+IDs and archive filenames still work. Published 0.2.0 and 0.2.1 releases keep their original
+SolveCraft branding. Documentation, the browser app and the Flatpak feed use the new
+SolidCraft project Pages URLs; old-name Pages addresses are not permanent aliases.
+
+**Which file?**
+- **Windows:** `SolveCraft-{version}-windows-x64.exe` runs as is. Or install the `.msi`, or unzip the
+  `-portable.zip` (x64, x86 and arm64).
+- **macOS 11+** (Apple silicon and Intel): open the `.dmg` and drag `SolveCraft.app` onto Applications.
+  The CLI is in `solvecraft-cli-{version}-macos-universal.zip`.
+- **Linux** (x86_64 and aarch64, glibc 2.35+): the `.AppImage` (`chmod +x`, then run it), the
+  `.deb` or `.rpm`, the `.flatpak` (`flatpak install --user <file>`), or the `.tar.gz`.
+- **FreeBSD:** `tar -xzf solvecraft-{version}-freebsd-x86_64.tar.gz --strip-components 1 -C /usr/local`.
+- **Web:** `solvecraft-web-{version}.zip` is a static site to host yourself.
+- `SHA256SUMS.txt`: `sha256sum -c SHA256SUMS.txt --ignore-missing`.
+
+For Flatpak feed installation and updates, add Flathub for the required runtime before
+installing SolidCraft; keep both remotes in the same user installation:
+
+```sh
+flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+flatpak remote-add --user --if-not-exists solvecraft https://bherbruck.github.io/solidcraft/flatpak/solvecraft.flatpakrepo
+flatpak install --user solvecraft ai.storyteller.solvecraft
+flatpak run ai.storyteller.solvecraft
+```
+
+Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
+still need an internet connection. [Linux installation details](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
+
+The builds aren't signed yet. On macOS, right-click `SolveCraft.app` in Applications and choose
+**Open** the first time (or run `xattr -dr com.apple.quarantine /Applications/SolveCraft.app`).
+On Windows, SmartScreen may say "Windows protected your PC": **More info**, then **Run anyway**.
+Licences are built in (Help ▸ About ▸ Licences, `solvecraft-cli licences`); the packages also
+install `THIRD-PARTY-LICENSES.txt`. Known limitations:
+[ROADMAP.md](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations).
+

.github/workflows/ci.yml

@@ -0,0 +1,206 @@
+# Fast checks always run; native builds run for code/CI changes.
+# Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      cross_compile:
+        description: "Also check WebAssembly and RISC-V (before a release)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  changes:
+    name: Select checks
+    runs-on: ubuntu-24.04
+    outputs:
+      native: ${{ steps.paths.outputs.native }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - id: paths
+        name: Detect code and CI changes
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          native=false
+          if [ "$EVENT_NAME" = workflow_dispatch ]; then
+            native=true
+          else
+            # Compare both old and new paths of renames; unknown paths run native checks.
+            git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                .github/workflows/ci.yml) native=true ;;
+                *.rs|Cargo.toml|Cargo.lock|*/Cargo.toml|.cargo/*|rust-toolchain*) native=true ;;
+                docs/*|*.md|.github/*|packaging/*|LICENSE*|NOTICE|THIRD-PARTY-LICENSES.txt) ;;
+                *) native=true ;;
+              esac
+            done < "$RUNNER_TEMP/ci-paths"
+          fi
+          echo "native=$native" >> "$GITHUB_OUTPUT"
+
+  checks:
+    name: Format and repository checks
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: repo-checks
+      - name: Format
+        run: cargo fmt --all -- --check
+      - name: Asset attribution
+        run: cargo xtask assets
+      - name: Licences
+        run: cargo xtask licences --check
+      - name: Dependency layers
+        run: cargo xtask layers
+
+  clippy:
+    name: Native Linux Clippy
+    needs: changes
+    if: needs.changes.outputs.native == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-clippy
+      - run: cargo clippy --workspace --all-targets --profile ci --locked -- -D warnings
+
+  tests:
+    name: Native Linux tests
+    needs: changes
+    if: needs.changes.outputs.native == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    env:
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_GHA_ENABLED: "true"
+      SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-tests
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
+      - name: Compile tests
+        run: cargo test --workspace --profile ci --locked --no-run
+      - name: Run tests
+        # Every test binary at once (cargo test runs them one after another).
+        run: cargo xtask test --locked
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
+
+  # Preserve the existing check name for branch protection, including docs-only PRs.
+  ci:
+    needs: [changes, checks, clippy, tests]
+    if: always()
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Verify required checks
+        env:
+          CHANGES: ${{ needs.changes.result }}
+          CHECKS: ${{ needs.checks.result }}
+          NATIVE: ${{ needs.changes.outputs.native }}
+          CLIPPY: ${{ needs.clippy.result }}
+          TESTS: ${{ needs.tests.result }}
+        run: |
+          test "$CHANGES" = success
+          test "$CHECKS" = success
+          if [ "$NATIVE" = true ]; then
+            test "$CLIPPY" = success
+            test "$TESTS" = success
+          fi
+
+  wasm:
+    name: Compile WebAssembly (manual)
+    if: github.event_name == 'workflow_dispatch' && inputs.cross_compile
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: wasm
+      - run: cargo xtask wasm
+
+  riscv64-gates:
+    name: Compile RISC-V (manual)
+    if: github.event_name == 'workflow_dispatch' && inputs.cross_compile
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check out craft-fonts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: storytold/craft-fonts
+          ref: ${{ env.CRAFT_FONTS_REF }}
+          path: craft-fonts
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: riscv64gc-unknown-linux-gnu
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: riscv64
+      - name: Install cross-compilation dependencies
+        run: |
+          # Ubuntu's regular archive serves amd64; RISC-V packages live in ports.
+          # The 24.04 runner uses deb822 sources, so scope every Ubuntu stanza.
+          sudo sed -i '/^Architectures:/d; /^Types:/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
+          sudo tee /etc/apt/sources.list.d/riscv64.sources >/dev/null <<'EOF'
+          Types: deb
+          URIs: http://ports.ubuntu.com/ubuntu-ports
+          Suites: noble noble-updates noble-backports noble-security
+          Components: main restricted universe multiverse
+          Architectures: riscv64
+          Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+          EOF
+          sudo dpkg --add-architecture riscv64
+          sudo apt-get update
+          sudo apt-get install -y gcc-riscv64-linux-gnu libasound2-dev:riscv64 libxkbcommon-dev:riscv64 \
+            libwayland-dev:riscv64 libx11-dev:riscv64 libxrandr-dev:riscv64 libxi-dev:riscv64 libgl1-mesa-dev:riscv64
+      - name: Cargo check on RISC-V
+        env:
+          CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER: riscv64-linux-gnu-gcc
+          PKG_CONFIG_SYSROOT_DIR: /
+          PKG_CONFIG_PATH: /usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
+          PKG_CONFIG_ALLOW_CROSS: 1
+        run: |
+          . "$HOME/.cargo/env"
+          export CRAFT_FONTS_DIR="$PWD/craft-fonts"
+          cargo check --all-targets --locked --target riscv64gc-unknown-linux-gnu

.github/workflows/flatpak-pages.yml

@@ -0,0 +1,37 @@
+name: Publish Flatpak repository to Pages
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Published GitHub release tag to publish (for example, v1.2.3)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: flatpak-pages-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Request the combined docs, web, and Flatpak deployment
+    runs-on: ubuntu-24.04
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+    steps:
+      - name: Deploy through the shared Pages workflow
+        run: |
+          set -euo pipefail
+          published="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" \
+            --jq 'select(.draft == false and .published_at != null) | .tag_name')"
+          test "$published" = "$RELEASE_TAG"
+          gh workflow run pages.yml --repo "$GITHUB_REPOSITORY" --ref main \
+            -f release_tag="$RELEASE_TAG"
+          echo "Requested the combined Pages deployment for $RELEASE_TAG" >>"$GITHUB_STEP_SUMMARY"

.github/workflows/packaging-lint.yml

@@ -0,0 +1,59 @@
+# Quick static checks for the release pipeline (seconds, no Rust build): workflow syntax, the
+# packaging shell and PowerShell scripts, and the Linux desktop/AppStream/Flatpak metadata.
+# Adapted from PhotoCraft's (storytold/photocraft, Apache-2.0; see ATTRIBUTION.md).
+name: Packaging lint
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/workflows/**", "packaging/**"]
+  pull_request:
+    paths: [".github/workflows/**", "packaging/**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: packaging-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    env:
+      ACTIONLINT_VERSION: 1.7.12
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml jq
+          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
+            | tar -xz -C "$RUNNER_TEMP" actionlint
+      - name: actionlint
+        run: '"$RUNNER_TEMP/actionlint" -color'
+      - name: shellcheck
+        run: shellcheck packaging/*.sh packaging/*/*.sh packaging/linux/AppRun
+      - name: Nightly release selection regression
+        run: python3 packaging/tests/nightly_test.py
+      - name: Windows executable icon validation regression
+        run: python3 packaging/tests/windows_icon_test.py
+      - name: Flatpak desktop smoke validation regression
+        run: python3 packaging/tests/flatpak_test.py
+      - name: PowerShell
+        shell: pwsh
+        run: |
+          foreach ($f in Get-ChildItem packaging/windows/*.ps1) {
+            $errors = $null
+            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
+            if ($errors) { $errors | ForEach-Object { Write-Output "::error file=$($f.Name)::$_" }; exit 1 }
+            Write-Output "ok $($f.Name)"
+          }
+      - name: XML, desktop entry, AppStream, Flatpak manifest
+        run: |
+          xmllint --noout packaging/windows/solvecraft.wxs packaging/windows/solvecraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
+          desktop-file-validate packaging/linux/ai.storyteller.solvecraft.desktop
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.solvecraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solvecraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solvecraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solvecraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solvecraft' and m['command'] == 'solvecraft'"

.github/workflows/pages.yml

@@ -0,0 +1,82 @@
+# The documentation site on GitHub Pages: the book (docs/book) at /solidcraft/ and the web app
+# at /solidcraft/app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
+# repository is private.
+name: Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Published release for Flatpak (empty: latest stable release)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  MDBOOK_VERSION: v0.5.4
+  TRUNK_VERSION: v0.21.14
+
+jobs:
+  build:
+    if: ${{ !github.event.repository.private }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Install mdbook and trunk
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          curl -sSL "https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
+          curl -sSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - name: Build the book
+        run: cargo xtask book
+      - name: Build the web app
+        working-directory: apps/solvecraft-web
+        run: trunk build --release --public-url /solidcraft/app/
+      - name: Assemble the site
+        run: |
+          mkdir -p site
+          cp -r target/book/. site/
+          cp -r dist/web site/app
+      - uses: actions/configure-pages@v5
+        id: pages
+      - name: Install Flatpak repository tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends flatpak ostree
+      - name: Include the published Flatpak repository
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || '' }}
+          PAGES_BASE_URL: ${{ steps.pages.outputs.base_url }}
+        run: bash packaging/flatpak-site.sh site
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release.yml

@@ -0,0 +1,408 @@
+# Release pipeline, after PhotoCraft's (storytold/photocraft, Apache-2.0; see ATTRIBUTION.md).
+#
+# Push to `release` to build packages and create/update a DRAFT GitHub Release. The version
+# comes from [workspace.package] in Cargo.toml. An agent verifies the artifacts and publishes
+# the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
+# At midnight Eastern, changed main commits build and publish a nightly pre-release.
+# A version with a suffix (0.2.0-rc.1) is a pre-release. Nothing is signed yet.
+#
+#   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .tar.gz     packaging/linux
+#   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
+#   macOS universal         .dmg, and the CLI as a .zip                            packaging/macos
+#   Windows x64, x86, arm64 .msi and a portable .zip; x64 also the plain .exe      packaging/windows
+#   Web                     a .zip of the static site                              packaging/web
+#
+# A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+name: Release
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+      timezone: America/New_York
+  push:
+    branches: [release]
+  workflow_dispatch:
+    inputs:
+      draft:
+        description: "Create/update a draft (release branch only; off: build artifacts only)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      build: ${{ steps.changed.outputs.build }}
+      version: ${{ steps.v.outputs.version }}
+      date: ${{ steps.v.outputs.date }}
+      prerelease: ${{ steps.v.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - id: changed
+        name: Skip unchanged nightly builds
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash packaging/nightly.sh
+      - id: v
+        if: steps.changed.outputs.build == 'true'
+        name: Resolve version
+        env:
+          REQUEST_DRAFT: ${{ inputs.draft || false }}
+        run: |
+          . packaging/env.sh
+          if [ "$GITHUB_EVENT_NAME" = schedule ]; then
+            # Unique SemVer without committing daily version bumps to main.
+            VERSION="${VERSION%%-*}-nightly.$(TZ=America/New_York date +%Y%m%d).$GITHUB_RUN_NUMBER.$GITHUB_RUN_ATTEMPT"
+          fi
+          if ! printf '%s' "$VERSION" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?$'; then
+            echo "::error::Cargo.toml must contain a version like 1.2.3 or 1.2.3-rc.1"
+            exit 1
+          fi
+          if [ "$REQUEST_DRAFT" = true ] && [ "$GITHUB_REF" != refs/heads/release ]; then
+            echo "::error::Draft releases must be built from the release branch"
+            exit 1
+          fi
+          case "$VERSION" in *-*) pre=true ;; *) pre=false ;; esac
+          { echo "version=$VERSION"; echo "date=$(date -u +%Y-%m-%d)"; echo "prerelease=$pre"; } >>"$GITHUB_OUTPUT"
+          echo "### SolidCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
+
+  # The app icon in every size, drawn by solvecraft-cli (no image files are committed), for the
+  # Windows jobs: the ARM64 build is cross-compiled and can't run there to draw its own.
+  icons:
+    needs: version
+    if: needs.version.outputs.build == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: release-icons
+      - run: cargo build --release --locked -p solvecraft-cli
+      - run: |
+          . packaging/env.sh
+          make_icons target/release/solvecraft-cli icons
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: icons
+          path: icons
+          if-no-files-found: error
+
+  linux:
+    name: Linux ${{ matrix.arch }}
+    needs: version
+    if: needs.version.outputs.build == 'true'
+    # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35.
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
+          - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      NFPM_VERSION: 2.47.0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install packaging tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends desktop-file-utils appstream zsync rpm
+          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
+          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: release-linux-${{ matrix.arch }}
+      - name: Build and package (AppImage, deb, rpm, tar.gz)
+        run: packaging/linux/package.sh
+      - name: Check the packages
+        run: |
+          dpkg-deb --info dist/release/*.deb
+          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/solvecraft$|usr/bin/solvecraft-cli$|metainfo|applications|THIRD-PARTY-LICENSES.txt'
+          rpm -qip dist/release/*.rpm
+          rpm -qlp dist/release/*.rpm | grep -E '/usr/bin/solvecraft$|THIRD-PARTY-LICENSES.txt'
+          tar -tzf dist/release/*.tar.gz | grep -E '/bin/solvecraft$|THIRD-PARTY-LICENSES.txt'
+          ldd target/release/solvecraft
+          for appimage in dist/release/*.AppImage; do
+            chmod +x "$appimage"
+            APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
+            "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
+            test -s "$appimage.zsync"
+          done
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/release/*
+          if-no-files-found: error
+
+  flatpak:
+    name: Flatpak ${{ matrix.arch }}
+    needs: [version, linux]
+    if: needs.version.outputs.build == 'true'
+    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
+    # build here. 24.04 for a newer flatpak-builder than 22.04 ships.
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-24.04 }
+          - { arch: aarch64, runner: ubuntu-24.04-arm }
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/linux
+      - name: Install flatpak-builder
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common xvfb xauth weston dbus-x11
+          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build the Flatpak bundle
+        run: packaging/linux/flatpak-bundle.sh "dist/linux/solvecraft-$SOLVECRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-flatpak-${{ matrix.arch }}
+          path: dist/release/*.flatpak
+          if-no-files-found: error
+
+
+
+  freebsd:
+    name: FreeBSD x86_64
+    needs: version
+    if: needs.version.outputs.build == 'true'
+    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM.
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build and package in a FreeBSD VM (tar.gz)
+        # vmactions/freebsd-vm v1.5.9, pinned by commit (it runs our build).
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
+        with:
+          release: "14.3"
+          usesh: true
+          cpu: 4
+          mem: 12288
+          # Passed into the VM by name; never templated into the script below.
+          envs: "SOLVECRAFT_VERSION SOLVECRAFT_BUILD_DATE"
+          prepare: |
+            pkg install -y bash git curl pkgconf libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+          run: |
+            set -e
+            . "$HOME/.cargo/env"
+            git config --global --add safe.directory "$PWD"
+            # Build outside the checkout so only dist/ is copied back out of the VM. 4 jobs: more
+            # runs the VM out of memory.
+            export CARGO_TARGET_DIR=/var/tmp/solvecraft-target CARGO_BUILD_JOBS=4
+            bash packaging/freebsd/package.sh
+            tar -tzf dist/release/solvecraft-*-freebsd-x86_64.tar.gz \
+              | grep -E '/bin/solvecraft$|/bin/solvecraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solvecraft/THIRD-PARTY-LICENSES\.txt$'
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-freebsd-x86_64
+          path: dist/release/*
+          if-no-files-found: error
+
+  macos:
+    name: macOS universal
+    needs: version
+    if: needs.version.outputs.build == 'true'
+    runs-on: macos-14
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      SOLVECRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin, x86_64-apple-darwin
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: release-macos-universal
+      - name: Build and package (dmg, CLI zip; the dmg is mounted and checked)
+        run: packaging/macos/package.sh --arch universal
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-macos
+          path: dist/release/*
+          if-no-files-found: error
+
+  windows:
+    name: Windows ${{ matrix.arch }}
+    needs: [version, icons]
+    if: needs.version.outputs.build == 'true'
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x64, target: x86_64-pc-windows-msvc }
+          - { arch: x86, target: i686-pc-windows-msvc }
+          # Windows on ARM: cross-compiled on the x64 runner.
+          - { arch: arm64, target: aarch64-pc-windows-msvc }
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: icons
+          path: icons
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: release-windows-${{ matrix.arch }}
+      - name: Install WiX
+        shell: pwsh
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
+      - name: Build and package (msi, portable zip)
+        shell: pwsh
+        env:
+          SOLVECRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-windows-${{ matrix.arch }}
+          path: dist/release/*
+          if-no-files-found: error
+
+  web:
+    name: Web (wasm)
+    needs: version
+    if: needs.version.outputs.build == 'true'
+    runs-on: ubuntu-latest
+    env:
+      SOLVECRAFT_VERSION: ${{ needs.version.outputs.version }}
+      TRUNK_VERSION: 0.21.14
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: release-web
+      - name: Install trunk
+        run: |
+          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
+            | tar -xz -C "$HOME/.cargo/bin" trunk
+      - name: Build and zip
+        run: packaging/web/package.sh
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-web
+          path: dist/release/*
+          if-no-files-found: error
+
+  release:
+    name: GitHub Release or dry-run artifacts
+    needs: [version, linux, flatpak, freebsd, macos, windows, web]
+    if: needs.version.outputs.build == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      VERSION: ${{ needs.version.outputs.version }}
+      PRERELEASE: ${{ needs.version.outputs.prerelease }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: release-*
+          path: artifacts
+          merge-multiple: true
+      - name: Checksums and notes
+        run: |
+          (cd artifacts && sha256sum -- * | tee SHA256SUMS.txt)
+          sed "s/{version}/$VERSION/g" .github/release-notes.md >notes.md
+      - name: Publish nightly pre-release
+        if: github.event_name == 'schedule'
+        working-directory: artifacts
+        run: |
+          tag="v$VERSION"
+          sha256sum --check SHA256SUMS.txt
+          # Stage all packages before publishing. Published tags are never replaced.
+          gh release create "$tag" --draft --prerelease --latest=false \
+            --title "SolidCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
+            --notes-file ../notes.md --generate-notes -- *
+          gh release edit "$tag" --draft=false --prerelease --latest=false
+          echo "### Published nightly: $tag (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
+      - name: Create or update the draft release
+        if: github.ref == 'refs/heads/release' && (github.event_name == 'push' || inputs.draft)
+        working-directory: artifacts
+        run: |
+          tag="v$VERSION"
+          # Refuse existing tags: a draft must point at this build, never an older tag.
+          # matching-refs returns [] for an absent tag and fails on API/auth errors.
+          existing_refs="$(gh api "repos/$GH_REPO/git/matching-refs/tags/$tag" \
+            --jq '.[].ref')"
+          if printf '%s\n' "$existing_refs" | grep -Fxq "refs/tags/$tag"; then
+            echo "::error::Tag $tag already exists. Choose a new version; never move a release tag."
+            exit 1
+          fi
+          pre=()
+          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
+          if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
+            if [ "$draft" != true ]; then
+              echo "::error::Release $tag is already published. Bump the version before releasing."
+              exit 1
+            fi
+            # Replace the complete draft asset set, including assets removed in this build.
+            assets="$(gh release view "$tag" --json assets --jq '.assets[].name')"
+            while IFS= read -r asset; do
+              if [ -n "$asset" ]; then gh release delete-asset "$tag" "$asset" --yes; fi
+            done <<<"$assets"
+            gh release edit "$tag" --draft --title "SolidCraft v$VERSION" \
+              --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
+            gh release upload "$tag" --clobber -- *
+          else
+            gh release create "$tag" --draft --title "SolidCraft v$VERSION" \
+              --target "$GITHUB_SHA" --notes-file ../notes.md --generate-notes "${pre[@]}" -- *
+          fi
+          {
+            echo "Draft **SolidCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"
+            echo
+            sed 's/^/    /' SHA256SUMS.txt
+          } >>"$GITHUB_STEP_SUMMARY"
+      - name: Keep the files (dry run)
+        if: github.event_name == 'workflow_dispatch' && !inputs.draft
+        run: cp notes.md artifacts/release-notes.md
+      - if: github.event_name == 'workflow_dispatch' && !inputs.draft
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-assets
+          path: artifacts/*

.gitignore

@@ -6,3 +6,4 @@
 *.swp
 /.claude/worktrees/
 /target-snapshot
+__pycache__/

AGENTS.md

@@ -1,12 +1,20 @@
-# SolveCraft — instructions for agents
+# SolidCraft — instructions for agents
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
 kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
 it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
 `gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
 code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
 
+## Product name and compatibility
+SolidCraft is the displayed product name; `solidcraft` is the repository name. Keep existing
+`solvecraft` crate/binary names, `.solvecraft` files, format markers, environment variables,
+settings/recovery paths and package IDs compatible. Published SolveCraft release artifacts
+and attribution records keep their historical names. Public docs/web/Flatpak deployments
+use project Pages `/solidcraft/`; do not add permanent old-name Pages aliases. See README's
+compatibility notes.
+
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
    and the relevant `plan/architecture.md` section. Behaviour reference: `plan/fusion/`
@@ -20,7 +28,7 @@ code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
   `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
@@ -44,13 +52,14 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
   copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
   CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
   operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
+- **Assets — absolutely essential.** SolidCraft contains **no Autodesk iconography, images,
   fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
   file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
   (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
   Breaking this rule is the most serious mistake you can make in this repo.
 - **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = Fusion's command id where Fusion has the command, else a dotted id; label;
+  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
+  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
   toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
   dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
 - **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
@@ -63,19 +72,51 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
 - **Rust only.** Units are millimetres and radians internally; Z is up.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. After each commit that
   passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
   then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
   produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.
 - **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
   (`cargo xtask wasm`, part of `cargo xtask ci`).
 
+## Showing and following through on changes
+
+- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
+  issues and PRs must include actual descriptive screenshots or a short recording from a
+  small reproduction. This includes kernel, geometry, assembly and backend changes whose
+  effects can be shown in the app. Coding agents should run the app and capture this evidence
+  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
+  or result, preferably before and after, with brief reproduction steps, expected/actual
+  behavior and annotations that point out the relevant detail.
+- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
+  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
+  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
+- Use a small public-safe example and check for private designs, paths, account details or
+  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
+  recording; do not commit generated screenshots or videos just to provide review evidence.
+- Throughout the work and before handoff, check current upstream commits and the relevant
+  PR's merge status. Keep your branch current with upstream merges, resolve conflicts without
+  discarding others' work, and re-run validation when integration changes the result. Use
+  `git pull --rebase origin main` before pushing as above; never force-push. Report the checked
+  upstream/PR state, any conflicts resolved and the validation performed. If a PR remains open,
+  keep monitoring it while the task is active and make its pending status clear at handoff;
+  do not claim it merged without checking.
+
+## Application releases
+Development pushes are not application releases. Follow `docs/releasing.md` when asked to
+prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
+Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
+resulting draft and its artifacts. When shipping is authorized, publish that verified draft
+and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
+version bumps solely from commit prefixes, overwrite published versions, or push release tags
+before the draft is verified.
+
 ## Running and looking at the app
 - `cargo run --release -p solvecraft -- --sample --control PORT` (sample design + control channel).
   Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
 - Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
-  - `{"id":1,"method":"engine.execute","params":{"command":"Extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"SketchCreate"}}` then `ui.click {x, y}`
+  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
+  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
   - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
 - **For UI work, look at the result** (screenshot, read the PNG). Without a window use
   `ui.render` or `solvecraft-cli snapshot`.

ATTRIBUTION.md

@@ -10,7 +10,7 @@ third-party material under an open licence. Screenshots of Autodesk software are
 
 Generated-in-code assets are original and have no file to list:
 - the UI icon set (`crates/ui-egui/src/icons.rs`);
-- the view cube, navigation bar and timeline glyphs (`crates/ui-egui/src/viewport.rs`,
+- the axis view, navigation bar and timeline glyphs (`crates/ui-egui/src/viewport.rs`,
   `crates/ui-egui/src/timeline.rs`).
 
 ## Files
@@ -18,6 +18,13 @@ Generated-in-code assets are original and have no file to list:
 | File | Author | Source | Licence |
 |---|---|---|---|
 | docs/screenshots/sample-plate.png | SolveCraft contributors | screenshot of SolveCraft itself (`solvecraft --sample`) | MIT OR Apache-2.0 |
+| docs/screenshots/enclosure-demo-0.2.1.gif | SolveCraft contributors | original electronics enclosure screen recording of the actual SolveCraft 0.2.1 English desktop UI, generated with examples/demo/record_ui.sh and its original animated pointer overlay (4× playback) | MIT OR Apache-2.0 |
+| docs/screenshots/enclosure-demo-0.2.1.mp4 | SolveCraft contributors | original electronics enclosure screen recording of the actual SolveCraft 0.2.1 English desktop UI, generated with examples/demo/record_ui.sh and its original animated pointer overlay (4× playback) | MIT OR Apache-2.0 |
+| docs/book/src/generated/sample-plate.png | SolveCraft contributors | copy of docs/screenshots/sample-plate.png made by `cargo xtask book` (gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/bracket.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot examples/bracket.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/enclosure.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot docs/book/scripts/enclosure.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/revolve.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot docs/book/scripts/revolve.json`; gitignored) | MIT OR Apache-2.0 |
+| docs/book/src/generated/sheet-metal.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot docs/book/scripts/sheet-metal.json`; gitignored) | MIT OR Apache-2.0 |
 | crates/sketch/fonts/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in crates/sketch/fonts/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
 
 ## Code adapted from sibling projects
@@ -34,6 +41,13 @@ Generated-in-code assets are original and have no file to list:
 | crates/io/src/threemf.rs (bounded zip part reading and writing) | GridCraft `crates/xlsx/src/package.rs` | MIT OR Apache-2.0 |
 | crates/ui-egui/src/titlebar.rs (title bar drag, caption buttons, resize zones, their tests) and the window setup in apps/solvecraft/src/main.rs | VectorCraft `crates/ui-egui/src/titlebar.rs`, `apps/vectorcraft/src/main.rs` | MIT OR Apache-2.0 |
 | LICENSE-MIT, LICENSE-APACHE (licence text) | CADCraft | — |
+| .github/workflows/release.yml, .github/workflows/packaging-lint.yml and packaging/ (release pipeline: Linux AppImage/deb/rpm/Flatpak/tar.gz, FreeBSD, macOS dmg, Windows MSI/portable zip, web zip; AppRun, nfpm, Flatpak, WiX and Info.plist templates) | PhotoCraft (https://github.com/storytold/photocraft) `.github/workflows/{release,packaging-lint}.yml`, `packaging/` | Apache-2.0 |
+
+## Recovered contributions
+
+| SolveCraft file | Original contribution | Licence |
+|---|---|---|
+| crates/ui-egui/src/viewport.rs (`nearest_quarter_turn`, `axis_view_orbit`) | N3MI-DG's [PR #101](https://github.com/bherbruck/solvecraft/pull/101): [minimal TOP/BOTTOM turns](https://github.com/bherbruck/solvecraft/commit/c28e780f52490784ef5886f094b9d3f6d10c3e3f) and [drag-to-orbit](https://github.com/bherbruck/solvecraft/commit/f30b30be6ecc4e2e6544a851243137c01a354934), adapted to the axis gizmo | MIT OR Apache-2.0 |
 
 ## Vendored third-party code
 
@@ -42,3 +56,13 @@ Generated-in-code assets are original and have no file to list:
 | vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: parameter searches kept inside the surface domain (vendor/README.md) |
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
 | vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; trace macro (vendor/README.md) |
+| vendor/matext4cgmath | matext4cgmath 0.1.0, https://github.com/ricosjp/matext4cgmath (RICOS Co. Ltd.) | Apache-2.0 | root refinement stops after 100 Newton steps (vendor/README.md) |
+
+## Vendored renderer compatibility fix
+
+`vendor/egui-wgpu` is egui-wgpu 0.36.2 from https://github.com/emilk/egui
+(MIT OR Apache-2.0; both original licence texts are included). Rust sources and
+its original `egui.wgsl` shader are retained; no images or other artwork are copied.
+SolidCraft's narrow patch selects a safe 1x MSAA path on the chosen OpenGL adapter
+and shares that effective count with the surface attachments and CAD callbacks.
+Vulkan, DirectX 12, Metal and WebGPU retain their requested multisampling.

CLAUDE.md

@@ -1,12 +1,20 @@
-# SolveCraft — instructions for agents
+# SolidCraft — instructions for agents
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
 kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
 it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
 `gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
 code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
 
+## Product name and compatibility
+SolidCraft is the displayed product name; `solidcraft` is the repository name. Keep existing
+`solvecraft` crate/binary names, `.solvecraft` files, format markers, environment variables,
+settings/recovery paths and package IDs compatible. Published SolveCraft release artifacts
+and attribution records keep their historical names. Public docs/web/Flatpak deployments
+use project Pages `/solidcraft/`; do not add permanent old-name Pages aliases. See README's
+compatibility notes.
+
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
    and the relevant `plan/architecture.md` section. Behaviour reference: `plan/fusion/`
@@ -20,7 +28,7 @@ code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
   `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
@@ -44,13 +52,14 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
   copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
   CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
   operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
+- **Assets — absolutely essential.** SolidCraft contains **no Autodesk iconography, images,
   fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
   file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
   (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
   Breaking this rule is the most serious mistake you can make in this repo.
 - **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = Fusion's command id where Fusion has the command, else a dotted id; label;
+  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
+  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
   toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
   dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
 - **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
@@ -63,19 +72,28 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
 - **Rust only.** Units are millimetres and radians internally; Z is up.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. After each commit that
   passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
   then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
   produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.
 - **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
   (`cargo xtask wasm`, part of `cargo xtask ci`).
 
+## Application releases
+Development pushes are not application releases. Follow `docs/releasing.md` when asked to
+prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
+Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
+resulting draft and its artifacts. When shipping is authorized, publish that verified draft
+and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
+version bumps solely from commit prefixes, overwrite published versions, or push release tags
+before the draft is verified.
+
 ## Running and looking at the app
 - `cargo run --release -p solvecraft -- --sample --control PORT` (sample design + control channel).
   Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
 - Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
-  - `{"id":1,"method":"engine.execute","params":{"command":"Extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"SketchCreate"}}` then `ui.click {x, y}`
+  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
+  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
   - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
 - **For UI work, look at the result** (screenshot, read the PNG). Without a window use
   `ui.render` or `solvecraft-cli snapshot`.

CONTRIBUTING.md

@@ -0,0 +1,216 @@
+# Contributing to SolidCraft
+
+SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
+You sketch on a plane, constrain the sketch, turn profiles into solids, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
+the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
+model with.
+
+Help is welcome, whether that's a one-line fix or owning a whole area. This page covers how to
+build it, how the code is laid out, the few rules that aren't negotiable, and where help is
+needed most.
+
+## Get it running (about 10 minutes on a fast machine)
+
+You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
+build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://trunkrs.dev).
+
+```sh
+git clone https://github.com/bherbruck/solidcraft && cd solidcraft
+cargo run --release -p solvecraft -- --sample      # desktop app with a sample part
+cargo xtask test                                   # unit, engine and UI-scenario tests
+cargo xtask ci                                     # everything a PR must pass (see below)
+```
+
+SolidCraft is the product and repository name. Cargo packages and executables retain
+their `solvecraft` names for compatibility with existing scripts and MCP clients.
+Build the desktop app with `cargo build --release -p solvecraft`, or the CLI with
+`cargo build --release -p solvecraft-cli`. Run the CLI with
+`cargo run --release -p solvecraft-cli -- commands` (or `target/release/solvecraft-cli commands`
+after building). There is no Cargo package named `solidcraft`.
+
+Web: `cd apps/solvecraft-web && trunk serve --release`, then open the printed URL (`?sample`
+opens the sample part, `?webgl` forces WebGL2). Saving and opening files in the browser needs
+HTTPS or localhost, because it uses the Origin Private File System.
+
+Windows from Linux: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
+
+### NixOS: `nix develop`
+
+NixOS has no `/usr/lib`, so nothing is on `LD_LIBRARY_PATH` and a plain `cargo run` finds none of
+the libraries the app loads at run time: the Wayland ones winit opens the window through, the EGL
+loader wgpu renders through, and libdbus-1, which rfd's file dialogs reach xdg-desktop-portal
+through (a dialog then never appears and the pick returns no path):
+
+```
+ERROR solvecraft: winit EventLoopError: ... The wayland library could not be loaded
+ERROR eframe::native::run: Exiting because of error: WGPU error: Failed to create surface for any enabled backend: {}
+ERROR rfd::backend::xdg_desktop_portal::portal::libdbus: Can't connect to a portal: libdbus-1.so not found
+```
+
+`nix develop` (the [`flake.nix`](flake.nix) in the repository root) supplies Wayland,
+X11, EGL, Vulkan-loader and D-Bus runtime libraries. It also exposes the NixOS
+driver manifests in `/run/opengl-driver/share`, so Vulkan can discover the system
+drivers. Enable `hardware.graphics.enable` on NixOS; other Linux distributions
+may need a matching [nixGL wrapper](https://github.com/nix-community/nixGL).
+The default development shell retains the Rust/C toolchain already on `PATH`;
+`nix develop .#rust` supplies the pinned toolchain and builds in `target/nix`.
+
+To launch, use `nix run .#solidcraft -- --sample`. To install the app's terminal
+commands, desktop entry and generated icons, use `nix profile install .#solidcraft`.
+`nix build` alone creates a build result; it does not install a launcher in your
+desktop menu. The installed `solidcraft` command and compatible `solvecraft`
+command run the same wrapped app; `solvecraft-cli` is included as well. See
+[Nix installation and troubleshooting](docs/nix.md) for remote-flake commands,
+desktop integration and how to distinguish an old executable on `PATH`.
+
+## How the code is laid out
+
+The [README](README.md#architecture) has the layer table. The short version:
+
+- `crates/geom`: vectors, planes, meshes, measures.
+- `crates/sketch`: our own constraint solver, plus profile finding.
+- `crates/kernel`: the B-rep kernel boundary. It wraps [truck](https://github.com/ricosjp/truck),
+  and it's the only crate allowed to touch truck. Fillets, chamfers, shell/offset, Delete Face,
+  Split Face, STEP/IGES read and write, and face provenance are our own code here. Patched
+  copies of three truck crates live in `vendor/` and are excluded from our fmt/clippy rules.
+- `crates/doc`: the document. It holds parameters and expressions, the feature timeline and its
+  incremental rebuild, components and occurrences, joints, appearances, and persistent naming.
+- `crates/io`: design files and mesh formats (3MF, STL, OBJ).
+- `crates/engine`: the session and the command registry. **Everything the user can do is a
+  command**, and the toolbar, dialogs, scripts, CLI, control channel and MCP all run the same
+  commands.
+- `crates/ui-egui`: the desktop/web front end (egui + wgpu). It's swappable; nothing below it
+  depends on egui.
+- `crates/mcp`, `apps/solvecraft`, `apps/solvecraft-cli`, `apps/solvecraft-web`.
+
+`cargo xtask layers` fails the build if a lower layer depends on a higher one.
+
+## Rules that aren't negotiable
+
+1. **Clean-room.** We observe Fusion as a black box: its UI, how parts it builds measure, and
+   what it does with a given input. We never copy Autodesk code, icons, artwork, help text,
+   tooltips, templates or materials, and we never commit files Fusion produced. Command ids are
+   our own (`solid.fillet`, not Fusion's internal names).
+2. **No GPL/LGPL/AGPL code, not even reading it.** That rules out OpenCASCADE, FreeCAD
+   (including planegcs), SolveSpace, CadQuery/OCP, LibreCAD and QCAD. SolidCraft is
+   MIT OR Apache-2.0, and its solver and blends are written from the maths. Permissive
+   dependencies are fine. Note which one you're adding and why in the PR, and run
+   `cargo xtask licences` so THIRD-PARTY-LICENSES.txt lists it (CI checks that it is current).
+3. **Every asset is original or openly licensed and has a row in
+   [ATTRIBUTION.md](ATTRIBUTION.md).** Icons are drawn in code (`crates/ui-egui/src/icons.rs`).
+   `cargo xtask assets` enforces this.
+4. **Never crash.** People trust a CAD app with their work.
+   - Non-test code never uses `unwrap`, `expect`, `panic!` or indexing on input-derived data.
+     There's no `unsafe`, and clippy denies it.
+   - An unsupported case returns an error ("not supported yet: …"); it never panics.
+   - Every call into truck goes through `solvecraft_kernel::guard`.
+   - Every crash fix comes with a regression test.
+5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
+   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
+   face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+
+[AGENTS.md](AGENTS.md) has the long form of these rules. It's written for AI agents, but it's
+the most complete description of the house style.
+
+## Tests
+
+| What | Where | Run |
+|---|---|---|
+| Unit and engine tests | next to the code, or `*_tests.rs` files | `cargo xtask test` (or `cargo test --workspace --profile ci`) |
+| UI scenarios | `crates/ui-egui/tests/scenarios/*.json` | part of `cargo test` |
+| Fusion oracle | `cargo xtask oracle` | needs the local oracle data (see below) |
+
+**UI scenarios** drive the real app headless: start a tool, click a plane or a sketch point,
+press keys, then assert on the result.
+
+```json
+[
+  {"start": "sketch.create"},
+  {"click": {"plane": "XY"}},
+  {"start": "sketch.rectangle.two_point"},
+  {"click": {"sketch": [0, 0]}},
+  {"click": {"sketch": [40, 30]}},
+  {"expect": {"errors": 0}}
+]
+```
+
+A new `.json` file in that folder is picked up automatically. To record a bug before it's fixed,
+put `{"pending": "why"}` in the scenario, and remove it in the PR that fixes the bug.
+
+**Use the `ci` profile.** CI runs the tests with `--profile ci`: light optimisation, line tables,
+no LTO, and debug assertions off (truck has debug-only assertions that reject valid geometry). It
+builds several times faster than `--release`. If a test fails only in a plain debug build, say so
+in the PR. `cargo xtask test` builds the tests with it and then runs every test binary at once
+(`cargo test` runs them one after another); arguments after `--` go to each binary, e.g.
+`cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
+depend on wall-clock timing.
+
+**The Fusion oracle** is a set of 76 reference parts, each built in Fusion from a recipe.
+SolidCraft rebuilds the same recipe and compares volume, area and topology counts with Fusion's
+measurements; [docs/oracle.md](docs/oracle.md) has the current results. The recipes and
+measurements live outside the repo (`plan/`, gitignored), because they come from a Fusion
+install. If you work on geometry and want to check against it, ask in an issue.
+
+## Sending a change
+
+1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solidcraft/issues), labelled
+   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). Before starting,
+   comment on the issue so it gets the `in progress` label and two people don't build the same
+   thing. For anything bigger than a bug fix that has no issue yet, open one first.
+2. Branch from `main` and keep the PR to one topic.
+3. Run `cargo xtask ci` before pushing. It runs fmt, the asset, licence and layer checks,
+   clippy (`-D warnings`), then the tests with the wasm build check alongside. A PR has to pass it.
+4. Reference the issue (`Fixes #12`). In the PR, say what you tested and how. For geometry work, include the measured numbers (and
+   the expected ones).
+
+Help reviewers see what the words mean. For observable CAD, UI or model behavior, please
+include actual descriptive screenshots or a short recording in the issue or PR. This evidence
+is required for changes or bugs that can be demonstrated in the app, including kernel,
+geometry, assembly and backend work. Coding agents should run a small reproduction and
+capture the evidence themselves; please don't ask a human for evidence the agent can produce.
+Show the actual failure or result, preferably before and after, with brief steps and
+expected/actual behavior. An arrow or annotation can help identify the detail that matters.
+
+Flowcharts and Mermaid diagrams cannot replace evidence of visible behavior. Diagrams are
+useful for architectural reasoning when actual screenshots cannot illustrate the point.
+Changes with no useful observable behavior do not need screenshot or video evidence. Use a
+small example without private designs or sensitive details; attach the media or link to an
+accessible recording rather than committing generated review artifacts.
+
+Keep checking upstream commits and the relevant PR's merge status throughout the work and
+before handoff. Integrate upstream merges, resolve conflicts without losing others' changes,
+and validate the integrated result. Before pushing, run `git pull --rebase origin main`, re-run
+CI if it brought changes, and push without force. Report the upstream/PR state you checked,
+any conflicts resolved and validation results. While a task remains active, follow an open
+PR through its status changes; at handoff, clearly identify anything still awaiting merge.
+
+Much of SolidCraft so far was written by AI coding agents (Claude) working in parallel, each
+owning one area, with a human setting direction and reporting bugs. Their working notes are in
+[AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
+long as the change meets the rules above.
+
+## Where help is wanted most
+
+See the [`help wanted`](https://github.com/bherbruck/solidcraft/labels/help%20wanted) and
+[`good first issue`](https://github.com/bherbruck/solidcraft/labels/good%20first%20issue) labels.
+In order of how much they'd help users:
+
+1. **Fillet and blend robustness.** Fillets are our own code (truck has no fillet operation).
+   Constant, variable-radius and chord fillets work, and so do corners where fillets of
+   different radii meet, including three rounds meeting at a vertex. Next are setback corners, fillets along curved edges between curved
+   faces, and fillets that consume neighbouring faces.
+2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
+   through without a kernel error. Each failing seed is a reproducible bug.
+3. **Y-up / Z-up.** SolidCraft is Z-up only, so most STEP files (from SolidWorks, Onshape, or
+   Fusion's default) open lying on their backs. Fusion solves this with a "default modeling
+   orientation" preference.
+4. **Imported appearances.** Colours from STEP files are lost when a feature changes the
+   imported body. They should become design appearances on import.
+5. **Drawings, CAM and mesh tools.** These are out of scope for now (see
+   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
+
+## Licence
+
+By contributing you agree that your contribution is licensed as MIT OR Apache-2.0, like the rest
+of SolidCraft. SolidCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.

Cargo.lock

@@ -422,12 +422,6 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
 [[package]]
 name = "bit-set"
 version = "0.10.0"
@@ -458,6 +452,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.5.1"
@@ -524,12 +527,6 @@ dependencies = [
  "syn 3.0.6",
 ]
 
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
@@ -685,7 +682,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
- "memchr 2.8.3",
+ "memchr",
 ]
 
 [[package]]
@@ -743,6 +740,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -783,6 +789,16 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "cursor-icon"
 version = "1.2.0"
@@ -813,6 +829,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
 [[package]]
 name = "dispatch"
 version = "0.2.0"
@@ -831,6 +857,17 @@ dependencies = [
  "objc2 0.6.5",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "dlib"
 version = "0.5.3"
@@ -934,8 +971,6 @@ dependencies = [
 [[package]]
 name = "egui-wgpu"
 version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -970,6 +1005,7 @@ dependencies = [
  "serde",
  "smithay-clipboard",
  "web-time",
+ "webbrowser",
  "winit",
 ]
 
@@ -1003,6 +1039,20 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "embed-resource"
+version = "3.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6168487b5e7eb2673e6efe1200b1848016e436a6ca0b8031bf04bd9d493a249f"
+dependencies = [
+ "cc",
+ "memchr",
+ "rustc_version",
+ "toml",
+ "vswhom",
+ "winreg",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -1211,6 +1261,15 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "futures-core"
 version = "0.3.34"
@@ -1266,6 +1325,16 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "gethostname"
 version = "1.1.0"
@@ -1496,6 +1565,19 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hidapi"
+version = "2.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818c0e1d27887aaf76fe737042e27a66b796a7b099e6d2e1a72d106c2dff3fa6"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "pkg-config",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -1520,6 +1602,110 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "image"
 version = "0.25.10"
@@ -1741,6 +1927,12 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
 [[package]]
 name = "litrs"
 version = "1.0.0"
@@ -1762,43 +1954,15 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
-[[package]]
-name = "lz4_flex"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05304f8e67dfc93d1b4b990137fd1a7a4c6ad44b60a9c486c8c4486f9d2027ae"
-
-[[package]]
-name = "lzma-sys"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
-]
-
 [[package]]
 name = "matext4cgmath"
 version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6541e181de37f70f0aceb25441823a3d0efa9cc1d23f475a0d3926678949178"
 dependencies = [
  "cgmath",
  "katexit",
  "num-complex",
 ]
 
-[[package]]
-name = "memchr"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "148fab2e51b4f1cfc66da2a7c32981d1d3c083a803978268bb11fe4b86925e7a"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -1927,15 +2091,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
-[[package]]
-name = "nom"
-version = "3.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05aec50c70fd288702bcd93284a8444607f3292dbdf2a30de5ea5dcdbe72287b"
-dependencies = [
- "memchr 1.0.2",
-]
-
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -1945,17 +2100,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "num-derive"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2537,6 +2681,15 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -2612,23 +2765,13 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8533f14c8382aaad0d592c812ac3b826162128b65662331e1127b45c3d18536b"
-dependencies = [
- "memchr 2.8.3",
- "serde",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.38.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
 dependencies = [
- "memchr 2.8.3",
+ "memchr",
 ]
 
 [[package]]
@@ -2637,7 +2780,7 @@ version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
- "memchr 2.8.3",
+ "memchr",
 ]
 
 [[package]]
@@ -2958,7 +3101,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
- "memchr 2.8.3",
+ "memchr",
  "serde",
  "serde_core",
  "zmij",
@@ -2975,6 +3118,26 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -3127,20 +3290,23 @@ dependencies = [
 
 [[package]]
 name = "solvecraft"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "eframe",
  "egui",
+ "embed-resource",
+ "hidapi",
  "log",
  "rfd",
  "serde_json",
  "solvecraft-engine",
  "solvecraft-ui-egui",
+ "winit",
 ]
 
 [[package]]
 name = "solvecraft-cli"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
  "solvecraft-engine",
@@ -3149,11 +3315,12 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-doc"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
  "serde_json",
+ "sha2",
  "solvecraft-geom",
  "solvecraft-kernel",
  "solvecraft-sketch",
@@ -3163,7 +3330,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-engine"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
@@ -3179,7 +3346,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-geom"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -3187,7 +3354,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-io"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "quick-xml 0.38.4",
  "solvecraft-doc",
@@ -3199,7 +3366,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-kernel"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
@@ -3214,7 +3381,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-mcp"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
  "solvecraft-engine",
@@ -3222,16 +3389,17 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-render"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "image",
  "serde",
+ "serde_json",
  "solvecraft-geom",
 ]
 
 [[package]]
 name = "solvecraft-sketch"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -3242,7 +3410,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-ui-egui"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "egui",
  "egui-wgpu",
@@ -3251,16 +3419,19 @@ dependencies = [
  "serde",
  "serde_json",
  "solvecraft-engine",
+ "ttf-parser",
  "web-time",
 ]
 
 [[package]]
 name = "solvecraft-web"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "eframe",
  "egui",
+ "js-sys",
  "log",
+ "serde_json",
  "solvecraft-engine",
  "solvecraft-ui-egui",
  "wasm-bindgen",
@@ -3289,6 +3460,12 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -3302,7 +3479,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
  "proc-macro2",
- "quote",
  "unicode-ident",
 ]
 
@@ -3328,6 +3504,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -3404,6 +3591,16 @@ dependencies = [
  "zune-jpeg",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tokio"
 version = "1.53.2"
@@ -3414,10 +3611,25 @@ dependencies = [
 ]
 
 [[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+name = "toml"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
@@ -3436,13 +3648,19 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_writer"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -3538,7 +3756,6 @@ dependencies = [
  "truck-geometry",
  "truck-polymesh",
  "truck-topology",
- "vtkio",
 ]
 
 [[package]]
@@ -3636,6 +3853,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
 [[package]]
 name = "uds_windows"
 version = "1.2.1"
@@ -3671,6 +3894,24 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "uuid"
 version = "1.27.0"
@@ -3716,22 +3957,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
-name = "vtkio"
-version = "0.6.3"
+name = "vswhom"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abbe89e5b97b472d57abeb02755a06d75b28d2df7d1fe3df5baf032281a65c16"
+checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
 dependencies = [
- "base64",
- "bytemuck",
- "byteorder",
- "flate2",
- "lz4_flex",
- "nom",
- "num-derive",
- "num-traits",
- "quick-xml 0.22.0",
- "serde",
- "xz2",
+ "libc",
+ "vswhom-sys",
+]
+
+[[package]]
+name = "vswhom-sys"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
+dependencies = [
+ "cc",
+ "libc",
 ]
 
 [[package]]
@@ -3970,6 +4212,22 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webbrowser"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62c35be770821a214dbc362fc26908c853e776c0004294d0b10b8a6bad582f94"
+dependencies = [
+ "jni",
+ "log",
+ "ndk-context",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
+ "url",
+ "web-sys",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -4500,7 +4758,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 dependencies = [
- "memchr 2.8.3",
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.56.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4509,6 +4777,12 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
 [[package]]
 name = "x11-dl"
 version = "2.21.0"
@@ -4574,18 +4848,32 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.1.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
 ]
 
 [[package]]
-name = "xz2"
-version = "0.1.7"
+name = "yoke"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
- "lzma-sys",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
 ]
 
 [[package]]
@@ -4714,6 +5002,60 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "zip"
 version = "3.0.0"
@@ -4724,7 +5066,7 @@ dependencies = [
  "crc32fast",
  "flate2",
  "indexmap",
- "memchr 2.8.3",
+ "memchr",
  "zopfli",
 ]
 

Cargo.toml

@@ -5,12 +5,12 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.3.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
-rust-version = "1.90"
-authors = ["SolveCraft contributors"]
-repository = "https://github.com/storytold/solvecraft"
+rust-version = "1.95"
+authors = ["SolidCraft contributors"]
+repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
 # internal
@@ -29,6 +29,7 @@ thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
+sha2 = "0.10"
 
 # geometry kernel (Apache-2.0; see plan/adr/0001-geometry-kernel.md). Only crates/kernel uses it.
 truck-modeling = "0.6"
@@ -72,6 +73,21 @@ opt-level = 2
 [profile.dev]
 opt-level = 1
 
+# Tests and lints (`cargo xtask ci`, GitHub CI): quick to build, quick enough to run. Light
+# optimisation, line tables only (file:line in backtraces), no LTO. Debug assertions are off because
+# truck's debug-only checks reject valid geometry (seam edges, closed edges); that was the only
+# reason the tests used to build with --release, which cost most of CI's time.
+[profile.ci]
+inherits = "dev"
+opt-level = 1
+debug = "line-tables-only"
+debug-assertions = false
+overflow-checks = true
+incremental = false
+
+[profile.ci.package."*"]
+opt-level = 2
+
 [profile.release]
 opt-level = 3
 lto = "thin"
@@ -83,3 +99,7 @@ debug = 0
 truck-shapeops = { path = "vendor/truck-shapeops" }
 truck-stepio = { path = "vendor/truck-stepio" }
 truck-meshalgo = { path = "vendor/truck-meshalgo" }
+matext4cgmath = { path = "vendor/matext4cgmath" }
+
+# Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
+egui-wgpu = { path = "vendor/egui-wgpu" }

NOTICE

@@ -5,7 +5,9 @@ Licensed under the MIT License or the Apache License, Version 2.0, at your optio
 
 Third-party material
 
-Software dependencies are listed in Cargo.lock. The geometry kernel builds on the truck crates
+Software dependencies are listed in Cargo.lock; their licences are in THIRD-PARTY-LICENSES.txt
+(`cargo xtask licences`), which the programs also carry (Help > About > Licences,
+`solvecraft-cli licences`). The geometry kernel builds on the truck crates
 (truck-modeling, truck-shapeops, truck-meshalgo, truck-stepio, truck-topology and their
 dependencies, https://github.com/ricosjp/truck), licensed under the Apache License 2.0 and used
 as libraries. truck-shapeops 0.4.0 is vendored in vendor/truck-shapeops with SolveCraft
@@ -14,6 +16,8 @@ vendor/truck-shapeops/LICENSE. Copyright (c) RICOS Co. Ltd.
 
 Some code is adapted from sibling projects in the storytold family (CADCraft, GridCraft), which are
 licensed MIT OR Apache-2.0; ATTRIBUTION.md lists the files.
+The release packaging (.github/workflows/release.yml, packaging/) is adapted from PhotoCraft
+(https://github.com/storytold/photocraft), licensed under the Apache License 2.0.
 
 None of the bundled assets come from third parties: every icon is drawn in code. The per-file
 list is in ATTRIBUTION.md.

README.md

@@ -1,46 +1,94 @@
-# SolveCraft
+# SolidCraft
 
-SolveCraft is an open-source parametric 3D CAD application written in Rust, in the style of
-Autodesk Fusion: sketch on a plane, constrain and dimension the sketch, turn profiles into solids
-with extrude and revolve, round edges, combine bodies, and change a parameter to watch the whole
-timeline rebuild. It is a clean-room implementation (see [CLAUDE.md](CLAUDE.md)) and part of the
-storytold "craft" family.
+**An open-source parametric 3D CAD application built in pure Rust.**
 
-![SolveCraft with the sample plate](docs/screenshots/sample-plate.png)
+Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
+and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
+model through the built-in MCP server. Part of the storytold "craft" family.
 
-**Status: early (milestone M0 done, M1 in progress).** See [ROADMAP.md](ROADMAP.md),
-[docs/parity.md](docs/parity.md) (command parity with Fusion's Design workspace) and
-[docs/oracle.md](docs/oracle.md) (parts built in Fusion, rebuilt and measured in SolveCraft).
+![SolidCraft: draw a rounded electronics enclosure, sketch its USB port directly on a face, add four mounting bosses and resize it through Parameters](docs/screenshots/enclosure-demo-0.2.1.gif)
+
+*Start with an empty design and draw the original parametric electronics enclosure in the English desktop UI: rounded corners, a shell, a USB port sketched directly on the wall and a four-boss pattern. Change width from 80 → 100 mm and wall thickness from 2 → 3 mm in Parameters and watch it rebuild. Original animated pointer and click cues; 4× playback. [Full video](https://github.com/bherbruck/solidcraft/raw/refs/heads/main/docs/screenshots/enclosure-demo-0.2.1.mp4), generated with the [demo script](examples/demo/record_ui.sh).*
+
+**Documentation:** the [SolidCraft book](https://bherbruck.github.io/solidcraft/) (user guide,
+developer guide and command reference; sources in [docs/book](docs/book)), and the
+[web app](https://bherbruck.github.io/solidcraft/app/) to try it in the browser.
+
+Linux Flatpak installation needs the Freedesktop runtime from Flathub as well as the
+SolidCraft application feed. See [install and launch commands](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
+
+**Status: early but usable for simple parts.** The historical benchmark report records
+76 of 76 reference parts matching volume, area and topology ([docs/oracle.md](docs/oracle.md)).
+These checks do not establish complete geometric or workflow equivalence. Feature coverage
+is tracked in [docs/parity.md](docs/parity.md) and [ROADMAP.md](ROADMAP.md).
+Open work and known bugs are in [GitHub issues](https://github.com/bherbruck/solidcraft/issues),
+and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Name and compatibility
+
+SolidCraft was previously called SolveCraft. The product display name and repository are
+changing; existing identifiers remain compatible: `.solvecraft` designs, `solvecraft-cli`,
+Cargo package names, settings/recovery locations and package IDs keep their existing names.
+Published 0.2.0 and 0.2.1 packages and demo recordings retain their original SolveCraft branding
+and filenames.
+
+Use the SolidCraft documentation and web-app URLs above. GitHub redirects links to the
+renamed repository; old-name Pages and Flatpak URLs are not maintained as permanent aliases.
 
 ## What works
 
-- **Sketches** on the origin planes, offset planes or planar faces: lines, rectangles (2-point,
-  3-point, centre), circles (centre, 2-point, 3-point), arcs (3-point, centre), polygons, slots
-  and points; construction geometry.
+- **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
+  arcs, polygons, slots, ellipses, fit/control splines, conics and text; construction geometry,
+  projection, trimming, fillets and chamfers, including corners at the origin.
+  New face attachments retain supported construction identities and chosen occurrences;
+  missing sources expose an explicit plane repair workflow. See [face attachments](docs/face-attachments.md).
+  Explicitly closed fit splines and closed associative offsets use periodic C2 interpolation.
+  Supported convex line-and-arc offsets retain their identity when an inset consumes corner
+  arcs, and linked extrusions follow the current boundary. Breaking the association freezes
+  the boundary and keeps existing extrusions usable.
+  Curve drawing and picking adapt together to zoom and display scale, including small circles
+  at Fit and sketches in placed components.
 - **Constraints and dimensions** solved by our own solver (damped Gauss–Newton with
   degree-of-freedom analysis): coincident, horizontal/vertical, parallel, perpendicular, tangent,
   equal, concentric, collinear, midpoint, symmetry, fix; linear, aligned, horizontal, vertical,
   radius, diameter and angle dimensions driven by parameters. Over-constraining edits are
   rejected; fully constrained geometry turns black.
+  Select a line or its two endpoints, type its dimension and press Enter to commit one undo
+  step. Fit keeps sketch geometry clear of the palette and navigation controls.
 - **Profiles** found automatically, including regions split by lines and holes inside outlines.
-- **Features** on a parametric timeline: extrude (one side, flipped, symmetric, two-sided, start
-  offset; new body, join, cut, intersect), revolve, fillet and chamfer (straight convex edges),
-  box, cylinder, sphere, torus, combine, move. The timeline rebuilds incrementally from the first
-  changed feature; it can be rolled back, and features can be suppressed, renamed, edited and
-  deleted.
-- **Parameters** with unit-aware expressions (`2 * width + 5 mm`, `angle / 2`).
+  Newly captured complete adaptive boundaries retain their outer and hole source identities
+  when spline span counts change. Partial or ambiguous boundaries do not qualify.
+- **Features** on a parametric timeline: extrude, revolve, sweep, loft, fillet/chamfer,
+  shell, draft, holes, threads, patterns, mirror, split, combine, move and construction geometry.
+  The timeline rebuilds incrementally; features can be edited, suppressed, renamed, reordered
+  and deleted. Supported geometry and current limitations are described in [ROADMAP.md](ROADMAP.md).
+  New revolves preserve symmetric and two-sided angular placement across reversed axes;
+  older designs retain their saved convention when reopened or edited.
+- **Parameters and configurations** with unit-aware expressions (`2 * width + 5 mm`,
+  `angle / 2`), ordered rules, feature suppression and per-row body materials/appearances.
+- **Assemblies** with nested components and occurrences, joints, motion studies, contact sets,
+  interference and material-aware mass properties. Recorded body transfers preserve modelling
+  history and world placement; 3D sketch wires retain their coordinate frames through edits.
+- **Sheet metal** with flanges, hems, fold/unfold/refold, material cutouts, flat patterns,
+  retained shallow prismatic pockets, exact line/arc/circle DXF outlines and bend tables;
+  plastic enclosure features and rules. Pocket depth and side survive unfold/refold and appear
+  separately from through-hole outlines in the flat preview and DXF.
 - **Files**: designs as JSON (`.solvecraft`), export to STEP (AP242 with body names, colours and
-  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori), 3MF, STL (binary/ASCII) and OBJ;
-  3MF and STL import as mesh bodies (they render, measure, move and export; solid features need
-  B-rep bodies);
-  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) as a base feature
-  that later features build on — open a `.step`/`.stp` file, insert one into a design, or drop it
-  on the window ([docs/step-import.md](docs/step-import.md)).
+  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
+  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ;
+  3MF, STL and OBJ import as mesh bodies (they render, measure, move and export; solid features
+  need B-rep bodies);
+  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
+  (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
+  that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
+  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)).
 - **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
-  view cube and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
+  axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
   control channel so agents and tests can drive it.
+  Feature errors and Help can open an editable **Create Issue** draft with relevant context
+  and an optional reviewed screenshot; opening GitHub does not submit the report.
 - **Headless CLI** `solvecraft-cli`: run command scripts, measure (volume, area, centre of mass,
-  face/edge/vertex counts), export, render PNG snapshots, replay Fusion oracle recipes.
+  face/edge/vertex counts), export, render PNG snapshots and replay reference recipes.
 - **MCP server** `solvecraft-cli mcp`: AI agents model, measure and look at parts headless or
   in the running app (see below).
 
@@ -58,6 +106,11 @@ cargo xtask ci                                          # fmt, clippy, tests, as
 
 Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
 
+On Windows, SolidCraft detects a connected 3Dconnexion SpaceNavigator or SpaceMouse through its
+multi-axis HID interface. Move the cap to pan and zoom, and tilt or twist it to rotate the 3D view.
+While editing a sketch, the cap pans and zooms without changing the sketch view. The Navigation
+page in Preferences has an on/off switch and a speed control for the 3D mouse.
+
 In the browser: `cd apps/solvecraft-web && trunk build --release --public-url ./` (WebGPU, or
 WebGL2 with `?webgl`; `?sample` opens the sample part).
 
@@ -67,10 +120,10 @@ A script is a JSON list of commands, the same ones the UI runs:
 
 ```json
 {"commands": [
-  {"command": "SketchCreate", "params": {"plane": "XY"}},
-  {"command": "ShapeRectangleTwoPoint", "params": {"p0": [0, 0], "p1": [40, 30]}},
-  {"command": "Extrude", "params": {"distance": 20}},
-  {"command": "FusionFilletEdgesCommand", "params": {"edges": [[0, 0, 10]], "radius": 3}}
+  {"command": "sketch.create", "params": {"plane": "XY"}},
+  {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [40, 30]}},
+  {"command": "solid.extrude", "params": {"distance": 20}},
+  {"command": "solid.fillet", "params": {"edges": [[0, 0, 10]], "radius": 3}}
 ]}
 ```
 
@@ -86,6 +139,7 @@ configuration and an example session: [docs/mcp.md](docs/mcp.md).
 
 ## Architecture
 
+<!-- ANCHOR: architecture -->
 | Layer | Crates | Role |
 |---|---|---|
 | L0 | `geom` | vectors, planes, profiles, meshes and their measures |
@@ -95,8 +149,23 @@ configuration and an example session: [docs/mcp.md](docs/mcp.md).
 | L4 | `engine` | the session and the command registry (everything is a command) |
 | L5 | `ui-egui`, `mcp` | the swappable desktop front end; the MCP server (headless or bridged to the app) |
 | apps | `solvecraft`, `solvecraft-cli` | desktop app, headless CLI |
+<!-- ANCHOR_END: architecture -->
+
+## Contributing
+
+Coming from Autodesk Fusion? SolidCraft uses familiar parametric CAD workflows: constrained
+sketches, solid features, an editable timeline, parameters and assemblies. See the
+[roadmap](ROADMAP.md) for supported operations and current limitations.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md): how to build and test, the code map, the clean-room
+and licence rules, and where help is wanted most.
 
 ## Licence
 
-MIT OR Apache-2.0, at your option. SolveCraft is not affiliated with Autodesk; Fusion is a
-trademark of Autodesk, Inc.
+MIT OR Apache-2.0, at your option. Developed under the
+[clean-room contribution rules](CLAUDE.md); third-party code and assets retain their
+documented licences and attribution.
+
+References to other products describe workflow comparisons and benchmark provenance.
+SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk. Autodesk and
+Fusion are trademarks of Autodesk, Inc.

ROADMAP.md

@@ -1,22 +1,28 @@
-# SolveCraft roadmap
+# SolidCraft roadmap
 
-Status as of **2026-10-07**. SolveCraft targets Fusion-style parametric modelling (sketch →
+Status as of **2026-10-11**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.
 
 ## At a glance
 
 | Question | Answer |
 |---|---|
-| Where are we? | **M0 done; M1/M2 in progress.** Sketch with solver, extrude (taper, two-sided, through all), revolve, fillet/chamfer, holes, patterns, mirror, shell, draft, loft, sweep, split, construction planes, parameters that rebuild the timeline, STEP/STL export, desktop and browser (wasm) app with Fusion-style selection (hover/selected highlights, origin planes, click-to-pick sketch planes, multi-select, window/crossing box selection, animated view cube), CLI, MCP server, oracle harness. |
-| Command parity (in scope) | **139 / 541 (26%)** in-scope commands; SOLID + SKETCH **102 / 291 (35%)** — [docs/parity.md](docs/parity.md) |
-| Fusion oracle | **72 / 76 parts match** (batch 1: 29/29; batch 2 in progress) — [docs/oracle.md](docs/oracle.md) |
-| Tests | 85 (solver, profiles, kernel booleans/blends/measures, expressions, timeline, file formats, camera, engine end-to-end, hostile-input fuzz over every command) |
+| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server, oracle harness. |
+| Command parity (in scope) | **335 / 541 (62%)** in-scope commands; SOLID + SKETCH **188 / 291 (65%)** — [docs/parity.md](docs/parity.md); registry breadth does not establish workflow or geometric parity |
+| Fusion oracle | **76 / 76 parts match** in the checked-in historical report — [docs/oracle.md](docs/oracle.md). The current sprint adds independent analytic and UI regressions; the local Fusion oracle corpus has not been rerun. |
+| Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
 | Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
-| Weighted parity estimate | **≈ 5%** of Fusion's Design workspace by importance (sketch + basic solids are the core, but surfaces, assemblies, sheet metal, CAM, drawings are untouched) |
-| Time to a useful alpha (M0–M6) | ≈ **150 agent hours** remain |
+| Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
 
 ## Scope (owner decision, 2026-10-07)
 
+The issue batch adds preservation of blind pockets in through cuts, associative projected
+offsets and plastic face placements, XZ (+Y normal) with a v6 migration preserving older
+designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
+toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
+acceptance scenarios now include board resizes; STEP reopening is automated. Inspection in
+Fusion remains an external acceptance step. See [WIP reconciliation](docs/wip-reconciliation.md).
+
 In scope, in priority order:
 1. SOLID and SKETCH (now).
 2. Parameters / functional constraints (done: see `parameters.*`, `expr.evaluate`; unit-aware,
@@ -40,25 +46,93 @@ headline counts in-scope tabs only and lists the deferred ones separately.
 | # | Milestone | Status | Hours left |
 |---|---|---|---|
 | M0 | Vertical slice | done | — |
-| M1 | Sketch depth: done — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs | done | 4 |
+| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends) | planned | 30 |
+| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
 | M4 | Files: STEP import (done: all 29 Fusion STEP files — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), DXF sketches, OBJ import | in progress | 6 |
-| M5 | Persistent naming of faces and edges (plan/adr/0002): faces named from their history (sketch curve sides, caps, revolve sections, primitive sides, blends, pattern/mirror copies; split pieces numbered), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. Left: sheet metal edges, kernel-reported face history (exact through coincident surfaces), more roles (sweep, loft, shell inner faces) | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: edit feature, history marker drag, reorder with dependency checks, suppress, rename, delete with dependents, re-resolved references), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearances, preferences | in progress | 6 |
-| M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces), thread (cosmetic), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Left: emboss on curved faces, thicken (needs surfaces), split face, modelled threads | in progress | 12 |
+| M5 | Persistent naming of faces and edges (plan/adr/0002): faces named from their history (sketch curve sides, caps, revolve sections, primitive sides, blends, pattern/mirror copies; split pieces numbered), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. Left: kernel-reported face history (exact through coincident surfaces) | in progress | 20 |
+| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, reorder with dependency checks, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
+| M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
 | M8 | Surface workspace | deferred | — |
-| M9 | Components and assemblies (Fusion-style): New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done (oracle 67-76). PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, no Fusion oracle (licence), tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table, DXF export), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Bend (Fold) has no engine command yet | in progress | 36 |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done (oracle 67-76). PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, no Fusion oracle (licence), tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
-| M12 | Release: installers, signing, docs, performance | planned | 16 |
-| M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (FusionStartDesignConfigModeCmd, FusionShowDesignConfigPanelCmd, config.column/row/activate). Left: configuration rules, per-row materials and appearances | in progress | 4 |
-| M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solvecraft/2"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solvecraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
+| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
+| M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
+| M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solvecraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solvecraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
+
+## Dimensioning and error reporting
+
+- Single-line and rectangle-side dimensioning supports selecting a line or its two endpoints.
+  Type a value and press Enter to commit one undo step; rejected values remain editable and
+  cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
+  and navigation controls, including enlarged displays and nested pending placements.
+- Contextual error reporting: a **Create Issue** action beside feature errors opens a
+  reviewable GitHub issue draft with the error, operation settings, build diagnostics and
+  useful reproduction context. The draft is editable, with optional capture of the actual
+  viewport and copy/save controls. Opening GitHub does not submit the issue. Help also exposes
+  reporting for unexpected results that did not produce an error.
+- The header exposes **Report a bug**, including an accessible compact control on
+  narrow windows. It opens the same editable report and screenshot review without
+  changing the active model or a pending dimension.
+
+## 0.2.0 release batch
+
+- Includes the new axis navigation, adaptive sketch drawing/picking, origin-corner repairs,
+  durable supported profile/face references, endpoint dimensioning and contextual reporting.
+- Smooth ruled-wall display joins are hidden only within the supported geometric certificate;
+  authored splits and actual creases remain protected. Wireframe retains physical edges.
+- Paste New uses a bounded current-geometry comparison for supported convex line/circle
+  prisms with separated circular holes; unsupported shapes retain the existing strict check.
+- Common-bore Union retries check additional boundary curves before recutting the bore,
+  preventing the reproduced thin-web loss. Unknown additional trims refuse; inherited
+  common-cylinder trims retain their existing policy, so this is not a general Boolean proof.
+- Exact full-path assembly joint editing remains separate work and is not part of this batch.
+- Stable 0.2.0 is published: all release payload checksums, native cold reopening, deployed
+  web app and both Flatpak architectures were verified. The replacement README demo uses
+  the original electronics enclosure story and animated pointer in the actual English
+  0.2.0 UI, at 4× playback. Publication follows [the release workflow](docs/releasing.md).
+
+## 0.2.1 critical fixes
+
+- Axis view and navigation controls stay anchored to the viewport when feature dialogs or
+  the command palette open, at normal and enlarged display scales. Fit still accounts for
+  dialog coverage; covered controls do not receive clicks through dialogs.
+- Eligible planar faces survive fillet, chamfer and shell operations with exact source
+  certificates. Sketches placed directly on the enclosure wall and inner floor follow
+  width and wall changes, including after the USB cut and cold reopening.
+- Remove artificial straight-wall and rounded-corner subdivisions left by shell and
+  extrusion cuts. Identical generated wall segments span adjacent slabs as one physical
+  face, with exact full-height supports and boundary stitching. Preserve authored face
+  splits and face appearances. Permanent regressions cover material, STEP, reopening and
+  unaffected bodies across the extrusion end plane.
+- Feature dialogs use the available screen height for their fields, with OK and Cancel
+  outside the scrolling region, including enlarged display scales.
+- Design format 13 records shell-face attachments. Older designs remain readable;
+  newly saved designs require 0.2.1 or later. Ambiguous or unsupported faces still refuse
+  attachment rather than guessing a plane.
+- Saved projections from a removed strip retain their geometry and report the lost
+  reference. Explicitly reselect the wall to repair that projection.
+
+## View navigation
+
+- Compact clickable signed X/Y/Z axis tips, smooth drag-to-orbit, and Shift-orbit snapping
+  to 26 standard and diagonal views. Pointer motion accumulates independently of a lightly
+  damped spring, with a boundary margin to prevent flicker. Z-up/Y-up and the nearest square
+  top/bottom heading are preserved. Diagonals include 45-degree edge and isometric corner views.
 
 ## Known limitations
 
-- Fillets and chamfers: straight edges (convex or concave) between planar faces with perpendicular
-  planar end faces; whole smooth loops of a planar face, picked whole or by one edge (tangent
+- Associative shell-face sketches require a unique certified planar source. Nested shell
+  attachments and ambiguous coincident sources remain unsupported.
+- Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
+  rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
+  meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
+  planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
+  basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
+  corners around pocket rims, with unequal wall slopes and extensions confined to the face;
+  connected equal-distance chamfers also trim each other across unequal sloped rim walls;
+  whole smooth loops of a planar face, picked whole or by one edge (tangent
   chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
   plate outlines), loops with sharp corners between straight edges (the blends meet in mitres), runs of
   neighbouring edges along a planar face's loop (two top edges of a box: mitred, ending square;
@@ -69,25 +143,172 @@ headline counts in-scope tabs only and lists the deferred ones separately.
   blend a rational B-spline through exact arcs), closed or ending at planar faces square to the
   edges.
 - Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
-  sections stacked end to end) are combined exactly in 2D; bodies touching along one whole face
+  sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
+  annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
+  curved wall qualification rejects false transverse axes instead of filling holes.
+  Bodies touching along one whole face
   (a part and its mirror image) are stitched; coincident planar faces are pushed apart when
   their neighbours are planes or cylinders. Other coincident curved configurations can still
-  fail. Fully internal voids are not supported. Spheres are built from six pole-free patches.
+  fail. Bounded containment classification preserves fully internal cavities and nested
+  material islands independently of shell order, with STEP round-trip and material-membership
+  regressions. Near-contact curved shells use the general boolean path rather than a
+  containment shortcut. Spheres are built from six pole-free patches.
 - Mass properties come from fine tessellation (curved faces within ~1e-4 relative); triangles
   that cut through curved faces (trimmed faces after booleans) are split onto the surface first.
 - STEP import (our own reader, crates/kernel/src/step_in; all 29 Fusion STEP files pass
   `cargo xtask step-corpus`) reads solids (B-rep with analytic and B-spline geometry), units,
-  product names, colours and assemblies; offset surfaces and pcurve-only edges are not read yet,
+  product names, colours and assemblies; analytic offsets on planes, cylinders, cones, spheres
+  and regular tori are read exactly (signed/nested distances, units and face sense). Freeform
+  offset surfaces and pcurve-only edges are not read yet,
   and assembly components are flattened into bodies. Closed periodic faces (torus, B-spline
   bands) are split in two for meshing; measure() uses a finer tolerance for small radii.
-- No persistent naming (fillet edges are re-found by position; projected sketch geometry too).
-- Free-form curves cut at a tangent touch (no clean crossing) enter that profile as polylines.
+- Persistent naming (plan/adr/0002) names faces from their history and edges by their faces;
+  references resolve by name first and warn when the entity split or vanished. Kernel-reported
+  face history (exact through coincident surfaces) is not wired in yet.
+  New planar sketch attachments use exact box, extrusion cap/side and immutable imported-face
+  source certificates with checked target and author occurrence paths. A missing or changed
+  source fails explicitly; Redefine Sketch Plane previews reattachment or a fixed plane while
+  retaining current geometry and dimension identities. Unsupported modified faces need an
+  explicit fixed plane. Legacy attachments retain their original resolver behavior.
+- Modelled threads are cut as a faceted body (curved faces within 1/200 of the pitch); Extrude
+  and Revolve To Object on a curved face cut the tool back to the target's surface.
+- Explicit sketch breaks preserve exact ellipses, fit/control splines (including high degrees)
+  and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
+  touch (no clean crossing) enter that profile as polylines.
   Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
+- Extend intersects exact ellipses and rational/high-degree splines without moving the line or
+  circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
+  certificate and refine within bounded node limits while retaining existing IDs. Singular,
+  self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
+  closed natural-spline seams remain limitations. New explicitly closed fit splines and closed
+  offset outputs use periodic C2 interpolation, supporting repeated certified offsets; older
+  natural splines are preserved. Clicking the starting fit point deliberately closes a new loop.
+  Newly captured adaptive profile references with complete source coverage retain their outer
+  and hole identities through span-count changes, including parameter edits after extrusion.
+  Partial, intersected or ambiguous boundaries do not qualify for these whole-source references.
+  Legacy curve-span multisets remain exact and unchanged; already-lost selections may need
+  reselection. Format 12 stores the new bounded whole-boundary references.
+  Projected analytic boundaries follow nested loop identities through resizing, including
+  stationary holes and rounded corners. Supported convex, tangent line-and-arc boundaries
+  can lose or regain corner arcs during an inset while preserving reserved curve identities
+  and linked profile selections. Format 12 saves those associations; compatible older closed
+  offsets upgrade structurally without changing their curve IDs. Breaking an association
+  freezes its current boundary and materializes downstream profile references. Child offsets
+  of a boundary with retired arcs still require breaking its association first; mixed or
+  nonconvex junctions and retained references to disappearing individual arcs remain limited.
+- Extrude and Revolve editors retain original direction, extent expressions, explicit targets,
+  axes, From/To inputs and All-profile intent. No-op edits preserve downstream dimension names
+  and selected occurrence frames; cancel and successful edits preserve one-step undo history.
+  Placed feature edits preview through the edited timeline entry, and cylindrical Emboss guides
+  use the sketch's actual target, author or uniquely placed third-component frame.
+  Revolve rotators follow the actual signed axis and support symmetric and two-sided extents;
+  dragging a To Object extent converts its derived value to an explicit angle. Legacy reversed-axis
+  symmetric geometry is preserved through format 11's explicit legacy convention. New revolves
+  use the sketch-normal direction for each selected profile, including To Object and curved
+  target trimming, independently of the selected axis sign.
+- Cylindrical emboss/deboss wraps bounded orthogonal line profiles, including holes, concave
+  outlines and nested islands, onto complete exterior cylinders or coaxial sleeves with exact
+  radial walls. New features infer a unique eligible cylinder when the face field is empty;
+  ambiguous targets require an explicit face. Saved target
+  and author occurrence paths retain the chosen placements; missing/split faces refuse rather
+  than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
+  remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
 - Shell and offset faces work on bodies of planes, cylinders, cones and spheres (convex or not:
-  filleted boxes, bosses, domes, countersinks); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
+  filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
+  floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
   sections ruled.
 
+- Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
+  its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
+  the origin; clicked UI regressions verify geometry, closed profiles and undo.
+- Sketch display: drawing, picking, highlighting, tool previews and profile shading share
+  adaptive projected curve boundaries. Fit, zoom, display scale and placed sketch frames
+  invalidate the display cache without changing CAD geometry or timeline history. Work
+  budgets and clipped paths prevent unbounded sampling or invented edges across the eye plane.
+  The Sketch Palette scrolls its options on short windows and enlarged displays while
+  keeping constraint status and Finish Sketch visible.
+- Face projection: closed boundaries have a deterministic outer-first order. Refresh matches
+  existing geometry before assigning positions, retaining saved curve IDs and constraints
+  across enumeration changes and resize, including concentric circles. Ambiguous identities
+  retain the last geometry and report a lost reference; permutation matching is bounded.
+- Inline sketch dimensions: Tab and Shift+Tab cycle within the active shape's value boxes,
+  selecting visited values for replacement. Expression completion retains forward-Tab
+  priority; real keyboard regressions cover rectangles, lines and single-value circles.
+  Typed lengths, radii, line angles, signed arc sweeps and slot lengths persist as constraints
+  and expressions through save/reopen. Shape creation and its dimensions form one undo step;
+  rejected values keep the editable field focused.
+- Repeated components: Browser selection, visibility, properties, copy and Move/Copy use
+  checked occurrence paths. Active nested occurrences author planar sketches and solids in
+  their selected frame. Pending moves compose through parents; dialog cancellation restores
+  its selected move. Source materials and body/face appearances follow transformed instances.
+  Shared nested definitions remain shared. Deep Paste New copies reachable definition graphs,
+  independent feature/input histories, styles and internal motion records, with bounded geometry
+  checks and explicit external-link notices. Paste New selects the copy while preserving the active
+  authoring context. Imported periodic STEP seams survive placement and reexport with shared
+  topology and appearances intact. Recorded body transfers preserve historical Join/Cut membership,
+  material, placements and machining data through edits, copying, undo and reopen. New 3D wires
+  record their coordinate frame; legacy wires migrate from known provenance without changing
+  coordinates. Broken legacy links with missing provenance can require explicit refresh or relink.
+  See [occurrence workflows](docs/occurrence-workflows.md).
+- Parameters and Configurations have distinct actions in the SOLID toolbar's CONFIGURE panel.
+  Parameters opens the user/model variable editor; Configurations opens the configuration table.
+  Configure remains available in the panel dropdown.
+- Parameter creation supports Enter with validation and continued keyboard entry. Shared
+  expression autocomplete supports Up/Down selection, Enter/Tab acceptance and Escape dismissal;
+  accepting a suggestion does not submit a parameter or trigger viewport shortcuts.
+- Movable window title bars follow the app's dark/light header palette. Radial right-click
+  menus are opt-in in Preferences > Navigation; ordinary context menus remain the default.
+- Desktop distribution: running Windows windows and executable resources use the app icon;
+  packaging validates icon resources. Nix installs launchers, MIME data and generated icons,
+  with explicit launch apps and Vulkan-loader/driver discovery. Flatpak feed instructions
+  register the required runtime source; release checks exercise desktop modelling on X11/Wayland.
+- OpenGL rendering clamps effective anti-aliasing to 1x across UI pipelines, textures and CAD
+  callbacks to prevent black frames. Other backends retain the requested sample count, and
+  stored preferences remain unchanged.
+- Configuration rules: ordered typed conditions can drive parameters and suppressions or
+  restrict values. Preview explains effective values without modifying the document; applying
+  rules validates rows atomically. Length expressions retain their authoring units across
+  document-unit changes. The UI supports structured All/Any/Not conditions and rule ordering.
+  Component styles and certified semantic face styles are available; unsupported lineage refuses
+  atomically, and stale certified face paint cannot jump to another surface. See [configurations](docs/configurations.md).
+- Sheet-metal material: inherited holes, crossing edge notches, overlapping cuts and retained
+  islands share the same boundaries in flat preview, DXF and unfolded solids. Detached material
+  pieces survive unfold/refold as one logical sheet group, including split flanged sheets.
+  Circular cuts crossing bends remain unsupported; free-form bases use bounded sampling.
+  Parallel prismatic partial-depth cuts retain pocket side and depth through transfer and
+  unfold/refold, with separate pocket contours in preview and DXF. Planar Intersect preserves
+  exact holes and retained islands, including the union of multiple selected profiles, and
+  records complementary depth layers as pockets while retaining the stock gauge. Unsupported
+  tapered or bend-crossing machining refuses atomically instead of restoring material later.
+- Rolling-ball fillet accuracy: independent offset-cylinder tee references check surface
+  distance, actual trimmed tessellation, supporting-cylinder contacts and tangency at two
+  scales. The measured trimmed-part error is below 0.0001 mm; this is an analytic geometry
+  check, not a new Fusion oracle result. Under-resolved fits return an error.
+- Contact driving checks the trajectory between clear endpoints, including linked joints,
+  playback and sparse motion exports. Checks use bounded tessellation samples, not exact
+  continuous collision detection; local thin walls and small details remain limitations.
+  See [contact-set limits and recovery](docs/contact-sets.md).
+
+## Document-opening performance
+
+- Cold rebuild profiling separates parsing, geometry, placement, display meshing and
+  thumbnails. Straight-line closest-point projection and exact curved-surface evaluation
+  reuse reduce repeated work without relaxing geometry checks. Three alternating optimized
+  benchmark runs reduce median rebuild time by 26% on the public sensor enclosure and 22%
+  on a local case assembly; shape measurements and topology match the original build.
+  See [performance measurements](docs/perf.md). Further cold Boolean and import costs remain.
+- Prepared assembly geometry survives selection and view changes while real geometry and
+  placement changes invalidate it. A Pi assembly edge-selection probe drops from 9.24 s to
+  0.57 s; initial opening is unchanged. Actual Windows desktop profiling measures 15.87 s
+  median opening, with 82% spent rebuilding geometry; halving full opening remains open.
+
 ## Kernel
 
+- Shell of a stepped, joined planar body no longer creates horizontal subdivisions across
+  continuous walls. Fresh axis-aligned Cut walls are stitched using their exact construction
+  support and shared topology, preserving real steps and intentional boundaries. The local
+  reported case returns from 86 to 49 faces with unchanged material and bounds; regressions
+  cover stepped stock, STEP round trips and saved projections from removed pieces.
+
 truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
 retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.

apps/app_icon.rs

@@ -0,0 +1,126 @@
+//! Original SolidCraft mark, shared by desktop, packaging and CLI.
+/// This block is the icon image data
+pub fn rgba(size: usize) -> Result<Vec<u8>, String> {
+    if !(1..=2048).contains(&size) {
+        return Err("icon size must be 1..=2048".into());
+    }
+    type P = (f32, f32);
+    // Coverage buffer at 4x4 samples per pixel (2x2 for big sizes), averaged down at the end.
+    let ss = if size > 512 { 2 } else { 4 };
+    let n = size * ss;
+    let mut buf = vec![[0u8; 4]; n * n];
+    let s = n as f32 / 412.217; // SVG units -> samples: the logo fills the height
+    let ox = (n as f32 - 357.0 * s) / 2.0; // and is centred sideways
+    // Fill a convex polygon given in SVG units.
+    let mut fill = |pts: &[P], col: [u8; 3]| {
+        let v: Vec<P> = pts.iter().map(|p| (ox + p.0 * s, p.1 * s)).collect();
+        let (top, bottom) = v.iter().fold((f32::MAX, f32::MIN), |(a, b), p| (a.min(p.1), b.max(p.1)));
+        for y in ((top - 0.5).ceil() as i32).max(0)..=((bottom - 0.5).floor() as i32).min(n as i32 - 1) {
+            let cy = y as f32 + 0.5;
+            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
+            for i in 0..v.len() {
+                let (a, b) = (v[i], v[(i + 1) % v.len()]);
+                if (a.1 <= cy) != (b.1 <= cy) {
+                    let x = a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0);
+                    lo = lo.min(x);
+                    hi = hi.max(x);
+                }
+            }
+            if lo > hi {
+                continue;
+            }
+            for x in ((lo - 0.5).ceil() as i32).max(0)..=((hi - 0.5).floor() as i32).min(n as i32 - 1) {
+                buf[y as usize * n + x as usize] = [col[0], col[1], col[2], 255];
+            }
+        }
+    };
+    // Faces: each is a few overlapping convex pieces (the filler only does convex shapes).
+    let (light, mid, dark) = ([96, 158, 236], [58, 136, 238], [55, 108, 197]);
+    fill(&[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)], light);
+    fill(&[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], light);
+    fill(&[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)], mid);
+    fill(&[(3.5, 105.9), (3.5, 205.7), (90.3, 256.2), (177.0, 206.1)], mid);
+    fill(&[(177.0, 206.1), (90.3, 256.2), (90.0, 356.2), (177.0, 406.4)], mid);
+    fill(&[(264.1, 155.8), (177.0, 206.1), (177.0, 406.4), (263.8, 256.2)], dark);
+    fill(&[(263.8, 256.2), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], dark);
+    fill(&[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)], dark);
+    fill(&[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)], dark);
+    // White edge lines, 10 units wide: a rectangle per segment and a disc at each inner corner.
+    let white = [255, 255, 255];
+    let mut stroke = |pts: &[P], closed: bool| {
+        let m = pts.len();
+        for i in 0..(if closed { m } else { m - 1 }) {
+            let (a, b) = (pts[i], pts[(i + 1) % m]);
+            let l = ((b.0 - a.0).powi(2) + (b.1 - a.1).powi(2)).sqrt();
+            let (nx, ny) = (-(b.1 - a.1) / l * 5.0, (b.0 - a.0) / l * 5.0);
+            fill(&[(a.0 + nx, a.1 + ny), (b.0 + nx, b.1 + ny), (b.0 - nx, b.1 - ny), (a.0 - nx, a.1 - ny)], white);
+        }
+        for c in &pts[if closed { 0 } else { 1 }..if closed { m } else { m - 1 }] {
+            let disc: Vec<P> = (0..16)
+                .map(|k| {
+                    let t = k as f32 * std::f32::consts::TAU / 16.0;
+                    (c.0 + 5.0 * t.cos(), c.1 + 5.0 * t.sin())
+                })
+                .collect();
+            fill(&disc, white);
+        }
+    };
+    stroke(&[(263.8, 55.9), (177.1, 105.9), (263.8, 156.0), (263.8, 256.2), (350.6, 206.1)], false);
+    stroke(&[(5.0, 105.9), (178.5, 206.1), (178.5, 406.4)], false);
+    stroke(&[(177.0, 206.1), (263.8, 156.0)], false);
+    stroke(
+        &[
+            (178.5, 5.8),
+            (5.0, 105.9),
+            (5.0, 206.1),
+            (91.7, 256.2),
+            (91.7, 356.4),
+            (178.5, 406.4),
+            (352.0, 306.3),
+            (352.0, 206.1),
+            (265.2, 156.0),
+            (265.2, 55.9),
+        ],
+        true,
+    );
+    // Average each ss x ss block down to one pixel (straight alpha = covered share).
+    let mut rgba = Vec::with_capacity(size * size * 4);
+    for y in 0..size {
+        for x in 0..size {
+            let (mut sum, mut cnt) = ([0u32; 3], 0u32);
+            for j in 0..ss {
+                for i in 0..ss {
+                    let p = buf[(y * ss + j) * n + x * ss + i];
+                    if p[3] != 0 {
+                        cnt += 1;
+                        for k in 0..3 {
+                            sum[k] += u32::from(p[k]);
+                        }
+                    }
+                }
+            }
+            if cnt == 0 {
+                rgba.extend_from_slice(&[0, 0, 0, 0]);
+            } else {
+                let a = 255 * cnt / (ss * ss) as u32;
+                rgba.extend_from_slice(&[(sum[0] / cnt) as u8, (sum[1] / cnt) as u8, (sum[2] / cnt) as u8, a as u8]);
+            }
+        }
+    }
+    Ok(rgba)
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn shared_mark_has_transparency_and_original_colors_at_window_and_package_sizes() {
+        for size in [16, 24, 32, 48, 64, 128, 256] {
+            let pixels = super::rgba(size).expect("valid size");
+            assert_eq!(pixels.len(), size * size * 4);
+            assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] == 0));
+            assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] == 255 && p[2] > p[0]));
+        }
+        assert!(super::rgba(0).is_err());
+        assert!(super::rgba(2049).is_err());
+    }
+}

apps/solvecraft-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-cli"
-description = "SolveCraft headless CLI: run command scripts, measure, export, render snapshots, replay oracle recipes"
+description = "SolidCraft headless CLI: run command scripts, measure, export, render snapshots, replay oracle recipes"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

apps/solvecraft-cli/src/fuzz.rs

@@ -0,0 +1,224 @@
+//! `solvecraft-cli fuzz`: random modelling sessions and boolean checks (docs/robustness.md).
+//!
+//! Each seed runs in its own process (`fuzz-one`) with a time limit, so a hang or a hard crash
+//! is recorded like any other failure.
+
+use std::collections::BTreeMap;
+use std::io::{BufRead, BufReader, Read};
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+use solvecraft_engine::fuzz;
+use solvecraft_engine::fuzz::boolean_case;
+
+fn flag<T: std::str::FromStr>(args: &[String], name: &str, default: T) -> T {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).and_then(|v| v.parse().ok()).unwrap_or(default)
+}
+
+/// One seed: a design and a boolean case, as JSON on stdout (progress on stderr).
+pub fn one(args: &[String]) -> Result<(), String> {
+    let seed: u64 = args.first().and_then(|s| s.parse().ok()).ok_or("fuzz-one <seed> [--steps N] [--minimise]")?;
+    let steps = flag(args, "--steps", 8usize);
+    let minimise = args.iter().any(|a| a == "--minimise");
+    // Panics caught inside the kernel: harmless natively, fatal in the web build.
+    static PANICS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    std::panic::set_hook(Box::new(|_| {
+        PANICS.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+    }));
+    eprintln!("design {seed}");
+    let run = fuzz::run_with(seed, steps, &mut |st| eprintln!("step {}", serde_json::to_string(st).unwrap_or_default()));
+    let mut design = json!({
+        "outcome": run.outcome,
+        "steps": run.steps.iter().map(|s| s.kind).collect::<Vec<_>>(),
+        "unsupported": run.unsupported,
+        "rejected": run.rejected,
+        "panics": PANICS.swap(0, std::sync::atomic::Ordering::SeqCst),
+    });
+    if run.outcome.is_bug() {
+        design["script"] = run.script();
+        if minimise {
+            eprintln!("minimise");
+            let m = fuzz::minimise(&run);
+            design["minimal"] = json!({"outcome": m.outcome, "steps": m.steps.iter().map(|s| s.kind).collect::<Vec<_>>(), "script": m.script()});
+        }
+    }
+    let (a, b) = solvecraft_engine::fuzz::boolean_shapes(seed);
+    eprintln!("boolean {seed} {} {}", serde_json::to_string(&a).unwrap_or_default(), serde_json::to_string(&b).unwrap_or_default());
+    let b = boolean_case(seed);
+    let bp = PANICS.swap(0, std::sync::atomic::Ordering::SeqCst);
+    println!("{}", json!({"seed": seed, "design": design, "boolean": b, "boolean_panics": bp}));
+    Ok(())
+}
+
+struct Job {
+    seed: u64,
+    child: std::process::Child,
+    started: Instant,
+    err: std::sync::mpsc::Receiver<String>,
+    last: String,
+}
+
+/// Run seeds `--from`…`--from + --count` in `--jobs` processes, `--timeout` seconds each;
+/// write failing scripts to `--out` and a summary to `--report`.
+pub fn run(args: &[String]) -> Result<(), String> {
+    let from = flag(args, "--from", 0u64);
+    let count = flag(args, "--count", 100u64);
+    let last = from.checked_add(count.saturating_sub(1)).ok_or("seed range exceeds u64::MAX: reduce --from or --count")?;
+    let mut seeds = (count > 0).then_some(from..=last).into_iter().flatten().peekable();
+    let jobs = flag(args, "--jobs", 4usize).clamp(1, 64);
+    let timeout = Duration::from_secs(flag(args, "--timeout", 120u64));
+    let steps = flag(args, "--steps", 8usize);
+    let out_dir = args.iter().position(|a| a == "--out").and_then(|i| args.get(i + 1)).cloned();
+    let report = args.iter().position(|a| a == "--report").and_then(|i| args.get(i + 1)).cloned();
+    let minimise = args.iter().any(|a| a == "--minimise");
+    let exe = std::env::current_exe().map_err(|e| e.to_string())?;
+    if let Some(d) = &out_dir {
+        std::fs::create_dir_all(d).map_err(|e| format!("{d}: {e}"))?;
+    }
+    let mut running: Vec<Job> = Vec::new();
+    let mut results: Vec<Value> = Vec::new();
+    let t0 = Instant::now();
+    while seeds.peek().is_some() || !running.is_empty() {
+        while running.len() < jobs {
+            let Some(seed) = seeds.next() else { break };
+            let mut cmd = Command::new(&exe);
+            cmd.args(["fuzz-one", &seed.to_string(), "--steps", &steps.to_string()]);
+            if minimise {
+                cmd.arg("--minimise");
+            }
+            let mut child = cmd.stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().map_err(|e| e.to_string())?;
+            let (tx, rx) = std::sync::mpsc::channel();
+            if let Some(err) = child.stderr.take() {
+                std::thread::spawn(move || {
+                    for line in BufReader::new(err).lines().map_while(Result::ok) {
+                        if tx.send(line).is_err() {
+                            break;
+                        }
+                    }
+                });
+            }
+            running.push(Job { seed, child, started: Instant::now(), err: rx, last: String::new() });
+        }
+        std::thread::sleep(Duration::from_millis(50));
+        let mut i = 0;
+        while i < running.len() {
+            let Some(j) = running.get_mut(i) else { break };
+            while let Ok(l) = j.err.try_recv() {
+                if l.starts_with("step") || l.starts_with("boolean") || l.starts_with("minimise") {
+                    j.last = l;
+                }
+            }
+            let done = match j.child.try_wait() {
+                Ok(Some(status)) => {
+                    let mut s = String::new();
+                    if let Some(mut o) = j.child.stdout.take() {
+                        let _ = o.read_to_string(&mut s);
+                    }
+                    Some(match serde_json::from_str::<Value>(s.trim()) {
+                        Ok(v) => v,
+                        Err(_) => json!({"seed": j.seed, "crash": format!("exit {status}"), "at": j.last}),
+                    })
+                }
+                Ok(None) if j.started.elapsed() > timeout => {
+                    let _ = j.child.kill();
+                    let _ = j.child.wait();
+                    Some(json!({"seed": j.seed, "timeout": timeout.as_secs(), "at": j.last}))
+                }
+                Ok(None) => None,
+                Err(e) => Some(json!({"seed": j.seed, "crash": e.to_string(), "at": j.last})),
+            };
+            match done {
+                Some(v) => {
+                    record(&v, out_dir.as_deref());
+                    results.push(v);
+                    running.swap_remove(i);
+                }
+                None => i += 1,
+            }
+        }
+    }
+    let summary = summarise(&results, t0.elapsed());
+    println!("{summary}");
+    if let Some(r) = report {
+        std::fs::write(&r, &summary).map_err(|e| format!("{r}: {e}"))?;
+    }
+    Ok(())
+}
+
+/// Print a failure as it comes in and keep its script.
+fn record(v: &Value, out_dir: Option<&str>) {
+    let seed = v["seed"].as_u64().unwrap_or(0);
+    let d = &v["design"];
+    let bug = matches!(d["outcome"]["kind"].as_str(), Some("failed" | "panic" | "invalid" | "volume"));
+    if bug || v.get("timeout").is_some() || v.get("crash").is_some() {
+        eprintln!("seed {seed}: {}", if bug { format!("{} {}", d["outcome"]["kind"], d["outcome"]["detail"]) } else { format!("{v}") });
+    }
+    let bk = v["boolean"]["outcome"].as_str().unwrap_or("ok");
+    if bk != "ok" {
+        eprintln!("seed {seed}: boolean {bk} {}", v["boolean"]["detail"]);
+    }
+    if let Some(dir) = out_dir {
+        use std::io::Write;
+        if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(format!("{dir}/results.jsonl")) {
+            let _ = writeln!(f, "{v}");
+        }
+        if bug {
+            let script = if d.get("minimal").is_some() { &d["minimal"]["script"] } else { &d["script"] };
+            let _ = std::fs::write(format!("{dir}/design-{seed}.json"), serde_json::to_string_pretty(script).unwrap_or_default());
+        }
+        if bk != "ok" {
+            let _ = std::fs::write(format!("{dir}/boolean-{seed}.json"), serde_json::to_string_pretty(&v["boolean"]).unwrap_or_default());
+        }
+    }
+}
+
+fn summarise(results: &[Value], took: Duration) -> String {
+    let n = results.len().max(1);
+    let mut design: BTreeMap<String, usize> = BTreeMap::new();
+    let mut boolean: BTreeMap<String, usize> = BTreeMap::new();
+    let mut at_step: BTreeMap<String, usize> = BTreeMap::new();
+    let mut unsupported: BTreeMap<String, usize> = BTreeMap::new();
+    let mut steps = 0;
+    let (mut dp, mut bp) = (0, 0);
+    for v in results {
+        dp += usize::from(v["design"]["panics"].as_u64().unwrap_or(0) > 0);
+        bp += usize::from(v["boolean_panics"].as_u64().unwrap_or(0) > 0);
+        let k = if v.get("timeout").is_some() {
+            "timeout".to_string()
+        } else if v.get("crash").is_some() {
+            "crash".to_string()
+        } else {
+            v["design"]["outcome"]["kind"].as_str().unwrap_or("?").to_string()
+        };
+        if k != "ok" {
+            let last = v["design"]["steps"].as_array().and_then(|a| a.last()).and_then(Value::as_str).unwrap_or("?");
+            *at_step.entry(format!("{k} at {last}")).or_default() += 1;
+        }
+        *design.entry(k).or_default() += 1;
+        *boolean.entry(v["boolean"]["outcome"].as_str().unwrap_or("not run").to_string()).or_default() += 1;
+        steps += v["design"]["steps"].as_array().map(Vec::len).unwrap_or(0);
+        for u in v["design"]["unsupported"].as_array().into_iter().flatten() {
+            *unsupported.entry(u[0].as_str().unwrap_or("?").to_string()).or_default() += 1;
+        }
+    }
+    let pct = |c: usize| format!("{c} ({:.1} %)", 100.0 * c as f64 / n as f64);
+    let mut s = format!("{} seeds, {steps} design steps, {:.0} s\n\nDesigns:\n", results.len(), took.as_secs_f64());
+    for (k, c) in &design {
+        s += &format!("- {k}: {}\n", pct(*c));
+    }
+    s += "\nFailures by step:\n";
+    for (k, c) in &at_step {
+        s += &format!("- {k}: {c}\n");
+    }
+    s += "\nSteps refused as not supported (undone, the design went on):\n";
+    for (k, c) in &unsupported {
+        s += &format!("- {k}: {c}\n");
+    }
+    s += &format!("\nCaught panics (fatal in the web build): designs {}, boolean checks {}\n", pct(dp), pct(bp));
+    s += "\nBoolean identity (union, intersection, cut of two primitives):\n";
+    for (k, c) in &boolean {
+        s += &format!("- {k}: {}\n", pct(*c));
+    }
+    s
+}

apps/solvecraft-cli/src/main.rs

@@ -3,6 +3,7 @@
 //! ```text
 //! solvecraft-cli run <script.json|design.solvecraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet]
 //! solvecraft-cli eval <script.json|design.solvecraft|part.step> (alias: inspect) measurements as JSON
+//! solvecraft-cli bench-open <design.solvecraft | part.step> [--parse-only] loading timings as JSON lines
 //! solvecraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|top|…]
 //! solvecraft-cli exec <command> [json-params]                 run one command on an empty design
 //! solvecraft-cli commands                                     the command registry as JSON
@@ -10,10 +11,13 @@
 //! solvecraft-cli oracle <case-dir>...                         replay recipes and compare with measure.json
 //! solvecraft-cli step-corpus <case-dir>...                    import part.step and compare with measure.json
 //! solvecraft-cli mcp [--in design|script] [--connect HOST:PORT] MCP server on stdio (docs/mcp.md)
+//! solvecraft-cli licences                                     SolveCraft's licence and the third-party licences
+//! solvecraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
 //! ```
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+mod fuzz;
 mod oracle;
 mod recipe;
 mod seams;
@@ -21,6 +25,9 @@ mod seams;
 use std::process::ExitCode;
 
 use serde_json::{Value, json};
+#[path = "../../app_icon.rs"]
+mod app_icon;
+
 use solvecraft_engine::Session;
 use solvecraft_engine::render::{StandardView, render_png};
 
@@ -28,13 +35,17 @@ const USAGE: &str = "usage:
   solvecraft-cli run <script.json|design.solvecraft|part.step> [--in design.solvecraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results]
   solvecraft-cli run --in <design.solvecraft|part.step> [--out FILE]...
   solvecraft-cli eval <script.json|design.solvecraft|part.step>     (alias: inspect; or --in FILE)
+  solvecraft-cli bench-open <design.solvecraft | part.step> [--parse-only]
   solvecraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|back|top|bottom|left|right]
   solvecraft-cli exec <command> [json-params]
   solvecraft-cli commands
   solvecraft-cli recipe <recipe.json>
   solvecraft-cli oracle <case-dir>... [--json]
-  solvecraft-cli step-corpus <case-dir>... [--json]
+  solvecraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]
+  solvecraft-cli step-corpus <case-dir>... [--json] [--iges]
   solvecraft-cli mcp [--in design.solvecraft|script.json] [--connect 127.0.0.1:PORT]
+  solvecraft-cli licences
+  solvecraft-cli icon --out icon.png [--size 256] | --out icon.ico
 ";
 
 fn main() -> ExitCode {
@@ -45,8 +56,17 @@ fn main() -> ExitCode {
         Some("snapshot") => cmd_snapshot(&args[1..]),
         Some("exec") => cmd_exec(&args[1..]),
         Some("commands") => {
+            use std::io::Write as _;
             let mut s = Session::default();
-            s.execute("engine.commands", &json!({})).map(|v| println!("{}", pretty(&v))).map_err(|e| e.to_string())
+            s.execute("engine.commands", &json!({})).map_err(|e| e.to_string()).and_then(|v| {
+                // A pipeline consumer may stop early (e.g. `commands | head`).
+                // Unlike println!, writing explicitly lets us handle that without a panic.
+                match writeln!(std::io::stdout().lock(), "{}", pretty(&v)) {
+                    Ok(()) => Ok(()),
+                    Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => Ok(()),
+                    Err(e) => Err(format!("stdout: {e}")),
+                }
+            })
         }
         Some("recipe") => args.get(1).ok_or_else(|| USAGE.to_string()).and_then(|p| {
             let v = read_json(p)?;
@@ -54,11 +74,21 @@ fn main() -> ExitCode {
         }),
         Some("oracle") => oracle::run(&args[1..]),
         Some("step-corpus") => oracle::step_corpus(&args[1..]),
+        Some("fuzz") => fuzz::run(&args[1..]),
+        Some("fuzz-one") => fuzz::one(&args[1..]),
         Some("mcp") => cmd_mcp(&args[1..]),
+        Some("icon") => cmd_icon(&args[1..]),
+        Some("licences" | "licenses") => {
+            // Written, not print!ed: a closed pipe (`| head`) is not a crash.
+            use std::io::Write as _;
+            let _ = std::io::stdout().lock().write_all(solvecraft_engine::licences::all().as_bytes());
+            Ok(())
+        }
         // Hidden, for the kill-mid-save test: save a large design over and over.
         Some("save-stress") => cmd_save_stress(&args[1..]),
         // Hidden: time recomputes after parameter edits (docs/perf.md).
         Some("bench-edit") => cmd_bench_edit(&args[1..]),
+        Some("bench-open") => cmd_bench_open(&args[1..]),
         Some("--version" | "-V") => {
             println!("solvecraft-cli {}", env!("CARGO_PKG_VERSION"));
             Ok(())
@@ -79,7 +109,9 @@ fn pretty(v: &Value) -> String {
 }
 
 pub fn read_json(path: &str) -> Result<Value, String> {
-    let s = std::fs::read_to_string(path).map_err(|e| format!("{path}: {e}"))?;
+    // Through the engine's file access, which refuses anything that is not a regular file and
+    // reads no more than the cap: a character device or a FIFO would otherwise never end.
+    let s = solvecraft_engine::io::vfs::read_to_string(path, solvecraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
     serde_json::from_str(&s).map_err(|e| format!("{path}: {e}"))
 }
 
@@ -134,29 +166,32 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
         Some(b) => load(b)?,
         None => Session::default(),
     };
-    if args.iter().any(|a| a == "--results") {
-        // Print every command's result (scripts only).
+    let results = if args.iter().any(|a| a == "--results") {
+        // Collect every command's result (scripts only), then process requested files too.
         let v = read_json(path.ok_or("--results needs a script")?)?;
         let r = s.run_script(&v).map_err(|e| e.to_string())?;
-        println!("{}", pretty(&Value::Array(r)));
-        return Ok(());
-    }
-    match (base, path) {
-        (Some(_), Some(p)) => {
-            let v = read_json(p)?;
-            s.run_script(&v).map_err(|e| e.to_string())?;
+        Some(Value::Array(r))
+    } else {
+        match (base, path) {
+            (Some(_), Some(p)) => {
+                let v = read_json(p)?;
+                s.run_script(&v).map_err(|e| e.to_string())?;
+            }
+            (None, Some(p)) => s = load(p)?,
+            _ => {}
         }
-        (None, Some(p)) => s = load(p)?,
-        _ => {}
-    }
+        None
+    };
     for out in flags(args, "--out") {
-        s.execute("ExportCommand", &json!({"path": out})).map_err(|e| e.to_string())?;
+        s.execute("file.export", &json!({"path": out})).map_err(|e| e.to_string())?;
     }
     if let Some(p) = flag(args, "--save") {
-        s.execute("SaveDocumentAsCommand", &json!({"path": p})).map_err(|e| e.to_string())?;
+        s.execute("file.save_as", &json!({"path": p})).map_err(|e| e.to_string())?;
     }
-    if !args.iter().any(|a| a == "--quiet") {
-        let m = s.execute("MeasureCommand", &json!({})).map_err(|e| e.to_string())?;
+    if let Some(results) = results {
+        println!("{}", pretty(&results));
+    } else if !args.iter().any(|a| a == "--quiet") {
+        let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
         println!("{}", pretty(&m));
     }
     Ok(())
@@ -165,7 +200,7 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
 fn cmd_eval(args: &[String]) -> Result<(), String> {
     let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(|| USAGE.to_string())?;
     let mut s = load(path)?;
-    let m = s.execute("MeasureCommand", &json!({})).map_err(|e| e.to_string())?;
+    let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
     let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
     let out = json!({
         "body_count": m["body_count"],
@@ -196,6 +231,47 @@ fn cmd_snapshot(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
+/// The app icon: the SolidCraft logo, drawn in code on a transparent background
+/// (so packages need no committed image). `.ico` holds the Windows sizes as PNGs.
+fn cmd_icon(args: &[String]) -> Result<(), String> {
+    let out = flag(args, "--out").ok_or("icon needs --out FILE.png or FILE.ico")?;
+    let size: usize = flag(args, "--size").and_then(|x| x.parse().ok()).unwrap_or(256).clamp(8, 2048);
+    let bytes = if out.to_ascii_lowercase().ends_with(".ico") {
+        let pngs: Vec<(usize, Vec<u8>)> =
+            [16, 20, 24, 32, 40, 48, 64, 128, 256].into_iter().map(|s| icon_png(s).map(|p| (s, p))).collect::<Result<_, _>>()?;
+        ico(&pngs)?
+    } else {
+        icon_png(size)?
+    };
+    std::fs::write(out, &bytes).map_err(|e| format!("{out}: {e}"))?;
+    println!("{}", pretty(&json!({"path": out, "bytes": bytes.len()})));
+    Ok(())
+}
+
+fn icon_png(size: usize) -> Result<Vec<u8>, String> {
+    solvecraft_engine::render::png(size, size, app_icon::rgba(size)?).ok_or_else(|| "icon: PNG encoding failed".to_string())
+}
+
+/// A Windows icon file holding PNG images (Vista and later read these).
+fn ico(images: &[(usize, Vec<u8>)]) -> Result<Vec<u8>, String> {
+    let n = u16::try_from(images.len()).map_err(|_| "too many icon sizes")?;
+    let mut out = Vec::new();
+    out.extend_from_slice(&[0, 0, 1, 0]);
+    out.extend_from_slice(&n.to_le_bytes());
+    let mut offset = 6 + 16 * images.len();
+    for (size, data) in images {
+        let dim = if *size >= 256 { 0 } else { *size as u8 };
+        out.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
+        out.extend_from_slice(&u32::try_from(data.len()).map_err(|_| "icon too large")?.to_le_bytes());
+        out.extend_from_slice(&u32::try_from(offset).map_err(|_| "icon too large")?.to_le_bytes());
+        offset += data.len();
+    }
+    for (_, data) in images {
+        out.extend_from_slice(data);
+    }
+    Ok(out)
+}
+
 fn cmd_exec(args: &[String]) -> Result<(), String> {
     let id = args.first().ok_or_else(|| USAGE.to_string())?;
     let p: Value = match args.get(1) {
@@ -239,7 +315,7 @@ fn cmd_save_stress(args: &[String]) -> Result<(), String> {
     s.doc_mut().params.extend(filler);
     for r in 0..rounds {
         s.doc_mut().set_param("save_round", &r.to_string(), None, None).map_err(|e| e.to_string())?;
-        s.execute("SaveDocumentCommand", &json!({ "path": path })).map_err(|e| e.to_string())?;
+        s.execute("file.save", &json!({ "path": path })).map_err(|e| e.to_string())?;
     }
     Ok(())
 }
@@ -266,10 +342,46 @@ fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
         Ok(())
     };
     let expr = expr.replace("{old}", &old);
-    time(&mut s, "edit", "ChangeParameterCommand", json!({"name": param, "expression": expr}))?;
-    time(&mut s, "set back", "ChangeParameterCommand", json!({"name": param, "expression": old}))?;
-    time(&mut s, "undo", "UndoCommand", json!({}))?;
-    time(&mut s, "redo", "RedoCommand", json!({}))?;
+    time(&mut s, "edit", "parameters.change", json!({"name": param, "expression": expr}))?;
+    time(&mut s, "set back", "parameters.change", json!({"name": param, "expression": old}))?;
+    time(&mut s, "undo", "edit.undo", json!({}))?;
+    time(&mut s, "redo", "edit.redo", json!({}))?;
     println!("{}", pretty(&json!(out)));
     Ok(())
 }
+
+/// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
+fn cmd_bench_open(args: &[String]) -> Result<(), String> {
+    let path = args.first().ok_or("usage: solvecraft-cli bench-open <design.solvecraft | part.step> [--parse-only]")?;
+    let t = std::time::Instant::now();
+    let step = solvecraft_engine::io::is_step_path(path);
+    let limit = if step { solvecraft_engine::io::MAX_STEP_BYTES } else { solvecraft_engine::io::MAX_DESIGN_BYTES };
+    let bytes = solvecraft_engine::io::vfs::read(path, limit).map_err(|e| format!("{path}: {e}"))?;
+    let read_ms = t.elapsed().as_secs_f64() * 1000.0;
+    println!("{}", json!({"step": "read", "ms": read_ms, "bytes": bytes.len()}));
+    let t = std::time::Instant::now();
+    let doc = if step {
+        let imported = solvecraft_engine::io::step_import_feature(&bytes, path).map_err(|e| e.to_string())?;
+        let mut doc = solvecraft_engine::doc::Document::new(&imported.name);
+        doc.add_feature(imported.kind, Some(&imported.name)).map_err(|e| e.to_string())?;
+        doc
+    } else {
+        solvecraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?
+    };
+    let parse_ms = t.elapsed().as_secs_f64() * 1000.0;
+    println!("{}", json!({"step": "parse", "ms": parse_ms, "features": doc.features.len()}));
+    if args.iter().any(|a| a == "--parse-only") {
+        return Ok(());
+    }
+    let t = std::time::Instant::now();
+    let s = Session::new(doc);
+    println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0}));
+    for r in &s.model.results {
+        println!("{}", json!({"step": "feature", "id": r.id, "name": r.name, "ms": r.ms, "error": r.error}));
+    }
+    let t = std::time::Instant::now();
+    let st = s.world_state();
+    let triangles: usize = st.bodies.iter().map(|b| b.mesh().triangles.len()).sum();
+    println!("{}", json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "bodies": st.bodies.len(), "triangles": triangles}));
+    Ok(())
+}

apps/solvecraft-cli/src/oracle.rs

@@ -12,7 +12,7 @@ pub const REL_TOL: f64 = 1e-3;
 const APPROXIMATE: [(&str, f64, &str); 1] = [(
     "49-helical-sweep",
     5e-3,
-    "Fusion sweeps along a spline fitted through helix points; SolveCraft builds the true helix (a coil), so the size is compared within 0.5% and the topology not at all",
+    "Fusion sweeps along a spline fitted through helix points; SolidCraft builds the true helix (a coil), so the size is compared within 0.5% and the topology not at all",
 )];
 
 fn check_case(dir: &str) -> Value {
@@ -31,7 +31,7 @@ fn check_case(dir: &str) -> Value {
     if let Err(e) = s.run_script(&script) {
         return json!({"case": name, "pass": false, "error": e.to_string()});
     }
-    let got = match s.execute("MeasureCommand", &json!({})) {
+    let got = match s.execute("inspect.measure", &json!({})) {
         Ok(m) => m,
         Err(e) => return json!({"case": name, "pass": false, "error": e.to_string()}),
     };
@@ -77,7 +77,7 @@ fn check_case(dir: &str) -> Value {
                     })
                     .collect();
                 seam_note = Some(format!(
-                    "topology compared seam-normalised: Fusion's {}/{}/{} faces/edges/vertices become {f}/{e}/{v} with closed-surface patches counted once and seam edges and vertices dropped (raw SolveCraft/Fusion: {})",
+                    "topology compared seam-normalised: Fusion's {}/{}/{} faces/edges/vertices become {f}/{e}/{v} with closed-surface patches counted once and seam edges and vertices dropped (raw SolidCraft/Fusion: {})",
                     want["total"]["faces"],
                     want["total"]["edges"],
                     want["total"]["vertices"],
@@ -120,7 +120,7 @@ fn check_case(dir: &str) -> Value {
         .collect();
     if !effective.is_empty() {
         out["note"] = json!(format!(
-            "known Fusion difference: {} replayed with the extent Fusion actually used (its through-all is sized as 1.1 × the farthest vertex, so curved tops stop it short; SolveCraft's through-all goes truly through)",
+            "known Fusion difference: {} replayed with the extent Fusion actually used (its through-all is sized as 1.1 × the farthest vertex, so curved tops stop it short; SolidCraft's through-all goes truly through)",
             effective.join(", ")
         ));
     }
@@ -170,9 +170,10 @@ const FUSION_AREA_OFF: &[&str] = &["50-sweep-tight-bend"];
 
 /// Import a case's `part.step` (as File → Open does) and compare with Fusion's measurements:
 /// body count, volume and area (relative 1e-3) and the faces read from the file.
-fn check_step_case(dir: &str) -> Value {
+/// Open the case's `part.step` (or `part.igs` with `iges`) and compare with measure.json.
+fn check_step_case(dir: &str, iges: bool) -> Value {
     let name = std::path::Path::new(dir).file_name().map(|x| x.to_string_lossy().to_string()).unwrap_or_default();
-    let sp = format!("{dir}/part.step");
+    let sp = format!("{dir}/{}", if iges { "part.igs" } else { "part.step" });
     let want = match read_json(&format!("{dir}/measure.json")) {
         Ok(m) => m,
         Err(e) => return json!({"case": name, "pass": false, "error": e}),
@@ -183,7 +184,7 @@ fn check_step_case(dir: &str) -> Value {
         Ok(v) => v,
         Err(e) => return json!({"case": name, "pass": false, "error": e.to_string()}),
     };
-    let got = match s.execute("MeasureCommand", &json!({})) {
+    let got = match s.execute("inspect.measure", &json!({})) {
         Ok(m) => m,
         Err(e) => return json!({"case": name, "pass": false, "error": e.to_string()}),
     };
@@ -191,7 +192,14 @@ fn check_step_case(dir: &str) -> Value {
     // Faces read from the file (the kernel may split a face that wraps around a closed surface).
     let file_faces = std::fs::read(&sp)
         .ok()
-        .and_then(|b| solvecraft_engine::kernel::step_import_shared(&String::from_utf8_lossy(&b)).ok())
+        .and_then(|b| {
+            let text = String::from_utf8_lossy(&b);
+            if iges {
+                solvecraft_engine::kernel::iges_import(&text).ok().map(std::sync::Arc::new)
+            } else {
+                solvecraft_engine::kernel::step_import_shared(&text).ok()
+            }
+        })
         .map(|imp| imp.bodies.iter().map(|b| b.file_faces).sum::<usize>() as f64);
     let mut checks = Vec::new();
     let mut pass = true;
@@ -221,7 +229,8 @@ pub fn step_corpus(args: &[String]) -> Result<(), String> {
     if dirs.is_empty() {
         return Err("step-corpus: give one or more case directories (each with part.step and measure.json)".into());
     }
-    let results: Vec<Value> = dirs.iter().map(|d| check_step_case(d)).collect();
+    let iges = args.iter().any(|a| a == "--iges");
+    let results: Vec<Value> = dirs.iter().map(|d| check_step_case(d, iges)).collect();
     report(args, &results);
     let failed = results.iter().filter(|r| !r["pass"].as_bool().unwrap_or(false)).count();
     if failed > 0 { Err(format!("{failed} STEP case(s) failed")) } else { Ok(()) }

apps/solvecraft-cli/src/recipe.rs

@@ -10,7 +10,7 @@ fn plane_param(pl: &Value) -> Value {
     let origin_zero = pl.get("origin").and_then(Value::as_array).is_none_or(|o| o.iter().all(|x| x.as_f64().unwrap_or(0.0).abs() < 1e-12));
     let std = match r.to_ascii_uppercase().as_str() {
         "XY" => Some(([1.0, 0.0, 0.0], [0.0, 1.0, 0.0])),
-        "XZ" => Some(([1.0, 0.0, 0.0], [0.0, 0.0, 1.0])),
+        "XZ" => Some(([1.0, 0.0, 0.0], [0.0, 0.0, -1.0])),
         "YZ" => Some(([0.0, 1.0, 0.0], [0.0, 0.0, 1.0])),
         _ => None,
     };
@@ -44,23 +44,23 @@ fn sketch_cmds(f: &Value, out: &mut Vec<Value>) -> Result<(), String> {
     if let Some(n) = f.get("name") {
         p["name"] = n.clone();
     }
-    out.push(json!({"command": "SketchCreate", "params": p}));
+    out.push(json!({"command": "sketch.create", "params": p}));
     for e in f.get("entities").and_then(Value::as_array).into_iter().flatten() {
         let id = e.get("id").cloned().unwrap_or(Value::Null);
         let construction = e.get("construction").cloned().unwrap_or(json!(false));
         match e.get("type").and_then(Value::as_str) {
-            Some("line") => out.push(json!({"command": "DrawPolyline", "params": {"points": [parg(e.get("start")), parg(e.get("end"))], "ids": [id], "construction": construction}})),
-            Some("circle") => out.push(json!({"command": "CircleCenterRadius", "params": {"center": parg(e.get("center")), "radius": e.get("radius"), "id": id, "construction": construction}})),
-            Some("arc_three_point") => out.push(json!({"command": "ArcThreePoint", "params": {"start": parg(e.get("start")), "end": parg(e.get("end")), "through": e.get("mid").or(e.get("through")), "id": id}})),
-            Some("arc_center_start_sweep") => out.push(json!({"command": "ArcCenterTwoPoint", "params": {"center": parg(e.get("center")), "start": parg(e.get("start")), "sweep": e.get("sweep_deg").or(e.get("sweep")), "id": id}})),
+            Some("line") => out.push(json!({"command": "sketch.line", "params": {"points": [parg(e.get("start")), parg(e.get("end"))], "ids": [id], "construction": construction}})),
+            Some("circle") => out.push(json!({"command": "sketch.circle.center", "params": {"center": parg(e.get("center")), "radius": e.get("radius"), "id": id, "construction": construction}})),
+            Some("arc_three_point") => out.push(json!({"command": "sketch.arc.three_point", "params": {"start": parg(e.get("start")), "end": parg(e.get("end")), "through": e.get("mid").or(e.get("through")), "id": id}})),
+            Some("arc_center_start_sweep") => out.push(json!({"command": "sketch.arc.center_point", "params": {"center": parg(e.get("center")), "start": parg(e.get("start")), "sweep": e.get("sweep_deg").or(e.get("sweep")), "id": id}})),
             Some("arc") => {
                 if e.get("center").is_some() {
-                    out.push(json!({"command": "ArcCenterTwoPoint", "params": {"center": parg(e.get("center")), "start": parg(e.get("start")), "end": parg(e.get("end")), "id": id}}))
+                    out.push(json!({"command": "sketch.arc.center_point", "params": {"center": parg(e.get("center")), "start": parg(e.get("start")), "end": parg(e.get("end")), "id": id}}))
                 } else {
-                    out.push(json!({"command": "ArcThreePoint", "params": {"start": parg(e.get("start")), "end": parg(e.get("end")), "through": parg(e.get("through").or(e.get("mid"))), "id": id}}))
+                    out.push(json!({"command": "sketch.arc.three_point", "params": {"start": parg(e.get("start")), "end": parg(e.get("end")), "through": parg(e.get("through").or(e.get("mid"))), "id": id}}))
                 }
             }
-            Some("point") => out.push(json!({"command": "DrawPoint", "params": {"point": parg(e.get("at").map(|a| json!({"at": a})).as_ref().or(Some(e))), "id": id}})),
+            Some("point") => out.push(json!({"command": "sketch.point", "params": {"point": parg(e.get("at").map(|a| json!({"at": a})).as_ref().or(Some(e))), "id": id}})),
             // A 3D helix fit: the sweep along it becomes a coil (see `helix_path`).
             Some("fitted_spline") if e.get("fit_points").and_then(Value::as_array).is_some_and(|a| a.iter().any(|p| p.get(2).is_some())) => {}
             Some(other) => return Err(format!("recipe: sketch entity type `{other}` is not supported yet")),
@@ -77,9 +77,9 @@ fn sketch_cmds(f: &Value, out: &mut Vec<Value>) -> Result<(), String> {
                 p[k] = v.clone();
             }
         }
-        out.push(json!({"command": "SketchDimension", "params": p}));
+        out.push(json!({"command": "sketch.dimension", "params": p}));
     }
-    out.push(json!({"command": "SketchStop", "params": {}}));
+    out.push(json!({"command": "sketch.finish", "params": {}}));
     Ok(())
 }
 
@@ -138,33 +138,33 @@ fn constraint_cmd(c: &Value) -> Result<Value, String> {
     let at = |i: usize| r.get(i).cloned().unwrap_or(Value::Null);
     let is_point = |v: &Value| v.as_str().is_some_and(|s| s.contains('.') || s == "origin" || s.starts_with('p'));
     let (cmd, p) = match ty.as_str() {
-        "horizontal" | "vertical" if r.len() >= 2 => ("ConstraintHorizontalVertical", json!({"points": [at(0), at(1)], "mode": ty})),
-        "horizontal" | "vertical" => ("ConstraintHorizontalVertical", json!({"line": at(0), "mode": ty})),
-        "horizontal_points" => ("ConstraintHorizontalVertical", json!({"points": [at(0), at(1)], "mode": "horizontal"})),
-        "vertical_points" => ("ConstraintHorizontalVertical", json!({"points": [at(0), at(1)], "mode": "vertical"})),
+        "horizontal" | "vertical" if r.len() >= 2 => ("sketch.constraint.horizontal_vertical", json!({"points": [at(0), at(1)], "mode": ty})),
+        "horizontal" | "vertical" => ("sketch.constraint.horizontal_vertical", json!({"line": at(0), "mode": ty})),
+        "horizontal_points" => ("sketch.constraint.horizontal_vertical", json!({"points": [at(0), at(1)], "mode": "horizontal"})),
+        "vertical_points" => ("sketch.constraint.horizontal_vertical", json!({"points": [at(0), at(1)], "mode": "vertical"})),
         "coincident" | "point_on_curve" => {
             // The point goes first.
             if is_point(&at(0)) {
-                ("ConstraintCoincident", json!({"a": at(0), "b": at(1)}))
+                ("sketch.constraint.coincident", json!({"a": at(0), "b": at(1)}))
             } else {
-                ("ConstraintCoincident", json!({"a": at(1), "b": at(0)}))
+                ("sketch.constraint.coincident", json!({"a": at(1), "b": at(0)}))
             }
         }
         "midpoint" => {
             if is_point(&at(0)) {
-                ("ConstraintMidPoint", json!({"point": at(0), "line": at(1)}))
+                ("sketch.constraint.midpoint", json!({"point": at(0), "line": at(1)}))
             } else {
-                ("ConstraintMidPoint", json!({"point": at(1), "line": at(0)}))
+                ("sketch.constraint.midpoint", json!({"point": at(1), "line": at(0)}))
             }
         }
-        "symmetric" | "symmetry" => ("ConstraintSymmetry", json!({"a": at(0), "b": at(1), "line": at(2)})),
-        "fix" => ("ConstraintFix", json!({"entity": at(0), "fixed": true})),
-        "tangent" => ("ConstraintTangent", json!({"a": at(0), "b": at(1)})),
-        "equal" => ("ConstraintEqual", json!({"a": at(0), "b": at(1)})),
-        "parallel" => ("ConstraintParallel", json!({"a": at(0), "b": at(1)})),
-        "perpendicular" => ("ConstraintPerpendicular", json!({"a": at(0), "b": at(1)})),
-        "concentric" => ("ConstraintConcentric", json!({"a": at(0), "b": at(1)})),
-        "collinear" => ("ConstraintCollinear", json!({"a": at(0), "b": at(1)})),
+        "symmetric" | "symmetry" => ("sketch.constraint.symmetry", json!({"a": at(0), "b": at(1), "line": at(2)})),
+        "fix" => ("sketch.constraint.fix", json!({"entity": at(0), "fixed": true})),
+        "tangent" => ("sketch.constraint.tangent", json!({"a": at(0), "b": at(1)})),
+        "equal" => ("sketch.constraint.equal", json!({"a": at(0), "b": at(1)})),
+        "parallel" => ("sketch.constraint.parallel", json!({"a": at(0), "b": at(1)})),
+        "perpendicular" => ("sketch.constraint.perpendicular", json!({"a": at(0), "b": at(1)})),
+        "concentric" => ("sketch.constraint.concentric", json!({"a": at(0), "b": at(1)})),
+        "collinear" => ("sketch.constraint.collinear", json!({"a": at(0), "b": at(1)})),
         other => return Err(format!("recipe: constraint `{other}` is not supported yet")),
     };
     Ok(json!({"command": cmd, "params": p}))
@@ -294,7 +294,7 @@ fn circle_fit(pts: &[[f64; 3]]) -> Option<(f64, f64)> {
 pub fn to_script(recipe: &Value) -> Result<Value, String> {
     let mut out: Vec<Value> = Vec::new();
     for p in recipe.get("parameters").and_then(Value::as_array).into_iter().flatten() {
-        out.push(json!({"command": "ChangeParameterCommand", "params": {"name": p.get("name"), "expression": p.get("expression").or(p.get("value")), "unit": p.get("unit").cloned().unwrap_or(json!("mm"))}}));
+        out.push(json!({"command": "parameters.change", "params": {"name": p.get("name"), "expression": p.get("expression").or(p.get("value")), "unit": p.get("unit").cloned().unwrap_or(json!("mm"))}}));
     }
     let features = recipe.get("features").and_then(Value::as_array).ok_or("recipe: missing `features`")?;
     for f in features {
@@ -305,9 +305,9 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
             Some("extrude") => {
                 let mut p = json!({"sketch": profile_sketch(f), "profiles": profiles_of(f), "operation": op(f), "name": name, "body_names": bodies});
                 extent(f, &mut p);
-                out.push(json!({"command": "Extrude", "params": p}));
+                out.push(json!({"command": "solid.extrude", "params": p}));
             }
-            Some("combine") => out.push(json!({"command": "FusionCombineCommand", "params": {
+            Some("combine") => out.push(json!({"command": "solid.combine", "params": {
                 "target": f.get("target_body").or(f.get("target")), "tools": f.get("tool_bodies").or(f.get("tools")),
                 "operation": op(f), "keep_tools": f.get("keep_tools").cloned().unwrap_or(json!(false)), "name": name}})),
             Some("revolve") => {
@@ -316,7 +316,7 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                     Some(a) => a.get("line").or(a.get("ref")).cloned().unwrap_or_else(|| a.clone()),
                     None => Value::Null,
                 };
-                out.push(json!({"command": "Revolve", "params": {
+                out.push(json!({"command": "solid.revolve", "params": {
                     "sketch": profile_sketch(f), "profiles": profiles_of(f), "axis": axis,
                     "angle": f.get("angle").cloned().unwrap_or(json!("360 deg")), "operation": op(f), "name": name, "body_names": bodies}}));
             }
@@ -329,11 +329,11 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                     p["count2"] = d2.get("count").cloned().unwrap_or(Value::Null);
                     p["spacing2"] = d2.get("spacing").cloned().unwrap_or(Value::Null);
                 }
-                out.push(json!({"command": "PatternRectangular", "params": p}));
+                out.push(json!({"command": "solid.pattern.rectangular", "params": p}));
             }
             Some("circular_pattern") => {
                 let axis = f.get("axis").map(|a| json!({"origin": a.get("origin").cloned().unwrap_or(json!([0, 0, 0])), "dir": a.get("dir")})).unwrap_or(Value::Null);
-                out.push(json!({"command": "PatternCircular", "params": {"features": feature_refs(f.get("features")), "axis": axis, "count": f.get("count"), "angle": f.get("total_angle").cloned().unwrap_or(json!(360)), "name": name}}));
+                out.push(json!({"command": "solid.pattern.circular", "params": {"features": feature_refs(f.get("features")), "axis": axis, "count": f.get("count"), "angle": f.get("total_angle").cloned().unwrap_or(json!(360)), "name": name}}));
             }
             Some("sm_flange") => match f.get("type").and_then(Value::as_str) {
                 Some("edge") => {
@@ -344,11 +344,11 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                     if f.get("flip").and_then(Value::as_bool) == Some(true) {
                         p["flip"] = json!(true);
                     }
-                    out.push(json!({"command": "FusionSheetMetalFlangeCommand", "params": p}));
+                    out.push(json!({"command": "sheet.flange", "params": p}));
                 }
-                Some("contour") => out.push(json!({"command": "FusionSheetMetalFlangeCommand", "params": {
+                Some("contour") => out.push(json!({"command": "sheet.flange", "params": {
                     "type": "contour", "sketch": f.get("profile_sketch"), "curves": f.get("profile_curves"), "distance": f.get("distance"), "name": name}})),
-                _ => out.push(json!({"command": "FusionSheetMetalFlangeCommand", "params": {
+                _ => out.push(json!({"command": "sheet.flange", "params": {
                     "type": "base", "sketch": profile_sketch(f), "profiles": profiles_of(f), "name": name, "body_names": bodies}})),
             },
             Some("sheet_metal_rule_edit") => {
@@ -368,7 +368,7 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                         p["thickness"] = json!(format!("{v} {u}"));
                     }
                 }
-                out.push(json!({"command": "FusionSheetMetalRulesCommand", "params": p}));
+                out.push(json!({"command": "sheet.manage_rules", "params": p}));
             }
             Some("sm_hem") => {
                 let e = f.get("edge").and_then(|e| e.get("point")).cloned().unwrap_or(Value::Null);
@@ -376,9 +376,9 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 if f.get("flipped").and_then(Value::as_bool) == Some(true) {
                     p["flip"] = json!(true);
                 }
-                out.push(json!({"command": "FusionSheetMetalHemFlangeCommand", "params": p}));
+                out.push(json!({"command": "sheet.hem", "params": p}));
             }
-            Some("sm_unfold") => out.push(json!({"command": "FusionSheetmetalUnfoldCommand", "params": {"name": name}})),
+            Some("sm_unfold") => out.push(json!({"command": "sheet.unfold", "params": {"name": name}})),
             Some("sm_refold") => out.push(json!({"command": "sheet.refold", "params": {"name": name}})),
             Some("path_pattern") => {
                 let path = f.get("path").cloned().unwrap_or(Value::Null);
@@ -392,7 +392,7 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 } else {
                     p["features"] = feature_refs(f.get("features"));
                 }
-                out.push(json!({"command": "PatternOnPath", "params": p}));
+                out.push(json!({"command": "solid.pattern.path", "params": p}));
             }
             Some("loft") => {
                 let sections: Vec<Value> = f
@@ -405,24 +405,24 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                         None => json!({"sketch": sec.get("sketch"), "profiles": [sec]}),
                     })
                     .collect();
-                out.push(json!({"command": "SolidLoft", "params": {"sections": sections, "operation": op(f), "name": name, "body_names": bodies}}));
+                out.push(json!({"command": "solid.loft", "params": {"sections": sections, "operation": op(f), "name": name, "body_names": bodies}}));
             }
             Some("sweep") if helix_path(features, f).is_some() => {
                 // A swept circle along a fitted 3D helix: a coil (the true helix).
                 let Some((base, diameter, pitch, turns, start, cw, size)) = helix_path(features, f) else { continue };
-                out.push(json!({"command": "PrimitiveCoil", "params": {
+                out.push(json!({"command": "solid.coil", "params": {
                     "base": base, "diameter": diameter, "pitch": pitch, "revolutions": turns, "section_size": size,
                     "start_angle": format!("{start} rad"), "clockwise": cw, "operation": op(f), "name": name, "body_names": bodies}}));
             }
             Some("sweep") => {
                 let path = f.get("path").cloned().unwrap_or(Value::Null);
-                out.push(json!({"command": "Sweep", "params": {
+                out.push(json!({"command": "solid.sweep", "params": {
                     "sketch": profile_sketch(f), "profiles": profiles_of(f), "path_sketch": path.get("sketch"), "path": path.get("curves"),
                     "operation": op(f), "name": name, "body_names": bodies}}));
             }
             Some("shell") => {
                 let faces: Vec<Value> = f.get("faces_removed").and_then(Value::as_array).into_iter().flatten().filter_map(|x| x.get("point").cloned()).collect();
-                out.push(json!({"command": "FusionShellBodyCommand", "params": {"faces": faces, "thickness": f.get("inside_thickness"), "name": name}}));
+                out.push(json!({"command": "solid.shell", "params": {"faces": faces, "thickness": f.get("inside_thickness"), "name": name}}));
             }
             Some("draft") => {
                 let faces: Vec<Value> = f.get("faces").and_then(Value::as_array).into_iter().flatten().filter_map(|x| x.get("point").cloned()).collect();
@@ -433,7 +433,7 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 if f.get("flipped").and_then(Value::as_bool).unwrap_or(false) {
                     angle = -angle;
                 }
-                out.push(json!({"command": "FusionDraftCommand", "params": {"faces": faces, "angle": angle, "neutral": neutral, "pull": n, "name": name}}));
+                out.push(json!({"command": "solid.draft", "params": {"faces": faces, "angle": angle, "neutral": neutral, "pull": n, "name": name}}));
             }
             Some("thread") => {
                 let face = f.get("face").and_then(|x| x.get("point")).cloned().unwrap_or(Value::Null);
@@ -443,7 +443,7 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 {
                     p["length"] = l.clone();
                 }
-                out.push(json!({"command": "FusionThreadCommand", "params": p}));
+                out.push(json!({"command": "solid.thread", "params": p}));
             }
             Some("hole") => {
                 let n = f.get("face").and_then(|fc| fc.get("plane_normal_outward").or(fc.get("normal_at_point_on_face"))).cloned();
@@ -495,20 +495,20 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                         p[k] = v.clone();
                     }
                 }
-                out.push(json!({"command": "FusionHoleCommand", "params": p}));
+                out.push(json!({"command": "solid.hole", "params": p}));
             }
             Some("construction_plane") => match f.get("method").and_then(Value::as_str) {
-                Some("offset") => out.push(json!({"command": "ConstructionPlaneOffsetFromPlaneCommand", "params": {"base": f.get("base"), "offset": f.get("offset"), "name": name}})),
+                Some("offset") => out.push(json!({"command": "construct.plane.offset", "params": {"base": f.get("base"), "offset": f.get("offset"), "name": name}})),
                 _ => {
                     // Use the resulting plane as recorded.
                     let (o, n) = (f.get("result_origin").cloned().unwrap_or(json!([0, 0, 0])), f.get("result_normal").cloned().unwrap_or(Value::Null));
                     if n.is_null() {
                         return Err(format!("recipe: construction plane method {:?} without result_normal", f.get("method")));
                     }
-                    out.push(json!({"command": "ConstructionPlaneOffsetFromPlaneCommand", "params": {"base": {"origin": o, "normal": n}, "offset": 0, "name": name}}));
+                    out.push(json!({"command": "construct.plane.offset", "params": {"base": {"origin": o, "normal": n}, "offset": 0, "name": name}}));
                 }
             },
-            Some("split_body") => out.push(json!({"command": "FusionSplitBodyCommand", "params": {"body": f.get("body"), "plane": f.get("tool"), "name": name}})),
+            Some("split_body") => out.push(json!({"command": "solid.split_body", "params": {"body": f.get("body"), "plane": f.get("tool"), "name": name}})),
             Some("mirror") => {
                 let pl = f.get("plane").cloned().unwrap_or(Value::Null);
                 let plane = match pl.get("ref").and_then(Value::as_str) {
@@ -519,13 +519,13 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
                 if f.get("mirror_of").and_then(Value::as_str) == Some("bodies") {
                     p = json!({"bodies": f.get("bodies"), "combine": f.get("combine").cloned().unwrap_or(json!(false)), "plane": plane, "name": name});
                 }
-                out.push(json!({"command": "MirrorCommand", "params": p}));
+                out.push(json!({"command": "solid.mirror", "params": p}));
             }
             Some("fillet") => {
-                out.push(json!({"command": "FusionFilletEdgesCommand", "params": {"edges": edge_points(f), "radius": f.get("radius"), "name": name}}))
+                out.push(json!({"command": "solid.fillet", "params": {"edges": edge_points(f), "radius": f.get("radius"), "name": name}}))
             }
             Some("chamfer") => {
-                out.push(json!({"command": "FusionChamferCommand", "params": {"edges": edge_points(f), "distance": f.get("distance"), "name": name}}))
+                out.push(json!({"command": "solid.chamfer", "params": {"edges": edge_points(f), "distance": f.get("distance"), "name": name}}))
             }
             Some(other) => return Err(format!("recipe: feature op `{other}` is not supported yet")),
             None => return Err("recipe: feature without `op`".into()),

apps/solvecraft-cli/tests/commands_output.rs

@@ -0,0 +1,26 @@
+//! The registry remains valid JSON and a closed pipeline reader must not cause a panic.
+
+use std::process::{Command, Stdio};
+
+#[test]
+fn registry_output_is_complete_json() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("commands").output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    let registry: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    let commands = registry.as_array().unwrap();
+    assert!(commands.iter().any(|command| command["id"] == "solid.box"));
+    assert!(commands.iter().any(|command| command["id"] == "engine.commands"));
+    assert!(output.stdout.ends_with(b"\n"));
+    assert!(output.stderr.is_empty());
+}
+
+#[test]
+fn closed_registry_pipe_exits_without_panicking() {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("commands").stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    // Close our read end before waiting. No sleeps or timing threshold are needed:
+    // the registry is larger than the pipe buffer, so it cannot all be written first.
+    drop(child.stdout.take());
+    let output = child.wait_with_output().unwrap();
+    assert!(output.status.success(), "status: {}; stderr: {}", output.status, String::from_utf8_lossy(&output.stderr));
+    assert!(output.stderr.is_empty(), "{}", String::from_utf8_lossy(&output.stderr));
+}

apps/solvecraft-cli/tests/corpus/scripts/components-arm.json

@@ -1,15 +1,15 @@
 {"commands": [
- {"command": "PrimitiveBox", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
- {"command": "FusionCreateNewComponentCommand", "params": {"name": "Arm"}},
- {"command": "PrimitiveBox", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
- {"command": "FusionFilletEdgesCommand", "params": {"edges": [[25, 4, 4]], "radius": 1}},
+ {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "body_name": "Base"}},
+ {"command": "component.create", "params": {"name": "Arm"}},
+ {"command": "solid.box", "params": {"corner": [20, 0, 0], "length": 10, "width": 4, "height": 4, "body_name": "ArmBody"}},
+ {"command": "solid.fillet", "params": {"edges": [[25, 4, 4]], "radius": 1}},
  {"command": "component.activate", "params": {"component": 0}},
  {"command": "occurrence.move", "params": {"occurrence": 3, "translate": [0, 50, 0]}},
  {"command": "occurrence.copy", "params": {"component": "Arm", "translate": [0, 20, 0]}},
  {"command": "component.paste_new", "params": {"component": "Arm", "translate": [0, -30, 0]}},
  {"command": "occurrence.ground", "params": {"occurrence": 3}},
- {"command": "SketchCreate", "params": {"plane": "XY", "name": "S1"}},
- {"command": "CircleCenterRadius", "params": {"center": [5, 5], "radius": 2}},
- {"command": "SketchStop", "params": {}},
- {"command": "Extrude", "params": {"distance": 10, "operation": "cut"}}
+ {"command": "sketch.create", "params": {"plane": "XY", "name": "S1"}},
+ {"command": "sketch.circle.center", "params": {"center": [5, 5], "radius": 2}},
+ {"command": "sketch.finish", "params": {}},
+ {"command": "solid.extrude", "params": {"distance": 10, "operation": "cut"}}
 ]}

apps/solvecraft-cli/tests/corpus/scripts/joints-hinge.json

@@ -1,14 +1,14 @@
 {"commands": [
- {"command": "ChangeParameterCommand", "params": {"name": "open_angle", "expression": "90 deg"}},
- {"command": "FusionCreateNewComponentCommand", "params": {"name": "LeafA"}},
- {"command": "PrimitiveBox", "params": {"length": 40, "width": 30, "height": 3, "corner": [0, 0, 0]}},
- {"command": "PrimitiveCylinder", "params": {"base": [0, 33, 4], "axis": [1, 0, 0], "radius": 4, "height": 40, "operation": "new"}},
+ {"command": "parameters.change", "params": {"name": "open_angle", "expression": "90 deg"}},
+ {"command": "component.create", "params": {"name": "LeafA"}},
+ {"command": "solid.box", "params": {"length": 40, "width": 30, "height": 3, "corner": [0, 0, 0]}},
+ {"command": "solid.cylinder", "params": {"base": [0, 33, 4], "axis": [1, 0, 0], "radius": 4, "height": 40, "operation": "new"}},
  {"command": "component.activate", "params": {"component": "root"}},
- {"command": "FusionCreateNewComponentCommand", "params": {"name": "LeafB"}},
- {"command": "PrimitiveBox", "params": {"length": 40, "width": 30, "height": 3, "corner": [0, 0, 0]}},
- {"command": "PrimitiveCylinder", "params": {"base": [0, 33, 4], "axis": [1, 0, 0], "radius": 4, "height": 40, "operation": "new"}},
+ {"command": "component.create", "params": {"name": "LeafB"}},
+ {"command": "solid.box", "params": {"length": 40, "width": 30, "height": 3, "corner": [0, 0, 0]}},
+ {"command": "solid.cylinder", "params": {"base": [0, 33, 4], "axis": [1, 0, 0], "radius": 4, "height": 40, "operation": "new"}},
  {"command": "component.activate", "params": {"component": "root"}},
  {"command": "occurrence.ground", "params": {"occurrence": 2, "grounded": true}},
- {"command": "JointAssembleCmdNew", "params": {"type": "revolute", "a": {"occurrence": "LeafA", "circle": [1, 37, 4]}, "b": {"occurrence": "LeafB", "circle": [1, 37, 4]}, "name": "Hinge"}},
- {"command": "FusionMoveJointsCommand", "params": {"joint": "Hinge", "value": "open_angle"}}
+ {"command": "joint.create", "params": {"type": "revolute", "a": {"occurrence": "LeafA", "circle": [1, 37, 4]}, "b": {"occurrence": "LeafB", "circle": [1, 37, 4]}, "name": "Hinge"}},
+ {"command": "joint.drive", "params": {"joint": "Hinge", "value": "open_angle"}}
 ]}

apps/solvecraft-cli/tests/corpus/scripts/m0-box-fillet-hole.json

@@ -1,12 +1,12 @@
 {"commands": [
- {"command": "ChangeParameterCommand", "params": {"name": "width", "expression": "40 mm"}},
- {"command": "SketchCreate", "params": {"plane": "XY"}},
- {"command": "ShapeRectangleTwoPoint", "params": {"p0": [0, 0], "p1": [40, 30]}},
- {"command": "SketchStop", "params": {}},
- {"command": "Extrude", "params": {"distance": "width / 2"}},
- {"command": "FusionFilletEdgesCommand", "params": {"edges": [[0, 0, 10]], "radius": 3}},
- {"command": "SketchCreate", "params": {"plane": "XY"}},
- {"command": "CircleCenterRadius", "params": {"center": [20, 15], "radius": 5}},
- {"command": "SketchStop", "params": {}},
- {"command": "Extrude", "params": {"distance": 20, "operation": "cut"}}
+ {"command": "parameters.change", "params": {"name": "width", "expression": "40 mm"}},
+ {"command": "sketch.create", "params": {"plane": "XY"}},
+ {"command": "sketch.rectangle.two_point", "params": {"p0": [0, 0], "p1": [40, 30]}},
+ {"command": "sketch.finish", "params": {}},
+ {"command": "solid.extrude", "params": {"distance": "width / 2"}},
+ {"command": "solid.fillet", "params": {"edges": [[0, 0, 10]], "radius": 3}},
+ {"command": "sketch.create", "params": {"plane": "XY"}},
+ {"command": "sketch.circle.center", "params": {"center": [20, 15], "radius": 5}},
+ {"command": "sketch.finish", "params": {}},
+ {"command": "solid.extrude", "params": {"distance": 20, "operation": "cut"}}
 ]}

apps/solvecraft-cli/tests/corpus/scripts/m0-revolve-primitives.json

@@ -1,11 +1,11 @@
 {"commands": [
- {"command": "SketchCreate", "params": {"plane": "XZ"}},
- {"command": "DrawPolyline", "params": {"points": [[10, 0], [15, 0], [15, 5], [10, 5]], "closed": true}},
- {"command": "SketchStop", "params": {}},
- {"command": "Revolve", "params": {"axis": "y"}},
- {"command": "PrimitiveBox", "params": {"length": 10, "width": 10, "height": 10, "corner": [30, 0, 0]}},
- {"command": "PrimitiveCylinder", "params": {"diameter": 4, "height": 20, "base": [35, 5, -5]}},
- {"command": "FusionCombineCommand", "params": {"target": "Body2", "tools": ["Body3"], "operation": "cut"}},
- {"command": "FusionChamferCommand", "params": {"edges": [[30, 5, 10]], "distance": 1}},
+ {"command": "sketch.create", "params": {"plane": "XZ"}},
+ {"command": "sketch.line", "params": {"points": [[10, 0], [15, 0], [15, 5], [10, 5]], "closed": true}},
+ {"command": "sketch.finish", "params": {}},
+ {"command": "solid.revolve", "params": {"axis": "y"}},
+ {"command": "solid.box", "params": {"length": 10, "width": 10, "height": 10, "corner": [30, 0, 0]}},
+ {"command": "solid.cylinder", "params": {"diameter": 4, "height": 20, "base": [35, 5, -5]}},
+ {"command": "solid.combine", "params": {"target": "Body2", "tools": ["Body3"], "operation": "cut"}},
+ {"command": "solid.chamfer", "params": {"edges": [[30, 5, 10]], "distance": 1}},
  {"command": "timeline.edit", "params": {"feature": "Revolve1", "set": {"angle": "180 deg"}}}
 ]}

apps/solvecraft-cli/tests/corpus/scripts/modern-path-pattern.json

@@ -1,14 +1,14 @@
 {
   "commands": [
     {
-      "command": "SketchCreate",
+      "command": "sketch.create",
       "params": {
         "name": "Plate_sketch",
         "plane": "XY"
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -27,7 +27,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -43,7 +43,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -59,7 +59,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -72,11 +72,11 @@
       }
     },
     {
-      "command": "SketchStop",
+      "command": "sketch.finish",
       "params": {}
     },
     {
-      "command": "Extrude",
+      "command": "solid.extrude",
       "params": {
         "body_names": [
           "Plate"
@@ -110,14 +110,14 @@
       }
     },
     {
-      "command": "SketchCreate",
+      "command": "sketch.create",
       "params": {
         "name": "PathSketch",
         "plane": "XY"
       }
     },
     {
-      "command": "ArcThreePoint",
+      "command": "sketch.arc.three_point",
       "params": {
         "end": [
           20,
@@ -135,7 +135,7 @@
       }
     },
     {
-      "command": "CircleCenterRadius",
+      "command": "sketch.circle.center",
       "params": {
         "center": "a1.start",
         "construction": false,
@@ -144,11 +144,11 @@
       }
     },
     {
-      "command": "SketchStop",
+      "command": "sketch.finish",
       "params": {}
     },
     {
-      "command": "Extrude",
+      "command": "solid.extrude",
       "params": {
         "body_names": [
           "Plate"
@@ -179,7 +179,7 @@
       }
     },
     {
-      "command": "PatternOnPath",
+      "command": "solid.pattern.path",
       "params": {
         "count": 7,
         "features": [

apps/solvecraft-cli/tests/corpus/scripts/modern-plastic.json

@@ -1,10 +1,10 @@
 {"commands": [
- {"command": "ChangeParameterCommand", "params": {"name": "wall", "expression": "2 mm"}},
- {"command": "PrimitiveBox", "params": {"length": 80, "width": 50, "height": 30}},
- {"command": "FusionShellBodyCommand", "params": {"faces": [[40, 25, 30]], "thickness": "wall"}},
- {"command": "FusionLipCommand", "params": {"face": [1, 25, 30], "width": 1, "height": 2}},
- {"command": "FusionBossCommand", "params": {"position": [20, 20, 2], "diameter": 6, "height": 10, "hole_diameter": 2.5, "draft": "1 deg"}},
- {"command": "FusionRestCommand", "params": {"position": [60, 30, 2], "width": 8, "length": 12, "height": 3, "thickness": 1}},
- {"command": "FusionSnapFitCommand", "params": {"position": [40, 12, 2], "direction": [0, 0, 1], "hook": [0, 1, 0], "length": 12, "thickness": 1.5, "width": 6, "catch_depth": 1, "catch_length": 2}},
- {"command": "FusionManagePlasticRuleCommand", "params": {"name": "ABS (1.5mm)", "active": true}}
+ {"command": "parameters.change", "params": {"name": "wall", "expression": "2 mm"}},
+ {"command": "solid.box", "params": {"length": 80, "width": 50, "height": 30}},
+ {"command": "solid.shell", "params": {"faces": [[40, 25, 30]], "thickness": "wall"}},
+ {"command": "plastic.lip", "params": {"face": [1, 25, 30], "width": 1, "height": 2}},
+ {"command": "plastic.boss", "params": {"position": [20, 20, 2], "diameter": 6, "height": 10, "hole_diameter": 2.5, "draft": "1 deg"}},
+ {"command": "plastic.rest", "params": {"position": [60, 30, 2], "width": 8, "length": 12, "height": 3, "thickness": 1}},
+ {"command": "plastic.snap_fit", "params": {"position": [40, 12, 2], "direction": [0, 0, 1], "hook": [0, 1, 0], "length": 12, "thickness": 1.5, "width": 6, "catch_depth": 1, "catch_length": 2}},
+ {"command": "plastic.manage_rules", "params": {"name": "ABS (1.5mm)", "active": true}}
 ]}

apps/solvecraft-cli/tests/corpus/scripts/modern-sheet-metal.json

@@ -1,7 +1,7 @@
 {
   "commands": [
     {
-      "command": "SketchCreate",
+      "command": "sketch.create",
       "params": {
         "name": "Contour",
         "plane": {
@@ -24,7 +24,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -43,7 +43,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -59,7 +59,7 @@
       }
     },
     {
-      "command": "DrawPolyline",
+      "command": "sketch.line",
       "params": {
         "construction": false,
         "ids": [
@@ -75,11 +75,11 @@
       }
     },
     {
-      "command": "SketchStop",
+      "command": "sketch.finish",
       "params": {}
     },
     {
-      "command": "FusionSheetMetalFlangeCommand",
+      "command": "sheet.flange",
       "params": {
         "curves": [
           "l1",

apps/solvecraft-cli/tests/design_corpus.rs

@@ -57,7 +57,7 @@ fn old_designs_open_and_evaluate_as_saved() {
             }
         }
         assert_eq!(s.doc.format, solvecraft_engine::doc::format::format_string(solvecraft_engine::doc::format::FORMAT), "{name}: upgraded");
-        let got = s.execute("MeasureCommand", &json!({})).unwrap();
+        let got = s.execute("inspect.measure", &json!({})).unwrap();
         if got["body_count"] != want["body_count"] && !known(&name, "body_count") {
             problems.push(format!("{name}: {} bodies, saved with {}", got["body_count"], want["body_count"]));
         }
@@ -145,15 +145,40 @@ fn at_mut<'a>(v: &'a mut Value, path: &[Value]) -> Option<&'a mut Value> {
 fn try_bytes(bytes: &[u8]) {
     if let Ok(doc) = solvecraft_engine::io::read_design(bytes) {
         let mut s = Session::new(doc);
-        let _ = s.execute("MeasureCommand", &json!({}));
+        let _ = s.execute("inspect.measure", &json!({}));
         let _ = s.execute("document.inspect", &json!({}));
     }
 }
 
+/// Hostile shapes that no mutation of a saved file produces: plane references that close a
+/// cycle, which resolve through the model and back into the document.
+fn generated() -> Vec<(String, Vec<u8>)> {
+    let to = |name: &str| json!({"type": "plane", "plane": {"type": "construction", "name": name}});
+    let plane = |id: u64, name: &str, side: Value| {
+        json!({"id": id, "name": name, "suppressed": false, "type": "construction_plane",
+               "plane": {"type": "midplane", "a": side, "b": {"type": "plane", "plane": {"type": "origin", "name": "XZ"}}}})
+    };
+    let design = |name: &str, features: Value| {
+        json!({"format": "solvecraft/11", "name": name, "units": "mm", "params": [], "next_id": 9, "features": features}).to_string().into_bytes()
+    };
+    // A sketch past the caps interactive editing enforces: solving it would size dense matrices
+    // by the point count and abort on the allocation.
+    let point = json!({"id": "p1", "pos": [0.0, 0.0], "fixed": false});
+    let oversized = json!([{"id": 1, "name": "Sketch1", "suppressed": false, "type": "sketch",
+                            "plane": {"type": "origin", "name": "XY"},
+                            "sketch": {"points": vec![point; 200_000], "curves": [], "constraints": []}}]);
+    vec![
+        ("construction plane is its own side".into(), design("selfplane", json!([plane(1, "P1", to("P1"))]))),
+        ("two construction planes refer to each other".into(), design("twoplanes", json!([plane(1, "P1", to("P2")), plane(2, "P2", to("P1"))]))),
+        ("sketch with 200,000 points".into(), design("bigsketch", oversized)),
+    ]
+}
+
 #[test]
 fn damaged_and_hostile_design_files_never_panic() {
     let mut rng = Rng(0x5eed_cafe_f00d_d00d);
-    let mut failures = Vec::new();
+    // The cases come from one seeded sequence; trying them is independent, so threads share it.
+    let mut all_cases: Vec<(String, String, Vec<u8>)> = Vec::new();
     for p in corpus() {
         let name = p.file_name().unwrap_or_default().to_string_lossy().to_string();
         let bytes = std::fs::read(&p).unwrap();
@@ -198,14 +223,29 @@ fn damaged_and_hostile_design_files_never_panic() {
         cases.push(("features repeated".into(), v.to_string().into_bytes()));
         cases.push(("deep nesting".into(), format!("{}{}", "[".repeat(100_000), "]".repeat(100_000)).into_bytes()));
         cases.push(("binary".into(), (0..4096u32).map(|i| (i.wrapping_mul(2_654_435_761) >> 24) as u8).collect()));
-        for (what, b) in cases {
-            if std::env::var_os("CORPUS_TRACE").is_some() {
-                eprintln!("{name}: {what}");
-            }
-            if std::panic::catch_unwind(|| try_bytes(&b)).is_err() {
-                failures.push(format!("{name}: {what}"));
-            }
-        }
+        all_cases.extend(cases.into_iter().map(|(what, b)| (name.clone(), what, b)));
     }
+    all_cases.extend(generated().into_iter().map(|(what, b)| ("generated".to_string(), what, b)));
+    let next = std::sync::atomic::AtomicUsize::new(0);
+    let threads = std::thread::available_parallelism().map_or(4, |n| n.get());
+    let failures: Vec<String> = std::thread::scope(|scope| {
+        let workers: Vec<_> = (0..threads)
+            .map(|_| {
+                scope.spawn(|| {
+                    let mut failures = Vec::new();
+                    while let Some((name, what, b)) = all_cases.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
+                        if std::env::var_os("CORPUS_TRACE").is_some() {
+                            eprintln!("{name}: {what}");
+                        }
+                        if std::panic::catch_unwind(|| try_bytes(b)).is_err() {
+                            failures.push(format!("{name}: {what}"));
+                        }
+                    }
+                    failures
+                })
+            })
+            .collect();
+        workers.into_iter().flat_map(|w| w.join().unwrap()).collect()
+    });
     assert!(failures.is_empty(), "panics:\n{}", failures.join("\n"));
 }

apps/solvecraft-cli/tests/fuzz_range.rs

@@ -0,0 +1,31 @@
+//! Seed ranges must not crash or wrap, including at the last representable seed.
+
+use std::process::Command;
+
+#[test]
+fn overflowing_seed_range_is_an_error_not_a_panic() {
+    let output =
+        Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "2"]).output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(stderr.contains("seed range exceeds u64::MAX"), "{stderr}");
+    assert!(!stderr.contains("panicked"), "{stderr}");
+}
+
+#[test]
+fn empty_seed_range_at_maximum_is_valid() {
+    let output =
+        Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).args(["fuzz", "--from", "18446744073709551615", "--count", "0"]).output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    assert!(String::from_utf8_lossy(&output.stdout).starts_with("0 seeds, 0 design steps,"));
+}
+
+#[test]
+fn maximum_seed_runs_once_without_wrapping() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli"))
+        .args(["fuzz", "--from", "18446744073709551615", "--count", "1", "--steps", "0", "--timeout", "0"])
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    assert!(String::from_utf8_lossy(&output.stdout).starts_with("1 seeds,"));
+}

apps/solvecraft-cli/tests/kill_mid_save.rs

@@ -22,10 +22,20 @@ fn killed_mid_save_the_old_file_survives() {
     assert_eq!(round_of(&path).as_deref(), Some("0"));
     let mut kills = 0;
     let mut seen = std::collections::BTreeSet::new();
+    let modified = || std::fs::metadata(&path).and_then(|m| m.modified()).ok();
     for i in 0..25u64 {
+        let before = modified();
         let mut child = Command::new(exe).args(["save-stress", &path.to_string_lossy(), "100000"]).spawn().unwrap();
-        // Let it get into its save loop (building the design takes a moment), then kill it.
-        std::thread::sleep(Duration::from_millis(150 + (i * 37) % 200));
+        // Wait until it is in its save loop (its first save replaced the file) and has reached a
+        // round that varies from kill to kill, however busy the machine is; then kill it a
+        // varying while later.
+        let target = i % 10;
+        let reached = || modified() != before && round_of(&path).and_then(|r| r.parse::<u64>().ok()).is_some_and(|r| r >= target);
+        let t0 = std::time::Instant::now();
+        while !reached() && t0.elapsed() < Duration::from_secs(20) && child.try_wait().unwrap().is_none() {
+            std::thread::sleep(Duration::from_millis(2));
+        }
+        std::thread::sleep(Duration::from_millis((i * 7) % 30));
         if child.try_wait().unwrap().is_none() {
             child.kill().unwrap();
             kills += 1;

apps/solvecraft-cli/tests/run_results.rs

@@ -0,0 +1,97 @@
+//! Result reporting must not skip requested files or execute a script twice.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solvecraft-run-results-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    fn script(&self) -> PathBuf {
+        let path = self.0.join("box.json");
+        std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
+        path
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn cli() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_solvecraft-cli"))
+}
+
+fn json_output(output: Output) -> Value {
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    serde_json::from_slice(&output.stdout).unwrap()
+}
+
+fn body_count(path: &Path) -> Value {
+    json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
+}
+
+#[test]
+fn results_still_save_and_export_the_script_once() {
+    let dir = Scratch::new();
+    let saved = dir.0.join("box.solvecraft");
+    let stl = dir.0.join("box.stl");
+    let obj = dir.0.join("box.obj");
+    let result = json_output(
+        cli().arg("run").arg(dir.script()).arg("--results").arg("--save").arg(&saved).arg("--out").arg(&stl).arg("--out").arg(&obj).output().unwrap(),
+    );
+    assert_eq!(result.as_array().unwrap().len(), 1);
+    assert_eq!(body_count(&saved), 1);
+    for exported in [&stl, &obj] {
+        assert!(std::fs::metadata(exported).unwrap().len() > 0);
+        assert_eq!(body_count(exported), 1);
+    }
+}
+
+#[test]
+fn results_with_base_design_and_quiet_still_report_and_save() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let base = dir.0.join("base.solvecraft");
+    let saved = dir.0.join("combined.solvecraft");
+    json_output(cli().arg("run").arg(&script).arg("--save").arg(&base).output().unwrap());
+    let result = json_output(cli().args(["run", "--results", "--quiet", "--in"]).arg(&base).arg(&script).arg("--save").arg(&saved).output().unwrap());
+    assert_eq!(result.as_array().unwrap().len(), 1);
+    assert_eq!(body_count(&saved), 2);
+    assert_eq!(body_count(&base), 1);
+}
+
+#[test]
+fn results_propagate_output_errors() {
+    let dir = Scratch::new();
+    for flag in ["--save", "--out"] {
+        let path = dir.0.join("missing").join(if flag == "--save" { "box.solvecraft" } else { "box.stl" });
+        let output = cli().arg("run").arg(dir.script()).arg("--results").arg(flag).arg(&path).output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        assert!(!output.stderr.is_empty());
+        assert!(output.stdout.is_empty());
+        assert!(!path.exists());
+    }
+}
+
+#[test]
+fn results_without_script_still_fail() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solvecraft");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let output = cli().args(["run", "--results", "--in"]).arg(&base).output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&output.stderr).contains("--results needs a script"));
+}

apps/solvecraft-web/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-web"
-description = "SolveCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
+description = "SolidCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -23,4 +23,11 @@ log = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location"] }
+js-sys = "0.3"
+serde_json = { workspace = true }
+web-sys = { version = "0.3", features = [
+    "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
+    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
+    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
+    "BeforeUnloadEvent", "Event", "EventTarget",
+] }

apps/solvecraft-web/index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
-  <title>SolveCraft</title>
+  <title>SolidCraft</title>
   <link data-trunk rel="rust" data-bin="solvecraft-web" data-wasm-opt="z" data-weak-refs />
   <style>
     html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: #e8ebf0; }
@@ -14,6 +14,6 @@
 </head>
 <body>
   <canvas id="solvecraft_canvas"></canvas>
-  <div id="solvecraft_loading">Loading SolveCraft&hellip;</div>
+  <div id="solvecraft_loading">Loading SolidCraft&hellip;</div>
 </body>
 </html>

apps/solvecraft-web/src/files.rs

@@ -0,0 +1,476 @@
+//! Files in the browser. Designs are kept in the origin private file system (OPFS): read into
+//! the engine's in-memory files (`solvecraft_engine::io::vfs`) at start, written back whenever a
+//! command writes one. Files come in from the computer through a file picker (the File System
+//! Access API where the browser has it, an `<input type=file>` otherwise) or a drop on the page,
+//! and go out as downloads (exports, and "Download design"). An autosave of unsaved work is kept
+//! in OPFS too and offered again after a reload or a crash.
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use js_sys::{Array, Function, Object, Reflect, Uint8Array};
+use solvecraft_engine::io::vfs;
+use wasm_bindgen::{JsCast as _, JsValue, closure::Closure};
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+use web_sys::{FileSystemDirectoryHandle, FileSystemFileHandle, FileSystemGetFileOptions, FileSystemWritableFileStream};
+
+/// Where OPFS files appear to the engine.
+pub const OPFS: &str = "/opfs/";
+/// Paths written here are handed to the user as downloads.
+pub const DOWNLOADS: &str = "/downloads/";
+/// Files brought in from the computer.
+pub const UPLOAD: &str = "/upload/";
+/// The autosave of unsaved work (in OPFS: `recovery.solvecraft` and `recovery.json`).
+const RECOVERY: &str = "recovery.solvecraft";
+const RECOVERY_META: &str = "recovery.json";
+
+/// What to do with a file brought in from the computer.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Intent {
+    /// Open it (a design, or STEP/mesh as a new design).
+    Open,
+    /// Add its bodies to the open design (STEP, 3MF, STL).
+    Insert,
+}
+
+/// A stored design, as the file panel lists it.
+#[derive(Clone, Debug)]
+pub struct Entry {
+    pub name: String,
+    pub size: u64,
+    /// Last written (ms since 1970; 0 when unknown).
+    pub modified: f64,
+}
+
+/// State shared between the async browser calls and the app's frames.
+#[derive(Default)]
+pub struct Files {
+    pub entries: RefCell<Vec<Entry>>,
+    /// Files read from the computer: (name, bytes, what to do).
+    pub incoming: RefCell<Vec<(String, Vec<u8>, Intent)>>,
+    /// Messages for the status line (errors and confirmations).
+    pub messages: RefCell<Vec<(String, bool)>>,
+    /// The stored designs are loaded (the app may open them).
+    pub ready: Cell<bool>,
+    /// The file panel is open.
+    pub panel: Cell<bool>,
+    /// An autosave left by an earlier session: its design's name and file.
+    pub recovery: RefCell<Option<(String, Option<String>)>>,
+    /// The app's context, to wake it when a browser call finishes.
+    pub ctx: RefCell<Option<egui::Context>>,
+}
+
+impl Files {
+    fn say(&self, text: impl Into<String>, error: bool) {
+        self.messages.borrow_mut().push((text.into(), error));
+        self.wake();
+    }
+
+    /// A file arrived from the computer.
+    fn arrive(&self, name: String, bytes: Vec<u8>, intent: Intent) {
+        self.incoming.borrow_mut().push((name, bytes, intent));
+        self.wake();
+    }
+
+    /// Run a frame (the app sleeps until something happens).
+    fn wake(&self) {
+        if let Some(c) = self.ctx.borrow().as_ref() {
+            c.request_repaint();
+        }
+    }
+}
+
+thread_local! {
+    /// The private file system isn't there (an insecure page: http on a network address, or an
+    /// old browser): designs are kept in local storage instead.
+    static LOCAL: Cell<bool> = const { Cell::new(false) };
+}
+
+/// Local storage keys of stored files.
+const LOCAL_PREFIX: &str = "solvecraft.file.";
+
+fn local() -> Result<web_sys::Storage, String> {
+    web_sys::window().and_then(|w| w.local_storage().ok().flatten()).ok_or_else(|| "this browser keeps no local storage".to_string())
+}
+
+/// Text as is, anything else as hex (local storage holds strings).
+fn encode(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(t) => format!("t{t}"),
+        Err(_) => {
+            let mut s = String::with_capacity(bytes.len() * 2 + 1);
+            s.push('x');
+            for b in bytes {
+                s.push_str(&format!("{b:02x}"));
+            }
+            s
+        }
+    }
+}
+
+fn decode(s: &str) -> Vec<u8> {
+    if let Some(t) = s.strip_prefix('t') {
+        return t.as_bytes().to_vec();
+    }
+    let h = s.strip_prefix('x').unwrap_or("");
+    (0..h.len() / 2).filter_map(|i| h.get(2 * i..2 * i + 2).and_then(|x| u8::from_str_radix(x, 16).ok())).collect()
+}
+
+/// Is the browser's storage local storage (no OPFS here)?
+pub fn local_only() -> bool {
+    LOCAL.with(Cell::get)
+}
+
+fn err(e: JsValue) -> String {
+    e.as_string().or_else(|| Reflect::get(&e, &"message".into()).ok().and_then(|m| m.as_string())).unwrap_or_else(|| format!("{e:?}"))
+}
+
+/// The browser's storage manager: missing on insecure pages (http on a network address) and in
+/// old browsers, where calling into it would throw.
+fn storage_manager() -> Option<web_sys::StorageManager> {
+    let nav = web_sys::window()?.navigator();
+    let sm = Reflect::get(&nav, &"storage".into()).ok().filter(|v| v.is_object())?;
+    Some(sm.unchecked_into())
+}
+
+/// Does the storage manager have `method`?
+fn has(sm: &web_sys::StorageManager, method: &str) -> bool {
+    Reflect::get(sm, &method.into()).is_ok_and(|f| f.is_function())
+}
+
+async fn root() -> Result<FileSystemDirectoryHandle, String> {
+    let sm = storage_manager().filter(|sm| has(sm, "getDirectory")).ok_or("this page has no private file storage (it needs https or localhost)")?;
+    let dir = JsFuture::from(sm.get_directory()).await.map_err(err)?;
+    dir.dyn_into::<FileSystemDirectoryHandle>().map_err(|_| "this browser has no private file storage (OPFS)".to_string())
+}
+
+async fn read_handle(h: &FileSystemFileHandle) -> Result<Vec<u8>, String> {
+    let file: web_sys::File = JsFuture::from(h.get_file()).await.map_err(err)?.dyn_into().map_err(|_| "not a file".to_string())?;
+    blob_bytes(&file).await
+}
+
+async fn blob_bytes(b: &web_sys::Blob) -> Result<Vec<u8>, String> {
+    let buf = JsFuture::from(b.array_buffer()).await.map_err(err)?;
+    Ok(Uint8Array::new(&buf).to_vec())
+}
+
+async fn file_handle(dir: &FileSystemDirectoryHandle, name: &str, create: bool) -> Result<FileSystemFileHandle, String> {
+    let opts = FileSystemGetFileOptions::new();
+    opts.set_create(create);
+    JsFuture::from(dir.get_file_handle_with_options(name, &opts)).await.map_err(err)?.dyn_into().map_err(|_| "not a file".to_string())
+}
+
+async fn write_file(name: &str, bytes: &[u8]) -> Result<(), String> {
+    if local_only() {
+        return local()?
+            .set_item(&format!("{LOCAL_PREFIX}{name}"), &encode(bytes))
+            .map_err(|e| format!("local storage is full or blocked: {}", err(e)));
+    }
+    let dir = root().await?;
+    let h = file_handle(&dir, name, true).await?;
+    let w: FileSystemWritableFileStream =
+        JsFuture::from(h.create_writable()).await.map_err(err)?.dyn_into().map_err(|_| "no writable stream".to_string())?;
+    JsFuture::from(w.write_with_u8_array(bytes).map_err(err)?).await.map_err(err)?;
+    JsFuture::from(w.close()).await.map_err(err)?;
+    Ok(())
+}
+
+async fn remove_file(name: &str) -> Result<(), String> {
+    if local_only() {
+        return local()?.remove_item(&format!("{LOCAL_PREFIX}{name}")).map_err(err);
+    }
+    let dir = root().await?;
+    JsFuture::from(dir.remove_entry(name)).await.map_err(err)?;
+    Ok(())
+}
+
+/// Every stored file in local storage.
+fn read_local() -> Result<Vec<(String, Vec<u8>, f64)>, String> {
+    let st = local()?;
+    let mut out = Vec::new();
+    for i in 0..st.length().unwrap_or(0).min(10_000) {
+        let Some(k) = st.key(i).ok().flatten() else { continue };
+        let Some(name) = k.strip_prefix(LOCAL_PREFIX) else { continue };
+        if let Some(v) = st.get_item(&k).ok().flatten() {
+            out.push((name.to_string(), decode(&v), 0.0));
+        }
+    }
+    Ok(out)
+}
+
+/// Every stored file: (name, bytes). Without OPFS, local storage takes over from here on.
+async fn read_all() -> Result<Vec<(String, Vec<u8>, f64)>, String> {
+    let dir = match root().await {
+        Ok(d) => d,
+        Err(e) => {
+            log::warn!("no OPFS ({e}): designs go to local storage");
+            LOCAL.with(|l| l.set(true));
+            return read_local();
+        }
+    };
+    let iter: JsValue = dir.values().into();
+    let next: Function = Reflect::get(&iter, &"next".into()).map_err(err)?.dyn_into().map_err(|_| "no iterator".to_string())?;
+    let mut out = Vec::new();
+    for _ in 0..10_000 {
+        let step = JsFuture::from(js_sys::Promise::resolve(&next.call0(&iter).map_err(err)?)).await.map_err(err)?;
+        if Reflect::get(&step, &"done".into()).ok().and_then(|d| d.as_bool()).unwrap_or(true) {
+            break;
+        }
+        let Ok(h) = Reflect::get(&step, &"value".into()).map_err(err)?.dyn_into::<FileSystemFileHandle>() else { continue };
+        let file =
+            match JsFuture::from(h.get_file()).await.map_err(err).and_then(|f| f.dyn_into::<web_sys::File>().map_err(|_| "not a file".to_string())) {
+                Ok(f) => f,
+                Err(e) => {
+                    log::warn!("{}: {e}", h.name());
+                    continue;
+                }
+            };
+        match blob_bytes(&file).await {
+            Ok(b) => out.push((h.name(), b, file.last_modified())),
+            Err(e) => log::warn!("{}: {e}", h.name()),
+        }
+    }
+    Ok(out)
+}
+
+/// Ask the browser to keep the storage (not evict it under pressure), then load every stored
+/// file into the engine's files.
+pub fn start(files: &Rc<Files>) {
+    if let Some(sm) = storage_manager().filter(|sm| has(sm, "persist"))
+        && let Ok(p) = sm.persist()
+    {
+        spawn_local(async move {
+            let _ = JsFuture::from(p).await;
+        });
+    }
+    let files = files.clone();
+    spawn_local(async move {
+        match read_all().await {
+            Ok(all) => {
+                if local_only() {
+                    files.say("This page can't use the browser's file storage (it needs https or localhost): designs are kept in local storage, a few MB at most.", false);
+                }
+                let mut entries = Vec::new();
+                for (name, bytes, modified) in all {
+                    if name == RECOVERY_META {
+                        let meta: serde_json::Value = serde_json::from_slice(&bytes).unwrap_or_default();
+                        let n = meta["name"].as_str().unwrap_or("Untitled").to_string();
+                        *files.recovery.borrow_mut() = Some((n, meta["path"].as_str().map(str::to_string)));
+                        continue;
+                    }
+                    if name != RECOVERY {
+                        entries.push(Entry { name: name.clone(), size: bytes.len() as u64, modified });
+                    }
+                    vfs::insert(&format!("{OPFS}{name}"), bytes);
+                }
+                entries.sort_by_key(|a| a.name.to_lowercase());
+                *files.entries.borrow_mut() = entries;
+                // An autosave without its design file is nothing to recover.
+                if !vfs::exists(&format!("{OPFS}{RECOVERY}")) {
+                    *files.recovery.borrow_mut() = None;
+                }
+            }
+            Err(e) => files.say(format!("browser storage: {e}"), true),
+        }
+        files.ready.set(true);
+        files.wake();
+    });
+}
+
+/// Store what commands wrote: OPFS paths into OPFS, download paths as downloads.
+pub fn flush(files: &Rc<Files>) {
+    for (path, bytes) in vfs::take_writes() {
+        if let Some(name) = path.strip_prefix(OPFS) {
+            let name = name.to_string();
+            {
+                let mut e = files.entries.borrow_mut();
+                e.retain(|x| x.name != name);
+                if name != RECOVERY && name != RECOVERY_META {
+                    e.push(Entry { name: name.clone(), size: bytes.len() as u64, modified: js_sys::Date::now() });
+                    e.sort_by_key(|a| a.name.to_lowercase());
+                }
+            }
+            let files = files.clone();
+            spawn_local(async move {
+                if let Err(e) = write_file(&name, &bytes).await {
+                    files.say(format!("{name}: {e}"), true);
+                }
+            });
+        } else if let Some(name) = path.strip_prefix(DOWNLOADS)
+            && let Err(e) = download(name, &bytes)
+        {
+            files.say(format!("{name}: {e}"), true);
+        }
+    }
+}
+
+/// Hand `bytes` to the user as a download named `name`.
+pub fn download(name: &str, bytes: &[u8]) -> Result<(), String> {
+    let doc = web_sys::window().and_then(|w| w.document()).ok_or("no document")?;
+    let parts = Array::new();
+    parts.push(&Uint8Array::from(bytes));
+    let opts = web_sys::BlobPropertyBag::new();
+    opts.set_type("application/octet-stream");
+    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &opts).map_err(err)?;
+    let url = web_sys::Url::create_object_url_with_blob(&blob).map_err(err)?;
+    let a: web_sys::HtmlAnchorElement = doc.create_element("a").map_err(err)?.dyn_into().map_err(|_| "no anchor".to_string())?;
+    a.set_href(&url);
+    a.set_download(name);
+    a.click();
+    // Let the browser start the download before the URL goes.
+    let revoke = Closure::once_into_js(move || {
+        let _ = web_sys::Url::revoke_object_url(&url);
+    });
+    if let Some(w) = web_sys::window() {
+        let _ = w.set_timeout_with_callback_and_timeout_and_arguments_0(revoke.unchecked_ref(), 10_000);
+    }
+    Ok(())
+}
+
+/// Delete a stored design.
+pub fn delete(files: &Rc<Files>, name: &str) {
+    let _ = vfs::remove(&format!("{OPFS}{name}"));
+    files.entries.borrow_mut().retain(|e| e.name != name);
+    let (files, name) = (files.clone(), name.to_string());
+    spawn_local(async move {
+        if let Err(e) = remove_file(&name).await {
+            files.say(format!("{name}: {e}"), true);
+        }
+    });
+}
+
+/// Rename a stored design (a copy under the new name, then the old one goes: not every browser
+/// can move OPFS files).
+pub fn rename(files: &Rc<Files>, from: &str, to: &str) -> Result<(), String> {
+    let to = to.trim();
+    if to.is_empty() || to.contains('/') || to.contains('\\') || to.len() > 200 {
+        return Err("give a file name without slashes".into());
+    }
+    if files.entries.borrow().iter().any(|e| e.name == to) {
+        return Err(format!("there is already a file named {to}"));
+    }
+    let bytes = vfs::read(&format!("{OPFS}{from}"), solvecraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
+    vfs::write(&format!("{OPFS}{to}"), &bytes).map_err(|e| e.to_string())?;
+    delete(files, from);
+    flush(files);
+    Ok(())
+}
+
+/// Keep (or drop) the autosave of the open design.
+pub fn autosave(files: &Rc<Files>, doc: Option<(&solvecraft_engine::doc::Document, Option<&str>)>) {
+    let files = files.clone();
+    match doc {
+        Some((d, path)) => {
+            let bytes = solvecraft_engine::io::write_design(d);
+            let meta = serde_json::json!({"name": d.name, "path": path, "saved_at": js_sys::Date::now()}).to_string();
+            spawn_local(async move {
+                let r = async {
+                    write_file(RECOVERY, &bytes).await?;
+                    write_file(RECOVERY_META, meta.as_bytes()).await
+                };
+                if let Err(e) = r.await {
+                    files.say(format!("autosave: {e}"), true);
+                }
+            });
+        }
+        None => spawn_local(async move {
+            let _ = remove_file(RECOVERY).await;
+            let _ = remove_file(RECOVERY_META).await;
+        }),
+    }
+}
+
+/// A stored path for `name` that no stored file has: `name`, else `name (2)`, `name (3)`…
+pub fn free_name(name: &str) -> String {
+    let (stem, ext) = name.rsplit_once('.').map(|(s, e)| (s.to_string(), format!(".{e}"))).unwrap_or((name.to_string(), String::new()));
+    for i in 1..1000 {
+        let n = if i == 1 { name.to_string() } else { format!("{stem} ({i}){ext}") };
+        let p = format!("{OPFS}{n}");
+        if !vfs::exists(&p) {
+            return p;
+        }
+    }
+    format!("{OPFS}{stem} ({}){ext}", js_sys::Date::now() as u64)
+}
+
+/// The autosaved design's path (in the engine's files) for opening it.
+pub fn recovery_path() -> String {
+    format!("{OPFS}{RECOVERY}")
+}
+
+/// Pick files on the computer: the File System Access picker where there is one, else an
+/// `<input type=file>`. Read files arrive in `files.incoming`.
+pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
+    let Some(window) = web_sys::window() else { return };
+    let picker = Reflect::get(&window, &"showOpenFilePicker".into()).ok().and_then(|f| f.dyn_into::<Function>().ok());
+    match picker {
+        Some(f) => {
+            let opts = Object::new();
+            let _ = Reflect::set(&opts, &"multiple".into(), &JsValue::FALSE);
+            let promise = f.call1(&window, &opts);
+            let files = files.clone();
+            spawn_local(async move {
+                let r = async {
+                    let p: js_sys::Promise = promise.map_err(err)?.dyn_into().map_err(|_| "no promise".to_string())?;
+                    let handles: Array = JsFuture::from(p).await.map_err(err)?.dyn_into().map_err(|_| "no files".to_string())?;
+                    for h in handles.iter() {
+                        let h: FileSystemFileHandle = h.dyn_into().map_err(|_| "not a file".to_string())?;
+                        let bytes = read_handle(&h).await?;
+                        files.arrive(h.name(), bytes, intent);
+                    }
+                    Ok::<(), String>(())
+                };
+                match r.await {
+                    Ok(()) => {}
+                    // Closing the picker is no error.
+                    Err(e) if e.contains("abort") || e.contains("Abort") => {}
+                    Err(e) => files.say(format!("open: {e}"), true),
+                }
+            });
+        }
+        None => input_picker(files, intent),
+    }
+}
+
+fn input_picker(files: &Rc<Files>, intent: Intent) {
+    let Some(doc) = web_sys::window().and_then(|w| w.document()) else { return };
+    let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
+    input.set_type("file");
+    input.set_accept(".solvecraft,.step,.stp,.3mf,.stl");
+    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
+    let _ = input.set_attribute("style", "display:none");
+    if let Some(body) = doc.body() {
+        let _ = body.append_child(&input);
+    }
+    let (files, el) = (files.clone(), input.clone());
+    let on_change = Closure::once_into_js(move || {
+        el.remove();
+        let Some(list) = el.files() else { return };
+        for i in 0..list.length() {
+            let Some(f) = list.get(i) else { continue };
+            let files = files.clone();
+            spawn_local(async move {
+                match blob_bytes(&f).await {
+                    Ok(b) => files.arrive(f.name(), b, intent),
+                    Err(e) => files.say(format!("{}: {e}", f.name()), true),
+                }
+            });
+        }
+    });
+    input.set_onchange(Some(on_change.unchecked_ref()));
+    input.click();
+}
+
+/// Read files dropped on the page.
+pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput) {
+    for f in std::mem::take(&mut raw.dropped_files) {
+        let files = files.clone();
+        spawn_local(async move {
+            let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
+            match f.bytes_async().await {
+                Ok(b) => files.arrive(name, b, Intent::Insert),
+                Err(e) => files.say(format!("{name}: {e}"), true),
+            }
+        });
+    }
+}

apps/solvecraft-web/src/main.rs

@@ -6,30 +6,324 @@
 //! sample part.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+#[cfg(target_arch = "wasm32")]
+mod files;
+
 #[cfg(target_arch = "wasm32")]
 mod web {
+    use std::rc::Rc;
+
     use solvecraft_engine::Session;
+    use solvecraft_engine::io::vfs;
     use solvecraft_ui_egui::{Services, SolveApp};
     use wasm_bindgen::JsCast as _;
 
+    use crate::files::{self, Files, Intent};
+
     const CANVAS_ID: &str = "solvecraft_canvas";
     const LOADING_ID: &str = "solvecraft_loading";
     const DEPTH_BITS: u8 = 24;
 
-    struct Shell(SolveApp);
+    /// Seconds between autosaves of unsaved work.
+    const AUTOSAVE_S: f64 = 30.0;
+
+    thread_local! {
+        /// An open design has unsaved changes: leaving the page asks first.
+        static UNSAVED: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+    }
+
+    /// The browser's "leave site? changes you made may not be saved" prompt while a design has
+    /// unsaved changes (the page can't show its own dialog when it is being closed).
+    fn ask_before_unload(window: &web_sys::Window) {
+        let on_unload = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::BeforeUnloadEvent)>::new(|e: web_sys::BeforeUnloadEvent| {
+            if UNSAVED.with(std::cell::Cell::get) {
+                e.prevent_default();
+                e.set_return_value("unsaved");
+            }
+        });
+        let _ = window.add_event_listener_with_callback("beforeunload", on_unload.as_ref().unchecked_ref());
+        // The listener lives as long as the page.
+        on_unload.forget();
+    }
+
+    struct Shell {
+        app: SolveApp,
+        files: Rc<Files>,
+        /// When the last autosave was (seconds), and the revision it holds (none stored: `None`).
+        autosaved_at: f64,
+        autosaved: Option<u64>,
+        /// A stored design being renamed: (its name, the new name).
+        renaming: Option<(String, String)>,
+        /// The rename field takes the keyboard when it appears.
+        rename_focus: bool,
+        /// The start page's recent designs were filled from the stored ones.
+        recents_synced: bool,
+    }
+
+    impl Shell {
+        /// Files from the computer, writes to store, messages and the autosave.
+        fn files_tick(&mut self, ctx: &egui::Context) {
+            if self.files.ctx.borrow().is_none() {
+                *self.files.ctx.borrow_mut() = Some(ctx.clone());
+            }
+            files::flush(&self.files);
+            for (text, error) in self.files.messages.borrow_mut().drain(..) {
+                self.app.set_status(text, error);
+            }
+            let incoming: Vec<_> = self.files.incoming.borrow_mut().drain(..).collect();
+            for (name, bytes, intent) in incoming {
+                let design = name.ends_with(&format!(".{}", solvecraft_engine::io::DESIGN_EXT));
+                let path = if design && intent == Intent::Open {
+                    // A design from the computer is kept in the browser (a copy), so Save works.
+                    let path = files::free_name(&name);
+                    if let Err(e) = vfs::write(&path, &bytes) {
+                        self.app.set_status(e.to_string(), true);
+                    }
+                    files::flush(&self.files);
+                    path
+                } else {
+                    let path = format!("{}{name}", files::UPLOAD);
+                    vfs::insert(&path, bytes);
+                    path
+                };
+                match intent {
+                    Intent::Open => self.app.open_path(&path),
+                    Intent::Insert => self.app.drop_path(&path),
+                }
+                self.files.panel.set(false);
+            }
+            if self.files.ready.get() && !self.recents_synced {
+                self.recents_synced = true;
+                self.sync_recents();
+            }
+            let now = ctx.input(|i| i.time);
+            // Unsaved work is kept (at most every AUTOSAVE_S); saved work needs no autosave.
+            if self.files.ready.get() && self.files.recovery.borrow().is_none() {
+                let s = &self.app.session;
+                let changed = s.is_dirty() && self.autosaved != Some(s.revision);
+                let wait = AUTOSAVE_S - (now - self.autosaved_at);
+                if changed && wait <= 0.0 {
+                    files::autosave(&self.files, Some((&s.doc, s.path.as_deref())));
+                    self.autosaved = Some(s.revision);
+                    self.autosaved_at = now;
+                } else if changed {
+                    // Come back for it even when nothing else happens.
+                    ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait));
+                } else if !s.is_dirty() && self.autosaved.is_some() {
+                    files::autosave(&self.files, None);
+                    self.autosaved = None;
+                }
+            }
+            if !self.files.ready.get() || !self.files.incoming.borrow().is_empty() {
+                ctx.request_repaint_after(std::time::Duration::from_millis(100));
+            }
+        }
+
+        /// The start page's recent designs are the stored ones: the remembered order first (those
+        /// still stored), then the others, newest first.
+        fn sync_recents(&mut self) {
+            let mut entries = self.files.entries.borrow().clone();
+            entries.sort_by(|a, b| b.modified.total_cmp(&a.modified));
+            let recent = &mut self.app.home.recent;
+            recent.retain(|p| vfs::exists(p));
+            for e in entries.iter().filter(|e| e.name.ends_with(&format!(".{}", solvecraft_engine::io::DESIGN_EXT))) {
+                let p = format!("{}{}", files::OPFS, e.name);
+                if !recent.contains(&p) {
+                    recent.push(p);
+                }
+            }
+            recent.truncate(solvecraft_ui_egui::home::MAX_RECENT);
+        }
+
+        /// The stored designs: open, insert, rename, delete, download; open from the computer.
+        fn file_panel(&mut self, ctx: &egui::Context) {
+            if !self.files.panel.get() {
+                return;
+            }
+            let mut open = true;
+            let mut act: Option<(&'static str, String)> = None;
+            egui::Window::new("Files in this browser")
+                .open(&mut open)
+                .collapsible(false)
+                .resizable(true)
+                .default_width(520.0)
+                .pivot(egui::Align2::CENTER_CENTER)
+                .default_pos(ctx.content_rect().center())
+                .show(ctx, |ui| {
+                    ui.horizontal(|ui| {
+                        if ui.button("Open from computer…").clicked() {
+                            files::pick_from_disk(&self.files, Intent::Open);
+                        }
+                        if ui.button("Insert from computer…").on_hover_text("STEP, 3MF or STL into the open design").clicked() {
+                            files::pick_from_disk(&self.files, Intent::Insert);
+                        }
+                        if ui.button("Download open design").clicked() {
+                            act = Some(("download_open", String::new()));
+                        }
+                    });
+                    ui.separator();
+                    if !self.files.ready.get() {
+                        ui.horizontal(|ui| {
+                            ui.spinner();
+                            ui.label("Reading the browser's storage…");
+                        });
+                        return;
+                    }
+                    let entries = self.files.entries.borrow().clone();
+                    if entries.is_empty() {
+                        ui.label("Designs you save appear here. They stay in this browser.");
+                    }
+                    egui::ScrollArea::vertical().max_height(360.0).show(ui, |ui| {
+                        egui::Grid::new("opfs_files").num_columns(3).spacing([12.0, 6.0]).show(ui, |ui| {
+                            for e in &entries {
+                                match &mut self.renaming {
+                                    Some((from, to)) if *from == e.name => {
+                                        let r = ui.add(egui::TextEdit::singleline(to).desired_width(200.0));
+                                        if std::mem::take(&mut self.rename_focus) {
+                                            r.request_focus();
+                                        }
+                                        if r.lost_focus() {
+                                            act = Some(if ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                                                ("rename", to.clone())
+                                            } else {
+                                                ("rename_cancel", String::new())
+                                            });
+                                        }
+                                    }
+                                    _ => {
+                                        ui.label(&e.name);
+                                    }
+                                }
+                                ui.label(format!("{:.1} KB", e.size as f64 / 1024.0));
+                                ui.horizontal(|ui| {
+                                    if ui.small_button("Open").clicked() {
+                                        act = Some(("open", e.name.clone()));
+                                    }
+                                    let design = e.name.ends_with(&format!(".{}", solvecraft_engine::io::DESIGN_EXT));
+                                    if !design && ui.small_button("Insert").on_hover_text("Into the open design (STEP, 3MF, STL)").clicked() {
+                                        act = Some(("insert", e.name.clone()));
+                                    }
+                                    if ui.small_button("Rename").clicked() {
+                                        self.renaming = Some((e.name.clone(), e.name.clone()));
+                                        self.rename_focus = true;
+                                    }
+                                    if ui.small_button("Download").clicked() {
+                                        act = Some(("download", e.name.clone()));
+                                    }
+                                    if ui.small_button("Delete").clicked() {
+                                        act = Some(("delete", e.name.clone()));
+                                    }
+                                });
+                                ui.end_row();
+                            }
+                        });
+                    });
+                });
+            if !open {
+                self.files.panel.set(false);
+                self.renaming = None;
+            }
+            let Some((what, name)) = act else { return };
+            let path = format!("{}{name}", files::OPFS);
+            match what {
+                "open" => {
+                    self.app.open_path(&path);
+                    self.files.panel.set(false);
+                }
+                "insert" => {
+                    self.app.insert_path(&path);
+                    self.files.panel.set(false);
+                }
+                "download" => match vfs::read(&path, solvecraft_engine::io::MAX_DESIGN_BYTES) {
+                    Ok(b) => {
+                        if let Err(e) = files::download(&name, &b) {
+                            self.app.set_status(e, true);
+                        }
+                    }
+                    Err(e) => self.app.set_status(e.to_string(), true),
+                },
+                "download_open" => {
+                    let d = &self.app.session.doc;
+                    let bytes = solvecraft_engine::io::write_design(d);
+                    if let Err(e) = files::download(&format!("{}.{}", d.name, solvecraft_engine::io::DESIGN_EXT), &bytes) {
+                        self.app.set_status(e, true);
+                    }
+                }
+                "delete" => {
+                    files::delete(&self.files, &name);
+                    self.app.home.recent.retain(|r| *r != path);
+                }
+                "rename_cancel" => self.renaming = None,
+                "rename" => {
+                    if let Some((from, _)) = self.renaming.take() {
+                        match files::rename(&self.files, &from, &name) {
+                            Ok(()) => {
+                                // Recent designs follow the new name.
+                                let (old, new) = (format!("{}{from}", files::OPFS), format!("{}{name}", files::OPFS));
+                                for r in &mut self.app.home.recent {
+                                    if *r == old {
+                                        *r = new.clone();
+                                    }
+                                }
+                            }
+                            Err(e) => self.app.set_status(e, true),
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+
+        /// Offer the autosave an earlier session left.
+        fn recovery_prompt(&mut self, ctx: &egui::Context) {
+            let Some((name, path)) = self.files.recovery.borrow().clone() else { return };
+            let mut answer = None;
+            egui::Window::new("Recover unsaved work?").collapsible(false).resizable(false).anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0]).show(
+                ctx,
+                |ui| {
+                    ui.label(format!("“{name}” had unsaved changes when this page last closed."));
+                    ui.horizontal(|ui| {
+                        if ui.button("Recover").clicked() {
+                            answer = Some(true);
+                        }
+                        if ui.button("Discard").clicked() {
+                            answer = Some(false);
+                        }
+                    });
+                },
+            );
+            let Some(recover) = answer else { return };
+            *self.files.recovery.borrow_mut() = None;
+            if recover {
+                self.app.open_path(&files::recovery_path());
+                // It belongs to its own file again (saving goes there); it is unsaved.
+                self.app.session.path = path;
+                self.app.session.doc_mut().name = name;
+                self.app.session.mark_unsaved();
+                self.app.home.open = false;
+            }
+            files::autosave(&self.files, None);
+        }
+    }
 
     impl eframe::App for Shell {
         fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-            self.0.logic(ctx);
+            self.app.logic(ctx);
+            self.files_tick(ctx);
+            UNSAVED.with(|u| u.set(solvecraft_ui_egui::documents::any_dirty(&self.app)));
         }
         fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-            self.0.raw_input_hook(raw);
+            files::take_drops(&self.files, raw);
+            self.app.raw_input_hook(raw);
         }
         fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-            self.0.ui(ui);
+            self.app.ui(ui);
+            let ctx = ui.ctx().clone();
+            self.file_panel(&ctx);
+            self.recovery_prompt(&ctx);
         }
         fn save(&mut self, storage: &mut dyn eframe::Storage) {
-            storage.set_string(PREFS_KEY, self.0.prefs());
+            storage.set_string(PREFS_KEY, self.app.prefs());
         }
     }
 
@@ -43,7 +337,9 @@ mod web {
     pub fn start() {
         eframe::WebLogger::init(log::LevelFilter::Info).ok();
         wasm_bindgen_futures::spawn_local(async {
-            let Some(document) = web_sys::window().and_then(|w| w.document()) else { return };
+            let Some(window) = web_sys::window() else { return };
+            ask_before_unload(&window);
+            let Some(document) = window.document() else { return };
             let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
                 log::error!("missing <canvas id=\"{CANVAS_ID}\">");
                 return;
@@ -59,12 +355,29 @@ mod web {
                     canvas,
                     options,
                     Box::new(move |cc| {
-                        let mut app = SolveApp::new(Session::default(), Services::default());
+                        let files = Rc::new(Files::default());
+                        files::start(&files);
+                        let panel = files.clone();
+                        let services = Services {
+                            // Open shows the browser's files (and the computer's, from there).
+                            pick_open: Some(Box::new(move || {
+                                panel.panel.set(true);
+                                None
+                            })),
+                            // Designs are kept in the browser; everything else is downloaded.
+                            pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
+                                let design = exts.contains(&solvecraft_engine::io::DESIGN_EXT);
+                                Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))
+                            })),
+                            ..Default::default()
+                        };
+                        let mut app = SolveApp::new(Session::default(), services);
                         if let Some(p) = cc.storage.and_then(|s| s.get_string(PREFS_KEY)) {
                             app.load_prefs(&p);
                         }
                         if let Some(rs) = &cc.wgpu_render_state {
-                            app.set_wgpu(rs, DEPTH_BITS, 1);
+                            // eframe's web painter has no stencil buffer.
+                            app.set_wgpu(rs, DEPTH_BITS, 0, 1);
                         }
                         if query().contains("sample") {
                             if let Err(e) = app.session.run_script(&solvecraft_engine::sample::script()) {
@@ -73,7 +386,19 @@ mod web {
                             app.session.doc_mut().name = "Sample Plate".into();
                             app.session.mark_saved();
                         }
-                        Ok(Box::new(Shell(app)))
+                        if !query().contains("sample") {
+                            let rev = app.session.revision;
+                            app.home.show(rev);
+                        }
+                        Ok(Box::new(Shell {
+                            app,
+                            files,
+                            autosaved_at: f64::NEG_INFINITY,
+                            autosaved: None,
+                            renaming: None,
+                            rename_focus: false,
+                            recents_synced: false,
+                        }))
                     }),
                 )
                 .await;
@@ -81,7 +406,7 @@ mod web {
                 match result {
                     Ok(()) => el.remove(),
                     Err(e) => {
-                        el.set_inner_html(&format!("<p>SolveCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>"))
+                        el.set_inner_html(&format!("<p>SolidCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>"))
                     }
                 }
             }

apps/solvecraft/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft"
-description = "SolveCraft desktop app"
+description = "SolidCraft desktop app"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -13,8 +13,17 @@ workspace = true
 [dependencies]
 solvecraft-engine = { workspace = true }
 solvecraft-ui-egui = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+hidapi = { version = "2.6.7", default-features = false, features = ["windows-native"] }
+
+[target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
+winit = { version = "0.30", default-features = false, features = ["x11"] }
+
+[build-dependencies]
+embed-resource = "3.0.11"

apps/solvecraft/build.rs

@@ -0,0 +1,61 @@
+#![forbid(unsafe_code)]
+#[path = "../app_icon.rs"]
+mod app_icon;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-changed=../app_icon.rs");
+    println!("cargo:rerun-if-changed=build.rs");
+    if std::env::var("CARGO_CFG_TARGET_OS")? != "windows" {
+        return Ok(());
+    }
+    let out = std::path::PathBuf::from(std::env::var_os("OUT_DIR").ok_or("missing OUT_DIR")?);
+    let sizes = [16usize, 24, 32, 48, 64, 128, 256];
+    let mut images = Vec::new();
+    for size in sizes {
+        let rgba = app_icon::rgba(size)?;
+        // ICO DIB: bottom-up BGRA plus a padded one-bit transparency mask.
+        let mask_stride = size.div_ceil(32) * 4;
+        let mut dib = Vec::new();
+        dib.extend_from_slice(&40u32.to_le_bytes());
+        dib.extend_from_slice(&(size as i32).to_le_bytes());
+        dib.extend_from_slice(&((size * 2) as i32).to_le_bytes());
+        dib.extend_from_slice(&1u16.to_le_bytes());
+        dib.extend_from_slice(&32u16.to_le_bytes());
+        dib.extend_from_slice(&[0; 24]);
+        for row in rgba.chunks_exact(size * 4).rev() {
+            for p in row.as_chunks::<4>().0.iter() {
+                dib.extend_from_slice(&[p[2], p[1], p[0], p[3]]);
+            }
+        }
+        for row in rgba.chunks_exact(size * 4).rev() {
+            let mut mask = vec![0u8; mask_stride];
+            for (x, p) in row.as_chunks::<4>().0.iter().enumerate() {
+                if p[3] == 0 {
+                    mask[x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+            dib.extend_from_slice(&mask);
+        }
+        images.push((size, dib));
+    }
+    let mut ico = vec![0, 0, 1, 0];
+    ico.extend_from_slice(&(images.len() as u16).to_le_bytes());
+    let mut offset = 6 + 16 * images.len();
+    for (size, data) in &images {
+        let dim = if *size == 256 { 0 } else { *size as u8 };
+        ico.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
+        ico.extend_from_slice(&(data.len() as u32).to_le_bytes());
+        ico.extend_from_slice(&(offset as u32).to_le_bytes());
+        offset += data.len();
+    }
+    for (_, data) in images {
+        ico.extend_from_slice(&data);
+    }
+    let icon = out.join("solidcraft.ico");
+    std::fs::write(&icon, ico)?;
+    let rc = out.join("solidcraft.rc");
+    std::fs::write(&rc, format!("1 ICON \"{}\"\n", icon.display().to_string().replace('\\', "/")))?;
+    // Missing resource tools are a build error, rather than silently shipping a generic icon.
+    embed_resource::compile_for(&rc, ["solvecraft"], embed_resource::NONE).manifest_required()?;
+    Ok(())
+}

apps/solvecraft/src/control_server.rs

@@ -3,12 +3,22 @@
 
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpListener, TcpStream};
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::mpsc::{Receiver, Sender, channel};
 use std::time::Duration;
 
 use serde_json::{Value, json};
+use solvecraft_engine::MAX_LINE;
 use solvecraft_ui_egui::ControlRequest;
 
+/// Connections served at once. The channel has no authentication beyond being bound to
+/// loopback, so a flood must not be able to spawn threads without end.
+const MAX_CONNECTIONS: usize = 16;
+/// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
+const MAX_BAD_LINES: usize = 8;
+
+static OPEN: AtomicUsize = AtomicUsize::new(0);
+
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
@@ -21,19 +31,69 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     eprintln!("solvecraft: control server listening on 127.0.0.1:{port}");
     std::thread::spawn(move || {
         for stream in listener.incoming().flatten() {
+            if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
+                OPEN.fetch_sub(1, Ordering::Relaxed);
+                let mut refused = stream;
+                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                continue;
+            }
             let tx = tx.clone();
             let ctx = ctx.clone();
-            std::thread::spawn(move || serve(stream, tx, ctx));
+            std::thread::spawn(move || {
+                serve(stream, tx, ctx);
+                OPEN.fetch_sub(1, Ordering::Relaxed);
+            });
         }
     });
     rx
 }
 
+/// One line without its newline, or `None` at the end of the stream. A client that sends
+/// gigabytes with no newline would otherwise make this thread allocate until the process is
+/// killed, so the line is refused as soon as it passes `max`.
+fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>>> {
+    let mut line = Vec::new();
+    loop {
+        let (done, used) = {
+            let available = r.fill_buf()?;
+            if available.is_empty() {
+                return Ok((!line.is_empty()).then_some(line));
+            }
+            match available.iter().position(|b| *b == b'\n') {
+                Some(i) => {
+                    line.extend_from_slice(available.get(..i).unwrap_or(&[]));
+                    (true, i + 1)
+                }
+                None => {
+                    line.extend_from_slice(available);
+                    (false, available.len())
+                }
+            }
+        };
+        r.consume(used);
+        if done {
+            return Ok(Some(line));
+        }
+        if line.len() > max {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "request too large"));
+        }
+    }
+}
+
 fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
-    for line in BufReader::new(read).lines() {
-        let Ok(line) = line else { break };
+    let mut reader = BufReader::new(read);
+    let mut bad = 0usize;
+    loop {
+        let line = match read_line(&mut reader, MAX_LINE) {
+            Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
+            Ok(None) => break,
+            Err(e) => {
+                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                break;
+            }
+        };
         if line.trim().is_empty() {
             continue;
         }
@@ -53,10 +113,58 @@ fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
                 }
                 r
             }
-            Err(e) => json!({"ok": false, "error": format!("bad JSON: {e}")}),
+            Err(e) => {
+                bad += 1;
+                json!({"ok": false, "error": format!("bad JSON: {e}")})
+            }
         };
         if writeln!(out, "{reply}").is_err() {
             break;
         }
+        if bad >= MAX_BAD_LINES {
+            break;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A request longer than the cap is refused instead of allocated.
+    #[test]
+    fn lines_past_the_cap_are_refused() {
+        let flood = vec![b'A'; MAX_LINE + 2];
+        let mut r = BufReader::new(flood.as_slice());
+        let e = read_line(&mut r, MAX_LINE).unwrap_err();
+        assert_eq!(e.kind(), std::io::ErrorKind::InvalidData);
+        assert!(e.to_string().contains("request too large"), "{e}");
+    }
+
+    /// Ordinary framing: lines split on newlines, blank lines kept, no trailing newline needed.
+    #[test]
+    fn lines_split_on_newlines() {
+        let text = b"{\"a\":1}\n\n{\"b\":2}\nlast".to_vec();
+        let mut r = BufReader::new(text.as_slice());
+        let mut got = Vec::new();
+        while let Some(line) = read_line(&mut r, MAX_LINE).unwrap() {
+            got.push(String::from_utf8(line).unwrap());
+        }
+        assert_eq!(got, vec!["{\"a\":1}", "", "{\"b\":2}", "last"]);
+        assert!(read_line(&mut r, MAX_LINE).unwrap().is_none());
+    }
+
+    /// A line that spans several reads of the underlying stream still arrives whole.
+    #[test]
+    fn lines_longer_than_one_buffer_arrive_whole() {
+        let long = "x".repeat(200_000);
+        let text = format!("{long}\n{long}\n").into_bytes();
+        let mut r = BufReader::with_capacity(64, text.as_slice());
+        assert_eq!(read_line(&mut r, MAX_LINE).unwrap().unwrap().len(), long.len());
+        assert_eq!(read_line(&mut r, MAX_LINE).unwrap().unwrap().len(), long.len());
+        assert!(read_line(&mut r, MAX_LINE).unwrap().is_none());
+        // The same line against a smaller cap is refused.
+        let mut r = BufReader::with_capacity(64, text.as_slice());
+        assert!(read_line(&mut r, 1000).is_err());
     }
 }

apps/solvecraft/src/main.rs

@@ -6,37 +6,53 @@
 //! `.3mf`/`.stl` file as a new design holding mesh bodies.
 //!
 //! `--control <port>` (or `SOLVECRAFT_CONTROL_PORT`) starts a localhost JSON-lines control
-//! server: `{"id":1,"method":"engine.execute","params":{"command":"PrimitiveBox","params":{…}}}`.
+//! server: `{"id":1,"method":"engine.execute","params":{"command":"solid.box","params":{…}}}`.
 //! See `solvecraft_ui_egui::control` and docs/control-protocol.md.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+#[path = "../../app_icon.rs"]
+mod app_icon;
 mod control_server;
+#[cfg(target_os = "windows")]
+mod space_mouse;
 
 use solvecraft_engine::Session;
 use solvecraft_ui_egui::{Services, SolveApp};
 
-struct App(SolveApp);
+struct App {
+    solve: SolveApp,
+    #[cfg(target_os = "windows")]
+    space_mouse: space_mouse::SpaceMouse,
+}
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        self.0.logic(ctx);
-        if self.0.quit_requested {
+        // The OS closing the window (Alt+F4, Cmd+Q, the window manager): ask about unsaved
+        // designs first; the window closes once they are answered (`quit_requested`).
+        if ctx.input(|i| i.viewport().close_requested()) && !self.solve.quit_requested {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+            solvecraft_ui_egui::documents::request_quit(&mut self.solve);
+        }
+        self.solve.logic(ctx);
+        #[cfg(target_os = "windows")]
+        self.space_mouse.tick(&mut self.solve, ctx);
+        if self.solve.quit_requested {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+        self.solve.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.0.ui(ui);
+        self.solve.ui(ui);
     }
     fn save(&mut self, storage: &mut dyn eframe::Storage) {
-        storage.set_string(PREFS_KEY, self.0.prefs());
+        storage.set_string(PREFS_KEY, self.solve.prefs());
     }
     fn on_exit(&mut self) {
-        solvecraft_ui_egui::recovery_ui::close(&mut self.0);
+        solvecraft_ui_egui::recovery_ui::close(&mut self.solve);
     }
 }
 
@@ -47,10 +63,15 @@ fn services() -> Services {
     Services {
         pick_open: Some(Box::new(|| {
             rfd::FileDialog::new()
-                .add_filter("Designs, STEP and meshes", &["solvecraft", "step", "stp", "STEP", "STP", "3mf", "3MF", "stl", "STL"])
-                .add_filter("SolveCraft design", &["solvecraft"])
+                .add_filter(
+                    "Designs, STEP, IGES and meshes",
+                    &["solvecraft", "step", "stp", "STEP", "STP", "igs", "iges", "IGS", "IGES", "3mf", "3MF", "stl", "STL"],
+                )
+                .add_filter("SolidCraft design", &["solvecraft"])
                 .add_filter("STEP", &["step", "stp", "STEP", "STP"])
+                .add_filter("IGES", &["igs", "iges", "IGS", "IGES"])
                 .add_filter("Mesh (3MF, STL)", &["3mf", "3MF", "stl", "STL"])
+                .add_filter("Sketch drawings (DXF, SVG)", &["dxf", "DXF", "svg", "SVG"])
                 .add_filter("All files", &["*"])
                 .pick_file()
                 .map(|p| p.to_string_lossy().to_string())
@@ -59,6 +80,23 @@ fn services() -> Services {
             rfd::FileDialog::new().set_file_name(name).add_filter("File", exts).save_file().map(|p| p.to_string_lossy().to_string())
         })),
         graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
+        show_in_folder: Some(Box::new(|path| {
+            let folder = std::path::Path::new(path).parent().unwrap_or_else(|| std::path::Path::new("."));
+            let mut command = std::process::Command::new(if cfg!(target_os = "windows") {
+                "explorer"
+            } else if cfg!(target_os = "macos") {
+                "open"
+            } else {
+                "xdg-open"
+            });
+            command.arg(folder);
+            #[cfg(target_os = "windows")]
+            {
+                use std::os::windows::process::CommandExt;
+                command.creation_flags(0x08000000);
+            }
+            let _ = command.spawn();
+        })),
     }
 }
 
@@ -84,8 +122,28 @@ fn msaa() -> u16 {
 const CUSTOM_TITLEBAR: bool = !cfg!(target_os = "macos");
 
 const DEPTH_BITS: u8 = 24;
+/// The section cap marks where it shows in the stencil.
+const STENCIL_BITS: u8 = 8;
 const MSAA: u16 = 4;
 
+fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
+    Ok(egui::ViewportBuilder::default()
+        .with_title("SolidCraft")
+        .with_icon(egui::IconData {
+            rgba: app_icon::rgba(64).map_err(|e| eframe::Error::AppCreation(std::io::Error::other(e).into()))?,
+            width: 64,
+            height: 64,
+        })
+        .with_inner_size([1600.0, 1000.0])
+        .with_min_inner_size([960.0, 600.0])
+        .with_drag_and_drop(true)
+        .with_decorations(!CUSTOM_TITLEBAR)
+        .with_fullsize_content_view(true)
+        .with_titlebar_shown(false)
+        .with_title_shown(false)
+        .with_app_id("ai.storyteller.solvecraft"))
+}
+
 fn main() -> eframe::Result {
     let samples = msaa();
     let mut control_port: Option<u16> = std::env::var("SOLVECRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
@@ -108,24 +166,29 @@ fn main() -> eframe::Result {
         }
     }
     let options = eframe::NativeOptions {
-        viewport: egui::ViewportBuilder::default()
-            .with_title("SolveCraft")
-            .with_inner_size([1600.0, 1000.0])
-            .with_min_inner_size([960.0, 600.0])
-            .with_drag_and_drop(true)
-            .with_decorations(!CUSTOM_TITLEBAR)
-            .with_fullsize_content_view(true)
-            .with_titlebar_shown(false)
-            .with_title_shown(false)
-            .with_app_id("ai.storyteller.solvecraft"),
+        viewport: app_viewport()?,
         depth_buffer: DEPTH_BITS,
+        stencil_buffer: STENCIL_BITS,
         multisampling: samples,
         ..Default::default()
     };
+    #[cfg(all(unix, not(target_os = "macos")))]
+    let mut options = options;
+    #[cfg(all(unix, not(target_os = "macos")))]
+    // winit has no file drag-and-drop on Wayland (only on X11), so dropping files from the file
+    // manager showed a "no" cursor. Run through XWayland when it's there; SOLVECRAFT_WAYLAND=1
+    // keeps the native Wayland backend.
+    if std::env::var_os("DISPLAY").is_some() && std::env::var_os("SOLVECRAFT_WAYLAND").is_none() {
+        options.event_loop_builder = Some(Box::new(|b| {
+            use winit::platform::x11::EventLoopBuilderExtX11;
+            b.with_x11();
+        }));
+    }
     eframe::run_native(
-        "SolveCraft",
+        "SolidCraft",
         options,
         Box::new(move |cc| {
+            solvecraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
             let mut app = SolveApp::new(Session::default(), services());
             app.custom_titlebar = CUSTOM_TITLEBAR;
             app.integrated_titlebar = cfg!(target_os = "macos");
@@ -133,7 +196,8 @@ fn main() -> eframe::Result {
                 app.load_prefs(&p);
             }
             if let Some(rs) = &cc.wgpu_render_state {
-                app.set_wgpu(rs, DEPTH_BITS, u32::from(samples));
+                eprintln!("SolidCraft graphics: {:?}, MSAA {}x (requested {}x)", rs.adapter.get_info().backend, rs.msaa_samples, samples);
+                app.set_wgpu(rs, DEPTH_BITS, STENCIL_BITS, rs.msaa_samples);
             }
             if let Some(port) = control_port {
                 let rx = control_server::start(port, cc.egui_ctx.clone());
@@ -148,7 +212,7 @@ fn main() -> eframe::Result {
                 app.session.undo.clear();
             }
             for f in &files {
-                app.open_path(f);
+                app.open_path_async(f);
             }
             // No design given: the start page (not when driven over the control channel, whose
             // clients expect the design view; `ui.home` shows it there).
@@ -161,7 +225,39 @@ fn main() -> eframe::Result {
                 let every = if app.autosave_minutes > 0.0 { app.autosave_minutes * 60.0 } else { f64::MAX / 4.0 };
                 solvecraft_ui_egui::recovery_ui::start(&mut app, &dir, std::time::Duration::from_secs_f64(every.min(1e9)));
             }
-            Ok(Box::new(App(app)))
+            #[cfg(target_os = "windows")]
+            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            Ok(Box::new(App {
+                solve: app,
+                #[cfg(target_os = "windows")]
+                space_mouse,
+            }))
         }),
     )
 }
+
+#[cfg(test)]
+mod icon_tests {
+    #[test]
+    fn desktop_viewport_supplies_the_original_mark_to_the_window() {
+        let viewport = super::app_viewport().expect("viewport");
+        let icon = viewport.icon.expect("running window must have an icon");
+        assert_eq!((icon.width, icon.height), (64, 64));
+        assert_eq!(icon.rgba, super::app_icon::rgba(64).expect("original mark"));
+        assert_eq!(viewport.app_id.as_deref(), Some("ai.storyteller.solvecraft"));
+    }
+}
+
+#[cfg(test)]
+mod msaa_tests {
+    #[test]
+    fn saved_multisampling_uses_the_selected_backend_policy() {
+        use eframe::wgpu::Backend;
+        for requested in [1, 2, 4, 8] {
+            assert_eq!(eframe::egui_wgpu::effective_msaa_samples(Backend::Gl, requested), 1);
+            for backend in [Backend::Vulkan, Backend::Dx12, Backend::Metal] {
+                assert_eq!(eframe::egui_wgpu::effective_msaa_samples(backend, requested), requested);
+            }
+        }
+    }
+}

apps/solvecraft/src/space_mouse.rs

@@ -0,0 +1,206 @@
+//! Windows 3Dconnexion HID navigation. The device reader never touches the document or UI;
+//! it publishes the latest axes, and the egui thread applies them once per frame.
+
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use egui::Context;
+use hidapi::{DeviceInfo, HidApi};
+use solvecraft_engine::render::Camera;
+use solvecraft_ui_egui::SolveApp;
+
+const STALE_AFTER: Duration = Duration::from_millis(150);
+const RETRY_AFTER: Duration = Duration::from_secs(2);
+
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+struct Axes {
+    translation: [i16; 3],
+    rotation: [i16; 3],
+}
+
+#[derive(Clone, Copy)]
+struct Reading {
+    axes: Axes,
+    translation_at: Instant,
+    rotation_at: Instant,
+}
+
+impl Reading {
+    fn new(now: Instant) -> Self {
+        Self { axes: Axes::default(), translation_at: now, rotation_at: now }
+    }
+
+    fn current(self, now: Instant) -> Axes {
+        Axes {
+            translation: if now.duration_since(self.translation_at) < STALE_AFTER { self.axes.translation } else { [0; 3] },
+            rotation: if now.duration_since(self.rotation_at) < STALE_AFTER { self.axes.rotation } else { [0; 3] },
+        }
+    }
+}
+
+/// The old SpaceNavigator uses Logitech's VID; newer 3Dconnexion devices use their own.
+/// The HID usage excludes ordinary Logitech mice and the keyboard interfaces of SpaceMice.
+fn is_3d_mouse(info: &DeviceInfo) -> bool {
+    matches!(info.vendor_id(), 0x046d | 0x256f) && info.usage_page() == 0x01 && info.usage() == 0x08
+}
+
+fn three_axes(bytes: &[u8]) -> Option<[i16; 3]> {
+    let &[x0, x1, y0, y1, z0, z1] = bytes.get(..6)? else { return None };
+    Some([i16::from_le_bytes([x0, x1]), i16::from_le_bytes([y0, y1]), i16::from_le_bytes([z0, z1])])
+}
+
+/// SpaceNavigator reports 1 (translation) and 2 (rotation), each with three signed
+/// little-endian 16-bit values. The HID layer may pad either report to its maximum size.
+fn decode_report(report: &[u8], reading: &mut Reading, now: Instant) -> bool {
+    match report.first().copied() {
+        Some(1) => {
+            let Some(translation) = report.get(1..).and_then(three_axes) else { return false };
+            reading.axes.translation = translation;
+            reading.translation_at = now;
+            true
+        }
+        Some(2) => {
+            let Some(rotation) = report.get(1..).and_then(three_axes) else { return false };
+            reading.axes.rotation = rotation;
+            reading.rotation_at = now;
+            true
+        }
+        _ => false,
+    }
+}
+
+fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
+    let Ok(mut api) = HidApi::new() else {
+        log::warn!("3D mouse: HID initialization failed");
+        return;
+    };
+    loop {
+        if let Err(error) = api.refresh_devices() {
+            log::warn!("3D mouse: device scan failed: {error}");
+        } else if let Some(device) = api.device_list().find(|info| is_3d_mouse(info)).and_then(|info| info.open_device(&api).ok()) {
+            let mut report = [0_u8; 64];
+            loop {
+                match device.read_timeout(&mut report, 100) {
+                    Ok(0) => {}
+                    Ok(size) => {
+                        if let Ok(mut reading) = shared.lock()
+                            && decode_report(&report[..size], &mut reading, Instant::now())
+                        {
+                            ctx.request_repaint();
+                        }
+                    }
+                    Err(error) => {
+                        log::info!("3D mouse disconnected: {error}");
+                        break;
+                    }
+                }
+            }
+            if let Ok(mut reading) = shared.lock() {
+                *reading = Reading::new(Instant::now());
+            }
+            ctx.request_repaint();
+        }
+        std::thread::sleep(RETRY_AFTER);
+    }
+}
+
+pub struct SpaceMouse {
+    shared: Arc<Mutex<Reading>>,
+    last_frame: Instant,
+}
+
+impl SpaceMouse {
+    pub fn start(ctx: &Context) -> Self {
+        let now = Instant::now();
+        let shared = Arc::new(Mutex::new(Reading::new(now)));
+        let worker_state = Arc::clone(&shared);
+        let worker_ctx = ctx.clone();
+        if let Err(error) = std::thread::Builder::new().name("solvecraft-3d-mouse".into()).spawn(move || reader(worker_ctx, worker_state)) {
+            log::warn!("3D mouse: reader could not start: {error}");
+        }
+        Self { shared, last_frame: now }
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
+        let now = Instant::now();
+        let seconds = now.duration_since(self.last_frame).as_secs_f64().min(0.05);
+        self.last_frame = now;
+        if !app.preferences.space_mouse_enabled || app.home.open {
+            return;
+        }
+        let axes = match self.shared.lock() {
+            Ok(reading) => reading.current(now),
+            Err(_) => return,
+        };
+        if axes == Axes::default() {
+            return;
+        }
+        let speed = f64::from(app.preferences.space_mouse_speed);
+        if !speed.is_finite() {
+            return;
+        }
+        app.begin_external_navigation();
+        let height = app.viewport.rect.map_or(600.0, |rect| f64::from(rect.height().max(1.0)));
+        navigate(&mut app.cam, axes, seconds * speed.clamp(0.1, 5.0), height, app.session.active_sketch.is_some());
+        ctx.request_repaint_after(Duration::from_millis(16));
+    }
+}
+
+/// A small dead zone avoids drift at rest. A full cap deflection takes roughly one viewport
+/// per second to pan and about two radians per second to turn, independent of frame rate.
+fn normalized(value: i16) -> f64 {
+    let v = f64::from(value);
+    if v.abs() <= 20.0 { 0.0 } else { v.signum() * ((v.abs() - 20.0) / 330.0).min(1.0) }
+}
+
+fn navigate(cam: &mut Camera, axes: Axes, seconds: f64, height: f64, sketch: bool) {
+    if !(seconds > 0.0) || !seconds.is_finite() {
+        return;
+    }
+    let [x, y, z] = axes.translation.map(normalized);
+    let [rx, ry, rz] = axes.rotation.map(normalized);
+    cam.pan(x * height * 0.6 * seconds, -y * height * 0.6 * seconds, height);
+    cam.zoom_at((-z * 1.5 * seconds).exp(), None);
+    if !sketch {
+        cam.orbit(ry * 250.0 * seconds, rx * 250.0 * seconds);
+        cam.roll_by(rz * 2.0 * seconds);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn decodes_separate_reports_without_stale_motion_or_padding_interference() {
+        let now = Instant::now();
+        let mut reading = Reading::new(now);
+        assert!(!decode_report(&[1, 1, 2], &mut reading, now));
+        assert_eq!(reading.current(now), Axes::default());
+        assert!(decode_report(&[1, 0x9c, 0xff, 0x2c, 0x01, 0, 0], &mut reading, now));
+        assert_eq!(reading.current(now).translation, [-100, 300, 0]);
+        assert!(decode_report(&[2, 0, 0, 1, 0, 0xff, 0xff], &mut reading, now));
+        assert_eq!(reading.current(now).rotation, [0, 1, -1]);
+        let later = now + STALE_AFTER + Duration::from_millis(1);
+        assert_eq!(reading.current(later), Axes::default());
+        assert!(decode_report(&[2, 4, 0, 5, 0, 6, 0], &mut reading, later));
+        assert!(decode_report(&[1, 1, 0, 2, 0, 3, 0, 0, 0, 0, 0, 0, 0], &mut reading, later));
+        assert_eq!(reading.current(later), Axes { translation: [1, 2, 3], rotation: [4, 5, 6] });
+    }
+
+    #[test]
+    fn six_axes_move_the_camera_and_sketches_keep_their_orientation() {
+        let mut cam = Camera::default();
+        let before = cam;
+        navigate(&mut cam, Axes { translation: [350, 350, 350], rotation: [350, 350, 350] }, 0.02, 600.0, false);
+        assert_ne!(cam.target, before.target);
+        assert!(cam.distance < before.distance);
+        assert_ne!(cam.yaw, before.yaw);
+        assert_ne!(cam.pitch, before.pitch);
+        assert_ne!(cam.roll, before.roll);
+        let orientation = (cam.yaw, cam.pitch, cam.roll);
+        navigate(&mut cam, Axes { translation: [350, 0, 0], rotation: [350, 350, 350] }, 0.02, 600.0, true);
+        assert_eq!((cam.yaw, cam.pitch, cam.roll), orientation);
+        assert!(cam.is_valid());
+    }
+}

crates/doc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-doc"
-description = "SolveCraft document model: parameters and expressions, sketches and features on a parametric timeline, incremental evaluation"
+description = "SolidCraft document model: parameters and expressions, sketches and features on a parametric timeline, incremental evaluation"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -16,4 +16,5 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+sha2 = { workspace = true }
 web-time = { workspace = true }

crates/doc/src/anchor_frame.rs

@@ -0,0 +1,21 @@
+//! Presentation/projection state for an exact selected planar source placement.
+use crate::{DocError, Document, FaceAnchor, ModelBody, ModelState, Result};
+use std::borrow::Cow;
+
+pub fn state_in_face_anchor_frame<'a>(doc: &Document, state: &'a ModelState, anchor: &FaceAnchor, author: u64) -> Result<Cow<'a, ModelState>> {
+    let frame = anchor.author_frame(doc, author)?;
+    let raw = state.body(&anchor.target.body).ok_or_else(|| DocError::Unknown(format!("anchored body `{}`", anchor.target.body)))?;
+    let relative = anchor.source_to_author(doc, author, raw)?;
+    let mut output = crate::state_in_frame_at(doc, state, author, frame).into_owned();
+    let shape = if crate::is_identity(&relative) { raw.body.clone() } else { solvecraft_kernel::transform_matrix(&raw.body, relative)? };
+    let mut body = ModelBody::new(raw.name.clone(), shape, raw.feature);
+    body.component = raw.component;
+    body.transferred = raw.transferred;
+    body.source_name = raw.source_name.clone();
+    body.source_transform = crate::mat_mul(&relative, &raw.source_transform);
+    body.imported = raw.imported.clone();
+    body.names = crate::naming::NameCell::known(crate::naming::face_names(raw));
+    let slot = output.bodies.iter_mut().find(|body| body.name == raw.name).ok_or_else(|| DocError::Unknown("anchored body frame".into()))?;
+    *slot = body;
+    Ok(Cow::Owned(output))
+}

crates/doc/src/appearance.rs

@@ -45,6 +45,42 @@ pub struct FaceLook {
     /// The face's persistent name (found first).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub name: Option<String>,
+    /// Strict semantic assignments never transfer to a nearby replacement face.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub strict_name: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub certificate: Option<crate::config::FaceCertificate>,
+}
+
+fn is_false(value: &bool) -> bool {
+    !*value
+}
+
+/// The look a body was imported with, carried through later features (which build new kernel
+/// bodies without it): its colour and opacity, and its faces' colours by persistent face name.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct ImportedLook {
+    pub color: Option<[f32; 3]>,
+    pub opacity: Option<f32>,
+    pub faces: BTreeMap<String, ([f32; 3], f32)>,
+}
+
+impl ImportedLook {
+    /// A body's imported look: its own kernel paint, else what it carries.
+    pub fn of(b: &crate::ModelBody) -> Option<std::sync::Arc<ImportedLook>> {
+        if b.body.paint().is_none() && b.body.color().is_none() {
+            return b.imported.clone();
+        }
+        let names = crate::naming::face_names(b);
+        let faces = b
+            .body
+            .paint()
+            .map(|p| {
+                p.faces.iter().filter_map(|f| names.get(f.face).map(|n| (crate::naming::strip_piece(n).to_string(), (f.color, f.opacity)))).collect()
+            })
+            .unwrap_or_default();
+        Some(std::sync::Arc::new(ImportedLook { color: b.body.color(), opacity: b.body.paint().map(|p| p.opacity), faces }))
+    }
 }
 
 /// The design's appearances.
@@ -103,6 +139,24 @@ pub fn material_look(material: &str) -> Option<Look> {
 }
 
 impl Document {
+    /// Shared definition appearance for a computed occurrence body.
+    pub fn model_body_look(&self, body: &crate::ModelBody) -> Option<Look> {
+        let name = body.definition_name();
+        self.appearances
+            .bodies
+            .get(name)
+            .cloned()
+            .or_else(|| self.appearances.components.get(&self.model_body_component(body)).cloned())
+            .or_else(|| self.materials.get(name).and_then(|material| material_look(material)))
+    }
+    /// Effective body opacity, including paint carried from an imported body.
+    pub fn model_body_opacity(&self, body: &crate::ModelBody) -> f64 {
+        self.model_body_look(body)
+            .map(|look| look.opacity)
+            .or_else(|| body.body.paint().map(|paint| paint.opacity as f64))
+            .or_else(|| body.imported.as_ref().and_then(|paint| paint.opacity.map(f64::from)))
+            .unwrap_or(1.0)
+    }
     /// A body's look (without face appearances): its own, else its component's, else its
     /// material's.
     pub fn body_look(&self, name: &str, feature: u64) -> Option<Look> {
@@ -126,17 +180,41 @@ impl Document {
     /// assignment to the same face wins.
     pub fn face_colors(&self, b: &crate::ModelBody) -> Vec<(usize, Look)> {
         // Face colours the body was imported with, under the design's own.
-        let mut out: Vec<(usize, Look)> = b
-            .body
-            .paint()
-            .map(|p| {
-                let to8 = |x: f32| (x.clamp(0.0, 1.0) * 255.0).round() as u8;
-                p.faces.iter().map(|f| (f.face, Look::custom(f.color.map(to8), f.opacity as f64))).collect()
-            })
-            .unwrap_or_default();
+        let to8 = |x: f32| (x.clamp(0.0, 1.0) * 255.0).round() as u8;
         let names = crate::naming::face_names(b);
-        for f in self.appearances.faces.iter().filter(|f| f.body == b.name) {
-            let (p, look) = (f.point, f.look.clone());
+        let mut out: Vec<(usize, Look)> = match b.body.paint() {
+            Some(p) => p.faces.iter().map(|f| (f.face, Look::custom(f.color.map(to8), f.opacity as f64))).collect(),
+            // Carried from an earlier version of the body: by face name.
+            None => match &b.imported {
+                Some(imp) => names
+                    .iter()
+                    .enumerate()
+                    .filter_map(|(i, n)| imp.faces.get(crate::naming::strip_piece(n)).map(|(c, o)| (i, Look::custom(c.map(to8), *o as f64))))
+                    .collect(),
+                None => Vec::new(),
+            },
+        };
+        for f in self.appearances.faces.iter().filter(|f| f.body == b.definition_name()) {
+            let (p, look) = (crate::apply_point(&b.source_transform, f.point), f.look.clone());
+            if f.strict_name {
+                let Some(name) = f.name.as_ref() else { continue };
+                let Some(origin_feature) = name.strip_prefix('F').and_then(|name| name.split_once(':')).and_then(|(id, _)| id.parse().ok()) else {
+                    continue;
+                };
+                let target = crate::config::ConfigFaceTarget {
+                    body: f.body.clone(),
+                    origin_feature,
+                    name: crate::naming::strip_piece(name).into(),
+                    point: f.point,
+                    certificate: f.certificate.clone(),
+                };
+                let Ok(indices) = self.configuration_face_indices(b, &target) else { continue };
+                for index in indices {
+                    out.retain(|(old, _)| *old != index);
+                    out.push((index, look.clone()));
+                }
+                continue;
+            }
             // By name (every piece of a split face), else by the point.
             if let Some(n) = &f.name {
                 let stem = crate::naming::strip_piece(n);
@@ -149,7 +227,9 @@ impl Document {
                     continue;
                 }
             }
-            if let Some(i) = face_index_at(b, p) {
+            if !f.strict_name
+                && let Some(i) = face_index_at(b, p)
+            {
                 out.retain(|(j, _)| *j != i);
                 out.push((i, look));
             }

crates/doc/src/assembly.rs

@@ -144,6 +144,56 @@ fn map_plane_ref(m: &Mat, p: &mut PlaneRef) {
         }
         // Named origin planes and construction planes are the component's own.
         PlaneRef::Origin { .. } | PlaneRef::Construction { .. } => {}
+        PlaneRef::Tangent { face, at } => {
+            *at = apply_point(m, *at);
+            map_geo_ref(m, face);
+        }
+        PlaneRef::Midplane { .. }
+        | PlaneRef::TwoEdges { .. }
+        | PlaneRef::ThreePoints { .. }
+        | PlaneRef::AlongPath { .. }
+        | PlaneRef::Perpendicular { .. } => {
+            for r in p.refs_mut() {
+                map_geo_ref(m, r);
+            }
+        }
+    }
+}
+
+fn map_geo_ref(m: &Mat, g: &mut crate::construct::GeoRef) {
+    g.map_points(&mut |p: &mut Vec3| *p = apply_point(m, *p), &mut |pl: &mut PlaneRef| map_plane_ref(m, pl));
+}
+
+/// Map a point given as expressions by `m`: numbers stay numbers; a coordinate that is an
+/// expression stays one (`m · (x, y, z) + t`, written out), so it still follows its parameters.
+pub fn map_point_expr(m: &Mat, p: &mut crate::PointExpr) {
+    let num = |e: &String| e.trim().parse::<f64>().ok().filter(|v| v.is_finite());
+    if let [Some(x), Some(y), Some(z)] = [num(&p[0]), num(&p[1]), num(&p[2])] {
+        *p = crate::point_expr(apply_point(m, Vec3::new(x, y, z)));
+        return;
+    }
+    let old = p.clone();
+    for (row, out) in p.iter_mut().enumerate() {
+        let mut constant = m[3][row];
+        let mut terms: Vec<String> = Vec::new();
+        for (col, e) in old.iter().enumerate() {
+            let c = m[col][row];
+            if c.abs() < 1e-12 {
+                continue;
+            }
+            match num(e) {
+                Some(v) => constant += c * v,
+                None if (c - 1.0).abs() < 1e-12 => terms.push(format!("({e})")),
+                None => terms.push(format!("{c} * ({e})")),
+            }
+        }
+        let mut e = terms.join(" + ");
+        if terms.is_empty() {
+            e = format!("{constant} mm");
+        } else if constant.abs() >= 1e-12 {
+            e = format!("{e} {} {} mm", if constant < 0.0 { '-' } else { '+' }, constant.abs());
+        }
+        *out = e;
     }
 }
 
@@ -153,27 +203,49 @@ impl FeatureKind {
         let pt = |p: &mut Vec3| *p = apply_point(m, *p);
         let dir = |v: &mut Vec3| *v = apply_vector(m, *v);
         match self {
-            FeatureKind::Sketch { plane, .. }
-            | FeatureKind::ConstructionPlane { plane }
-            | FeatureKind::Split { plane, .. }
-            | FeatureKind::Mirror { plane, .. } => map_plane_ref(m, plane),
+            FeatureKind::Sketch { plane, .. } | FeatureKind::ConstructionPlane { plane } | FeatureKind::Mirror { plane, .. } => {
+                map_plane_ref(m, plane)
+            }
+            FeatureKind::ConstructionAxis { def } => def.refs_mut().into_iter().for_each(|r| map_geo_ref(m, r)),
+            FeatureKind::ConstructionPoint { def } => def.refs_mut().into_iter().for_each(|r| map_geo_ref(m, r)),
+            FeatureKind::Split { plane, tool, .. } => {
+                map_plane_ref(m, plane);
+                if let Some(t) = tool {
+                    pt(&mut t.point);
+                }
+            }
+            FeatureKind::SplitFace { faces, plane, tool, .. } => {
+                faces.iter_mut().for_each(pt);
+                map_plane_ref(m, plane);
+                if let Some(t) = tool {
+                    pt(&mut t.point);
+                }
+            }
             FeatureKind::Revolve { axis: AxisRef::Line { origin, dir: d }, .. } => {
                 pt(origin);
                 dir(d);
             }
-            FeatureKind::Fillet { edges, .. } | FeatureKind::Chamfer { edges, .. } => edges.iter_mut().for_each(pt),
-            FeatureKind::Shell { faces, .. } | FeatureKind::OffsetFace { faces, .. } => faces.iter_mut().for_each(pt),
+            FeatureKind::Fillet { edges, style, .. } => {
+                edges.iter_mut().for_each(pt);
+                if let crate::FilletStyle::Variable { start, .. } = style {
+                    pt(start);
+                }
+            }
+            FeatureKind::Chamfer { edges, .. } => edges.iter_mut().for_each(pt),
+            FeatureKind::Shell { faces, .. } | FeatureKind::OffsetFace { faces, .. } | FeatureKind::DeleteFace { faces, .. } => {
+                faces.iter_mut().for_each(pt)
+            }
             FeatureKind::Draft { faces, neutral, pull, .. } => {
                 faces.iter_mut().for_each(pt);
                 map_plane_ref(m, neutral);
                 dir(pull);
             }
-            FeatureKind::Box { corner, .. } => pt(corner),
+            FeatureKind::Box { corner, .. } => map_point_expr(m, corner),
             FeatureKind::Cylinder { base, axis, .. } => {
-                pt(base);
+                map_point_expr(m, base);
                 dir(axis);
             }
-            FeatureKind::Sphere { center, .. } | FeatureKind::Torus { center, .. } => pt(center),
+            FeatureKind::Sphere { center, .. } | FeatureKind::Torus { center, .. } => map_point_expr(m, center),
             FeatureKind::Pattern { pattern: PatternKind::Rectangular { dir1, dir2, .. }, .. } => {
                 dir(dir1);
                 if let Some(d) = dir2 {
@@ -205,6 +277,7 @@ impl FeatureKind {
                 dir(direction);
             }
             FeatureKind::Lip { face, .. } => pt(face),
+            FeatureKind::BoundaryFill { cells, .. } => cells.iter_mut().for_each(pt),
             FeatureKind::Rest { position, direction, along, .. } => {
                 pt(position);
                 dir(direction);
@@ -219,7 +292,7 @@ impl FeatureKind {
             }
             FeatureKind::SheetBase { .. } | FeatureKind::SheetContour { .. } | FeatureKind::SheetUnfold { .. } => {}
             FeatureKind::Coil { base, axis, .. } => {
-                pt(base);
+                map_point_expr(m, base);
                 dir(axis);
             }
             FeatureKind::ReplaceFace { faces, target, .. } => {
@@ -252,8 +325,19 @@ impl FeatureKind {
             | FeatureKind::Emboss { .. }
             | FeatureKind::Rib { .. }
             | FeatureKind::Remove { .. }
+            | FeatureKind::Stitch { .. }
+            | FeatureKind::Thicken { .. }
             | FeatureKind::Import { .. }
-            | FeatureKind::MeshImport { .. } => {}
+            | FeatureKind::MeshImport { .. }
+            | FeatureKind::BodyTransfer { .. } => {}
+            FeatureKind::Patch { edges, .. } | FeatureKind::SurfaceExtend { edges, .. } => edges.iter_mut().for_each(pt),
+            FeatureKind::SurfaceTrim { plane, tool, keep, .. } => {
+                map_plane_ref(m, plane);
+                if let Some(t) = tool {
+                    pt(&mut t.point);
+                }
+                pt(keep);
+            }
         }
     }
 }
@@ -298,6 +382,80 @@ impl Document {
         out
     }
 
+    /// Every body as the world shows it: its world name ("Body1", or "Body1 (Occ:2)" for a
+    /// further instance), its component, the occurrence path, and the transform from the frame
+    /// its geometry is in to the world.
+    pub fn body_frames(&self, st: &crate::ModelState) -> Vec<(String, u64, Vec<u64>, Mat)> {
+        self.body_frames_with_source(st).into_iter().map(|(world, _, component, path, matrix)| (world, component, path, matrix)).collect()
+    }
+
+    /// Body frames with explicit definition names; callers must not infer them from labels.
+    pub fn body_frames_with_source(&self, st: &crate::ModelState) -> Vec<(String, String, u64, Vec<u64>, Mat)> {
+        let mut out = Vec::new();
+        for (comp, path, m) in self.placements() {
+            for b in st.bodies.iter().filter(|b| self.model_body_component(b) == comp) {
+                let name = self.world_body_name(st, &b.name, comp, &path);
+                let w = match self.model_body_offset(b) {
+                    Some(o) => mat_mul(&m, o),
+                    None => m,
+                };
+                out.push((name, b.definition_name().to_string(), comp, path.clone(), w));
+            }
+        }
+        out
+    }
+
+    /// Computed placement name. Source names retain priority; ambiguous labels use full IDs.
+    /// Resolves label ambiguity with bounded dynamic counts instead of expanding all placements.
+    pub fn world_body_name(&self, st: &crate::ModelState, source: &str, component: u64, path: &[u64]) -> String {
+        if path == self.first_path(component) {
+            return source.to_string();
+        }
+        let names: Vec<&str> = path.iter().filter_map(|id| self.occurrences.iter().find(|o| o.id == *id)).map(|o| o.name.as_str()).collect();
+        let label = names.join("/");
+        let candidate = format!("{source} ({label})");
+        let mut counts = std::collections::BTreeMap::from([(0, 1usize)]);
+        for name in &names {
+            let mut next = std::collections::BTreeMap::<u64, usize>::new();
+            for o in self.occurrences.iter().filter(|o| o.name == *name) {
+                if let Some(count) = counts.get(&o.parent) {
+                    let n = next.entry(o.component).or_default();
+                    *n = (*n + count).min(2);
+                }
+            }
+            counts = next;
+        }
+        let ambiguous = counts.get(&component).copied().unwrap_or(0) > 1;
+        // Slash and reserved-marker names could alias concatenated labels or fallback keys.
+        let reserved =
+            self.occurrences.iter().any(|o| o.name.contains('/') || o.name.contains("@occ[")) || st.bodies.iter().any(|b| b.name.contains("@occ["));
+        if !ambiguous && !reserved && st.body(&candidate).is_none() {
+            return candidate;
+        }
+        let ids = path.iter().map(u64::to_string).collect::<Vec<_>>().join("/");
+        let encoded = serde_json::to_string(source).unwrap_or_else(|_| source.to_string());
+        let mut key = format!("{encoded}@occ[{ids}]");
+        while st.body(&key).is_some() {
+            key.push('#');
+        }
+        key
+    }
+
+    /// The occurrence path of a component's first placement.
+    pub fn first_path(&self, component: u64) -> Vec<u64> {
+        let mut path = Vec::new();
+        let mut c = component;
+        for _ in 0..1000 {
+            if c == 0 {
+                break;
+            }
+            let Some(o) = self.occurrence_of(c) else { break };
+            path.insert(0, o.id);
+            c = o.parent;
+        }
+        path
+    }
+
     /// Is `a` inside `b` (or `b` itself)?
     pub fn component_within(&self, a: u64, b: u64) -> bool {
         let mut c = a;

crates/doc/src/body_transfer.rs

@@ -0,0 +1,80 @@
+//! Recorded ownership changes are evaluated at their timeline position.
+use crate::{DocError, Document, Mat, ModelBody, ModelState, Result};
+use solvecraft_geom::Vec3;
+use std::collections::BTreeSet;
+
+pub fn valid_transfer_matrix(m: &Mat) -> bool {
+    let axis = |i: usize| Vec3::new(m[i][0], m[i][1], m[i][2]);
+    let (x, y, z) = (axis(0), axis(1), axis(2));
+    m.iter().flatten().all(|v| v.is_finite())
+        && m[3][..3].iter().all(|v| v.abs() <= 1e9)
+        && [x, y, z].iter().all(|v| (v.dot(*v) - 1.0).abs() < 1e-6)
+        && x.dot(y).abs() < 1e-6
+        && x.dot(z).abs() < 1e-6
+        && y.dot(z).abs() < 1e-6
+        && x.cross(y).dot(z) > 0.0
+        && [m[0][3], m[1][3], m[2][3]].iter().all(|v| v.abs() < 1e-9)
+        && (m[3][3] - 1.0).abs() < 1e-9
+}
+
+/// Validate the stored boundary before allocation, loading, or evaluation.
+pub fn validate_body_transfer(doc: &Document, bodies: &[String], from: u64, to: u64, transform: &Mat) -> Result<()> {
+    if bodies.is_empty()
+        || bodies.len() > 1000
+        || bodies.iter().any(|name| name.trim().is_empty() || name.len() > 512 || name.chars().any(char::is_control))
+        || bodies.iter().collect::<BTreeSet<_>>().len() != bodies.len()
+        || !valid_transfer_matrix(transform)
+        || [from, to].iter().any(|id| *id != 0 && !doc.components.iter().any(|c| c.id == *id))
+    {
+        return Err(DocError::Invalid("invalid body transfer boundary".into()));
+    }
+    Ok(())
+}
+
+pub(crate) fn evaluate(doc: &Document, st: &mut ModelState, bodies: &[String], from: u64, to: u64, transform: Mat) -> Result<()> {
+    validate_body_transfer(doc, bodies, from, to, &transform)?;
+    let mut next = st.clone();
+    for name in bodies {
+        let old = st.body(name).ok_or_else(|| DocError::Unknown(format!("transferred body `{name}`")))?;
+        if doc.model_body_component(old) != from {
+            return Err(DocError::Invalid(format!("body `{name}` no longer belongs to transfer source component {from}")));
+        }
+        let shape = if crate::is_identity(&transform) { old.body.clone() } else { solvecraft_kernel::transform_matrix(&old.body, transform)? };
+        let mut body = ModelBody::new(old.name.clone(), shape, old.feature);
+        body.component = to;
+        body.transferred = true;
+        body.source_name = old.source_name.clone();
+        body.source_transform = crate::mat_mul(&transform, &old.source_transform);
+        body.imported = old.imported.clone();
+        body.names = crate::naming::NameCell::known(crate::naming::face_names(old));
+        let slot = next.bodies.iter_mut().find(|b| b.name == *name).ok_or_else(|| DocError::Unknown(format!("transferred body `{name}`")))?;
+        *slot = body;
+    }
+    crate::body_transfer_sheet::remap_sheet_metadata(&mut next, bodies, &transform)?;
+    *st = next;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn invalid_transfer_constructor_preserves_document_and_allocator() {
+        let mut doc = Document::default();
+        let before = doc.to_json();
+        let mut scaled = crate::IDENTITY;
+        scaled[0][0] = 2.0;
+        for (bodies, from, transform) in [
+            (vec!["Block".into()], 42, crate::IDENTITY),
+            (vec!["Block".into(), "Block".into()], 0, crate::IDENTITY),
+            (vec![String::new()], 0, crate::IDENTITY),
+            (vec!["   ".into()], 0, crate::IDENTITY),
+            (vec!["bad\nname".into()], 0, crate::IDENTITY),
+            (vec!["Block".into()], 0, scaled),
+        ] {
+            assert!(doc.add_feature(crate::FeatureKind::BodyTransfer { bodies, from, to: 0, transform }, None).is_err());
+            assert_eq!(doc.to_json(), before);
+        }
+    }
+}

crates/doc/src/body_transfer_sheet.rs

@@ -0,0 +1,54 @@
+//! World-frame metadata at a timeline body ownership boundary.
+use solvecraft_geom::Plane;
+
+use crate::{DocError, Mat, ModelState, Result, apply_point, apply_vector};
+
+pub(crate) fn remap_sheet_metadata(st: &mut ModelState, names: &[String], transform: &Mat) -> Result<()> {
+    if names.len() > 1000 || st.sheets.len().saturating_add(st.threads.len()) > 100_000 || !transform.iter().flatten().all(|v| v.is_finite()) {
+        return Err(DocError::Invalid("body transfer metadata exceeds its finite processing budget".into()));
+    }
+    let names: std::collections::BTreeSet<&str> = names.iter().map(String::as_str).collect();
+    if !st.sheets.iter().any(|s| names.contains(s.body.as_str())) && !st.threads.iter().any(|t| names.contains(t.body.as_str())) {
+        return Ok(());
+    }
+    if !crate::valid_transfer_matrix(transform) {
+        return Err(DocError::Invalid("sheet and thread transfer requires a rigid placement".into()));
+    }
+    let frames: Vec<_> = st
+        .sheets
+        .iter()
+        .enumerate()
+        .filter(|(_, s)| names.contains(s.body.as_str()))
+        .map(|(i, s)| {
+            let frame = Plane::new(apply_point(transform, s.frame.origin), apply_vector(transform, s.frame.x), apply_vector(transform, s.frame.y))
+                .ok_or_else(|| DocError::Invalid("invalid transferred sheet frame".into()))?;
+            Ok((i, frame))
+        })
+        .collect::<Result<_>>()?;
+    let threads: Vec<_> = st
+        .threads
+        .iter()
+        .enumerate()
+        .filter(|(_, t)| names.contains(t.body.as_str()))
+        .map(|(i, t)| {
+            let point = apply_point(transform, t.axis_point);
+            let axis = apply_vector(transform, t.axis).normalized().ok_or_else(|| DocError::Invalid("invalid transferred thread axis".into()))?;
+            if !point.is_finite() {
+                return Err(DocError::Invalid("invalid transferred thread placement".into()));
+            }
+            Ok((i, point, axis))
+        })
+        .collect::<Result<_>>()?;
+    for (i, frame) in frames {
+        if let Some(s) = st.sheets.get_mut(i) {
+            s.frame = frame;
+        }
+    }
+    for (i, point, axis) in threads {
+        if let Some(t) = st.threads.get_mut(i) {
+            t.axis_point = point;
+            t.axis = axis;
+        }
+    }
+    Ok(())
+}

crates/doc/src/canvas.rs

@@ -34,6 +34,14 @@ pub struct Canvas {
     pub flip: bool,
     #[serde(default = "yes")]
     pub visible: bool,
+    /// The component it belongs to (its plane is in that component's frame, so it moves with
+    /// the component's occurrence); 0 = the root.
+    #[serde(default, skip_serializing_if = "is_root")]
+    pub component: u64,
+}
+
+fn is_root(c: &u64) -> bool {
+    *c == 0
 }
 
 fn half() -> f64 {
@@ -57,7 +65,7 @@ impl Canvas {
         let f = if self.flip { -1.0 } else { 1.0 };
         [rot(-hw * f, -hh), rot(hw * f, -hh), rot(hw * f, hh), rot(-hw * f, hh)]
     }
-    /// Corners in world coordinates.
+    /// Corners on `plane` (in whatever frame the plane is given).
     pub fn world_corners(&self, plane: &Plane) -> [Vec3; 4] {
         self.corners().map(|p| plane.to_world(p))
     }
@@ -66,6 +74,19 @@ impl Canvas {
     }
 }
 
+impl crate::Document {
+    /// A canvas's plane in the world: resolved in its component's frame, then placed where the
+    /// component's occurrence puts it.
+    pub fn canvas_plane(&self, vals: &std::collections::BTreeMap<String, crate::expr::Value>, c: &Canvas) -> crate::Result<Plane> {
+        let p = self.resolve_plane(vals, &c.plane, 0)?;
+        let m = self.component_transform(c.component);
+        if crate::is_identity(&m) {
+            return Ok(p);
+        }
+        Ok(Plane::new(crate::apply_point(&m, p.origin), crate::apply_vector(&m, p.x), crate::apply_vector(&m, p.y)).unwrap_or(p))
+    }
+}
+
 /// Image kind and pixel size from the file header (PNG or JPEG).
 pub fn image_info(b: &[u8]) -> Option<(&'static str, [u32; 2])> {
     if b.len() > 24 && b.starts_with(b"\x89PNG\r\n\x1a\n") {

crates/doc/src/clipboard.rs

@@ -40,10 +40,19 @@ impl FeatureKind {
             FeatureKind::Sketch { plane, .. } | FeatureKind::ConstructionPlane { plane } | FeatureKind::Split { plane, .. } => {
                 plane_names(plane, names)
             }
+            FeatureKind::SplitFace { plane, sketch, .. } => {
+                plane_names(plane, names);
+                if let Some(s) = sketch {
+                    sk(s);
+                }
+            }
             FeatureKind::Extrude { sketch, .. }
             | FeatureKind::Revolve { sketch, .. }
             | FeatureKind::Emboss { sketch, .. }
+            | FeatureKind::SheetBase { sketch, .. }
+            | FeatureKind::SheetContour { sketch, .. }
             | FeatureKind::Rib { sketch, .. } => sk(sketch),
+            FeatureKind::Patch { sketch: Some(s), .. } => sk(s),
             FeatureKind::Sweep { sketch, path_sketch, .. } => {
                 sk(sketch);
                 sk(path_sketch);
@@ -68,3 +77,387 @@ impl FeatureKind {
         }
     }
 }
+
+/// Remap persistent topology tokens without rewriting arbitrary user expressions or labels.
+pub fn remap_topology(name: &str, ids: &BTreeMap<u64, u64>, bodies: &BTreeMap<String, String>) -> String {
+    // Imported names belong to the complete canonical body prefix, even when that prefix
+    // happens to contain text resembling a feature token.
+    if let Some((body, suffix)) = name.rsplit_once(":face:")
+        && let Some(new) = bodies.get(body)
+    {
+        return format!("{new}:face:{suffix}");
+    }
+    let mut out = String::new();
+    let mut at = 0;
+    while at < name.len() {
+        let rest = &name[at..];
+        if rest.starts_with('F') && (at == 0 || matches!(name.as_bytes().get(at - 1), Some(b'@') | Some(b':') | Some(b'|'))) {
+            let end = rest.as_bytes().iter().skip(1).take_while(|b| b.is_ascii_digit()).count() + 1;
+            if end > 1
+                && matches!(rest.as_bytes().get(end), Some(b':') | Some(b'.'))
+                && let Ok(id) = rest[1..end].parse::<u64>()
+                && let Some(new) = ids.get(&id)
+            {
+                out.push_str(&format!("F{new}"));
+                at += end;
+                continue;
+            }
+        }
+        let Some(ch) = rest.chars().next() else { break };
+        out.push(ch);
+        at += ch.len_utf8();
+    }
+    // Import faces have a canonical body prefix rather than a feature token.
+    if let Some((body, suffix)) = out.rsplit_once(":face:")
+        && let Some(new) = bodies.get(body)
+    {
+        return format!("{new}:face:{suffix}");
+    }
+    out
+}
+
+fn mapped_name(n: &mut String, names: &BTreeMap<String, String>) {
+    if let Some(new) = names.get(n) {
+        *n = new.clone();
+    }
+}
+
+/// Simultaneous generated-parameter substitution: map values may themselves be old keys.
+pub fn clone_expression(source: &str, parameters: &BTreeMap<String, String>) -> String {
+    let mut result = source.to_string();
+    let mut temporary = Vec::new();
+    for (index, (old, new)) in parameters.iter().enumerate() {
+        let mut token = format!("__clone_reference_{index}");
+        while source.contains(&token) || parameters.values().any(|n| n == &token) {
+            token.push('_');
+        }
+        result = crate::expr::rename_reference(&result, old, &token);
+        temporary.push((token, new));
+    }
+    for (token, new) in temporary {
+        result = crate::expr::rename_reference(&result, &token, new);
+    }
+    result
+}
+
+fn remap_geo(
+    g: &mut crate::construct::GeoRef,
+    ids: &BTreeMap<u64, u64>,
+    names: &BTreeMap<String, String>,
+    bodies: &BTreeMap<String, String>,
+    depth: usize,
+) -> crate::Result<()> {
+    use crate::construct::GeoRef;
+    if depth > 64 {
+        return Err(crate::DocError::Invalid("clone plane reference depth exceeded".into()));
+    }
+    match g {
+        GeoRef::SketchPoint { sketch, .. } | GeoRef::SketchCurve { sketch, .. } => {
+            if let Some(new) = ids.get(sketch) {
+                *sketch = *new;
+            }
+        }
+        GeoRef::Face { name: Some(n), .. } | GeoRef::Edge { name: Some(n), .. } => *n = remap_topology(n, ids, bodies),
+        GeoRef::ConstructPoint { name } | GeoRef::Axis { name } => mapped_name(name, names),
+        GeoRef::Plane { plane } => remap_plane(plane, ids, names, bodies, depth + 1)?,
+        _ => {}
+    }
+    Ok(())
+}
+
+fn remap_plane(
+    p: &mut PlaneRef,
+    ids: &BTreeMap<u64, u64>,
+    names: &BTreeMap<String, String>,
+    bodies: &BTreeMap<String, String>,
+    depth: usize,
+) -> crate::Result<()> {
+    if depth > 64 {
+        return Err(crate::DocError::Invalid("clone plane reference depth exceeded".into()));
+    }
+    match p {
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => remap_plane(base, ids, names, bodies, depth + 1)?,
+        PlaneRef::Construction { name } => mapped_name(name, names),
+        PlaneRef::Face { name, anchor, .. } => {
+            if let Some(name) = name {
+                *name = remap_topology(name, ids, bodies);
+            }
+            if let Some(anchor) = anchor {
+                anchor.remap_target(ids, bodies)?;
+            }
+        }
+        _ => {
+            for r in p.refs_mut() {
+                remap_geo(r, ids, names, bodies, depth + 1)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+fn remap_link(
+    source: &mut solvecraft_sketch::LinkSource,
+    ids: &BTreeMap<u64, u64>,
+    names: &BTreeMap<String, String>,
+    bodies: &BTreeMap<String, String>,
+    depth: usize,
+) {
+    use solvecraft_sketch::LinkSource;
+    if depth > 64 {
+        return;
+    }
+    match source {
+        LinkSource::Edge { body, .. }
+        | LinkSource::Face { body, .. }
+        | LinkSource::Body { body }
+        | LinkSource::Vertex { body, .. }
+        | LinkSource::Iso { body, .. }
+        | LinkSource::Spun { body, .. } => mapped_name(body, bodies),
+        LinkSource::SketchCurve { sketch, .. } | LinkSource::SketchPoint { sketch, .. } => {
+            if let Some(new) = ids.get(sketch) {
+                *sketch = *new;
+            }
+        }
+        LinkSource::OnSurface { sketch, body, .. } => {
+            if let Some(new) = ids.get(sketch) {
+                *sketch = *new;
+            }
+            mapped_name(body, bodies);
+        }
+        LinkSource::Intersection { a, b } => {
+            remap_link(a, ids, names, bodies, depth + 1);
+            remap_link(b, ids, names, bodies, depth + 1);
+        }
+        LinkSource::Plane { name } => mapped_name(name, names),
+        _ => {}
+    }
+}
+
+impl crate::Feature {
+    /// Clone identities through typed reference fields. Sketch-local entity IDs stay local.
+    pub fn remap_clone(
+        &mut self,
+        ids: &BTreeMap<u64, u64>,
+        names: &BTreeMap<String, String>,
+        bodies: &BTreeMap<String, String>,
+        parameters: &BTreeMap<String, String>,
+    ) -> crate::Result<()> {
+        use FeatureKind as K;
+        match &self.kind {
+            K::Sketch { plane, sketch } => {
+                checked_plane(plane, 0)?;
+                for link in &sketch.links {
+                    checked_link(&link.source, 0)?;
+                }
+            }
+            K::ConstructionPlane { plane }
+            | K::Split { plane, .. }
+            | K::SplitFace { plane, .. }
+            | K::Mirror { plane, .. }
+            | K::SurfaceTrim { plane, .. } => checked_plane(plane, 0)?,
+            K::Draft { neutral, .. } => checked_plane(neutral, 0)?,
+            K::ReplaceFace { target, .. } => checked_plane(target, 0)?,
+            K::ConstructionAxis { def } => {
+                for r in def.refs() {
+                    checked_geo(r, 0)?;
+                }
+            }
+            K::ConstructionPoint { def } => {
+                for r in def.refs() {
+                    checked_geo(r, 0)?;
+                }
+            }
+            _ => {}
+        }
+        self.kind.remap_refs(ids, names);
+        for n in &mut self.body_names {
+            mapped_name(n, bodies);
+        }
+        for n in &mut self.participants {
+            mapped_name(n, bodies);
+        }
+        for n in &mut self.param_names {
+            mapped_name(n, parameters);
+        }
+        for n in self.face_names.iter_mut().chain(&mut self.edge_names) {
+            *n = remap_topology(n, ids, bodies);
+        }
+        for (_, e, _) in self.kind.inputs_mut() {
+            *e = clone_expression(e, parameters);
+        }
+        for e in self.kind.point_expr_mut().into_iter().flatten() {
+            *e = clone_expression(e, parameters);
+        }
+        match &mut self.kind {
+            K::Emboss { face: Some(face), .. } => mapped_name(&mut face.body, bodies),
+            K::Split { tool: Some(tool), .. } | K::SplitFace { tool: Some(tool), .. } | K::SurfaceTrim { tool: Some(tool), .. } => {
+                mapped_name(&mut tool.body, bodies)
+            }
+            _ => {}
+        }
+        match &mut self.kind {
+            K::Extrude { targets, .. }
+            | K::Revolve { targets, .. }
+            | K::Loft { targets, .. }
+            | K::Sweep { targets, .. }
+            | K::Pipe { targets, .. }
+            | K::Emboss { targets, .. } => {
+                for n in targets {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::Combine { target, tools, .. } => {
+                mapped_name(target, bodies);
+                for n in tools {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::Pattern { bodies: list, .. }
+            | K::Mirror { bodies: list, .. }
+            | K::Scale { bodies: list, .. }
+            | K::BoundingSolid { bodies: list, .. }
+            | K::Align { bodies: list, .. }
+            | K::Remove { bodies: list }
+            | K::Stitch { bodies: list, .. }
+            | K::Move { bodies: list, .. }
+            | K::BodyTransfer { bodies: list, .. } => {
+                for n in list {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::Thicken { bodies: list, targets, .. } => {
+                for n in list.iter_mut().chain(targets) {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::BoundaryFill { tools, .. } => {
+                for n in tools {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::Fillet { body, .. }
+            | K::Chamfer { body, .. }
+            | K::Shell { body, .. }
+            | K::Draft { body, .. }
+            | K::SplitFace { body, .. }
+            | K::OffsetFace { body, .. }
+            | K::DeleteFace { body, .. }
+            | K::ReplaceFace { body, .. }
+            | K::SheetFlange { body, .. }
+            | K::SheetHem { body, .. }
+            | K::SheetFold { body, .. }
+            | K::SheetUnfold { body, .. }
+            | K::Boss { body, .. }
+            | K::Lip { body, .. }
+            | K::SnapFit { body, .. }
+            | K::Rest { body, .. }
+            | K::Patch { body, .. } => {
+                if let Some(n) = body {
+                    mapped_name(n, bodies);
+                }
+            }
+            K::Split { body, .. } | K::SheetConvert { body, .. } | K::SurfaceExtend { body, .. } | K::SurfaceTrim { body, .. } => {
+                mapped_name(body, bodies)
+            }
+            _ => {}
+        }
+        match &mut self.kind {
+            K::Sketch { plane, sketch } => {
+                remap_plane(plane, ids, names, bodies, 0)?;
+                for c in &mut sketch.constraints {
+                    if let Some(n) = &mut c.param {
+                        mapped_name(n, parameters);
+                    }
+                }
+                for link in &mut sketch.links {
+                    remap_link(&mut link.source, ids, names, bodies, 0);
+                    if let Some(n) = &mut link.face_name {
+                        *n = remap_topology(n, ids, bodies);
+                    }
+                }
+            }
+            K::ConstructionPlane { plane }
+            | K::Split { plane, .. }
+            | K::SplitFace { plane, .. }
+            | K::Mirror { plane, .. }
+            | K::SurfaceTrim { plane, .. } => remap_plane(plane, ids, names, bodies, 0)?,
+            K::Draft { neutral, .. } => remap_plane(neutral, ids, names, bodies, 0)?,
+            K::ReplaceFace { target, .. } => remap_plane(target, ids, names, bodies, 0)?,
+            K::ConstructionAxis { def } => {
+                for r in def.refs_mut() {
+                    remap_geo(r, ids, names, bodies, 0)?;
+                }
+            }
+            K::ConstructionPoint { def } => {
+                for r in def.refs_mut() {
+                    remap_geo(r, ids, names, bodies, 0)?;
+                }
+            }
+            _ => {}
+        }
+        Ok(())
+    }
+}
+
+fn checked_geo(g: &crate::construct::GeoRef, depth: usize) -> crate::Result<()> {
+    if depth > 64 {
+        return Err(crate::DocError::Invalid("copy reference nesting exceeds 64".into()));
+    }
+    if let crate::construct::GeoRef::Plane { plane } = g {
+        checked_plane(plane, depth + 1)?;
+    }
+    Ok(())
+}
+fn checked_plane(p: &PlaneRef, depth: usize) -> crate::Result<()> {
+    if depth > 64 {
+        return Err(crate::DocError::Invalid("copy reference nesting exceeds 64".into()));
+    }
+    match p {
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => checked_plane(base, depth + 1)?,
+        PlaneRef::Midplane { a, b } | PlaneRef::TwoEdges { a, b } => {
+            checked_geo(a, depth + 1)?;
+            checked_geo(b, depth + 1)?;
+        }
+        PlaneRef::Perpendicular { plane, line } => {
+            checked_geo(plane, depth + 1)?;
+            checked_geo(line, depth + 1)?;
+        }
+        PlaneRef::ThreePoints { a, b, c } => {
+            checked_geo(a, depth + 1)?;
+            checked_geo(b, depth + 1)?;
+            checked_geo(c, depth + 1)?;
+        }
+        PlaneRef::Tangent { face, .. } => checked_geo(face, depth + 1)?,
+        PlaneRef::AlongPath { path, .. } => checked_geo(path, depth + 1)?,
+        _ => {}
+    }
+    Ok(())
+}
+fn checked_link(source: &solvecraft_sketch::LinkSource, depth: usize) -> crate::Result<()> {
+    if depth > 64 {
+        return Err(crate::DocError::Invalid("copy link nesting exceeds 64".into()));
+    }
+    if let solvecraft_sketch::LinkSource::Intersection { a, b } = source {
+        checked_link(a, depth + 1)?;
+        checked_link(b, depth + 1)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod clone_tests {
+    use super::*;
+    #[test]
+    fn imported_names_and_topology_tokens_have_separate_identity() {
+        let ids = BTreeMap::from([(1, 2), (10, 20)]);
+        let bodies = BTreeMap::from([("F1:Housing".into(), "F1:Housing (copy)".into())]);
+        assert_eq!(remap_topology("F1:Housing:face:0", &ids, &bodies), "F1:Housing (copy):face:0");
+        assert_eq!(remap_topology("F1:+x|F10:end@F1.2", &ids, &bodies), "F2:+x|F20:end@F2.2");
+        assert_eq!(remap_topology("UserF1:label", &ids, &bodies), "UserF1:label");
+    }
+    #[test]
+    fn parameter_remap_is_simultaneous_and_token_scoped() {
+        let map = BTreeMap::from([("d1".into(), "d2".into()), ("d2".into(), "d3".into())]);
+        assert_eq!(clone_expression("d1 + d2 + d10 + 2 mm", &map), "d2 + d3 + d10 + 2 mm");
+    }
+}

crates/doc/src/config.rs

@@ -1,11 +1,24 @@
 //! Configurations: a table whose rows are variants of the design. Each column is a parameter
-//! (its expression per row) or a feature (suppressed or not per row); activating a row sets
-//! those values in the design, which then rebuilds as usual.
+//! expression, feature suppression, body material or body appearance. Activating a row sets
+//! those values in the design atomically, which then rebuilds as usual.
 
 use serde::{Deserialize, Serialize};
 
 use crate::{DocError, Document, Result};
 
+#[path = "config_rules.rs"]
+mod rules;
+pub use rules::*;
+#[path = "config_styles.rs"]
+mod styles;
+pub use styles::*;
+#[path = "config_certificates.rs"]
+mod certificates;
+pub use certificates::*;
+#[path = "config_clone.rs"]
+mod clone;
+pub use clone::*;
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum Column {
@@ -13,12 +26,20 @@ pub enum Column {
     Param(String),
     /// A feature's suppression (by feature id).
     Suppress(u64),
+    /// A body's physical material (library name, or Default to clear).
+    Material(String),
+    /// A body's appearance (library name, serialized Look, or empty to clear).
+    Appearance(String),
+    /// Shared component definition's direct appearance.
+    ComponentAppearance(u64),
+    /// A certified semantic face lineage in a shared definition.
+    FaceAppearance(ConfigFaceTarget),
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct ConfigRow {
     pub name: String,
-    /// One cell per column: an expression, or "true"/"false" for suppression.
+    /// One cell per column: expression, suppression, material name or appearance look.
     pub cells: Vec<String>,
 }
 
@@ -28,67 +49,235 @@ pub struct ConfigTable {
     pub rows: Vec<ConfigRow>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub active: Option<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub rules: Vec<ConfigRule>,
 }
 
 pub const MAX_COLUMNS: usize = 500;
 pub const MAX_ROWS: usize = 2000;
 
-impl ConfigTable {
-    pub fn is_empty(&self) -> bool {
-        self.columns.is_empty() && self.rows.is_empty()
+pub fn suppression_cell(value: &str) -> Result<bool> {
+    match value.trim().to_ascii_lowercase().as_str() {
+        "true" | "1" | "yes" => Ok(true),
+        "false" | "0" | "no" => Ok(false),
+        _ => Err(DocError::Invalid("suppression must be true or false".into())),
     }
 }
 
+impl ConfigTable {
+    pub fn is_empty(&self) -> bool {
+        self.columns.is_empty() && self.rows.is_empty() && self.rules.is_empty()
+    }
+}
+
+/// Parse an appearance cell. Empty/Default follows the body's material; named library looks
+/// and JSON Look objects support both convenient editing and lossless custom colours.
+pub fn appearance_cell(value: &str) -> Result<Option<crate::appearance::Look>> {
+    let value = value.trim();
+    if value.is_empty() || value.eq_ignore_ascii_case("default") {
+        return Ok(None);
+    }
+    if value.len() > 4096 {
+        return Err(DocError::Invalid("appearance value too long".into()));
+    }
+    if let Some(look) = crate::appearance::library(value) {
+        return Ok(Some(look));
+    }
+    let look: crate::appearance::Look =
+        serde_json::from_str(value).map_err(|_| DocError::Invalid(format!("unknown configuration appearance `{value}`")))?;
+    if look.name.chars().count() > 128 || !look.opacity.is_finite() || !(0.0..=1.0).contains(&look.opacity) {
+        return Err(DocError::Invalid("appearance requires a name up to 128 characters and opacity in 0..1".into()));
+    }
+    Ok(Some(look))
+}
+
+/// Parse a physical material cell, returning None for the default material.
+pub fn material_cell(value: &str) -> Result<Option<String>> {
+    let name = crate::MATERIALS
+        .iter()
+        .find(|(n, _)| n.eq_ignore_ascii_case(value.trim()))
+        .map(|(n, _)| *n)
+        .ok_or_else(|| DocError::Invalid(format!("unknown configuration material `{value}`")))?;
+    Ok((name != "Default").then(|| name.to_string()))
+}
+
 impl Document {
-    /// A column's current value in the design.
-    pub fn config_current(&self, c: &Column) -> Option<String> {
-        match c {
-            Column::Param(n) => self.all_param_exprs().into_iter().find(|(m, _, _)| m == n).map(|(_, e, _)| e),
-            Column::Suppress(id) => self.feature(*id).map(|f| f.suppressed.to_string()),
+    /// Freeze design-unit-sensitive configuration literals when changing display units.
+    /// Explicit units and nonliteral expressions retain their source text.
+    pub fn preserve_configuration_units(&mut self, previous_unit: &str, kept_parameters: &[String]) {
+        let feature_lengths: Vec<String> = self
+            .features
+            .iter()
+            .flat_map(|feature| {
+                feature
+                    .param_names
+                    .iter()
+                    .zip(feature.kind.inputs())
+                    .filter(|(_, (_, _, kind))| *kind == crate::expr::Kind::Length)
+                    .map(|(name, _)| name.clone())
+            })
+            .collect();
+        let lengths: std::collections::BTreeSet<String> = feature_lengths.into_iter().chain(kept_parameters.iter().cloned()).collect();
+        for row in &mut self.configs.rows {
+            for (column, cell) in self.configs.columns.iter().zip(&mut row.cells) {
+                if matches!(column,Column::Param(name) if lengths.contains(name)) && cell.trim().parse::<f64>().is_ok() {
+                    *cell = format!("{} {previous_unit}", cell.trim());
+                }
+            }
+        }
+        for rule in &mut self.configs.rules {
+            rule.preserve_length_units(&lengths, previous_unit);
         }
     }
 
-    /// A column's display key: `param:<name>` or `suppress:<feature name>`.
+    /// A column's current value in the design.
+    pub fn config_current(&self, c: &Column) -> Option<String> {
+        match c {
+            Column::Param(n) => self.all_param_exprs().into_iter().find(|(m, _, _)| m == n).map(|(_, e, kind)| {
+                // Feature literals are stored in base units, unlike newly typed bare
+                // row cells. Capture their unit explicitly before editing in an inch design.
+                if self.param(n).is_none() && kind == crate::expr::Kind::Length && self.units != "mm" && e.trim().parse::<f64>().is_ok() {
+                    format!("{} mm", e.trim())
+                } else {
+                    e
+                }
+            }),
+            Column::Suppress(id) => self.feature(*id).map(|f| f.suppressed.to_string()),
+            Column::Material(body) => Some(self.materials.get(body).cloned().unwrap_or_else(|| "Default".into())),
+            Column::Appearance(body) => Some(self.appearances.bodies.get(body).and_then(|look| serde_json::to_string(look).ok()).unwrap_or_default()),
+            Column::ComponentAppearance(id) => {
+                Some(self.appearances.components.get(id).and_then(|look| serde_json::to_string(look).ok()).unwrap_or_default())
+            }
+            Column::FaceAppearance(target) => {
+                Some(self.config_face_look(target).and_then(|look| serde_json::to_string(&look).ok()).unwrap_or_default())
+            }
+        }
+    }
+
+    /// A column's display key, prefixed by its kind to distinguish targets with equal names.
     pub fn config_key(&self, c: &Column) -> String {
         match c {
             Column::Param(n) => format!("param:{n}"),
             Column::Suppress(id) => format!("suppress:{}", self.feature(*id).map(|f| f.name.clone()).unwrap_or_else(|| id.to_string())),
+            Column::Material(body) => format!("material:{body}"),
+            Column::Appearance(body) => format!("appearance:{body}"),
+            Column::ComponentAppearance(id) => format!("component_appearance:{id}"),
+            Column::FaceAppearance(target) => format!("face_appearance:{}", target.key()),
         }
     }
 
     /// Set the design to a row's values (all or nothing).
     pub fn apply_configuration(&mut self, row: &str) -> Result<()> {
+        self.apply_configuration_with_trace(row).map(|_| ())
+    }
+
+    pub fn apply_configuration_with_trace(&mut self, row: &str) -> Result<Vec<RuleTrace>> {
         let r = self.configs.rows.iter().find(|r| r.name == row).cloned().ok_or_else(|| DocError::Unknown(format!("configuration `{row}`")))?;
+        if self.configs.columns.len() > MAX_COLUMNS || self.configs.rows.len() > MAX_ROWS || r.cells.len() != self.configs.columns.len() {
+            return Err(DocError::Invalid("configuration table exceeds limits or has incomplete rows".into()));
+        }
         let mut next = self.clone();
+        let changes: Vec<(String, String)> = self
+            .configs
+            .columns
+            .iter()
+            .zip(&r.cells)
+            .filter_map(|(c, v)| match c {
+                Column::Param(name) => Some((name.clone(), v.clone())),
+                _ => None,
+            })
+            .collect();
+        next.change_params_atomic(&changes).map_err(|e| DocError::Invalid(format!("configuration `{row}`: {e}")))?;
         for (c, v) in self.configs.columns.iter().zip(&r.cells) {
+            if v.len() > 4096 {
+                return Err(DocError::Invalid("configuration value too long".into()));
+            }
             match c {
-                Column::Param(n) => {
-                    if next.config_current(c).as_deref() != Some(v.as_str()) {
-                        next.change_param(n, v, None, None).map_err(|e| DocError::Invalid(format!("configuration `{row}`, parameter `{n}`: {e}")))?;
-                    }
-                }
+                Column::Param(_) => {}
                 Column::Suppress(id) => {
-                    let on = match v.trim() {
-                        "true" | "1" | "yes" => true,
-                        "false" | "0" | "no" => false,
-                        o => return Err(DocError::Invalid(format!("configuration `{row}`: suppression must be true or false, not `{o}`"))),
-                    };
+                    let on = suppression_cell(v)?;
                     let f = next.feature_mut(*id).ok_or_else(|| DocError::Unknown(format!("configuration `{row}`: feature {id} is gone")))?;
                     f.suppressed = on;
                 }
+                Column::Material(body) => match material_cell(v)? {
+                    Some(material) => {
+                        next.materials.insert(body.clone(), material);
+                    }
+                    None => {
+                        next.materials.remove(body);
+                    }
+                },
+                Column::Appearance(body) => match appearance_cell(v)? {
+                    Some(look) => {
+                        next.appearances.bodies.insert(body.clone(), look);
+                    }
+                    None => {
+                        next.appearances.bodies.remove(body);
+                    }
+                },
+                Column::ComponentAppearance(id) => {
+                    if *id == 0 || !next.components.iter().any(|component| component.id == *id) {
+                        return Err(DocError::Unknown(format!("component {id} is gone")));
+                    }
+                    match appearance_cell(v)? {
+                        Some(look) => {
+                            next.appearances.components.insert(*id, look);
+                        }
+                        None => {
+                            next.appearances.components.remove(id);
+                        }
+                    }
+                }
+                Column::FaceAppearance(target) => {
+                    next.certify_config_face(target)?;
+                    next.appearances.faces.retain(|face| !target.matches(face));
+                    if let Some(look) = appearance_cell(v)? {
+                        next.appearances.faces.push(crate::appearance::FaceLook {
+                            body: target.body.clone(),
+                            point: target.point,
+                            look,
+                            name: Some(target.name.clone()),
+                            strict_name: true,
+                            certificate: target.certificate.clone(),
+                        });
+                    }
+                }
             }
         }
         next.configs.active = Some(row.to_string());
+        let trace = next.evaluate_configuration_rules()?;
         *self = next;
-        Ok(())
+        Ok(trace)
     }
 
     /// The active row's values all hold in the design.
     pub fn configuration_matches(&self) -> bool {
         let Some(r) = self.configs.active.as_ref().and_then(|a| self.configs.rows.iter().find(|r| r.name == *a)) else { return false };
+        if r.cells.len() != self.configs.columns.len() {
+            return false;
+        }
+        if !self.configs.rules.is_empty() {
+            let mut expected = self.clone();
+            if expected.apply_configuration(&r.name).is_err() {
+                return false;
+            }
+            return self.configs.columns.iter().all(|column| self.config_current(column) == expected.config_current(column));
+        }
         self.configs.columns.iter().zip(&r.cells).all(|(c, v)| match c {
-            Column::Suppress(_) => self.config_current(c).as_deref() == Some(v.trim()),
-            Column::Param(_) => self.config_current(c).is_some_and(|x| x.replace(' ', "") == v.replace(' ', "")),
+            Column::Suppress(id) => suppression_cell(v).is_ok_and(|on| self.feature(*id).is_some_and(|f| f.suppressed == on)),
+            Column::Param(name) => {
+                let kind = self
+                    .features
+                    .iter()
+                    .find_map(|f| f.param_names.iter().position(|n| n == name).and_then(|k| f.kind.inputs().get(k).map(|input| input.2)));
+                let expected = kind.map_or_else(|| v.trim().to_string(), |kind| self.with_design_unit(v, kind));
+                self.config_current(c)
+                    .is_some_and(|current| current.chars().filter(|c| !c.is_whitespace()).eq(expected.chars().filter(|c| !c.is_whitespace())))
+            }
+            Column::Material(body) => material_cell(v).is_ok_and(|m| self.materials.get(body) == m.as_ref()),
+            Column::Appearance(body) => appearance_cell(v).is_ok_and(|look| self.appearances.bodies.get(body) == look.as_ref()),
+            Column::ComponentAppearance(id) => appearance_cell(v).is_ok_and(|look| self.appearances.components.get(id) == look.as_ref()),
+            Column::FaceAppearance(target) => appearance_cell(v).is_ok_and(|look| self.config_face_look(target) == look),
         })
     }
 }
@@ -97,6 +286,53 @@ impl Document {
 mod tests {
     use super::*;
 
+    #[test]
+    fn rows_use_final_graph_and_missing_targets_never_reappear() {
+        let mut d = Document::new("A");
+        d.set_param("a", "1 mm", None, None).unwrap();
+        d.set_param("b", "a", None, None).unwrap();
+        d.configs.columns = vec![Column::Param("a".into()), Column::Param("b".into())];
+        d.configs.rows.push(ConfigRow { name: "Reordered".into(), cells: vec!["b".into(), "2 mm".into()] });
+        d.apply_configuration("Reordered").unwrap();
+        assert!(d.configuration_matches());
+        assert_eq!(d.param_values().0["a"].v, 2.0);
+        d.configs.rows.push(ConfigRow { name: "Cycle".into(), cells: vec!["b".into(), "a".into()] });
+        let before = d.clone();
+        assert!(d.apply_configuration("Cycle").is_err());
+        assert_eq!(d, before);
+        d.params.retain(|p| p.name != "a");
+        let before = d.clone();
+        assert!(d.apply_configuration("Reordered").is_err());
+        assert_eq!(d, before);
+    }
+
+    #[test]
+    fn bulk_changes_reject_new_errors_in_unchanged_dependents() {
+        let mut d = Document::new("A");
+        d.set_param("length", "2 mm", None, None).unwrap();
+        d.set_param("twice", "length * 2", None, None).unwrap();
+        let before = d.clone();
+        assert!(d.change_params_atomic(&[("length".into(), "1 / 0".into())]).is_err());
+        assert_eq!(d, before);
+        assert!(d.change_params_atomic(&[("length".into(), "3 mm".into()), ("length".into(), "4 mm".into())]).is_err());
+        assert_eq!(d, before);
+    }
+
+    #[test]
+    fn unchanged_erroneous_configured_parameter_is_a_noop_but_changed_error_rejects() {
+        let mut d = Document::new("Existing broken design");
+        d.set_param("width", "10 mm", None, None).unwrap();
+        d.params[0].expr = "1/".into();
+        d.configs.columns = vec![Column::Param("width".into())];
+        d.configs.rows.push(ConfigRow { name: "Default".into(), cells: vec!["1/".into()] });
+        d.apply_configuration("Default").unwrap();
+        assert!(d.configuration_matches());
+        d.configs.rows.push(ConfigRow { name: "Different error".into(), cells: vec!["missing + 1".into()] });
+        let before = d.clone();
+        assert!(d.apply_configuration("Different error").is_err());
+        assert_eq!(d, before);
+    }
+
     #[test]
     fn rows_switch_parameters() {
         let mut d = Document::new("A");
@@ -114,4 +350,21 @@ mod tests {
         assert!(d.apply_configuration("Bad").is_err());
         assert_eq!(d, before, "all or nothing");
     }
+
+    #[test]
+    fn invalid_saved_appearance_rolls_back_material_and_parameters() {
+        let mut d = Document::new("A");
+        d.set_param("width", "10 mm", None, None).unwrap();
+        d.configs.columns = vec![Column::Param("width".into()), Column::Material("Body".into()), Column::Appearance("Body".into())];
+        d.configs.rows.push(ConfigRow {
+            name: "Broken".into(),
+            cells: vec!["20 mm".into(), "Steel".into(), r#"{"name":"Invalid","color":[1,2,3],"opacity":2}"#.into()],
+        });
+        let before = d.clone();
+        assert!(d.apply_configuration("Broken").is_err());
+        assert_eq!(d, before);
+        assert!(appearance_cell(r#"{"name":"Invalid","color":[1,2,3],"opacity":1e999}"#).is_err());
+        assert!(appearance_cell(&"a".repeat(4097)).is_err());
+        assert!(appearance_cell("default").unwrap().is_none());
+    }
 }

crates/doc/src/config_certificates.rs

@@ -0,0 +1,518 @@
+//! Certificates are producer identities, never a nearest-surface selection.
+use crate::{DocError, Document, FeatureKind, ModelBody, Result, SolvedSketch};
+use serde::{Deserialize, Serialize};
+use solvecraft_geom::Seg2;
+
+fn valid_signature(outer: &[String], holes: &[Vec<String>]) -> bool {
+    let valid = |ids: &[String]| {
+        !ids.is_empty() && ids.len() <= 2000 && ids.iter().all(|id| !id.is_empty() && id.len() <= 128) && ids.windows(2).all(|pair| pair[0] < pair[1])
+    };
+    valid(outer)
+        && holes.len() <= 128
+        && holes.iter().all(|ids| valid(ids))
+        && outer.len() + holes.iter().map(Vec::len).sum::<usize>() <= 2000
+        && holes.windows(2).all(|pair| pair[0] < pair[1])
+        && holes.iter().flatten().all(|id| outer.binary_search(id).is_err())
+        && holes.iter().flatten().collect::<std::collections::BTreeSet<_>>().len() == holes.iter().map(Vec::len).sum::<usize>()
+}
+fn valid_signature_json(outer: Option<&serde_json::Value>, holes: Option<&serde_json::Value>) -> bool {
+    let valid = |value: &serde_json::Value| {
+        value.as_array().is_some_and(|ids| {
+            !ids.is_empty()
+                && ids.len() <= 2000
+                && ids.iter().all(|id| id.as_str().is_some_and(|id| !id.is_empty() && id.len() <= 128))
+                && ids.windows(2).all(|pair| pair[0].as_str() < pair[1].as_str())
+        })
+    };
+    let Some(outer) = outer.filter(|value| valid(value)).and_then(serde_json::Value::as_array) else {
+        return false;
+    };
+    let Some(holes) = holes.and_then(serde_json::Value::as_array).filter(|holes| holes.len() <= 128) else {
+        return false;
+    };
+    if !holes.iter().all(valid) {
+        return false;
+    }
+    let total = outer.len() + holes.iter().filter_map(serde_json::Value::as_array).map(Vec::len).sum::<usize>();
+    let ids: Vec<_> = outer.iter().filter_map(serde_json::Value::as_str).collect();
+    total <= 2000
+        && holes
+            .iter()
+            .filter_map(serde_json::Value::as_array)
+            .flatten()
+            .filter_map(serde_json::Value::as_str)
+            .collect::<std::collections::BTreeSet<_>>()
+            .len()
+            == total - outer.len()
+        && holes
+            .iter()
+            .filter_map(serde_json::Value::as_array)
+            .flatten()
+            .filter_map(serde_json::Value::as_str)
+            .all(|id| ids.binary_search(&id).is_err())
+        && holes.windows(2).all(|pair| {
+            let a: Vec<_> = pair[0].as_array().into_iter().flatten().filter_map(serde_json::Value::as_str).collect();
+            let b: Vec<_> = pair[1].as_array().into_iter().flatten().filter_map(serde_json::Value::as_str).collect();
+            a < b
+        })
+}
+pub(crate) fn cap_key(outer: &[String], holes: &[Vec<String>]) -> String {
+    use sha2::{Digest, Sha256};
+    let mut hash = Sha256::new();
+    for ids in std::iter::once(outer).chain(holes.iter().map(Vec::as_slice)) {
+        hash.update((ids.len() as u64).to_le_bytes());
+        for id in ids {
+            hash.update((id.len() as u64).to_le_bytes());
+            hash.update(id.as_bytes());
+        }
+    }
+    format!("{:x}", hash.finalize())
+}
+pub(crate) fn exact_region_signature(sketch: &SolvedSketch, region: &solvecraft_geom::Region2) -> Option<solvecraft_kernel::CapSignature> {
+    if region.outer.segs.len() + region.holes.iter().map(|hole| hole.segs.len()).sum::<usize>() > 4096 || region.holes.len() > 128 {
+        return None;
+    }
+    let signature = |outline: &solvecraft_geom::Loop2| {
+        let mut ids = outline.segs.iter().map(|segment| exact_sketch_curve(sketch, segment)).collect::<Option<Vec<_>>>()?;
+        ids.sort();
+        ids.dedup();
+        Some(ids)
+    };
+    let outer = signature(&region.outer)?;
+    let mut holes = region.holes.iter().map(signature).collect::<Option<Vec<_>>>()?;
+    holes.sort();
+    valid_signature(&outer, &holes).then_some((outer, holes))
+}
+
+/// Charge all source-curve comparisons before matching; over-budget tools stay usable but uncertified.
+type CapBindings = Vec<Vec<Option<solvecraft_kernel::CapSignature>>>;
+pub(crate) fn extrude_cap_bindings(sketch: &SolvedSketch, bodies: &[solvecraft_kernel::Body], budget: usize) -> Option<CapBindings> {
+    use solvecraft_kernel::FaceSource;
+    if sketch.sketch.curves.len() > 2000 {
+        return None;
+    }
+    let mut faces = 0usize;
+    let mut comparisons = 0usize;
+    for body in bodies {
+        for source in body.face_sources().into_iter().flatten() {
+            faces = faces.checked_add(1)?;
+            if faces > 50_000 {
+                return None;
+            }
+            let segments = match source {
+                Some(FaceSource::ExtrudeSide { .. }) => 1,
+                Some(FaceSource::ExtrudeCap { region, .. }) => {
+                    region.outer.segs.len().checked_add(region.holes.iter().map(|hole| hole.segs.len()).sum::<usize>())?
+                }
+                _ => 0,
+            };
+            comparisons = comparisons.checked_add(segments.checked_mul(sketch.sketch.curves.len())?)?;
+            if comparisons > budget {
+                return None;
+            }
+        }
+    }
+    let mut counts = std::collections::BTreeMap::new();
+    let mut bindings = Vec::with_capacity(bodies.len());
+    for body in bodies {
+        let mut cached: Option<(&solvecraft_geom::Region2, Option<solvecraft_kernel::CapSignature>)> = None;
+        let mut values = Vec::new();
+        for source in body.face_sources().into_iter().flatten() {
+            let signature = if let Some(FaceSource::ExtrudeCap { region, high, .. }) = source {
+                let signature = match &cached {
+                    Some((previous, signature)) if *previous == region => signature.clone(),
+                    _ => exact_region_signature(sketch, region),
+                };
+                cached = Some((region, signature.clone()));
+                if let Some((outer, holes)) = &signature {
+                    *counts.entry((*high, outer.clone(), holes.clone())).or_insert(0usize) += 1;
+                }
+                signature
+            } else {
+                None
+            };
+            values.push(signature);
+        }
+        bindings.push(values);
+    }
+    for (body, values) in bodies.iter().zip(&mut bindings) {
+        for (source, value) in body.face_sources().into_iter().flatten().zip(values) {
+            if let (Some(FaceSource::ExtrudeCap { high, .. }), Some((outer, holes))) = (source, value.as_ref())
+                && counts.get(&(*high, outer.clone(), holes.clone())) != Some(&1)
+            {
+                *value = None;
+            }
+        }
+    }
+    Some(bindings)
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum FaceCertificate {
+    Box { axis: u8, high: bool },
+    ExtrudeCap { sketch: u64, high: bool, outer: Vec<String>, holes: Vec<Vec<String>> },
+    ExtrudeSide { sketch: u64, curve: String },
+    Imported { payload_sha256: String, item: u64, face: u64 },
+    ShellPlanar { source_producer: u64, source: Box<FaceCertificate>, inner: bool },
+}
+
+impl FaceCertificate {
+    pub fn remap_features(&mut self, features: &std::collections::BTreeMap<u64, u64>) {
+        if let Self::ShellPlanar { source_producer, source, .. } = self {
+            if let Some(mapped) = features.get(source_producer) {
+                *source_producer = *mapped;
+            }
+            if !matches!(source.as_ref(), Self::ShellPlanar { .. }) {
+                source.remap_features(features);
+            }
+        }
+        if let Self::ExtrudeSide { sketch, .. } | Self::ExtrudeCap { sketch, .. } = self
+            && let Some(mapped) = features.get(sketch)
+        {
+            *sketch = *mapped;
+        }
+    }
+    pub fn validate(&self) -> Result<()> {
+        let valid = match self {
+            Self::Box { axis, .. } => *axis <= 2,
+            Self::ExtrudeCap { sketch, outer, holes, .. } => *sketch != 0 && valid_signature(outer, holes),
+            Self::ExtrudeSide { sketch, curve } => *sketch != 0 && !curve.is_empty() && curve.len() <= 128,
+            Self::Imported { payload_sha256, item, face } => {
+                *item != 0
+                    && *face != 0
+                    && payload_sha256.len() == 64
+                    && payload_sha256.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+            }
+            Self::ShellPlanar { source_producer, source, .. } => {
+                *source_producer != 0 && !matches!(source.as_ref(), Self::ShellPlanar { .. }) && source.validate().is_ok()
+            }
+        };
+        if valid { Ok(()) } else { Err(DocError::Invalid("invalid face source certificate".into())) }
+    }
+}
+
+pub(crate) fn validate_certificate_json(value: &serde_json::Value) -> Result<()> {
+    if value.is_null() {
+        return Ok(());
+    }
+    let fields = value.as_object().ok_or_else(|| DocError::Invalid("face certificate must be an object".into()))?;
+    let nonzero = |field: &str| fields.get(field).and_then(serde_json::Value::as_u64).is_some_and(|id| id != 0);
+    let valid = match fields.get("kind").and_then(serde_json::Value::as_str) {
+        Some("box") => {
+            fields.len() == 3
+                && fields.keys().all(|key| ["kind", "axis", "high"].contains(&key.as_str()))
+                && fields.get("axis").and_then(serde_json::Value::as_u64).is_some_and(|axis| axis <= 2)
+                && fields.get("high").and_then(serde_json::Value::as_bool).is_some()
+        }
+        Some("extrude_cap") => {
+            fields.len() == 5
+                && fields.keys().all(|key| ["kind", "sketch", "high", "outer", "holes"].contains(&key.as_str()))
+                && nonzero("sketch")
+                && fields.get("high").and_then(serde_json::Value::as_bool).is_some()
+                && valid_signature_json(fields.get("outer"), fields.get("holes"))
+        }
+        Some("extrude_side") => {
+            fields.len() == 3
+                && fields.keys().all(|key| ["kind", "sketch", "curve"].contains(&key.as_str()))
+                && nonzero("sketch")
+                && fields.get("curve").and_then(serde_json::Value::as_str).is_some_and(|curve| !curve.is_empty() && curve.len() <= 128)
+        }
+        Some("imported") => {
+            fields.len() == 4
+                && fields.keys().all(|key| ["kind", "payload_sha256", "item", "face"].contains(&key.as_str()))
+                && nonzero("item")
+                && nonzero("face")
+                && fields
+                    .get("payload_sha256")
+                    .and_then(serde_json::Value::as_str)
+                    .is_some_and(|digest| digest.len() == 64 && digest.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)))
+        }
+        Some("shell_planar") => {
+            fields.len() == 4
+                && fields.keys().all(|key| ["kind", "source_producer", "source", "inner"].contains(&key.as_str()))
+                && nonzero("source_producer")
+                && fields.get("inner").and_then(serde_json::Value::as_bool).is_some()
+                && fields.get("source").is_some_and(|source| {
+                    source.as_object().is_some_and(|source| source.get("kind").and_then(serde_json::Value::as_str) != Some("shell_planar"))
+                        && validate_certificate_json(source).is_ok()
+                })
+        }
+        _ => false,
+    };
+    if valid { Ok(()) } else { Err(DocError::Invalid("malformed or oversized face source certificate".into())) }
+}
+
+/// Canonical diagnostic role; producer identity remains in the typed certificate.
+pub(crate) fn shell_certificate_role(source: &FaceCertificate, inner: bool) -> Result<String> {
+    source.validate()?;
+    let role = match source {
+        FaceCertificate::Box { axis, high } => {
+            let axis = ["x", "y", "z"].get(*axis as usize).ok_or_else(|| DocError::Invalid("invalid shell source axis".into()))?;
+            format!("box:{}{axis}", if *high { "+" } else { "-" })
+        }
+        FaceCertificate::ExtrudeSide { curve, .. } => format!("side:{curve}"),
+        FaceCertificate::ExtrudeCap { high, outer, holes, .. } => format!("cap:{}:{}", if *high { "high" } else { "low" }, cap_key(outer, holes)),
+        FaceCertificate::Imported { payload_sha256, item, face } => format!("import:{payload_sha256}:{item}:{face}"),
+        FaceCertificate::ShellPlanar { .. } => return Err(DocError::Invalid("nested shell source certificates are unsupported".into())),
+    };
+    Ok(format!("shell:{}:{role}", if inner { "inner" } else { "outer" }))
+}
+
+pub(crate) fn flat_source_certificate(source: &solvecraft_kernel::FaceSource) -> Option<(u64, FaceCertificate)> {
+    use solvecraft_kernel::FaceSource;
+    match source {
+        FaceSource::Box { producer: Some(producer), axis, high, .. } => Some((*producer, FaceCertificate::Box { axis: *axis, high: *high })),
+        FaceSource::CertifiedExtrudeSide { producer, sketch, curve, .. } => {
+            Some((*producer, FaceCertificate::ExtrudeSide { sketch: *sketch, curve: curve.clone() }))
+        }
+        FaceSource::CertifiedExtrudeCap { producer, sketch, high, outer, holes, .. } => {
+            Some((*producer, FaceCertificate::ExtrudeCap { sketch: *sketch, high: *high, outer: outer.clone(), holes: holes.clone() }))
+        }
+        FaceSource::Imported { producer: Some(producer), payload_sha256: Some(digest), item, face } => {
+            Some((*producer, FaceCertificate::Imported { payload_sha256: digest.clone(), item: *item, face: *face }))
+        }
+        _ => None,
+    }
+}
+
+pub(crate) fn flat_source_matches(certificate: &FaceCertificate, source: &solvecraft_kernel::FaceSource, producer: u64) -> bool {
+    use solvecraft_kernel::FaceSource;
+    match (certificate, source) {
+        (FaceCertificate::Box { axis, high }, FaceSource::Box { producer: Some(current), axis: current_axis, high: current_high, .. }) => {
+            producer == *current && axis == current_axis && high == current_high
+        }
+        (
+            FaceCertificate::ExtrudeSide { sketch, curve },
+            FaceSource::CertifiedExtrudeSide { producer: current, sketch: current_sketch, curve: current_curve, .. },
+        ) => producer == *current && sketch == current_sketch && curve == current_curve,
+        (
+            FaceCertificate::ExtrudeCap { sketch, high, outer, holes },
+            FaceSource::CertifiedExtrudeCap {
+                producer: current,
+                sketch: current_sketch,
+                high: current_high,
+                outer: current_outer,
+                holes: current_holes,
+                ..
+            },
+        ) => producer == *current && sketch == current_sketch && high == current_high && outer == current_outer && holes == current_holes,
+        (
+            FaceCertificate::Imported { payload_sha256, item, face },
+            FaceSource::Imported { producer: Some(current), payload_sha256: Some(digest), item: current_item, face: current_face },
+        ) => producer == *current && payload_sha256 == digest && item == current_item && face == current_face,
+        _ => false,
+    }
+}
+
+/// Match a generated segment to one exact analytic sketch curve. Coincident
+/// candidates are ambiguous and never resolved by distance or candidate order.
+pub(crate) fn exact_sketch_curve(sketch: &SolvedSketch, generated: &Seg2) -> Option<String> {
+    if sketch.sketch.curves.len() > 2000 {
+        return None;
+    }
+    let mut found = None;
+    for (index, curve) in sketch.sketch.curves.iter().enumerate() {
+        if curve.construction
+            || !matches!(
+                curve.kind,
+                solvecraft_sketch::CurveKind::Line { .. } | solvecraft_sketch::CurveKind::Arc { .. } | solvecraft_sketch::CurveKind::Circle { .. }
+            )
+        {
+            continue;
+        }
+        let matches = if let solvecraft_sketch::CurveKind::Circle { c, r } = curve.kind {
+            sketch
+                .sketch
+                .point(c)
+                .is_some_and(|center| exact_segment_contains(&Seg2::Arc { center, radius: r, start: 0., sweep: std::f64::consts::TAU }, generated))
+        } else {
+            sketch.sketch.segs(index).iter().any(|original| exact_segment_contains(original, generated))
+        };
+        if matches {
+            if found.is_some() {
+                return None;
+            }
+            found = Some(curve.id.clone());
+        }
+    }
+    found
+}
+
+fn exact_segment_contains(original: &Seg2, generated: &Seg2) -> bool {
+    match (original, generated) {
+        (Seg2::Line { a, b }, Seg2::Line { a: c, b: d }) => {
+            let direction = *b - *a;
+            let scale = direction.len().max((*d - *c).len()).max(1.);
+            let interval = |point: solvecraft_geom::Vec2| {
+                let t = (point - *a).dot(direction) / direction.len2();
+                (-1e-10..=1. + 1e-10).contains(&t)
+            };
+            direction.len() > 1e-12
+                && direction.cross(*c - *a).abs() <= 1e-10 * scale * scale
+                && direction.cross(*d - *a).abs() <= 1e-10 * scale * scale
+                && interval(*c)
+                && interval(*d)
+        }
+        (Seg2::Arc { center: a, radius: ar, start: os, sweep: ow }, Seg2::Arc { center: b, radius: br, start: gs, sweep: gw }) => {
+            let tau = std::f64::consts::TAU;
+            let tolerance = 1e-10;
+            let length = ow.abs();
+            let generated_length = gw.abs();
+            if a.dist(*b) > 1e-10 * ar.max(*br).max(1.)
+                || (ar - br).abs() > 1e-10 * ar.max(*br).max(1.)
+                || length > tau + tolerance
+                || generated_length > length + tolerance
+            {
+                return false;
+            }
+            if length >= tau - tolerance {
+                return true;
+            }
+            let original_low = if *ow >= 0. { *os } else { os + ow };
+            let generated_low = if *gw >= 0. { *gs } else { gs + gw };
+            let offset = (generated_low - original_low).rem_euclid(tau);
+            let offset = if offset > tau - tolerance { 0. } else { offset };
+            offset + generated_length <= length + tolerance
+        }
+        _ => false,
+    }
+}
+
+impl Document {
+    pub fn configuration_face_target(&self, body: &ModelBody, index: usize, point: solvecraft_geom::Vec3) -> Result<crate::config::ConfigFaceTarget> {
+        let names = crate::naming::face_names(body);
+        let mut name = names
+            .get(index)
+            .map(|name| crate::naming::strip_piece(name).to_string())
+            .ok_or_else(|| DocError::Unknown("face source name missing".into()))?;
+        let origin = match body.body.face_sources().and_then(|sources| sources.get(index)).and_then(Option::as_ref) {
+            Some(solvecraft_kernel::FaceSource::Imported { producer: Some(producer), .. })
+            | Some(solvecraft_kernel::FaceSource::CertifiedExtrudeSide { producer, .. })
+            | Some(solvecraft_kernel::FaceSource::CertifiedExtrudeCap { producer, .. })
+            | Some(solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), .. })
+            | Some(solvecraft_kernel::FaceSource::Box { producer: Some(producer), .. }) => *producer,
+            _ => name
+                .strip_prefix('F')
+                .and_then(|name| name.split_once(':'))
+                .and_then(|(id, _)| id.parse().ok())
+                .ok_or_else(|| DocError::Invalid("face source producer missing".into()))?,
+        };
+        let certificate = self.configuration_face_certificate(body, index)?;
+        if let Some(FaceCertificate::ExtrudeSide { curve, .. }) = &certificate {
+            name = format!("F{origin}:side:{curve}");
+        } else if let Some(FaceCertificate::ShellPlanar { source, inner, .. }) = &certificate {
+            name = format!("F{origin}:{}", shell_certificate_role(source, *inner)?);
+        } else if !name.starts_with(&format!("F{origin}:")) {
+            name = format!("F{origin}:face:{index}");
+        }
+        let inverse = crate::mat_inverse(&body.source_transform).ok_or_else(|| DocError::Invalid("invalid definition placement".into()))?;
+        Ok(crate::config::ConfigFaceTarget {
+            body: body.definition_name().into(),
+            origin_feature: origin,
+            name,
+            point: crate::apply_point(&inverse, point),
+            certificate,
+        })
+    }
+    pub fn configuration_face_certificate(&self, body: &ModelBody, index: usize) -> Result<Option<FaceCertificate>> {
+        let Some(source) = body.body.face_sources().and_then(|sources| sources.get(index)).and_then(Option::as_ref) else {
+            return Ok(None);
+        };
+        if let solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), source, inner, .. } = source {
+            if !self.feature(*producer).is_some_and(|feature| matches!(feature.kind, FeatureKind::Shell { .. })) {
+                return Err(DocError::Invalid("shell source producer missing".into()));
+            }
+            let (source_producer, source) =
+                flat_source_certificate(source).ok_or_else(|| DocError::Invalid("shell has no flat certified source".into()))?;
+            if !self.flat_certificate_producer_matches(source_producer, &source) {
+                return Err(DocError::Invalid("shell original source producer missing".into()));
+            }
+            let certificate = FaceCertificate::ShellPlanar { source_producer, source: Box::new(source), inner: *inner };
+            certificate.validate()?;
+            return Ok(Some(certificate));
+        }
+        if let solvecraft_kernel::FaceSource::Imported { item, face, payload_sha256: Some(digest), producer: Some(producer) } = source {
+            if !self.feature(*producer).is_some_and(|feature| matches!(feature.kind, FeatureKind::Import { .. })) {
+                return Err(DocError::Invalid("import source producer missing".into()));
+            }
+            let certificate = FaceCertificate::Imported { payload_sha256: digest.clone(), item: *item, face: *face };
+            certificate.validate()?;
+            return Ok(Some(certificate));
+        }
+        let certificate = match source {
+            solvecraft_kernel::FaceSource::CertifiedExtrudeSide { producer, sketch, curve, .. } => {
+                if !self.feature(*producer).is_some_and(|feature| matches!(feature.kind, FeatureKind::Extrude { .. })) {
+                    return Err(DocError::Invalid("side source producer missing".into()));
+                }
+                FaceCertificate::ExtrudeSide { sketch: *sketch, curve: curve.clone() }
+            }
+            _ => return Ok(None),
+        };
+        certificate.validate()?;
+        Ok(Some(certificate))
+    }
+    pub fn strong_face_target(&self, body: &ModelBody, index: usize, point: solvecraft_geom::Vec3) -> Result<crate::config::ConfigFaceTarget> {
+        let mut target = self.configuration_face_target(body, index, point)?;
+        match body.body.face_sources().and_then(|sources| sources.get(index)).and_then(Option::as_ref) {
+            Some(solvecraft_kernel::FaceSource::Box { producer: Some(producer), axis, high, .. }) => {
+                target.origin_feature = *producer;
+                let axis_name = ["x", "y", "z"].get(*axis as usize).ok_or_else(|| DocError::Invalid("invalid box face axis".into()))?;
+                target.name = format!("F{producer}:{}{axis_name}", if *high { "+" } else { "-" });
+                target.certificate = Some(FaceCertificate::Box { axis: *axis, high: *high });
+            }
+            Some(solvecraft_kernel::FaceSource::CertifiedExtrudeCap { producer, sketch, high, outer, holes, .. }) => {
+                target.origin_feature = *producer;
+                target.name = format!("F{producer}:cap:{}:{}", if *high { "high" } else { "low" }, cap_key(outer, holes));
+                target.certificate = Some(FaceCertificate::ExtrudeCap { sketch: *sketch, high: *high, outer: outer.clone(), holes: holes.clone() });
+            }
+            _ => {}
+        }
+        self.certify_config_face(&target)?;
+        Ok(target)
+    }
+}
+
+pub(crate) fn payload_digest(payload: &str) -> String {
+    use sha2::{Digest, Sha256};
+    format!("{:x}", Sha256::digest(payload.as_bytes()))
+}
+
+#[cfg(test)]
+#[path = "config_shell_tests.rs"]
+mod shell_tests;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    #[test]
+    fn certificate_budgets_apply_before_saved_target_and_paint_decode() {
+        for certificate in [
+            json!({"kind":"extrude_side","sketch":1,"curve":"x".repeat(1_000_000)}),
+            json!({"kind":"imported","payload_sha256":"0".repeat(64),"item":0,"face":1}),
+            json!({"kind":"imported","payload_sha256":"g".repeat(64),"item":1,"face":1}),
+            json!({"kind":"extrude_side","sketch":1,"curve":"c1","extra":[[[[[]]]]]}),
+        ] {
+            assert!(validate_certificate_json(&certificate).is_err());
+            let target = json!({"configs":{"columns":[{"face_appearance":{"body":"B","origin_feature":1,"name":"F1:side:c1","point":[0,0,0],"certificate":certificate}}]}});
+            assert!(crate::config::validate_styles_json(&target).is_err());
+            let paint = json!({"appearances":{"faces":[{"certificate":certificate}]}});
+            assert!(crate::config::validate_styles_json(&paint).is_err());
+        }
+        assert!(validate_certificate_json(&json!({"kind":"imported","payload_sha256":"a".repeat(64),"item":1,"face":2})).is_ok());
+        assert!(validate_certificate_json(&json!({"kind":"extrude_side","sketch":1,"curve":"c1"})).is_ok());
+    }
+    #[test]
+    fn analytic_arc_interval_refuses_unsampled_gaps_and_accepts_wrap_reversal() {
+        let radians = |degrees: f64| degrees.to_radians();
+        let arc = |start, sweep| Seg2::Arc { center: solvecraft_geom::Vec2::default(), radius: 10., start: radians(start), sweep: radians(sweep) };
+        assert!(!exact_segment_contains(&arc(10., 350.), &arc(20., 360.)), "five point probes missed the missing ten-degree gap");
+        assert!(!exact_segment_contains(&arc(10., 350.), &arc(20., -360.)));
+        assert!(exact_segment_contains(&arc(350., 40.), &arc(355., 20.)));
+        assert!(exact_segment_contains(&arc(350., 40.), &arc(15., -20.)));
+        assert!(exact_segment_contains(&arc(30., -40.), &arc(15., -20.)));
+        assert!(!exact_segment_contains(&arc(350., 40.), &arc(345., 20.)));
+        assert!(exact_segment_contains(&arc(0., 360.), &arc(20., -360.)));
+    }
+}

crates/doc/src/config_clone.rs

@@ -0,0 +1,218 @@
+//! Configuration graph remapping for independent component copies.
+use super::{Column, ConfigTable};
+use crate::{DocError, Result};
+use std::collections::BTreeMap;
+
+#[derive(Clone, Debug, Default)]
+pub struct ConfigCloneMaps {
+    pub features: BTreeMap<u64, u64>,
+    pub components: BTreeMap<u64, u64>,
+    pub bodies: BTreeMap<String, String>,
+    pub parameters: BTreeMap<String, String>,
+}
+
+/// Simultaneous token-reference substitution, including maps whose values are other keys.
+pub(super) fn remap_expression(source: &str, parameters: &BTreeMap<String, String>) -> String {
+    let refs = crate::expr::references(source);
+    let mut result = source.to_string();
+    let mut replacements = Vec::new();
+    for (index, reference) in refs.iter().enumerate() {
+        if let Some(mapped) = parameters.get(reference) {
+            let mut temporary = format!("_config_clone_{index}");
+            while refs.contains(&temporary) || parameters.contains_key(&temporary) || parameters.values().any(|value| value == &temporary) {
+                temporary.push('_');
+            }
+            result = crate::expr::rename_reference(&result, reference, &temporary);
+            replacements.push((temporary, mapped));
+        }
+    }
+    for (temporary, mapped) in replacements {
+        result = crate::expr::rename_reference(&result, &temporary, mapped);
+    }
+    result
+}
+
+impl ConfigTable {
+    /// Append mapped columns/cells/rules atomically; source targets and active row remain intact.
+    pub fn clone_targets(&mut self, maps: &ConfigCloneMaps) -> Result<()> {
+        if maps.features.values().chain(maps.components.values()).any(|id| *id == 0)
+            || maps.parameters.values().any(|name| crate::Document::param_name_problem(name).is_some())
+            || maps.bodies.values().any(|name| name.is_empty() || name.len() > 128)
+        {
+            return Err(DocError::Invalid("invalid configuration clone identity mapping".into()));
+        }
+        if self.columns.len() > super::MAX_COLUMNS
+            || self.rows.len() > super::MAX_ROWS
+            || self.rules.len() > super::MAX_RULES
+            || self.rows.iter().any(|row| row.cells.len() != self.columns.len())
+        {
+            return Err(DocError::Invalid("cannot clone an incomplete configuration table".into()));
+        }
+        let mut next = self.clone();
+        for (index, column) in self.columns.iter().enumerate() {
+            if let Column::FaceAppearance(target) = column
+                && maps.bodies.contains_key(&target.body)
+                && !maps.features.contains_key(&target.origin_feature)
+            {
+                return Err(DocError::Invalid(format!(
+                    "cannot copy configured face `{}`: imported foreign body has no certified cloned lineage",
+                    target.name
+                )));
+            }
+            let mapped = match column {
+                Column::Param(name) => maps.parameters.get(name).cloned().map(Column::Param),
+                Column::Suppress(id) => maps.features.get(id).copied().map(Column::Suppress),
+                Column::Material(name) => maps.bodies.get(name).cloned().map(Column::Material),
+                Column::Appearance(name) => maps.bodies.get(name).cloned().map(Column::Appearance),
+                Column::ComponentAppearance(id) => maps.components.get(id).copied().map(Column::ComponentAppearance),
+                Column::FaceAppearance(target) => {
+                    maps.bodies.get(&target.body).zip(maps.features.get(&target.origin_feature)).map(|(body, origin)| {
+                        let mut target = target.clone();
+                        target.body = body.clone();
+                        target.name = target
+                            .name
+                            .strip_prefix(&format!("F{}:", target.origin_feature))
+                            .map(|role| format!("F{origin}:{role}"))
+                            .unwrap_or_else(|| target.name.clone());
+                        target.origin_feature = *origin;
+                        if let Some(certificate) = &mut target.certificate {
+                            certificate.remap_features(&maps.features);
+                        }
+                        Column::FaceAppearance(target)
+                    })
+                }
+            };
+            if let Some(mapped) = mapped {
+                if mapped == *column {
+                    continue;
+                }
+                if next.columns.iter().any(|column| {
+                    *column == mapped
+                        || matches!((column,&mapped),(Column::FaceAppearance(a),Column::FaceAppearance(b)) if a.body == b.body && a.name == b.name)
+                }) {
+                    return Err(DocError::Invalid("configuration copy target collides with an existing column".into()));
+                }
+                if next.columns.len() >= super::MAX_COLUMNS {
+                    return Err(DocError::Invalid("configuration copy exceeds column limit".into()));
+                }
+                next.columns.push(mapped);
+                for (source, destination) in self.rows.iter().zip(&mut next.rows) {
+                    let value = source.cells.get(index).cloned().unwrap_or_default();
+                    let value = if matches!(column, Column::Param(_)) { remap_expression(&value, &maps.parameters) } else { value };
+                    if value.len() > 4096 {
+                        return Err(DocError::Invalid("configuration copied value exceeds length limit".into()));
+                    }
+                    destination.cells.push(value);
+                }
+            }
+        }
+        for rule in &self.rules {
+            if let Some(mut copied) = rule.clone_for_targets(maps) {
+                if next.rules.len() >= super::MAX_RULES {
+                    return Err(DocError::Invalid("configuration copy exceeds rule limit".into()));
+                }
+                let stem: String = rule.id.chars().take(40).collect();
+                copied.id = (1..=super::MAX_RULES + 1)
+                    .map(|i| format!("{stem}_copy{i}"))
+                    .find(|id| !next.rules.iter().any(|rule| rule.id == *id))
+                    .ok_or_else(|| DocError::Invalid("no configuration rule ID available".into()))?;
+                copied.name = format!("{} (copy)", rule.name.chars().take(120).collect::<String>());
+                next.rules.push(copied);
+            }
+        }
+        super::validate_rules_json(&serde_json::json!({"configs":{"rules":next.rules}}))?;
+        *self = next;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::{ConfigFaceTarget, ConfigRow, ConfigRule, RuleCondition, RuleEffect};
+    #[test]
+    fn clone_preserves_source_variations_and_remaps_only_typed_targets_and_tokens() {
+        let mut table = ConfigTable {
+            columns: vec![
+                Column::Param("d1".into()),
+                Column::Param("d2".into()),
+                Column::Appearance("Old".into()),
+                Column::ComponentAppearance(2),
+                Column::FaceAppearance(ConfigFaceTarget {
+                    body: "Old".into(),
+                    origin_feature: 3,
+                    name: "F3:+z".into(),
+                    point: solvecraft_geom::Vec3::new(1., 1., 2.),
+                    certificate: None,
+                }),
+            ],
+            rows: vec![ConfigRow {
+                name: "Default".into(),
+                cells: vec!["d1 * 2 + d2".into(), "4 mm".into(), "d1".into(), String::new(), String::new()],
+            }],
+            active: Some("Default".into()),
+            rules: vec![ConfigRule {
+                id: "Rule1".into(),
+                name: "Rule1".into(),
+                enabled: true,
+                length_unit: Some("mm".into()),
+                condition: RuleCondition::Suppression { feature: 3, value: false },
+                effect: RuleEffect::DriveParameter { parameter: "d1".into(), expression: "d2 * 2 + d1".into() },
+            }],
+        };
+        let original = table.clone();
+        let maps = ConfigCloneMaps {
+            features: BTreeMap::from([(3, 7)]),
+            components: BTreeMap::from([(2, 8)]),
+            bodies: BTreeMap::from([("Old".into(), "New".into())]),
+            parameters: BTreeMap::from([("d1".into(), "copy_d1".into()), ("d2".into(), "copy_d2".into())]),
+        };
+        table.clone_targets(&maps).unwrap();
+        assert_eq!(&table.columns[..5], &original.columns);
+        assert_eq!(&table.rows[0].cells[..5], &original.rows[0].cells);
+        assert_eq!(table.columns[5], Column::Param("copy_d1".into()));
+        assert_eq!(table.rows[0].cells[5], "copy_d1 * 2 + copy_d2");
+        assert_eq!(table.rows[0].cells[7], "d1"); // appearance strings are never parameter expressions
+        assert_eq!(table.columns[8], Column::ComponentAppearance(8));
+        let Column::FaceAppearance(face) = &table.columns[9] else { panic!() };
+        assert_eq!(face.name, "F7:+z");
+        assert_eq!(face.body, "New");
+        assert_eq!(table.rules[0], original.rules[0]);
+        assert!(
+            matches!(&table.rules[1].effect,RuleEffect::DriveParameter{parameter,expression} if parameter=="copy_d1" && expression=="copy_d2 * 2 + copy_d1")
+        );
+        assert!(matches!(table.rules[1].condition, RuleCondition::Suppression { feature: 7, .. }));
+        assert_eq!(table.active, original.active);
+        let chained = BTreeMap::from([("d1".into(), "d2".into()), ("d2".into(), "d3".into())]);
+        assert_eq!(remap_expression("d1 * 2 + d2", &chained), "d2 * 2 + d3");
+        let collision = ConfigCloneMaps { parameters: chained, ..Default::default() };
+        let mut original_copy = original.clone();
+        assert!(original_copy.clone_targets(&collision).is_err());
+        assert_eq!(original_copy, original);
+    }
+    #[test]
+    fn foreign_strict_lineage_failure_is_atomic() {
+        let mut table = ConfigTable {
+            columns: vec![
+                Column::Param("width".into()),
+                Column::FaceAppearance(ConfigFaceTarget {
+                    body: "Foreign".into(),
+                    origin_feature: 3,
+                    name: "F3:+z".into(),
+                    point: solvecraft_geom::Vec3::ZERO,
+                    certificate: None,
+                }),
+            ],
+            rows: vec![ConfigRow { name: "Default".into(), cells: vec!["2 mm".into(), String::new()] }],
+            ..Default::default()
+        };
+        let original = table.clone();
+        let maps = ConfigCloneMaps {
+            bodies: BTreeMap::from([("Foreign".into(), "Copied".into())]),
+            parameters: BTreeMap::from([("width".into(), "copied_width".into())]),
+            ..Default::default()
+        };
+        assert!(table.clone_targets(&maps).unwrap_err().to_string().contains("certified"));
+        assert_eq!(table, original);
+    }
+}

crates/doc/src/config_rules.rs

@@ -0,0 +1,684 @@
+//! Bounded typed configuration rules. The saved row remains the editable source;
+//! ordered rules derive an effective design without overwriting its cells.
+use super::Column;
+use crate::{DocError, Document, Result, expr};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::{BTreeMap, BTreeSet};
+
+pub const MAX_RULES: usize = 128;
+const MAX_NODES: usize = 64;
+const MAX_DEPTH: usize = 8;
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConfigRule {
+    pub id: String,
+    pub name: String,
+    #[serde(default = "enabled")]
+    pub enabled: bool,
+    /// Unit context for feature-length expressions, fixed when authoring a rule.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub length_unit: Option<String>,
+    pub condition: RuleCondition,
+    pub effect: RuleEffect,
+}
+fn enabled() -> bool {
+    true
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub enum RuleCondition {
+    Always,
+    All { conditions: Vec<RuleCondition> },
+    Any { conditions: Vec<RuleCondition> },
+    Not { condition: Box<RuleCondition> },
+    Parameter { parameter: String, operator: RuleOperator, expression: String },
+    Suppression { feature: u64, value: bool },
+}
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RuleOperator {
+    Eq,
+    Ne,
+    Lt,
+    Le,
+    Gt,
+    Ge,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub enum RuleEffect {
+    DriveParameter { parameter: String, expression: String },
+    DriveSuppression { feature: u64, value: bool },
+    ParameterRange { parameter: String, minimum: String, maximum: String },
+    AllowParameterValues { parameter: String, expressions: Vec<String> },
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct RuleTrace {
+    pub id: String,
+    pub name: String,
+    pub matched: bool,
+    pub effect: RuleEffect,
+}
+
+/// Check saved rule structure before recursive serde decoding. Absence is backward
+/// compatible; malformed present data is refused. Runtime evaluation checks it again.
+pub fn validate_rules_json(document: &Value) -> Result<()> {
+    let Some(rules) = document.get("configs").and_then(|configs| configs.get("rules")) else { return Ok(()) };
+    let rules = rules.as_array().ok_or_else(|| invalid("rules must be an array"))?;
+    if rules.len() > MAX_RULES {
+        return Err(invalid("too many rules"));
+    }
+    for rule in rules {
+        let rule = rule.as_object().ok_or_else(|| invalid("rule must be an object"))?;
+        for (key, limit) in [("id", 64), ("name", 128)] {
+            let value = rule.get(key).and_then(Value::as_str).ok_or_else(|| invalid("rule id and name are required"))?;
+            if value.trim().is_empty() || value.chars().count() > limit {
+                return Err(invalid("rule id or name is empty or too long"));
+            }
+        }
+        if let Some(unit) = rule.get("length_unit") {
+            let unit =
+                unit.as_str().filter(|unit| matches!(*unit, "mm" | "cm" | "m" | "in" | "ft")).ok_or_else(|| invalid("invalid rule length unit"))?;
+            let _ = unit;
+        }
+        let mut pending = vec![(rule.get("condition").ok_or_else(|| invalid("condition required"))?, 1usize)];
+        let mut count = 0;
+        while let Some((condition, depth)) = pending.pop() {
+            count += 1;
+            if depth > MAX_DEPTH || count > MAX_NODES {
+                return Err(invalid("condition nesting or node limit exceeded"));
+            }
+            let kind = condition.get("type").and_then(Value::as_str).ok_or_else(|| invalid("condition type required"))?;
+            match kind {
+                "all" | "any" => {
+                    let children = condition.get("conditions").and_then(Value::as_array).ok_or_else(|| invalid("conditions must be an array"))?;
+                    if children.is_empty() || children.len() > MAX_NODES {
+                        return Err(invalid("condition group is empty or too large"));
+                    }
+                    pending.extend(children.iter().map(|child| (child, depth + 1)));
+                }
+                "not" => pending.push((condition.get("condition").ok_or_else(|| invalid("nested condition required"))?, depth + 1)),
+                "parameter" => {
+                    check_parameter(condition.get("parameter"))?;
+                    check_expression(condition.get("expression"))?;
+                }
+                "always" | "suppression" => {}
+                _ => return Err(invalid("unknown condition type")),
+            }
+        }
+        let effect = rule.get("effect").ok_or_else(|| invalid("effect required"))?;
+        if effect.get("type").and_then(Value::as_str) != Some("drive_suppression") {
+            check_parameter(effect.get("parameter"))?;
+        }
+        match effect.get("type").and_then(Value::as_str) {
+            Some("drive_parameter") => check_expression(effect.get("expression"))?,
+            Some("parameter_range") => {
+                check_expression(effect.get("minimum"))?;
+                check_expression(effect.get("maximum"))?;
+            }
+            Some("allow_parameter_values") => {
+                let expressions = effect.get("expressions").and_then(Value::as_array).ok_or_else(|| invalid("allowed values must be an array"))?;
+                if expressions.is_empty() || expressions.len() > 128 {
+                    return Err(invalid("allowed values are empty or too many"));
+                }
+                for expression in expressions {
+                    check_expression(Some(expression))?;
+                }
+            }
+            Some("drive_suppression") => {}
+            _ => return Err(invalid("unknown effect type")),
+        }
+    }
+    Ok(())
+}
+fn check_expression(value: Option<&Value>) -> Result<()> {
+    let text = value.and_then(Value::as_str).ok_or_else(|| invalid("expression must be text"))?;
+    if text.trim().is_empty() || text.len() > 4096 {
+        return Err(invalid("expression is empty or too long"));
+    }
+    Ok(())
+}
+fn check_parameter(value: Option<&Value>) -> Result<()> {
+    let name = value.and_then(Value::as_str).ok_or_else(|| invalid("parameter name required"))?;
+    if name.is_empty() || name.len() > 64 || Document::param_name_problem(name).is_some() {
+        return Err(invalid("invalid parameter name"));
+    }
+    Ok(())
+}
+fn invalid(message: &str) -> DocError {
+    DocError::Invalid(format!("configuration rules: {message}"))
+}
+
+fn operands(
+    doc: &Document,
+    values: &BTreeMap<String, expr::Value>,
+    parameter: &str,
+    expression: &str,
+    length_unit: Option<&str>,
+) -> Result<(f64, f64)> {
+    let lhs = values.get(parameter).copied().ok_or_else(|| invalid(&format!("parameter `{parameter}` is missing or invalid")))?;
+    let unit = doc
+        .param(parameter)
+        .map(|p| p.unit.as_str())
+        .or_else(|| lhs.kind().map(|kind| if kind == expr::Kind::Length { length_unit.unwrap_or(doc.units.as_str()) } else { kind.default_unit() }))
+        .unwrap_or("");
+    let defaults = expr::Defaults::for_unit(unit, expr::unit_info(&doc.units).map(|(_, scale)| scale).unwrap_or(1.0));
+    let rhs = expr::eval_with_defaults(
+        expression,
+        &|name| values.get(name).copied().ok_or_else(|| invalid(&format!("unknown parameter `{name}`"))),
+        defaults,
+    )?;
+    let kind = lhs.kind().ok_or_else(|| invalid("comparison requires length, angle or unitless values"))?;
+    let right = rhs.to_kind_in(kind, defaults)?;
+    if !lhs.v.is_finite() || !right.is_finite() {
+        return Err(invalid("comparison requires finite values"));
+    }
+    Ok((lhs.v, right))
+}
+fn close(a: f64, b: f64) -> bool {
+    (a - b).abs() <= 1e-9 * a.abs().max(b.abs()).max(1.0)
+}
+fn validate_drive_graph(graph: &BTreeMap<String, Vec<String>>, parameter: &str, expression: &str) -> Result<()> {
+    let mut pending = expr::references(expression);
+    let mut visited = BTreeSet::new();
+    while let Some(name) = pending.pop() {
+        if name == parameter {
+            return Err(invalid(&format!("drive for `{parameter}` creates a parameter cycle")));
+        }
+        if visited.insert(name.clone())
+            && let Some(references) = graph.get(&name)
+        {
+            pending.extend(references.iter().cloned());
+        }
+    }
+    Ok(())
+}
+fn condition(doc: &Document, values: &BTreeMap<String, expr::Value>, value: &RuleCondition, length_unit: Option<&str>) -> Result<bool> {
+    match value {
+        RuleCondition::Always => Ok(true),
+        RuleCondition::All { conditions } => {
+            for c in conditions {
+                if !condition(doc, values, c, length_unit)? {
+                    return Ok(false);
+                }
+            }
+            Ok(true)
+        }
+        RuleCondition::Any { conditions } => {
+            for c in conditions {
+                if condition(doc, values, c, length_unit)? {
+                    return Ok(true);
+                }
+            }
+            Ok(false)
+        }
+        RuleCondition::Not { condition: c } => Ok(!condition(doc, values, c, length_unit)?),
+        RuleCondition::Suppression { feature, value } => {
+            Ok(doc.feature(*feature).ok_or_else(|| invalid("condition feature is gone"))?.suppressed == *value)
+        }
+        RuleCondition::Parameter { parameter, operator, expression } => {
+            let (a, b) = operands(doc, values, parameter, expression, length_unit)?;
+            Ok(match operator {
+                RuleOperator::Eq => close(a, b),
+                RuleOperator::Ne => !close(a, b),
+                RuleOperator::Lt => a < b,
+                RuleOperator::Le => a <= b || close(a, b),
+                RuleOperator::Gt => a > b,
+                RuleOperator::Ge => a >= b || close(a, b),
+            })
+        }
+    }
+}
+
+impl Document {
+    /// Apply ordered drives, then enforce all matched restrictions on the final state.
+    /// Running on a scratch document makes a failing rule fully atomic for callers.
+    pub(super) fn evaluate_configuration_rules(&mut self) -> Result<Vec<RuleTrace>> {
+        validate_rules_json(&serde_json::json!({"configs":{"rules":self.configs.rules}}))?;
+        let mut ids = BTreeSet::new();
+        let mut trace = Vec::new();
+        let mut restrictions = Vec::new();
+        let (mut values, _) = self.param_values();
+        let parameter_names: BTreeSet<String> = self.all_param_exprs().into_iter().map(|(name, _, _)| name).collect();
+        let mut dependency_graph: BTreeMap<String, Vec<String>> =
+            self.all_param_exprs().into_iter().map(|(name, expression, _)| (name, expr::references(&expression))).collect();
+        for rule in self.configs.rules.clone() {
+            if !ids.insert(rule.id.clone()) {
+                return Err(invalid("duplicate rule id"));
+            }
+            if let Some(name) = rule.parameter_references().iter().find(|name| !parameter_names.contains(*name)) {
+                return Err(invalid(&format!("rule `{}` references missing parameter `{name}`", rule.name)));
+            }
+            // Targets must remain configured, including disabled rules, so dormant rules
+            // cannot silently become invalid and surprise a subsequent activation.
+            let target = match &rule.effect {
+                RuleEffect::DriveParameter { parameter, .. }
+                | RuleEffect::ParameterRange { parameter, .. }
+                | RuleEffect::AllowParameterValues { parameter, .. } => Column::Param(parameter.clone()),
+                RuleEffect::DriveSuppression { feature, .. } => Column::Suppress(*feature),
+            };
+            if !self.configs.columns.contains(&target) {
+                return Err(invalid(&format!("rule `{}` target is not configured", rule.name)));
+            }
+            let matched = rule.enabled
+                && condition(self, &values, &rule.condition, rule.length_unit.as_deref())
+                    .map_err(|e| invalid(&format!("rule `{}`: {e}", rule.name)))?;
+            trace.push(RuleTrace { id: rule.id, name: rule.name.clone(), matched, effect: rule.effect.clone() });
+            if !matched {
+                continue;
+            }
+            match rule.effect {
+                RuleEffect::DriveParameter { parameter, mut expression } => {
+                    validate_drive_graph(&dependency_graph, &parameter, &expression)?;
+                    dependency_graph.insert(parameter.clone(), expr::references(&expression));
+                    if self.param(&parameter).is_none()
+                        && rule.length_unit.as_deref().is_some_and(|unit| unit != self.units)
+                        && values.get(&parameter).is_some_and(|value| value.kind() == Some(expr::Kind::Length))
+                    {
+                        let (_, value) = operands(self, &values, &parameter, &expression, rule.length_unit.as_deref())?;
+                        expression = format!("{value} mm");
+                    }
+                    self.change_params_atomic(&[(parameter, expression)]).map_err(|e| invalid(&format!("rule `{}`: {e}", rule.name)))?;
+                    values = self.param_values().0;
+                }
+                RuleEffect::DriveSuppression { feature, value } => {
+                    self.feature_mut(feature).ok_or_else(|| invalid("rule feature is gone"))?.suppressed = value
+                }
+                effect => restrictions.push((rule.name, effect, rule.length_unit)),
+            }
+        }
+        for (name, effect, length_unit) in restrictions {
+            let valid = match effect {
+                RuleEffect::ParameterRange { parameter, minimum, maximum } => {
+                    let (value, min) = operands(self, &values, &parameter, &minimum, length_unit.as_deref())?;
+                    let (_, max) = operands(self, &values, &parameter, &maximum, length_unit.as_deref())?;
+                    min <= max && (value >= min || close(value, min)) && (value <= max || close(value, max))
+                }
+                RuleEffect::AllowParameterValues { parameter, expressions } => {
+                    let mut valid = false;
+                    for expression in expressions {
+                        let (a, b) = operands(self, &values, &parameter, &expression, length_unit.as_deref())?;
+                        valid |= close(a, b);
+                    }
+                    valid
+                }
+                _ => true,
+            };
+            if !valid {
+                return Err(invalid(&format!("rule `{name}` restricts the final value")));
+            }
+        }
+        Ok(trace)
+    }
+}
+
+impl ConfigRule {
+    pub(super) fn preserve_length_units(&mut self, parameters: &BTreeSet<String>, unit: &str) {
+        if self.length_unit.is_none() {
+            self.length_unit = Some(unit.to_string());
+        }
+        fn annotate(parameter: &str, expression: &mut String, parameters: &BTreeSet<String>, unit: &str) {
+            if parameters.contains(parameter) && expression.trim().parse::<f64>().is_ok() {
+                *expression = format!("{} {unit}", expression.trim());
+            }
+        }
+        fn walk(condition: &mut RuleCondition, parameters: &BTreeSet<String>, unit: &str) {
+            match condition {
+                RuleCondition::Parameter { parameter, expression, .. } => annotate(parameter, expression, parameters, unit),
+                RuleCondition::All { conditions } | RuleCondition::Any { conditions } => {
+                    for condition in conditions {
+                        walk(condition, parameters, unit);
+                    }
+                }
+                RuleCondition::Not { condition } => walk(condition, parameters, unit),
+                _ => {}
+            }
+        }
+        walk(&mut self.condition, parameters, unit);
+        match &mut self.effect {
+            RuleEffect::DriveParameter { parameter, expression } => annotate(parameter, expression, parameters, unit),
+            RuleEffect::ParameterRange { parameter, minimum, maximum } => {
+                annotate(parameter, minimum, parameters, unit);
+                annotate(parameter, maximum, parameters, unit);
+            }
+            RuleEffect::AllowParameterValues { parameter, expressions } => {
+                for expression in expressions {
+                    annotate(parameter, expression, parameters, unit);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Parameter references include targets and condition/effect expressions.
+    pub fn parameter_references(&self) -> Vec<String> {
+        let mut copy = self.clone();
+        let mut references = Vec::new();
+        copy.visit_parameters(&mut |text, expression| {
+            if expression {
+                references.extend(expr::references(text));
+            } else {
+                references.push(text.clone());
+            }
+        });
+        references
+    }
+    pub fn rename_parameter(&mut self, old: &str, new: &str) {
+        self.visit_parameters(&mut |text, expression| {
+            if expression {
+                *text = expr::rename_reference(text, old, new);
+            } else if text == old {
+                *text = new.to_string();
+            }
+        });
+    }
+    pub(super) fn clone_for_targets(&self, maps: &super::ConfigCloneMaps) -> Option<Self> {
+        let mapped = match &self.effect {
+            RuleEffect::DriveParameter { parameter, .. }
+            | RuleEffect::ParameterRange { parameter, .. }
+            | RuleEffect::AllowParameterValues { parameter, .. } => maps.parameters.contains_key(parameter),
+            RuleEffect::DriveSuppression { feature, .. } => maps.features.contains_key(feature),
+        };
+        if !mapped {
+            return None;
+        }
+        let mut copy = self.clone();
+        copy.visit_parameters(&mut |text, expression| {
+            *text = if expression {
+                super::clone::remap_expression(text, &maps.parameters)
+            } else {
+                maps.parameters.get(text).cloned().unwrap_or_else(|| text.clone())
+            };
+        });
+        fn remap(condition: &mut RuleCondition, maps: &super::ConfigCloneMaps) {
+            match condition {
+                RuleCondition::Suppression { feature, .. } => {
+                    *feature = maps.features.get(feature).copied().unwrap_or(*feature);
+                }
+                RuleCondition::All { conditions } | RuleCondition::Any { conditions } => {
+                    for condition in conditions {
+                        remap(condition, maps);
+                    }
+                }
+                RuleCondition::Not { condition } => remap(condition, maps),
+                _ => {}
+            }
+        }
+        remap(&mut copy.condition, maps);
+        if let RuleEffect::DriveSuppression { feature, .. } = &mut copy.effect {
+            *feature = maps.features.get(feature).copied().unwrap_or(*feature);
+        }
+        Some(copy)
+    }
+    fn visit_parameters(&mut self, visit: &mut impl FnMut(&mut String, bool)) {
+        fn walk(c: &mut RuleCondition, visit: &mut impl FnMut(&mut String, bool)) {
+            match c {
+                RuleCondition::All { conditions } | RuleCondition::Any { conditions } => {
+                    for c in conditions {
+                        walk(c, visit);
+                    }
+                }
+                RuleCondition::Not { condition } => walk(condition, visit),
+                RuleCondition::Parameter { parameter, expression, .. } => {
+                    visit(parameter, false);
+                    visit(expression, true);
+                }
+                _ => {}
+            }
+        }
+        walk(&mut self.condition, visit);
+        match &mut self.effect {
+            RuleEffect::DriveParameter { parameter, expression } => {
+                visit(parameter, false);
+                visit(expression, true);
+            }
+            RuleEffect::ParameterRange { parameter, minimum, maximum } => {
+                visit(parameter, false);
+                visit(minimum, true);
+                visit(maximum, true);
+            }
+            RuleEffect::AllowParameterValues { parameter, expressions } => {
+                visit(parameter, false);
+                for e in expressions {
+                    visit(e, true);
+                }
+            }
+            _ => {}
+        }
+    }
+    pub fn references_features(&self, ids: &[u64]) -> bool {
+        fn condition(c: &RuleCondition, ids: &[u64]) -> bool {
+            match c {
+                RuleCondition::Suppression { feature, .. } => ids.contains(feature),
+                RuleCondition::All { conditions } | RuleCondition::Any { conditions } => conditions.iter().any(|c| condition(c, ids)),
+                RuleCondition::Not { condition: c } => condition(c, ids),
+                _ => false,
+            }
+        }
+        condition(&self.condition, ids) || matches!(&self.effect,RuleEffect::DriveSuppression {feature,..} if ids.contains(feature))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::ConfigRow;
+    fn design() -> Document {
+        let mut doc = Document::new("Rules");
+        doc.set_param("width", "10 mm", None, None).unwrap();
+        doc.set_param("depth", "5 mm", None, None).unwrap();
+        doc.configs.columns = vec![Column::Param("width".into()), Column::Param("depth".into())];
+        doc.configs.rows.push(ConfigRow { name: "Default".into(), cells: vec!["10 mm".into(), "5 mm".into()] });
+        doc
+    }
+    fn rule(id: &str, condition: RuleCondition, effect: RuleEffect) -> ConfigRule {
+        ConfigRule { id: id.into(), name: id.into(), enabled: true, length_unit: None, condition, effect }
+    }
+    #[test]
+    fn ordered_rules_derive_values_without_overwriting_rows() {
+        let mut doc = design();
+        doc.configs.rules = vec![
+            rule("first", RuleCondition::Always, RuleEffect::DriveParameter { parameter: "width".into(), expression: "1 in".into() }),
+            rule(
+                "second",
+                RuleCondition::Parameter { parameter: "width".into(), operator: RuleOperator::Gt, expression: "20 mm".into() },
+                RuleEffect::DriveParameter { parameter: "depth".into(), expression: "width / 2".into() },
+            ),
+        ];
+        let source = doc.configs.rows.clone();
+        let trace = doc.apply_configuration_with_trace("Default").unwrap();
+        assert!(trace.iter().all(|entry| entry.matched));
+        assert!((doc.param_values().0["depth"].v - 12.7).abs() < 1e-9);
+        assert_eq!(doc.configs.rows, source);
+        assert!(doc.configuration_matches());
+        doc.configs.rules.swap(0, 1);
+        let trace = doc.apply_configuration_with_trace("Default").unwrap();
+        assert!(!trace[0].matched);
+        assert_eq!(doc.param_values().0["depth"].v, 5.0);
+    }
+    #[test]
+    fn restrictions_intersect_and_fail_atomically_with_named_rule() {
+        let mut doc = design();
+        doc.configs.rules = vec![
+            rule(
+                "range",
+                RuleCondition::Always,
+                RuleEffect::ParameterRange { parameter: "width".into(), minimum: "5 mm".into(), maximum: "1 in".into() },
+            ),
+            rule(
+                "choices",
+                RuleCondition::Always,
+                RuleEffect::AllowParameterValues { parameter: "width".into(), expressions: vec!["1 cm".into(), "20 mm".into()] },
+            ),
+        ];
+        doc.apply_configuration("Default").unwrap();
+        doc.configs.rows[0].cells[0] = "15 mm".into();
+        let before = doc.clone();
+        assert!(doc.apply_configuration("Default").unwrap_err().to_string().contains("choices"));
+        assert_eq!(doc, before);
+        doc.configs.rules[0].effect = RuleEffect::ParameterRange { parameter: "width".into(), minimum: "1 deg".into(), maximum: "90 deg".into() };
+        assert!(doc.apply_configuration("Default").is_err());
+    }
+    #[test]
+    fn rule_references_follow_rename_and_prevent_delete() {
+        let mut doc = design();
+        doc.configs.rules.push(rule(
+            "derive",
+            RuleCondition::Parameter { parameter: "width".into(), operator: RuleOperator::Ge, expression: "depth".into() },
+            RuleEffect::DriveParameter { parameter: "depth".into(), expression: "width / 2".into() },
+        ));
+        assert!(doc.remove_param("width").is_err());
+        doc.rename_param("width", "span").unwrap();
+        let refs = doc.configs.rules[0].parameter_references();
+        assert!(refs.contains(&"span".into()));
+        assert!(!refs.contains(&"width".into()));
+        doc.apply_configuration("Default").unwrap();
+        assert_eq!(doc.param_values().0["depth"].v, 5.0);
+    }
+    #[test]
+    fn angle_and_unitless_comparisons_keep_their_dimensions() {
+        let mut doc = design();
+        doc.set_param("angle", "45 deg", Some("deg"), None).unwrap();
+        doc.set_param("count", "1", Some(""), None).unwrap();
+        doc.configs.columns.push(Column::Param("count".into()));
+        doc.configs.rows[0].cells.push("1".into());
+        doc.configs.rules.push(rule(
+            "angle-drive",
+            RuleCondition::Parameter { parameter: "angle".into(), operator: RuleOperator::Gt, expression: "1".into() },
+            RuleEffect::DriveParameter { parameter: "count".into(), expression: "2".into() },
+        ));
+        let trace = doc.apply_configuration_with_trace("Default").unwrap();
+        assert!(trace[0].matched);
+        assert_eq!(doc.param_values().0["count"].v, 2.0);
+        doc.configs.rules[0].condition =
+            RuleCondition::Parameter { parameter: "count".into(), operator: RuleOperator::Eq, expression: "1 deg".into() };
+        let before = doc.clone();
+        assert!(doc.apply_configuration("Default").is_err());
+        assert_eq!(doc, before);
+    }
+
+    #[test]
+    fn saved_rule_budgets_are_checked_before_deserialization() {
+        let valid = serde_json::to_value(rule(
+            "r",
+            RuleCondition::Always,
+            RuleEffect::DriveParameter { parameter: "width".into(), expression: "2 mm".into() },
+        ))
+        .unwrap();
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":[valid.clone()]}})).is_ok());
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":null}})).is_err());
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":vec![valid.clone();129]}})).is_err());
+        let mut condition = serde_json::json!({"type":"always"});
+        for _ in 0..8 {
+            condition = serde_json::json!({"type":"not","condition":condition});
+        }
+        let mut deep = valid.clone();
+        deep["condition"] = condition;
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":[deep]}})).is_err());
+        let mut wide = valid.clone();
+        wide["condition"] = serde_json::json!({"type":"all","conditions":vec![serde_json::json!({"type":"always"});64]});
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":[wide]}})).is_err());
+        let mut long = valid.clone();
+        long["effect"]["expression"] = serde_json::json!("a".repeat(4097));
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":[long]}})).is_err());
+        let mut malformed = valid;
+        malformed["condition"] = serde_json::json!({"type":"any","conditions":{}});
+        assert!(validate_rules_json(&serde_json::json!({"configs":{"rules":[malformed]}})).is_err());
+    }
+
+    #[test]
+    fn compound_conditions_short_circuit_guarded_numeric_expressions() {
+        let mut doc = design();
+        doc.set_param("count", "0", Some(""), None).unwrap();
+        let guard = RuleCondition::Parameter { parameter: "count".into(), operator: RuleOperator::Gt, expression: "0".into() };
+        let invalid_when_zero = RuleCondition::Parameter { parameter: "count".into(), operator: RuleOperator::Gt, expression: "1 / count".into() };
+        doc.configs.rules = vec![rule(
+            "guarded",
+            RuleCondition::All { conditions: vec![guard, invalid_when_zero.clone()] },
+            RuleEffect::DriveParameter { parameter: "width".into(), expression: "20 mm".into() },
+        )];
+        assert!(!doc.apply_configuration_with_trace("Default").unwrap()[0].matched);
+        assert_eq!(doc.param_values().0["width"].v, 10.0);
+        doc.configs.rules[0].condition = RuleCondition::Any {
+            conditions: vec![
+                RuleCondition::Parameter { parameter: "count".into(), operator: RuleOperator::Eq, expression: "0".into() },
+                invalid_when_zero,
+            ],
+        };
+        assert!(doc.apply_configuration_with_trace("Default").unwrap()[0].matched);
+        assert_eq!(doc.param_values().0["width"].v, 20.0);
+    }
+
+    #[test]
+    fn saved_documents_reject_malformed_deep_and_oversized_rules_before_typed_decode() {
+        let valid = serde_json::to_value(rule(
+            "r",
+            RuleCondition::Always,
+            RuleEffect::DriveParameter { parameter: "width".into(), expression: "2 mm".into() },
+        ))
+        .unwrap();
+        let mut deep = valid.clone();
+        let mut condition = serde_json::json!({"type":"always"});
+        for _ in 0..8 {
+            condition = serde_json::json!({"type":"not","condition":condition});
+        }
+        deep["condition"] = condition;
+        let mut wide = valid.clone();
+        wide["condition"] = serde_json::json!({"type":"all","conditions":vec![serde_json::json!({"type":"always"});64]});
+        let mut invalid_context = valid.clone();
+        invalid_context["length_unit"] = serde_json::json!("mile".repeat(1000));
+        for invalid in [
+            Value::Null,
+            serde_json::json!([deep]),
+            serde_json::json!([wide]),
+            serde_json::json!(vec![valid; 129]),
+            serde_json::json!([invalid_context]),
+        ] {
+            let mut saved = serde_json::to_value(design()).unwrap();
+            saved["configs"]["rules"] = invalid;
+            let error = crate::format::read(&saved.to_string()).unwrap_err().to_string();
+            assert!(error.contains("configuration rules"), "saved boundary must report bounded rule validation: {error}");
+        }
+    }
+
+    #[test]
+    fn cross_unit_effective_literals_keep_declared_drive_cycle_checks() {
+        let mut doc = Document::new("Cross-unit drive graph");
+        doc.add_feature(
+            crate::FeatureKind::Box {
+                corner: ["0".into(), "0".into(), "0".into()],
+                length: "10 mm".into(),
+                width: "5 mm".into(),
+                height: "10 mm".into(),
+                operation: crate::Operation::NewBody,
+            },
+            None,
+        )
+        .unwrap();
+        let width = doc.features[0].param_names[0].clone();
+        let depth = doc.features[0].param_names[1].clone();
+        doc.rename_param(&width, "width").unwrap();
+        doc.rename_param(&depth, "depth").unwrap();
+        doc.configs.columns = vec![Column::Param("width".into()), Column::Param("depth".into())];
+        doc.configs.rows.push(ConfigRow { name: "Default".into(), cells: vec!["10 mm".into(), "5 mm".into()] });
+        doc.units = "in".into();
+        let mut first =
+            rule("first", RuleCondition::Always, RuleEffect::DriveParameter { parameter: "width".into(), expression: "depth + 1".into() });
+        first.length_unit = Some("mm".into());
+        let mut second =
+            rule("second", RuleCondition::Always, RuleEffect::DriveParameter { parameter: "depth".into(), expression: "width + 1".into() });
+        second.length_unit = Some("mm".into());
+        doc.configs.rules = vec![first];
+        doc.apply_configuration("Default").unwrap();
+        assert_eq!(doc.config_current(&Column::Param("width".into())).as_deref(), Some("6 mm"));
+        doc.configs.rules.push(second);
+        let before = doc.clone();
+        assert!(doc.apply_configuration("Default").is_err());
+        assert_eq!(doc, before);
+    }
+}

crates/doc/src/config_shell_tests.rs

@@ -0,0 +1,580 @@
+use super::*;
+use crate::{FeatureKind, Model, PlaneRef};
+use serde_json::json;
+use solvecraft_geom::{Vec2, Vec3};
+
+fn shell_document() -> (Document, u64, u64) {
+    let mut doc = Document::new("certified shell");
+    doc.set_param("width", "20", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    let base = doc
+        .add_feature(
+            serde_json::from_value(json!({"type":"box","corner":[0,0,0],"length":"width","width":"12","height":"10"})).unwrap(),
+            Some("Case"),
+        )
+        .unwrap();
+    doc.feature_mut(base).unwrap().body_names = vec!["Case".into()];
+    let shell = doc
+        .add_feature(
+            FeatureKind::Shell {
+                faces: vec![Vec3::new(5., 6., 10.)],
+                thickness: "wall".into(),
+                body: Some("Case".into()),
+                direction: "inside".into(),
+                tangent_chain: false,
+            },
+            Some("Shell"),
+        )
+        .unwrap();
+    (doc, base, shell)
+}
+
+fn face_index(body: &ModelBody, inner: bool) -> usize {
+    body.body
+        .face_sources()
+        .unwrap()
+        .iter()
+        .position(|source| {
+            matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { inner: current, source, .. })
+            if *current == inner && matches!(source.as_ref(), solvecraft_kernel::FaceSource::Box { axis:0,high:true,.. }))
+        })
+        .unwrap()
+}
+
+#[test]
+fn shell_planar_raw_bounds_flat_identity_and_clone_remap() {
+    let plane = solvecraft_geom::Plane::XY;
+    let same = |planes: &[Option<solvecraft_geom::Plane>]| super::super::styles::shell_plane_family(planes.iter().copied());
+    assert!(same(&[Some(plane), Some(plane)]));
+    assert!(!same(&[]));
+    assert!(!same(&[Some(plane), None]));
+    for different in [
+        solvecraft_geom::Plane { origin: Vec3::X, ..plane },
+        solvecraft_geom::Plane { x: -plane.x, y: -plane.y, ..plane },
+        solvecraft_geom::Plane { y: -plane.y, ..plane },
+    ] {
+        assert!(!same(&[Some(plane), Some(different)]));
+    }
+    let valid = json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"extrude_side","sketch":2,"curve":"c4"},"inner":true});
+    assert!(validate_certificate_json(&valid).is_ok());
+    let mut certificate: FaceCertificate = serde_json::from_value(valid.clone()).unwrap();
+    certificate.remap_features(&[(2, 20), (3, 30)].into_iter().collect());
+    assert_eq!(serde_json::to_value(&certificate).unwrap()["source_producer"], 30);
+    assert_eq!(serde_json::to_value(&certificate).unwrap()["source"]["sketch"], 20);
+    for bad in [
+        json!({"kind":"shell_planar","source_producer":0,"source":{"kind":"box","axis":0,"high":true},"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":null,"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":valid,"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"extrude_side","sketch":2,"curve":"x".repeat(1_000_000)},"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"box","axis":0,"high":true,"extra":[[[]]]},"inner":false}),
+    ] {
+        assert!(validate_certificate_json(&bad).is_err());
+    }
+}
+
+#[test]
+fn shell_planar_anchor_rebuild_cold_geometry_and_missing_source_errors() {
+    let (mut doc, base, shell) = shell_document();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|result| result.error.is_none()), "{:?}", model.results);
+    let state = model.state();
+    let body = state.body("Case").unwrap();
+    let outer = doc.strong_face_target(body, face_index(body, false), Vec3::default()).unwrap();
+    let outer_matches: Vec<_> = body.body.face_sources().unwrap().iter().enumerate().filter_map(|(index, source)| {
+        matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { inner: false, source, .. }) if matches!(source.as_ref(), solvecraft_kernel::FaceSource::Box { axis: 0, high: true, .. })).then_some((index, body.body.face_plane(index)))
+    }).collect();
+    assert_eq!(outer_matches.len(), 1, "outer support must be one physical face: {outer_matches:?}");
+    assert!(super::super::styles::shell_plane_family(outer_matches.iter().map(|(_, plane)| *plane)));
+    let outer_plane = body.body.face_plane(face_index(body, false)).unwrap();
+    let outer_anchor = doc.capture_face_anchor(body, face_index(body, false), &outer_plane, &[], 0, &[]).unwrap();
+    let projected = crate::project::resolve_anchored_face(&doc, &state, &outer_plane, solvecraft_sketch::LinkKind::Project, &outer_anchor).unwrap();
+    let mut linked = solvecraft_sketch::Sketch::new();
+    let link = linked.add_link(solvecraft_sketch::LinkKind::Project, projected.source, &projected.geom).unwrap();
+    assert!(!linked.update_link(&link, &projected.geom).unwrap());
+    let inner_index = face_index(body, true);
+    let inner = doc.strong_face_target(body, inner_index, Vec3::default()).unwrap();
+    assert_ne!(outer.key(), inner.key());
+    assert!(matches!(&inner.certificate, Some(FaceCertificate::ShellPlanar { source_producer,inner:true,.. }) if *source_producer==base));
+    assert_eq!(inner.origin_feature, shell);
+    let picked = body.body.face_plane(inner_index).unwrap();
+    assert!((picked.origin.x - 18.).abs() < 1e-8);
+    let anchor = doc.capture_face_anchor(body, inner_index, &picked, &[], 0, &[]).unwrap();
+    let mut sketch = solvecraft_sketch::Sketch::new();
+    let points: Vec<_> =
+        [(2., 2.), (4., 2.), (4., 4.), (2., 4.)].into_iter().map(|(x, y)| sketch.add_point(Vec2::new(x, y), None).unwrap()).collect();
+    for edge in 0..4 {
+        sketch.add_line_pts(points[edge], points[(edge + 1) % 4], None).unwrap();
+    }
+    let sk = doc
+        .add_feature(
+            FeatureKind::Sketch {
+                plane: PlaneRef::Face { plane: picked, at: picked.origin, name: None, anchor: Some(Box::new(anchor.clone())) },
+                sketch,
+            },
+            Some("Inner face sketch"),
+        )
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"2"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Face boss"),
+        )
+        .unwrap();
+    model.evaluate(&doc);
+    let before = model.state().bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    doc.set_param("width", "30", Some("mm"), None).unwrap();
+    doc.set_param("wall", "3", Some("mm"), None).unwrap();
+    model.evaluate(&doc);
+    let changed = model.state();
+    let plane = doc.resolve_face_anchor(&anchor, 0, &changed).unwrap();
+    assert!((plane.origin.x - 27.).abs() < 1e-8);
+    let after = changed.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    assert!((solvecraft_kernel::measure(&changed.bodies.iter().find(|body| body.feature == boss).unwrap().body).unwrap().volume - 8.).abs() < 1e-8);
+    assert!((doc.resolve_face_anchor(&outer_anchor, 0, &changed).unwrap().origin.x - 30.).abs() < 1e-8);
+    let changed_outer_plane = doc.resolve_face_anchor(&outer_anchor, 0, &changed).unwrap();
+    let refreshed =
+        crate::project::resolve_anchored_face(&doc, &changed, &changed_outer_plane, solvecraft_sketch::LinkKind::Project, &outer_anchor).unwrap();
+    assert!(!linked.update_link(&link, &refreshed.geom).unwrap(), "same exterior boundary must retain projected IDs");
+    assert!((after.min.x - before.min.x - 9.).abs() < 1e-8, "{before:?} -> {after:?}");
+    assert!((after.max.x - before.max.x - 9.).abs() < 1e-8, "{before:?} -> {after:?}");
+    assert!((after.min.y - before.min.y).abs() < 1e-8 && (after.min.z - before.min.z).abs() < 1e-8);
+    let saved = doc.to_json();
+    assert!(saved.contains("solvecraft/13"));
+    let loaded = crate::format::read(&saved).unwrap();
+    let mut cold = Model::new();
+    cold.evaluate(&loaded);
+    let cold_state = cold.state();
+    let cold_bounds = cold_state.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    assert!(after.min.dist(cold_bounds.min) < 1e-9 && after.max.dist(cold_bounds.max) < 1e-9);
+    assert!(loaded.resolve_face_anchor(&anchor, 0, &cold_state).unwrap().origin.dist(plane.origin) < 1e-9);
+    let mut wrong = anchor.clone();
+    wrong.target.origin_feature = base;
+    assert!(doc.resolve_face_anchor(&wrong, 0, &changed).is_err());
+    let mut wrong_source = anchor.clone();
+    if let Some(FaceCertificate::ShellPlanar { source_producer, .. }) = &mut wrong_source.target.certificate {
+        *source_producer = shell;
+    }
+    assert!(doc.resolve_face_anchor(&wrong_source, 0, &changed).is_err());
+    doc.feature_mut(shell).unwrap().suppressed = true;
+    model.evaluate(&doc);
+    let lost = model.state();
+    assert!(doc.resolve_face_anchor(&anchor, 0, &lost).is_err());
+    assert!(!lost.bodies.iter().any(|body| body.feature == boss), "lost attachment must prevent downstream geometry");
+}
+
+#[test]
+fn shell_planar_format13_keeps_v12_documents_and_refuses_future() {
+    let (doc, _, _) = shell_document();
+    let mut legacy: serde_json::Value = serde_json::from_str(&doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/12");
+    let loaded = crate::format::read(&legacy.to_string()).unwrap();
+    let mut current: serde_json::Value = serde_json::from_str(&loaded.to_json()).unwrap();
+    assert_eq!(current["format"], "solvecraft/13");
+    current["format"] = json!("solvecraft/12");
+    assert_eq!(legacy, current, "identity migration must preserve every prior field");
+    legacy["format"] = json!("solvecraft/14");
+    assert!(crate::format::read(&legacy.to_string()).is_err());
+}
+
+#[test]
+fn regularized_shell_keeps_legacy_and_explicit_single_face_projections_closed() {
+    let (mut doc, _, _) = shell_document();
+    let mut model = Model::new();
+    for (width, wall) in [(20., 2.), (30., 3.)] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for state in [model.state(), cold.state()] {
+            let body = state.body("Case").unwrap();
+            let index = face_index(body, false);
+            let mesh = body.mesh();
+            assert_eq!(body.body.face_sources().unwrap().iter().filter(|source|matches!(source,Some(solvecraft_kernel::FaceSource::ShellPlanar {inner:false,source,..}) if matches!(source.as_ref(),solvecraft_kernel::FaceSource::Box {axis:0,high:true,..}))).count(),1,"no physical outer-wall strip face may remain");
+            let plane = body.body.face_plane(index).unwrap();
+            let point = mesh
+                .triangles
+                .iter()
+                .zip(&mesh.tri_face)
+                .find_map(|(tri, face)| (*face as usize == index).then(|| mesh.tri(tri)).flatten())
+                .map(|[a, b, c]| (a + b + c) / 3.)
+                .unwrap();
+            let source = solvecraft_sketch::LinkSource::Face { body: "Case".into(), at: point };
+            let (values, _) = doc.param_values();
+            let legacy = crate::project::resolve(&doc, &values, &state, &plane, solvecraft_sketch::LinkKind::Project, &source).unwrap();
+            let explicit = crate::project::resolve_face_indices(&state, &plane, solvecraft_sketch::LinkKind::Project, "Case", &[index]).unwrap();
+            assert_eq!(legacy.geom, explicit.geom);
+            assert_eq!(explicit.geom.len(), 4, "raw planar piece keeps all four edges");
+            let mut sketch = solvecraft_sketch::Sketch::new();
+            let link = sketch.add_link(solvecraft_sketch::LinkKind::Project, source, &legacy.geom).unwrap();
+            sketch.links[0].face_name = Some(crate::naming::face_names(body)[index].clone());
+            let warnings = crate::project::refresh_links(&doc, &values, &state, &plane, &mut sketch);
+            assert!(warnings.is_empty(), "{warnings:?}");
+            assert!(!sketch.links[0].lost);
+            assert!(!sketch.update_link(&link, &explicit.geom).unwrap());
+        }
+    }
+}
+
+#[test]
+fn saved_former_strip_projection_reports_lost_without_expanding_healthy_material() {
+    let (mut doc, _, shell) = shell_document();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    let state = model.state();
+    let body = state.body("Case").unwrap();
+    let index = face_index(body, false);
+    let plane = body.body.face_plane(index).unwrap();
+    let stem = crate::naming::face_names(body)[index].clone();
+    assert_eq!(crate::naming::strip_piece(&stem), stem);
+    // Reconstruct the original raw shell before certificate stamping/regularization,
+    // and run the unchanged historical naming/capture path on its actual strip.
+    let before = model.state_before(shell);
+    // Legacy Shell did not propagate construction certificates. Omit transient
+    // metadata here; operand paint also disables new wall-run coalescence so
+    // this control retains the actual historical raw pieces.
+    let raw_source = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(20., 12., 10.)).unwrap().with_paint(Some(solvecraft_kernel::Paint {
+        opacity: 1.,
+        faces: vec![solvecraft_kernel::FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }],
+    }));
+    let raw = solvecraft_kernel::shell(&raw_source, &[Vec3::new(5., 6., 10.)], 2.).unwrap();
+    let mut old_body = ModelBody::new("Case".into(), raw, shell);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(shell).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let former = crate::naming::face_name_at_body(&old_body, Vec3::new(20., 6., 1.)).unwrap();
+    assert_eq!(former, format!("{stem}#1"), "historical actual strip capture records full piece name");
+    let mut sketch = solvecraft_sketch::Sketch::new();
+    let corners = [Vec2::new(0., 0.), Vec2::new(12., 0.), Vec2::new(12., 2.), Vec2::new(0., 2.)];
+    let geometry: Vec<_> = (0..4).map(|i| solvecraft_sketch::LinkGeom::Line(corners[i], corners[(i + 1) % 4])).collect();
+    sketch
+        .add_link(
+            solvecraft_sketch::LinkKind::Project,
+            solvecraft_sketch::LinkSource::Face { body: "Case".into(), at: Vec3::new(20., 6., 1.) },
+            &geometry,
+        )
+        .unwrap();
+    sketch.links[0].face_name = Some(former.clone());
+    let original = sketch.clone();
+    let sk = doc
+        .add_feature(
+            FeatureKind::Sketch { plane: PlaneRef::Face { plane, at: Vec3::new(20., 6., 1.), name: Some(former), anchor: None }, sketch },
+            Some("Saved strip sketch"),
+        )
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Saved strip profile material"),
+        )
+        .unwrap();
+    let mut legacy: serde_json::Value = serde_json::from_str(&doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/12");
+    let mut doc = crate::format::read(&legacy.to_string()).unwrap();
+    for width in [20., 30.] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", "3", Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for current in [&model, &cold] {
+            let warning = current.results.iter().find(|r| r.id == sk).unwrap().warning.as_deref().unwrap();
+            assert!(warning.contains("no longer exists; last geometry retained"), "{warning}");
+            let state = current.state();
+            let solved = state.sketch(sk).unwrap();
+            assert!(solved.sketch.links[0].lost);
+            assert_eq!(solved.sketch.curves, original.curves);
+            assert_eq!(solved.sketch.points, original.points);
+            let material = state.bodies.iter().find(|body| body.feature == boss).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&material.body).unwrap().volume - 24.).abs() < 1e-8,
+                "old24mm3 profile must not silently become120mm3 wall profile"
+            );
+            let bounds = material.mesh().bounds();
+            assert!((bounds.min.x - width).abs() < 1e-8 && (bounds.max.x - width - 1.).abs() < 1e-8);
+            assert!((bounds.max.y - 12.).abs() < 1e-8 && (bounds.max.z - 2.).abs() < 1e-8);
+        }
+    }
+}
+
+#[test]
+fn saved_curved_strip_projection_is_lost_after_exact_wall_coalescence() {
+    use solvecraft_kernel::{FacePaint, Paint};
+    use solvecraft_sketch::{LinkKind, LinkSource, Sketch};
+    let mut doc = Document::new("saved curved strip");
+    doc.set_param("width", "80", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    let base = doc
+        .add_feature(
+            serde_json::from_value(json!({"type":"box","corner":["-width/2",-30,0],"length":"width","width":"60","height":"30"})).unwrap(),
+            Some("Case"),
+        )
+        .unwrap();
+    doc.feature_mut(base).unwrap().body_names = vec!["Case".into()];
+    doc.add_feature(
+        serde_json::from_value(json!({"type":"fillet","body":"Case","edges":[[40,30,15],[-40,30,15],[-40,-30,15],[40,-30,15]],"radius":"6"}))
+            .unwrap(),
+        Some("Corners"),
+    )
+    .unwrap();
+    let shell = doc
+        .add_feature(
+            FeatureKind::Shell {
+                faces: vec![Vec3::new(0., 0., 30.)],
+                thickness: "wall".into(),
+                body: Some("Case".into()),
+                direction: "inside".into(),
+                tangent_chain: false,
+            },
+            Some("Shell"),
+        )
+        .unwrap();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|r| r.error.is_none()), "{:?}", model.results);
+    let before = model.state_before(shell);
+    // Per-face paint disables the construction optimization: this control keeps
+    // the real pre-repair slab faces without forging a name or source witness.
+    let old_source = before
+        .body("Case")
+        .unwrap()
+        .body
+        .clone()
+        .with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] }));
+    let cavity_box = solvecraft_kernel::box_solid(Vec3::new(-38., -28., 2.), Vec3::new(38., 28., 35.)).unwrap();
+    let cavity = solvecraft_kernel::fillet(
+        &cavity_box,
+        &[Vec3::new(38., 28., 15.), Vec3::new(-38., 28., 15.), Vec3::new(-38., -28., 15.), Vec3::new(38., -28., 15.)],
+        4.,
+    )
+    .unwrap();
+    let raw = solvecraft_kernel::boolean(&old_source, &cavity, solvecraft_kernel::BoolOp::Cut).unwrap().unwrap();
+    let mut old_body = ModelBody::new("Case".into(), raw, shell);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(shell).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let t = std::f64::consts::FRAC_1_SQRT_2;
+    let at = Vec3::new(34. + 6. * t, 24. + 6. * t, 1.);
+    let former = crate::naming::face_name_at_body(&old_body, at).unwrap();
+    let stem = crate::naming::strip_piece(&former).to_string();
+    assert_ne!(former, stem, "actual old cylindrical strip must have a piece suffix");
+    let state = model.state();
+    let current = state.body("Case").unwrap();
+    let names = crate::naming::face_names(current);
+    let index = names.iter().position(|name| name == &stem).unwrap();
+    assert!(current.body.face_was_coalesced(index));
+    assert!(current.body.face_plane(index).is_none(), "witness grants no planar attachment authority");
+    assert!(old_body.body.face_sources().is_none_or(|sources| sources.iter().enumerate().all(|(index, _)| !old_body.body.face_was_coalesced(index))));
+    let mut old_state = (*model.state()).clone();
+    old_state.bodies = vec![old_body];
+    let source = LinkSource::Face { body: "Case".into(), at };
+    // Recover the saved projection from the old face's complete raw topology.
+    // Display seam suppression must not discard a historical strip boundary.
+    let old_body = old_state.body("Case").unwrap();
+    let old_index = crate::naming::face_on_body(old_body, &former, at).unwrap().0;
+    let mesh = old_body.mesh();
+    let mut geometry = Vec::new();
+    for (index, faces) in mesh.edge_faces.iter().enumerate() {
+        if !faces.contains(&(old_index as u32)) {
+            continue;
+        }
+        let points = &mesh.edges[index];
+        let a = solvecraft_geom::Plane::YZ.to_local(*points.first().unwrap());
+        let b = solvecraft_geom::Plane::YZ.to_local(*points.last().unwrap());
+        let (a, b) = (Vec2::new(a.x, a.y), Vec2::new(b.x, b.y));
+        assert!(a.dist(b) > 1e-6);
+        for point in points {
+            let q = solvecraft_geom::Plane::YZ.to_local(*point);
+            let q = Vec2::new(q.x, q.y);
+            let direction = b - a;
+            let t = ((q - a).dot(direction) / direction.dot(direction)).clamp(0., 1.);
+            assert!(q.dist(a + direction * t) < 1e-7, "exact cylindrical quadrant projects to a straight support");
+        }
+        geometry.push(solvecraft_sketch::LinkGeom::Line(a, b));
+    }
+    assert_eq!(geometry.len(), 4, "historical curved strip has a complete four-edge rectangular projection");
+    let mut sketch = Sketch::new();
+    sketch.add_link(LinkKind::Project, source, &geometry).unwrap();
+    sketch.links[0].face_name = Some(former);
+    let original = sketch.clone();
+    let sk = doc
+        .add_feature(FeatureKind::Sketch { plane: PlaneRef::Custom { plane: solvecraft_geom::Plane::YZ }, sketch }, Some("Saved corner strip"))
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Retained strip material"),
+        )
+        .unwrap();
+    for (width, wall) in [(80., 2.), (100., 3.)] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for current in [&model, &cold] {
+            let result = current.results.iter().find(|r| r.id == sk).unwrap();
+            assert!(result.error.is_none());
+            assert!(result.warning.as_deref().unwrap().contains("no longer exists; last geometry retained"));
+            let state = current.state();
+            let solved = state.sketch(sk).unwrap();
+            assert!(solved.sketch.links[0].lost);
+            assert_eq!(solved.sketch.points, original.points);
+            assert_eq!(solved.sketch.curves, original.curves);
+            let material = state.bodies.iter().find(|body| body.feature == boss).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&material.body).unwrap().volume - 12.).abs() < 1e-7,
+                "two-mm strip cannot expand to a full thirty-mm wall"
+            );
+        }
+    }
+}
+
+#[test]
+fn saved_stepped_tab_cut_piece_projection_is_lost_without_expanding_material() {
+    use solvecraft_kernel::{BoolOp, FacePaint, Paint};
+    use solvecraft_sketch::{LinkKind, LinkSource, Sketch};
+    let mut doc = Document::new("public stepped tab case");
+    doc.set_param("length", "40", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    for (name, kind) in [
+        ("Case", json!({"type":"box","corner":[0,0,0],"length":"length","width":"30","height":"20"})),
+        ("Tab", json!({"type":"box","corner":["length",10,12],"length":"8","width":"10","height":"8"})),
+    ] {
+        let id = doc.add_feature(serde_json::from_value(kind).unwrap(), Some(name)).unwrap();
+        doc.feature_mut(id).unwrap().body_names = vec![name.into()];
+    }
+    doc.add_feature(
+        FeatureKind::Combine { target: "Case".into(), tools: vec!["Tab".into()], operation: crate::Operation::Join, keep_tools: false },
+        None,
+    )
+    .unwrap();
+    let tool = doc
+        .add_feature(
+            serde_json::from_value(
+                json!({"type":"box","corner":["wall","wall","wall"],"length":"length-2*wall","width":"30-2*wall","height":"22-wall"}),
+            )
+            .unwrap(),
+            Some("Pocket tool"),
+        )
+        .unwrap();
+    doc.feature_mut(tool).unwrap().body_names = vec!["Pocket tool".into()];
+    let cut = doc
+        .add_feature(
+            FeatureKind::Combine { target: "Case".into(), tools: vec!["Pocket tool".into()], operation: crate::Operation::Cut, keep_tools: false },
+            Some("Pocket"),
+        )
+        .unwrap();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|r| r.error.is_none()), "{:?}", model.results);
+    let before = model.state_before(cut);
+    // A real per-face paint control preserves the former slab construction;
+    // no historical names or geometry are fabricated.
+    let old_stock = before
+        .body("Case")
+        .unwrap()
+        .body
+        .clone()
+        .with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] }));
+    let old_cut = solvecraft_kernel::boolean(&old_stock, &before.body("Pocket tool").unwrap().body, BoolOp::Cut).unwrap().unwrap();
+    let mut old_body = ModelBody::new("Case".into(), old_cut, cut);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(cut).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let at = Vec3::new(0., 15., 1.);
+    let former = crate::naming::face_name_at_body(&old_body, at).unwrap();
+    assert_ne!(former, crate::naming::strip_piece(&former), "actual former bounded wall patch has a full piece name");
+    let index = crate::naming::face_on_body(&old_body, &former, at).unwrap().0;
+    let mut old_state = crate::ModelState::default();
+    old_state.bodies.push(old_body);
+    let plane = solvecraft_geom::Plane::YZ;
+    let resolved = crate::project::resolve_face_indices(&old_state, &plane, LinkKind::Project, "Case", &[index]).unwrap();
+    let current_state = model.state();
+    let current = current_state.body("Case").unwrap();
+    let stem = crate::naming::strip_piece(&former);
+    let current_names = crate::naming::face_names(current);
+    let merged = current_names.iter().position(|name| name == stem).unwrap();
+    assert!(current.body.face_was_coalesced(merged), "new exact generated-wall construction supplies the loss-only witness");
+    assert!(!current_names.contains(&former));
+    let mut sketch = Sketch::new();
+    sketch.add_link(LinkKind::Project, LinkSource::Face { body: "Case".into(), at }, &resolved.geom).unwrap();
+    sketch.links[0].face_name = Some(former);
+    let original = sketch.clone();
+    let captured = original.points.iter().filter(|p| p.link.is_some()).map(|p| p.pos).collect::<Vec<_>>();
+    assert_eq!(captured.len(), 4);
+    assert!(captured.iter().all(|p| (p.x == 10. || p.x == 20.) && (p.y == 0. || p.y == 20.)));
+    let sk = doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Custom { plane }, sketch }, Some("Saved wall patch")).unwrap();
+    let material = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Saved band stock"),
+        )
+        .unwrap();
+    for (length, wall) in [(40., 2.), (50., 3.)] {
+        doc.set_param("length", &length.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let reopened = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&reopened);
+        for current in [&model, &cold] {
+            let result = current.results.iter().find(|r| r.id == sk).unwrap();
+            assert!(result.error.is_none(), "{result:?}");
+            assert!(result.warning.as_deref().is_some_and(|w| w.contains("no longer exists; last geometry retained")), "{result:?}");
+            let state = current.state();
+            let saved = state.sketch(sk).unwrap();
+            assert!(saved.sketch.links[0].lost);
+            assert_eq!(saved.sketch.points, original.points);
+            assert_eq!(saved.sketch.curves, original.curves);
+            let stock = state.bodies.iter().find(|b| b.feature == material).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&stock.body).unwrap().volume - 200.).abs() < 1e-7,
+                "saved10x20 patch must not become30x20 wall; actualvolume={}, bounds={:?}, originalpoints={:?}",
+                solvecraft_kernel::measure(&stock.body).unwrap().volume,
+                stock.mesh().bounds(),
+                original.points
+            );
+            let case = state.body("Case").unwrap();
+            let expected = length * 30. * 20. + 8. * 10. * 8. - (length - 2. * wall) * (30. - 2. * wall) * (20. - wall);
+            assert!((solvecraft_kernel::measure(&case.body).unwrap().volume - expected).abs() < 1e-6);
+        }
+    }
+}

crates/doc/src/config_styles.rs

@@ -0,0 +1,341 @@
+//! Stable configuration style targets. Display indices and placement names are never saved.
+use super::Column;
+use crate::{DocError, Document, FeatureKind, ModelState, Result};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use solvecraft_geom::Vec3;
+
+pub(crate) fn shell_plane_family(planes: impl IntoIterator<Item = Option<solvecraft_geom::Plane>>) -> bool {
+    let mut planes = planes.into_iter();
+    let Some(Some(first)) = planes.next() else { return false };
+    first.origin.is_finite() && first.x.is_finite() && first.y.is_finite() && planes.all(|plane| plane == Some(first))
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConfigFaceTarget {
+    pub body: String,
+    pub origin_feature: u64,
+    pub name: String,
+    /// Definition-frame point for diagnostics and rendering; never a resolver fallback.
+    pub point: Vec3,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub certificate: Option<super::FaceCertificate>,
+}
+impl ConfigFaceTarget {
+    pub fn key(&self) -> String {
+        // Length-prefix encoding keeps punctuation in body/name unambiguous.
+        format!("{}:{}{}", self.body.len(), self.body, self.name)
+    }
+    pub fn matches(&self, face: &crate::appearance::FaceLook) -> bool {
+        face.body == self.body && face.name.as_ref().is_some_and(|name| crate::naming::strip_piece(name) == self.name)
+    }
+    pub fn validate(&self) -> Result<()> {
+        if let Some(certificate) = &self.certificate {
+            certificate.validate()?;
+        }
+        if self.body.is_empty()
+            || self.body.len() > 128
+            || self.name.is_empty()
+            || self.name.len() > 512
+            || self.origin_feature == 0
+            || [self.point.x, self.point.y, self.point.z].iter().any(|v| !v.is_finite() || v.abs() > 1e9)
+        {
+            return Err(DocError::Invalid("invalid configuration face target".into()));
+        }
+        Ok(())
+    }
+}
+
+pub fn validate_face_target_json(target: &Value) -> Result<()> {
+    let fields = target.as_object().ok_or_else(|| DocError::Invalid("face target must be an object".into()))?;
+    if !(4..=5).contains(&fields.len())
+        || fields.keys().any(|key| !["body", "origin_feature", "name", "point", "certificate"].contains(&key.as_str()))
+        || fields.get("body").and_then(Value::as_str).is_none_or(|body| body.is_empty() || body.len() > 128)
+        || fields.get("name").and_then(Value::as_str).is_none_or(|name| name.is_empty() || name.len() > 512)
+        || fields.get("origin_feature").and_then(Value::as_u64).is_none_or(|id| id == 0)
+        || fields.get("point").and_then(Value::as_array).is_none_or(|point| {
+            point.len() != 3 || point.iter().any(|value| value.as_f64().is_none_or(|value| !value.is_finite() || value.abs() > 1e9))
+        })
+    {
+        return Err(DocError::Invalid("invalid or oversized configuration face target".into()));
+    }
+    if let Some(certificate) = fields.get("certificate") {
+        super::validate_certificate_json(certificate)?;
+    }
+    Ok(())
+}
+
+/// Budget malformed style nodes before decoding their typed representation.
+pub fn validate_styles_json(value: &Value) -> Result<()> {
+    if let Some(columns) = value.get("configs").and_then(|v| v.get("columns")).and_then(Value::as_array) {
+        if columns.len() > super::MAX_COLUMNS {
+            return Err(DocError::Invalid("too many configuration columns".into()));
+        }
+        for column in columns {
+            if let Some(target) = column.get("face_appearance") {
+                validate_face_target_json(target)?;
+            }
+            if let Some(id) = column.get("component_appearance")
+                && id.as_u64().is_none_or(|id| id == 0)
+            {
+                return Err(DocError::Invalid("configuration component ID must be nonzero".into()));
+            }
+        }
+    }
+    if let Some(faces) = value.get("appearances").and_then(|value| value.get("faces")).and_then(Value::as_array) {
+        for face in faces {
+            if let Some(certificate) = face.get("certificate") {
+                super::validate_certificate_json(certificate)?;
+                if !certificate.is_null()
+                    && (face.get("strict_name").and_then(Value::as_bool) != Some(true)
+                        || face.get("body").and_then(Value::as_str).is_none_or(|body| body.is_empty() || body.len() > 128)
+                        || face.get("name").and_then(Value::as_str).is_none_or(|name| name.is_empty() || name.len() > 512)
+                        || face.get("point").and_then(Value::as_array).is_none_or(|point| {
+                            point.len() != 3 || point.iter().any(|value| value.as_f64().is_none_or(|value| !value.is_finite() || value.abs() > 1e9))
+                        }))
+                {
+                    return Err(DocError::Invalid("invalid certified face appearance".into()));
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+impl Document {
+    pub(crate) fn flat_certificate_producer_matches(&self, producer: u64, certificate: &super::FaceCertificate) -> bool {
+        use super::FaceCertificate;
+        let Some(feature) = self.feature(producer) else { return false };
+        match (certificate, &feature.kind) {
+            (FaceCertificate::Box { .. }, FeatureKind::Box { operation: crate::Operation::NewBody, .. }) => true,
+            (FaceCertificate::ExtrudeCap { sketch, .. }, FeatureKind::Extrude { sketch: current, extent, operation: crate::Operation::NewBody, .. }) => sketch == current && extent.taper.is_none(),
+            (FaceCertificate::ExtrudeSide { sketch, curve }, FeatureKind::Extrude { sketch: current, extent, operation: crate::Operation::NewBody, .. }) => {
+                sketch == current && extent.taper.is_none()
+                    && self.feature(*sketch).is_some_and(|feature| matches!(&feature.kind, FeatureKind::Sketch { sketch, .. } if sketch.curves.iter().any(|candidate| candidate.id == *curve && !candidate.construction && matches!(candidate.kind, solvecraft_sketch::CurveKind::Line { .. } | solvecraft_sketch::CurveKind::Circle { .. } | solvecraft_sketch::CurveKind::Arc { .. }))))
+            }
+            (FaceCertificate::Imported { .. }, FeatureKind::Import { .. }) => true,
+            _ => false,
+        }
+    }
+    /// Certify named generator lineage; generic index-derived naming is unsupported.
+    pub fn certify_config_face(&self, target: &ConfigFaceTarget) -> Result<()> {
+        target.validate()?;
+        let prefix = format!("F{}:", target.origin_feature);
+        let role = target.name.strip_prefix(&prefix).ok_or_else(|| DocError::Invalid("face lineage does not match its feature".into()))?;
+        if crate::naming::strip_piece(&target.name) != target.name {
+            return Err(DocError::Invalid("configure a face lineage, not a numbered split piece".into()));
+        }
+        let feature = self.feature(target.origin_feature).ok_or_else(|| DocError::Unknown("face origin feature is gone".into()))?;
+        if let Some(certificate) = &target.certificate {
+            let valid = match (certificate, &feature.kind) {
+                (super::FaceCertificate::Box { axis, high }, FeatureKind::Box { operation: crate::Operation::NewBody, .. }) => {
+                    ["x", "y", "z"].get(*axis as usize).is_some_and(|axis| role == format!("{}{axis}", if *high { "+" } else { "-" }))
+                }
+                (super::FaceCertificate::ExtrudeCap { sketch, high, outer, holes }, FeatureKind::Extrude { sketch: producer_sketch, extent, operation: crate::Operation::NewBody, .. }) => {
+                    sketch == producer_sketch && extent.taper.is_none()
+                        && role == format!("cap:{}:{}", if *high { "high" } else { "low" }, super::cap_key(outer, holes))
+                }
+                (super::FaceCertificate::ExtrudeSide { sketch, curve }, FeatureKind::Extrude { sketch: producer_sketch, extent, operation: crate::Operation::NewBody, .. }) => {
+                    sketch == producer_sketch && extent.taper.is_none() && role == format!("side:{curve}")
+                        && self.feature(*sketch).is_some_and(|feature| matches!(&feature.kind, FeatureKind::Sketch { sketch, .. } if sketch.curves.iter().any(|candidate| candidate.id == *curve && !candidate.construction && matches!(candidate.kind, solvecraft_sketch::CurveKind::Line { .. } | solvecraft_sketch::CurveKind::Circle { .. } | solvecraft_sketch::CurveKind::Arc { .. }))))
+                }
+                (super::FaceCertificate::Imported { .. }, FeatureKind::Import { .. }) => role.strip_prefix("face:").is_some_and(|index| index.parse::<usize>().is_ok()),
+                (super::FaceCertificate::ShellPlanar { source_producer, source, inner }, FeatureKind::Shell { .. }) => {
+                    *source_producer != target.origin_feature
+                        && self.flat_certificate_producer_matches(*source_producer, source)
+                        && super::shell_certificate_role(source, *inner).is_ok_and(|expected| role == expected)
+                }
+                _ => false,
+            };
+            return if valid { Ok(()) } else { Err(DocError::Invalid("face certificate no longer matches its producer".into())) };
+        }
+        let valid = match &feature.kind {
+            FeatureKind::Box { .. } => ["+x", "-x", "+y", "-y", "+z", "-z"].contains(&role),
+            FeatureKind::Cylinder { .. } => ["top", "bottom", "side"].contains(&role),
+            // Curved side lineage currently uses centroid/nearest-curve heuristics;
+            // certify caps only until the naming layer supplies proven curve provenance.
+            FeatureKind::Extrude { extent, .. } => {
+                extent.from.is_none()
+                    && extent.start_offset.as_deref().is_none_or(|value| {
+                        crate::expr::is_literal(value)
+                            && crate::expr::eval_with(value, &|name| Err(DocError::Unknown(name.into())))
+                                .ok()
+                                .and_then(|value| value.to_kind(crate::expr::Kind::Length).ok())
+                                .is_some_and(|value| value.abs() < 1e-12)
+                    })
+                    && extent.distance2.is_none()
+                    && ["start", "top", "bottom"].contains(&role)
+            }
+            FeatureKind::Revolve { angle2, symmetric, .. } => angle2.is_none() && !symmetric && ["start", "end"].contains(&role),
+            _ => false,
+        };
+        if !valid {
+            return Err(DocError::Invalid("this face has no supported stable semantic lineage".into()));
+        }
+        Ok(())
+    }
+    /// Verify the current named pieces describe one surface, not ambiguous generated roles.
+    pub fn configuration_face_indices(&self, body: &crate::ModelBody, target: &ConfigFaceTarget) -> Result<Vec<usize>> {
+        self.certify_config_face(target)?;
+        if body.body.is_mesh() || body.definition_name() != target.body {
+            return Err(DocError::Invalid("configured face definition does not match".into()));
+        }
+        if let Some(super::FaceCertificate::ShellPlanar { source_producer, source, inner }) = &target.certificate {
+            let indices: Vec<_> = body.body.face_sources().into_iter().flatten().enumerate().filter_map(|(index, current)| {
+                matches!(current, Some(solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), source: current_source, inner: current_inner, .. }) if *producer == target.origin_feature && inner == current_inner && super::flat_source_matches(source, current_source, *source_producer)).then_some(index)
+            }).collect();
+            // A shell can split one original support into several pieces. All pieces
+            // must retain the same canonical frame, not merely lie on a common plane.
+            if !shell_plane_family(indices.iter().map(|index| body.body.face_plane(*index))) {
+                return Err(DocError::Unknown("shell planar face certificate is missing or ambiguous".into()));
+            }
+            return Ok(indices);
+        }
+        if matches!(target.certificate, Some(super::FaceCertificate::Box { .. } | super::FaceCertificate::ExtrudeCap { .. })) {
+            let indices: Vec<_> = body
+                .body
+                .face_sources()
+                .into_iter()
+                .flatten()
+                .enumerate()
+                .filter_map(|(index, source)| {
+                    let matched = match (&target.certificate, source) {
+                        (
+                            Some(super::FaceCertificate::Box { axis, high }),
+                            Some(solvecraft_kernel::FaceSource::Box { producer: Some(producer), axis: current_axis, high: current_high, .. }),
+                        ) => *producer == target.origin_feature && axis == current_axis && high == current_high,
+                        (
+                            Some(super::FaceCertificate::ExtrudeCap { sketch, high, outer, holes }),
+                            Some(solvecraft_kernel::FaceSource::CertifiedExtrudeCap {
+                                producer,
+                                sketch: current_sketch,
+                                high: current_high,
+                                outer: current_outer,
+                                holes: current_holes,
+                                ..
+                            }),
+                        ) => {
+                            *producer == target.origin_feature
+                                && sketch == current_sketch
+                                && high == current_high
+                                && outer == current_outer
+                                && holes == current_holes
+                        }
+                        _ => false,
+                    };
+                    matched.then_some(index)
+                })
+                .collect();
+            if indices.len() != 1 {
+                return Err(DocError::Unknown("attached planar face certificate is missing or ambiguous".into()));
+            }
+            return Ok(indices);
+        }
+        if let Some(super::FaceCertificate::ExtrudeSide { sketch, curve }) = &target.certificate {
+            let indices: Vec<_> = body.body.face_sources().into_iter().flatten().enumerate().filter_map(|(index, source)| {
+                matches!(source, Some(solvecraft_kernel::FaceSource::CertifiedExtrudeSide { producer, sketch: current_sketch, curve: current_curve, .. }) if *producer == target.origin_feature && current_sketch == sketch && current_curve == curve).then_some(index)
+            }).collect();
+            if indices.is_empty() {
+                return Err(DocError::Unknown("constructed side certificate no longer exists".into()));
+            }
+            return Ok(indices);
+        }
+        if let Some(super::FaceCertificate::Imported { payload_sha256, item, face }) = &target.certificate {
+            let indices: Vec<_> = body.body.face_sources().into_iter().flatten().enumerate().filter_map(|(index, source)| {
+                matches!(source, Some(solvecraft_kernel::FaceSource::Imported { item: current_item, face: current_face, payload_sha256: Some(digest), producer: Some(producer) }) if current_item == item && current_face == face && digest == payload_sha256 && *producer == target.origin_feature).then_some(index)
+            }).collect();
+            if indices.is_empty() {
+                return Err(DocError::Unknown("immutable import face certificate no longer exists".into()));
+            }
+            return Ok(indices);
+        }
+        let names = crate::naming::face_names(body);
+        let indices: Vec<usize> =
+            names.iter().enumerate().filter(|(_, name)| crate::naming::strip_piece(name) == target.name).map(|(index, _)| index).collect();
+        if indices.is_empty() {
+            return Err(DocError::Unknown(format!("configured face `{}` on `{}` no longer exists", target.name, target.body)));
+        }
+        if let Some(certificate) = &target.certificate {
+            for index in &indices {
+                if self.configuration_face_certificate(body, *index)?.as_ref() != Some(certificate) {
+                    return Err(DocError::Invalid("face pieces do not share the exact certified source".into()));
+                }
+            }
+            return Ok(indices);
+        }
+        if target.name.ends_with(":side") {
+            if indices.len() != 1 {
+                return Err(DocError::Invalid("split curved face lineage is not yet certified".into()));
+            }
+            return Ok(indices);
+        }
+        // Caps and box faces must share an oriented plane. This rejects generic cap-role
+        // collisions while permitting the coplanar pieces of a split supported face.
+        let mesh = body.mesh();
+        let mut plane: Option<(Vec3, Vec3)> = None;
+        for (triangle, face) in mesh.triangles.iter().zip(&mesh.tri_face) {
+            if indices.binary_search(&(*face as usize)).is_err() {
+                continue;
+            }
+            let Some([a, b, c]) = mesh.tri(triangle) else { continue };
+            let Some(normal) = (b - a).cross(c - a).normalized() else { continue };
+            if let Some((point, base)) = plane {
+                let magnitude = [point.x, point.y, point.z, a.x, a.y, a.z, b.x, b.y, b.z, c.x, c.y, c.z]
+                    .iter()
+                    .fold(body.body.size(), |scale, value| scale.max(value.abs()));
+                let tolerance = (magnitude * f64::EPSILON * 128.0).max(1e-7);
+                if normal.dot(base) < 1.0 - 1e-6 || [a, b, c].iter().any(|vertex| (*vertex - point).dot(base).abs() > tolerance) {
+                    return Err(DocError::Invalid("face lineage names more than one oriented surface".into()));
+                }
+            } else {
+                plane = Some((a, normal));
+            }
+        }
+        if plane.is_none() {
+            return Err(DocError::Invalid("configured face has no valid surface".into()));
+        }
+        Ok(indices)
+    }
+    pub fn config_face_look(&self, target: &ConfigFaceTarget) -> Option<crate::appearance::Look> {
+        self.appearances.faces.iter().rev().find(|face| target.matches(face)).map(|face| face.look.clone())
+    }
+    /// Validate against the final rebuilt definition state. Missing names never pick nearby faces.
+    pub fn configuration_style_status(&self, state: &ModelState) -> Result<Vec<serde_json::Value>> {
+        let mut result = Vec::new();
+        for column in &self.configs.columns {
+            match column {
+                Column::ComponentAppearance(id) => {
+                    let component =
+                        self.components.iter().find(|c| c.id == *id).ok_or_else(|| DocError::Unknown(format!("component {id} is gone")))?;
+                    result.push(serde_json::json!({"key":self.config_key(column),"target":component.name,"shared":true,"dormant":false}));
+                }
+                Column::FaceAppearance(target) => {
+                    self.certify_config_face(target)?;
+                    let dormant = match state.body(&target.body) {
+                        None if self.feature(target.origin_feature).is_some_and(|feature| feature.suppressed) => true,
+                        None => return Err(DocError::Unknown(format!("configured face body `{}` is gone", target.body))),
+                        Some(body) => {
+                            self.configuration_face_indices(body, target)?;
+                            false
+                        }
+                    };
+                    result.push(serde_json::json!({"key":self.config_key(column),"target":format!("{} / {}",target.body,target.name),"shared":true,"dormant":dormant}));
+                }
+                _ => {}
+            }
+        }
+        Ok(result)
+    }
+    /// Maintain columns and row cell alignment when component definitions are deleted.
+    pub fn remove_configuration_components(&mut self, ids: &[u64]) {
+        let keep: Vec<bool> = self.configs.columns.iter().map(|c| !matches!(c,Column::ComponentAppearance(id) if ids.contains(id))).collect();
+        let mut mask = keep.iter();
+        self.configs.columns.retain(|_| mask.next().copied().unwrap_or(false));
+        for row in &mut self.configs.rows {
+            let mut mask = keep.iter();
+            row.cells.retain(|_| mask.next().copied().unwrap_or(false));
+        }
+        self.appearances.components.retain(|id, _| !ids.contains(id));
+    }
+}

crates/doc/src/construct.rs

@@ -0,0 +1,657 @@
+//! Construction geometry from the model: references to vertices, edges, faces, planes, axes,
+//! points and sketch entities, resolved on each evaluation, and the axes, points and planes
+//! built from them (Fusion's CONSTRUCT panel).
+//!
+//! Face and edge references carry the persistent name of what was picked (see `naming`), so
+//! they follow the model when earlier features change; the picked point is the fallback.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+use solvecraft_geom::{Plane, Vec2, Vec3};
+use solvecraft_kernel::{self as kernel, FaceSurface};
+
+use crate::eval::{ModelBody, ModelState};
+use crate::expr::{Kind, Value};
+use crate::{DocError, Document, PlaneRef, Result};
+
+/// Something picked to build construction geometry from.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum GeoRef {
+    /// A fixed point.
+    Point { p: Vec3 },
+    /// The design origin.
+    Origin,
+    /// A body vertex (the one nearest `at`).
+    Vertex { at: Vec3 },
+    /// A body edge: the one named `name`, else the one nearest `at`.
+    Edge {
+        at: Vec3,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        name: Option<String>,
+    },
+    /// A body face: the one named `name`, else the one at `at`.
+    Face {
+        at: Vec3,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        name: Option<String>,
+    },
+    /// A plane (origin, construction, offset…).
+    Plane { plane: PlaneRef },
+    /// World X, Y or Z axis.
+    World { axis: String },
+    /// A construction axis feature, by name.
+    Axis { name: String },
+    /// A construction point feature, by name.
+    ConstructPoint { name: String },
+    /// A sketch point (by sketch feature id and point id).
+    SketchPoint { sketch: u64, point: String },
+    /// A sketch curve (by sketch feature id and curve id).
+    SketchCurve { sketch: u64, curve: String },
+}
+
+/// How a construction axis is defined.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum AxisDef {
+    /// The axis of a cylinder, cone or torus face (or a circular edge).
+    ThroughFace { face: GeoRef },
+    /// Perpendicular to a face, through a point (projected onto the face).
+    NormalToFace { face: GeoRef, point: GeoRef },
+    /// Where two planes meet.
+    TwoPlanes { a: GeoRef, b: GeoRef },
+    /// Through two points.
+    TwoPoints { a: GeoRef, b: GeoRef },
+    /// Along a straight edge (or sketch line).
+    Edge { edge: GeoRef },
+}
+
+/// How a construction point is defined.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum PointDef {
+    /// At a vertex, sketch point or fixed point.
+    At { point: GeoRef },
+    /// Where two edges (lines) meet, or come closest.
+    TwoEdges { a: GeoRef, b: GeoRef },
+    /// Where three planes meet.
+    ThreePlanes { a: GeoRef, b: GeoRef, c: GeoRef },
+    /// The centre of a circular edge, a sphere or a torus.
+    Center { of: GeoRef },
+    /// Where an edge (line) crosses a plane.
+    EdgeAndPlane { edge: GeoRef, plane: GeoRef },
+    /// At a fraction `t` (0…1) of the way along an edge or sketch curve.
+    AlongPath { path: GeoRef, t: String },
+}
+
+/// Resolved construction geometry, kept in the model state by feature.
+#[derive(Clone, Debug, PartialEq)]
+pub enum ConstructGeom {
+    Plane(Plane),
+    Axis { origin: Vec3, dir: Vec3 },
+    Point(Vec3),
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Construct {
+    pub feature: u64,
+    pub name: String,
+    pub geom: ConstructGeom,
+}
+
+/// Everything a reference needs to be resolved.
+pub(crate) struct Ctx<'a> {
+    pub doc: &'a Document,
+    pub vals: &'a BTreeMap<String, Value>,
+    pub st: &'a ModelState,
+    /// How deep the plane resolution that led here already is. A plane built from model
+    /// geometry resolves its sides through the document again, so the count has to continue
+    /// across that hop; restarting it lets a plane that refers to itself recurse forever.
+    pub depth: usize,
+}
+
+fn bad(m: impl Into<String>) -> DocError {
+    DocError::Invalid(m.into())
+}
+
+fn bodies(st: &ModelState) -> impl Iterator<Item = &ModelBody> {
+    st.bodies.iter().filter(|b| !b.body.is_mesh())
+}
+
+fn construct<'a>(st: &'a ModelState, name: &str) -> Result<&'a ConstructGeom> {
+    st.construct.iter().find(|c| c.name == name).map(|c| &c.geom).ok_or_else(|| DocError::Unknown(format!("construction `{name}`")))
+}
+
+/// The face picked: (body, face index, point on it).
+fn face_of<'a>(st: &'a ModelState, at: Vec3, name: &Option<String>) -> Result<(&'a ModelBody, usize, Vec3)> {
+    let at = match name.as_deref().and_then(|n| crate::naming::point_on_face(st, n, at)) {
+        Some((q, _)) => q,
+        None => at,
+    };
+    for b in bodies(st) {
+        if let Some(fi) = crate::appearance::face_index_at(b, at) {
+            return Ok((b, fi, at));
+        }
+    }
+    Err(bad(format!("no face at {at:?}")))
+}
+
+/// The edge picked, as a polyline.
+fn edge_points(st: &ModelState, at: Vec3, name: &Option<String>) -> Result<Vec<Vec3>> {
+    let mut at = at;
+    if let Some(n) = name {
+        for b in bodies(st) {
+            if let Ok((q, _)) = crate::naming::find_edge(b, n, at) {
+                at = q;
+                break;
+            }
+        }
+    }
+    let mut best: Option<(f64, Vec<Vec3>)> = None;
+    for b in bodies(st) {
+        let tol = (b.body.size() * 1e-3).max(1e-3);
+        let Ok(edges) = b.body.edges(tol) else { continue };
+        for e in edges {
+            let d = e.points.windows(2).map(|w| at.dist_to_segment(w[0], w[1])).fold(f64::MAX, f64::min);
+            if best.as_ref().is_none_or(|(bd, _)| d < *bd) {
+                best = Some((d, e.points));
+            }
+        }
+    }
+    match best {
+        Some((d, pts)) if pts.len() >= 2 && d <= 1e-3 + 1e-2 * pts.iter().fold(0.0, |m: f64, p| m.max(p.len())).max(1.0) => Ok(pts),
+        _ => Err(bad(format!("no edge at {at:?}"))),
+    }
+}
+
+/// A polyline that is straight: its line.
+fn as_line(pts: &[Vec3]) -> Option<(Vec3, Vec3)> {
+    let (a, b) = (*pts.first()?, *pts.last()?);
+    let d = (b - a).normalized()?;
+    let len = (b - a).len();
+    pts.iter().all(|p| p.dist_to_segment(a, b) <= len * 1e-6 + 1e-9).then_some((a, d))
+}
+
+/// A polyline on a circle: (centre, unit normal, radius).
+fn as_circle(pts: &[Vec3]) -> Option<(Vec3, Vec3, f64)> {
+    let n = pts.len();
+    if n < 4 {
+        return None;
+    }
+    let (a, b, c) = (*pts.first()?, *pts.get(n / 3)?, *pts.get(2 * n / 3)?);
+    let (ab, ac) = (b - a, c - a);
+    let nrm = ab.cross(ac);
+    let l2 = nrm.len2();
+    if l2 < 1e-24 {
+        return None;
+    }
+    // Circumcentre of abc.
+    let centre = a + (nrm.cross(ab) * ac.len2() + ac.cross(nrm) * ab.len2()) * (1.0 / (2.0 * l2));
+    let r = (a - centre).len();
+    let unit = nrm.normalized()?;
+    pts.iter()
+        .all(|p| ((*p - centre).len() - r).abs() <= r * 1e-3 + 1e-6 && (*p - centre).dot(unit).abs() <= r * 1e-3 + 1e-6)
+        .then_some((centre, unit, r))
+}
+
+fn sketch_world(ctx: &Ctx, sketch: u64, q: Vec2) -> Result<Vec3> {
+    let ss = ctx.st.sketch(sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
+    Ok(ss.plane.to_world(q))
+}
+
+fn sketch_curve_points(ctx: &Ctx, sketch: u64, curve: &str) -> Result<Vec<Vec3>> {
+    let ss = ctx.st.sketch(sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
+    let ci = ss.sketch.curve_index(curve).ok_or_else(|| DocError::Unknown(format!("curve `{curve}`")))?;
+    let pl = ss.sketch.polyline(ci);
+    if pl.len() < 2 {
+        return Err(bad(format!("curve `{curve}` has no length")));
+    }
+    Ok(pl.into_iter().map(|q| ss.plane.to_world(q)).collect())
+}
+
+/// A reference as a point.
+pub(crate) fn point(ctx: &Ctx, g: &GeoRef) -> Result<Vec3> {
+    match g {
+        GeoRef::Point { p } => Ok(*p),
+        GeoRef::Origin => Ok(Vec3::ZERO),
+        GeoRef::Vertex { at } => {
+            let mut best: Option<(f64, Vec3)> = None;
+            for b in bodies(ctx.st) {
+                let tol = (b.body.size() * 1e-3).max(1e-3);
+                let Ok(edges) = b.body.edges(tol) else { continue };
+                for v in edges.iter().flat_map(|e| [e.points.first().copied(), e.points.last().copied()]).flatten() {
+                    let d = v.dist(*at);
+                    if best.is_none_or(|(bd, _)| d < bd) {
+                        best = Some((d, v));
+                    }
+                }
+            }
+            best.map(|(_, v)| v).ok_or_else(|| bad("there is no vertex"))
+        }
+        GeoRef::ConstructPoint { name } => match construct(ctx.st, name)? {
+            ConstructGeom::Point(p) => Ok(*p),
+            _ => Err(bad(format!("`{name}` is not a point"))),
+        },
+        GeoRef::SketchPoint { sketch, point } => {
+            let ss = ctx.st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
+            let q =
+                ss.sketch.point_index(point).and_then(|i| ss.sketch.point(i)).ok_or_else(|| DocError::Unknown(format!("sketch point `{point}`")))?;
+            sketch_world(ctx, *sketch, q)
+        }
+        // A round edge or face: its centre.
+        GeoRef::Edge { .. } | GeoRef::Face { .. } | GeoRef::SketchCurve { .. } => centre(ctx, g),
+        _ => Err(bad("pick a point, vertex or sketch point")),
+    }
+}
+
+/// A reference as a line (origin, unit direction).
+pub(crate) fn line(ctx: &Ctx, g: &GeoRef) -> Result<(Vec3, Vec3)> {
+    match g {
+        GeoRef::Edge { at, name } => {
+            let pts = edge_points(ctx.st, *at, name)?;
+            as_line(&pts).or_else(|| as_circle(&pts).map(|(c, n, _)| (c, n))).ok_or_else(|| bad("the edge is neither straight nor circular"))
+        }
+        GeoRef::SketchCurve { sketch, curve } => {
+            let pts = sketch_curve_points(ctx, *sketch, curve)?;
+            as_line(&pts).ok_or_else(|| bad(format!("sketch curve `{curve}` is not a line")))
+        }
+        GeoRef::World { axis } => {
+            let d = match axis.to_ascii_uppercase().as_str() {
+                "X" => Vec3::X,
+                "Y" => Vec3::Y,
+                "Z" => Vec3::Z,
+                _ => return Err(DocError::Unknown(format!("axis `{axis}`"))),
+            };
+            Ok((Vec3::ZERO, d))
+        }
+        GeoRef::Axis { name } => match construct(ctx.st, name)? {
+            ConstructGeom::Axis { origin, dir } => Ok((*origin, *dir)),
+            _ => Err(bad(format!("`{name}` is not an axis"))),
+        },
+        GeoRef::Face { at, name } => {
+            let (b, fi, _) = face_of(ctx.st, *at, name)?;
+            match kernel::face_surface(&b.body, fi) {
+                Some(FaceSurface::Cylinder { origin, axis, .. }) => Ok((origin, axis)),
+                Some(FaceSurface::Cone { apex, axis, .. }) => Ok((apex, axis)),
+                Some(FaceSurface::Torus { center, axis, .. }) => Ok((center, axis)),
+                _ => Err(bad("the face is not a cylinder, cone or torus")),
+            }
+        }
+        _ => Err(bad("pick an edge, line or axis")),
+    }
+}
+
+/// A reference as a plane.
+pub(crate) fn plane(ctx: &Ctx, g: &GeoRef) -> Result<Plane> {
+    match g {
+        GeoRef::Plane { plane } => ctx.doc.resolve_plane_in(ctx.vals, plane, ctx.depth + 1, Some(ctx.st)),
+        GeoRef::Face { at, name } => {
+            let (b, fi, q) = face_of(ctx.st, *at, name)?;
+            match kernel::face_surface(&b.body, fi) {
+                Some(FaceSurface::Plane { normal, point }) => {
+                    let o = q - normal * (q - point).dot(normal);
+                    Plane::from_normal(o, normal).ok_or_else(|| bad("degenerate face"))
+                }
+                _ => Err(bad("the face is not planar")),
+            }
+        }
+        _ => Err(bad("pick a plane or planar face")),
+    }
+}
+
+/// The centre of a round edge, sketch circle, sphere or torus.
+fn centre(ctx: &Ctx, g: &GeoRef) -> Result<Vec3> {
+    match g {
+        GeoRef::Edge { at, name } => {
+            let pts = edge_points(ctx.st, *at, name)?;
+            as_circle(&pts).map(|(c, _, _)| c).ok_or_else(|| bad("the edge is not circular"))
+        }
+        GeoRef::SketchCurve { sketch, curve } => {
+            let pts = sketch_curve_points(ctx, *sketch, curve)?;
+            as_circle(&pts).map(|(c, _, _)| c).ok_or_else(|| bad(format!("sketch curve `{curve}` is not a circle or arc")))
+        }
+        GeoRef::Face { at, name } => {
+            let (b, fi, _) = face_of(ctx.st, *at, name)?;
+            match kernel::face_surface(&b.body, fi) {
+                Some(FaceSurface::Sphere { center, .. }) | Some(FaceSurface::Torus { center, .. }) => Ok(center),
+                _ => Err(bad("the face is not a sphere or torus")),
+            }
+        }
+        _ => Err(bad("pick a circular edge, a sphere or a torus")),
+    }
+}
+
+/// Point and unit tangent at fraction `t` along a polyline.
+fn along(pts: &[Vec3], t: f64) -> Option<(Vec3, Vec3)> {
+    let total: f64 = pts.windows(2).map(|w| (w[1] - w[0]).len()).sum();
+    if !(total > 0.0) {
+        return None;
+    }
+    let mut left = t.clamp(0.0, 1.0) * total;
+    for w in pts.windows(2) {
+        let l = (w[1] - w[0]).len();
+        if l <= 0.0 {
+            continue;
+        }
+        if left <= l {
+            return Some((w[0] + (w[1] - w[0]) * (left / l), (w[1] - w[0]) * (1.0 / l)));
+        }
+        left -= l;
+    }
+    let (a, b) = (pts.get(pts.len() - 2)?, pts.last()?);
+    Some((*b, (*b - *a).normalized()?))
+}
+
+fn path_points(ctx: &Ctx, g: &GeoRef) -> Result<Vec<Vec3>> {
+    match g {
+        GeoRef::Edge { at, name } => edge_points(ctx.st, *at, name),
+        GeoRef::SketchCurve { sketch, curve } => sketch_curve_points(ctx, *sketch, curve),
+        _ => Err(bad("pick an edge or sketch curve as the path")),
+    }
+}
+
+/// The surface's unit normal at (the point of the surface nearest) `p`, and that point.
+fn surface_normal(s: FaceSurface, p: Vec3) -> Option<(Vec3, Vec3)> {
+    match s {
+        FaceSurface::Plane { normal, point } => Some((p - normal * (p - point).dot(normal), normal)),
+        FaceSurface::Cylinder { origin, axis, radius } => {
+            let w = p - origin;
+            let r = (w - axis * w.dot(axis)).normalized()?;
+            Some((origin + axis * w.dot(axis) + r * radius, r))
+        }
+        FaceSurface::Sphere { center, radius } => {
+            let r = (p - center).normalized()?;
+            Some((center + r * radius, r))
+        }
+        FaceSurface::Cone { apex, axis, half_angle } => {
+            let w = p - apex;
+            let radial = (w - axis * w.dot(axis)).normalized()?;
+            // The generator through p's side, and the normal square to it in the axial plane.
+            let line = axis * half_angle.cos() + radial * half_angle.sin();
+            let n = (radial * half_angle.cos() - axis * half_angle.sin()).normalized()?;
+            Some((apex + line * w.dot(line), n))
+        }
+        FaceSurface::Torus { center, axis, major, minor } => {
+            let w = p - center;
+            let radial = (w - axis * w.dot(axis)).normalized()?;
+            let tube = center + radial * major;
+            let n = (p - tube).normalized()?;
+            Some((tube + n * minor, n))
+        }
+    }
+}
+
+fn face_surface_at(ctx: &Ctx, g: &GeoRef) -> Result<(FaceSurface, Vec3)> {
+    match g {
+        GeoRef::Face { at, name } => {
+            let (b, fi, q) = face_of(ctx.st, *at, name)?;
+            kernel::face_surface(&b.body, fi).map(|s| (s, q)).ok_or_else(|| bad("the face's surface is not a plane, cylinder, cone, sphere or torus"))
+        }
+        GeoRef::Plane { .. } => {
+            let pl = plane(ctx, g)?;
+            Ok((FaceSurface::Plane { normal: pl.normal(), point: pl.origin }, pl.origin))
+        }
+        _ => Err(bad("pick a face")),
+    }
+}
+
+/// Where two planes meet.
+fn plane_plane(a: &Plane, b: &Plane) -> Option<(Vec3, Vec3)> {
+    let (n1, n2) = (a.normal(), b.normal());
+    let d = n1.cross(n2);
+    let l2 = d.len2();
+    if l2 < 1e-18 {
+        return None;
+    }
+    let (h1, h2) = (n1.dot(a.origin), n2.dot(b.origin));
+    let o = (n2.cross(d) * h1 + d.cross(n1) * h2) * (1.0 / l2);
+    Some((o, d.normalized()?))
+}
+
+/// Closest points of two lines: their midpoint (where they meet, if they do).
+fn line_line(a: (Vec3, Vec3), b: (Vec3, Vec3)) -> Option<Vec3> {
+    let ((p, u), (q, v)) = (a, b);
+    let w = p - q;
+    let (uu, uv, vv, uw, vw) = (u.dot(u), u.dot(v), v.dot(v), u.dot(w), v.dot(w));
+    let den = uu * vv - uv * uv;
+    if den.abs() < 1e-12 {
+        return None;
+    }
+    let s = (uv * vw - vv * uw) / den;
+    let t = (uu * vw - uv * uw) / den;
+    Some(((p + u * s) + (q + v * t)) * 0.5)
+}
+
+pub(crate) fn resolve_axis(ctx: &Ctx, d: &AxisDef) -> Result<(Vec3, Vec3)> {
+    match d {
+        AxisDef::ThroughFace { face } => line(ctx, face),
+        AxisDef::Edge { edge } => {
+            let (o, dir) = line(ctx, edge)?;
+            if let GeoRef::Edge { at, name } = edge
+                && as_line(&edge_points(ctx.st, *at, name)?).is_none()
+            {
+                return Err(bad("the edge is not straight"));
+            }
+            Ok((o, dir))
+        }
+        AxisDef::NormalToFace { face, point: p } => {
+            let (s, _) = face_surface_at(ctx, face)?;
+            let q = point(ctx, p)?;
+            let (on, n) = surface_normal(s, q).ok_or_else(|| bad("the point is on the face's axis"))?;
+            Ok((on, n))
+        }
+        AxisDef::TwoPlanes { a, b } => plane_plane(&plane(ctx, a)?, &plane(ctx, b)?).ok_or_else(|| bad("the planes are parallel")),
+        AxisDef::TwoPoints { a, b } => {
+            let (p, q) = (point(ctx, a)?, point(ctx, b)?);
+            Ok((p, (q - p).normalized().ok_or_else(|| bad("the two points coincide"))?))
+        }
+    }
+}
+
+pub(crate) fn resolve_point(ctx: &Ctx, d: &PointDef) -> Result<Vec3> {
+    match d {
+        PointDef::At { point: p } => point(ctx, p),
+        PointDef::Center { of } => centre(ctx, of),
+        PointDef::TwoEdges { a, b } => line_line(line(ctx, a)?, line(ctx, b)?).ok_or_else(|| bad("the edges are parallel")),
+        PointDef::ThreePlanes { a, b, c } => {
+            let (pa, pb, pc) = (plane(ctx, a)?, plane(ctx, b)?, plane(ctx, c)?);
+            let (o, dir) = plane_plane(&pa, &pb).ok_or_else(|| bad("two of the planes are parallel"))?;
+            line_plane(o, dir, &pc).ok_or_else(|| bad("the planes don't meet in a point"))
+        }
+        PointDef::EdgeAndPlane { edge, plane: p } => {
+            let (o, dir) = line(ctx, edge)?;
+            line_plane(o, dir, &plane(ctx, p)?).ok_or_else(|| bad("the edge is parallel to the plane"))
+        }
+        PointDef::AlongPath { path, t } => {
+            let t = Document::eval_in(ctx.vals, t, Kind::Unitless)?;
+            along(&path_points(ctx, path)?, t).map(|(p, _)| p).ok_or_else(|| bad("the path has no length"))
+        }
+    }
+}
+
+fn line_plane(o: Vec3, d: Vec3, p: &Plane) -> Option<Vec3> {
+    let n = p.normal();
+    let den = d.dot(n);
+    if den.abs() < 1e-12 {
+        return None;
+    }
+    Some(o + d * ((p.origin - o).dot(n) / den))
+}
+
+/// Planes built from model geometry (the `PlaneRef` kinds that need the model).
+pub(crate) fn resolve_geo_plane(ctx: &Ctx, p: &PlaneRef) -> Result<Plane> {
+    let degenerate = || bad("degenerate plane");
+    match p {
+        PlaneRef::Midplane { a, b } => {
+            let (pa, pb) = (plane(ctx, a)?, plane(ctx, b)?);
+            let (na, nb) = (pa.normal(), pb.normal());
+            if na.cross(nb).len() < 1e-9 {
+                // Parallel: halfway between, facing as the first.
+                let half = nb * ((pb.origin - pa.origin).dot(nb) * 0.5);
+                return Plane::new(pa.origin + half, pa.x, pa.y).ok_or_else(degenerate);
+            }
+            // Meeting at an angle: the plane through their line that halves the angle.
+            let (o, dir) = plane_plane(&pa, &pb).ok_or_else(degenerate)?;
+            let n = (na - nb).normalized().ok_or_else(degenerate)?;
+            Plane::new(o, dir, n.cross(dir)).ok_or_else(degenerate)
+        }
+        PlaneRef::TwoEdges { a, b } => {
+            let ((o1, d1), (o2, d2)) = (line(ctx, a)?, line(ctx, b)?);
+            let n = match d1.cross(d2).normalized() {
+                Some(n) if (o2 - o1).dot(n).abs() <= 1e-6 * (1.0 + (o2 - o1).len()) => n,
+                Some(_) => return Err(bad("the edges are not in one plane")),
+                None => d1.cross(o2 - o1).normalized().ok_or_else(|| bad("the edges are on one line"))?,
+            };
+            Plane::new(o1, d1, n.cross(d1)).ok_or_else(degenerate)
+        }
+        PlaneRef::ThreePoints { a, b, c } => {
+            let (pa, pb, pc) = (point(ctx, a)?, point(ctx, b)?, point(ctx, c)?);
+            if (pb - pa).cross(pc - pa).len() < 1e-9 {
+                return Err(bad("the three points are on one line"));
+            }
+            Plane::new(pa, pb - pa, pc - pa).ok_or_else(degenerate)
+        }
+        PlaneRef::Tangent { face, at } => {
+            let (s, _) = face_surface_at(ctx, face)?;
+            let (on, n) = surface_normal(s, *at).ok_or_else(|| bad("the point is on the face's axis"))?;
+            Plane::from_normal(on, n).ok_or_else(degenerate)
+        }
+        PlaneRef::Perpendicular { plane: base, line: l } => {
+            let pl = plane(ctx, base)?;
+            let (o, d) = line(ctx, l)?;
+            let n = d
+                .cross(pl.normal())
+                .normalized()
+                .ok_or_else(|| bad("the line is square to the plane: every plane through it is perpendicular; pick a line in or along the plane"))?;
+            Plane::new(o, d, n.cross(d)).ok_or_else(degenerate)
+        }
+        PlaneRef::AlongPath { path, t } => {
+            let t = Document::eval_in(ctx.vals, t, Kind::Unitless)?;
+            let (p, tan) = along(&path_points(ctx, path)?, t).ok_or_else(|| bad("the path has no length"))?;
+            Plane::from_normal(p, tan).ok_or_else(degenerate)
+        }
+        _ => ctx.doc.resolve_plane_in(ctx.vals, p, ctx.depth + 1, Some(ctx.st)),
+    }
+}
+
+impl GeoRef {
+    /// Map the reference's world points (component frames).
+    pub fn map_points(&mut self, pt: &mut dyn FnMut(&mut Vec3), plane: &mut dyn FnMut(&mut PlaneRef)) {
+        match self {
+            GeoRef::Point { p } => pt(p),
+            GeoRef::Vertex { at } | GeoRef::Edge { at, .. } | GeoRef::Face { at, .. } => pt(at),
+            GeoRef::Plane { plane: p } => plane(p),
+            _ => {}
+        }
+    }
+
+    /// Picked faces and edges get their persistent names (and only those still missing one).
+    pub fn name_picks(&mut self, st: &ModelState) {
+        match self {
+            GeoRef::Face { at, name: name @ None } => {
+                *name = crate::naming::face_names_at(st, &[*at]).into_iter().next().filter(|n| !n.is_empty());
+            }
+            GeoRef::Edge { at, name: name @ None } => {
+                for b in bodies(st) {
+                    let tol = (b.body.size() * 1e-3).max(1e-3);
+                    if b.body.nearest_edge(*at, tol).ok().flatten().is_some_and(|(_, d)| d <= tol * 10.0) {
+                        *name = crate::naming::edge_names_at(b, &[*at]).into_iter().next().filter(|n| !n.is_empty());
+                        break;
+                    }
+                }
+            }
+            GeoRef::Plane { plane } => plane.name_picks(st),
+            _ => {}
+        }
+    }
+}
+
+impl GeoRef {
+    fn plane_ref(&self) -> Option<&PlaneRef> {
+        match self {
+            GeoRef::Plane { plane } => Some(plane),
+            _ => None,
+        }
+    }
+}
+
+impl AxisDef {
+    pub fn refs(&self) -> Vec<&GeoRef> {
+        match self {
+            AxisDef::ThroughFace { face } => vec![face],
+            AxisDef::Edge { edge } => vec![edge],
+            AxisDef::NormalToFace { face, point } => vec![face, point],
+            AxisDef::TwoPlanes { a, b } | AxisDef::TwoPoints { a, b } => vec![a, b],
+        }
+    }
+
+    /// Planes it refers to (whose expressions it depends on).
+    pub fn planes(&self) -> Vec<&PlaneRef> {
+        self.refs().into_iter().filter_map(GeoRef::plane_ref).collect()
+    }
+
+    pub fn refs_mut(&mut self) -> Vec<&mut GeoRef> {
+        match self {
+            AxisDef::ThroughFace { face } => vec![face],
+            AxisDef::Edge { edge } => vec![edge],
+            AxisDef::NormalToFace { face, point } => vec![face, point],
+            AxisDef::TwoPlanes { a, b } | AxisDef::TwoPoints { a, b } => vec![a, b],
+        }
+    }
+}
+
+impl PointDef {
+    pub fn refs(&self) -> Vec<&GeoRef> {
+        match self {
+            PointDef::At { point } => vec![point],
+            PointDef::Center { of } => vec![of],
+            PointDef::TwoEdges { a, b } => vec![a, b],
+            PointDef::ThreePlanes { a, b, c } => vec![a, b, c],
+            PointDef::EdgeAndPlane { edge, plane } => vec![edge, plane],
+            PointDef::AlongPath { path, .. } => vec![path],
+        }
+    }
+
+    pub fn planes(&self) -> Vec<&PlaneRef> {
+        self.refs().into_iter().filter_map(GeoRef::plane_ref).collect()
+    }
+
+    pub fn refs_mut(&mut self) -> Vec<&mut GeoRef> {
+        match self {
+            PointDef::At { point } => vec![point],
+            PointDef::Center { of } => vec![of],
+            PointDef::TwoEdges { a, b } => vec![a, b],
+            PointDef::ThreePlanes { a, b, c } => vec![a, b, c],
+            PointDef::EdgeAndPlane { edge, plane } => vec![edge, plane],
+            PointDef::AlongPath { path, .. } => vec![path],
+        }
+    }
+}
+
+impl PlaneRef {
+    /// The references of a plane built from model geometry.
+    pub fn refs_mut(&mut self) -> Vec<&mut GeoRef> {
+        match self {
+            PlaneRef::Midplane { a, b } | PlaneRef::TwoEdges { a, b } => vec![a.as_mut(), b.as_mut()],
+            PlaneRef::Perpendicular { plane, line } => vec![plane.as_mut(), line.as_mut()],
+            PlaneRef::ThreePoints { a, b, c } => vec![a.as_mut(), b.as_mut(), c.as_mut()],
+            PlaneRef::Tangent { face, .. } => vec![face.as_mut()],
+            PlaneRef::AlongPath { path, .. } => vec![path.as_mut()],
+            PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => base.refs_mut(),
+            _ => Vec::new(),
+        }
+    }
+
+    pub fn name_picks(&mut self, st: &ModelState) {
+        for r in self.refs_mut() {
+            r.name_picks(st);
+        }
+    }
+
+    /// Does resolving it need the model (edges, faces, construction axes and points)?
+    pub fn needs_model(&self) -> bool {
+        let mut k = self.clone();
+        !k.refs_mut().is_empty()
+    }
+}

crates/doc/src/eval_more.rs

@@ -2,18 +2,66 @@
 //! kernel's extrude, boolean, offset and transform operations).
 
 use super::*;
+use crate::EmbossFace;
 use crate::apply_point;
+use crate::sheet;
 use solvecraft_geom::{Loop2, Seg2};
 
 pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState) -> Result<()> {
     match &f.kind {
-        FeatureKind::Emboss { sketch, profiles, depth, deboss, targets } => {
+        FeatureKind::Emboss { sketch, profiles, depth, deboss, targets, face } => {
             let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
             let regions = select_profiles(ss, profiles)?;
             let d = val(vals, depth, Kind::Length)?;
             if !(d > 0.0) {
                 return Err(DocError::Invalid("the emboss depth must be positive".into()));
             }
+            if let Some(face) = face {
+                if !targets.is_empty() && (targets.len() != 1 || targets.first() != Some(&face.body)) {
+                    return Err(DocError::Invalid("cylinder emboss must keep its selected target body".into()));
+                }
+                let i =
+                    st.bodies.iter().position(|b| b.name == face.body).ok_or_else(|| DocError::Unknown(format!("emboss body `{}`", face.body)))?;
+                let mb = st.bodies.get(i).cloned().ok_or_else(|| DocError::Invalid("emboss body".into()))?;
+                let body_frame = face.body_frame(doc, &mb)?;
+                let inverse = crate::mat_inverse(&body_frame).ok_or_else(|| DocError::Invalid("invalid cylinder body frame".into()))?;
+                let sketch_owner = doc.feature(ss.feature).map(|f| f.component).unwrap_or(0);
+                let author_frame = EmbossFace::component_frame(doc, f.component, &face.author_path)?;
+                let sketch_frame = face.sketch_frame(doc, f.component, sketch_owner, &mb)?;
+                let sketch_transform = crate::mat_mul(&inverse, &sketch_frame);
+                let plane = Plane::new(
+                    crate::apply_point(&sketch_transform, ss.plane.origin),
+                    crate::apply_vector(&sketch_transform, ss.plane.x),
+                    crate::apply_vector(&sketch_transform, ss.plane.y),
+                )
+                .ok_or_else(|| DocError::Invalid("invalid cylinder sketch frame".into()))?;
+                let mut at = crate::apply_point(&crate::mat_mul(&inverse, &author_frame), face.at);
+                let name = f
+                    .face_names
+                    .first()
+                    .filter(|name| !name.is_empty())
+                    .ok_or_else(|| DocError::Invalid("selected cylinder face has no persistent identity".into()))?;
+                {
+                    let mut scoped = ModelState::default();
+                    scoped.bodies.push(mb.clone());
+                    let (picked, split) = crate::naming::point_on_face(&scoped, name, at)
+                        .ok_or_else(|| DocError::Invalid("selected cylinder face no longer exists".into()))?;
+                    if split {
+                        return Err(DocError::Invalid("selected cylinder face was split".into()));
+                    }
+                    let (index, _, _) = crate::project::nearest_face(&mb.mesh(), picked)
+                        .ok_or_else(|| DocError::Invalid("selected cylinder face cannot be resolved".into()))?;
+                    if crate::naming::face_names(&mb).get(index as usize) != Some(name) {
+                        return Err(DocError::Invalid("selected cylinder face is ambiguous".into()));
+                    }
+                    at = kernel::cylinder_emboss_anchor(&mb.body, index as usize, picked)?;
+                }
+                let result = kernel::emboss_cylinder_at(&mb.body, at, &plane, &regions, if *deboss { -d } else { d })?;
+                if let Some(slot) = st.bodies.get_mut(i) {
+                    *slot = ModelBody::new(mb.name, result, mb.feature);
+                }
+                return Ok(());
+            }
             let (a, b) = if *deboss { (-d, 0.0) } else { (0.0, d) };
             let tools = kernel::extrude(&ss.plane, &regions, a, b)?;
             if st.bodies.is_empty() {
@@ -45,7 +93,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
             apply_op(st, f, tools, Operation::Join, &[])
         }
         FeatureKind::ReplaceFace { faces, target, body } => {
-            let tp = doc.resolve_plane(vals, target, 0)?;
+            let tp = doc.resolve_plane_in(vals, target, 0, Some(st))?;
             let tn = tp.normal();
             let i = body_at(st, body, faces)?;
             let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
@@ -242,12 +290,22 @@ fn point_on_polyline(pts: &[Vec2], d: f64) -> Vec2 {
 }
 
 /// Rebuild a sheet body's solid from its model.
+fn replace_sheet_body(mb: &mut ModelBody, body: Body) {
+    let mut next = ModelBody::new(mb.name.clone(), body, mb.feature);
+    next.component = mb.component;
+    next.transferred = mb.transferred;
+    next.source_name = mb.source_name.clone();
+    next.source_transform = mb.source_transform;
+    next.imported = mb.imported.clone();
+    *mb = next;
+}
+
 fn rebuild_sheet(st: &mut ModelState, idx: usize) -> Result<()> {
     let sheet = st.sheets.get(idx).cloned().ok_or_else(|| DocError::Invalid("sheet".into()))?;
     let solid = sheet.solid()?;
     let i = st.bodies.iter().position(|b| b.name == sheet.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", sheet.body)))?;
     if let Some(mb) = st.bodies.get_mut(i) {
-        *mb = ModelBody::new(mb.name.clone(), solid, mb.feature);
+        replace_sheet_body(mb, solid);
     }
     Ok(())
 }
@@ -288,7 +346,13 @@ fn mirror_y(r: &Region2) -> Region2 {
     Region2 { outer: m(&r.outer), holes: r.holes.iter().map(|h| m(h).reversed()).collect() }
 }
 
-pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState) -> Result<()> {
+pub(super) fn sheet_eval(
+    doc: &Document,
+    vals: &BTreeMap<String, Value>,
+    f: &Feature,
+    st: &mut ModelState,
+    warning: &mut Option<String>,
+) -> Result<()> {
     use crate::sheet;
     match &f.kind {
         FeatureKind::SheetBase { sketch, profiles, rule, flip } => {
@@ -303,7 +367,22 @@ pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Fea
                     (ss.plane, region)
                 };
                 let name = new_name(st, f, k);
-                let sh = sheet::base_flange(&name, &r.name, &rv, plane, region);
+                let mut sh = sheet::base_flange(&name, &r.name, &rv, plane, region);
+                // The sketch's lines name the base panel's edges.
+                sh.base_curves = ss
+                    .sketch
+                    .curves
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, c)| !c.construction)
+                    .flat_map(|(ci, c)| {
+                        ss.sketch.segs(ci).into_iter().filter_map(move |sg| match sg {
+                            Seg2::Line { a, b } => Some((c.id.clone(), a, b)),
+                            _ => None,
+                        })
+                    })
+                    .map(|(id, a, b)| if *flip { (id, Vec2::new(a.x, -a.y), Vec2::new(b.x, -b.y)) } else { (id, a, b) })
+                    .collect();
                 let solid = sh.solid()?;
                 st.bodies.push(ModelBody::new(name, solid, f.id));
                 st.sheets.push(sh);
@@ -349,7 +428,10 @@ pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Fea
             if sh.flat {
                 return Err(DocError::Invalid("refold the sheet before adding flanges".into()));
             }
-            sh.add_flanges(edges, h, a, rr, position, *flip)?;
+            let picks = sheet_picks(sh, f, edges, warning);
+            let n0 = sh.flanges.len();
+            sh.add_flanges(&picks, h, a, rr, position, *flip)?;
+            tag_flanges(sh, n0, f.id);
             rebuild_sheet(st, i)
         }
         FeatureKind::SheetHem { edges, length, gap, flip, body } => {
@@ -363,9 +445,12 @@ pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Fea
                 }
             };
             let sh = st.sheets.get_mut(i).ok_or_else(|| DocError::Invalid("sheet".into()))?;
-            for e in edges {
+            let picks = sheet_picks(sh, f, edges, warning);
+            let n0 = sh.flanges.len();
+            for e in &picks {
                 sh.add_hem(*e, l, g, *flip)?;
             }
+            tag_flanges(sh, n0, f.id);
             rebuild_sheet(st, i)
         }
         FeatureKind::SheetFold { sketch, curve, a, b, angle, radius, position, flip, fixed, body } => {
@@ -394,7 +479,9 @@ pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Fea
             if sh.flat {
                 return Err(DocError::Invalid("refold the sheet before folding it".into()));
             }
+            let n0 = sh.flanges.len();
             sh.add_fold(a, b, ang, rr, position, *flip, *fixed)?;
+            tag_flanges(sh, n0, f.id);
             rebuild_sheet(st, i)
         }
         FeatureKind::SheetUnfold { body, refold } => {
@@ -437,7 +524,7 @@ pub(super) fn sheet_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Fea
             sh.holes = region.holes.iter().map(|h| Region2 { outer: h.ccw(), holes: Vec::new() }).collect();
             let solid = sh.solid()?;
             if let Some(b) = st.bodies.iter_mut().find(|b| &b.name == body) {
-                *b = ModelBody::new(b.name.clone(), solid, b.feature);
+                replace_sheet_body(b, solid);
             }
             st.sheets.retain(|s| &s.body != body);
             st.sheets.push(sh);
@@ -452,79 +539,301 @@ fn poly_area(p: &[Vec2]) -> f64 {
     (0..m).filter_map(|i| Some(p.get(i)?.cross(*p.get((i + 1) % m)?))).sum::<f64>() / 2.0
 }
 
-/// An extrude cut through sheet metal: the profiles become cut-outs of the flat pattern
-/// (parallel to a panel, through its thickness). Returns the sheet bodies handled.
-pub(super) fn sheet_cut(f: &Feature, st: &mut ModelState, tools: &[Body], targets: &[String]) -> Result<Vec<String>> {
-    let FeatureKind::Extrude { sketch, profiles, .. } = &f.kind else { return Ok(Vec::new()) };
+/// Current unmodified extrusion caps, including placement, certify the tool's depth.
+/// Tessellation can drift in thickness at distant coordinates and cannot certify a slab.
+fn sheet_tool_span(body: &Body, source: &Plane) -> Option<(f64, f64, f64, Option<(Plane, Region2)>)> {
+    use kernel::FaceSource;
+    #[derive(PartialEq)]
+    enum Signature<'a> {
+        Raw(&'a Region2),
+        Certified(&'a [String], &'a [Vec<String>]),
+    }
+    let sources = body.face_sources()?;
+    if sources.len() != body.face_count() || sources.len() > 16_384 {
+        return None;
+    }
+    let n = source.normal();
+    let mut family = None;
+    let mut caps = [None, None];
+    let mut projection_roundoff: f64 = 0.0;
+    let mut footprint = None;
+    for (index, entry) in sources.iter().enumerate() {
+        let (group, cap) = match entry.as_ref()? {
+            FaceSource::ExtrudeSide { .. } => (None, None),
+            FaceSource::ExtrudeCap { high, region, plane } => (None, Some((*high, *plane, Signature::Raw(region)))),
+            FaceSource::CertifiedExtrudeSide { producer, sketch, .. } => (Some((*producer, *sketch)), None),
+            FaceSource::CertifiedExtrudeCap { producer, sketch, high, outer, holes, plane } => {
+                (Some((*producer, *sketch)), Some((*high, *plane, Signature::Certified(outer, holes))))
+            }
+            _ => return None,
+        };
+        match family {
+            None => family = Some(group),
+            Some(previous) if previous != group => return None,
+            _ => {}
+        }
+        if let Some((high, plane, signature)) = cap {
+            if high && let Signature::Raw(region) = &signature {
+                footprint = Some((plane, (*region).clone()));
+            }
+            let valid = |p: &Plane| {
+                p.origin.is_finite()
+                    && p.x.is_finite()
+                    && p.y.is_finite()
+                    && (p.x.len2() - 1.0).abs() <= 1e-10
+                    && (p.y.len2() - 1.0).abs() <= 1e-10
+                    && p.x.dot(p.y).abs() <= 1e-10
+                    && p.normal().cross(n).len() <= 1e-10
+            };
+            let current = body.planar_face(index)?;
+            if !valid(&plane) || !valid(&current) {
+                return None;
+            }
+            // Bound floating point projection separately from model geometry tolerance.
+            let roundoff = 128.0 * f64::EPSILON * (plane.origin.len() + current.origin.len() + source.origin.len()).max(1.0);
+            if roundoff > 1e-7 || (current.origin - plane.origin).dot(n).abs() > roundoff {
+                return None;
+            }
+            projection_roundoff = projection_roundoff.max(roundoff);
+            let distance = (plane.origin - source.origin).dot(n);
+            if !distance.is_finite() || caps[usize::from(high)].is_some() {
+                return None;
+            }
+            caps[usize::from(high)] = Some((distance, signature));
+        }
+    }
+    let [Some((low, low_signature)), Some((high, high_signature))] = caps else { return None };
+    (low_signature == high_signature && low != high).then_some((low.min(high), low.max(high), projection_roundoff, footprint))
+}
+
+/// Exact prismatic machining, retained in sheet material/depth metadata.
+pub(super) fn sheet_cut(
+    f: &Feature,
+    st: &mut ModelState,
+    tools: &[Body],
+    targets: &[String],
+    constructor: Option<&ExtrudeConstructor>,
+) -> Result<Vec<String>> {
+    let FeatureKind::Extrude { sketch, profiles, operation, extent, .. } = &f.kind else { return Ok(Vec::new()) };
+    if extent.taper.is_some() {
+        return Ok(Vec::new());
+    }
+    let targets = if targets.is_empty() { &f.participants } else { targets };
+    let all = targets.len() == 1 && targets.first().is_some_and(|t| t == "*");
+    let eligible = |original: &crate::sheet::SheetBody| {
+        all || if targets.is_empty() {
+            st.bodies.iter().any(|b| b.name == original.body && (b.component == f.component || b.feature == f.id))
+        } else {
+            targets.contains(&original.body)
+        }
+    };
+    if !st.sheets.iter().any(&eligible) {
+        return Ok(Vec::new());
+    }
     let Some(ss) = st.sketch(*sketch).cloned() else { return Ok(Vec::new()) };
     let regions = solvecraft_sketch::merge_regions(&select_profiles(&ss, profiles)?);
     let n = ss.plane.normal();
-    // How far the tools reach along the sketch normal.
+    let mut work = sheet::FlatWork::new();
+    let faces = tools.iter().fold(0usize, |count, body| count.saturating_add(body.face_count()));
+    if tools.len() > 1000 || faces > 16_384 {
+        return Err(DocError::Invalid("sheet machining tools exceed the bounded geometry budget".into()));
+    }
+    work.charge(faces.saturating_mul(5))?;
     let mut span = (f64::MAX, f64::MIN);
-    for t in tools {
-        for p in t.tessellate((t.size() * 1e-3).max(1e-3))?.positions {
-            let d = (p - ss.plane.origin).dot(n);
-            span = (span.0.min(d), span.1.max(d));
+    let mut cap_roundoff: f64 = 0.0;
+    let mut current_footprints = Vec::new();
+    for tool in tools {
+        let Some((lo, hi, roundoff, footprint)) = sheet_tool_span(tool, &ss.plane) else {
+            // Modified tools need a current geometric prism certificate. The generic
+            // sheet preflight permits actual no-change, otherwise refuses stale metadata.
+            return Ok(Vec::new());
+        };
+        if span.0 != f64::MAX && ((span.0 - lo).abs() > cap_roundoff + roundoff || (span.1 - hi).abs() > cap_roundoff + roundoff) {
+            // Different profile tools cannot be represented as one filled depth interval.
+            return Ok(Vec::new());
+        }
+        span = (span.0.min(lo), span.1.max(hi));
+        cap_roundoff = cap_roundoff.max(roundoff);
+        if let Some(footprint) = footprint {
+            current_footprints.push(footprint);
         }
     }
-    let mut handled = Vec::new();
-    for i in 0..st.sheets.len() {
-        let Some(sh) = st.sheets.get(i).cloned() else { continue };
-        if !targets.is_empty() && !targets.contains(&sh.body) {
+    // Only untrimmed Distance tools may use their exact authored scalar interval.
+    // The cap certificate still qualifies their current physical slab above.
+    let selected_edges =
+        regions.iter().flat_map(|r| std::iter::once(&r.outer).chain(&r.holes)).map(|l| l.segs.len()).fold(0usize, usize::saturating_add);
+    work.charge(faces.saturating_mul(selected_edges).saturating_mul(16))?;
+    let nominal = constructor.filter(|c| c.plane == ss.plane).and_then(|c| {
+        let placed_basis = Plane::new(c.plane.origin, c.plane.x, c.plane.y)?;
+        (current_footprints.len() == tools.len()
+            && current_footprints.iter().all(|(plane, r)| plane.x == placed_basis.x && plane.y == placed_basis.y && regions.contains(r)))
+        .then_some(c.interval)
+    });
+    let mut plans = Vec::new();
+    'sheets: for original in &st.sheets {
+        if !eligible(original) {
             continue;
         }
-        let candidates: Vec<(Option<usize>, Region2)> = if sh.flat {
-            if sh.frame.normal().cross(n).len() > 1e-6 {
-                Vec::new()
-            } else {
-                vec![(None, Region2 { outer: Loop2::polygon(&sh.outline()?.into_iter().next().unwrap_or_default()), holes: Vec::new() })]
-            }
-        } else {
-            sh.parallel_panels(&ss.plane)
+        let Some(mb) = st.body(&original.body) else {
+            continue;
         };
-        let mut added = Vec::new();
-        for (pi, panel) in candidates {
-            // The panel's faces along the sketch normal must both be inside the cut.
-            let w = sh.world(pi);
-            let z0 = (apply_point(&w, Vec3::ZERO) - ss.plane.origin).dot(n);
-            let z1 = (apply_point(&w, Vec3::Z * sh.t) - ss.plane.origin).dot(n);
-            if z0.min(z1) < span.0 - 1e-6 || z0.max(z1) > span.1 + 1e-6 {
-                continue;
-            }
-            let outline = if sh.flat { sh.outline()?.into_iter().flatten().collect::<Vec<_>>() } else { panel.outer.polyline(1e-3) };
-            for r in &regions {
-                let Some(flat) = sh.region_to_flat(pi, &ss.plane, r) else { continue };
-                let fp = flat.outer.polyline(1e-3);
-                let overlaps = fp.iter().any(|p| point_in_poly(&outline, *p)) || outline.iter().any(|p| point_in_poly(&fp, *p));
-                if overlaps && !added.iter().any(|x: &Region2| x == &flat) {
-                    added.push(flat);
+        let mut sh = original.clone();
+        if *operation == Operation::Intersect && (!sh.flat && !sh.flanges.is_empty()) {
+            super::sheet_boolean_unchanged(&mb.body, tools, *operation)?;
+            plans.push((sh.body.clone(), Some((sh, mb.body.clone()))));
+            continue;
+        }
+        if !sh.flat && !sh.flanges.is_empty() && !super::sheet_boolean_changes(&mb.body, tools, *operation)? {
+            plans.push((sh.body.clone(), Some((sh, mb.body.clone()))));
+            continue;
+        }
+        if let Some(bends) = sh.unmodeled_solid(&ss.plane)? {
+            for tool in tools {
+                if kernel::boolean(&bends, tool, kernel::BoolOp::Intersect)?.is_some() {
+                    return Err(DocError::Invalid(
+                        "this machining intersects a folded bend or a nonparallel panel; unfold the sheet before machining that material".into(),
+                    ));
                 }
             }
         }
-        if added.is_empty() {
-            continue;
+        let candidates = if sh.flat {
+            if sh.frame.normal().cross(n).len() > 1e-6 { Vec::new() } else { sh.flat_regions()?.into_iter().map(|r| (None, r)).collect() }
+        } else {
+            sh.material_panels(Some(&ss.plane), &mut work)?
+        };
+        let mut modeled = false;
+        for (pi, panel) in candidates {
+            let w = if sh.flat { sh.world(None) } else { sh.world(pi) };
+            let zorigin = (apply_point(&w, Vec3::ZERO) - ss.plane.origin).dot(n);
+            let sign = crate::apply_vector(&w, Vec3::Z).dot(n);
+            if sign.abs() < 1e-6 {
+                continue;
+            }
+            let (a, b) = ((span.0 - zorigin) / sign, (span.1 - zorigin) / sign);
+            let roundoff = (cap_roundoff
+                + 128.0 * f64::EPSILON * (apply_point(&w, Vec3::ZERO).len() + ss.plane.origin.len() + span.0.abs() + span.1.abs() + sh.t).max(1.0))
+                / sign.abs();
+            let nominal_depth = if apply_point(&w, Vec3::ZERO) == ss.plane.origin
+                && let Some((lo, hi)) = nominal
+                && (span.0 - lo).abs() <= roundoff
+                && (span.1 - hi).abs() <= roundoff
+            {
+                // Equality of the two frame origins proves zero origin displacement;
+                // use authored distances, never an inferred endpoint coincidence.
+                let normal = crate::apply_vector(&w, Vec3::X).cross(crate::apply_vector(&w, Vec3::Y));
+                let exact_sign = if normal == n {
+                    1.0
+                } else if normal == -n {
+                    -1.0
+                } else {
+                    sign
+                };
+                Some((lo / exact_sign, hi / exact_sign))
+            } else {
+                None
+            };
+            if nominal_depth.is_none() && roundoff > 1e-7 {
+                super::sheet_boolean_unchanged(&mb.body, tools, *operation)?;
+                plans.push((original.body.clone(), Some((original.clone(), mb.body.clone()))));
+                continue 'sheets;
+            }
+            let (a, b) = nominal_depth.unwrap_or((a, b));
+            let (z0, z1) = (a.min(b).max(0.0), a.max(b).min(sh.t));
+            // Sub-resolution layers must not be silently erased by endpoint snapping.
+            let depth_resolved = ![z0, sh.t - z1, z1 - z0].into_iter().any(|d| d > 0.0 && d < 1e-6);
+            let mapped = if extent.to.is_some() && current_footprints.len() == tools.len() {
+                current_footprints.iter().map(|(plane, r)| sh.region_to_flat(pi, plane, r)).collect::<Result<Vec<_>>>()?
+            } else {
+                regions.iter().map(|r| sh.region_to_flat(pi, &ss.plane, r)).collect::<Result<Vec<_>>>()?
+            };
+            if *operation == Operation::Intersect {
+                if z1 <= z0 {
+                    sh.holes.push(panel);
+                    modeled = true;
+                    continue;
+                }
+                let tool = sheet::material_union(mapped, &mut work)?;
+                let retained = sheet::material_boolean(std::slice::from_ref(&panel), &tool, kernel::BoolOp::Intersect, &mut work)?;
+                let removed = sheet::material_boolean(std::slice::from_ref(&panel), &retained, kernel::BoolOp::Cut, &mut work)?;
+                if removed.is_empty() && !sh.material_outside_depth(&panel, z0, z1, &mut work)? {
+                    modeled = true;
+                    continue;
+                }
+                if !retained.is_empty() && !depth_resolved {
+                    return Err(DocError::Invalid(
+                        "sheet machining depth is below the supported 0.000001 mm extrusion resolution; increase the layer depth".into(),
+                    ));
+                }
+                sh.holes.extend(removed);
+                // Preserve original stock thickness and prior machining. Intersection
+                // removes the complementary layers above/below every surviving region.
+                for region in retained {
+                    if z0 > 0.0 {
+                        sh.record_pocket(region.clone(), 0.0, z0, &mut work)?;
+                    }
+                    if z1 < sh.t {
+                        sh.record_pocket(region, z1, sh.t, &mut work)?;
+                    }
+                }
+                modeled = true;
+            } else if z1 > z0 {
+                for flat in mapped {
+                    let clipped =
+                        sheet::material_boolean(std::slice::from_ref(&panel), std::slice::from_ref(&flat), kernel::BoolOp::Intersect, &mut work)?;
+                    if !clipped.is_empty() && !depth_resolved {
+                        return Err(DocError::Invalid(
+                            "sheet machining depth is below the supported 0.000001 mm extrusion resolution; increase the layer depth".into(),
+                        ));
+                    }
+                    if !clipped.is_empty() && z0 <= 1e-7 && z1 >= sh.t - 1e-7 {
+                        // Keep a single original tool boundary across structural seams.
+                        // Re-clipping notch polygons creates coincident seam endpoints.
+                        if !sh.holes.contains(&flat) {
+                            sh.holes.push(flat);
+                        }
+                        modeled = true;
+                    } else {
+                        for region in clipped {
+                            sh.record_pocket(region, z0, z1, &mut work)?;
+                            modeled = true;
+                        }
+                    }
+                }
+            }
         }
-        if let Some(s) = st.sheets.get_mut(i) {
-            s.holes.extend(added);
+        if !modeled {
+            super::sheet_boolean_unchanged(&mb.body, tools, *operation)?;
+            plans.push((sh.body.clone(), Some((sh, mb.body.clone()))));
+        } else if sh.flat_material()?.is_empty() {
+            // Empty exact material removes geometry and metadata together. Budget or
+            // topology errors propagate; they are never mistaken for an empty blank.
+            plans.push((sh.body.clone(), None));
+        } else {
+            let body = sh.solid()?;
+            plans.push((sh.body.clone(), Some((sh, body))));
+        }
+    }
+    let handled = plans.iter().map(|(name, _)| name.clone()).collect();
+    for (name, result) in plans {
+        match result {
+            Some((sh, body)) => {
+                if let Some(mb) = st.bodies.iter_mut().find(|b| b.name == name) {
+                    replace_sheet_body(mb, body);
+                }
+                if let Some(target) = st.sheets.iter_mut().find(|s| s.body == name) {
+                    *target = sh;
+                }
+            }
+            None => {
+                st.bodies.retain(|b| b.name != name);
+                st.sheets.retain(|s| s.body != name);
+                st.threads.retain(|t| t.body != name);
+            }
         }
-        rebuild_sheet(st, i)?;
-        handled.push(sh.body.clone());
     }
     Ok(handled)
 }
 
-fn point_in_poly(poly: &[Vec2], p: Vec2) -> bool {
-    let mut inside = false;
-    let m = poly.len();
-    for i in 0..m {
-        let (Some(&a), Some(&b)) = (poly.get(i), poly.get((i + m - 1) % m)) else { continue };
-        if (a.y > p.y) != (b.y > p.y) && p.x < (b.x - a.x) * (p.y - a.y) / (b.y - a.y) + a.x {
-            inside = !inside;
-        }
-    }
-    inside
-}
-
 /// Outline loops (in `plane` coordinates) of the mesh triangles lying in the plane at distance
 /// `level` from `at` along `n`: the edges used by one of them only, chained.
 fn face_loops(mesh: &solvecraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3, level: f64, tol: f64) -> Vec<Vec<Vec2>> {
@@ -584,7 +893,12 @@ fn face_loops(mesh: &solvecraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3, le
 /// The body a placed plastic feature joins: by name, else the one under the point.
 fn body_under(st: &ModelState, body: &Option<String>, p: Vec3) -> Result<String> {
     let i = body_at(st, body, &[p])?;
-    st.bodies.get(i).map(|b| b.name.clone()).ok_or_else(|| DocError::Invalid("there is no body".into()))
+    let b = st.bodies.get(i).ok_or_else(|| DocError::Invalid("there is no body".into()))?;
+    let tolerance = (b.body.size() * 1e-5).max(1e-4);
+    if crate::project::nearest_face(&b.mesh(), p).is_none_or(|(_, _, distance)| distance > tolerance) {
+        return Err(DocError::Invalid("the plastic feature's placement is no longer on its body face".into()));
+    }
+    Ok(b.name.clone())
 }
 
 /// Axes with z along `z` (and x along `x` when given).
@@ -754,11 +1068,28 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                 return Err(DocError::Invalid("pick the rim face of a shelled body (a face with an inner and an outer edge)".into()));
             };
             let bw = if *groove { w + g } else { w };
-            // The band along the chosen edge, inside the rim face.
+            // A lip: the band raised from the rim's own faces (its walls continue the walls
+            // below, which a join can't do: they would coincide).
+            if !*groove
+                && let Ok(b) = kernel::raise_band(&mb.body, *face, w, h, *outside)
+                && let Some(slot) = st.bodies.iter_mut().find(|x| x.name == target)
+            {
+                *slot = ModelBody::new(target.clone(), b, slot.feature);
+                return Ok(());
+            }
+            // The band along the chosen edge, inside the rim face. A groove's cutter reaches past
+            // the edge into the free side (the cavity, or outside), so no wall coincides.
+            let free = if *groove { bw } else { 0.0 };
             let band = if *outside {
-                Region2 { outer: Loop2::polygon(&outer).ccw(), holes: vec![Loop2::polygon(&offset_left(&outer, bw)).ccw().reversed()] }
+                Region2 {
+                    outer: Loop2::polygon(&offset_left(&outer, -free)).ccw(),
+                    holes: vec![Loop2::polygon(&offset_left(&outer, bw)).ccw().reversed()],
+                }
             } else {
-                Region2 { outer: Loop2::polygon(&offset_left(&inner, -bw)).ccw(), holes: vec![Loop2::polygon(&inner).ccw().reversed()] }
+                Region2 {
+                    outer: Loop2::polygon(&offset_left(&inner, -bw)).ccw(),
+                    holes: vec![Loop2::polygon(&offset_left(&inner, free)).ccw().reversed()],
+                }
             };
             let delta = (h * 0.05).clamp(1e-3, 0.5);
             if *groove {
@@ -843,3 +1174,31 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
         _ => Err(DocError::Invalid(format!("{} is not a plastic feature", f.name))),
     }
 }
+
+/// Edge picks of a sheet feature, moved onto their named edges (a name that is gone keeps the
+/// point, with a warning).
+fn sheet_picks(sh: &crate::sheet::SheetBody, f: &Feature, edges: &[Vec3], warning: &mut Option<String>) -> Vec<Vec3> {
+    let mut gone = Vec::new();
+    let out = edges
+        .iter()
+        .enumerate()
+        .map(|(i, p)| match f.edge_names.get(i).filter(|n| !n.is_empty()) {
+            Some(n) => sh.edge_by_name(n, *p).unwrap_or_else(|| {
+                gone.push(n.clone());
+                *p
+            }),
+            None => *p,
+        })
+        .collect();
+    if !gone.is_empty() {
+        *warning = Some(format!("sheet edge(s) {} no longer exist; using the edges at the picked points", gone.join(", ")));
+    }
+    out
+}
+
+/// Tag the flanges a feature just added (`F<feature>.<k>`).
+fn tag_flanges(sh: &mut crate::sheet::SheetBody, from: usize, feature: u64) {
+    for (k, fl) in sh.flanges.iter_mut().enumerate().skip(from) {
+        fl.tag = format!("F{feature}.{}", k - from);
+    }
+}

crates/doc/src/eval_surface.rs

@@ -0,0 +1,89 @@
+//! Evaluation of the surface features: Patch, Stitch, Thicken and Trim (kernel `surfaces`).
+
+use super::*;
+
+pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState) -> Result<()> {
+    match &f.kind {
+        FeatureKind::Patch { sketch, profiles, body, edges } => {
+            let mut made = Vec::new();
+            if let Some(sk) = sketch {
+                let ss = st.sketch(*sk).ok_or_else(|| DocError::Unknown(format!("sketch {sk} (it must come earlier in the timeline)")))?;
+                let regions = solvecraft_sketch::merge_regions(&select_profiles(ss, profiles)?);
+                for r in &regions {
+                    made.push(kernel::patch_region(&ss.plane, r)?);
+                }
+            }
+            if !edges.is_empty() {
+                let i = body_at(st, body, edges)?;
+                let b = st.bodies.get(i).ok_or_else(|| DocError::Invalid("body".into()))?;
+                made.push(kernel::patch_edges(&b.body, edges)?);
+            }
+            if made.is_empty() {
+                return Err(DocError::Invalid("a patch needs a sketch region or a loop of edges".into()));
+            }
+            for (k, b) in made.into_iter().enumerate() {
+                let name = new_name(st, f, k);
+                st.bodies.push(ModelBody::new(name, b, f.id));
+            }
+            Ok(())
+        }
+        FeatureKind::Stitch { bodies, tolerance } => {
+            let tol = val(vals, tolerance, Kind::Length)?;
+            let idx: Vec<usize> = bodies
+                .iter()
+                .map(|n| st.bodies.iter().position(|b| &b.name == n).ok_or_else(|| DocError::Unknown(format!("body `{n}`"))))
+                .collect::<Result<_>>()?;
+            let Some(&first) = idx.first() else { return Err(DocError::Invalid("pick the surfaces to stitch".into())) };
+            let refs: Vec<&kernel::Body> = idx.iter().filter_map(|i| st.bodies.get(*i).map(|b| &b.body)).collect();
+            let sewn = kernel::stitch(&refs, tol)?;
+            let Some(mb) = st.bodies.get(first).cloned() else { return Err(DocError::Invalid("body".into())) };
+            if let Some(slot) = st.bodies.get_mut(first) {
+                *slot = ModelBody::new(mb.name, sewn, mb.feature);
+            }
+            // The others are now part of the first.
+            let gone: Vec<String> = idx.iter().skip(1).filter_map(|i| st.bodies.get(*i).map(|b| b.name.clone())).collect();
+            st.bodies.retain(|b| !gone.contains(&b.name));
+            Ok(())
+        }
+        FeatureKind::Thicken { bodies, thickness, symmetric, operation, targets } => {
+            let t = val(vals, thickness, Kind::Length)?;
+            let mut tools = Vec::new();
+            for n in bodies {
+                let b = st.body(n).ok_or_else(|| DocError::Unknown(format!("body `{n}`")))?;
+                tools.push(kernel::thicken(&b.body, t, *symmetric)?);
+            }
+            if tools.is_empty() {
+                return Err(DocError::Invalid("pick the surfaces to thicken".into()));
+            }
+            apply_op(st, f, tools, *operation, targets)
+        }
+        FeatureKind::SurfaceTrim { body, plane, tool, keep } => {
+            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
+            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
+            let trimmed = match tool {
+                Some(t) => {
+                    let tb = st.body(&t.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", t.body)))?;
+                    let face = crate::appearance::face_index_at(tb, t.point)
+                        .ok_or_else(|| DocError::Invalid(format!("no face of `{}` at the tool point", t.body)))?;
+                    kernel::trim(&mb.body, &kernel::SplitTool::Face { body: &tb.body, face }, *keep)?
+                }
+                None => kernel::trim(&mb.body, &kernel::SplitTool::Plane(doc.resolve_plane_in(vals, plane, 0, Some(st))?), *keep)?,
+            };
+            if let Some(slot) = st.bodies.get_mut(i) {
+                *slot = ModelBody::new(mb.name, trimmed, mb.feature);
+            }
+            Ok(())
+        }
+        FeatureKind::SurfaceExtend { body, edges, distance } => {
+            let d = val(vals, distance, Kind::Length)?;
+            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
+            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
+            let out = kernel::extend(&mb.body, edges, d)?;
+            if let Some(slot) = st.bodies.get_mut(i) {
+                *slot = ModelBody::new(mb.name, out, mb.feature);
+            }
+            Ok(())
+        }
+        _ => Err(DocError::Invalid("not a surface feature".into())),
+    }
+}

crates/doc/src/face_anchor.rs

@@ -0,0 +1,561 @@
+//! Exact ordinary face attachments. Missing identities never invoke a proximity fallback.
+use crate::config::ConfigFaceTarget;
+use crate::{DocError, Document, EmbossFace, FeatureKind, Model, ModelBody, ModelState, PlaneRef, Result};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use solvecraft_geom::Plane;
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct FaceAnchor {
+    pub target: ConfigFaceTarget,
+    pub component: u64,
+    pub path: Vec<u64>,
+    pub author_path: Vec<u64>,
+    /// Origin and x direction in the exact canonical face plane's coordinates.
+    pub coordinates: [f64; 2],
+    pub x_axis: [f64; 2],
+}
+
+impl FaceAnchor {
+    pub fn remap_target(
+        &mut self,
+        features: &std::collections::BTreeMap<u64, u64>,
+        bodies: &std::collections::BTreeMap<String, String>,
+    ) -> Result<()> {
+        if bodies.contains_key(&self.target.body) && !features.contains_key(&self.target.origin_feature) {
+            return Err(DocError::Invalid("cannot clone an attached face without its certified producer".into()));
+        }
+        self.target.name = crate::remap_topology(&self.target.name, features, bodies);
+        if let Some(body) = bodies.get(&self.target.body) {
+            self.target.body = body.clone();
+        }
+        if let Some(feature) = features.get(&self.target.origin_feature) {
+            self.target.origin_feature = *feature;
+        }
+        if let Some(certificate) = &mut self.target.certificate {
+            certificate.remap_features(features);
+        }
+        self.validate()
+    }
+    pub fn validate(&self) -> Result<()> {
+        self.target.validate()?;
+        if self.target.certificate.is_none()
+            || self.path.len() > 64
+            || self.author_path.len() > 64
+            || self.path.iter().chain(&self.author_path).any(|id| *id == 0)
+            || (self.component == 0 && !self.path.is_empty())
+            || (self.component != 0 && self.path.is_empty())
+            || self.coordinates.iter().any(|value| !value.is_finite() || value.abs() > 1e9)
+            || self.x_axis.iter().any(|value| !value.is_finite())
+            || (self.x_axis[0].hypot(self.x_axis[1]) - 1.).abs() > 1e-6
+        {
+            return Err(DocError::Invalid("invalid exact face attachment".into()));
+        }
+        Ok(())
+    }
+    pub fn author_frame(&self, doc: &Document, author: u64) -> Result<crate::Mat> {
+        if author != 0 && self.author_path.is_empty() {
+            return Err(DocError::Invalid(
+                "attached sketch requires an explicit author occurrence path; activate a placement or choose a fixed plane".into(),
+            ));
+        }
+        EmbossFace::component_frame(doc, author, &self.author_path)
+    }
+    pub fn source_to_author(&self, doc: &Document, author: u64, body: &ModelBody) -> Result<crate::Mat> {
+        self.validate()?;
+        if doc.model_body_component(body) != self.component {
+            return Err(DocError::Invalid("attached face's component ownership changed; reattach explicitly".into()));
+        }
+        let inverse = crate::mat_inverse(&self.author_frame(doc, author)?)
+            .ok_or_else(|| DocError::Invalid("attached sketch author frame is invalid".into()))?;
+        let source =
+            EmbossFace { body: self.target.body.clone(), at: self.target.point, path: self.path.clone(), author_path: self.author_path.clone() };
+        Ok(crate::mat_mul(&inverse, &source.body_frame(doc, body)?))
+    }
+}
+
+pub fn plane_face_anchor(plane: &PlaneRef) -> Option<&FaceAnchor> {
+    match plane {
+        PlaneRef::Face { anchor, .. } => anchor.as_deref(),
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => plane_face_anchor(base),
+        _ => None,
+    }
+}
+
+fn has_face_reference(plane: &PlaneRef) -> bool {
+    match plane {
+        PlaneRef::Face { .. } => true,
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => has_face_reference(base),
+        _ => false,
+    }
+}
+
+impl Document {
+    pub fn resolve_attached_plane(
+        &self,
+        vals: &std::collections::BTreeMap<String, crate::expr::Value>,
+        plane: &PlaneRef,
+        author: u64,
+        state: &ModelState,
+        framed: &ModelState,
+    ) -> Result<Plane> {
+        fn replace(doc: &Document, plane: &mut PlaneRef, author: u64, state: &ModelState, depth: usize) -> Result<()> {
+            if depth > 64 {
+                return Err(DocError::Invalid("attached plane nesting exceeds budget".into()));
+            }
+            match plane {
+                PlaneRef::Face { anchor: Some(anchor), .. } => *plane = PlaneRef::Custom { plane: doc.resolve_face_anchor(anchor, author, state)? },
+                PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => replace(doc, base, author, state, depth + 1)?,
+                _ => {}
+            }
+            Ok(())
+        }
+        let mut resolved = plane.clone();
+        replace(self, &mut resolved, author, state, 0)?;
+        self.resolve_plane_in(vals, &resolved, 0, Some(framed))
+    }
+}
+
+/// All status planes are world-space. A lost plane is a repair guide only.
+#[derive(Clone, Debug)]
+pub enum FaceAttachmentStatus {
+    Fixed { plane: Option<Plane> },
+    Legacy { plane: Option<Plane> },
+    Healthy { plane: Plane, target: ConfigFaceTarget, path: Vec<u64> },
+    Lost { message: String, repair_plane: Option<Plane> },
+}
+
+fn map_plane(matrix: &crate::Mat, plane: &Plane) -> Result<Plane> {
+    Plane::new(crate::apply_point(matrix, plane.origin), crate::apply_vector(matrix, plane.x), crate::apply_vector(matrix, plane.y))
+        .ok_or_else(|| DocError::Invalid("attached plane transform is degenerate".into()))
+}
+
+impl Document {
+    /// Capture a known selected face in the definition model, without another nearest pick.
+    pub fn capture_face_anchor(
+        &self,
+        body: &ModelBody,
+        index: usize,
+        picked: &Plane,
+        target_path: &[u64],
+        author: u64,
+        author_path: &[u64],
+    ) -> Result<FaceAnchor> {
+        let source = body
+            .body
+            .face_plane(index)
+            .ok_or_else(|| DocError::Invalid("this face has no exact planar source; choose a fixed plane instead".into()))?;
+        let target = self.strong_face_target(body, index, source.origin)?;
+        if target.certificate.is_none() {
+            return Err(DocError::Invalid("this face has no supported construction certificate; choose a fixed plane instead".into()));
+        }
+        self.configuration_face_indices(body, &target)?;
+        let mut anchor = FaceAnchor {
+            target,
+            component: self.model_body_component(body),
+            path: target_path.to_vec(),
+            author_path: author_path.to_vec(),
+            coordinates: [0., 0.],
+            x_axis: [1., 0.],
+        };
+        let canonical = map_plane(&anchor.source_to_author(self, author, body)?, &source)?;
+        if picked.normal().dot(canonical.normal()) < 1. - 1e-7 || (picked.origin - canonical.origin).dot(canonical.normal()).abs() > 1e-7 {
+            return Err(DocError::Invalid("picked plane does not match its exact source face".into()));
+        }
+        let delta = picked.origin - canonical.origin;
+        anchor.coordinates = [delta.dot(canonical.x), delta.dot(canonical.y)];
+        anchor.x_axis = [picked.x.dot(canonical.x), picked.x.dot(canonical.y)];
+        anchor.validate()?;
+        Ok(anchor)
+    }
+
+    pub fn resolve_face_anchor(&self, anchor: &FaceAnchor, author: u64, state: &ModelState) -> Result<Plane> {
+        anchor.validate()?;
+        let body =
+            state.body(&anchor.target.body).ok_or_else(|| DocError::Unknown(format!("attached body `{}` no longer exists", anchor.target.body)))?;
+        let indices = self.configuration_face_indices(body, &anchor.target)?;
+        let first = indices.first().copied().ok_or_else(|| DocError::Unknown("attached face no longer exists".into()))?;
+        let plane = body.body.face_plane(first).ok_or_else(|| DocError::Invalid("attached face no longer has an exact planar source".into()))?;
+        for index in indices.iter().skip(1) {
+            let other = body.body.face_plane(*index).ok_or_else(|| DocError::Invalid("attached face pieces are not exactly planar".into()))?;
+            if plane.normal().dot(other.normal()) < 1. - 1e-8 || (other.origin - plane.origin).dot(plane.normal()).abs() > 1e-7 {
+                return Err(DocError::Invalid("attached face pieces no longer share one oriented plane".into()));
+            }
+        }
+        let canonical = map_plane(&anchor.source_to_author(self, author, body)?, &plane)?;
+        let origin = canonical.origin + canonical.x * anchor.coordinates[0] + canonical.y * anchor.coordinates[1];
+        let x = canonical.x * anchor.x_axis[0] + canonical.y * anchor.x_axis[1];
+        Plane::new(origin, x, canonical.normal().cross(x)).ok_or_else(|| DocError::Invalid("attached sketch basis is degenerate".into()))
+    }
+
+    pub fn sketch_face_attachment(&self, feature: u64, model: &Model) -> FaceAttachmentStatus {
+        let Some(feature) = self.feature(feature) else {
+            return FaceAttachmentStatus::Lost { message: "sketch no longer exists".into(), repair_plane: None };
+        };
+        let FeatureKind::Sketch { plane, .. } = &feature.kind else {
+            return FaceAttachmentStatus::Fixed { plane: None };
+        };
+        let Some(anchor) = plane_face_anchor(plane) else {
+            let path = self.first_path(feature.component);
+            let unique = path.iter().all(|id| {
+                self.occurrences
+                    .iter()
+                    .find(|o| o.id == *id)
+                    .is_some_and(|selected| self.occurrences.iter().filter(|o| o.component == selected.component).count() == 1)
+            });
+            let world = unique.then(|| EmbossFace::component_frame(self, feature.component, &path).ok()).flatten();
+            let current = model.state().sketch(feature.id).map(|sketch| sketch.plane).or_else(|| {
+                let (vals, _) = self.param_values();
+                self.resolve_plane(&vals, plane, 0).ok()
+            });
+            let current = world.and_then(|world| current.and_then(|plane| map_plane(&world, &plane).ok()));
+            return if has_face_reference(plane) {
+                FaceAttachmentStatus::Legacy { plane: current }
+            } else {
+                FaceAttachmentStatus::Fixed { plane: current }
+            };
+        };
+        let (vals, _) = self.param_values();
+        let picked = self.resolve_plane(&vals, plane, 0).ok();
+        let world = anchor.author_frame(self, feature.component);
+        let repair_plane = world.as_ref().ok().and_then(|matrix| picked.as_ref().and_then(|picked| map_plane(matrix, picked).ok()));
+        let state = model.state_before(feature.id);
+        match crate::state_in_face_anchor_frame(self, &state, anchor, feature.component)
+            .and_then(|framed| self.resolve_attached_plane(&vals, plane, feature.component, &state, &framed))
+            .and_then(|plane| map_plane(&world?, &plane))
+        {
+            Ok(plane) => FaceAttachmentStatus::Healthy { plane, target: anchor.target.clone(), path: anchor.path.clone() },
+            Err(error) => FaceAttachmentStatus::Lost { message: format!("lost face attachment on `{}`: {error}", anchor.target.body), repair_plane },
+        }
+    }
+}
+
+pub fn validate_face_anchor_json(value: &Value) -> Result<()> {
+    let fields = value.as_object().ok_or_else(|| DocError::Invalid("face anchor must be an object".into()))?;
+    if fields.len() != 6 || fields.keys().any(|key| !["target", "component", "path", "author_path", "coordinates", "x_axis"].contains(&key.as_str()))
+    {
+        return Err(DocError::Invalid("unknown or missing face anchor fields".into()));
+    }
+    let target = fields.get("target").ok_or_else(|| DocError::Invalid("face anchor target missing".into()))?;
+    crate::config::validate_face_target_json(target)?;
+    if target.get("certificate").is_none_or(Value::is_null) {
+        return Err(DocError::Invalid("face anchor needs a source certificate".into()));
+    }
+    let component =
+        fields.get("component").and_then(Value::as_u64).ok_or_else(|| DocError::Invalid("face anchor component must be an integer".into()))?;
+    for key in ["path", "author_path"] {
+        if fields.get(key).and_then(Value::as_array).is_none_or(|path| {
+            path.len() > 64
+                || path.iter().any(|id| id.as_u64().is_none_or(|id| id == 0))
+                || (key == "path" && component == 0 && !path.is_empty())
+                || (key == "path" && component != 0 && path.is_empty())
+        }) {
+            return Err(DocError::Invalid("face anchor path is invalid or oversized".into()));
+        }
+    }
+    for key in ["coordinates", "x_axis"] {
+        let values = fields
+            .get(key)
+            .and_then(Value::as_array)
+            .filter(|values| values.len() == 2)
+            .ok_or_else(|| DocError::Invalid("face anchor vectors require exactly two values".into()))?;
+        if values.iter().any(|value| value.as_f64().is_none_or(|value| !value.is_finite() || value.abs() > 1e9)) {
+            return Err(DocError::Invalid("face anchor vector is invalid".into()));
+        }
+        if key == "x_axis" && (values[0].as_f64().unwrap_or(0.).hypot(values[1].as_f64().unwrap_or(0.)) - 1.).abs() > 1e-6 {
+            return Err(DocError::Invalid("face anchor basis must be normalized".into()));
+        }
+    }
+    Ok(())
+}
+
+/// Walk reference-bearing JSON before typed decoding, excluding bulk geometry payloads.
+pub fn validate_face_anchors_json(value: &Value) -> Result<()> {
+    let mut stack = vec![(value, 0usize)];
+    let mut visited = 0usize;
+    while let Some((value, depth)) = stack.pop() {
+        visited += 1;
+        if visited > 2_000_000 || depth > 128 {
+            return Err(DocError::Invalid("face anchor structure exceeds work limits".into()));
+        }
+        match value {
+            Value::Object(fields) => {
+                if fields.get("type").and_then(Value::as_str) == Some("face")
+                    && let Some(anchor) = fields.get("anchor")
+                    && !anchor.is_null()
+                {
+                    validate_face_anchor_json(anchor)?;
+                }
+                for (key, child) in fields {
+                    if !["sketch", "meshes", "step", "configs", "appearances", "materials"].contains(&key.as_str())
+                        && matches!(child, Value::Array(_) | Value::Object(_))
+                    {
+                        stack.push((child, depth + 1));
+                    }
+                }
+            }
+            Value::Array(values) => {
+                for child in values {
+                    if matches!(child, Value::Array(_) | Value::Object(_)) {
+                        stack.push((child, depth + 1));
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use solvecraft_geom::Vec3;
+    fn fixture() -> (Document, ModelBody, usize, Plane) {
+        let mut doc = Document::default();
+        let kind: FeatureKind =
+            serde_json::from_value(serde_json::json!({"type":"box","corner":[0,0,0],"length":"10","width":"10","height":"10"})).unwrap();
+        let id = doc.add_feature(kind, Some("Base")).unwrap();
+        let body = ModelBody::new(
+            "Base".into(),
+            solvecraft_kernel::box_solid(Vec3::default(), Vec3::new(10., 10., 10.)).unwrap().with_box_certificate(id).unwrap(),
+            id,
+        );
+        let index = body
+            .body
+            .face_sources()
+            .unwrap()
+            .iter()
+            .position(|source| matches!(source, Some(solvecraft_kernel::FaceSource::Box { axis: 2, high: true, .. })))
+            .unwrap();
+        let canonical = body.body.face_plane(index).unwrap();
+        let picked = Plane::new(canonical.origin + canonical.x * 2. + canonical.y * 3., canonical.y, -canonical.x).unwrap();
+        (doc, body, index, picked)
+    }
+    #[test]
+    fn exact_anchor_preserves_picked_basis_and_follows_height_without_parallel_rescue() {
+        let (doc, body, index, picked) = fixture();
+        let anchor = doc.capture_face_anchor(&body, index, &picked, &[], 0, &[]).unwrap();
+        let anchor: FaceAnchor = serde_json::from_str(&serde_json::to_string(&anchor).unwrap()).unwrap();
+        assert!(anchor.author_frame(&doc, 1).is_err(), "strong author attachment cannot infer a first placement");
+        let mut missing_source = anchor.clone();
+        missing_source.component = 1;
+        assert!(missing_source.validate().is_err(), "strong source attachment needs an explicit path");
+        assert!(validate_face_anchor_json(&serde_json::to_value(missing_source).unwrap()).is_err());
+        let mut state = ModelState::default();
+        state.bodies.push(body);
+        let initial = doc.resolve_face_anchor(&anchor, 0, &state).unwrap();
+        assert!((initial.origin - picked.origin).len() < 1e-9);
+        assert!((initial.x - picked.x).len() < 1e-9);
+        state.bodies[0] = ModelBody::new(
+            "Base".into(),
+            solvecraft_kernel::box_solid(Vec3::default(), Vec3::new(10., 10., 20.))
+                .unwrap()
+                .with_box_certificate(anchor.target.origin_feature)
+                .unwrap(),
+            anchor.target.origin_feature,
+        );
+        let changed = doc.resolve_face_anchor(&anchor, 0, &state).unwrap();
+        assert!((changed.origin.z - 20.).abs() < 1e-9);
+        assert!((changed.origin.x - initial.origin.x).abs() < 1e-9);
+        state.bodies[0] = ModelBody::new(
+            "Control".into(),
+            solvecraft_kernel::box_solid(Vec3::default(), Vec3::new(10., 10., 30.))
+                .unwrap()
+                .with_box_certificate(anchor.target.origin_feature)
+                .unwrap(),
+            anchor.target.origin_feature,
+        );
+        assert!(doc.resolve_face_anchor(&anchor, 0, &state).is_err());
+        state.bodies[0].name = "Base".into();
+        state.bodies[0].body = solvecraft_kernel::box_solid(Vec3::default(), Vec3::new(10., 10., 30.))
+            .unwrap()
+            .with_box_certificate(anchor.target.origin_feature + 1)
+            .unwrap();
+        assert!(doc.resolve_face_anchor(&anchor, 0, &state).is_err(), "reused name cannot replace the producer");
+    }
+    #[test]
+    fn nested_anchor_offset_tracks_source_and_raw_budgets_precede_decode() {
+        let (doc, body, index, picked) = fixture();
+        let anchor = doc.capture_face_anchor(&body, index, &picked, &[], 0, &[]).unwrap();
+        let plane = PlaneRef::Offset {
+            base: Box::new(PlaneRef::Face { plane: picked, at: picked.origin, name: None, anchor: Some(Box::new(anchor.clone())) }),
+            distance: "2".into(),
+        };
+        let mut state = ModelState::default();
+        state.bodies.push(body);
+        let (vals, _) = doc.param_values();
+        let result = doc.resolve_attached_plane(&vals, &plane, 0, &state, &state).unwrap();
+        assert!((result.origin.z - 12.).abs() < 1e-9);
+        state.bodies.clear();
+        assert!(doc.resolve_attached_plane(&vals, &plane, 0, &state, &state).is_err());
+        let mut raw = serde_json::to_value(anchor).unwrap();
+        assert!(validate_face_anchor_json(&raw).is_ok());
+        raw["path"] = serde_json::json!([1]);
+        assert!(validate_face_anchor_json(&raw).is_err());
+        raw["path"] = serde_json::json!([]);
+        raw["target"]["name"] = Value::String("x".repeat(1_000_000));
+        assert!(validate_face_anchor_json(&raw).is_err());
+    }
+    #[test]
+    fn extrude_cap_profile_reordering_never_retargets_an_ordinal_body() {
+        use solvecraft_geom::Vec2;
+        let mut sketch = solvecraft_sketch::Sketch::new();
+        for offset in [0., 30.] {
+            let points: Vec<_> = [(0., 0.), (10., 0.), (10., 10.), (0., 10.)]
+                .iter()
+                .map(|(x, y)| sketch.add_point(Vec2::new(x + offset, *y), None).unwrap())
+                .collect();
+            for edge in 0..4 {
+                sketch.add_line_pts(points[edge], points[(edge + 1) % 4], None).unwrap();
+            }
+        }
+        let mut doc = Document::default();
+        let source = doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Origin { name: "XY".into() }, sketch }, None).unwrap();
+        let extent: crate::Extent = serde_json::from_value(serde_json::json!({"distance":"10"})).unwrap();
+        let producer = doc
+            .add_feature(
+                FeatureKind::Extrude {
+                    sketch: source,
+                    profiles: crate::ProfileSel::Indices { indices: vec![0, 1] },
+                    extent,
+                    operation: crate::Operation::NewBody,
+                    targets: vec![],
+                },
+                None,
+            )
+            .unwrap();
+        let mut model = Model::new();
+        model.evaluate(&doc);
+        let state = model.state();
+        assert_eq!(state.bodies.len(), 2);
+        let solved = state.sketch(source).unwrap();
+        let regions = crate::select_profiles(solved, &crate::ProfileSel::All).unwrap();
+        let raw = solvecraft_kernel::extrude(&solved.plane, &regions, 0., 10.).unwrap();
+        assert!(
+            crate::config::extrude_cap_bindings(solved, &raw, 0).is_none(),
+            "exhausted certification work must leave the complete producer uncertified"
+        );
+        let bindings = crate::config::extrude_cap_bindings(solved, &raw, 10_000_000).unwrap();
+        assert_eq!(bindings.iter().flatten().flatten().count(), 4, "two profiles each retain both exact caps within budget");
+        let mut duplicate = raw.clone();
+        duplicate.extend(raw);
+        let ambiguous = crate::config::extrude_cap_bindings(solved, &duplicate, 10_000_000).unwrap();
+        assert!(ambiguous.iter().flatten().all(Option::is_none), "duplicated profile identities cannot stamp ambiguous caps");
+        let body = &state.bodies[0];
+        let index = body
+            .body
+            .face_sources()
+            .unwrap()
+            .iter()
+            .position(|source| matches!(source, Some(solvecraft_kernel::FaceSource::CertifiedExtrudeCap { high: true, .. })))
+            .unwrap();
+        let picked = body.body.face_plane(index).unwrap();
+        let anchor = doc.capture_face_anchor(body, index, &picked, &[], 0, &[]).unwrap();
+        let bounds = body.mesh().bounds();
+        let FeatureKind::Extrude { profiles, .. } = &mut doc.feature_mut(producer).unwrap().kind else {
+            panic!("fixture must retain its extrude feature")
+        };
+        *profiles = crate::ProfileSel::Indices { indices: vec![1, 0] };
+        model.evaluate(&doc);
+        let changed = model.state();
+        assert_eq!(changed.bodies.len(), 2);
+        if doc.resolve_face_anchor(&anchor, 0, &changed).is_ok() {
+            let current = changed.body(&anchor.target.body).unwrap().mesh().bounds();
+            assert!((current.min.x - bounds.min.x).abs() < 1e-9, "a same-role cap of the other profile must never replace the source");
+        }
+    }
+    #[test]
+    fn wrapped_legacy_face_is_reported_as_legacy_without_inferred_upgrade() {
+        let (mut doc, _, _, picked) = fixture();
+        let id = doc
+            .add_feature(
+                FeatureKind::Sketch {
+                    plane: PlaneRef::Offset {
+                        base: Box::new(PlaneRef::Face { plane: picked, at: picked.origin, name: None, anchor: None }),
+                        distance: "2".into(),
+                    },
+                    sketch: solvecraft_sketch::Sketch::new(),
+                },
+                None,
+            )
+            .unwrap();
+        let mut model = Model::new();
+        model.evaluate(&doc);
+        let FaceAttachmentStatus::Legacy { plane: Some(plane) } = doc.sketch_face_attachment(id, &model) else {
+            panic!("wrapped legacy attachment must retain its classification and fixed-plane escape");
+        };
+        assert!((plane.origin.z - 12.).abs() < 1e-9);
+        let FeatureKind::Sketch { plane, .. } = &doc.feature(id).unwrap().kind else { panic!("fixture must retain its sketch feature") };
+        assert!(plane_face_anchor(plane).is_none());
+    }
+    #[test]
+    fn warm_root_body_offset_edit_matches_cold_attached_sketch_and_downstream_bounds() {
+        use solvecraft_geom::Vec2;
+        let (mut doc, _, _, _) = fixture();
+        let mut warm = Model::new();
+        warm.evaluate(&doc);
+        let source = warm.state();
+        let body = &source.bodies[0];
+        let index = body
+            .body
+            .face_sources()
+            .unwrap()
+            .iter()
+            .position(|source| matches!(source, Some(solvecraft_kernel::FaceSource::Box { axis: 2, high: true, .. })))
+            .unwrap();
+        let picked = body.body.face_plane(index).unwrap();
+        let anchor = doc.capture_face_anchor(body, index, &picked, &[], 0, &[]).unwrap();
+        let source_name = body.name.clone();
+        let mut sketch = solvecraft_sketch::Sketch::new();
+        let points: Vec<_> =
+            [(2., 2.), (4., 2.), (4., 4.), (2., 4.)].iter().map(|(x, y)| sketch.add_point(Vec2::new(*x, *y), None).unwrap()).collect();
+        for edge in 0..4 {
+            sketch.add_line_pts(points[edge], points[(edge + 1) % 4], None).unwrap();
+        }
+        let sk = doc
+            .add_feature(
+                FeatureKind::Sketch {
+                    plane: PlaneRef::Face { plane: picked, at: picked.origin, name: None, anchor: Some(Box::new(anchor)) },
+                    sketch,
+                },
+                None,
+            )
+            .unwrap();
+        let extent = serde_json::from_value(serde_json::json!({"distance":"2"})).unwrap();
+        let boss = doc
+            .add_feature(
+                FeatureKind::Extrude { sketch: sk, profiles: crate::ProfileSel::All, extent, operation: crate::Operation::NewBody, targets: vec![] },
+                Some("Boss"),
+            )
+            .unwrap();
+        warm.evaluate(&doc);
+        let initial = warm.state();
+        let before = initial.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+        let mut offset = crate::IDENTITY;
+        offset[3][0] = 5.;
+        offset[3][2] = 3.;
+        doc.body_offsets.insert(source_name, offset);
+        warm.evaluate(&doc);
+        let mut cold = Model::new();
+        cold.evaluate(&doc);
+        let warm_state = warm.state();
+        let cold_state = cold.state();
+        let after = warm_state.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+        let rebuilt = cold_state.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+        assert!(
+            (after.min - before.min - Vec3::new(5., 0., 3.)).len() < 1e-7,
+            "before={before:?}, warm={after:?}, cold={rebuilt:?}, warm_plane={:?}, cold_plane={:?}",
+            warm_state.sketch(sk).map(|sk| sk.plane),
+            cold_state.sketch(sk).map(|sk| sk.plane)
+        );
+        assert!((after.min - rebuilt.min).len() < 1e-7);
+        assert!((after.max - rebuilt.max).len() < 1e-7);
+        let FaceAttachmentStatus::Healthy { plane, .. } = doc.sketch_face_attachment(sk, &warm) else {
+            panic!("offset source must remain attached");
+        };
+        assert!((plane.origin - warm_state.sketch(sk).unwrap().plane.origin).len() < 1e-9);
+        assert!((warm_state.sketch(sk).unwrap().plane.origin - cold_state.sketch(sk).unwrap().plane.origin).len() < 1e-9);
+    }
+}

crates/doc/src/format_offsets.rs

@@ -0,0 +1,453 @@
+//! Pre-allocation bounds for versioned analytic offset roles and boundary references.
+use std::collections::BTreeSet;
+
+use serde_json::Value;
+
+use crate::{DocError, Document, FeatureKind, ProfileSel, Result};
+
+fn invalid() -> DocError {
+    DocError::Invalid("damaged design: invalid analytic offset topology or boundary reference".into())
+}
+
+fn id(value: &Value) -> Result<&str> {
+    value.as_str().filter(|id| !id.is_empty() && id.len() <= 512 && !id.chars().any(char::is_control)).ok_or_else(invalid)
+}
+
+fn exact_keys(value: &Value, keys: &[&str]) -> Result<()> {
+    let object = value.as_object().ok_or_else(invalid)?;
+    if object.len() != keys.len() || object.keys().any(|key| !keys.contains(&key.as_str())) {
+        return Err(invalid());
+    }
+    Ok(())
+}
+
+/// Validate a complete-source profile reference before copying or decoding it.
+pub fn whole_profile_selection_from_value(value: &Value) -> Result<ProfileSel> {
+    validate_whole_reference(value)?;
+    serde_json::from_value(value.clone()).map_err(|_| invalid())
+}
+
+fn validate_whole_reference(value: &Value) -> Result<()> {
+    exact_keys(value, &["type", "profiles"])?;
+    if value.get("type").and_then(Value::as_str) != Some("whole_boundaries") {
+        return Err(invalid());
+    }
+    let profiles = value.get("profiles").and_then(Value::as_array).ok_or_else(invalid)?;
+    if profiles.is_empty() || profiles.len() > 128 {
+        return Err(invalid());
+    }
+    let mut total = 0usize;
+    let mut identities = BTreeSet::new();
+    for profile in profiles {
+        exact_keys(profile, &["outer", "holes"])?;
+        let mut boundary = |value: &Value| -> Result<Vec<String>> {
+            let values = value.as_array().ok_or_else(invalid)?;
+            if values.is_empty() || values.len() > 512 {
+                return Err(invalid());
+            }
+            total += values.len();
+            if total > 20_000 {
+                return Err(invalid());
+            }
+            let mut previous = None;
+            // Bound each raw ID before any owned allocation. Require canonical order.
+            for value in values {
+                let current = id(value)?;
+                if previous.is_some_and(|previous| previous >= current) {
+                    return Err(invalid());
+                }
+                previous = Some(current);
+            }
+            values.iter().map(|value| Ok(id(value)?.to_owned())).collect()
+        };
+        let outer = boundary(profile.get("outer").ok_or_else(invalid)?)?;
+        let holes = profile.get("holes").and_then(Value::as_array).ok_or_else(invalid)?;
+        if holes.len() > 128 {
+            return Err(invalid());
+        }
+        let mut sorted_holes = Vec::with_capacity(holes.len());
+        let mut all: BTreeSet<_> = outer.iter().cloned().collect();
+        for hole in holes {
+            let hole = boundary(hole)?;
+            if sorted_holes.last().is_some_and(|previous| previous >= &hole) || hole.iter().any(|curve| !all.insert(curve.clone())) {
+                return Err(invalid());
+            }
+            sorted_holes.push(hole);
+        }
+        if !identities.insert((outer, sorted_holes)) {
+            return Err(invalid());
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_raw(value: &Value) -> Result<()> {
+    let Some(features) = value.get("features").and_then(Value::as_array) else { return Ok(()) };
+    let mut total_roles = 0usize;
+    for feature in features {
+        if feature.get("type").and_then(Value::as_str) != Some("sketch") {
+            continue;
+        }
+        let Some(offsets) = feature.get("sketch").and_then(|sketch| sketch.get("offsets")) else { continue };
+        let offsets = offsets.as_array().ok_or_else(invalid)?;
+        let mut groups = BTreeSet::new();
+        let mut outputs = BTreeSet::new();
+        let mut point_owners = std::collections::BTreeMap::new();
+        let mut sketch_roles = 0usize;
+        for offset in offsets {
+            let Some(topology) = offset.get("topology").filter(|topology| !topology.is_null()) else { continue };
+            if groups.len() >= 128 {
+                return Err(invalid());
+            }
+            exact_keys(topology, &["version", "id", "roles"])?;
+            let group = id(topology.get("id").ok_or_else(invalid)?)?;
+            if !groups.insert(group)
+                || topology.get("version").and_then(Value::as_u64) != Some(1)
+                || offset.get("closed").and_then(Value::as_bool) != Some(true)
+            {
+                return Err(invalid());
+            }
+            let distance = offset.get("distance").and_then(Value::as_f64).ok_or_else(invalid)?;
+            if !distance.is_finite() || distance.abs() <= 1e-9 || distance.abs() >= 1e9 {
+                return Err(invalid());
+            }
+            let sources = offset.get("sources").and_then(Value::as_array).ok_or_else(invalid)?;
+            let roles = topology.get("roles").and_then(Value::as_array).ok_or_else(invalid)?;
+            let active = offset.get("outputs").and_then(Value::as_array).ok_or_else(invalid)?;
+            if roles.is_empty() || roles.len() > 512 || roles.len() != sources.len() || active.len() > roles.len() {
+                return Err(invalid());
+            }
+            total_roles = total_roles.saturating_add(roles.len());
+            sketch_roles = sketch_roles.saturating_add(roles.len());
+            if total_roles > 1_000_000 || sketch_roles > 20_000 {
+                return Err(invalid());
+            }
+            let mut active_index = 0;
+            let mut source_ids = BTreeSet::new();
+            for (source, role) in sources.iter().zip(roles) {
+                let source = source.as_array().ok_or_else(invalid)?;
+                if source.len() != 2 || source.get(1).and_then(Value::as_bool).is_none() {
+                    return Err(invalid());
+                }
+                let source = id(source.first().ok_or_else(invalid)?)?;
+                if !source_ids.insert(source) {
+                    return Err(invalid());
+                }
+                let role_object = role.as_object().ok_or_else(invalid)?;
+                if role_object.keys().any(|key| !matches!(key.as_str(), "output" | "kind" | "start" | "end" | "retired" | "flags")) {
+                    return Err(invalid());
+                }
+                if let Some(flags) = role.get("flags") {
+                    exact_keys(flags, &["construction", "centerline", "reversed", "fixed"])?;
+                    if flags.as_object().is_none_or(|flags| flags.values().any(|flag| flag.as_bool().is_none())) {
+                        return Err(invalid());
+                    }
+                }
+                let output = id(role.get("output").ok_or_else(invalid)?)?;
+                if source == output || !outputs.insert(output) {
+                    return Err(invalid());
+                }
+                if role.get("start") == role.get("end") {
+                    return Err(invalid());
+                }
+                for key in ["start", "end"] {
+                    let point = id(role.get(key).ok_or_else(invalid)?)?;
+                    if point == output || point == source || point_owners.insert(point, group).is_some_and(|owner| owner != group) {
+                        return Err(invalid());
+                    }
+                }
+                let kind = role.get("kind").and_then(Value::as_str).ok_or_else(invalid)?;
+                let retired = role.get("retired").and_then(Value::as_bool).ok_or_else(invalid)?;
+                if !matches!(kind, "line" | "arc") || (retired && kind != "arc") {
+                    return Err(invalid());
+                }
+                if !retired {
+                    if active.get(active_index).map(id).transpose()?.is_none_or(|id| id != output) {
+                        return Err(invalid());
+                    }
+                    active_index += 1;
+                }
+            }
+            if active_index != active.len() || active_index < 3 {
+                return Err(invalid());
+            }
+        }
+        if groups.iter().any(|group| outputs.contains(group) || point_owners.contains_key(group))
+            || outputs.iter().any(|output| point_owners.contains_key(output))
+        {
+            return Err(invalid());
+        }
+    }
+    fn references(value: &Value) -> Result<()> {
+        if value.get("type").and_then(Value::as_str) == Some("whole_boundaries") {
+            return validate_whole_reference(value);
+        }
+        if value.get("type").and_then(Value::as_str) == Some("offset_boundaries") {
+            exact_keys(value, &["type", "associations"])?;
+            let ids = value.get("associations").and_then(Value::as_array).ok_or_else(invalid)?;
+            if ids.is_empty() || ids.len() > 128 {
+                return Err(invalid());
+            }
+            let mut seen = BTreeSet::new();
+            for value in ids {
+                if !seen.insert(id(value)?) {
+                    return Err(invalid());
+                }
+            }
+        }
+        Ok(())
+    }
+    // Only feature profile fields can contain this variant. Do not impose a new
+    // document-wide node limit on unrelated legacy sketches or imported payloads.
+    for feature in features {
+        if let Some(selection) = feature.get("profiles") {
+            references(selection)?;
+        }
+        if let Some(sections) = feature.get("sections").and_then(Value::as_array) {
+            if sections.len() > 10_000 {
+                return Err(invalid());
+            }
+            for section in sections {
+                if let Some(selection) = section.get("profiles") {
+                    references(selection)?;
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_typed(document: &Document) -> Result<()> {
+    let mut sketches = std::collections::BTreeMap::new();
+    for feature in &document.features {
+        if let FeatureKind::Sketch { sketch, .. } = &feature.kind {
+            sketch.validate_offset_topologies()?;
+            sketches.insert(feature.id, sketch);
+        }
+        for (sketch, selection) in feature.kind.profile_sels() {
+            if let ProfileSel::OffsetBoundaries { associations } = selection {
+                // A deleted association or source sketch is a repairable model error,
+                // just like an ordinary missing curve reference. Keep that design loadable.
+                let Some(sketch) = sketches.get(&sketch) else { continue };
+                for association in associations {
+                    let count =
+                        sketch.offsets.iter().filter_map(|offset| offset.topology.as_ref()).filter(|topology| &topology.id == association).count();
+                    if count > 1 {
+                        return Err(invalid());
+                    }
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::panic)]
+    use super::*;
+    use serde_json::json;
+
+    fn fixture() -> Value {
+        json!({"features":[{"type":"sketch","sketch":{"offsets":[{
+            "sources":[["s0",true],["s1",true],["s2",true],["s3",true]],
+            "outputs":["l0","l1","l2"],"closed":true,"distance":1.4,
+            "topology":{"version":1,"id":"o1","roles":[
+                {"output":"l0","kind":"line","start":"p0","end":"p1","retired":false},
+                {"output":"a0","kind":"arc","start":"p1","end":"p2","retired":true},
+                {"output":"l1","kind":"line","start":"p2","end":"p3","retired":false},
+                {"output":"l2","kind":"line","start":"p3","end":"p0","retired":false}
+            ]}
+        }]}}]})
+    }
+
+    #[test]
+    fn whole_boundaries_raw_identity_is_bounded_canonical_and_complete() {
+        let good = json!({"type":"whole_boundaries","profiles":[{"outer":["s2"],"holes":[["s1"]]}]});
+        assert!(matches!(whole_profile_selection_from_value(&good).unwrap(), ProfileSel::WholeBoundaries { profiles } if profiles.len() == 1));
+        let malformed = [
+            json!({"type":"whole_boundaries","profiles":[]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":[],"holes":[]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s1","s1"],"holes":[]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s2","s1"],"holes":[]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s1"],"holes":[["s1"]]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s2"],"holes":[["s1"],["s1"]]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s2"],"holes":[["s3"],["s1"]]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s2"],"holes":[],"extra":true}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["s2"],"holes":[]},{"outer":["s2"],"holes":[]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["x".repeat(513)],"holes":[]}]}),
+            json!({"type":"whole_boundaries","profiles":[{"outer":["a\nb"],"holes":[]}]}),
+        ];
+        for value in malformed {
+            assert!(whole_profile_selection_from_value(&value).is_err(), "accepted malformed reference {value}");
+            assert!(validate_raw(&json!({"features":[{"type":"extrude","profiles":value}]})).is_err());
+        }
+        let many = (0..129).map(|index| json!({"outer":[format!("c{index:03}")],"holes":[]})).collect::<Vec<_>>();
+        assert!(whole_profile_selection_from_value(&json!({"type":"whole_boundaries","profiles":&many[..128]})).is_ok());
+        assert!(whole_profile_selection_from_value(&json!({"type":"whole_boundaries","profiles":many})).is_err());
+        let oversized = (0..513).map(|index| format!("c{index:03}")).collect::<Vec<_>>();
+        assert!(whole_profile_selection_from_value(&json!({"type":"whole_boundaries","profiles":[{"outer":oversized,"holes":[]}]})).is_err());
+        let too_many_holes = (0..129).map(|index| vec![format!("hole{index:03}")]).collect::<Vec<_>>();
+        assert!(
+            whole_profile_selection_from_value(&json!({"type":"whole_boundaries","profiles":[{"outer":["outer"],"holes":too_many_holes}]})).is_err()
+        );
+        let aggregate = (0..40)
+            .map(|profile| {
+                let outer = (0..512).map(|curve| format!("profile{profile:03}curve{curve:03}")).collect::<Vec<_>>();
+                json!({"outer":outer,"holes":[]})
+            })
+            .collect::<Vec<_>>();
+        assert!(whole_profile_selection_from_value(&json!({"type":"whole_boundaries","profiles":aggregate})).is_err());
+    }
+
+    #[test]
+    fn raw_offset_roles_reject_aliases_order_damage_and_hostile_shapes() {
+        let good = fixture();
+        assert!(validate_raw(&good).is_ok());
+        let path = "/features/0/sketch/offsets/0";
+        let mut flags = good.clone();
+        flags.pointer_mut(&format!("{path}/topology/roles/1")).unwrap()["flags"] =
+            json!({"construction":true,"centerline":false,"reversed":true,"fixed":false});
+        assert!(validate_raw(&flags).is_ok());
+        *flags.pointer_mut(&format!("{path}/topology/roles/1/flags/construction")).unwrap() = json!(1);
+        assert!(validate_raw(&flags).is_err());
+        for (suffix, replacement) in [
+            ("/topology/version", json!(2)),
+            ("/topology/id", json!("x".repeat(513))),
+            ("/closed", json!(false)),
+            ("/distance", json!(1e9)),
+            ("/outputs", json!(["l1", "l0", "l2"])),
+            ("/outputs", json!(["l0", "a0", "l1", "l2"])),
+            ("/topology/roles/1/kind", json!("line")),
+            ("/topology/roles/1/output", json!("l0")),
+            ("/topology/roles/1/start", json!("a0")),
+            ("/topology/roles/0/kind", json!("guess")),
+            ("/sources/0/1", json!(0)),
+            ("/sources/0/0", json!("l0")),
+            ("/topology/roles", json!(vec![json!({}); 513])),
+        ] {
+            let mut damaged = good.clone();
+            *damaged.pointer_mut(&format!("{path}{suffix}")).unwrap() = replacement;
+            assert!(validate_raw(&damaged).is_err(), "accepted {suffix}");
+        }
+        let mut extra = good.clone();
+        extra.pointer_mut(&format!("{path}/topology")).unwrap()["fallback"] = json!([]);
+        assert!(validate_raw(&extra).is_err());
+        let mut excessive = good.clone();
+        let chain = excessive.pointer(path).unwrap().clone();
+        let groups = (0..129)
+            .map(|index| {
+                let mut chain = chain.clone();
+                chain["topology"]["id"] = json!(format!("o{index}"));
+                for source in chain["sources"].as_array_mut().unwrap() {
+                    source[0] = json!(format!("g{index}-{}", source[0].as_str().unwrap()));
+                }
+                for output in chain["outputs"].as_array_mut().unwrap() {
+                    *output = json!(format!("g{index}-{}", output.as_str().unwrap()));
+                }
+                for role in chain["topology"]["roles"].as_array_mut().unwrap() {
+                    for key in ["output", "start", "end"] {
+                        role[key] = json!(format!("g{index}-{}", role[key].as_str().unwrap()));
+                    }
+                }
+                chain
+            })
+            .collect::<Vec<_>>();
+        excessive["features"][0]["sketch"]["offsets"] = json!(&groups[..128]);
+        assert!(validate_raw(&excessive).is_ok(), "the permitted group boundary must be accepted");
+        excessive["features"][0]["sketch"]["offsets"] = json!(groups);
+        assert!(validate_raw(&excessive).is_err());
+    }
+
+    #[test]
+    fn raw_boundary_references_are_bounded_and_future_versions_refuse_first() {
+        let mut good = fixture();
+        good["features"].as_array_mut().unwrap().push(json!({"type":"extrude","profiles":{"type":"offset_boundaries","associations":["o1"]}}));
+        assert!(validate_raw(&good).is_ok());
+        for associations in [json!([]), json!(["o1", "o1"]), json!(["x".repeat(513)]), json!(vec!["o"; 129]), json!([0])] {
+            let mut damaged = good.clone();
+            damaged["features"][1]["profiles"]["associations"] = associations;
+            assert!(validate_raw(&damaged).is_err());
+            damaged["format"] = json!(crate::format::format_string(crate::format::FORMAT + 1));
+            assert!(crate::format::read(&damaged.to_string()).unwrap_err().to_string().contains("newer SolidCraft"));
+        }
+        // Absent metadata preserves the historical one-to-one chain representation.
+        let mut legacy = fixture();
+        legacy["features"][0]["sketch"]["offsets"][0].as_object_mut().unwrap().remove("topology");
+        legacy["features"][0]["sketch"]["offsets"][0]["closed"] = json!(false);
+        assert!(validate_raw(&legacy).is_ok());
+    }
+
+    #[test]
+    fn formats_one_through_eleven_keep_legacy_offset_geometry_and_ids() {
+        let mut sketch = solvecraft_sketch::Sketch::new();
+        let center = sketch.add_point(solvecraft_geom::Vec2::new(4., 7.), Some("center")).unwrap();
+        sketch.add_circle(solvecraft_geom::Vec2::new(4., 7.), 10., Some(center), Some("source")).unwrap();
+        sketch.add_circle(solvecraft_geom::Vec2::new(4., 7.), 9., Some(center), Some("offset")).unwrap();
+        sketch.offsets.push(solvecraft_sketch::OffsetChain {
+            sources: vec![("source".into(), true)],
+            outputs: vec!["offset".into()],
+            distance: 1.,
+            closed: true,
+            topology: None,
+        });
+        let mut document = Document::new("legacy offset circles");
+        let sketch_id =
+            document.add_feature(FeatureKind::Sketch { plane: crate::PlaneRef::Origin { name: "XY".into() }, sketch }, Some("Circles")).unwrap();
+        let original: Value = serde_json::from_str(&document.to_json()).unwrap();
+        for version in 1..=11 {
+            let mut old = original.clone();
+            old["format"] = json!(crate::format::format_string(version));
+            let upgraded = crate::format::read(&old.to_string()).unwrap();
+            let saved: Value = serde_json::from_str(&upgraded.to_json()).unwrap();
+            assert_eq!(saved["features"][0]["sketch"]["offsets"], original["features"][0]["sketch"]["offsets"]);
+            assert_eq!(saved["features"][0]["sketch"]["curves"], original["features"][0]["sketch"]["curves"]);
+            assert_eq!(saved["features"][0]["sketch"]["points"], original["features"][0]["sketch"]["points"]);
+            let mut model = crate::Model::new();
+            model.evaluate(&upgraded);
+            assert!(model.results.iter().all(|result| result.error.is_none()));
+            let state = model.state();
+            let solved = state.sketch(sketch_id).unwrap();
+            let radius = solved.sketch.curves.iter().find(|curve| curve.id == "offset").map(|curve| &curve.kind);
+            assert!(matches!(radius,Some(solvecraft_sketch::CurveKind::Circle {r,..}) if *r ==9.));
+        }
+    }
+
+    #[test]
+    fn missing_boundary_or_defining_sketch_reopens_as_a_model_error_without_retarget() {
+        for missing_sketch in [false, true] {
+            let mut sketch = solvecraft_sketch::Sketch::new();
+            sketch.add_circle(solvecraft_geom::Vec2::new(0., 0.), 10., None, Some("unrelated-circle")).unwrap();
+            let mut document = Document::new("repairable lost boundary");
+            let id = document.add_feature(FeatureKind::Sketch { plane: crate::PlaneRef::Origin { name: "XY".into() }, sketch }, None).unwrap();
+            document
+                .add_feature(
+                    FeatureKind::Extrude {
+                        sketch: if missing_sketch { 999_999 } else { id },
+                        profiles: ProfileSel::OffsetBoundaries { associations: vec!["deleted-o1".into()] },
+                        extent: crate::Extent {
+                            distance: "2".into(),
+                            direction: crate::Direction::Positive,
+                            distance2: None,
+                            start_offset: None,
+                            through_all: false,
+                            taper: None,
+                            to: None,
+                            to_offset: None,
+                            from: None,
+                        },
+                        operation: crate::Operation::NewBody,
+                        targets: vec![],
+                    },
+                    None,
+                )
+                .unwrap();
+            let reopened = crate::format::read(&document.to_json()).unwrap();
+            assert_eq!(reopened, document);
+            let mut model = crate::Model::new();
+            model.evaluate(&reopened);
+            assert!(model.results.last().unwrap().error.is_some());
+            assert!(model.state().bodies.is_empty(), "lost boundary must not select the remaining ordinary circle");
+        }
+    }
+}

crates/doc/src/joints.rs

@@ -223,7 +223,7 @@ pub fn motion(kind: JointKind, q: &[f64]) -> Mat {
 
 /// Bodies of a component in the model (its own frame).
 fn component_bodies<'a>(doc: &Document, st: &'a ModelState, component: u64) -> Vec<&'a crate::ModelBody> {
-    st.bodies.iter().filter(|b| doc.body_component(&b.name, b.feature) == component).collect()
+    st.bodies.iter().filter(|b| doc.model_body_component(b) == component).collect()
 }
 
 /// The component an occurrence places (0 for the root).

crates/doc/src/lib.rs

@@ -7,28 +7,40 @@
 
 pub mod appearance;
 mod assembly;
+mod body_transfer;
+mod body_transfer_sheet;
+pub use body_transfer::{valid_transfer_matrix, validate_body_transfer};
 pub mod canvas;
 mod clipboard;
+pub use clipboard::{clone_expression, remap_topology};
 pub mod config;
+pub mod construct;
 mod document;
 mod eval;
 pub mod expr;
+pub mod face_anchor;
+pub use face_anchor::{FaceAnchor, FaceAttachmentStatus};
 pub mod format;
+mod format_offsets;
+pub use format_offsets::whole_profile_selection_from_value;
 pub mod joints;
 pub mod motion;
 pub mod naming;
 mod params;
+mod profile_refs;
+pub use profile_refs::{capture_profile_selection, profile_selection_indices};
 pub mod plastic;
 pub mod project;
 mod project3d;
 pub use project3d::iso_grid;
 pub mod sheet;
 
-pub use assembly::{IDENTITY, Mat, Occurrence, apply_point, apply_vector, is_identity, mat_inverse, mat_mul, rigid};
+pub use assembly::{IDENTITY, Mat, Occurrence, apply_point, apply_vector, is_identity, map_point_expr, mat_inverse, mat_mul, rigid};
 pub use document::*;
 pub use eval::{
-    EdgeRef, FeatureResult, Model, ModelBody, ModelState, SolvedSketch, ThreadInfo, edge_names_for, edge_refs, parse_metric_thread, pattern_matrices,
-    world_state,
+    EdgeRef, FeatureResult, Model, ModelBody, ModelState, RevolveExtent, SolvedSketch, ThreadInfo, curve_pick_error, edge_names_for, edge_refs,
+    object_height, parse_metric_thread, pattern_matrices, revolve_extent, revolve_extent_with_convention, select_profiles, state_in_frame,
+    state_in_frame_at, through_all_distance, world_state,
 };
 pub use params::{ParamRow, ParamUser, cycles};
 pub use solvecraft_kernel as kernel;
@@ -50,5 +62,10 @@ pub enum DocError {
 
 pub type Result<T> = std::result::Result<T, DocError>;
 
+#[cfg(test)]
+mod named_projection_tests;
 #[cfg(test)]
 mod tests;
+
+mod anchor_frame;
+pub use anchor_frame::state_in_face_anchor_frame;

crates/doc/src/named_projection_tests.rs

@@ -0,0 +1,50 @@
+use crate::{Document, ModelBody, ModelState};
+use solvecraft_geom::{Plane, Vec3};
+use solvecraft_sketch::{LinkKind, LinkSource, Sketch};
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+fn named_box(name: &str, width: f64, height: f64) -> ModelBody {
+    let body = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(width, width, height)).unwrap();
+    let mut names = vec!["unrelated".to_string(); body.faces(0.01).unwrap().len()];
+    let top = body.faces(0.01).unwrap().into_iter().find(|face| face.plane_normal.is_some_and(|normal| normal.z > 0.99)).unwrap().index;
+    names[top] = "shared:top".into();
+    let mut result = ModelBody::new(name.into(), body, 1);
+    result.names = crate::naming::NameCell::known(Arc::new(names));
+    result
+}
+
+#[test]
+fn named_manual_projection_keeps_its_body_and_face_at_shared_boundaries() {
+    let doc = Document::default();
+    let mut initial = ModelState::default();
+    initial.bodies.extend([named_box("Source", 20., 10.), named_box("Control", 5., 10.)]);
+    let plane = Plane::XY.offset(20.);
+    let source = LinkSource::Face { body: "Source".into(), at: Vec3::new(1., 1., 10.) };
+    let resolved = crate::project::resolve(&doc, &BTreeMap::new(), &initial, &plane, LinkKind::Project, &source).unwrap();
+    let mut sketch = Sketch::default();
+    let link = sketch.add_link(LinkKind::Project, source, &resolved.geom).unwrap();
+    sketch.links[0].face_name = Some("shared:top".into());
+    sketch.links[0].source = LinkSource::Face { body: "Source".into(), at: Vec3::new(0., 0., 10.) };
+    let mut current = ModelState::default();
+    current.bodies.extend([named_box("Source", 20., 20.), named_box("Control", 5., 10.)]);
+    assert!(crate::project::refresh_links(&doc, &BTreeMap::new(), &current, &plane, &mut sketch).is_empty());
+    assert!(!sketch.links[0].lost);
+    assert!(sketch.points.iter().any(|point| point.pos.x > 19.));
+    assert!(sketch.points.iter().any(|point| point.pos.y > 19.));
+    assert!(matches!(&sketch.links[0].source,LinkSource::Face{body,at} if body=="Source" && (at.z-20.).abs()<1e-6));
+    // The closest named point can sit on the wall/top seam: retain its actual
+    // face index rather than re-picking the adjacent vertical wall.
+    let index = crate::naming::face_on_body(current.body("Source").unwrap(), "shared:top", Vec3::new(0., 0., 10.)).unwrap().0;
+    assert!(current.body("Source").unwrap().body.faces(0.01).unwrap()[index].plane_normal.unwrap().z > 0.99);
+    let saved = sketch.clone();
+    let mut missing = ModelState::default();
+    missing.bodies.push(named_box("Control", 5., 10.));
+    let warnings = crate::project::refresh_links(&doc, &BTreeMap::new(), &missing, &plane, &mut sketch);
+    assert!(sketch.links[0].lost);
+    assert!(!warnings.is_empty());
+    assert_eq!(sketch.curves, saved.curves);
+    assert_eq!(sketch.points, saved.points);
+    assert_eq!(sketch.links[0].id, link);
+    assert!(matches!(&sketch.links[0].source,LinkSource::Face{body,..} if body=="Source"));
+}

crates/doc/src/naming.rs

@@ -34,6 +34,12 @@ impl NameCell {
     pub fn new(origin: Option<Arc<NamingOrigin>>) -> Self {
         NameCell { origin, names: Arc::new(OnceLock::new()) }
     }
+    /// Names already known (a moved copy of a body keeps its faces' names).
+    pub fn known(names: Arc<Vec<String>>) -> Self {
+        let cell = OnceLock::new();
+        let _ = cell.set(names);
+        NameCell { origin: None, names: Arc::new(cell) }
+    }
 }
 
 /// Deeper chains than this are named by position only (bounded work and stack).
@@ -167,6 +173,13 @@ pub fn face_names(b: &ModelBody) -> Arc<Vec<String>> {
 
 /// Work out a body's face names from the feature that made it and the model before it.
 fn derive(b: &ModelBody, o: &NamingOrigin, nf: usize) -> Vec<String> {
+    // A rigid Move changes coordinates, not topology or face ownership. Geometric
+    // overlap with the unmoved input cannot recover the names at the new position.
+    if matches!(o.feature.kind, FeatureKind::Move { .. })
+        && let Some(input) = o.before.body(&b.name)
+    {
+        return face_names(input).as_ref().clone();
+    }
     let m = b.mesh();
     let size = b.body.size().max(1e-6);
     let tol = (size * 1e-4).max(1e-6);
@@ -182,11 +195,22 @@ fn derive(b: &ModelBody, o: &NamingOrigin, nf: usize) -> Vec<String> {
             || xb.max.z < bb.min.z - tol
             || xb.min.z > bb.max.z + tol)
     };
+    // Independently created solids own their faces even when another body
+    // occupies the same coordinates. Boolean operations still inherit inputs.
+    let independent_solid = matches!(
+        o.feature.kind,
+        FeatureKind::Box { operation: crate::Operation::NewBody, .. }
+            | FeatureKind::Cylinder { operation: crate::Operation::NewBody, .. }
+            | FeatureKind::Sphere { operation: crate::Operation::NewBody, .. }
+            | FeatureKind::Torus { operation: crate::Operation::NewBody, .. }
+            | FeatureKind::Extrude { operation: crate::Operation::NewBody, .. }
+            | FeatureKind::Revolve { operation: crate::Operation::NewBody, .. }
+    );
     let inputs: Vec<(&ModelBody, FaceIndex, Arc<Vec<String>>)> = o
         .before
         .bodies
         .iter()
-        .filter(|x| !x.body.is_mesh() && overlaps(x))
+        .filter(|x| !independent_solid && !x.body.is_mesh() && overlaps(x))
         .take(64)
         .map(|x| {
             let n = face_count(x);
@@ -226,7 +250,14 @@ fn derive(b: &ModelBody, o: &NamingOrigin, nf: usize) -> Vec<String> {
         .enumerate()
         .map(|(fi, n)| {
             n.unwrap_or_else(|| {
-                role_name(&o.feature, &o.before, pts.get(fi).map(Vec::as_slice).unwrap_or(&[]), ns.get(fi).unwrap_or(&empty), fi, fid)
+                let (ps, nn) = (pts.get(fi).map(Vec::as_slice).unwrap_or(&[]), ns.get(fi).unwrap_or(&empty));
+                // A shell's inner face: the face its wall runs back to.
+                if matches!(o.feature.kind, FeatureKind::Shell { .. })
+                    && let Some(n) = behind(ps, nn, &inputs)
+                {
+                    return format!("F{fid}:inner:{}", strip_piece(&n));
+                }
+                role_name(&o.feature, &o.before, ps, nn, fi, fid)
             })
         })
         .collect();
@@ -234,6 +265,59 @@ fn derive(b: &ModelBody, o: &NamingOrigin, nf: usize) -> Vec<String> {
     names
 }
 
+/// The input face a face looks back at through the material (along minus its normal): the
+/// face a shell wall's inner side offsets.
+fn behind(ps: &[Vec3], ns: &[Vec3], inputs: &[(&ModelBody, FaceIndex, Arc<Vec<String>>)]) -> Option<String> {
+    let n = ns.first().copied()?;
+    let d = n * -1.0;
+    let mut votes: Vec<(String, usize)> = Vec::new();
+    for p in ps {
+        let mut best: Option<(f64, String)> = None;
+        for (_, idx, nm) in inputs {
+            for (fi, (_, _, tris)) in idx.faces.iter().enumerate() {
+                for [a, b, c] in tris {
+                    if let Some(t) = ray_hit(*p, d, *a, *b, *c)
+                        && t > 1e-9
+                        && best.as_ref().is_none_or(|(bt, _)| t < *bt)
+                        && let Some(name) = nm.get(fi)
+                    {
+                        best = Some((t, name.clone()));
+                    }
+                }
+            }
+        }
+        if let Some((_, n)) = best {
+            match votes.iter_mut().find(|(v, _)| *v == n) {
+                Some(v) => v.1 += 1,
+                None => votes.push((n, 1)),
+            }
+        }
+    }
+    votes.sort_by_key(|v| std::cmp::Reverse(v.1));
+    votes.first().filter(|(_, k)| *k * 2 >= ps.len().max(1)).map(|(n, _)| n.clone())
+}
+
+fn ray_hit(o: Vec3, d: Vec3, a: Vec3, b: Vec3, c: Vec3) -> Option<f64> {
+    let (e1, e2) = (b - a, c - a);
+    let h = d.cross(e2);
+    let det = e1.dot(h);
+    if det.abs() < 1e-14 {
+        return None;
+    }
+    let f = 1.0 / det;
+    let s = o - a;
+    let u = f * s.dot(h);
+    if !(0.0..=1.0).contains(&u) {
+        return None;
+    }
+    let q = s.cross(e1);
+    let v = f * d.dot(q);
+    if v < 0.0 || u + v > 1.0 {
+        return None;
+    }
+    Some(f * e2.dot(q))
+}
+
 /// The input face most of a face's sample points lie on (mapped by `map` first), if it holds
 /// at least half of them.
 fn vote(ps: &[Vec3], inputs: &[(&ModelBody, FaceIndex, Arc<Vec<String>>)], tol: f64, map: Option<&crate::Mat>) -> Option<String> {
@@ -247,16 +331,20 @@ fn vote(ps: &[Vec3], inputs: &[(&ModelBody, FaceIndex, Arc<Vec<String>>)], tol:
             if let Some(f) = idx.face_at(p, tol)
                 && let Some(n) = nm.get(f)
             {
+                // A later operation may merge several pieces of the same input face.
+                // Count their shared ancestry before testing the majority; a piece
+                // number identifies topology subdivision, not a different source.
+                let n = strip_piece(n);
                 match votes.iter_mut().find(|(v, _)| v == n) {
                     Some(v) => v.1 += 1,
-                    None => votes.push((n.clone(), 1)),
+                    None => votes.push((n.to_string(), 1)),
                 }
                 break;
             }
         }
     }
     votes.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
-    votes.first().filter(|(_, n)| *n * 2 >= ps.len().max(1)).map(|(n, _)| strip_piece(n).to_string())
+    votes.first().filter(|(_, n)| *n * 2 >= ps.len().max(1) && votes.get(1).is_none_or(|(_, other)| n > other)).map(|(n, _)| n.clone())
 }
 
 /// A face name without its piece number (`#k`).
@@ -382,6 +470,27 @@ fn role_name(f: &Feature, before: &ModelState, ps: &[Vec3], ns: &[Vec3], fi: usi
                 .min_by(|a, b| a.0.total_cmp(&b.0));
             best.map(|(_, id)| format!("F{fid}:side:{id}")).unwrap_or_else(|| format!("F{fid}:face:{fi}"))
         }
+        FeatureKind::Sweep { .. } | FeatureKind::Loft { .. } => {
+            let sk = match &f.kind {
+                FeatureKind::Sweep { sketch, .. } => Some(*sketch),
+                FeatureKind::Loft { sections, .. } => sections.first().map(|x| x.sketch),
+                _ => None,
+            };
+            let Some(ss) = sk.and_then(|k| before.sketch(k)) else { return format!("F{fid}:face:{fi}") };
+            let n = ss.plane.normal();
+            let h = |p: &Vec3| (*p - ss.plane.origin).dot(n);
+            let flat = !ns.is_empty() && ns.windows(2).all(|w| w[0].cross(w[1]).len() < 1e-6);
+            if flat && ps.iter().all(|p| h(p).abs() < 1e-6 * (1.0 + p.len())) {
+                return format!("F{fid}:start");
+            }
+            if flat && ns.iter().all(|m| m.cross(n).len() < 1e-6) {
+                return format!("F{fid}:end");
+            }
+            // A side: the profile curve under its sample nearest the start.
+            let Some(p0) = ps.iter().min_by(|a, b| h(a).abs().total_cmp(&h(b).abs())) else { return format!("F{fid}:face:{fi}") };
+            let q = ss.plane.to_local(*p0);
+            nearest_curve(ss, Vec2::new(q.x, q.y)).map(|id| format!("F{fid}:side:{id}")).unwrap_or_else(|| format!("F{fid}:face:{fi}"))
+        }
         FeatureKind::Box { .. } => {
             let n = ns.first().copied().unwrap_or(Vec3::Z);
             let axis = |v: f64, p: &str, m: &str| {
@@ -550,6 +659,21 @@ pub fn face_names_at(st: &ModelState, pts: &[Vec3]) -> Vec<String> {
         .collect()
 }
 
+/// Capture a face name from the recorded projection body only.
+pub fn face_name_at_body(body: &ModelBody, point: Vec3) -> Option<String> {
+    if body.body.is_mesh() || !point.is_finite() {
+        return None;
+    }
+    let mesh = body.mesh();
+    let count = face_count(body);
+    if mesh.triangles.len() > 2_000_000 || count > 50_000 {
+        return None;
+    }
+    let tolerance = (body.body.size() * 1e-3).max(1e-3);
+    let index = FaceIndex::new(&mesh, count).face_at(point, tolerance)?;
+    face_names(body).get(index).filter(|name| !name.is_empty()).cloned()
+}
+
 /// The point on the face with this name nearest `p` (a split face: its nearest piece, with
 /// `true` for "it was split"); `None` when no face has the name.
 pub fn point_on_face(st: &ModelState, name: &str, p: Vec3) -> Option<(Vec3, bool)> {
@@ -574,3 +698,56 @@ pub fn point_on_face(st: &ModelState, name: &str, p: Vec3) -> Option<(Vec3, bool
     }
     best.map(|(_, q, split)| (q, split))
 }
+
+/// Resolve a legacy named face only on its recorded source body. Return the
+/// selected face index as well as the closest point, which may lie on a shared
+/// edge and therefore must not be used to pick the face a second time.
+pub fn face_on_body(body: &ModelBody, name: &str, p: Vec3) -> Option<(usize, Vec3, bool)> {
+    if body.body.is_mesh() {
+        return None;
+    }
+    let names = face_names(body);
+    let mesh = body.mesh();
+    let stem = strip_piece(name);
+    let mut best: Option<(f64, usize, Vec3, bool)> = None;
+    for (triangle, face) in mesh.triangles.iter().zip(&mesh.tri_face) {
+        let index = usize::try_from(*face).ok()?;
+        let Some(candidate) = names.get(index) else { continue };
+        let exact = candidate == name;
+        if !exact && strip_piece(candidate) != stem {
+            continue;
+        }
+        let Some([a, b, c]) = mesh.tri(triangle) else { continue };
+        let q = closest(p, a, b, c);
+        let distance = q.dist(p) - if exact { 1e-9 } else { 0. };
+        if best.is_none_or(|(old, _, _, _)| distance < old) {
+            best = Some((distance, index, q, !exact));
+        }
+    }
+    best.map(|(_, index, q, split)| (index, q, split))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn merged_face_votes_collectively_for_pieces_of_one_source() {
+        let body = ModelBody::new("Input".into(), solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(4., 1., 1.)).unwrap(), 1);
+        let mut mesh = Mesh::default();
+        let mut points = Vec::new();
+        for i in 0..3u32 {
+            let x = f64::from(i);
+            mesh.positions.extend([Vec3::new(x, 0., 0.), Vec3::new(x + 0.8, 0., 0.), Vec3::new(x, 0.8, 0.)]);
+            mesh.triangles.push([i * 3, i * 3 + 1, i * 3 + 2]);
+            mesh.tri_face.push(i);
+            points.push(Vec3::new(x + 0.2, 0.2, 0.));
+        }
+        let pieces = Arc::new(vec!["F1:side:wall#1".into(), "F1:side:wall#2".into(), "F1:side:wall#3".into()]);
+        assert_eq!(vote(&points, &[(&body, FaceIndex::new(&mesh, 3), pieces)], 1e-8, None).as_deref(), Some("F1:side:wall"));
+        let distinct = Arc::new(vec!["F1:side:wall#1".into(), "F2:side:wall#2".into(), "F3:side:wall#3".into()]);
+        let inputs = [(&body, FaceIndex::new(&mesh, 3), distinct)];
+        assert_eq!(vote(&points, &inputs, 1e-8, None), None);
+        assert_eq!(vote(&points[..2], &inputs, 1e-8, None), None, "equal different-source votes must not pick a lexicographic winner");
+    }
+}

crates/doc/src/params.rs

@@ -21,6 +21,7 @@ fn plane_inputs_mut<'a>(p: &'a mut PlaneRef, v: &mut Vec<(&'static str, &'a mut
             v.push(("Angle", angle, Kind::Angle));
             plane_inputs_mut(base, v);
         }
+        PlaneRef::AlongPath { t, .. } => v.push(("Distance (0 to 1)", t, Kind::Unitless)),
         _ => {}
     }
 }
@@ -34,7 +35,25 @@ impl FeatureKind {
             FeatureKind::Sketch { plane, .. }
             | FeatureKind::ConstructionPlane { plane }
             | FeatureKind::Split { plane, .. }
+            | FeatureKind::SplitFace { plane, .. }
             | FeatureKind::Mirror { plane, .. } => plane_inputs_mut(plane, &mut v),
+            FeatureKind::ConstructionAxis { def } => {
+                for r in def.refs_mut() {
+                    if let crate::construct::GeoRef::Plane { plane } = r {
+                        plane_inputs_mut(plane, &mut v);
+                    }
+                }
+            }
+            FeatureKind::ConstructionPoint { def } => match def {
+                crate::construct::PointDef::AlongPath { t, .. } => v.push(("Distance (0 to 1)", t, U)),
+                other => {
+                    for r in other.refs_mut() {
+                        if let crate::construct::GeoRef::Plane { plane } = r {
+                            plane_inputs_mut(plane, &mut v);
+                        }
+                    }
+                }
+            },
             FeatureKind::Extrude { extent, .. } => {
                 v.push(("Distance", &mut extent.distance, L));
                 if let Some(d) = &mut extent.distance2 {
@@ -46,9 +65,25 @@ impl FeatureKind {
                 if let Some(d) = &mut extent.taper {
                     v.push(("Taper angle", d, A));
                 }
+                if let Some(d) = &mut extent.to_offset {
+                    v.push(("To offset", d, L));
+                }
             }
-            FeatureKind::Revolve { angle, .. } => v.push(("Angle", angle, A)),
-            FeatureKind::Fillet { radius, .. } => v.push(("Radius", radius, L)),
+            FeatureKind::Revolve { angle, angle2, .. } => {
+                v.push(("Angle", angle, A));
+                if let Some(a) = angle2 {
+                    v.push(("Angle 2", a, A));
+                }
+            }
+            FeatureKind::Fillet { radius, style, .. } => match style {
+                crate::FilletStyle::Constant => v.push(("Radius", radius, L)),
+                crate::FilletStyle::Chord => v.push(("Chord length", radius, L)),
+                crate::FilletStyle::Variable { radius2, mid, .. } => {
+                    v.push(("Start radius", radius, L));
+                    v.push(("End radius", radius2, L));
+                    v.extend(mid.iter_mut().map(|(_, r)| ("Mid radius", r, L)));
+                }
+            },
             FeatureKind::Chamfer { distance, distance2, angle, .. } => {
                 v.push(("Distance", distance, L));
                 if let Some(d) = distance2 {
@@ -223,20 +258,54 @@ impl FeatureKind {
                 }
             }
             FeatureKind::ReplaceFace { target, .. } => plane_inputs_mut(target, &mut v),
+            FeatureKind::Stitch { tolerance, .. } => v.push(("Tolerance", tolerance, L)),
+            FeatureKind::Thicken { thickness, .. } => v.push(("Thickness", thickness, L)),
+            FeatureKind::SurfaceTrim { plane, .. } => plane_inputs_mut(plane, &mut v),
+            FeatureKind::SurfaceExtend { distance, .. } => v.push(("Distance", distance, L)),
+            FeatureKind::Patch { .. } => {}
             FeatureKind::Combine { .. }
             | FeatureKind::SheetBase { .. }
             | FeatureKind::SheetUnfold { .. }
             | FeatureKind::SheetConvert { .. }
             | FeatureKind::Align { .. }
             | FeatureKind::Remove { .. }
+            | FeatureKind::DeleteFace { .. }
+            | FeatureKind::BoundaryFill { .. }
             | FeatureKind::Loft { .. }
             | FeatureKind::Sweep { .. }
             | FeatureKind::Import { .. }
-            | FeatureKind::MeshImport { .. } => {}
+            | FeatureKind::MeshImport { .. }
+            | FeatureKind::BodyTransfer { .. } => {}
         }
         v
     }
 
+    /// A primitive's placement point (length expressions). Its coordinates are not inputs:
+    /// they get no parameter names and keep bare numbers in mm whatever the design's units, as
+    /// every other position does; renames and users still find them.
+    pub fn point_expr_mut(&mut self) -> Option<&mut crate::PointExpr> {
+        match self {
+            FeatureKind::Box { corner: p, .. }
+            | FeatureKind::Cylinder { base: p, .. }
+            | FeatureKind::Sphere { center: p, .. }
+            | FeatureKind::Torus { center: p, .. }
+            | FeatureKind::Coil { base: p, .. } => Some(p),
+            _ => None,
+        }
+    }
+
+    /// Read-only view of [`FeatureKind::point_expr_mut`].
+    pub fn point_expr(&self) -> Option<&crate::PointExpr> {
+        match self {
+            FeatureKind::Box { corner: p, .. }
+            | FeatureKind::Cylinder { base: p, .. }
+            | FeatureKind::Sphere { center: p, .. }
+            | FeatureKind::Torus { center: p, .. }
+            | FeatureKind::Coil { base: p, .. } => Some(p),
+            _ => None,
+        }
+    }
+
     /// Read-only view of [`FeatureKind::inputs_mut`]: (label, expression, kind).
     pub fn inputs(&self) -> Vec<(&'static str, String, Kind)> {
         // Imports have no inputs (and their STEP text is large: don't clone it).
@@ -333,7 +402,85 @@ impl Document {
         }
     }
 
+    /// Repair a loaded timeline in one pass. Reserve even later features' names, just as
+    /// `name_feature_inputs` does, without restarting a document scan for every `dN` candidate.
+    pub(crate) fn name_all_feature_inputs(&mut self) {
+        let mut taken: BTreeMap<String, usize> = BTreeMap::new();
+        for name in self.params.iter().map(|p| &p.name).chain(self.features.iter().flat_map(|f| &f.param_names)) {
+            *taken.entry(name.clone()).or_default() += 1;
+        }
+        let mut next = 1usize;
+        for f in &mut self.features {
+            let n = f.kind.inputs().len();
+            for k in 0..n {
+                if f.param_names.get(k).is_some_and(|name| !name.is_empty()) {
+                    continue;
+                }
+                let name = loop {
+                    let name = format!("d{next}");
+                    next += 1;
+                    if !taken.contains_key(&name) {
+                        break name;
+                    }
+                };
+                if f.param_names.len() <= k {
+                    f.param_names.resize(k + 1, String::new());
+                }
+                // Empty slots cannot collide with a generated name.
+                if let Some(slot) = f.param_names.get_mut(k) {
+                    *slot = name.clone();
+                }
+                taken.insert(name, 1);
+            }
+            // Match the single-feature repair: surplus names become available only after
+            // this feature has been repaired. Counts preserve names shared with parameters.
+            for name in f.param_names.drain(n..) {
+                if let Some(count) = taken.get_mut(&name) {
+                    *count -= 1;
+                    if *count == 0 {
+                        taken.remove(&name);
+                        if let Some(i) = name.strip_prefix('d').and_then(|s| s.parse::<usize>().ok())
+                            && name == format!("d{i}")
+                            && i > 0
+                        {
+                            next = next.min(i);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     /// Change a parameter: a stored one, or a feature input by its name.
+    /// A typed length that is a bare number means the design's units: it gets that unit written
+    /// in (feature inputs are stored in mm otherwise). Anything else is returned unchanged.
+    pub fn with_design_unit(&self, e: &str, kind: Kind) -> String {
+        let u = self.units.trim();
+        let bare = expr::is_literal(e) && e.trim().trim_start_matches(['-', '+']).trim().parse::<f64>().is_ok();
+        if kind == Kind::Length && bare && !u.is_empty() && u != "mm" && expr::unit_info(u).is_some_and(|(k, _)| k == Kind::Length) {
+            format!("{} {u}", e.trim())
+        } else {
+            e.to_string()
+        }
+    }
+
+    /// Every length input of every feature as the geometry reads it (mm; a unit-less result is
+    /// in the design's units), for checking that an edit moves nothing.
+    pub fn length_inputs(&self) -> Vec<Option<f64>> {
+        let (vals, _) = self.param_values();
+        let scale = expr::unit_info(self.units.trim()).filter(|(k, _)| *k == Kind::Length).map(|(_, s)| s).unwrap_or(1.0);
+        let look = |n: &str| vals.get(n).copied().ok_or_else(|| DocError::Expr(format!("unknown parameter `{n}`")));
+        self.features
+            .iter()
+            .flat_map(|f| f.kind.inputs())
+            .filter(|(_, _, k)| *k == Kind::Length)
+            .map(|(_, e, _)| {
+                let d = if expr::is_literal(&e) { expr::Defaults::default() } else { expr::Defaults { len: scale, ..expr::Defaults::default() } };
+                expr::eval_with(&e, &look).and_then(|v| v.to_kind_in(Kind::Length, d)).ok()
+            })
+            .collect()
+    }
+
     pub fn change_param(&mut self, name: &str, expr_s: &str, unit: Option<&str>, comment: Option<&str>) -> Result<()> {
         let hit = self.features.iter().enumerate().find_map(|(i, f)| f.param_names.iter().position(|n| n == name).map(|k| (i, k)));
         let Some((i, k)) = hit else { return self.set_param(name, expr_s, unit, comment) };
@@ -341,10 +488,12 @@ impl Document {
             return Err(DocError::Expr("expression too long".into()));
         }
         let mut next = self.clone();
+        let kind = self.features.get(i).and_then(|f| f.kind.inputs().get(k).map(|x| x.2)).unwrap_or(Kind::Unitless);
+        let expr_s = self.with_design_unit(expr_s, kind);
         if let Some(f) = next.features.get_mut(i)
             && let Some((_, e, _)) = f.kind.inputs_mut().into_iter().nth(k)
         {
-            *e = expr_s.to_string();
+            *e = expr_s.clone();
         }
         if let Some(c) = comment {
             next.param_comments.insert(name.to_string(), c.to_string());
@@ -357,6 +506,53 @@ impl Document {
         Ok(())
     }
 
+    /// Change existing expressions against their final dependency graph, independent of
+    /// column order. Unlike `change_param`, this never creates a missing parameter.
+    pub fn change_params_atomic(&mut self, changes: &[(String, String)]) -> Result<()> {
+        if changes.len() > crate::config::MAX_COLUMNS {
+            return Err(DocError::Invalid("too many parameter changes".into()));
+        }
+        let mut names = BTreeSet::new();
+        let mut changed = BTreeSet::new();
+        let (_, before_errors) = self.param_values();
+        let mut next = self.clone();
+        for (name, expression) in changes {
+            if !names.insert(name.clone()) {
+                return Err(DocError::Invalid(format!("duplicate parameter `{name}`")));
+            }
+            if expression.len() > 4096 || expression.trim().is_empty() {
+                return Err(DocError::Expr("expression is empty or too long".into()));
+            }
+            if let Some(p) = next.params.iter_mut().find(|p| p.name == *name) {
+                if p.expr != expression.trim() {
+                    changed.insert(name.clone());
+                }
+                p.expr = expression.trim().to_string();
+                continue;
+            }
+            let hit = next.features.iter().enumerate().find_map(|(i, f)| f.param_names.iter().position(|n| n == name).map(|k| (i, k)));
+            let Some((i, k)) = hit else { return Err(DocError::Unknown(format!("parameter `{name}`"))) };
+            let kind = next.features.get(i).and_then(|f| f.kind.inputs().get(k).map(|x| x.2)).unwrap_or(Kind::Unitless);
+            let normalized = next.with_design_unit(expression, kind);
+            let Some(feature) = next.features.get_mut(i) else { return Err(DocError::Unknown(format!("parameter `{name}`"))) };
+            let Some((_, target, _)) = feature.kind.inputs_mut().into_iter().nth(k) else {
+                return Err(DocError::Unknown(format!("parameter `{name}`")));
+            };
+            if *target != normalized {
+                changed.insert(name.clone());
+            }
+            *target = normalized;
+        }
+        let (_, errors) = next.param_values();
+        for (name, error) in errors {
+            if changed.contains(&name) || !before_errors.contains_key(&name) {
+                return Err(DocError::Expr(format!("parameter `{name}`: {error}")));
+            }
+        }
+        *self = next;
+        Ok(())
+    }
+
     /// The parameters table (user, sketch dimensions, feature inputs).
     pub fn param_rows(&self) -> Vec<ParamRow> {
         let (vals, errs) = self.param_values();
@@ -494,6 +690,8 @@ pub enum ParamUser {
     Feature { feature: u64, name: String, input: String },
     /// A sketch dimension (`constraint` is its id).
     Dimension { feature: u64, name: String, constraint: String },
+    /// A configured column or an expression saved in a configuration row.
+    Configuration { row: Option<String>, column: String },
 }
 
 impl ParamUser {
@@ -502,6 +700,10 @@ impl ParamUser {
             ParamUser::Parameter { name } => format!("parameter {name}"),
             ParamUser::Feature { name, input, .. } => format!("{name} ({input})"),
             ParamUser::Dimension { name, constraint, .. } => format!("{name} dimension {constraint}"),
+            ParamUser::Configuration { row, column } => match row {
+                Some(row) => format!("configuration `{row}` ({column})"),
+                None => format!("configuration column {column}"),
+            },
         }
     }
 }
@@ -523,7 +725,16 @@ impl Document {
         for f in &self.features {
             for (name, (_, e, k)) in f.param_names.iter().zip(f.kind.inputs()) {
                 if !name.is_empty() {
-                    v.push(ParamDef { name: name.clone(), expr: e, unit: unit_of(k).into() });
+                    // A bare number stored in an input is mm (the design's units are written in
+                    // when it is typed); anything else that comes out unit-less (a unit-less
+                    // parameter used as a length) is in the design's units.
+                    let unit = match k {
+                        Kind::Length if !expr::is_literal(&e) && expr::unit_info(self.units.trim()).is_some_and(|(k, _)| k == Kind::Length) => {
+                            self.units.trim().to_string()
+                        }
+                        _ => unit_of(k).to_string(),
+                    };
+                    v.push(ParamDef { name: name.clone(), expr: e, unit });
                 }
             }
         }
@@ -562,6 +773,24 @@ impl Document {
     /// expressions refer to it, and the sketch dimensions it drives.
     pub fn param_users(&self, name: &str) -> Vec<ParamUser> {
         let mut out = Vec::new();
+        for rule in &self.configs.rules {
+            if rule.parameter_references().iter().any(|reference| reference == name) {
+                out.push(ParamUser::Configuration { row: None, column: format!("rule `{}`", rule.name) });
+            }
+        }
+        for (index, column) in self.configs.columns.iter().enumerate() {
+            if let crate::config::Column::Param(target) = column {
+                let key = self.config_key(column);
+                if target == name {
+                    out.push(ParamUser::Configuration { row: None, column: key.clone() });
+                }
+                for row in &self.configs.rows {
+                    if row.cells.get(index).is_some_and(|value| expr::references(value).iter().any(|reference| reference == name)) {
+                        out.push(ParamUser::Configuration { row: Some(row.name.clone()), column: key.clone() });
+                    }
+                }
+            }
+        }
         for p in &self.params {
             if p.name != name && expr::references(&p.expr).iter().any(|r| r == name) {
                 out.push(ParamUser::Parameter { name: p.name.clone() });
@@ -576,6 +805,9 @@ impl Document {
                     }
                 }
             }
+            if f.kind.point_expr().is_some_and(|p| p.iter().any(|e| expr::references(e).iter().any(|r| r == name))) {
+                out.push(ParamUser::Feature { feature: f.id, name: f.name.clone(), input: "Position".into() });
+            }
             if let FeatureKind::Sketch { sketch, .. } = &f.kind {
                 for c in &sketch.constraints {
                     if c.param.as_deref() == Some(name) {
@@ -639,6 +871,13 @@ impl Document {
                     *x = new.to_string();
                 }
             }
+            for e in f.kind.point_expr_mut().into_iter().flatten() {
+                let r = expr::rename_reference(e, old, new);
+                if r != *e {
+                    *e = r;
+                    n += 1;
+                }
+            }
             for (_, e, _) in f.kind.inputs_mut() {
                 let r = expr::rename_reference(e, old, new);
                 if r != *e {
@@ -664,9 +903,14 @@ impl Document {
             }
         }
         // Configuration cells refer to parameters too.
+        for rule in &mut self.configs.rules {
+            rule.rename_parameter(old, new);
+        }
         for r in &mut self.configs.rows {
-            for cell in &mut r.cells {
-                *cell = expr::rename_reference(cell, old, new);
+            for (column, cell) in self.configs.columns.iter().zip(&mut r.cells) {
+                if matches!(column, crate::config::Column::Param(_)) {
+                    *cell = expr::rename_reference(cell, old, new);
+                }
             }
         }
         if let Some(c) = self.param_comments.remove(old) {

crates/doc/src/profile_refs.rs

@@ -0,0 +1,505 @@
+//! Exact profile references through analytic offset topology transitions.
+use std::collections::BTreeSet;
+
+use crate::{DocError, ProfileSel, Result, SolvedSketch, WholeProfileBoundary};
+
+const MAX_SELECTIONS: usize = 128;
+
+fn whole_boundary(profile: &solvecraft_sketch::Profile) -> Option<WholeProfileBoundary> {
+    let (outer, holes) = profile.whole_curve_boundaries()?;
+    Some(WholeProfileBoundary { outer, holes })
+}
+
+fn validate_whole(profiles: &[WholeProfileBoundary]) -> Result<()> {
+    if profiles.is_empty() || profiles.len() > MAX_SELECTIONS {
+        return Err(DocError::Invalid("whole-source profile selection needs bounded unique profiles".into()));
+    }
+    let mut total = 0usize;
+    let mut identities = BTreeSet::new();
+    for profile in profiles {
+        if profile.holes.len() > 128 || !identities.insert((&profile.outer, &profile.holes)) {
+            return Err(DocError::Invalid("invalid whole-source profile holes or duplicate identity".into()));
+        }
+        let mut all = BTreeSet::new();
+        for boundary in std::iter::once(&profile.outer).chain(&profile.holes) {
+            total += boundary.len();
+            if boundary.is_empty() || boundary.len() > 512 || total > 20_000 {
+                return Err(DocError::Invalid("whole-source boundary exceeds its identity budget".into()));
+            }
+            let mut previous = None;
+            for curve in boundary {
+                if curve.is_empty()
+                    || curve.len() > 512
+                    || curve.chars().any(char::is_control)
+                    || previous.is_some_and(|previous| previous >= curve)
+                    || !all.insert(curve)
+                {
+                    return Err(DocError::Invalid("whole-source boundary needs canonical disjoint curve identities".into()));
+                }
+                previous = Some(curve);
+            }
+        }
+        if profile.holes.windows(2).any(|pair| pair[0] >= pair[1]) {
+            return Err(DocError::Invalid("whole-source holes need canonical unique identities".into()));
+        }
+    }
+    Ok(())
+}
+
+fn whole_profile_indices(ss: &SolvedSketch, profiles: &[WholeProfileBoundary]) -> Result<Vec<usize>> {
+    validate_whole(profiles)?;
+    let current = ss.profiles.iter().map(whole_boundary).collect::<Vec<_>>();
+    profiles
+        .iter()
+        .map(|identity| {
+            let mut matches = current.iter().enumerate().filter(|(_, candidate)| candidate.as_ref() == Some(identity));
+            let (index, _) = matches.next().ok_or_else(|| DocError::Unknown(format!("complete source profile in {}", ss.name)))?;
+            if matches.next().is_some() {
+                return Err(DocError::Invalid(format!("ambiguous complete source profile in {}", ss.name)));
+            }
+            Ok(index)
+        })
+        .collect()
+}
+
+fn same_ids(a: &[String], b: &[String]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let (mut a, mut b) = (a.iter().collect::<Vec<_>>(), b.iter().collect::<Vec<_>>());
+    a.sort();
+    b.sort();
+    a == b
+}
+
+fn unique_profile(ss: &SolvedSketch, curves: &[String]) -> Result<usize> {
+    let mut matches = ss.profiles.iter().enumerate().filter(|(_, profile)| same_ids(curves, &profile.outer_curves));
+    let (index, _) = matches.next().ok_or_else(|| DocError::Unknown(format!("profile bounded by {curves:?} in {}", ss.name)))?;
+    if matches.next().is_some() {
+        return Err(DocError::Invalid(format!("ambiguous profile boundary in {}", ss.name)));
+    }
+    Ok(index)
+}
+
+fn reserved_boundaries(ss: &SolvedSketch) -> Result<std::collections::BTreeMap<Vec<String>, String>> {
+    let mut found = std::collections::BTreeMap::new();
+    for offset in &ss.sketch.offsets {
+        let Some(topology) = &offset.topology else { continue };
+        let mut reserved = topology.roles.iter().map(|role| role.output.clone()).collect::<Vec<_>>();
+        reserved.sort();
+        if found.insert(reserved, topology.id.clone()).is_some() {
+            return Err(DocError::Invalid("profile role set belongs to multiple offset associations".into()));
+        }
+    }
+    Ok(found)
+}
+
+/// Resolve exact selection identities to the solved sketch's current profile indices.
+/// Complete reserved role sets follow their association; partial sets never expand.
+pub fn profile_selection_indices(ss: &SolvedSketch, selection: &ProfileSel) -> Result<Vec<usize>> {
+    let indices = match selection {
+        ProfileSel::All => (0..ss.profiles.len()).collect(),
+        ProfileSel::Indices { indices } => indices.clone(),
+        ProfileSel::Curves { loops } => {
+            let boundaries = reserved_boundaries(ss)?;
+            let mut indices = Vec::with_capacity(loops.len());
+            for curves in loops {
+                let mut key = curves.clone();
+                key.sort();
+                if let Some(id) = boundaries.get(&key) {
+                    if curves.len() > 512 || curves.iter().collect::<BTreeSet<_>>().len() != curves.len() {
+                        return Err(DocError::Invalid("offset profile has repeated or excessive curve roles".into()));
+                    }
+                    indices.push(unique_profile(ss, &ss.sketch.offset_boundary(id)?)?);
+                } else {
+                    // Repeated saved IDs identify exact graph spans. Their multiplicity
+                    // must not silently turn into a whole-source certificate on resize.
+                    if curves.iter().collect::<BTreeSet<_>>().len() != curves.len()
+                        && !ss.profiles.iter().any(|profile| same_ids(curves, &profile.outer_curves))
+                    {
+                        return Err(crate::curve_pick_error(solvecraft_sketch::CurvePick::Missing, curves, &ss.name));
+                    }
+                    indices.push(
+                        solvecraft_sketch::profile_by_curves(&ss.profiles, curves)
+                            .map_err(|error| crate::curve_pick_error(error, curves, &ss.name))?,
+                    );
+                }
+            }
+            indices
+        }
+        ProfileSel::OffsetBoundaries { associations } => {
+            if associations.is_empty()
+                || associations.len() > MAX_SELECTIONS
+                || associations.iter().collect::<BTreeSet<_>>().len() != associations.len()
+            {
+                return Err(DocError::Invalid("offset profile selection needs unique bounded association identities".into()));
+            }
+            associations.iter().map(|id| unique_profile(ss, &ss.sketch.offset_boundary(id)?)).collect::<Result<Vec<_>>>()?
+        }
+        ProfileSel::WholeBoundaries { profiles } => whole_profile_indices(ss, profiles)?,
+        ProfileSel::Points { points } => {
+            let mut indices = Vec::with_capacity(points.len());
+            for point in points {
+                let (index, _) = ss
+                    .profiles
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, profile)| profile.region.contains(*point))
+                    .min_by(|(_, a), (_, b)| a.area.total_cmp(&b.area))
+                    .ok_or_else(|| DocError::Unknown(format!("profile at {:?} in {}", [point.x, point.y], ss.name)))?;
+                indices.push(index);
+            }
+            indices
+        }
+    };
+    if indices.iter().any(|index| *index >= ss.profiles.len()) {
+        return Err(DocError::Invalid(format!("out-of-range profile selection in {}", ss.name)));
+    }
+    Ok(indices)
+}
+
+/// Persist selected complete offset boundaries by association identity. Mixed selections
+/// retain exact ordinary loops and the complete reserved role set of each offset boundary.
+pub fn capture_profile_selection(ss: &SolvedSketch, indices: &[usize]) -> Result<ProfileSel> {
+    let checked = profile_selection_indices(ss, &ProfileSel::Indices { indices: indices.to_vec() })?;
+    if checked.is_empty() || checked.iter().collect::<BTreeSet<_>>().len() != checked.len() {
+        return Ok(ProfileSel::Indices { indices: indices.to_vec() });
+    }
+    // Capture adaptive free-form boundaries only with complete source provenance,
+    // including every hole. Ordinary analytic captures keep their historical form.
+    let adaptive = checked.iter().any(|index| {
+        ss.profiles.get(*index).is_some_and(|profile| {
+            std::iter::once(&profile.outer_curves)
+                .chain(&profile.hole_curves)
+                .any(|curves| curves.iter().collect::<BTreeSet<_>>().len() != curves.len())
+        })
+    });
+    if adaptive {
+        let identities = checked.iter().map(|index| ss.profiles.get(*index).and_then(whole_boundary)).collect::<Option<Vec<_>>>();
+        if let Some(profiles) = identities {
+            // Dynamic analytic offset groups need their own association identities.
+            // Do not silently flatten a mixed selection into current active curve IDs.
+            let mut dynamic = false;
+            for profile in &profiles {
+                for boundary in std::iter::once(&profile.outer).chain(&profile.holes) {
+                    dynamic |= ss.sketch.offset_boundary_for_curves(boundary)?.is_some();
+                }
+            }
+            if !dynamic && whole_profile_indices(ss, &profiles)? == checked {
+                return Ok(ProfileSel::WholeBoundaries { profiles });
+            }
+        }
+    }
+    let mut associations = Vec::new();
+    let mut loops = Vec::new();
+    for index in checked {
+        let curves = &ss.profiles.get(index).ok_or_else(|| DocError::Invalid("profile index changed during capture".into()))?.outer_curves;
+        if curves.is_empty() {
+            return Ok(ProfileSel::Indices { indices: indices.to_vec() });
+        }
+        // Ordinary free-form loops retain one curve ID per exact span. That
+        // historical multiset is valid profile identity, but is not a candidate
+        // for the unique reserved-role set of a topology-aware association.
+        let association =
+            if curves.iter().collect::<BTreeSet<_>>().len() == curves.len() { ss.sketch.offset_boundary_for_curves(curves)? } else { None };
+        if let Some(id) = association {
+            unique_profile(ss, curves)?;
+            let offset = ss
+                .sketch
+                .offsets
+                .iter()
+                .filter_map(|offset| offset.topology.as_ref())
+                .find(|topology| topology.id == id)
+                .ok_or_else(|| DocError::Unknown(format!("offset association {id}")))?;
+            loops.push(offset.roles.iter().map(|role| role.output.clone()).collect());
+            associations.push(id);
+        } else {
+            if ss.profiles.iter().filter(|profile| same_ids(curves, &profile.outer_curves)).count() != 1 {
+                return Ok(ProfileSel::Indices { indices: indices.to_vec() });
+            }
+            loops.push(curves.clone());
+        }
+    }
+    if associations.len() > MAX_SELECTIONS {
+        return Err(DocError::Invalid("too many offset association profiles".into()));
+    }
+    if associations.len() == loops.len() { Ok(ProfileSel::OffsetBoundaries { associations }) } else { Ok(ProfileSel::Curves { loops }) }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::panic)]
+    use super::*;
+    use solvecraft_geom::{Plane, Vec2};
+    use solvecraft_sketch::{Sketch, find_profiles, solve};
+
+    fn rounded_source(sketch: &mut Sketch, radius: f64) -> Vec<(String, bool)> {
+        let endpoints = [
+            Vec2::new(-37., -32. - radius),
+            Vec2::new(37., -32. - radius),
+            Vec2::new(37. + radius, -32.),
+            Vec2::new(37. + radius, 32.),
+            Vec2::new(37., 32. + radius),
+            Vec2::new(-37., 32. + radius),
+            Vec2::new(-37. - radius, 32.),
+            Vec2::new(-37. - radius, -32.),
+        ];
+        let points: Vec<_> =
+            endpoints.iter().enumerate().map(|(index, point)| sketch.add_point(*point, Some(&format!("source-p{index}"))).unwrap()).collect();
+        let centers = [Vec2::new(37., -32.), Vec2::new(37., 32.), Vec2::new(-37., 32.), Vec2::new(-37., -32.)];
+        for index in 0..8 {
+            let id = format!("source-edge{index}");
+            if index % 2 == 0 {
+                sketch.add_line_pts(points[index], points[(index + 1) % 8], Some(&id)).unwrap();
+            } else {
+                let center = centers[index / 2];
+                sketch
+                    .add_arc(
+                        center,
+                        endpoints[index],
+                        endpoints[(index + 1) % 8],
+                        [None, Some(points[index]), Some(points[(index + 1) % 8])],
+                        Some(&id),
+                    )
+                    .unwrap();
+            }
+        }
+        for point in &mut sketch.points {
+            point.fixed = true;
+        }
+        (0..8).map(|index| (format!("source-edge{index}"), true)).collect()
+    }
+
+    fn set_source_radius(sketch: &mut Sketch, radius: f64) {
+        let points = [
+            Vec2::new(-37., -32. - radius),
+            Vec2::new(37., -32. - radius),
+            Vec2::new(37. + radius, -32.),
+            Vec2::new(37. + radius, 32.),
+            Vec2::new(37., 32. + radius),
+            Vec2::new(-37., 32. + radius),
+            Vec2::new(-37. - radius, 32.),
+            Vec2::new(-37. - radius, -32.),
+        ];
+        for (index, value) in points.into_iter().enumerate() {
+            sketch.points.iter_mut().find(|point| point.id == format!("source-p{index}")).unwrap().pos = value;
+        }
+    }
+
+    #[test]
+    fn captured_sharp_offset_profile_survives_arc_resurrection_and_reopen() {
+        let mut sketch = Sketch::new();
+        let sources = rounded_source(&mut sketch, 1.);
+        let created = sketch.add_convex_offset(sources, 1.4).unwrap();
+        assert_eq!(created.curves.len(), 4);
+        let mut document = crate::Document::new("selected logical inner boundary");
+        let feature =
+            document.add_feature(crate::FeatureKind::Sketch { plane: crate::PlaneRef::Origin { name: "XY".into() }, sketch }, None).unwrap();
+        let mut model = crate::Model::new();
+        model.evaluate(&document);
+        let state = model.state();
+        let solved = state.sketch(feature).unwrap();
+        let index = unique_profile(solved, &created.curves).unwrap();
+        let selection = capture_profile_selection(solved, &[index]).unwrap();
+        assert_eq!(selection, ProfileSel::OffsetBoundaries { associations: vec![created.association.clone()] });
+        let original_roles = solved.sketch.offsets[0].topology.as_ref().unwrap().roles.iter().map(|role| role.output.clone()).collect::<Vec<_>>();
+        let sharp_area = crate::select_profiles(solved, &selection).unwrap()[0].area();
+        assert!((sharp_area - 73.2 * 63.2).abs() < 1e-7, "{sharp_area}");
+        document
+            .add_feature(
+                crate::FeatureKind::Extrude {
+                    sketch: feature,
+                    profiles: selection.clone(),
+                    extent: crate::Extent {
+                        distance: "2".into(),
+                        direction: crate::Direction::Positive,
+                        distance2: None,
+                        start_offset: None,
+                        through_all: false,
+                        taper: None,
+                        to: None,
+                        to_offset: None,
+                        from: None,
+                    },
+                    operation: crate::Operation::NewBody,
+                    targets: vec![],
+                },
+                None,
+            )
+            .unwrap();
+        model.evaluate(&document);
+        let volume = solvecraft_kernel::measure(&model.state().bodies[0].body).unwrap().volume;
+        assert!((volume - 2. * 73.2 * 63.2).abs() < 1e-6, "{volume}");
+        let reopened = crate::Document::from_json(&document.to_json()).unwrap();
+        assert_eq!(reopened, document);
+        let mut cold = crate::Model::new();
+        cold.evaluate(&reopened);
+        assert!((solvecraft_kernel::measure(&cold.state().bodies[0].body).unwrap().volume - volume).abs() < 1e-6);
+        let crate::FeatureKind::Sketch { sketch, .. } = &mut document.features[0].kind else { panic!("sketch") };
+        set_source_radius(sketch, 2.);
+        model.evaluate(&document);
+        assert!(model.results.iter().all(|result| result.error.is_none()), "{:?}", model.results);
+        let state = model.state();
+        let solved = state.sketch(feature).unwrap();
+        let active = solved.sketch.offset_boundary(&created.association).unwrap();
+        assert_eq!(active, original_roles);
+        let rounded_area = 75.2 * 65.2 - (4. - std::f64::consts::PI) * 0.6 * 0.6;
+        assert!((crate::select_profiles(solved, &selection).unwrap()[0].area() - rounded_area).abs() < 1e-7);
+        let volume = solvecraft_kernel::measure(&model.state().bodies[0].body).unwrap().volume;
+        // Kernel volume integrates the curved display mesh; the analytic region above
+        // checks the exact rounded geometry independently of that tessellation.
+        assert!((volume - 2. * rounded_area).abs() < 0.002, "{volume}");
+        assert!(
+            crate::select_profiles(solved, &ProfileSel::Curves { loops: vec![created.curves.clone()] }).is_err(),
+            "partial old active set must not expand after resurrection"
+        );
+        assert_eq!(
+            profile_selection_indices(solved, &ProfileSel::Curves { loops: vec![original_roles] }).unwrap(),
+            profile_selection_indices(solved, &selection).unwrap()
+        );
+        let reopened = crate::Document::from_json(&document.to_json()).unwrap();
+        cold.evaluate(&reopened);
+        assert!((solvecraft_kernel::measure(&cold.state().bodies[0].body).unwrap().volume - volume).abs() < 1e-5);
+    }
+
+    #[test]
+    fn ordinary_profile_selection_keeps_legacy_large_and_duplicate_semantics() {
+        let mut sketch = Sketch::new();
+        sketch.add_circle(Vec2::new(0., 0.), 3., None, Some("circle")).unwrap();
+        let report = solve(&mut sketch);
+        let profiles = find_profiles(&sketch);
+        let ss = SolvedSketch { feature: 1, name: "ordinary circle".into(), plane: Plane::XY, sketch, report, profiles };
+        assert_eq!(ss.profiles.len(), 1);
+        let indices = vec![0; 600];
+        let selection = ProfileSel::Indices { indices: indices.clone() };
+        assert_eq!(profile_selection_indices(&ss, &selection).unwrap(), indices);
+        assert_eq!(capture_profile_selection(&ss, &indices).unwrap(), selection);
+        let points = ProfileSel::Points { points: vec![Vec2::new(0., 0.); 600] };
+        assert_eq!(profile_selection_indices(&ss, &points).unwrap(), indices);
+        let curves = ProfileSel::Curves { loops: vec![vec!["circle".into()]; 600] };
+        let regions = crate::select_profiles(&ss, &curves).unwrap();
+        assert_eq!(regions.len(), 600);
+        assert!(regions.iter().all(|region| (region.area() - std::f64::consts::PI * 9.).abs() < 1e-9));
+        assert!(profile_selection_indices(&ss, &ProfileSel::Indices { indices: vec![1] }).is_err());
+    }
+
+    #[test]
+    fn periodic_offset_ring_whole_source_survives_adaptive_spans_and_reopen() {
+        let mut sketch = Sketch::new();
+        let major = sketch.add_point(Vec2::new(10., 0.), None).unwrap();
+        let ellipse = sketch.add_curve(solvecraft_sketch::CurveKind::Ellipse { c: 0, m: major, r: 5. }, None).unwrap();
+        let first = sketch.add_freeform_offset(ellipse, true, -1.).unwrap();
+        sketch.add_freeform_offset(first, true, -0.5).unwrap();
+        let mut document = crate::Document::new("periodic offset ring multiset");
+        let feature =
+            document.add_feature(crate::FeatureKind::Sketch { plane: crate::PlaneRef::Origin { name: "XY".into() }, sketch }, None).unwrap();
+        let mut model = crate::Model::new();
+        model.evaluate(&document);
+        let state = model.state();
+        let solved = state.sketch(feature).unwrap();
+        assert_eq!(solved.profiles.len(), 3);
+        let (index, profile) = solved.profiles.iter().enumerate().min_by(|(_, a), (_, b)| a.area.total_cmp(&b.area)).unwrap();
+        assert!(profile.outer_curves.len() > 1);
+        assert_eq!(profile.outer_curves.iter().collect::<BTreeSet<_>>().len(), 1);
+        assert!(solved.sketch.offset_boundary_for_curves(&profile.outer_curves).is_err(), "strict association identity still refuses repeated roles");
+        let selection = capture_profile_selection(solved, &[index]).unwrap();
+        assert!(matches!(&selection, ProfileSel::WholeBoundaries { profiles } if profiles.len() == 1 && profiles[0].holes.len() == 1));
+        let legacy_spans = ProfileSel::Curves { loops: vec![profile.outer_curves.clone()] };
+        assert_eq!(profile_selection_indices(solved, &legacy_spans).unwrap(), vec![index]);
+        let legacy_roundtrip: ProfileSel = serde_json::from_str(&serde_json::to_string(&legacy_spans).unwrap()).unwrap();
+        assert_eq!(legacy_roundtrip, legacy_spans, "ordinary legacy span multiplicities remain serialized exactly");
+        assert_eq!(profile_selection_indices(solved, &selection).unwrap(), vec![index]);
+        let selected = crate::select_profiles(solved, &selection).unwrap();
+        assert_eq!(selected.len(), 1);
+        assert!((selected[0].area() - profile.area).abs() < 1e-10);
+        assert!(selected[0].contains(Vec2::new(11.25, 0.)));
+        assert!(!selected[0].contains(Vec2::new(10.5, 0.)));
+        assert!(!selected[0].contains(Vec2::new(11.75, 0.)));
+        let saved = serde_json::to_string(&selection).unwrap();
+        let reopened: ProfileSel = serde_json::from_str(&saved).unwrap();
+        let reopened_doc = crate::Document::from_json(&document.to_json()).unwrap();
+        let mut cold = crate::Model::new();
+        cold.evaluate(&reopened_doc);
+        let cold_state = cold.state();
+        let regions = crate::select_profiles(cold_state.sketch(feature).unwrap(), &reopened).unwrap();
+        assert_eq!(regions, selected);
+
+        // An identical complete identity in two profiles is ambiguous, even when
+        // their boundary geometry and graph coverage certificates are identical.
+        let mut ambiguous = cold_state.sketch(feature).unwrap().clone();
+        ambiguous.profiles.push(ambiguous.profiles[index].clone());
+        assert!(profile_selection_indices(&ambiguous, &reopened).is_err());
+
+        document
+            .add_feature(
+                crate::FeatureKind::Extrude {
+                    sketch: feature,
+                    profiles: selection.clone(),
+                    extent: crate::Extent {
+                        distance: "2".into(),
+                        direction: crate::Direction::Positive,
+                        distance2: None,
+                        start_offset: None,
+                        through_all: false,
+                        taper: None,
+                        to: None,
+                        to_offset: None,
+                        from: None,
+                    },
+                    operation: crate::Operation::NewBody,
+                    targets: vec![],
+                },
+                None,
+            )
+            .unwrap();
+        model.evaluate(&document);
+        let initial_volume = solvecraft_kernel::measure(&model.state().bodies[0].body).unwrap().volume;
+        // Kernel measurement integrates the curved mesh. Scale the established
+        // periodic-ring tolerance (0.05 mm³ at height3) to this height2 extrusion.
+        // Exact profile identity and cold/warm equality below remain strict.
+        let volume_tolerance = 0.05 * 2. / 3.;
+        assert!(
+            (initial_volume - 2. * profile.area).abs() < volume_tolerance,
+            "initial kernel volume {initial_volume}, analytic area {}",
+            profile.area
+        );
+        let crate::FeatureKind::Sketch { sketch, .. } = &mut document.features[0].kind else { panic!("sketch") };
+        sketch.points[major].pos.x = 12.;
+        model.evaluate(&document);
+        assert!(model.results.iter().all(|result| result.error.is_none()), "{:?}", model.results);
+        let updated_state = model.state();
+        let updated = updated_state.sketch(feature).unwrap();
+        assert!(profile_selection_indices(updated, &legacy_spans).is_err(), "legacy tessellation-span multiplicity intentionally remains exact");
+        let updated_index = profile_selection_indices(updated, &selection).unwrap()[0];
+        let updated_region = &updated.profiles[updated_index].region;
+        // Probe away from exact spline-span seams, using the independent analytic
+        // ellipse point and unit outward gradient rather than a stored profile sample.
+        let parameter = 0.2_f64;
+        let source_point = Vec2::new(12. * parameter.cos(), 5. * parameter.sin());
+        let normal = Vec2::new(parameter.cos() / 12., parameter.sin() / 5.).normalized().unwrap();
+        let ring_point = source_point + normal * 1.25;
+        assert!(updated_region.contains(ring_point));
+        assert!(!updated_region.contains(source_point + normal * 0.5));
+        assert!(!updated_region.contains(source_point + normal * 1.75));
+        let updated_volume = solvecraft_kernel::measure(&updated_state.bodies[0].body).unwrap().volume;
+        assert!(updated_volume > initial_volume);
+        assert!(
+            (updated_volume - 2. * updated_region.area()).abs() < volume_tolerance,
+            "updated kernel volume {updated_volume}, analytic area {}",
+            updated_region.area()
+        );
+        let reopened_document = crate::Document::from_json(&document.to_json()).unwrap();
+        cold.evaluate(&reopened_document);
+        assert!(cold.results.iter().all(|result| result.error.is_none()));
+        assert!((solvecraft_kernel::measure(&cold.state().bodies[0].body).unwrap().volume - updated_volume).abs() < 1e-6);
+
+        // A new hole is a semantic boundary change, not the old ring. Whole-source
+        // identities include holes and must not silently absorb the new material cutout.
+        let crate::FeatureKind::Sketch { sketch, .. } = &mut document.features[0].kind else { panic!("sketch") };
+        sketch.add_circle(ring_point, 0.1, None, Some("new-hole")).unwrap();
+        model.evaluate(&document);
+        let changed = model.state();
+        assert!(profile_selection_indices(changed.sketch(feature).unwrap(), &selection).is_err());
+        assert!(model.results.last().unwrap().error.is_some());
+    }
+}

crates/doc/src/project.rs

@@ -20,6 +20,9 @@ const AXIS_HALF: f64 = 100.0;
 /// Points in one fitted chain at most (longer chains are thinned).
 const MAX_CHAIN: usize = 4000;
 
+#[path = "project_order.rs"]
+mod order;
+
 /// A resolved link: its geometry in sketch coordinates and the (possibly moved) reference.
 #[derive(Clone, Debug)]
 pub struct Resolved {
@@ -29,6 +32,9 @@ pub struct Resolved {
     pub source: LinkSource,
     /// The reference was not exactly where it was and was re-found on the nearest geometry.
     pub moved: bool,
+    /// Exact face selected during this resolution, before its closest point is
+    /// projected onto an edge shared with another face. Computed metadata only.
+    pub face_index: Option<usize>,
 }
 
 /// Resolutions of body-based references, keyed by the reference, the sketch plane and the
@@ -91,6 +97,7 @@ fn resolve_uncached(
 ) -> Result<Resolved> {
     let lost = |what: &str| DocError::Invalid(format!("{what} no longer exists"));
     let mut moved = false;
+    let mut face_index = None;
     let mut source = src.clone();
     let mut wires: Vec<Vec<Vec3>> = Vec::new();
     // Included curves that leave the sketch plane stay 3D.
@@ -122,6 +129,7 @@ fn resolve_uncached(
         LinkSource::Face { body, at } => {
             let (bi, mesh) = body_mesh(st, body, *at)?;
             let (f, q, d) = nearest_face(&mesh, *at).ok_or_else(|| lost("the face"))?;
+            face_index = Some(usize::try_from(f).map_err(|_| DocError::Invalid("face index exceeds platform limit".into()))?);
             let size = mesh.bounds().diagonal().max(1e-9);
             if d > size * 0.25 {
                 return Err(lost("the face"));
@@ -133,15 +141,13 @@ fn resolve_uncached(
                 LinkKind::Intersect => section(plane, &mesh, Some(f)),
                 _ => {
                     let mut g = Vec::new();
-                    for e in mesh.face_edges(f) {
-                        if mesh.seams.get(e).copied().unwrap_or(false) {
-                            continue;
-                        }
+                    let target = st.bodies.get(bi).ok_or_else(|| lost("the projection body"))?;
+                    for e in projection_face_edges(target, &mesh, f, plane)? {
                         if let Some(pts) = mesh.edges.get(e) {
                             g.extend(fit_world(plane, pts));
                         }
                     }
-                    g
+                    if certified_planar_construction(target, f as usize) { merge_family_lines(g)? } else { g }
                 }
             }
         }
@@ -257,23 +263,271 @@ fn resolve_uncached(
         LinkSource::Plane { name } => {
             let pr =
                 if Plane::named(name).is_some() { PlaneRef::Origin { name: name.clone() } } else { PlaneRef::Construction { name: name.clone() } };
-            let other = doc.resolve_plane(vals, &pr, 0).map_err(|_| lost(&format!("plane {name}")))?;
+            let other = doc.resolve_plane_in(vals, &pr, 0, Some(st)).map_err(|_| lost(&format!("plane {name}")))?;
             plane_trace(plane, &other).into_iter().collect()
         }
     };
     if geom.is_empty() && wires.is_empty() {
         return Err(DocError::Invalid(format!("the {} projects to nothing on this sketch plane", src.describe())));
     }
-    Ok(Resolved { geom: merge_split_circles(geom), wires, source, moved })
+    Ok(Resolved { geom: merge_split_circles(geom), wires, source, moved, face_index })
 }
 
 /// Re-resolve every link of a sketch (in place). Returns warnings for lost, moved or rebuilt
 /// links; lost links keep their last geometry.
+fn lost(reference: &str) -> DocError {
+    DocError::Unknown(format!("{reference} no longer exists"))
+}
+
+fn resolve_named_face(st: &ModelState, plane: &Plane, kind: LinkKind, body: &str, index: usize, at: Vec3) -> Result<Resolved> {
+    let target = st.body(body).ok_or_else(|| lost("named projection body"))?;
+    let mesh = target.mesh();
+    if mesh.triangles.len() > 2_000_000 || mesh.edges.len() > 2_000_000 {
+        return Err(DocError::Invalid("named face projection work limit exceeded".into()));
+    }
+    let face_index = Some(index);
+    let index = u32::try_from(index).map_err(|_| DocError::Invalid("named projection face index exceeds limit".into()))?;
+    let geom = if kind == LinkKind::Intersect {
+        section(plane, &mesh, Some(index))
+    } else {
+        let mut geom = Vec::new();
+        for edge in projection_face_edges(target, &mesh, index, plane)? {
+            if let Some(points) = mesh.edges.get(edge) {
+                geom.extend(fit_world(plane, points));
+            }
+        }
+        let geom = merge_split_circles(geom);
+        if certified_planar_construction(target, index as usize) { merge_family_lines(geom)? } else { geom }
+    };
+    if geom.is_empty() {
+        return Err(DocError::Invalid("named face projects to nothing on this sketch plane".into()));
+    }
+    Ok(Resolved { geom, wires: Vec::new(), source: LinkSource::Face { body: body.into(), at }, moved: false, face_index })
+}
+
+fn projection_face_edges(body: &crate::ModelBody, mesh: &Mesh, index: u32, plane: &Plane) -> Result<Vec<usize>> {
+    let shell_plane = body
+        .body
+        .face_sources()
+        .and_then(|sources| sources.get(index as usize))
+        .is_some_and(|source| matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { .. })));
+    if shell_plane { order::raw_face_edges(mesh, index, plane) } else { order::face_edges(mesh, index, plane) }
+}
+
+fn certified_planar_construction(body: &crate::ModelBody, index: usize) -> bool {
+    body.body.face_sources().and_then(|sources| sources.get(index)).is_some_and(|source| {
+        matches!(
+            source,
+            Some(
+                solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::Box { producer: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::CertifiedExtrudeSide { plane: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::CertifiedExtrudeCap { .. }
+            )
+        )
+    })
+}
+
+pub fn resolve_anchored_face(doc: &Document, st: &ModelState, plane: &Plane, kind: LinkKind, anchor: &crate::FaceAnchor) -> Result<Resolved> {
+    let body = st.body(&anchor.target.body).ok_or_else(|| lost("anchored projection body"))?;
+    let indices = doc.configuration_face_indices(body, &anchor.target)?;
+    resolve_face_indices(st, plane, kind, &body.name, &indices)
+}
+
+/// Project explicitly selected current face indices, without claiming persistent provenance.
+/// Callers retaining a link must supply their own replay identity policy.
+pub fn resolve_face_indices(st: &ModelState, plane: &Plane, kind: LinkKind, body_name: &str, indices: &[usize]) -> Result<Resolved> {
+    let body = st.body(body_name).ok_or_else(|| lost("projection body"))?;
+    let mesh = body.mesh();
+    if mesh.triangles.len() > 2_000_000 || indices.len() > 10_000 {
+        return Err(DocError::Invalid("anchored projection work limit exceeded".into()));
+    }
+    let work = mesh.triangles.len().saturating_add(mesh.edges.len()).saturating_mul(indices.len());
+    if work > 10_000_000 {
+        return Err(DocError::Invalid("anchored projection aggregate work limit exceeded".into()));
+    }
+    let selected: std::collections::BTreeSet<_> = indices.iter().copied().collect();
+    let mut geometry = Vec::new();
+    if kind == LinkKind::Intersect {
+        for index in indices {
+            let index = u32::try_from(*index).map_err(|_| DocError::Invalid("anchored face index exceeds format bounds".into()))?;
+            geometry.extend(section(plane, &mesh, Some(index)));
+        }
+    } else {
+        let edges = if let [index] = indices {
+            projection_face_edges(
+                body,
+                &mesh,
+                u32::try_from(*index).map_err(|_| DocError::Invalid("face index exceeds format bounds".into()))?,
+                plane,
+            )?
+        } else {
+            order::family_edges(&mesh, &selected, plane)?
+        };
+        for edge in edges {
+            if let Some(points) = mesh.edges.get(edge) {
+                geometry.extend(fit_world(plane, points));
+            }
+        }
+    }
+    if kind != LinkKind::Intersect && (indices.len() > 1 || indices.first().is_some_and(|index| certified_planar_construction(body, *index))) {
+        geometry = merge_family_lines(geometry)?;
+    }
+    let point = mesh
+        .triangles
+        .iter()
+        .zip(&mesh.tri_face)
+        .find_map(|(triangle, face)| selected.contains(&(*face as usize)).then(|| mesh.tri(triangle)).flatten().map(|[a, b, c]| (a + b + c) / 3.0))
+        .ok_or_else(|| lost("anchored projection face"))?;
+    if geometry.is_empty() {
+        return Err(lost("anchored projection boundaries"));
+    }
+    Ok(Resolved {
+        geom: merge_split_circles(geometry),
+        wires: Vec::new(),
+        source: LinkSource::Face { body: body.name.clone(), at: point },
+        moved: false,
+        face_index: if indices.len() == 1 { indices.first().copied() } else { None },
+    })
+}
+
+pub fn refresh_face_anchor_links(
+    doc: &Document,
+    vals: &BTreeMap<String, Value>,
+    st: &ModelState,
+    plane: &Plane,
+    sk: &mut Sketch,
+    anchor: &crate::FaceAnchor,
+) -> Vec<String> {
+    refresh_links_in(doc, vals, st, plane, sk, Some(anchor))
+}
+
+/// Remove degree-two straight stations introduced by coplanar face subdivision.
+/// The walk uses endpoint incidence; geometric sorting does not imply adjacency.
+fn merge_family_lines(geom: Vec<LinkGeom>) -> Result<Vec<LinkGeom>> {
+    if geom.len().saturating_mul(geom.len()).saturating_mul(3) > 10_000_000 {
+        return Err(DocError::Invalid("face family straight-boundary work limit exceeded".into()));
+    }
+    let ends = |curve: &LinkGeom| match curve {
+        LinkGeom::Line(a, b) | LinkGeom::Arc { a, b, .. } | LinkGeom::Conic { a, b, .. } => Some((*a, *b)),
+        LinkGeom::Spline { pts, periodic: false, .. } => pts.first().zip(pts.last()).map(|(a, b)| (*a, *b)),
+        _ => None,
+    };
+    let scale = geom.iter().filter_map(&ends).flat_map(|(a, b)| [a.len(), b.len()]).fold(1., f64::max);
+    let tol = scale * f64::EPSILON * 512.;
+    let mut used = vec![false; geom.len()];
+    let mut result = Vec::new();
+    for (index, curve) in geom.iter().enumerate() {
+        if used.get(index).copied().unwrap_or(true) {
+            continue;
+        }
+        if let Some(slot) = used.get_mut(index) {
+            *slot = true;
+        }
+        let LinkGeom::Line(a, b) = curve else {
+            result.push(curve.clone());
+            continue;
+        };
+        let mut endpoints = [*a, *b];
+        for side in 0..2 {
+            let mut current = index;
+            for _ in 0..geom.len() {
+                let Some(point) = endpoints.get(side).copied() else { break };
+                let mut incidence = geom
+                    .iter()
+                    .enumerate()
+                    .filter_map(|(other, curve)| ends(curve).filter(|(a, b)| a.dist(point) <= tol || b.dist(point) <= tol).map(|_| other));
+                let (Some(one), Some(two), None) = (incidence.next(), incidence.next(), incidence.next()) else { break };
+                let other = if one == current {
+                    two
+                } else if two == current {
+                    one
+                } else {
+                    break;
+                };
+                if used.get(other).copied().unwrap_or(true) {
+                    break;
+                }
+                let Some(LinkGeom::Line(a, b)) = geom.get(other) else { break };
+                let next = if a.dist(point) <= tol { *b } else { *a };
+                let Some(opposite) = endpoints.get(1 - side).copied() else { break };
+                let (Some(incoming), Some(outgoing)) = ((point - opposite).normalized(), (next - point).normalized()) else { break };
+                if incoming.dot(outgoing) <= 0. || incoming.cross(outgoing).abs() > f64::EPSILON * 512. {
+                    break;
+                }
+                if let Some(slot) = used.get_mut(other) {
+                    *slot = true;
+                }
+                if let Some(slot) = endpoints.get_mut(side) {
+                    *slot = next;
+                }
+                current = other;
+            }
+        }
+        if let (Some(a), Some(b)) = (endpoints.first(), endpoints.get(1)) {
+            result.push(LinkGeom::Line(*a, *b));
+        }
+    }
+    Ok(result)
+}
+
 pub fn refresh_links(doc: &Document, vals: &BTreeMap<String, Value>, st: &ModelState, plane: &Plane, sk: &mut Sketch) -> Vec<String> {
+    refresh_links_in(doc, vals, st, plane, sk, None)
+}
+
+fn refresh_links_in(
+    doc: &Document,
+    vals: &BTreeMap<String, Value>,
+    st: &ModelState,
+    plane: &Plane,
+    sk: &mut Sketch,
+    anchor: Option<&crate::FaceAnchor>,
+) -> Vec<String> {
     let mut warn = Vec::new();
     let links = sk.links.clone();
     for l in &links {
-        match resolve(doc, vals, st, plane, l.kind, &l.source) {
+        let mut source = l.source.clone();
+        let mut named_face = None;
+        if !l.auto_face
+            && let (Some(name), LinkSource::Face { body, at }) = (&l.face_name, &mut source)
+        {
+            if let Some((index, p, split)) = st.body(body).and_then(|target| crate::naming::face_on_body(target, name, *at)) {
+                let stem = crate::naming::strip_piece(name);
+                let removed_piece = split
+                    && name != stem
+                    && st.body(body).is_some_and(|target| {
+                        (certified_planar_construction(target, index) || target.body.face_was_coalesced(index))
+                            && crate::naming::face_names(target).get(index).is_some_and(|current| current == stem)
+                    });
+                if removed_piece {
+                    sk.set_link_lost(&l.id, true);
+                    warn.push(format!("projected face piece `{name}` no longer exists; last geometry retained"));
+                    continue;
+                }
+                *at = p;
+                named_face = Some((body.clone(), index, p));
+                if split {
+                    warn.push(format!("projected face `{name}` was split; using the nearest piece"));
+                }
+            } else {
+                sk.set_link_lost(&l.id, true);
+                warn.push(format!("projected face `{name}` no longer exists"));
+                continue;
+            }
+        }
+        let resolved = if l.auto_face {
+            anchor
+                .filter(|anchor| {
+                    l.face_name.as_ref() == Some(&anchor.target.name) && matches!(&l.source,LinkSource::Face {body,..} if *body==anchor.target.body)
+                })
+                .ok_or_else(|| lost("exact auto-projected attachment"))
+                .and_then(|anchor| resolve_anchored_face(doc, st, plane, l.kind, anchor))
+        } else if let Some((body, index, at)) = named_face {
+            resolve_named_face(st, plane, l.kind, &body, index, at)
+        } else {
+            resolve(doc, vals, st, plane, l.kind, &source)
+        };
+        match resolved {
             Ok(r) => {
                 sk.set_link_source(&l.id, r.source);
                 let _ = sk.set_link_wires(&l.id, &r.wires);
@@ -426,9 +680,9 @@ fn project_sketch_curve(sk: &Sketch, from: &Plane, ci: usize, to: &Plane) -> Vec
             (Some(c), Some(m)) => vec![LinkGeom::Ellipse { c: map(c), major: map(m), minor: *r }],
             _ => Vec::new(),
         },
-        Some(CurveKind::Spline { pts, control, degree }) if parallel => {
+        Some(CurveKind::Spline { pts, control, degree, periodic }) if parallel => {
             let p: Option<Vec<Vec2>> = pts.iter().map(|q| sk.point(*q).map(map)).collect();
-            p.map(|pts| vec![LinkGeom::Spline { pts, control: *control, degree: *degree }]).unwrap_or_default()
+            p.map(|pts| vec![LinkGeom::Spline { pts, control: *control, degree: *degree, periodic: *periodic }]).unwrap_or_default()
         }
         Some(CurveKind::Conic { a, b, apex, rho }) if parallel => match (sk.point(*a), sk.point(*apex), sk.point(*b)) {
             (Some(a), Some(x), Some(b)) => vec![LinkGeom::Conic { a: map(a), apex: map(x), b: map(b), rho: *rho }],
@@ -472,7 +726,7 @@ fn tilted_circle(plane: &Plane, pts: &[Vec3]) -> Option<Vec<LinkGeom>> {
     let (c, n, r, closed) = circle3(pts)?;
     let sn = plane.normal();
     let cosang = n.dot(sn).abs();
-    if cosang > 1.0 - 1e-12 || cosang < 1e-9 {
+    if !(1e-9..=1.0 - 1e-12).contains(&cosang) {
         return None;
     }
     if closed {
@@ -544,7 +798,7 @@ fn as_spline(pts: &[Vec2], tol: f64) -> Option<LinkGeom> {
                 <= tol
         });
         if ok {
-            return Some(LinkGeom::Spline { pts: fit, control: false, degree: 3 });
+            return Some(LinkGeom::Spline { pts: fit, control: false, degree: 3, periodic: false });
         }
     }
     None

crates/doc/src/project3d.rs

@@ -456,7 +456,7 @@ fn link_polyline(g: &solvecraft_sketch::LinkGeom) -> Vec<Vec2> {
         LinkGeom::Ellipse { c, major, minor } => {
             (0..=96).map(|i| solvecraft_sketch::ellipse_point(c, major, minor, i as f64 / 96.0 * std::f64::consts::TAU)).collect()
         }
-        LinkGeom::Spline { ref pts, control, degree } => solvecraft_sketch::spline_polyline(pts, control, degree),
+        LinkGeom::Spline { ref pts, control, degree, periodic } => solvecraft_sketch::spline_polyline_mode(pts, control, degree, periodic),
         LinkGeom::Point(_) => Vec::new(),
     }
 }

crates/doc/src/project_order.rs

@@ -0,0 +1,392 @@
+//! Stable face projection order: outer boundary first, then holes by geometry.
+//! B-rep edge indices depend on face enumeration and must not choose sketch curve IDs.
+
+use std::collections::BTreeMap;
+
+use solvecraft_geom::{Mesh, Plane, Vec3};
+
+use crate::{DocError, Result};
+
+type Key = (i64, i64, i64);
+
+pub(super) fn face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<usize>> {
+    let edges = mesh.face_edges(face).into_iter().filter(|e| !mesh.seams.get(*e).copied().unwrap_or(false)).collect();
+    boundary_edges(mesh, edges, plane)
+}
+
+/// Full boundary of an explicitly selected analytic planar piece. Display seams
+/// hide subdivisions for picking, but cannot remove a raw piece's closing edge.
+pub(super) fn raw_face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<usize>> {
+    boundary_edges(mesh, mesh.face_edges(face), plane)
+}
+
+/// Exterior of an exact current face family. Shared topological edges are internal;
+/// geometric proximity never merges distinct edges or chooses a different face.
+pub(super) fn family_edges(mesh: &Mesh, selected: &std::collections::BTreeSet<usize>, plane: &Plane) -> Result<Vec<usize>> {
+    let mut edges = Vec::new();
+    for (index, faces) in mesh.edge_faces.iter().enumerate() {
+        let count = faces.iter().filter(|face| selected.contains(&(**face as usize))).count();
+        if count == 0 {
+            continue;
+        }
+        if faces.len() > 2 || (faces.len() == 2 && faces.first() == faces.get(1)) {
+            return Err(DocError::Invalid("face family has ambiguous edge adjacency".into()));
+        }
+        if count == 1 && !mesh.seams.get(index).copied().unwrap_or(false) {
+            edges.push(index);
+        }
+    }
+    boundary_edges(mesh, edges, plane)
+}
+
+fn boundary_edges(mesh: &Mesh, mut edges: Vec<usize>, plane: &Plane) -> Result<Vec<usize>> {
+    let bounds = mesh.bounds();
+    let origin = bounds.min;
+    let local_origin = plane.to_local(origin);
+    let tol = (bounds.diagonal() * 1e-8).max(1e-9);
+    if !tol.is_finite() {
+        return Err(DocError::Invalid("face projection has invalid bounds".into()));
+    }
+    let key = |p: Vec3| -> Key {
+        let p = p - origin;
+        ((p.x / tol).round() as i64, (p.y / tol).round() as i64, (p.z / tol).round() as i64)
+    };
+    if edges.iter().any(|e| !mesh.edges.get(*e).is_some_and(|p| p.len() >= 2 && p.iter().all(|p| p.is_finite()))) {
+        return Err(DocError::Invalid("face projection has an invalid boundary edge".into()));
+    }
+    if edges.len() > solvecraft_sketch::MAX_LINK_ENTITIES {
+        return Err(DocError::Invalid("face projection exceeds the boundary edge limit".into()));
+    }
+    let geometry_key = |e: usize| {
+        let pts = mesh.edges.get(e).map(Vec::as_slice).unwrap_or_default();
+        let lo = pts.iter().copied().fold(Vec3::new(f64::INFINITY, f64::INFINITY, f64::INFINITY), Vec3::min);
+        let hi = pts.iter().copied().fold(Vec3::new(f64::NEG_INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY), Vec3::max);
+        (key(lo), key(hi))
+    };
+    edges.sort_by_key(|e| geometry_key(*e));
+    let mut at: BTreeMap<Key, Vec<usize>> = BTreeMap::new();
+    for e in &edges {
+        if let Some(pts) = mesh.edges.get(*e) {
+            for point in [pts.first(), pts.last()].into_iter().flatten() {
+                at.entry(key(*point)).or_default().push(*e);
+            }
+        }
+    }
+    let mut used = vec![false; mesh.edges.len()];
+    let mut boundaries = Vec::new();
+    for start_edge in &edges {
+        if used.get(*start_edge).copied().unwrap_or(true) {
+            continue;
+        }
+        let Some(pts) = mesh.edges.get(*start_edge) else { continue };
+        let (Some(a), Some(b)) = (pts.first(), pts.last()) else { continue };
+        let start = if key(*a) <= key(*b) { *a } else { *b };
+        let mut current = start;
+        let mut edge = *start_edge;
+        let mut boundary = Vec::new();
+        let mut twice_area = 0.0;
+        for _ in 0..edges.len() {
+            let Some(pts) = mesh.edges.get(edge) else { break };
+            let (Some(a), Some(b)) = (pts.first(), pts.last()) else { break };
+            let forward = current.dist(*a) <= current.dist(*b);
+            for pair in pts.windows(2) {
+                let (Some(a), Some(b)) = (pair.first(), pair.get(1)) else { continue };
+                let (a, b) = (plane.to_local(*a) - local_origin, plane.to_local(*b) - local_origin);
+                twice_area += if forward { a.cross(b) } else { b.cross(a) };
+            }
+            current = if forward { *b } else { *a };
+            if let Some(slot) = used.get_mut(edge) {
+                *slot = true;
+            }
+            boundary.push(edge);
+            if current.dist(start) <= tol {
+                break;
+            }
+            // Neighbouring quantization cells cover points on either side of a rounding
+            // boundary. Connectivity is checked in world space, not in the projection.
+            let (x, y, z) = key(current);
+            let mut candidates = Vec::new();
+            for dx in -1..=1 {
+                for dy in -1..=1 {
+                    for dz in -1..=1 {
+                        let cell = (x.saturating_add(dx), y.saturating_add(dy), z.saturating_add(dz));
+                        if let Some(list) = at.get(&cell) {
+                            candidates.extend(list.iter().copied().filter(|e| {
+                                !used.get(*e).copied().unwrap_or(true)
+                                    && mesh.edges.get(*e).is_some_and(|p| {
+                                        p.first().is_some_and(|a| a.dist(current) <= tol) || p.last().is_some_and(|b| b.dist(current) <= tol)
+                                    })
+                            }));
+                        }
+                    }
+                }
+            }
+            candidates.sort_by_key(|e| geometry_key(*e));
+            candidates.dedup();
+            if candidates.len() > 1 {
+                return Err(DocError::Invalid("face projection has a branched boundary".into()));
+            }
+            let Some(next) = candidates.first() else { break };
+            edge = *next;
+        }
+        boundary.sort_by_key(|e| geometry_key(*e));
+        let closed = current.dist(start) <= tol;
+        if !closed || !twice_area.is_finite() {
+            return Err(DocError::Invalid("face projection has an open or invalid boundary".into()));
+        }
+        // Equal-sized holes use their geometric key, not round-off from summing the
+        // same area at different positions or walking their edges in reverse.
+        let area = (twice_area.abs() / (tol * bounds.diagonal().max(tol))).round() as i64;
+        let first = boundary.first().copied().map(geometry_key);
+        boundaries.push((area, first, boundary));
+    }
+    boundaries.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.cmp(&b.1)));
+    Ok(boundaries.into_iter().flat_map(|(_, _, edges)| edges).collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn face_family_omits_only_exact_shared_topological_edges() {
+        let mut mesh = Mesh::default();
+        for (a, b, faces) in [
+            ((0., 0.), (2., 0.), vec![0]),
+            ((2., 0.), (2., 1.), vec![0]),
+            ((2., 1.), (0., 1.), vec![0, 1]),
+            ((0., 1.), (0., 0.), vec![0]),
+            ((2., 1.), (2., 2.), vec![1]),
+            ((2., 2.), (0., 2.), vec![1]),
+            ((0., 2.), (0., 1.), vec![1]),
+        ] {
+            mesh.edges.push(vec![Vec3::new(a.0, a.1, 0.), Vec3::new(b.0, b.1, 0.)]);
+            mesh.positions.extend([Vec3::new(a.0, a.1, 0.), Vec3::new(b.0, b.1, 0.)]);
+            mesh.edge_faces.push(faces);
+        }
+        let selected = [0, 1].into_iter().collect();
+        let edges = family_edges(&mesh, &selected, &Plane::XY).unwrap();
+        assert_eq!(edges.len(), 6);
+        assert!(!edges.contains(&2));
+        let geometry: Vec<_> = edges.iter().flat_map(|edge| super::super::fit_world(&Plane::XY, &mesh.edges[*edge])).collect();
+        assert_eq!(super::super::merge_family_lines(geometry).unwrap().len(), 4);
+        assert_eq!(family_edges(&mesh, &[0].into_iter().collect(), &Plane::XY).unwrap().len(), 4);
+        mesh.edge_faces[2] = vec![0, 1, 2];
+        assert!(family_edges(&mesh, &selected, &Plane::XY).is_err());
+        mesh.edge_faces[2] = vec![0, 0];
+        assert!(family_edges(&mesh, &selected, &Plane::XY).is_err());
+    }
+
+    #[test]
+    fn distinct_crossing_boundaries_are_not_geometrically_cancelled() {
+        let mut mesh = Mesh::default();
+        for (face, x, y) in [(0, 0., 0.), (1, 1., 1.)] {
+            let corners = [Vec3::new(x, y, 0.), Vec3::new(x + 2., y, 0.), Vec3::new(x + 2., y + 2., 0.), Vec3::new(x, y + 2., 0.)];
+            mesh.positions.extend(corners);
+            for i in 0..4 {
+                mesh.edges.push(vec![corners[i], corners[(i + 1) % 4]]);
+                mesh.edge_faces.push(vec![face]);
+            }
+        }
+        let edges = family_edges(&mesh, &[0, 1].into_iter().collect(), &Plane::XY).unwrap();
+        assert_eq!(edges.len(), 8);
+        let geom: Vec<_> = edges.iter().flat_map(|edge| super::super::fit_world(&Plane::XY, &mesh.edges[*edge])).collect();
+        let mut sk = solvecraft_sketch::Sketch::new();
+        let link = sk
+            .add_link(solvecraft_sketch::LinkKind::Project, solvecraft_sketch::LinkSource::Face { body: "ambiguous".into(), at: Vec3::ZERO }, &geom)
+            .unwrap();
+        assert!(sk.update_link(&link, &geom).is_err());
+    }
+
+    #[test]
+    fn family_line_normalization_preserves_corners_arcs_branches_and_retracing() {
+        use solvecraft_geom::Vec2;
+        use solvecraft_sketch::LinkGeom;
+        let line = |a, b| LinkGeom::Line(Vec2::new(a, 0.), Vec2::new(b, 0.));
+        assert_eq!(super::super::merge_family_lines(vec![line(0., 1.), line(2., 1.)]).unwrap(), vec![line(0., 2.)]);
+        for geometry in [
+            vec![line(0., 1.), line(1., 0.5)],
+            vec![line(0., 1.), LinkGeom::Line(Vec2::new(1., 0.), Vec2::new(2., 1e-8))],
+            vec![line(0., 1.), line(1., 2.), LinkGeom::Line(Vec2::new(1., 0.), Vec2::new(1., 1.))],
+            vec![line(0., 1.), line(1., 2.), LinkGeom::Conic { a: Vec2::new(1., 0.), apex: Vec2::new(2., 1.), b: Vec2::new(3., 1.), rho: 0.5 }],
+            vec![
+                line(0., 1.),
+                line(1., 2.),
+                LinkGeom::Spline { pts: vec![Vec2::new(1., 0.), Vec2::new(2., 1.), Vec2::new(3., 1.)], control: false, degree: 2, periodic: false },
+            ],
+            vec![line(0., 1.), LinkGeom::Arc { c: Vec2::new(1., 1.), a: Vec2::new(1., 0.), b: Vec2::new(2., 1.) }],
+            vec![line(0., 1.), line(1.00001, 2.)],
+        ] {
+            assert_eq!(super::super::merge_family_lines(geometry.clone()).unwrap(), geometry);
+        }
+    }
+
+    fn rectangles() -> Mesh {
+        let mut mesh = Mesh::default();
+        for (x, y) in [(40.0, 30.0), (38.0, 28.0), (4.0, 2.0)] {
+            let pts = [Vec3::new(-x, -y, 0.0), Vec3::new(x, -y, 0.0), Vec3::new(x, y, 0.0), Vec3::new(-x, y, 0.0)];
+            mesh.positions.extend(pts);
+            for i in 0..4 {
+                mesh.edges.push(vec![pts[i], pts[(i + 1) % 4]]);
+                mesh.edge_faces.push(vec![7]);
+            }
+        }
+        mesh
+    }
+
+    #[test]
+    fn boundaries_and_edge_identity_are_independent_of_mesh_enumeration() {
+        let baseline = rectangles();
+        let expected: Vec<_> =
+            face_edges(&baseline, 7, &Plane::XY).unwrap().into_iter().map(|e| super::super::fit_world(&Plane::XY, &baseline.edges[e])).collect();
+        for shift in 0..baseline.edges.len() {
+            for reverse in [false, true] {
+                let mut mesh = baseline.clone();
+                mesh.edges = (0..mesh.edges.len()).map(|i| baseline.edges[(i * 5) % baseline.edges.len()].clone()).collect();
+                mesh.edges.rotate_left(shift);
+                if reverse {
+                    mesh.edges.reverse();
+                    for pts in &mut mesh.edges {
+                        pts.reverse();
+                    }
+                }
+                let actual: Vec<_> = face_edges(&mesh, 7, &Plane::XY)
+                    .unwrap()
+                    .into_iter()
+                    .map(|e| {
+                        let mut pts = mesh.edges[e].clone();
+                        // Lines' direction does not change their geometry.
+                        if pts.first().unwrap().x > pts.last().unwrap().x || pts.first().unwrap().y > pts.last().unwrap().y {
+                            pts.reverse();
+                        }
+                        super::super::fit_world(&Plane::XY, &pts)
+                    })
+                    .collect();
+                let normalized: Vec<_> = expected
+                    .iter()
+                    .map(|g| {
+                        let solvecraft_sketch::LinkGeom::Line(a, b) = g[0] else { panic!("line") };
+                        if a.x > b.x || a.y > b.y { vec![solvecraft_sketch::LinkGeom::Line(b, a)] } else { g.clone() }
+                    })
+                    .collect();
+                assert_eq!(actual, normalized);
+                let ordered = face_edges(&mesh, 7, &Plane::XY).unwrap();
+                for (loop_index, chunk) in ordered.chunks(4).enumerate() {
+                    let want = [40.0, 38.0, 4.0][loop_index];
+                    assert!(chunk.iter().flat_map(|e| &mesh.edges[*e]).all(|p| p.x.abs() <= want));
+                    assert!(chunk.iter().flat_map(|e| &mesh.edges[*e]).any(|p| p.x.abs() == want));
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn rounded_boundary_arc_sweeps_survive_individual_edge_reversal() {
+        use solvecraft_geom::{Seg2, Vec2};
+        use solvecraft_sketch::LinkGeom;
+        let mut mesh = Mesh::default();
+        for (extent, radius) in [(10.0, 3.0), (8.0, 1.0)] {
+            for k in 0..4 {
+                let angle = k as f64 * std::f64::consts::FRAC_PI_2;
+                let rotate = |p: Vec2| (0..k).fold(p, |p, _| p.perp());
+                let centre = rotate(Vec2::new(extent - radius, extent - radius));
+                let arc = Seg2::Arc { center: centre, radius, start: angle, sweep: std::f64::consts::FRAC_PI_2 };
+                let line = Seg2::Line { a: arc.point_at(1.0), b: rotate(Vec2::new(-(extent - radius), extent)) };
+                for seg in [arc, line] {
+                    let pts: Vec<_> = (0..=16).map(|i| Plane::XY.to_world(seg.point_at(i as f64 / 16.0))).collect();
+                    mesh.positions.extend(pts.iter().copied());
+                    mesh.edges.push(pts);
+                    mesh.edge_faces.push(vec![2]);
+                }
+            }
+        }
+        let normalized = |mesh: &Mesh| -> Vec<Vec<LinkGeom>> {
+            face_edges(mesh, 2, &Plane::XY)
+                .unwrap()
+                .into_iter()
+                .map(|e| {
+                    super::super::fit_world(&Plane::XY, &mesh.edges[e])
+                        .into_iter()
+                        .map(|g| match g {
+                            LinkGeom::Line(a, b) if (a.x, a.y) > (b.x, b.y) => LinkGeom::Line(b, a),
+                            g => g,
+                        })
+                        .collect()
+                })
+                .collect()
+        };
+        let expected = normalized(&mesh);
+        for shift in 0..mesh.edges.len() {
+            let mut permuted = mesh.clone();
+            permuted.edges = (0..mesh.edges.len()).map(|i| mesh.edges[(i * 5 + shift) % mesh.edges.len()].clone()).collect();
+            for (i, points) in permuted.edges.iter_mut().enumerate() {
+                if i % 2 == 0 {
+                    points.reverse();
+                }
+            }
+            let actual = normalized(&permuted);
+            for (a, b) in actual.iter().zip(&expected) {
+                assert_eq!(a.len(), b.len());
+                for (a, b) in a.iter().zip(b) {
+                    match (a, b) {
+                        (LinkGeom::Line(a, b), LinkGeom::Line(c, d)) => assert!(a.dist(*c) < 1e-9 && b.dist(*d) < 1e-9),
+                        (LinkGeom::Arc { c, a, b }, LinkGeom::Arc { c: cc, a: aa, b: bb }) => {
+                            assert!(c.dist(*cc) < 1e-9 && a.dist(*aa) < 1e-9 && b.dist(*bb) < 1e-9);
+                        }
+                        _ => panic!("boundary changed kind"),
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn incomplete_and_branched_boundaries_are_reported_without_partial_geometry() {
+        let mut open = rectangles();
+        open.edges.pop();
+        open.edge_faces.pop();
+        assert!(face_edges(&open, 7, &Plane::XY).unwrap_err().to_string().contains("open"));
+        let mut branched = rectangles();
+        branched.edges.push(vec![Vec3::new(-40.0, -30.0, 0.0), Vec3::ZERO]);
+        branched.edge_faces.push(vec![7]);
+        assert!(face_edges(&branched, 7, &Plane::XY).is_err());
+        let mut invalid = rectangles();
+        invalid.edges[0].push(Vec3::new(f64::NAN, 0.0, 0.0));
+        assert!(face_edges(&invalid, 7, &Plane::XY).unwrap_err().to_string().contains("invalid"));
+    }
+
+    #[test]
+    fn equal_area_holes_use_geometric_order_after_translation() {
+        let mut baseline = rectangles();
+        baseline.edges.truncate(4);
+        baseline.edge_faces.truncate(4);
+        for x in [-12.0, 12.0] {
+            let pts = [Vec3::new(x - 2.0, -2.0, 0.0), Vec3::new(x + 2.0, -2.0, 0.0), Vec3::new(x + 2.0, 2.0, 0.0), Vec3::new(x - 2.0, 2.0, 0.0)];
+            for i in 0..4 {
+                baseline.edges.push(vec![pts[i], pts[(i + 1) % 4]]);
+                baseline.edge_faces.push(vec![7]);
+            }
+        }
+        let shift = Vec3::new(12345.6789, -23456.7891, 987.0);
+        for p in &mut baseline.positions {
+            *p += shift;
+        }
+        for points in &mut baseline.edges {
+            for p in points {
+                *p += shift;
+            }
+        }
+        for offset in 0..baseline.edges.len() {
+            let mut mesh = baseline.clone();
+            mesh.edges = (0..mesh.edges.len()).map(|i| baseline.edges[(i * 5 + offset) % baseline.edges.len()].clone()).collect();
+            for (i, points) in mesh.edges.iter_mut().enumerate() {
+                if i % 2 == 0 {
+                    points.reverse();
+                }
+            }
+            let order = face_edges(&mesh, 7, &Plane::XY).unwrap();
+            assert!(order[4..8].iter().flat_map(|e| &mesh.edges[*e]).all(|p| p.x < shift.x));
+            assert!(order[8..12].iter().flat_map(|e| &mesh.edges[*e]).all(|p| p.x > shift.x));
+        }
+    }
+}

crates/doc/src/tests.rs

@@ -38,6 +38,9 @@ fn plate_doc() -> (Document, u64) {
                 start_offset: None,
                 through_all: false,
                 taper: None,
+                to: None,
+                to_offset: None,
+                from: None,
             },
             operation: Operation::NewBody,
             targets: vec![],
@@ -78,10 +81,31 @@ fn parametric_plate_reevaluates() {
     assert!(rel(measure(&m.state().bodies[0].body).unwrap().volume, 50.0 * 30.0 * 10.0) < 1e-9);
 }
 
+/// Setting a parameter back takes the earlier results from the cache: nothing is recomputed, but
+/// the evaluation reports the features it restored (their geometry did change back).
+#[test]
+fn set_back_reports_restored_features() {
+    let (mut doc, _) = plate_doc();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert_eq!((m.last_recomputed, m.last_restored), (2, 0));
+    doc.set_param("width", "50 mm", None, None).unwrap();
+    m.evaluate(&doc);
+    assert_eq!((m.last_recomputed, m.last_restored), (2, 0));
+    doc.set_param("width", "40 mm", None, None).unwrap();
+    m.evaluate(&doc);
+    assert_eq!((m.last_recomputed, m.last_restored), (0, 2));
+    assert!(rel(measure(&m.state().bodies[0].body).unwrap().volume, 24000.0) < 1e-9);
+    // No change: nothing recomputed and nothing restored.
+    m.evaluate(&doc);
+    assert_eq!((m.last_recomputed, m.last_restored), (0, 0));
+}
+
 #[test]
 fn box_fillet_cut_timeline() {
     let (mut doc, _) = plate_doc();
-    doc.add_feature(FeatureKind::Fillet { edges: vec![Vec3::new(0.0, 0.0, 10.0)], radius: "3".into(), body: None }, None).unwrap();
+    doc.add_feature(FeatureKind::Fillet { edges: vec![Vec3::new(0.0, 0.0, 10.0)], radius: "3".into(), body: None, style: Default::default() }, None)
+        .unwrap();
     let mut sk = Sketch::new();
     sk.add_circle(Vec2::new(20.0, 15.0), 5.0, None, None).unwrap();
     let s2 = doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Origin { name: "XY".into() }, sketch: sk }, None).unwrap();
@@ -96,6 +120,9 @@ fn box_fillet_cut_timeline() {
                 start_offset: None,
                 through_all: false,
                 taper: None,
+                to: None,
+                to_offset: None,
+                from: None,
             },
             operation: Operation::Cut,
             targets: vec![],
@@ -128,13 +155,24 @@ fn errors_are_reported_not_fatal() {
             angle: "90 deg".into(),
             operation: Operation::NewBody,
             targets: vec![],
+            angle2: None,
+            symmetric: false,
+            convention: Default::default(),
+            to: None,
         },
         None,
     )
     .unwrap();
-    doc.add_feature(FeatureKind::Fillet { edges: vec![Vec3::new(500.0, 0.0, 0.0)], radius: "1".into(), body: None }, None).unwrap();
+    doc.add_feature(FeatureKind::Fillet { edges: vec![Vec3::new(500.0, 0.0, 0.0)], radius: "1".into(), body: None, style: Default::default() }, None)
+        .unwrap();
     doc.add_feature(
-        FeatureKind::Box { corner: Vec3::ZERO, length: "nope".into(), width: "1".into(), height: "1".into(), operation: Operation::NewBody },
+        FeatureKind::Box {
+            corner: point_expr(Vec3::ZERO),
+            length: "nope".into(),
+            width: "1".into(),
+            height: "1".into(),
+            operation: Operation::NewBody,
+        },
         None,
     )
     .unwrap();
@@ -171,13 +209,19 @@ fn params_and_serialization() {
 fn primitives_and_combine() {
     let mut doc = Document::new("p");
     doc.add_feature(
-        FeatureKind::Box { corner: Vec3::ZERO, length: "10".into(), width: "10".into(), height: "10".into(), operation: Operation::NewBody },
+        FeatureKind::Box {
+            corner: point_expr(Vec3::ZERO),
+            length: "10".into(),
+            width: "10".into(),
+            height: "10".into(),
+            operation: Operation::NewBody,
+        },
         None,
     )
     .unwrap();
     doc.add_feature(
         FeatureKind::Cylinder {
-            base: Vec3::new(5.0, 5.0, 0.0),
+            base: point_expr(Vec3::new(5.0, 5.0, 0.0)),
             axis: Vec3::Z,
             radius: "2".into(),
             height: "20".into(),
@@ -264,3 +308,95 @@ fn parameter_cycles_are_found() {
     assert!(errs["a"].contains("circular reference: a → b → c → a"), "{}", errs["a"]);
     assert!(vals.contains_key("d") && errs.contains_key("a") && errs.contains_key("e"));
 }
+
+/// Features that use a sketch's points or regions go with it (not only profile and path users).
+#[test]
+fn input_sketches_cover_points_and_patches() {
+    let hole: FeatureKind = serde_json::from_value(serde_json::json!({
+        "type": "hole", "position": [0, 0, 0], "direction": [0, 0, -1], "diameter": "3",
+        "points": {"sketch": 7, "ids": ["p1"]},
+    }))
+    .unwrap();
+    assert_eq!(hole.input_sketches(), vec![7]);
+    let patch: FeatureKind = serde_json::from_value(serde_json::json!({"type": "patch", "sketch": 9})).unwrap();
+    assert_eq!(patch.input_sketches(), vec![9]);
+    let pipe: FeatureKind = serde_json::from_value(serde_json::json!({"type": "pipe", "path_sketch": 72, "path": ["l1"], "diameter": "4"})).unwrap();
+    assert_eq!(pipe.input_sketches(), vec![72]);
+}
+
+/// Guard for `FeatureKind::input_sketches`: a variant with a field that refers to a sketch
+/// (a field named `*sketch*` holding an id, sketch points or loft sections) must not sit in the
+/// arm that returns no sketches. New variants are caught by the compiler (the match has no
+/// wildcard); this catches a sketch field added to an existing variant.
+#[test]
+fn input_sketches_lists_every_variant_with_a_sketch_field() {
+    let src = include_str!("document.rs");
+    let body = src.split("pub enum FeatureKind {").nth(1).and_then(|s| s.split("\n}\n").next()).unwrap();
+    let mut with_sketch = Vec::new();
+    let mut variant = "";
+    for line in body.lines() {
+        let t = line.trim();
+        if line.starts_with("    ") && !line.starts_with("     ") && t.chars().next().is_some_and(|c| c.is_ascii_uppercase()) {
+            variant = t.split(|c: char| !c.is_alphanumeric()).next().unwrap_or("");
+            continue;
+        }
+        let Some((name, ty)) = t.strip_prefix("pub ").unwrap_or(t).split_once(':') else { continue };
+        let refers = (name.contains("sketch") && (ty.contains("u64") || ty.contains("SketchPoints")))
+            || ty.contains("SketchPoints")
+            || ty.contains("LoftSection");
+        if refers && !line.trim_start().starts_with("//") && !with_sketch.contains(&variant) {
+            with_sketch.push(variant);
+        }
+    }
+    assert!(with_sketch.len() >= 10, "the FeatureKind parse found too few sketch users: {with_sketch:?}");
+    let f = src.split("pub fn input_sketches(&self)").nth(1).unwrap();
+    let empty_arm = f.split("=> Vec::new()").next().and_then(|s| s.rsplit("=> ").next()).unwrap();
+    for v in with_sketch {
+        assert!(
+            !empty_arm.contains(&format!("K::{v} {{")),
+            "FeatureKind::{v} has a sketch field but input_sketches says it uses no sketch: deleting the sketch would leave it broken"
+        );
+    }
+}
+
+#[test]
+fn timeline_clones_share_meshes_even_when_cloned_before_tessellation() {
+    let body = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(10., 10., 10.)).unwrap();
+    let a = crate::eval::ModelBody::new("box".into(), body, 1);
+    let b = a.clone();
+    assert!(std::sync::Arc::ptr_eq(&a.mesh(), &b.mesh()));
+    assert!(!a.mesh().triangles.is_empty());
+}
+
+/// A construction plane that is its own side resolves through the model and back into the
+/// document. The depth count has to survive that hop, or the recursion overflows the stack and
+/// aborts the process, which no panic guard can intercept.
+#[test]
+fn self_referencing_construction_planes_are_errors() {
+    let selfref = |name: &str| Box::new(construct::GeoRef::Plane { plane: PlaneRef::Construction { name: name.into() } });
+    let xz = || Box::new(construct::GeoRef::Plane { plane: PlaneRef::Origin { name: "XZ".into() } });
+
+    // Directly its own first side.
+    let mut doc = Document::new("selfplane");
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P1"), b: xz() } }, Some("P1")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a plane that is its own side must report an error: {:?}", m.results);
+
+    // Two planes that are each other's side.
+    let mut doc = Document::new("twoplanes");
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P2"), b: xz() } }, Some("P1")).unwrap();
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P1"), b: xz() } }, Some("P2")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a two-plane cycle must report an error: {:?}", m.results);
+
+    // A perpendicular plane whose base is itself, and a sketch placed on it.
+    let mut doc = Document::new("perpplane");
+    let line = Box::new(construct::GeoRef::World { axis: "X".into() });
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Perpendicular { plane: selfref("P1"), line } }, Some("P1")).unwrap();
+    doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Construction { name: "P1".into() }, sketch: Sketch::new() }, Some("Sketch1")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a cyclic perpendicular plane must report an error: {:?}", m.results);
+}

crates/engine/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-engine"
-description = "SolveCraft engine: the session, the command registry (everything is a command), undo/redo and selection"
+description = "SolidCraft engine: the session, the command registry (everything is a command), undo/redo and selection"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/engine/src/boolean_regression_tests.rs

@@ -0,0 +1,66 @@
+//! Booleans that failed, panicked or hung, replayed from the scripts in
+//! `examples/regressions/` (each script's description says what went wrong).
+
+use serde_json::{Value, json};
+
+use crate::Session;
+
+fn replay(script: &str) -> Session {
+    let mut s = Session::default();
+    let script: Value = serde_json::from_str(script).unwrap();
+    s.run_script(&script).unwrap();
+    s
+}
+
+fn volume(s: &Session, body: &str) -> f64 {
+    s.model.state().body(body).map(|b| solvecraft_kernel::measure(&b.body).unwrap().volume).unwrap_or(0.0)
+}
+
+/// Slab less a 557.68 × 100 × 120 pocket and the loft below its floor (556.68 × 99 down 4 mm to
+/// 80 × 80; prismatoid: h/6 · (A_top + A_bottom + 4 A_mid)).
+fn slab_pocket_loft() -> (f64, f64) {
+    let slab = 900.0 * 480.0 * 160.0;
+    let loft = 4.0 / 6.0 * (556.68 * 99.0 + 80.0 * 80.0 + 4.0 * (556.68 + 80.0) / 2.0 * (99.0 + 80.0) / 2.0);
+    (slab - 557.68 * 100.0 * 120.0, loft)
+}
+
+#[test]
+fn loft_cut_beside_a_round_hole() {
+    let s = replay(include_str!("../../../examples/regressions/loft_cut_beside_round_hole.json"));
+    let (pocketed, loft) = slab_pocket_loft();
+    let hole = std::f64::consts::PI * 17.5 * 17.5 * 25.0;
+    let want = pocketed - loft - hole;
+    let got = volume(&s, "Body1");
+    assert!((got - want).abs() < 1e-6 * want, "{got} vs {want}");
+}
+
+#[test]
+fn shallow_loft_cut_from_the_top_face() {
+    let s = replay(include_str!("../../../examples/regressions/shallow_loft_cut_from_top_face.json"));
+    let (_, loft) = slab_pocket_loft();
+    let want = 900.0 * 480.0 * 160.0 - loft;
+    let got = volume(&s, "Body1");
+    assert!((got - want).abs() < 1e-9 * want, "{got} vs {want}");
+}
+
+#[test]
+fn oblique_cut_through_a_small_arc_matches_a_split() {
+    let scripts = [
+        include_str!("../../../examples/regressions/oblique_cut_of_cylinder.json"),
+        include_str!("../../../examples/regressions/oblique_cut_of_cylinder_hang.json"),
+    ];
+    // The same bar split by the prism's tilted top: the piece above it is the cut's result.
+    let mut split = Session::default();
+    let script: Value = serde_json::from_str(scripts[0]).unwrap();
+    let steps = script.get("commands").and_then(Value::as_array).unwrap();
+    split.run_script(&Value::Array(steps[..5].to_vec())).unwrap();
+    let whole = volume(&split, "Tool");
+    split.execute("solid.split_body", &json!({"body": "Tool", "plane": {"origin": [0, -472, 853.91], "normal": [0, 15.44, 40]}})).unwrap();
+    let above = volume(&split, "Tool");
+    assert!(above < whole - 10.0, "{above} of {whole}");
+    for script in scripts {
+        let s = replay(script);
+        let got = volume(&s, "Tool");
+        assert!((got - above).abs() < 1e-6 * above, "{got} vs {above}");
+    }
+}

crates/engine/src/cmd/browser.rs

@@ -9,14 +9,14 @@ use serde_json::{Value, json};
 use solvecraft_doc::FeatureKind;
 
 use super::CommandSpec;
-use crate::params::{bad, str_};
+use crate::params::{bad, bool_, str_};
 use crate::{Result, Session};
 
 pub static COMMANDS: &[CommandSpec] = &[
     CommandSpec::new("body.rename", "Rename Body", rename_body).params("body: its name, name: the new name (features that use the body follow)"),
     CommandSpec::new("sketch.redefine", "Redefine Sketch Plane", redefine_sketch)
         .icon("plane")
-        .params("sketch: id or name; plane: XY|XZ|YZ | construction plane name | {face: [x,y,z]} | {origin, normal} (the sketch keeps its geometry)"),
+        .params("sketch: id or name; plane: as sketch.create; author_path?: exact owner occurrence ids; explicitly rebinds or freezes the plane while preserving geometry and dimension names"),
     CommandSpec::new("browser.group", "New Group", group)
         .icon("folder")
         .params("folder: bodies|sketches|construction; component?: id (default 0); name?; items?: [keys] (they leave other groups)"),
@@ -34,6 +34,10 @@ pub static COMMANDS: &[CommandSpec] = &[
     CommandSpec::new("view.delete", "Delete Named View", view_delete).params("view: name"),
     CommandSpec::new("view.list", "List Named Views", view_list).noundo(),
     CommandSpec::new("browser.order", "Order Browser Items", order).params("folder, component?, order: [keys] (the folder's items in display order)"),
+    CommandSpec::new("browser.visibility", "Show/Hide", visibility).icon("eye").noundo().params(
+        "visible: bool; items?: [sketch id or name | body name | construction name | O|X|Y|Z|XY|XZ|YZ]; \
+         or folder?: bodies|sketches|construction|origin (all of it); or paths?: [[occurrence ids]] (exact placements and descendants), isolate?: bool (requires paths and visible:true). View state: not saved, not an undo step",
+    ),
 ];
 
 const FOLDERS: [&str; 3] = ["bodies", "sketches", "construction"];
@@ -155,6 +159,146 @@ fn order(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({}))
 }
 
+const ORIGIN: [&str; 7] = ["O", "X", "Y", "Z", "XY", "XZ", "YZ"];
+
+/// A browser item whose visibility can change.
+enum Shown {
+    Sketch(u64),
+    Body(String),
+    /// Origin items and construction geometry, by name.
+    Origin(String),
+}
+
+fn is_construction(k: &FeatureKind) -> bool {
+    matches!(k, FeatureKind::ConstructionPlane { .. } | FeatureKind::ConstructionAxis { .. } | FeatureKind::ConstructionPoint { .. })
+}
+
+fn shown_item(s: &Session, key: &str) -> Option<Shown> {
+    if let Some(f) = s.doc.find_feature(key) {
+        if matches!(f.kind, FeatureKind::Sketch { .. }) {
+            return Some(Shown::Sketch(f.id));
+        }
+        if is_construction(&f.kind) {
+            return Some(Shown::Origin(f.name.clone()));
+        }
+    }
+    if s.world_state().bodies.iter().any(|b| b.name == key) {
+        return Some(Shown::Body(key.to_string()));
+    }
+    ORIGIN.iter().find(|o| o.eq_ignore_ascii_case(key)).map(|o| Shown::Origin(o.to_string()))
+}
+
+fn visibility(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "browser.visibility";
+    let visible = bool_(p, "visible").ok_or_else(|| bad(cmd, "`visible` must be true or false"))?;
+    if let Some(value) = p.get("paths") {
+        if p.get("items").is_some() || p.get("folder").is_some() {
+            return Err(bad(cmd, "give paths, items or folder, not several"));
+        }
+        let paths =
+            value.as_array().filter(|a| !a.is_empty() && a.len() <= 10_000).ok_or_else(|| bad(cmd, "paths must list 1..10000 occurrence paths"))?;
+        let paths: Vec<Vec<u64>> = paths
+            .iter()
+            .map(|value| {
+                let path = value
+                    .as_array()
+                    .filter(|a| !a.is_empty() && a.len() <= 64)
+                    .and_then(|a| a.iter().map(Value::as_u64).collect::<Option<Vec<_>>>())
+                    .ok_or_else(|| bad(cmd, "each path must list 1..64 occurrence ids"))?;
+                s.occurrence_placement(&path).map_err(|e| bad(cmd, e.to_string()))?;
+                Ok(path)
+            })
+            .collect::<Result<_>>()?;
+        if bool_(p, "isolate").unwrap_or(false) {
+            if !visible {
+                return Err(bad(cmd, "isolate requires visible:true"));
+            }
+            let mut hidden = Vec::new();
+            let mut ancestor_bodies = Vec::new();
+            let mut stack = vec![Vec::<u64>::new()];
+            let mut count = 0;
+            while let Some(parent) = stack.pop() {
+                for child in s.occurrence_children(&parent)? {
+                    count += 1;
+                    if count > 100_000 {
+                        return Err(bad(cmd, "isolate exceeds 100000 placements"));
+                    }
+                    if paths.iter().any(|selected| child.path.starts_with(selected)) {
+                        continue;
+                    }
+                    if paths.iter().any(|selected| selected.starts_with(&child.path)) {
+                        ancestor_bodies.extend(child.bodies.into_iter().map(|b| b.world));
+                        stack.push(child.path);
+                    } else {
+                        hidden.push(child.path);
+                    }
+                }
+            }
+            let mut root_bodies: Vec<String> =
+                s.model.state().bodies.iter().filter(|b| s.doc.model_body_component(b) == 0).map(|b| b.name.clone()).collect();
+            root_bodies.extend(ancestor_bodies);
+            s.visibility.hidden_occurrences = hidden;
+            s.visibility.hidden_bodies = root_bodies;
+            s.revision += 1;
+            return Ok(json!({"visible":true,"isolated":paths,"visibility":s.visibility}));
+        }
+        for path in &paths {
+            s.visibility.hidden_occurrences.retain(|p| p != path);
+            if !visible {
+                s.visibility.hidden_occurrences.push(path.clone());
+            }
+        }
+        s.revision += 1;
+        return Ok(json!({"visible":visible,"changed":paths.len(),"visibility":s.visibility}));
+    }
+    let items: Vec<Shown> = match (str_(p, "folder"), p.get("items")) {
+        (Some(_), Some(_)) => return Err(bad(cmd, "give `items` or `folder`, not both")),
+        (Some("bodies"), None) => s.world_state().bodies.iter().map(|b| Shown::Body(b.name.clone())).collect(),
+        (Some("sketches"), None) => s.model.state().sketches.iter().map(|x| Shown::Sketch(x.feature)).collect(),
+        (Some("construction"), None) => s.doc.features.iter().filter(|f| is_construction(&f.kind)).map(|f| Shown::Origin(f.name.clone())).collect(),
+        (Some("origin"), None) => ORIGIN.iter().map(|o| Shown::Origin(o.to_string())).collect(),
+        (Some(f), None) => return Err(bad(cmd, format!("unknown folder `{f}` (bodies, sketches, construction, origin)"))),
+        (None, Some(_)) => {
+            let keys = keys(p, "items", cmd)?;
+            if keys.is_empty() {
+                return Err(bad(cmd, "`items` must list sketches, bodies or construction geometry"));
+            }
+            // Every item is found before anything changes.
+            keys.iter()
+                .map(|k| shown_item(s, k).ok_or_else(|| bad(cmd, format!("no sketch, body or construction item `{k}`"))))
+                .collect::<Result<_>>()?
+        }
+        (None, None) => return Err(bad(cmd, "`items` or `folder` is required")),
+    };
+    let v = &mut s.visibility;
+    if visible && str_(p, "folder") == Some("bodies") {
+        v.hidden_occurrences.clear();
+    }
+    for it in &items {
+        match it {
+            Shown::Sketch(id) => {
+                v.hidden_sketches.retain(|x| x != id);
+                v.shown_sketches.retain(|x| x != id);
+                if visible { v.shown_sketches.push(*id) } else { v.hidden_sketches.push(*id) }
+            }
+            Shown::Body(n) => {
+                v.hidden_bodies.retain(|x| x != n);
+                if !visible {
+                    v.hidden_bodies.push(n.clone());
+                }
+            }
+            Shown::Origin(n) => {
+                v.hidden_origin.retain(|x| x != n);
+                if !visible {
+                    v.hidden_origin.push(n.clone());
+                }
+            }
+        }
+    }
+    s.revision += 1;
+    Ok(json!({ "visible": visible, "changed": items.len(), "visibility": s.visibility }))
+}
+
 fn document_units(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "document.units";
     let u = str_(p, "units").ok_or_else(|| bad(cmd, "`units` is required"))?;
@@ -165,14 +309,18 @@ fn document_units(s: &mut Session, p: &Value) -> Result<Value> {
     if old == u {
         return Ok(json!({ "units": u, "kept": [] }));
     }
-    let (before, _) = s.doc.param_values();
+    // What the geometry reads: every feature's length inputs.
+    let matched_configuration = s.doc.configuration_matches().then(|| s.doc.configs.active.clone()).flatten();
+    let before = s.doc.length_inputs();
     s.doc_mut().units = u.to_string();
     // Unit-less user parameters holding a bare number read it in the design's units where they
-    // stand for lengths. If any value moved, those numbers keep the old unit, written out.
-    let (after, _) = s.doc.param_values();
-    let moved = before.iter().any(|(k, b)| after.get(k).is_none_or(|a| (a.v - b.v).abs() > 1e-9 * b.v.abs().max(1.0)));
+    // stand for lengths. If any input moved, those numbers keep the old unit, written out.
+    let same = |a: &[Option<f64>]| {
+        a.iter().zip(&before).filter(|(x, y)| matches!((x, y), (Some(x), Some(y)) if (x - y).abs() <= 1e-9 * y.abs().max(1.0))).count()
+    };
+    let after = s.doc.length_inputs();
     let mut kept = Vec::new();
-    if moved {
+    if same(&after) < before.len() {
         let bare: Vec<(String, String)> = s
             .doc
             .params
@@ -181,20 +329,23 @@ fn document_units(s: &mut Session, p: &Value) -> Result<Value> {
             .map(|p| (p.name.clone(), p.expr.trim().to_string()))
             .collect();
         for (name, e) in bare {
+            let now = same(&s.doc.length_inputs());
             let probe = {
                 let mut d = (*s.doc).clone();
-                let _ = d.change_param(&name, &format!("{e} {old}"), None, None);
-                d.param_values().0
+                let _ = d.change_param(&name, &format!("{e} {old}"), Some(&old), None);
+                same(&d.length_inputs())
             };
-            // Only when writing the old unit puts the values back where they were.
-            let fixes = before.iter().filter(|(k, b)| probe.get(*k).is_some_and(|a| (a.v - b.v).abs() <= 1e-9 * b.v.abs().max(1.0))).count()
-                > before.iter().filter(|(k, b)| after.get(*k).is_some_and(|a| (a.v - b.v).abs() <= 1e-9 * b.v.abs().max(1.0))).count();
-            if fixes {
-                s.doc_mut().change_param(&name, &format!("{e} {old}"), None, None)?;
+            // Only when writing the old unit puts more inputs back where they were.
+            if probe > now {
+                s.doc_mut().change_param(&name, &format!("{e} {old}"), Some(&old), None)?;
                 kept.push(name);
             }
         }
     }
+    s.doc_mut().preserve_configuration_units(&old, &kept);
+    if let Some(row) = matched_configuration {
+        s.doc_mut().apply_configuration(&row)?;
+    }
     Ok(json!({ "units": u, "kept": kept }))
 }
 
@@ -310,6 +461,19 @@ fn rename_body(s: &mut Session, p: &Value) -> Result<Value> {
     // Later features refer to bodies by name.
     let mut failed = None;
     for f in d.features.iter_mut().filter(|f| f.id != fid) {
+        if let FeatureKind::Sketch { plane, sketch } = &mut f.kind
+            && let Some(anchor) = super::sketch::face::anchor_mut(plane)
+            && anchor.target.body == old
+        {
+            let ids = std::collections::BTreeMap::from([(anchor.target.origin_feature, anchor.target.origin_feature)]);
+            let bodies = std::collections::BTreeMap::from([(old.clone(), name.to_string())]);
+            anchor.remap_target(&ids, &bodies)?;
+            for link in &mut sketch.links {
+                if link.auto_face && matches!(&link.source,solvecraft_sketch::LinkSource::Face {body,..} if *body==old) {
+                    link.face_name = Some(anchor.target.name.clone());
+                }
+            }
+        }
         let Ok(mut v) = serde_json::to_value(&f.kind) else { continue };
         if replace_str(&mut v, &old, name, 0) {
             match serde_json::from_value(v) {
@@ -330,10 +494,27 @@ fn rename_body(s: &mut Session, p: &Value) -> Result<Value> {
     for f in d.appearances.faces.iter_mut().filter(|f| f.body == old) {
         f.body = name.to_string();
     }
+    for column in &mut d.configs.columns {
+        match column {
+            solvecraft_doc::config::Column::Material(body) | solvecraft_doc::config::Column::Appearance(body) if *body == old => {
+                *body = name.to_string();
+            }
+            solvecraft_doc::config::Column::FaceAppearance(target) if target.body == old => {
+                target.body = name.to_string();
+            }
+            _ => {}
+        }
+    }
+    if let Some(o) = d.body_offsets.remove(&old) {
+        d.body_offsets.insert(name.to_string(), o);
+    }
     if let Some(c) = d.body_components.remove(&old) {
         d.body_components.insert(name.to_string(), c);
     }
     rename_key(d, "bodies", &old, name);
+    for b in s.visibility.hidden_bodies.iter_mut().filter(|b| **b == old) {
+        *b = name.to_string();
+    }
     Ok(json!({"body": old, "name": name}))
 }
 
@@ -351,13 +532,89 @@ fn redefine_sketch(s: &mut Session, p: &Value) -> Result<Value> {
     if p.get("plane").is_none() {
         return Err(bad(cmd, "`plane` is required"));
     }
-    let plane = super::sketch::plane_ref(s, p, cmd)?;
-    let (vals, _) = s.doc.param_values();
-    s.doc.resolve_plane(&vals, &plane, 0)?;
-    if let Some(FeatureKind::Sketch { plane: slot, .. }) = s.doc_mut().feature_mut(id).map(|f| &mut f.kind) {
+    let feature = s.doc.feature(id).ok_or_else(|| bad(cmd, "sketch disappeared"))?;
+    let component = feature.component;
+    let index = s.doc.feature_index(id).ok_or_else(|| bad(cmd, "sketch disappeared"))?;
+    let author_path = super::sketch::author_path_for_rebind(s, feature, p, cmd)?;
+    let marker = s.doc.marker;
+    let mut baseline = s.scratch();
+    baseline.doc_mut().marker = Some(index + 1);
+    baseline.refresh();
+    let visible_geometry = baseline.model.state().sketch(id).map(|resolved| resolved.sketch.clone());
+    let mut trial = s.scratch();
+    trial.active_component = component;
+    trial.active_occurrence_path = (!author_path.is_empty()).then_some(author_path);
+    // A new attachment may only depend on geometry preceding this sketch.
+    trial.doc_mut().marker = Some(index);
+    trial.refresh();
+    let old_anchor = trial
+        .doc
+        .feature(id)
+        .and_then(|feature| match &feature.kind {
+            FeatureKind::Sketch { plane, .. } => super::sketch::face::anchor(plane),
+            _ => None,
+        })
+        .cloned();
+    let plane = super::sketch::plane_ref(&trial, p, cmd)?;
+    if super::sketch::face::is_face(p) {
+        super::sketch::face::capture_positions(&mut trial, &plane)?;
+    }
+    if let Some(anchor) = old_anchor
+        && super::sketch::face::anchor(&plane)
+            .is_none_or(|next| next.target != anchor.target || next.component != anchor.component || next.path != anchor.path)
+    {
+        let sketch = trial.doc_mut().sketch_mut(id)?;
+        if let Some(mut visible) = visible_geometry {
+            let constraints: std::collections::BTreeMap<_, _> =
+                sketch.constraints.iter().map(|constraint| (constraint.id.clone(), constraint.clone())).collect();
+            for constraint in &mut visible.constraints {
+                if let Some(original) = constraints.get(&constraint.id) {
+                    if std::mem::discriminant(&constraint.kind) != std::mem::discriminant(&original.kind) {
+                        return Err(bad(cmd, "a dimension role changed during border refresh; repair it explicitly before rebinding"));
+                    }
+                    // Keep evaluated entity indices after linked topology rebuilds.
+                    constraint.param = original.param.clone();
+                    constraint.driven = original.driven;
+                    constraint.text = original.text;
+                    if let Some(value) = original.kind.value() {
+                        constraint.kind.set_value(value);
+                    }
+                }
+            }
+            *sketch = visible;
+        }
+        let affected: Vec<_> = sketch
+            .links
+            .iter()
+            .filter(|link| {
+                link.auto_face
+                    && link.face_name.as_ref() == Some(&anchor.target.name)
+                    && matches!(&link.source,solvecraft_sketch::LinkSource::Face {body,..} if *body==anchor.target.body)
+            })
+            .map(|link| link.id.clone())
+            .collect();
+        for link in affected {
+            sketch.break_link(&link)?;
+        }
+    }
+    if let Some(FeatureKind::Sketch { plane: slot, .. }) = trial.doc_mut().feature_mut(id).map(|feature| &mut feature.kind) {
         *slot = plane;
     }
-    Ok(json!({ "sketch": id }))
+    trial.doc_mut().marker = Some(index + 1);
+    trial.refresh();
+    if let Some(error) = trial.model.result(id).and_then(|result| result.error.as_ref()) {
+        return Err(bad(cmd, error.clone()));
+    }
+    trial.doc_mut().marker = marker;
+    trial.refresh();
+    s.doc = trial.doc;
+    s.pending_moves = trial.pending_moves;
+
+    let attachment = s.doc.feature(id).and_then(|feature| match &feature.kind {
+        FeatureKind::Sketch { plane, .. } => Some(if super::sketch::face::anchor(plane).is_some() { "exact_face" } else { "fixed" }),
+        _ => None,
+    });
+    Ok(json!({ "sketch": id,"attachment":attachment }))
 }
 
 #[cfg(test)]
@@ -380,10 +637,10 @@ mod tests {
     #[test]
     fn renamed_body_keeps_its_users() {
         let mut s = Session::default();
-        run(&mut s, "PrimitiveBox", json!({"length": 10, "width": 10, "height": 10}));
-        run(&mut s, "PrimitiveBox", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0]}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0]}));
         let [a, b] = [names(&s)[0].clone(), names(&s)[1].clone()];
-        run(&mut s, "FusionMoveCommand", json!({"bodies": [b.clone()], "translate": [0, 0, 5]}));
+        run(&mut s, "solid.move", json!({"bodies": [b.clone()], "translate": [0, 0, 5]}));
         run(&mut s, "body.rename", json!({"body": b, "name": "Lid"}));
         assert_eq!(names(&s), vec![a.clone(), "Lid".to_string()]);
         assert!(s.model.results.iter().all(|r| r.error.is_none()), "the move still finds its body");
@@ -391,22 +648,24 @@ mod tests {
         assert!(s.execute("body.rename", &json!({"body": "Lid", "name": a})).is_err());
         assert!(s.execute("body.rename", &json!({"body": "Nope", "name": "X"})).is_err());
         assert!(s.execute("body.rename", &json!({"body": "Lid", "name": " "})).is_err());
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!(names(&s)[1], b);
     }
 
     #[test]
     fn redefined_sketch_moves_its_extrude() {
         let mut s = Session::default();
-        let sk = run(&mut s, "SketchCreate", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
-        run(&mut s, "ShapeRectangleTwoPoint", json!({"p0": [0, 0], "p1": [10, 20]}));
-        run(&mut s, "SketchStop", json!({}));
-        run(&mut s, "Extrude", json!({"distance": 5}));
-        let zmax = |s: &mut Session| run(s, "MeasureCommand", json!({}))["bodies"][0]["bbox"]["max"][2].as_f64().unwrap();
+        let sk = run(&mut s, "sketch.create", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
+        run(&mut s, "sketch.rectangle.two_point", json!({"p0": [0, 0], "p1": [10, 20]}));
+        run(&mut s, "sketch.finish", json!({}));
+        run(&mut s, "solid.extrude", json!({"distance": 5}));
+        let zmax = |s: &mut Session| run(s, "inspect.measure", json!({}))["bodies"][0]["bbox"]["max"][2].as_f64().unwrap();
         assert!((zmax(&mut s) - 5.0).abs() < 1e-6);
         run(&mut s, "sketch.redefine", json!({"sketch": sk, "plane": "XZ"}));
         let z = zmax(&mut s);
-        assert!(z > 9.0, "the profile stands up on XZ: {z}");
+        assert!(z.abs() < 1e-6, "positive sketch Y on XZ extends toward -Z: {z}");
+        let ymin = run(&mut s, "inspect.measure", json!({}))["bodies"][0]["bbox"]["min"][2].as_f64().unwrap();
+        assert!((ymin + 20.0).abs() < 1e-6);
         assert!(s.execute("sketch.redefine", &json!({"sketch": sk, "plane": "nope"})).is_err());
         assert!(s.execute("sketch.redefine", &json!({"sketch": 999, "plane": "XY"})).is_err());
     }
@@ -414,8 +673,8 @@ mod tests {
     #[test]
     fn design_units_change_without_moving_geometry() {
         let mut s = Session::default();
-        run(&mut s, "PrimitiveBox", json!({"length": 20, "width": 10, "height": 5}));
-        let vol = |s: &mut Session| run(s, "MeasureCommand", json!({}))["total"]["volume_mm3"].as_f64().unwrap();
+        run(&mut s, "solid.box", json!({"length": 20, "width": 10, "height": 5}));
+        let vol = |s: &mut Session| run(s, "inspect.measure", json!({}))["total"]["volume_mm3"].as_f64().unwrap();
         let v0 = vol(&mut s);
         run(&mut s, "document.units", json!({"units": "in"}));
         assert_eq!(s.doc.units, "in");
@@ -425,17 +684,34 @@ mod tests {
         let mut s = Session::default();
         run(&mut s, "parameters.add", json!({"name": "w", "expression": "5", "unit": ""}));
         run(&mut s, "parameters.add", json!({"name": "n", "expression": "3", "unit": ""}));
-        run(&mut s, "PrimitiveBox", json!({"length": "w", "width": 10, "height": 5}));
+        run(&mut s, "solid.box", json!({"length": "w", "width": 10, "height": 5}));
         let b = s.model.state().bodies[0].name.clone();
-        run(&mut s, "PatternRectangular", json!({"bodies": [b], "dir1": [1, 0, 0], "count1": "n", "spacing1": 20}));
+        run(&mut s, "solid.pattern.rectangular", json!({"bodies": [b], "dir1": [1, 0, 0], "count1": "n", "spacing1": 20}));
         let v0 = vol(&mut s);
         let r = run(&mut s, "document.units", json!({"units": "cm"}));
         assert!((vol(&mut s) - v0).abs() < 1e-6, "{r}");
         assert!(s.doc.param("n").is_some_and(|p| p.expr == "3"), "the count stays bare");
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!(s.doc.units, "mm");
     }
 
+    #[test]
+    fn a_bare_width_keeps_its_inches_when_the_design_goes_metric() {
+        let mut s = Session::default();
+        run(&mut s, "document.units", json!({"units": "in"}));
+        run(&mut s, "parameters.add", json!({"name": "w", "expression": "2", "unit": ""}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": "w", "height": 5}));
+        let width = |s: &mut Session| {
+            let b = &run(s, "inspect.measure", json!({}))["bodies"][0]["bbox"];
+            b["max"][1].as_f64().unwrap() - b["min"][1].as_f64().unwrap()
+        };
+        assert!((width(&mut s) - 50.8).abs() < 1e-6, "2 in an inch design");
+        let r = run(&mut s, "document.units", json!({"units": "mm"}));
+        assert!((width(&mut s) - 50.8).abs() < 1e-6, "still 50.8 mm: {r}");
+        assert_eq!(r["kept"], json!(["w"]));
+        assert_eq!(s.doc.param("w").map(|p| p.expr.as_str()), Some("2 in"));
+    }
+
     #[test]
     fn named_views_are_saved_renamed_and_deleted() {
         let mut s = Session::default();
@@ -452,15 +728,69 @@ mod tests {
         for p in [json!({}), json!({"camera": {"target": [0, 0, 0], "yaw": 0, "pitch": 0, "distance": -1}}), json!({"camera": "x"})] {
             assert!(s.execute("view.save", &p).is_err(), "{p}");
         }
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!(s.doc.named_views.len(), 2);
     }
 
+    #[test]
+    fn helper_sketches_hide_and_show() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        let floor = run(&mut s, "sketch.create", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
+        run(&mut s, "sketch.line", json!({"points": [[0, 0], [50, 0]], "construction": true}));
+        run(&mut s, "sketch.finish", json!({}));
+        let drain = run(&mut s, "sketch.create", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
+        run(&mut s, "sketch.point", json!({"point": [25, 5]}));
+        run(&mut s, "sketch.finish", json!({}));
+        run(&mut s, "construct.plane.offset", json!({"base": "XY", "offset": 5, "name": "Floor"}));
+        let body = s.model.state().bodies[0].name.clone();
+        let drain_name = s.doc.feature(drain).unwrap().name.clone();
+        let cam = solvecraft_render::Camera::default();
+        let lines = |s: &Session| crate::view::scene(s, &cam).lines.len();
+        let shown = |s: &mut Session| {
+            let d = run(s, "document.inspect", json!({}));
+            d["sketches"].as_array().unwrap().iter().filter(|x| x["visible"] == true).count()
+        };
+        let (n0, undo0, doc0) = (lines(&s), s.undo.len(), s.doc.clone());
+        assert_eq!(shown(&mut s), 2);
+        // By id and by name; the view loses their lines, the design and its history don't change.
+        let r = run(&mut s, "browser.visibility", json!({"items": [floor, drain_name], "visible": false}));
+        assert_eq!(r["changed"], 2);
+        assert_eq!(shown(&mut s), 0);
+        assert!(lines(&s) < n0);
+        assert!(std::sync::Arc::ptr_eq(&s.doc, &doc0) && s.undo.len() == undo0, "view state, not a design change");
+        run(&mut s, "browser.visibility", json!({"folder": "sketches", "visible": true}));
+        assert_eq!(lines(&s), n0);
+        // Bodies (following a rename) and construction planes.
+        run(&mut s, "browser.visibility", json!({"items": [body.clone(), "Floor", "xy"], "visible": false}));
+        assert!(crate::view::scene(&s, &cam).meshes.is_empty());
+        assert_eq!(s.visibility.hidden_origin, vec!["Floor".to_string(), "XY".to_string()]);
+        run(&mut s, "body.rename", json!({"body": body, "name": "Tray"}));
+        assert_eq!(s.visibility.hidden_bodies, vec!["Tray".to_string()]);
+        let d = run(&mut s, "document.inspect", json!({}));
+        assert_eq!(d["bodies"][0]["visible"], false);
+        // Hostile input is refused and changes nothing.
+        let before = s.visibility.clone();
+        for p in [
+            json!({"items": [floor]}),
+            json!({"items": [floor], "visible": "no"}),
+            json!({"items": [floor, "Nope"], "visible": false}),
+            json!({"items": [], "visible": false}),
+            json!({"items": "Floor", "visible": false}),
+            json!({"folder": "sketches", "items": [floor], "visible": false}),
+            json!({"folder": "nope", "visible": false}),
+            json!({"visible": false}),
+        ] {
+            assert!(s.execute("browser.visibility", &p).is_err(), "{p}");
+        }
+        assert_eq!(s.visibility, before);
+    }
+
     #[test]
     fn groups_hold_items_and_follow_renames() {
         let mut s = Session::default();
-        run(&mut s, "PrimitiveBox", json!({"length": 10, "width": 10, "height": 10}));
-        run(&mut s, "PrimitiveBox", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0]}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0]}));
         let [a, b] = [names(&s)[0].clone(), names(&s)[1].clone()];
         let g = run(&mut s, "browser.group", json!({"folder": "bodies", "items": [a.clone()]}))["group"].as_u64().unwrap();
         assert_eq!(s.doc.browser_groups[0].name, "Group1");
@@ -490,7 +820,7 @@ mod tests {
         ] {
             assert!(s.execute(c, &p).is_err(), "{c} {p}");
         }
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!(s.doc.browser_groups.len(), 1, "ungroup undoes");
     }
 }

crates/engine/src/cmd/clipboard.rs

@@ -62,11 +62,68 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
     let feats = s.clipboard.clone();
     let comp = s.active_component;
     let mut sketches: BTreeMap<u64, u64> = BTreeMap::new();
+    let mut bodies: BTreeMap<String, String> = BTreeMap::new();
+    let mut used: std::collections::BTreeSet<String> = s.model.state().bodies.iter().map(|body| body.name.clone()).collect();
+    let mut notices = Vec::new();
+    let author_path = s.active_occurrence_path.clone().unwrap_or_else(|| s.doc.first_path(comp));
+    solvecraft_doc::EmbossFace::component_frame(&s.placed_document(), comp, &author_path)?;
     let mut names: BTreeMap<String, String> = BTreeMap::new();
     let mut made = Vec::new();
     for f in feats {
         let mut kind = f.kind.clone();
         kind.remap_refs(&sketches, &names);
+        if let FeatureKind::Sketch { plane, .. } = &mut kind
+            && let Some(anchor) = super::sketch::face::anchor_mut(plane)
+        {
+            let internal = bodies.contains_key(&anchor.target.body);
+            if !internal && translate.is_some_and(|translate| translate.len() > 1e-12) {
+                return Err(bad(cmd, "translated paste retains an external exact face attachment; explicitly convert it to a fixed plane first"));
+            }
+            if !internal {
+                notices.push(format!("pasted sketch retains external exact face attachment to {}", anchor.target.body));
+            }
+            anchor.remap_target(&sketches, &bodies)?;
+            if internal {
+                anchor.component = comp;
+                anchor.path = author_path.clone();
+            }
+            anchor.author_path = author_path.clone();
+            let target = anchor.target.clone();
+            if let FeatureKind::Sketch { sketch, .. } = &mut kind {
+                for link in &mut sketch.links {
+                    if link.auto_face {
+                        if let solvecraft_sketch::LinkSource::Face { body, .. } = &mut link.source
+                            && let Some(mapped) = bodies.get(body)
+                        {
+                            *body = mapped.clone();
+                        }
+                        link.face_name = Some(target.name.clone());
+                    }
+                }
+            }
+        }
+        let outputs = if f.body_names.is_empty() {
+            s.model
+                .result(f.id)
+                .map(|result| result.state.bodies.iter().filter(|body| body.feature == f.id).map(|body| body.name.clone()).collect::<Vec<_>>())
+                .unwrap_or_default()
+        } else {
+            f.body_names.clone()
+        };
+        let copied_names: Vec<_> = outputs
+            .iter()
+            .map(|original| {
+                let base = format!("{original} (copy)");
+                let mut name = base.clone();
+                let mut suffix = 2usize;
+                while !used.insert(name.clone()) {
+                    name = format!("{base} {suffix}");
+                    suffix += 1;
+                }
+                bodies.insert(original.clone(), name.clone());
+                name
+            })
+            .collect();
         let doc = s.doc_mut();
         if let FeatureKind::Sketch { sketch, .. } = &mut kind {
             // Each dimension of the copy gets its own parameter, with the same expression.
@@ -90,12 +147,10 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
         let id = doc.add_feature(kind, None)?;
         if let Some(nf) = doc.feature_mut(id) {
             nf.component = comp;
-            nf.body_names = f.body_names.iter().map(|b| format!("{b} (copy)")).collect();
+            nf.body_names = copied_names;
         }
         let new_name = doc.feature(id).map(|x| x.name.clone()).unwrap_or_default();
-        if matches!(f.kind, FeatureKind::Sketch { .. }) {
-            sketches.insert(f.id, id);
-        }
+        sketches.insert(f.id, id);
         names.insert(f.name.clone(), new_name.clone());
         made.push(json!({"id": id, "name": new_name, "from": f.name}));
     }
@@ -105,7 +160,7 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
         .filter_map(|m| m["id"].as_u64())
         .filter_map(|id| s.model.result(id).and_then(|r| r.error.clone()).map(|e| json!({"feature": id, "error": e})))
         .collect();
-    Ok(json!({"pasted": made, "errors": errors}))
+    Ok(json!({"pasted": made, "errors": errors, "notices":notices}))
 }
 
 #[cfg(test)]
@@ -122,32 +177,32 @@ mod tests {
     }
 
     fn volume(s: &mut Session) -> f64 {
-        run(s, "MeasureCommand", json!({}))["total"]["volume_mm3"].as_f64().unwrap_or(f64::NAN)
+        run(s, "inspect.measure", json!({}))["total"]["volume_mm3"].as_f64().unwrap_or(f64::NAN)
     }
 
     #[test]
     fn copy_paste_sketch_and_extrude() {
         let mut s = Session::default();
-        run(&mut s, "ChangeParameterCommand", json!({"name": "w", "expression": "10 mm"}));
-        run(&mut s, "SketchCreate", json!({"plane": "XY", "name": "S"}));
-        run(&mut s, "ShapeRectangleTwoPoint", json!({"p0": [0, 0], "p1": [10, 10]}));
-        run(&mut s, "ConstraintCoincident", json!({"a": "p1", "b": "origin"}));
-        run(&mut s, "SketchDimension", json!({"entities": ["l1"], "value": "w"}));
-        run(&mut s, "SketchDimension", json!({"entities": ["l2"], "value": 10}));
-        run(&mut s, "SketchStop", json!({}));
-        run(&mut s, "Extrude", json!({"sketch": "S", "distance": 5}));
+        run(&mut s, "parameters.change", json!({"name": "w", "expression": "10 mm"}));
+        run(&mut s, "sketch.create", json!({"plane": "XY", "name": "S"}));
+        run(&mut s, "sketch.rectangle.two_point", json!({"p0": [0, 0], "p1": [10, 10]}));
+        run(&mut s, "sketch.constraint.coincident", json!({"a": "p1", "b": "origin"}));
+        run(&mut s, "sketch.dimension", json!({"entities": ["l1"], "value": "w"}));
+        run(&mut s, "sketch.dimension", json!({"entities": ["l2"], "value": 10}));
+        run(&mut s, "sketch.finish", json!({}));
+        run(&mut s, "solid.extrude", json!({"sketch": "S", "distance": 5}));
         assert!((volume(&mut s) - 500.0).abs() < 1e-6);
         run(&mut s, "timeline.copy", json!({"features": ["S", "Extrude1"]}));
         let r = run(&mut s, "timeline.paste", json!({"translate": [30, 0, 0]}));
         assert_eq!(r["errors"].as_array().map(Vec::len), Some(0), "{r}");
-        assert_eq!(run(&mut s, "MeasureCommand", json!({}))["body_count"], 2);
+        assert_eq!(run(&mut s, "inspect.measure", json!({}))["body_count"], 2);
         assert!((volume(&mut s) - 1000.0).abs() < 1e-6);
         // The copy's dimensions are its own, still driven by the user parameter.
-        run(&mut s, "ChangeParameterCommand", json!({"name": "w", "expression": "20 mm"}));
+        run(&mut s, "parameters.change", json!({"name": "w", "expression": "20 mm"}));
         assert!((volume(&mut s) - 2000.0).abs() < 1e-6);
         let pasted_extrude = r["pasted"][1]["name"].as_str().unwrap_or_default().to_string();
         let d = s.doc.find_feature(&pasted_extrude).and_then(|f| f.param_names.first().cloned()).unwrap_or_default();
-        run(&mut s, "ChangeParameterCommand", json!({"name": d, "expression": "10"}));
+        run(&mut s, "parameters.change", json!({"name": d, "expression": "10"}));
         assert!((volume(&mut s) - 3000.0).abs() < 1e-6, "only the copy got thicker");
         assert!(s.execute("timeline.paste", &json!({"translate": "x"})).is_err());
         let mut t = Session::default();

crates/engine/src/cmd/component.rs

@@ -8,31 +8,47 @@ use solvecraft_doc::{FeatureKind, Mat, Occurrence};
 use solvecraft_geom::Vec3;
 
 use super::CommandSpec;
-use crate::params::{bad, bool_, num, str_, string_list, vec3};
+use crate::params::{bad, bool_, str_, string_list, vec3};
 use crate::{Result, Session};
 
+#[path = "component_properties.rs"]
+pub(super) mod properties;
+#[path = "component_transfer.rs"]
+mod transfer;
+
+#[cfg(test)]
+#[path = "occurrence_tests.rs"]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod occurrence_tests;
+
 pub static COMMANDS: &[CommandSpec] = &[
-    CommandSpec::new("FusionCreateNewComponentCommand", "New Component", new_component)
+    CommandSpec::new("component.create", "New Component", new_component)
         .at("SOLID", "ASSEMBLE")
         .icon("component")
-        .params("name?, parent?: component id or name (default: the active one); activate?: bool (default true)"),
-    CommandSpec::new("FusionCreateComponentsFromBodiesCommand", "Create Components from Bodies", from_bodies)
+        .params("name?, parent?: component id or name (default: the active one); parent_path?: exact parent placement; activate?: bool (default true)"),
+    CommandSpec::new("component.from_bodies", "Create Components from Bodies", from_bodies)
         .icon("component")
         .params("bodies: [names] → one new component per body, named after it"),
-    CommandSpec::new("component.activate", "Activate Component", activate).noundo().params("component: id or name (0 or \"root\" for the design)"),
+    CommandSpec::new("component.activate", "Activate Component", activate).noundo().params("component: id or name (0 or \"root\" for the design); occurrence?, path?: exact placement used to author shared geometry"),
     CommandSpec::new("component.list", "List Components", list).noundo(),
+    CommandSpec::new("component.properties", "Component Physical Properties", properties::component)
+        .icon("measure").noundo()
+        .params("component?: id or name (default active); descendants?: bool (default true). Measures the first placement, or all placements for root, including pending moves; material-aware mass and center of mass in world coordinates"),
+    CommandSpec::new("occurrence.properties", "Occurrence Physical Properties", properties::occurrence)
+        .icon("measure").noundo()
+        .params("occurrence: id or name; path?: [occurrence ids] (required if nested under multiple instances); descendants?: bool (default true). Physical properties of this placement in world coordinates, including pending moves"),
     CommandSpec::new("component.rename", "Rename Component", rename).params("component, name"),
     CommandSpec::new("component.delete", "Delete Component", delete).params("component: deletes it, its subcomponents, occurrences and features"),
     CommandSpec::new("component.move_bodies", "Move Bodies to Component", move_bodies).params("bodies: [names], component"),
     CommandSpec::new("component.move_sketches", "Move Sketches to Component", move_sketches).params("sketches: [ids or names], component"),
     CommandSpec::new("occurrence.copy", "Paste (Instance)", copy_occurrence)
-        .params("component (or occurrence): what to place again; parent?: component (default: the same parent); translate?: [x,y,z]"),
-    CommandSpec::new("component.paste_new", "Paste New", paste_new).params("component: copied with its features into a new, independent component; translate?: [x,y,z]"),
+        .params("component (or occurrence): what to place again; path?: validates selected occurrence; parent?: component (default: the same parent); translate?: [x,y,z]. Copies the selected effective transform, including pending moves"),
+    CommandSpec::new("component.paste_new", "Paste New", paste_new).params("component: independently copy its nested definition graph and history, materials and styles; occurrence?, path?: selected source placement; translate?: [x,y,z]. Reassigned external bodies become base geometry; retained external links and omitted boundary joints are reported"),
     CommandSpec::new("occurrence.move", "Move Occurrence", move_occurrence)
-        .params("occurrence; translate?: [x,y,z]; axis?: [x,y,z], angle?: radians or \"30 deg\", origin?: [x,y,z]; capture?: bool (default true; false keeps it pending until Capture Position)"),
+        .params("occurrence; path?: exact placement; space?: local|world (default local); translate?: [x,y,z]; axis?: [x,y,z], angle?: radians or \"30 deg\", origin?: [x,y,z]; capture?: bool (default true; false keeps it pending until Capture Position). Nested occurrence definitions remain shared"),
     CommandSpec::new("occurrence.ground", "Ground", ground).params("occurrence; grounded?: bool (default toggles)"),
-    CommandSpec::new("SnapshotCmd", "Capture Position", capture).at("SOLID", "POSITION").icon("capture").params("keeps pending occurrence moves"),
-    CommandSpec::new("AsBuiltPositionsCmd", "Revert Position", revert).at("SOLID", "POSITION").icon("revert").noundo().params("drops pending occurrence moves"),
+    CommandSpec::new("component.capture_position", "Capture Position", capture).at("SOLID", "POSITION").icon("capture").params("keeps pending occurrence moves"),
+    CommandSpec::new("component.revert_position", "Revert Position", revert).at("SOLID", "POSITION").icon("revert").noundo().params("occurrences?: [ids] (default all); drops selected pending occurrence moves"),
 ];
 
 fn key(v: Option<&Value>) -> Option<String> {
@@ -57,12 +73,61 @@ fn translation(t: Vec3) -> Mat {
     solvecraft_doc::rigid(t, Vec3::ZERO, Vec3::Z, 0.0)
 }
 
+fn move_vector(p: &Value, key: &str, default: Vec3, coordinate: bool, cmd: &str) -> Result<Vec3> {
+    let v = match p.get(key) {
+        None => default,
+        Some(value) => vec3(value).ok_or_else(|| bad(cmd, format!("{key} must contain three finite numbers")))?,
+    };
+    if !v.is_finite() || (coordinate && [v.x, v.y, v.z].iter().any(|x| x.abs() > 1e9)) {
+        return Err(bad(cmd, format!("{key} exceeds supported numeric range")));
+    }
+    Ok(v)
+}
+
+pub(super) fn valid_position(m: &Mat) -> bool {
+    let column = |i: usize| Vec3::new(m[i][0], m[i][1], m[i][2]);
+    let (x, y, z) = (column(0), column(1), column(2));
+    m.iter().flatten().all(|x| x.is_finite())
+        && m[3][..3].iter().all(|x| x.abs() <= 1e9)
+        && [x, y, z].iter().all(|axis| (axis.dot(*axis) - 1.0).abs() < 1e-6)
+        && x.dot(y).abs() < 1e-6
+        && x.dot(z).abs() < 1e-6
+        && y.dot(z).abs() < 1e-6
+        && x.cross(y).dot(z) > 0.0
+        && [m[0][3], m[1][3], m[2][3]].iter().all(|x| x.abs() < 1e-9)
+        && (m[3][3] - 1.0).abs() < 1e-9
+}
+
 fn new_component(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "FusionCreateNewComponentCommand";
+    let cmd = "component.create";
     let parent = if p.get("parent").is_some() { component(s, p, "parent", cmd)? } else { s.active_component };
+    let parent_path = if let Some(value) = p.get("parent_path") {
+        let path = value
+            .as_array()
+            .filter(|a| a.len() < 64)
+            .and_then(|a| a.iter().map(Value::as_u64).collect::<Option<Vec<_>>>())
+            .ok_or_else(|| bad(cmd, "parent_path must list up to 63 occurrence ids"))?;
+        let component = if path.is_empty() { 0 } else { s.occurrence_placement(&path).map_err(|e| bad(cmd, e.to_string()))?.component };
+        if component != parent {
+            return Err(bad(cmd, "parent_path belongs to another component"));
+        }
+        path
+    } else if parent == s.active_component {
+        s.active_occurrence_path.clone().unwrap_or_else(|| s.doc.first_path(parent))
+    } else {
+        s.doc.first_path(parent)
+    };
+    if parent_path.len() >= 64 {
+        return Err(bad(cmd, "new component exceeds occurrence depth limit"));
+    }
     let id = s.doc_mut().add_component(str_(p, "name"), parent)?;
     if p.get("activate").and_then(Value::as_bool).unwrap_or(true) {
+        let mut path = parent_path;
+        if let Some(o) = s.doc.occurrence_of(id) {
+            path.push(o.id);
+        }
         s.active_component = id;
+        s.active_occurrence_path = Some(path);
     }
     let name = s.doc.components.iter().find(|c| c.id == id).map(|c| c.name.clone()).unwrap_or_default();
     let occ = s.doc.occurrence_of(id).map(|o| o.id);
@@ -70,30 +135,23 @@ fn new_component(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn from_bodies(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "FusionCreateComponentsFromBodiesCommand";
-    let bodies = string_list(p, "bodies");
-    if bodies.is_empty() || bodies.len() > 1000 {
-        return Err(bad(cmd, "`bodies` must list 1…1000 body names"));
-    }
-    let st = s.model.state();
-    for b in &bodies {
-        if st.body(b).is_none() {
-            return Err(bad(cmd, format!("no body `{b}`")));
-        }
-    }
-    let parent = s.active_component;
-    let mut made = Vec::new();
-    for b in bodies {
-        let id = s.doc_mut().add_component(Some(&b), parent)?;
-        s.doc_mut().body_components.insert(b.clone(), id);
-        made.push(json!({"component": id, "body": b}));
-    }
-    Ok(json!({ "components": made }))
+    transfer::from_bodies(s, p)
 }
 
 fn activate(s: &mut Session, p: &Value) -> Result<Value> {
     let id = component(s, p, "component", "component.activate")?;
+    let path = if p.get("path").is_some() || p.get("occurrence").is_some() {
+        let occurrence = occurrence(s, p, "component.activate")?;
+        let path = occurrence_path(s, p, occurrence, "component.activate")?;
+        if s.occurrence_placement(&path)?.component != id {
+            return Err(bad("component.activate", "path belongs to another component"));
+        }
+        Some(path)
+    } else {
+        None
+    };
     s.active_component = id;
+    s.active_occurrence_path = path;
     s.revision += 1;
     Ok(json!({ "active": id }))
 }
@@ -102,7 +160,7 @@ fn list(s: &mut Session, _p: &Value) -> Result<Value> {
     let st = s.model.state();
     let doc = &s.doc;
     let node = |id: u64, name: &str, parent: Option<u64>| {
-        let bodies: Vec<&str> = st.bodies.iter().filter(|b| doc.body_component(&b.name, b.feature) == id).map(|b| b.name.as_str()).collect();
+        let bodies: Vec<&str> = st.bodies.iter().filter(|b| doc.model_body_component(b) == id).map(|b| b.name.as_str()).collect();
         let features: Vec<&str> = doc
             .features
             .iter()
@@ -149,14 +207,26 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(cmd, "the design itself can't be deleted"));
     }
     let gone: Vec<u64> = s.doc.components.iter().filter(|c| s.doc.component_within(c.id, id)).map(|c| c.id).collect();
+    if s.doc.features.iter().any(|feature| {
+        !gone.contains(&feature.component)
+            && matches!(&feature.kind, FeatureKind::BodyTransfer { from, to, .. } if gone.contains(from) || gone.contains(to))
+    }) {
+        return Err(bad(
+            cmd,
+            "component supplies a recorded body transfer outside this subtree; remove that transfer history before deleting its source",
+        ));
+    }
     let feats: Vec<u64> = s.doc.features.iter().filter(|f| gone.contains(&f.component)).map(|f| f.id).collect();
     let d = s.doc_mut();
     for f in &feats {
         let _ = d.delete_feature(*f);
     }
     d.components.retain(|c| !gone.contains(&c.id));
+    d.remove_configuration_components(&gone);
     d.occurrences.retain(|o| !gone.contains(&o.component) && !gone.contains(&o.parent));
+    let moved_out: Vec<String> = d.body_components.iter().filter(|(_, c)| gone.contains(c)).map(|(b, _)| b.clone()).collect();
     d.body_components.retain(|_, c| !gone.contains(c));
+    d.body_offsets.retain(|b, _| !moved_out.contains(b));
     if gone.contains(&s.active_component) {
         s.active_component = 0;
     }
@@ -164,23 +234,11 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn move_bodies(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "component.move_bodies";
-    let to = component(s, p, "component", cmd)?;
-    let bodies = string_list(p, "bodies");
-    let st = s.model.state();
-    if bodies.is_empty() || bodies.iter().any(|b| st.body(b).is_none()) {
-        return Err(bad(cmd, "`bodies` must list existing bodies"));
-    }
-    for b in &bodies {
-        let feature = st.body(b).map(|x| x.feature).unwrap_or(0);
-        let own = s.doc.feature(feature).map(|f| f.component).unwrap_or(0);
-        if own == to {
-            s.doc_mut().body_components.remove(b);
-        } else {
-            s.doc_mut().body_components.insert(b.clone(), to);
-        }
-    }
-    Ok(json!({"bodies": bodies, "component": to}))
+    transfer::move_bodies(s, p)
+}
+
+pub(crate) fn transfer_constructor_result(s: &mut Session, p: &Value) -> Result<Value> {
+    transfer::move_result(s, p)
 }
 
 fn move_sketches(s: &mut Session, p: &Value) -> Result<Value> {
@@ -207,16 +265,30 @@ fn move_sketches(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn copy_occurrence(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "occurrence.copy";
-    let comp = if p.get("occurrence").is_some() {
+    let selected = if p.get("occurrence").is_some() {
         let o = occurrence(s, p, cmd)?;
-        s.doc.occurrences.iter().find(|x| x.id == o).map(|x| x.component).unwrap_or(0)
+        Some(o)
+    } else {
+        None
+    };
+    let comp = if let Some(id) = selected {
+        s.doc.occurrences.iter().find(|o| o.id == id).map(|o| o.component).unwrap_or(0)
     } else {
         component(s, p, "component", cmd)?
     };
-    let src = s.doc.occurrence_of(comp).cloned().ok_or_else(|| bad(cmd, "that component has no occurrence"))?;
+    let src = if let Some(id) = selected { s.doc.occurrences.iter().find(|o| o.id == id) } else { s.doc.occurrence_of(comp) }
+        .cloned()
+        .ok_or_else(|| bad(cmd, "that component has no occurrence"))?;
+    if p.get("path").is_some() {
+        occurrence_path(s, p, src.id, cmd)?;
+    }
     let parent = if p.get("parent").is_some() { component(s, p, "parent", cmd)? } else { src.parent };
-    let t = p.get("translate").and_then(vec3).unwrap_or(Vec3::ZERO);
-    let m = solvecraft_doc::mat_mul(&translation(t), &src.transform);
+    let t = move_vector(p, "translate", Vec3::ZERO, true, cmd)?;
+    let base = s.pending_moves.get(&src.id).unwrap_or(&src.transform);
+    let m = solvecraft_doc::mat_mul(&translation(t), base);
+    if !valid_position(&m) {
+        return Err(bad(cmd, "copy transform exceeds supported numeric range"));
+    }
     let id = s.doc_mut().add_occurrence(comp, parent, m)?;
     Ok(json!({"occurrence": id, "component": comp}))
 }
@@ -228,68 +300,55 @@ fn paste_new(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(cmd, "pick a component, not the design"));
     }
     let src = s.doc.components.iter().find(|c| c.id == comp).cloned().ok_or_else(|| bad(cmd, "component"))?;
-    let occ = s.doc.occurrence_of(comp).cloned();
-    let new_id = s.doc_mut().add_component(Some(&format!("{} (copy)", src.name)), src.parent)?;
-    // Copy the component's features with fresh ids and names; references between them follow.
-    let feats: Vec<solvecraft_doc::Feature> = s.doc.features.iter().filter(|f| f.component == comp).cloned().collect();
-    let mut idmap: std::collections::HashMap<u64, u64> = Default::default();
-    let mut namemap: std::collections::HashMap<String, String> = Default::default();
-    let mut new_ids = Vec::new();
-    for f in &feats {
-        let nid = s.doc_mut().add_feature(f.kind.clone(), Some(&format!("{} (copy)", f.name)))?;
-        idmap.insert(f.id, nid);
-        let nname = s.doc.feature(nid).map(|x| x.name.clone()).unwrap_or_default();
-        namemap.insert(f.name.clone(), nname);
-        new_ids.push(nid);
-    }
-    for nid in &new_ids {
-        let Some(f) = s.doc.feature(*nid).cloned() else { continue };
-        let mut v = serde_json::to_value(&f.kind).map_err(|e| bad(cmd, e.to_string()))?;
-        remap(&mut v, &idmap, &namemap, 0);
-        let kind: FeatureKind = serde_json::from_value(v).map_err(|e| bad(cmd, e.to_string()))?;
-        if let Some(slot) = s.doc_mut().feature_mut(*nid) {
-            slot.kind = kind;
-            slot.component = new_id;
+    let occ = if p.get("occurrence").is_some() {
+        let id = occurrence(s, p, cmd)?;
+        if p.get("path").is_some() {
+            occurrence_path(s, p, id, cmd)?;
         }
+        let occurrence = s.doc.occurrences.iter().find(|o| o.id == id).cloned().ok_or_else(|| bad(cmd, "no occurrence"))?;
+        if occurrence.component != comp {
+            return Err(bad(cmd, "occurrence belongs to another component"));
+        }
+        Some(occurrence)
+    } else {
+        s.doc.occurrence_of(comp).cloned()
+    };
+    let t = move_vector(p, "translate", Vec3::ZERO, true, cmd)?;
+    let base = occ.as_ref().map(|o| s.pending_moves.get(&o.id).copied().unwrap_or(o.transform)).unwrap_or(solvecraft_doc::IDENTITY);
+    let transform = solvecraft_doc::mat_mul(&translation(t), &base);
+    if !valid_position(&transform) {
+        return Err(bad(cmd, "copy transform exceeds supported numeric range"));
     }
-    let t = p.get("translate").and_then(vec3).unwrap_or(Vec3::ZERO);
-    let base = occ.map(|o| o.transform).unwrap_or(solvecraft_doc::IDENTITY);
-    if let Some(o) = s.doc_mut().occurrences.iter_mut().find(|o| o.component == new_id) {
-        o.transform = solvecraft_doc::mat_mul(&translation(t), &base);
-    }
-    Ok(json!({"component": new_id, "features": new_ids}))
+    let parent = occ.as_ref().map(|o| o.parent).unwrap_or(src.parent);
+    super::component_clone::paste(s, comp, occ, transform, parent, p)
 }
 
-/// Point copied features at their copied sketches and features.
-fn remap(v: &mut Value, ids: &std::collections::HashMap<u64, u64>, names: &std::collections::HashMap<String, String>, depth: usize) {
-    if depth > 32 {
-        return;
-    }
-    match v {
-        Value::Object(o) => {
-            for (k, x) in o.iter_mut() {
-                match (k.as_str(), &*x) {
-                    ("sketch" | "path_sketch", Value::Number(n)) => {
-                        if let Some(m) = n.as_u64().and_then(|i| ids.get(&i)) {
-                            *x = json!(m);
-                        }
-                    }
-                    ("features", Value::Array(_)) => {
-                        if let Value::Array(a) = x {
-                            for e in a.iter_mut() {
-                                if let Some(m) = e.as_str().and_then(|n| names.get(n)) {
-                                    *e = json!(m);
-                                }
-                            }
-                        }
-                    }
-                    _ => remap(x, ids, names, depth + 1),
-                }
+pub(super) fn occurrence_path(s: &Session, p: &Value, id: u64, cmd: &str) -> Result<Vec<u64>> {
+    let path = if let Some(value) = p.get("path") {
+        value
+            .as_array()
+            .filter(|a| !a.is_empty() && a.len() <= 64)
+            .and_then(|a| a.iter().map(Value::as_u64).collect::<Option<Vec<_>>>())
+            .ok_or_else(|| bad(cmd, "`path` must list 1..64 occurrence ids"))?
+    } else {
+        let o = s.doc.occurrences.iter().find(|o| o.id == id).ok_or_else(|| bad(cmd, "no occurrence"))?;
+        let mut path = s.doc.first_path(o.parent);
+        // A world frame requires an explicit containing placement when any ancestor is instanced.
+        for ancestor in &path {
+            if let Some(a) = s.doc.occurrences.iter().find(|a| a.id == *ancestor)
+                && s.doc.occurrences.iter().filter(|x| x.component == a.component).count() > 1
+            {
+                return Err(bad(cmd, "occurrence has multiple placements; supply its `path`"));
             }
         }
-        Value::Array(a) => a.iter_mut().for_each(|x| remap(x, ids, names, depth + 1)),
-        _ => {}
+        path.push(id);
+        path
+    };
+    if path.last() != Some(&id) {
+        return Err(bad(cmd, "path and occurrence disagree"));
     }
+    s.occurrence_placement(&path).map_err(|e| bad(cmd, e.to_string()))?;
+    Ok(path)
 }
 
 fn move_occurrence(s: &mut Session, p: &Value) -> Result<Value> {
@@ -299,19 +358,56 @@ fn move_occurrence(s: &mut Session, p: &Value) -> Result<Value> {
     if o.grounded {
         return Err(bad(cmd, format!("{} is grounded", o.name)));
     }
-    let t = p.get("translate").and_then(vec3).unwrap_or(Vec3::ZERO);
-    let axis = p.get("axis").and_then(vec3).unwrap_or(Vec3::Z);
+    let t = move_vector(p, "translate", Vec3::ZERO, true, cmd)?;
+    let axis = move_vector(p, "axis", Vec3::Z, false, cmd)?;
     let angle = match p.get("angle") {
         Some(Value::String(e)) => s.doc.eval(e, solvecraft_doc::expr::Kind::Angle).map_err(|e| bad(cmd, e.to_string()))?,
-        _ => num(p, "angle").unwrap_or(0.0),
+        None => 0.0,
+        Some(value) => value.as_f64().ok_or_else(|| bad(cmd, "angle must be a number or angle expression"))?,
     };
-    if !(t.is_finite() && angle.is_finite()) {
+    if !(t.is_finite() && axis.is_finite() && angle.is_finite()) {
         return Err(bad(cmd, "non-finite move"));
     }
-    let origin = p.get("origin").and_then(vec3).unwrap_or(Vec3::ZERO);
+    if angle != 0.0 && axis.normalized().is_none() {
+        return Err(bad(cmd, "rotation axis must have a finite nonzero length"));
+    }
+    let origin = move_vector(p, "origin", Vec3::ZERO, true, cmd)?;
     let delta = solvecraft_doc::rigid(t, origin, axis, angle);
-    let cur = s.pending_moves.get(&id).copied().unwrap_or(o.transform);
+    let space = match p.get("space") {
+        None => "local",
+        Some(Value::String(space)) => space.as_str(),
+        _ => return Err(bad(cmd, "space must be local or world")),
+    };
+    if !matches!(space, "local" | "world") {
+        return Err(bad(cmd, "space must be local or world"));
+    }
+    let path = if p.get("path").is_some() || space == "world" { Some(occurrence_path(s, p, id, cmd)?) } else { None };
+    let delta = if space == "world" {
+        let placement = s.occurrence_placement(path.as_deref().unwrap_or(&[]))?;
+        let inverse = solvecraft_doc::mat_inverse(&placement.parent_world).ok_or_else(|| bad(cmd, "parent frame is singular"))?;
+        solvecraft_doc::mat_mul(&solvecraft_doc::mat_mul(&inverse, &delta), &placement.parent_world)
+    } else {
+        delta
+    };
+    let cur = if let Some(value) = p.get("base_transform") {
+        let base: Mat = serde_json::from_value(value.clone()).map_err(|_| bad(cmd, "base_transform must be a 4x4 affine matrix"))?;
+        if !valid_position(&base)
+            || base[0][3].abs() > 1e-12
+            || base[1][3].abs() > 1e-12
+            || base[2][3].abs() > 1e-12
+            || (base[3][3] - 1.0).abs() > 1e-12
+            || solvecraft_doc::mat_inverse(&base).is_none()
+        {
+            return Err(bad(cmd, "base_transform must be finite, affine and invertible"));
+        }
+        base
+    } else {
+        s.pending_moves.get(&id).copied().unwrap_or(o.transform)
+    };
     let next = solvecraft_doc::mat_mul(&delta, &cur);
+    if !valid_position(&next) {
+        return Err(bad(cmd, "move transform exceeds supported numeric range"));
+    }
     if bool_(p, "capture").unwrap_or(true) {
         s.pending_moves.remove(&id);
         if let Some(x) = s.doc_mut().occurrences.iter_mut().find(|x| x.id == id) {
@@ -327,6 +423,9 @@ fn move_occurrence(s: &mut Session, p: &Value) -> Result<Value> {
 fn ground(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "occurrence.ground";
     let id = occurrence(s, p, cmd)?;
+    if p.get("path").is_some() {
+        occurrence_path(s, p, id, cmd)?;
+    }
     let want = bool_(p, "grounded");
     let o = s.doc_mut().occurrences.iter_mut().find(|o| o.id == id).ok_or_else(|| bad(cmd, "occurrence"))?;
     o.grounded = want.unwrap_or(!o.grounded);
@@ -346,19 +445,35 @@ fn capture(s: &mut Session, _p: &Value) -> Result<Value> {
     Ok(json!({ "captured": n }))
 }
 
-fn revert(s: &mut Session, _p: &Value) -> Result<Value> {
-    let n = s.pending_moves.len();
-    s.pending_moves.clear();
+fn revert(s: &mut Session, p: &Value) -> Result<Value> {
+    let before = s.pending_moves.len();
+    if let Some(value) = p.get("occurrences") {
+        let ids = value
+            .as_array()
+            .filter(|a| !a.is_empty() && a.len() <= 10_000)
+            .and_then(|a| a.iter().map(Value::as_u64).collect::<Option<Vec<_>>>())
+            .ok_or_else(|| bad("component.revert_position", "occurrences must list 1..10000 ids"))?;
+        if ids.iter().any(|id| !s.doc.occurrences.iter().any(|o| o.id == *id)) {
+            return Err(bad("component.revert_position", "no occurrence"));
+        }
+        for id in ids {
+            s.pending_moves.remove(&id);
+        }
+    } else {
+        s.pending_moves.clear();
+    }
+    let n = before - s.pending_moves.len();
     s.revision += 1;
     Ok(json!({ "reverted": n }))
 }
 
 /// The active component's frame from world coordinates (for new features' geometry).
 pub fn to_active_frame(s: &Session, kind: &mut FeatureKind) {
-    if s.active_component == 0 {
+    // Commands whose picks `frames` maps are already in their frames.
+    if s.active_component == 0 || crate::frames::mapped() {
         return;
     }
-    let m = s.doc.component_transform(s.active_component);
+    let m = s.active_component_frame();
     if solvecraft_doc::is_identity(&m) {
         return;
     }

crates/engine/src/cmd/component_clone.rs

@@ -0,0 +1,694 @@
+//! Independent copies of a component definition graph, assembled and evaluated atomically.
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::params::bad;
+use crate::{Result, Sel, Session};
+use serde_json::{Value, json};
+use solvecraft_doc::{Document, Feature, FeatureKind, Mat, Occurrence};
+
+const CMD: &str = "component.paste_new";
+const MAX_WORK: usize = 10_000;
+
+fn mesh_distance(mesh: &solvecraft_geom::Mesh, point: solvecraft_geom::Vec3) -> f64 {
+    mesh.triangles
+        .iter()
+        .filter_map(|triangle| mesh.tri(triangle))
+        .map(|[a, b, c]| {
+            let normal = (b - a).cross(c - a);
+            let squared = normal.dot(normal);
+            let projected = if squared > 0. { point - normal * ((point - a).dot(normal) / squared) } else { point };
+            if squared > 0. && [(a, b), (b, c), (c, a)].iter().all(|(start, end)| (*end - *start).cross(projected - *start).dot(normal) >= 0.) {
+                return point.dist(projected);
+            }
+            [(a, b), (b, c), (c, a)]
+                .iter()
+                .map(|(start, end)| {
+                    let edge = *end - *start;
+                    let t = if edge.dot(edge) > 0. { ((point - *start).dot(edge) / edge.dot(edge)).clamp(0., 1.) } else { 0. };
+                    point.dist(*start + edge * t)
+                })
+                .fold(f64::INFINITY, f64::min)
+        })
+        .fold(f64::INFINITY, f64::min)
+}
+
+fn material_probe_matches(a: &solvecraft_geom::Mesh, b: &solvecraft_geom::Mesh, point: solvecraft_geom::Vec3, tol_a: f64, tol_b: f64) -> bool {
+    if !point.is_finite() || !tol_a.is_finite() || !tol_b.is_finite() || tol_a <= 0. || tol_b <= 0. {
+        return false;
+    }
+    if a.contains(point) == b.contains(point) {
+        return true;
+    }
+    // A chord approximation does not define material ON a boundary. Certify
+    // nearby stock and void instead, outside both meshes' approximation strips.
+    if mesh_distance(a, point) > tol_a || mesh_distance(b, point) > tol_b {
+        return false;
+    }
+    let offset = 4. * tol_a.max(tol_b);
+    let mut material = false;
+    let mut void = false;
+    for axis in [solvecraft_geom::Vec3::X, solvecraft_geom::Vec3::Y, solvecraft_geom::Vec3::Z] {
+        for sign in [-1., 1.] {
+            let q = point + axis * (sign * offset);
+            if !q.is_finite() {
+                return false;
+            }
+            if mesh_distance(a, q) <= tol_a || mesh_distance(b, q) <= tol_b {
+                continue;
+            }
+            let inside = a.contains(q);
+            if inside != b.contains(q) {
+                return false;
+            }
+            material |= inside;
+            void |= !inside;
+        }
+    }
+    material && void
+}
+
+fn cloned_path(source: &Document, path: &[u64], root: u64, destination: &[u64], occurrences: &BTreeMap<u64, u64>) -> Result<Vec<u64>> {
+    let start = path
+        .iter()
+        .position(|id| source.occurrences.iter().any(|o| o.id == *id && o.component == root))
+        .ok_or_else(|| bad(CMD, "copied Emboss placement is outside the copied component tree"))?;
+    let mut mapped = destination.to_vec();
+    for id in path.iter().skip(start + 1) {
+        mapped.push(*occurrences.get(id).ok_or_else(|| bad(CMD, "copied Emboss path has an external descendant"))?);
+    }
+    if mapped.len() > 64 {
+        return Err(bad(CMD, "copied Emboss path exceeds placement depth limit"));
+    }
+    Ok(mapped)
+}
+
+fn unique(base: &str, used: &mut BTreeSet<String>) -> String {
+    let stem = format!("{base} (copy)");
+    let mut name = stem.clone();
+    let mut n = 2;
+    while used.contains(&name) {
+        name = format!("{stem} {n}");
+        n += 1;
+    }
+    used.insert(name.clone());
+    name
+}
+
+fn graph(doc: &Document, root: u64) -> Result<Vec<u64>> {
+    let definitions: BTreeSet<_> = doc.components.iter().map(|c| c.id).collect();
+    let mut children: BTreeMap<u64, Vec<u64>> = BTreeMap::new();
+    for occurrence in &doc.occurrences {
+        children.entry(occurrence.parent).or_default().push(occurrence.component);
+    }
+    let mut output = Vec::new();
+    let mut seen = BTreeSet::new();
+    let mut stack = vec![(root, Vec::<u64>::new())];
+    let mut work = 0;
+    while let Some((id, mut ancestors)) = stack.pop() {
+        work += 1;
+        if work > MAX_WORK || ancestors.len() >= 64 {
+            return Err(bad(CMD, "component graph exceeds copy work limit"));
+        }
+        if ancestors.contains(&id) {
+            return Err(bad(CMD, "component graph contains a cycle"));
+        }
+        if !definitions.contains(&id) {
+            return Err(bad(CMD, "component graph has a missing definition"));
+        }
+        if !seen.insert(id) {
+            continue;
+        }
+        output.push(id);
+        ancestors.push(id);
+        if let Some(children) = children.get(&id) {
+            if work.saturating_add(stack.len()).saturating_add(children.len()) > MAX_WORK {
+                return Err(bad(CMD, "component graph exceeds copy work limit"));
+            }
+            for child in children.iter().rev() {
+                stack.push((*child, ancestors.clone()));
+            }
+        }
+    }
+    // A shared node may be reached by a longer path after its first DFS visit. Check the
+    // longest path over the complete DAG, rather than trusting the first placement depth.
+    let mut indegree: BTreeMap<u64, usize> = output.iter().map(|id| (*id, 0)).collect();
+    for parent in &output {
+        if let Some(edges) = children.get(parent) {
+            for child in edges {
+                if let Some(degree) = indegree.get_mut(child) {
+                    *degree += 1;
+                }
+            }
+        }
+    }
+    let mut ready = std::collections::VecDeque::from([root]);
+    let mut depth = BTreeMap::from([(root, 1usize)]);
+    let mut sorted = Vec::new();
+    while let Some(parent) = ready.pop_front() {
+        sorted.push(parent);
+        let parent_depth = *depth.get(&parent).unwrap_or(&1);
+        if let Some(edges) = children.get(&parent) {
+            for child in edges {
+                let next = parent_depth + 1;
+                if next > 64 {
+                    return Err(bad(CMD, "component graph exceeds copy depth limit"));
+                }
+                depth.entry(*child).and_modify(|d| *d = (*d).max(next)).or_insert(next);
+                if let Some(degree) = indegree.get_mut(child) {
+                    *degree = degree.saturating_sub(1);
+                    if *degree == 0 {
+                        ready.push_back(*child);
+                    }
+                }
+            }
+        }
+    }
+    if sorted.len() != output.len() {
+        return Err(bad(CMD, "component graph contains a cycle"));
+    }
+    Ok(sorted)
+}
+
+pub(super) fn paste(
+    s: &mut Session,
+    component: u64,
+    source_occurrence: Option<Occurrence>,
+    transform: Mat,
+    parent: u64,
+    params: &Value,
+) -> Result<Value> {
+    let source = s.doc.clone();
+    let source_parameters: BTreeMap<_, _> = source.params.iter().map(|p| (p.name.as_str(), p)).collect();
+    let generated_parameters: BTreeSet<_> = source
+        .params
+        .iter()
+        .filter(|p| p.model)
+        .map(|p| p.name.as_str())
+        .chain(source.features.iter().flat_map(|f| f.param_names.iter().map(String::as_str)))
+        .collect();
+    let definitions = graph(&source, component)?;
+    let definition_records: BTreeMap<_, _> = source.components.iter().map(|c| (c.id, c)).collect();
+    let selected: BTreeSet<_> = definitions.iter().copied().collect();
+    if source.marker.is_some_and(|m| m < source.features.len()) {
+        return Err(bad(CMD, "move the timeline marker to the end before Paste New"));
+    }
+    let feats: Vec<Feature> = source.features.iter().filter(|f| selected.contains(&f.component)).cloned().collect();
+    if feats.len() + source.features.len() > MAX_WORK {
+        return Err(bad(CMD, "too many features to copy"));
+    }
+    for f in &feats {
+        if s.model.result(f.id).is_some_and(|r| r.error.is_some()) {
+            return Err(bad(CMD, format!("source feature {} has an evaluation error", f.name)));
+        }
+    }
+    let state = s.model.state();
+    if state.bodies.len() > MAX_WORK {
+        return Err(bad(CMD, "body set exceeds copy work limit"));
+    }
+    if source.next_id.checked_add(100_000).is_none() {
+        return Err(bad(CMD, "copy id allocation exceeds supported range"));
+    }
+    let mut scratch = s.scratch();
+    let mut components = BTreeMap::new();
+    let mut occurrences = BTreeMap::new();
+    let mut features = BTreeMap::new();
+    let mut names = BTreeMap::new();
+    let mut bodies = BTreeMap::new();
+    let mut parameters = BTreeMap::new();
+    let mut used: BTreeSet<String> = source
+        .features
+        .iter()
+        .map(|f| f.name.clone())
+        .chain(source.components.iter().map(|c| c.name.clone()))
+        .chain(state.bodies.iter().map(|b| b.name.clone()))
+        .collect();
+    let mut new_ids = Vec::new();
+    let mut frozen = Vec::new();
+    // Allocate definitions, discarding their automatic placeholder occurrence except root.
+    for old in &definitions {
+        let c = definition_records.get(old).ok_or_else(|| bad(CMD, "missing definition"))?;
+        let mapped_parent = if *old == component {
+            parent
+        } else {
+            components.get(&c.parent).copied().unwrap_or(*components.get(&component).ok_or_else(|| bad(CMD, "missing clone root"))?)
+        };
+        let name = unique(&c.name, &mut used);
+        let new = scratch.doc_mut().add_component(Some(&name), mapped_parent)?;
+        components.insert(*old, new);
+        if *old != component {
+            scratch.doc_mut().occurrences.retain(|o| o.component != new);
+        }
+    }
+    let root = *components.get(&component).ok_or_else(|| bad(CMD, "missing clone root"))?;
+    let root_occurrence = scratch.doc.occurrence_of(root).map(|o| o.id).ok_or_else(|| bad(CMD, "missing cloned placement"))?;
+    let mut clone_path = if let Some(o) = &source_occurrence {
+        let mut path = super::component::occurrence_path(s, params, o.id, CMD)?;
+        path.pop();
+        path
+    } else {
+        source.first_path(parent)
+    };
+    clone_path.push(root_occurrence);
+    if let Some(o) = scratch.doc_mut().occurrences.iter_mut().find(|o| o.id == root_occurrence) {
+        o.transform = transform;
+        o.grounded = source_occurrence.as_ref().is_some_and(|o| o.grounded);
+    }
+    if let Some(o) = &source_occurrence {
+        occurrences.insert(o.id, root_occurrence);
+    }
+    for old in source.occurrences.iter().filter(|o| selected.contains(&o.parent)) {
+        let child = *components.get(&old.component).ok_or_else(|| bad(CMD, "missing child definition"))?;
+        let owner = *components.get(&old.parent).ok_or_else(|| bad(CMD, "missing parent definition"))?;
+        let pose = s.pending_moves.get(&old.id).copied().unwrap_or(old.transform);
+        if !super::component::valid_position(&pose) {
+            return Err(bad(CMD, "invalid internal pending occurrence transform"));
+        }
+        let id = scratch.doc_mut().add_occurrence(child, owner, pose)?;
+        if let Some(o) = scratch.doc_mut().occurrences.iter_mut().find(|o| o.id == id) {
+            o.grounded = old.grounded;
+        }
+        occurrences.insert(old.id, id);
+    }
+    // Collect historical outputs too: a later Combine may have consumed a named tool body.
+    let mut outputs: BTreeMap<u64, Vec<String>> = BTreeMap::new();
+    for f in &feats {
+        if let Some(result) = s.model.result(f.id) {
+            let created: Vec<_> = result.state.bodies.iter().filter(|b| b.feature == f.id).map(|b| b.name.clone()).collect();
+            for name in &created {
+                bodies.entry(name.clone()).or_insert_with(|| unique(name, &mut used));
+            }
+            outputs.insert(f.id, created);
+        }
+        for name in &f.body_names {
+            if !name.is_empty() {
+                bodies.entry(name.clone()).or_insert_with(|| unique(name, &mut used));
+            }
+        }
+        if bodies.len() > MAX_WORK {
+            return Err(bad(CMD, "historical body set exceeds copy work limit"));
+        }
+    }
+    // Body assignment may put externally authored geometry into this graph. Freeze it explicitly.
+    let owned_features: BTreeSet<_> = feats.iter().map(|f| f.id).collect();
+    for body in state.bodies.iter().filter(|b| selected.contains(&source.model_body_component(b)) && !owned_features.contains(&b.feature)) {
+        if body.body.is_mesh() {
+            return Err(bad(CMD, "Paste New of a reassigned mesh body is not supported yet"));
+        }
+        let offset = source.model_body_offset(body).copied().unwrap_or(solvecraft_doc::IDENTITY);
+        // An external transfer establishes the local baseline in this graph.
+        // Freeze AFTER that boundary, then replay it as an identity ownership event.
+        let entry = feats.iter().find(|f| {
+            !f.suppressed
+                && matches!(&f.kind, FeatureKind::BodyTransfer { bodies, from, to, .. }
+            if !selected.contains(from) && bodies.contains(&body.name)
+                && s.model.result(f.id).is_some_and(|result| !result.skipped && result.error.is_none()
+                    && result.state.body(&body.name).is_some_and(|entered| source.model_body_component(entered) == *to)))
+        });
+        let before = feats.iter().find_map(|f| {
+            let before = s.model.state_before(f.id);
+            let prior = before.body(&body.name)?;
+            let after = s.model.result(f.id)?.state.body(&body.name);
+            if after.is_none_or(|after| !prior.body.same(&after.body)) { Some(before) } else { None }
+        });
+        let entered = entry.and_then(|f| s.model.result(f.id)).map(|r| r.state.clone());
+        let base = entered.as_ref().and_then(|st| st.body(&body.name)).or_else(|| before.as_ref().and_then(|st| st.body(&body.name))).unwrap_or(body);
+        let baseline_component = source.model_body_component(base);
+        let geometry = solvecraft_kernel::transform_matrix(&base.body, offset)?;
+        let step = solvecraft_kernel::step_export(&[&geometry], "SolidCraft independent reassigned body")?;
+        let new_name = unique(&body.name, &mut used);
+        bodies.insert(body.name.clone(), new_name.clone());
+        let feature_name = unique(&format!("{} Base", body.name), &mut used);
+        let id = scratch.doc_mut().add_feature(
+            FeatureKind::Import { file: format!("{} independent base", body.name), step, components: Vec::new() },
+            Some(&feature_name),
+        )?;
+        if let Some(f) = scratch.doc_mut().feature_mut(id) {
+            f.component = *components.get(&baseline_component).ok_or_else(|| bad(CMD, "reassigned baseline is outside copied component graph"))?;
+            f.body_names = vec![new_name];
+        }
+        new_ids.push(id);
+        frozen.push(body.name.clone());
+    }
+    // Allocate all history IDs before rewriting any forward reference.
+    for f in &feats {
+        let name = unique(&f.name, &mut used);
+        let id = scratch.doc_mut().add_feature(f.kind.clone(), Some(&name))?;
+        if let Some(new) = scratch.doc.feature(id) {
+            for (old, pn) in f.param_names.iter().zip(&new.param_names) {
+                parameters.insert(old.clone(), pn.clone());
+            }
+        }
+        features.insert(f.id, id);
+        names.insert(f.name.clone(), name);
+        new_ids.push(id);
+    }
+    // Constraint dimensions own independent generated parameters; public user parameters stay shared.
+    for f in &feats {
+        if let FeatureKind::Sketch { sketch, .. } = &f.kind {
+            for c in &sketch.constraints {
+                if let Some(name) = &c.param
+                    && !parameters.contains_key(name)
+                    && let Some(p) = source_parameters.get(name.as_str())
+                    && p.model
+                {
+                    if scratch.doc.params.len() >= solvecraft_doc::MAX_PARAMS {
+                        return Err(bad(CMD, "too many copied parameters"));
+                    }
+                    let new = scratch.doc_mut().new_model_param(&p.expr, &p.unit);
+                    parameters.insert(name.clone(), new);
+                }
+            }
+        }
+    }
+    for (old, new) in &parameters {
+        if let Some(comment) = source.param_comments.get(old) {
+            scratch.doc_mut().param_comments.insert(new.clone(), comment.clone());
+        }
+        if let Some(p) = source_parameters.get(old.as_str())
+            && p.model
+        {
+            let expr = solvecraft_doc::clone_expression(&p.expr, &parameters);
+            if let Some(p) = scratch.doc_mut().params.iter_mut().find(|p| p.name == *new) {
+                p.expr = expr;
+                p.comment = source_parameters.get(old.as_str()).map(|p| p.comment.clone()).unwrap_or_default();
+            }
+        }
+    }
+    for old in &feats {
+        let mut f = old.clone();
+        f.id = *features.get(&old.id).ok_or_else(|| bad(CMD, "missing feature mapping"))?;
+        f.name = names.get(&old.name).cloned().ok_or_else(|| bad(CMD, "missing feature name"))?;
+        f.component = *components.get(&old.component).ok_or_else(|| bad(CMD, "missing component mapping"))?;
+        if f.body_names.is_empty() {
+            f.body_names = outputs.get(&old.id).cloned().unwrap_or_default();
+        }
+        f.remap_clone(&features, &names, &bodies, &parameters)?;
+        if let FeatureKind::BodyTransfer { from, to, transform, .. } = &mut f.kind {
+            *to = *components.get(to).ok_or_else(|| bad(CMD, "transfer destination is outside the copied graph"))?;
+            if let Some(mapped) = components.get(from) {
+                *from = *mapped;
+            } else {
+                *from = *to;
+                *transform = solvecraft_doc::IDENTITY;
+            }
+        }
+        if let FeatureKind::Emboss { face: Some(face), .. } = &mut f.kind
+            && !face.path.is_empty()
+            && let FeatureKind::Emboss { face: Some(old_face), .. } = &old.kind
+            && bodies.contains_key(&old_face.body)
+        {
+            face.path = cloned_path(&source, &old_face.path, component, &clone_path, &occurrences)?;
+        }
+        if let FeatureKind::Emboss { face: Some(face), .. } = &mut f.kind
+            && !face.author_path.is_empty()
+        {
+            face.author_path = cloned_path(&source, &face.author_path, component, &clone_path, &occurrences)?;
+        }
+        if let (FeatureKind::Sketch { plane, .. }, FeatureKind::Sketch { plane: old_plane, .. }) = (&mut f.kind, &old.kind)
+            && let (Some(anchor), Some(original)) = (super::sketch::face::anchor_mut(plane), super::sketch::face::anchor(old_plane))
+        {
+            if bodies.contains_key(&original.target.body) {
+                anchor.component =
+                    *components.get(&original.component).ok_or_else(|| bad(CMD, "anchored source component is outside copied graph"))?;
+                anchor.path = cloned_path(&source, &original.path, component, &clone_path, &occurrences)?;
+            }
+            anchor.author_path = cloned_path(&source, &original.author_path, component, &clone_path, &occurrences)?;
+        }
+        if let Some(slot) = scratch.doc_mut().feature_mut(f.id) {
+            *slot = f;
+        }
+    }
+    for (old, new) in &bodies {
+        if let Some(mat) = source.materials.get(old) {
+            scratch.doc_mut().materials.insert(new.clone(), mat.clone());
+        }
+        if let Some(look) = source.appearances.bodies.get(old) {
+            scratch.doc_mut().appearances.bodies.insert(new.clone(), look.clone());
+        }
+        if !frozen.contains(old) {
+            if let Some(comp) = source.body_components.get(old).and_then(|c| components.get(c)) {
+                scratch.doc_mut().body_components.insert(new.clone(), *comp);
+            }
+            if let Some(offset) = source.body_offsets.get(old) {
+                scratch.doc_mut().body_offsets.insert(new.clone(), *offset);
+            }
+        }
+    }
+    for (old, new) in &components {
+        if let Some(part) = source.parts.get(old) {
+            scratch.doc_mut().parts.insert(*new, part.clone());
+        }
+        if let Some(look) = source.appearances.components.get(old) {
+            scratch.doc_mut().appearances.components.insert(*new, look.clone());
+        }
+    }
+    // A creator's history can belong here while its final body was reassigned outside.
+    // Retain the independent history, but reproduce the current ownership at its end.
+    let moved_out: Vec<_> = state
+        .bodies
+        .iter()
+        .filter(|b| owned_features.contains(&b.feature) && !selected.contains(&source.model_body_component(b)))
+        .filter_map(|b| bodies.get(&b.name).cloned())
+        .collect();
+    if !moved_out.is_empty() {
+        let name = unique("Assigned-out bodies", &mut used);
+        let id = scratch.doc_mut().add_feature(FeatureKind::Remove { bodies: moved_out }, Some(&name))?;
+        if let Some(f) = scratch.doc_mut().feature_mut(id) {
+            f.component = root;
+        }
+        new_ids.push(id);
+    }
+    for face in &source.appearances.faces {
+        if let Some(new) = bodies.get(&face.body) {
+            let mut face = face.clone();
+            if frozen.contains(&face.body) {
+                if face.strict_name {
+                    return Err(bad(CMD, "cannot copy strict face paint through uncertified foreign re-export"));
+                }
+                if let Some(name) = &face.name {
+                    face.point = solvecraft_doc::naming::point_on_face(&state, name, face.point)
+                        .map(|(point, _)| point)
+                        .ok_or_else(|| bad(CMD, "source frozen face appearance lost its identity"))?;
+                }
+                let source_body = state.body(&face.body).ok_or_else(|| bad(CMD, "source frozen face appearance lost its body"))?;
+                face.point = solvecraft_doc::apply_point(source.model_body_offset(source_body).unwrap_or(&solvecraft_doc::IDENTITY), face.point);
+                face.name = None;
+            } else if let Some(name) = &mut face.name {
+                *name = solvecraft_doc::remap_topology(name, &features, &bodies);
+            }
+            face.body = new.clone();
+            if let Some(certificate) = &mut face.certificate {
+                certificate.remap_features(&features);
+            }
+            scratch.doc_mut().appearances.faces.push(face);
+        }
+    }
+    // Typed configuration and assembly helpers preserve original targets.
+    scratch.doc_mut().configs.clone_targets(&solvecraft_doc::config::ConfigCloneMaps {
+        features: features.clone(),
+        components: components.clone(),
+        bodies: bodies.clone(),
+        parameters: parameters.clone(),
+    })?;
+    let mut notices = super::component_clone_assembly::clone_assembly(scratch.doc_mut(), &source, &occurrences, &features, &bodies)?;
+    let mut reference_work = 0usize;
+    for feature in &feats {
+        if let FeatureKind::Emboss { face: Some(face), .. } = &feature.kind
+            && !face.path.is_empty()
+            && !bodies.contains_key(&face.body)
+        {
+            notices.push(format!("{} retains external selected occurrence path {:?}", feature.name, face.path));
+        }
+        if let FeatureKind::Sketch { sketch, .. } = &feature.kind {
+            use solvecraft_sketch::LinkSource as L;
+            let mut pending: Vec<_> = sketch.links.iter().map(|l| &l.source).collect();
+            let mut work = 0;
+            while let Some(link) = pending.pop() {
+                work += 1;
+                reference_work += 1;
+                if work > MAX_WORK || reference_work > 100_000 {
+                    return Err(bad(CMD, "linked references exceed copy work limit"));
+                }
+                match link {
+                    L::Edge { body, .. }
+                    | L::Face { body, .. }
+                    | L::Body { body }
+                    | L::Vertex { body, .. }
+                    | L::Iso { body, .. }
+                    | L::Spun { body, .. } => {
+                        if !bodies.contains_key(body) {
+                            notices.push(format!("{} retains external linked body {body}", feature.name));
+                        }
+                    }
+                    L::SketchCurve { sketch, .. } | L::SketchPoint { sketch, .. } => {
+                        if !features.contains_key(sketch) {
+                            notices.push(format!("{} retains external linked sketch {sketch}", feature.name));
+                        }
+                    }
+                    L::OnSurface { sketch, body, .. } => {
+                        if !features.contains_key(sketch) || !bodies.contains_key(body) {
+                            notices.push(format!("{} retains external surface link", feature.name));
+                        }
+                    }
+                    L::Intersection { a, b } => {
+                        pending.push(a);
+                        pending.push(b);
+                    }
+                    L::Plane { name } if source.find_feature(name).is_some() && !names.contains_key(name) => {
+                        notices.push(format!("{} retains external linked plane {name}", feature.name));
+                    }
+                    _ => {}
+                }
+            }
+        }
+        if let FeatureKind::Sketch { plane, .. } = &feature.kind
+            && let Some(anchor) = super::sketch::face::anchor(plane)
+            && !bodies.contains_key(&anchor.target.body)
+        {
+            notices.push(format!(
+                "{} retains external exact face attachment to {} (producer {})",
+                feature.name, anchor.target.body, anchor.target.origin_feature
+            ));
+        }
+        for id in feature.kind.input_sketches() {
+            if !features.contains_key(&id) {
+                notices.push(format!("{} retains an external sketch reference to {id}", feature.name));
+            }
+        }
+        if let FeatureKind::Pattern { features: references, .. } | FeatureKind::Mirror { features: references, .. } = &feature.kind {
+            for name in references {
+                if !names.contains_key(name) {
+                    notices.push(format!("{} retains external feature reference {name}", feature.name));
+                }
+            }
+        }
+        for expression in feature.kind.expressions() {
+            for name in solvecraft_doc::expr::references(expression) {
+                reference_work += 1;
+                if reference_work > 100_000 {
+                    return Err(bad(CMD, "expression references exceed copy work limit"));
+                }
+                if !parameters.contains_key(&name) && generated_parameters.contains(name.as_str()) {
+                    notices.push(format!("{} retains external model parameter {name}", feature.name));
+                }
+            }
+        }
+    }
+    notices.sort();
+    notices.dedup();
+    scratch.refresh();
+    let original_errors: BTreeMap<_, _> = s.model.results.iter().map(|result| (result.id, result.error.as_ref())).collect();
+    let refreshed_errors: BTreeMap<_, _> = scratch.model.results.iter().map(|result| (result.id, result.error.as_ref())).collect();
+    if source.features.iter().any(|feature| original_errors.get(&feature.id) != refreshed_errors.get(&feature.id)) {
+        return Err(bad(CMD, "copy would change an original feature's error state"));
+    }
+    // Base imports acquire new face identities. Resolve copied face overrides against the
+    // verified new geometry once, rather than weakening strict persistent-name semantics.
+    let resolved = scratch.model.state();
+    let mut face_updates = Vec::new();
+    for (index, face) in scratch.doc.appearances.faces.iter().enumerate() {
+        if bodies.iter().any(|(old, new)| frozen.contains(old) && *new == face.body) {
+            let body = resolved.body(&face.body).ok_or_else(|| bad(CMD, "missing frozen face body"))?;
+            let face_index =
+                solvecraft_doc::appearance::face_index_at(body, face.point).ok_or_else(|| bad(CMD, "cannot reproduce frozen face appearance"))?;
+            let name = solvecraft_doc::naming::face_names(body).get(face_index).cloned().ok_or_else(|| bad(CMD, "missing frozen face identity"))?;
+            face_updates.push((index, name));
+        }
+    }
+    for (index, name) in face_updates {
+        if let Some(face) = scratch.doc_mut().appearances.faces.get_mut(index) {
+            face.name = Some(name);
+        }
+    }
+    for id in &new_ids {
+        if let Some(error) = scratch.model.result(*id).and_then(|r| r.error.as_ref()) {
+            return Err(bad(CMD, format!("copied feature failed: {error}")));
+        }
+    }
+    let copied = scratch.model.state();
+    let copied_bodies: BTreeMap<_, _> = copied.bodies.iter().map(|body| (body.name.as_str(), body)).collect();
+    // Adding placements can invalidate cached source evaluation. Compare clone effects
+    // against that same evaluation's source prefix, not older shared B-rep pointers.
+    if scratch.doc.features.get(..source.features.len()) != Some(source.features.as_slice())
+        || scratch.doc.params.get(..source.params.len()) != Some(source.params.as_slice())
+    {
+        return Err(bad(CMD, "copy would change original feature history or parameters"));
+    }
+    let original_state = new_ids.first().map(|id| scratch.model.state_before(*id)).unwrap_or_else(|| copied.clone());
+    let all_columns = std::mem::take(&mut scratch.doc_mut().configs.columns);
+    scratch.doc_mut().configs.columns = all_columns.iter().skip(source.configs.columns.len()).cloned().collect();
+    let style_validation = scratch.doc.configuration_style_status(&copied);
+    scratch.doc_mut().configs.columns = all_columns;
+    style_validation?;
+    let mut proof_work = 0usize;
+    let expected_count = state.bodies.iter().filter(|b| selected.contains(&source.model_body_component(b))).count();
+    let copied_components: BTreeSet<_> = components.values().copied().collect();
+    let actual_count = copied.bodies.iter().filter(|b| copied_components.contains(&scratch.doc.model_body_component(b))).count();
+    if actual_count != expected_count {
+        return Err(bad(CMD, "copy produced an incomplete or unexpected set of bodies"));
+    }
+    for original in &original_state.bodies {
+        let Some(after) = copied_bodies.get(original.name.as_str()) else {
+            return Err(bad(CMD, "copy would remove a source body outside its independent history"));
+        };
+        if !original.body.same(&after.body) {
+            return Err(bad(CMD, "copy would modify a source body; external destructive dependencies are not supported"));
+        }
+    }
+    for body in state.bodies.iter().filter(|b| selected.contains(&source.model_body_component(b))) {
+        let new = bodies.get(&body.name).ok_or_else(|| bad(CMD, format!("body {} has no clone identity", body.name)))?;
+        let cloned = copied_bodies.get(new.as_str()).ok_or_else(|| bad(CMD, format!("copy did not reproduce body {}", body.name)))?;
+        let a = solvecraft_kernel::transform_matrix(&body.body, *source.model_body_offset(body).unwrap_or(&solvecraft_doc::IDENTITY))?;
+        let b = solvecraft_kernel::transform_matrix(&cloned.body, *scratch.doc.model_body_offset(cloned).unwrap_or(&solvecraft_doc::IDENTITY))?;
+        let ma = solvecraft_kernel::measure(&a)?;
+        let mb = solvecraft_kernel::measure(&b)?;
+        let tolerance = 1e-5 * (1.0 + (ma.bbox.max - ma.bbox.min).len()) + 64.0 * f64::EPSILON * (ma.bbox.min.len() + ma.bbox.max.len());
+        let mut material_matches = true;
+        let tol_a = (a.size() * 1e-3).max(1e-3).max(a.size() * 1e-6);
+        let tol_b = (b.size() * 1e-3).max(1e-3).max(b.size() * 1e-6);
+        let mesh_a = a.display_mesh(tol_a)?;
+        let mesh_b = b.display_mesh(tol_b)?;
+        // Precharge all 27 candidates, six possible replacements, their triangle
+        // distances and the three containment rays before any proof traversal.
+        proof_work = proof_work.saturating_add(mesh_a.triangles.len().saturating_add(mesh_b.triangles.len()).saturating_mul(27 * 7 * 4));
+        if proof_work > 50_000_000 {
+            return Err(bad(CMD, "geometry verification exceeds copy work limit"));
+        }
+        for x in [0.2, 0.5, 0.8] {
+            for y in [0.2, 0.5, 0.8] {
+                for z in [0.2, 0.5, 0.8] {
+                    let d = ma.bbox.max - ma.bbox.min;
+                    let p = ma.bbox.min + solvecraft_geom::Vec3::new(d.x * x, d.y * y, d.z * z);
+                    let roundoff = 64. * f64::EPSILON * (1. + p.len());
+                    material_matches &= material_probe_matches(&mesh_a, &mesh_b, p, tol_a + roundoff, tol_b + roundoff);
+                }
+            }
+        }
+        // Meshes of the same current circular section can have different
+        // chord-volume biases after STEP. Only independently certified current
+        // sections may replace that volume comparison; shape mismatches still
+        // refuse even when their volumes happen to agree.
+        let volume_matches = match solvecraft_kernel::certified_prism_equivalent(&a, &b)? {
+            Some(same) => same,
+            None => (ma.volume - mb.volume).abs() <= 1e-5 * (1.0 + ma.volume.abs()),
+        };
+        if !volume_matches
+            || (ma.area - mb.area).abs() > 1e-5 * (1.0 + ma.area.abs())
+            || ma.centroid.dist(mb.centroid) > tolerance
+            || ma.bbox.min.dist(mb.bbox.min) > tolerance
+            || ma.bbox.max.dist(mb.bbox.max) > tolerance
+            || !material_matches
+        {
+            return Err(bad(CMD, format!("copy geometry differs for body {}", body.name)));
+        }
+    }
+    scratch.selection = vec![Sel::Occurrence { path: clone_path }];
+    s.accept_computed(scratch);
+    Ok(
+        json!({"component":root,"occurrence":root_occurrence,"features":new_ids,"components":components.len(),"bodies":expected_count,"frozen_bodies":frozen,"notices":notices}),
+    )
+}
+
+#[cfg(test)]
+#[path = "component_clone_tests.rs"]
+mod tests;

crates/engine/src/cmd/component_clone_assembly.rs

@@ -0,0 +1,360 @@
+//! Typed remapping of assembly relationships for an independent component-tree copy.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use solvecraft_doc::Document;
+use solvecraft_doc::joints::{Assembly, JointOrigin, Snap};
+
+use crate::{EngineError, Result};
+
+const MAX_RECORDS: usize = 10_000;
+const MAX_REFERENCES: usize = 100_000;
+const MAX_TEXT: usize = 1_048_576;
+const MAX_NAME: usize = 8192;
+
+fn invalid(message: &str) -> EngineError {
+    EngineError::Other(format!("Paste New assembly: {message}"))
+}
+
+fn add_references(count: &mut usize, more: usize) -> Result<()> {
+    *count = count.saturating_add(more);
+    if *count > MAX_REFERENCES {
+        return Err(invalid("assembly references exceed the processing budget"));
+    }
+    Ok(())
+}
+
+fn finite_origin(origin: &JointOrigin) -> Result<()> {
+    let finite = match &origin.snap {
+        Snap::Frame { origin, z, x } => origin.is_finite() && z.is_finite() && x.is_none_or(|x| x.is_finite()),
+        Snap::FaceCenter { pick, .. } | Snap::CircleCenter { pick, .. } => pick.is_finite(),
+        Snap::Point { point, z } => point.is_finite() && z.is_none_or(|z| z.is_finite()),
+    };
+    if !finite {
+        return Err(invalid("joint origin contains non-finite geometry"));
+    }
+    Ok(())
+}
+
+fn budget(assembly: &Assembly) -> Result<()> {
+    let counts = [
+        assembly.origins.len(),
+        assembly.joints.len(),
+        assembly.links.len(),
+        assembly.contact_sets.len(),
+        assembly.studies.len(),
+        assembly.exploded.len(),
+    ];
+    if counts.iter().any(|n| *n > MAX_RECORDS) {
+        return Err(invalid("too many assembly records"));
+    }
+    let mut references = counts.iter().fold(0usize, |n, c| n.saturating_add(*c));
+    let mut bytes = 0usize;
+    let mut text = |s: &str| -> Result<()> {
+        bytes = bytes.saturating_add(s.len());
+        if s.len() > MAX_NAME || bytes > MAX_TEXT {
+            return Err(invalid("assembly names exceed the processing budget"));
+        }
+        Ok(())
+    };
+    for origin in &assembly.origins {
+        finite_origin(&origin.origin)?;
+        text(&origin.name)?;
+        if let Snap::FaceCenter { face: Some(face), .. } | Snap::CircleCenter { face: Some(face), .. } = &origin.origin.snap {
+            text(face)?;
+        }
+    }
+    for joint in &assembly.joints {
+        text(&joint.name)?;
+        add_references(&mut references, joint.values.len().saturating_add(joint.limits.len()))?;
+        if !joint.values.iter().all(|v| v.is_finite())
+            || !joint.limits.iter().flatten().all(|(lo, hi)| lo.is_finite() && hi.is_finite() && lo <= hi)
+            || !joint.offset.is_finite()
+            || !joint.angle.is_finite()
+        {
+            return Err(invalid("joint contains invalid motion values"));
+        }
+        for origin in [&joint.a, &joint.b] {
+            finite_origin(origin)?;
+            if let Snap::FaceCenter { face: Some(face), .. } | Snap::CircleCenter { face: Some(face), .. } = &origin.snap {
+                text(face)?;
+            }
+        }
+    }
+    for contact in &assembly.contact_sets {
+        text(&contact.name)?;
+        add_references(&mut references, contact.occurrences.len())?;
+    }
+    for study in &assembly.studies {
+        text(&study.name)?;
+        add_references(&mut references, study.keys.len())?;
+        for key in &study.keys {
+            add_references(&mut references, key.points.len())?;
+            if !key.points.iter().all(|(step, value)| step.is_finite() && value.is_finite()) {
+                return Err(invalid("motion study contains non-finite keys"));
+            }
+        }
+    }
+    for view in &assembly.exploded {
+        text(&view.name)?;
+        add_references(&mut references, view.moves.len())?;
+        if !view.moves.iter().all(|(_, p)| p.is_finite()) {
+            return Err(invalid("exploded view contains non-finite moves"));
+        }
+    }
+    if !assembly.links.iter().all(|l| l.ratio.is_finite() && l.offset.is_finite()) {
+        return Err(invalid("motion link contains non-finite values"));
+    }
+    if references > MAX_REFERENCES {
+        return Err(invalid("assembly references exceed the processing budget"));
+    }
+    Ok(())
+}
+
+fn unique_name(base: &str, used: &mut BTreeSet<String>) -> Result<String> {
+    if !used.contains(base) {
+        used.insert(base.to_string());
+        return Ok(base.to_string());
+    }
+    for index in 1..=MAX_RECORDS {
+        let name = if index == 1 { format!("{base} (copy)") } else { format!("{base} (copy {index})") };
+        if name.len() > MAX_NAME {
+            return Err(invalid("copied assembly name is too long"));
+        }
+        if used.insert(name.clone()) {
+            return Ok(name);
+        }
+    }
+    Err(invalid("could not allocate a unique assembly name"))
+}
+
+fn next_id(id: &mut u64) -> Result<u64> {
+    *id = id.checked_add(1).ok_or_else(|| invalid("assembly identifier space is exhausted"))?;
+    Ok(*id)
+}
+
+fn unique_ids(ids: impl Iterator<Item = u64>) -> Result<u64> {
+    let mut seen = BTreeSet::new();
+    let mut largest = 0;
+    for id in ids {
+        if id == 0 || !seen.insert(id) {
+            return Err(invalid("assembly identifiers must be nonzero and unique"));
+        }
+        largest = largest.max(id);
+    }
+    Ok(largest)
+}
+
+fn validate_map<K: Ord, V: Ord>(map: &BTreeMap<K, V>) -> Result<()> {
+    if map.len() > MAX_RECORDS || map.values().collect::<BTreeSet<_>>().len() != map.len() {
+        return Err(invalid("copy maps exceed their budget or contain duplicate destinations"));
+    }
+    Ok(())
+}
+
+/// Remap certified naming tokens, rather than replacing digit substrings (F1 must not
+/// alter F10). Body-based legacy names are remapped only through an explicit identity map.
+fn face_name(name: &str, features: &BTreeMap<u64, u64>, bodies: &BTreeMap<String, String>) -> Option<String> {
+    let body = name.match_indices(':').filter_map(|(end, _)| bodies.get_key_value(name.get(..end)?)).next_back();
+    let mut out = String::new();
+    let mut last = 0usize;
+    let mut mapped = false;
+    if let Some((old, new)) = body {
+        out.push_str(new);
+        last = old.len();
+        mapped = true;
+    }
+    let bytes = name.as_bytes();
+    let mut i = last;
+    while i < bytes.len() {
+        let boundary = i == 0
+            || bytes.get(i.wrapping_sub(1)).is_some_and(|c| matches!(*c, b'@' | b'|'))
+            || name.get(..i).is_some_and(|prefix| prefix.ends_with(":blend:") || prefix.ends_with(":inner:"));
+        if bytes.get(i) == Some(&b'F') && boundary {
+            let mut end = i + 1;
+            while bytes.get(end).is_some_and(u8::is_ascii_digit) {
+                end += 1;
+            }
+            if end > i + 1 && bytes.get(end).is_some_and(|c| matches!(*c, b':' | b'.')) {
+                let id: u64 = name.get(i + 1..end)?.parse().ok()?;
+                let replacement = features.get(&id)?;
+                out.push_str(name.get(last..i)?);
+                out.push_str(&format!("F{replacement}"));
+                last = end;
+                mapped |= i == 0;
+                i = end;
+                continue;
+            }
+        }
+        i += 1;
+    }
+    if !mapped {
+        return None;
+    }
+    out.push_str(name.get(last..)?);
+    Some(out)
+}
+
+fn origin(
+    origin: &JointOrigin,
+    occurrences: &BTreeMap<u64, u64>,
+    features: &BTreeMap<u64, u64>,
+    bodies: &BTreeMap<String, String>,
+) -> Option<JointOrigin> {
+    let mut out = origin.clone();
+    out.occurrence = *occurrences.get(&origin.occurrence)?;
+    match &mut out.snap {
+        Snap::FaceCenter { face: Some(face), .. } | Snap::CircleCenter { face: Some(face), .. } => *face = face_name(face, features, bodies)?,
+        _ => {}
+    }
+    Some(out)
+}
+
+fn report(messages: &mut Vec<String>, kind: &str, name: &str) {
+    messages.push(format!("Skipped {kind} `{name}`: references outside the copied component tree or geometry without a copied identity."));
+}
+
+/// Called with a scratch document after geometry cloning. Only wholly internal records
+/// are copied; cross-boundary relationships are reported and omitted without truncation.
+/// The assembly is swapped in only after every map, allocation and aggregate check passes.
+pub(super) fn clone_assembly(
+    doc: &mut Document,
+    source: &Document,
+    occurrences: &BTreeMap<u64, u64>,
+    features: &BTreeMap<u64, u64>,
+    bodies: &BTreeMap<String, String>,
+) -> Result<Vec<String>> {
+    budget(&source.assembly)?;
+    budget(&doc.assembly)?;
+    validate_map(occurrences)?;
+    validate_map(features)?;
+    validate_map(bodies)?;
+    if doc.occurrences.len() > MAX_REFERENCES {
+        return Err(invalid("too many destination occurrences"));
+    }
+    let mut map_bytes = 0usize;
+    for (old, new) in bodies {
+        map_bytes = map_bytes.saturating_add(old.len()).saturating_add(new.len());
+        if old.is_empty() || new.is_empty() || old.len() > MAX_NAME || new.len() > MAX_NAME || map_bytes > MAX_TEXT {
+            return Err(invalid("invalid or excessive body identity map"));
+        }
+    }
+    let available: BTreeSet<u64> = doc.occurrences.iter().map(|o| o.id).chain(std::iter::once(0)).collect();
+    if occurrences.values().any(|id| !available.contains(id)) {
+        return Err(invalid("copy occurrence map points to a missing occurrence"));
+    }
+    unique_ids(source.assembly.joints.iter().map(|j| j.id))?;
+    let mut joint_id = unique_ids(doc.assembly.joints.iter().map(|j| j.id))?;
+    let aux = |a: &Assembly| {
+        a.contact_sets.iter().map(|x| x.id).chain(a.studies.iter().map(|x| x.id)).chain(a.exploded.iter().map(|x| x.id)).collect::<Vec<_>>()
+    };
+    unique_ids(aux(&source.assembly).into_iter())?;
+    let mut auxiliary_id = unique_ids(aux(&doc.assembly).into_iter())?;
+    let mut a = doc.assembly.clone();
+    let mut messages = Vec::new();
+    let mut origin_names = a.origins.iter().map(|o| o.name.clone()).collect();
+    for old in &source.assembly.origins {
+        if !occurrences.contains_key(&old.origin.occurrence) {
+            continue;
+        }
+        if let Some(new) = origin(&old.origin, occurrences, features, bodies) {
+            let mut item = old.clone();
+            item.name = unique_name(&old.name, &mut origin_names)?;
+            item.origin = new;
+            a.origins.push(item);
+        } else {
+            report(&mut messages, "joint origin", &old.name);
+        }
+    }
+    let mut joint_names = a.joints.iter().map(|j| j.name.clone()).collect();
+    let mut joints = BTreeMap::new();
+    let mut touched_joints = BTreeSet::new();
+    for old in &source.assembly.joints {
+        if !occurrences.contains_key(&old.a.occurrence) && !occurrences.contains_key(&old.b.occurrence) {
+            continue;
+        }
+        touched_joints.insert(old.id);
+        match (origin(&old.a, occurrences, features, bodies), origin(&old.b, occurrences, features, bodies)) {
+            (Some(aa), Some(bb)) => {
+                let mut item = old.clone();
+                item.id = next_id(&mut joint_id)?;
+                item.name = unique_name(&old.name, &mut joint_names)?;
+                item.a = aa;
+                item.b = bb;
+                joints.insert(old.id, item.id);
+                a.joints.push(item);
+            }
+            _ => report(&mut messages, "joint", &old.name),
+        }
+    }
+    for old in &source.assembly.links {
+        if !touched_joints.contains(&old.a) && !touched_joints.contains(&old.b) {
+            continue;
+        }
+        match (joints.get(&old.a), joints.get(&old.b)) {
+            (Some(aa), Some(bb)) => {
+                let mut item = old.clone();
+                item.a = *aa;
+                item.b = *bb;
+                a.links.push(item);
+            }
+            _ => report(&mut messages, "motion link", &format!("{} → {}", old.a, old.b)),
+        }
+    }
+    let mut contact_names = a.contact_sets.iter().map(|x| x.name.clone()).collect();
+    for old in &source.assembly.contact_sets {
+        if !old.occurrences.iter().any(|o| occurrences.contains_key(o)) {
+            continue;
+        }
+        if let Some(ids) = old.occurrences.iter().map(|o| occurrences.get(o).copied()).collect::<Option<Vec<_>>>() {
+            let mut item = old.clone();
+            item.id = next_id(&mut auxiliary_id)?;
+            item.name = unique_name(&old.name, &mut contact_names)?;
+            item.occurrences = ids;
+            a.contact_sets.push(item);
+        } else {
+            report(&mut messages, "contact set", &old.name);
+        }
+    }
+    let mut study_names = a.studies.iter().map(|x| x.name.clone()).collect();
+    for old in &source.assembly.studies {
+        if !old.keys.iter().any(|k| touched_joints.contains(&k.joint)) {
+            continue;
+        }
+        if old.keys.iter().all(|k| joints.contains_key(&k.joint)) {
+            let mut item = old.clone();
+            item.id = next_id(&mut auxiliary_id)?;
+            item.name = unique_name(&old.name, &mut study_names)?;
+            for key in &mut item.keys {
+                key.joint = *joints.get(&key.joint).ok_or_else(|| invalid("missing copied study joint"))?;
+            }
+            a.studies.push(item);
+        } else {
+            report(&mut messages, "motion study", &old.name);
+        }
+    }
+    let mut view_names = a.exploded.iter().map(|x| x.name.clone()).collect();
+    for old in &source.assembly.exploded {
+        if !old.moves.iter().any(|(o, _)| occurrences.contains_key(o)) {
+            continue;
+        }
+        if old.moves.iter().all(|(o, _)| occurrences.contains_key(o)) {
+            let mut item = old.clone();
+            item.id = next_id(&mut auxiliary_id)?;
+            item.name = unique_name(&old.name, &mut view_names)?;
+            for (o, _) in &mut item.moves {
+                *o = *occurrences.get(o).ok_or_else(|| invalid("missing copied exploded occurrence"))?;
+            }
+            a.exploded.push(item);
+        } else {
+            report(&mut messages, "exploded view", &old.name);
+        }
+    }
+    budget(&a)?;
+    doc.assembly = a;
+    Ok(messages)
+}
+
+#[cfg(test)]
+#[path = "component_clone_assembly_tests.rs"]
+mod tests;

crates/engine/src/cmd/component_clone_assembly_tests.rs

@@ -0,0 +1,193 @@
+#![allow(clippy::unwrap_used, clippy::panic)]
+use super::*;
+use solvecraft_doc::joints::{Joint, JointKind, MotionLink, NamedOrigin};
+use solvecraft_doc::motion::{ContactSet, ExplodedView, MotionStudy, StudyKey};
+use solvecraft_doc::{IDENTITY, Occurrence};
+use solvecraft_geom::Vec3;
+
+fn at(occurrence: u64) -> JointOrigin {
+    JointOrigin { occurrence, snap: Snap::Point { point: Vec3::ZERO, z: None } }
+}
+
+fn joint(id: u64, a: u64, b: u64) -> Joint {
+    Joint {
+        id,
+        name: format!("Joint{id}"),
+        kind: JointKind::Revolute,
+        a: at(a),
+        b: at(b),
+        values: vec![0.25],
+        limits: vec![Some((-1.0, 1.0))],
+        flip: true,
+        offset: 2.0,
+        angle: 0.1,
+        suppressed: false,
+    }
+}
+
+fn occurrence(id: u64) -> Occurrence {
+    Occurrence { id, component: id, parent: 0, name: format!("Occurrence{id}"), transform: IDENTITY, grounded: false }
+}
+
+fn documents() -> (Document, Document) {
+    let mut source = Document { occurrences: [1, 2, 8, 9].map(occurrence).to_vec(), ..Document::default() };
+    source.assembly.joints = vec![joint(1, 1, 2), joint(2, 1, 2), joint(3, 2, 9), joint(4, 8, 9)];
+    source.assembly.origins = vec![
+        NamedOrigin {
+            name: "Typed origin".into(),
+            origin: JointOrigin { occurrence: 1, snap: Snap::FaceCenter { pick: Vec3::new(1.0, 2.0, 3.0), face: Some("F1:start@F10.2".into()) } },
+        },
+        NamedOrigin {
+            name: "Foreign geometry".into(),
+            origin: JointOrigin { occurrence: 1, snap: Snap::CircleCenter { pick: Vec3::ZERO, face: Some("F99:end".into()) } },
+        },
+        NamedOrigin { name: "Outside".into(), origin: at(9) },
+    ];
+    source.assembly.links =
+        vec![MotionLink { a: 1, ia: 0, b: 2, ib: 0, ratio: -2.0, offset: 0.3 }, MotionLink { a: 1, ia: 0, b: 3, ib: 0, ratio: 1.0, offset: 0.0 }];
+    source.assembly.contact_sets = vec![
+        ContactSet { id: 1, name: "Internal contact".into(), occurrences: vec![1, 2], suppressed: true },
+        ContactSet { id: 2, name: "Cross contact".into(), occurrences: vec![1, 9], suppressed: false },
+    ];
+    let key = |joint| StudyKey { joint, index: 0, points: vec![(0.0, 0.0), (10.0, 0.5)] };
+    source.assembly.studies = vec![
+        MotionStudy { id: 3, name: "Internal study".into(), steps: 10, keys: vec![key(1), key(2)] },
+        MotionStudy { id: 4, name: "Cross study".into(), steps: 10, keys: vec![key(1), key(3)] },
+    ];
+    source.assembly.exploded = vec![
+        ExplodedView { id: 5, name: "Internal explode".into(), moves: vec![(1, Vec3::X * 10.0), (2, Vec3::Y * 20.0)] },
+        ExplodedView { id: 6, name: "Cross explode".into(), moves: vec![(1, Vec3::X), (9, Vec3::Y)] },
+    ];
+    let mut destination = source.clone();
+    destination.occurrences.extend([101, 102].map(occurrence));
+    (source, destination)
+}
+
+#[test]
+fn internal_relationships_receive_independent_ids_and_remapped_typed_references() {
+    let (source, mut destination) = documents();
+    let report =
+        clone_assembly(&mut destination, &source, &BTreeMap::from([(1, 101), (2, 102)]), &BTreeMap::from([(1, 11), (10, 110)]), &BTreeMap::new())
+            .unwrap();
+    let a = &destination.assembly;
+    assert_eq!(a.joints.len(), 6);
+    assert_eq!((a.joints[4].id, a.joints[5].id), (5, 6));
+    assert_eq!((a.joints[4].a.occurrence, a.joints[4].b.occurrence), (101, 102));
+    assert_eq!(a.joints[4].values, source.assembly.joints[0].values);
+    assert_eq!(a.joints[4].limits, source.assembly.joints[0].limits);
+    assert_eq!(a.joints[4].name, "Joint1 (copy)");
+    assert_eq!(a.origins.len(), 4);
+    assert!(matches!(&a.origins[3].origin.snap, Snap::FaceCenter { face: Some(face), .. } if face == "F11:start@F110.2"));
+    assert_eq!((a.links[2].a, a.links[2].b, a.links[2].ratio), (5, 6, -2.0));
+    assert_eq!(a.contact_sets[2].id, 7);
+    assert_eq!(a.contact_sets[2].occurrences, vec![101, 102]);
+    assert!(a.contact_sets[2].suppressed);
+    assert_eq!(a.studies[2].id, 8);
+    assert_eq!(a.studies[2].keys.iter().map(|k| k.joint).collect::<Vec<_>>(), vec![5, 6]);
+    assert_eq!(a.exploded[2].id, 9);
+    assert_eq!(a.exploded[2].moves, vec![(101, Vec3::X * 10.0), (102, Vec3::Y * 20.0)]);
+    assert_eq!(report.len(), 6);
+    for kind in ["joint origin", "joint `Joint3`", "motion link", "contact set", "motion study", "exploded view"] {
+        assert!(report.iter().any(|m| m.contains(kind)), "{kind}: {report:?}");
+    }
+    assert!(!report.iter().any(|m| m.contains("Outside") || m.contains("Joint4")));
+    assert_eq!(destination.assembly.joints[..4], source.assembly.joints);
+    destination.assembly.joints[4].values[0] = 0.75;
+    assert_eq!(source.assembly.joints[0].values[0], 0.25);
+}
+
+#[test]
+fn naming_remaps_exact_tokens_unicode_and_legacy_body_identity() {
+    let features = BTreeMap::from([(1, 21), (10, 30)]);
+    let bodies = BTreeMap::from([("Wheel: inner".into(), "Wheel copy: inner".into())]);
+    assert_eq!(face_name("F1:blend:F10:start@F1.3", &features, &bodies).as_deref(), Some("F21:blend:F30:start@F21.3"));
+    assert_eq!(face_name("F1:side:曲線F10", &features, &bodies).as_deref(), Some("F21:side:曲線F10"));
+    assert_eq!(face_name("F1:side:F100.7", &features, &bodies).as_deref(), Some("F21:side:F100.7"));
+    assert_eq!(face_name("Wheel: inner:face:7", &features, &bodies).as_deref(), Some("Wheel copy: inner:face:7"));
+    assert!(face_name("F100:start", &features, &bodies).is_none());
+    assert!(face_name("F1:start@F99.1", &features, &bodies).is_none());
+    assert!(face_name("Foreign:face:0", &features, &bodies).is_none());
+    assert!(face_name("Foreign:face:0@F1.1", &features, &bodies).is_none());
+    let bodies = BTreeMap::from([("F1:Housing".into(), "F1:Housing (copy)".into())]);
+    assert_eq!(face_name("F1:Housing:face:0@F10.1", &features, &bodies).as_deref(), Some("F1:Housing (copy):face:0@F30.1"));
+}
+
+#[test]
+fn malformed_maps_identifier_exhaustion_and_aggregate_budgets_are_atomic() {
+    let (source, destination) = documents();
+    let mut cases = Vec::new();
+    cases.push((source.clone(), destination.clone(), BTreeMap::from([(1, 101), (2, 101)])));
+    cases.push((source.clone(), destination.clone(), BTreeMap::from([(1, 999)])));
+    let mut overflow = destination.clone();
+    overflow.assembly.joints[0].id = u64::MAX;
+    cases.push((source.clone(), overflow, BTreeMap::from([(1, 101), (2, 102)])));
+    let mut oversized = source.clone();
+    oversized.assembly.contact_sets[0].occurrences = vec![1; MAX_REFERENCES + 1];
+    cases.push((oversized, destination.clone(), BTreeMap::from([(1, 101), (2, 102)])));
+    let mut invalid = source.clone();
+    invalid.assembly.links[0].ratio = f64::NAN;
+    cases.push((invalid, destination, BTreeMap::from([(1, 101), (2, 102)])));
+    for (source, mut destination, occurrences) in cases {
+        let before = destination.assembly.clone();
+        assert!(clone_assembly(&mut destination, &source, &occurrences, &BTreeMap::from([(1, 11), (10, 110)]), &BTreeMap::new()).is_err());
+        assert_eq!(destination.assembly, before);
+    }
+}
+
+#[test]
+fn second_copy_has_unique_names_and_keeps_global_contact_switches_unchanged() {
+    let (source, mut destination) = documents();
+    destination.assembly.contact_enabled = true;
+    destination.assembly.contact_all = true;
+    let features = BTreeMap::from([(1, 11), (10, 110)]);
+    clone_assembly(&mut destination, &source, &BTreeMap::from([(1, 101), (2, 102)]), &features, &BTreeMap::new()).unwrap();
+    destination.occurrences.extend([201, 202].map(occurrence));
+    clone_assembly(&mut destination, &source, &BTreeMap::from([(1, 201), (2, 202)]), &features, &BTreeMap::new()).unwrap();
+    assert_eq!(destination.assembly.joints[6].name, "Joint1 (copy 2)");
+    assert!(destination.assembly.contact_enabled && destination.assembly.contact_all);
+    let names: BTreeSet<&str> = destination.assembly.origins.iter().map(|x| x.name.as_str()).collect();
+    assert_eq!(names.len(), destination.assembly.origins.len());
+}
+
+#[test]
+fn paste_new_internal_motion_study_drives_only_the_copied_assembly_and_reopens() {
+    use serde_json::{Value, json};
+    fn run(s: &mut crate::Session, command: &str, params: Value) -> Value {
+        s.execute(command, &params).unwrap_or_else(|e| panic!("{command}: {e}"))
+    }
+    let mut s = crate::Session::default();
+    let parent = run(&mut s, "component.create", json!({"name":"Mechanism"}))["component"].as_u64().unwrap();
+    let fixed = run(&mut s, "component.create", json!({"name":"Support"}))["occurrence"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"SupportBox"}));
+    run(&mut s, "occurrence.ground", json!({"occurrence":fixed,"grounded":true}));
+    run(&mut s, "component.activate", json!({"component":parent}));
+    let moving = run(&mut s, "component.create", json!({"name":"Carriage"}))["occurrence"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"corner":[0,0,5],"body_name":"CarriageBox"}));
+    run(&mut s, "joint.origin", json!({"name":"Support origin","occurrence":fixed,"point":[0,0,0]}));
+    let source_joint = run(&mut s, "joint.as_built", json!({"type":"slider","a":fixed,"b":moving,"name":"Rail"}))["joint"].as_u64().unwrap();
+    run(&mut s, "contact.create", json!({"name":"Internal contact","occurrences":[fixed,moving]}));
+    run(&mut s, "motion.study", json!({"name":"Travel","steps":10,"keys":[{"joint":source_joint,"points":[[0,0],[10,6]]}]}));
+    run(
+        &mut s,
+        "explode.create",
+        json!({"name":"Exploded mechanism","moves":[{"occurrence":fixed,"translate":[10,0,0]},{"occurrence":moving,"translate":[0,10,0]}]}),
+    );
+    let original = s.doc.occurrences.iter().find(|o| o.id == moving).unwrap().transform;
+    run(&mut s, "component.activate", json!({"component":"root"}));
+    let result = run(&mut s, "component.paste_new", json!({"component":parent,"translate":[20,0,0]}));
+    assert_eq!(result["notices"], json!([]));
+    assert_eq!(s.doc.assembly.joints.len(), 2);
+    assert_eq!(s.doc.assembly.origins.len(), 2);
+    assert_eq!(s.doc.assembly.contact_sets.len(), 2);
+    assert_eq!(s.doc.assembly.exploded.len(), 2);
+    let copied_joint = s.doc.assembly.joints.iter().find(|j| j.name == "Rail (copy)").unwrap().id;
+    let copied_moving = s.doc.assembly.joints.iter().find(|j| j.id == copied_joint).unwrap().b.occurrence;
+    assert_ne!(copied_moving, moving);
+    run(&mut s, "motion.play", json!({"study":"Travel (copy)","step":10}));
+    assert_eq!(s.doc.assembly.joints.iter().find(|j| j.id == source_joint).unwrap().values, vec![0.0]);
+    assert_eq!(s.doc.assembly.joints.iter().find(|j| j.id == copied_joint).unwrap().values, vec![6.0]);
+    assert_eq!(s.doc.occurrences.iter().find(|o| o.id == moving).unwrap().transform, original);
+    let reopened = Document::from_json(&s.doc.to_json()).unwrap();
+    assert_eq!(reopened.assembly, s.doc.assembly);
+    assert!(reopened.assembly.studies.iter().any(|m| m.name == "Travel (copy)" && m.keys[0].joint == copied_joint));
+}

crates/engine/src/cmd/component_clone_tests.rs

@@ -0,0 +1,554 @@
+#![allow(clippy::unwrap_used)]
+use crate::Session;
+use serde_json::{Value, json};
+fn run(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, &p).unwrap()
+}
+fn component(s: &mut Session, name: &str) -> u64 {
+    run(s, "component.create", json!({"name":name}))["component"].as_u64().unwrap()
+}
+fn volume(s: &mut Session, id: u64) -> f64 {
+    run(s, "component.properties", json!({"component":id}))["total"]["volume_mm3"].as_f64().unwrap()
+}
+fn box2(s: &mut Session) -> u64 {
+    run(s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Cube"}))["feature"].as_u64().unwrap()
+}
+fn copy(s: &mut Session, id: u64) -> Value {
+    run(s, "component.paste_new", json!({"component":id,"translate":[20,0,0]}))
+}
+fn near(a: f64, b: f64) {
+    assert!((a - b).abs() < 1e-6, "{a} != {b}");
+}
+
+#[test]
+fn coincident_independent_primitives_keep_their_own_semantic_faces() {
+    let mut s = Session::default();
+    let first = box2(&mut s);
+    let second = run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Other"}))["feature"].as_u64().unwrap();
+    let state = s.model.state();
+    let a = state.body("Cube").unwrap();
+    let b = state.body("Other").unwrap();
+    let a_names = solvecraft_doc::naming::face_names(a);
+    let b_names = solvecraft_doc::naming::face_names(b);
+    assert!(a_names.contains(&format!("F{first}:+z")));
+    assert!(b_names.contains(&format!("F{second}:+z")));
+    assert!(!b_names.contains(&format!("F{first}:+z")));
+}
+
+#[test]
+fn nested_definition_dag_and_histories_are_independent() {
+    let mut s = Session::default();
+    let parent = component(&mut s, "Assembly");
+    let child = component(&mut s, "Child");
+    let feature = box2(&mut s);
+    run(&mut s, "occurrence.copy", json!({"component":child}));
+    let copied = copy(&mut s, parent);
+    let new = copied["component"].as_u64().unwrap();
+    assert_eq!(copied["components"], 2);
+    near(volume(&mut s, new), 16.0);
+    let kids: Vec<_> = s.doc.occurrences.iter().filter(|o| o.parent == new).collect();
+    assert_eq!(kids.len(), 2);
+    assert_eq!(kids[0].component, kids[1].component);
+    assert_ne!(kids[0].component, child);
+    let parameter = s.doc.feature(feature).unwrap().param_names[0].clone();
+    run(&mut s, "parameters.change", json!({"name":parameter,"expression":"3 mm"}));
+    near(volume(&mut s, parent), 24.0);
+    near(volume(&mut s, new), 16.0);
+    let saved = s.doc.to_json();
+    let reopened = solvecraft_doc::Document::from_json(&saved).unwrap();
+    assert_eq!(reopened.occurrences.iter().filter(|o| o.parent == new).count(), 2);
+}
+
+#[test]
+fn reassigned_body_is_an_independent_base_feature() {
+    let mut s = Session::default();
+    let feature = box2(&mut s);
+    let part = component(&mut s, "Part");
+    run(&mut s, "component.move_bodies", json!({"component":part,"bodies":["Cube"]}));
+    let copied = copy(&mut s, part);
+    let new = copied["component"].as_u64().unwrap();
+    assert_eq!(copied["frozen_bodies"], json!(["Cube"]));
+    near(volume(&mut s, new), 8.0);
+    let parameter = s.doc.feature(feature).unwrap().param_names[0].clone();
+    run(&mut s, "parameters.change", json!({"name":parameter,"expression":"3 mm"}));
+    near(volume(&mut s, part), 12.0);
+    near(volume(&mut s, new), 8.0);
+}
+
+#[test]
+fn clone_preserves_physical_material_and_independent_styles() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Part");
+    box2(&mut s);
+    run(&mut s, "material.assign", json!({"bodies":["Cube"],"material":"Brass"}));
+    run(&mut s, "appearance.assign", json!({"components":[part.to_string()],"color":"#123456","opacity":0.4}));
+    run(&mut s, "appearance.assign", json!({"bodies":["Cube"],"color":"#abcdef"}));
+    run(&mut s, "appearance.assign", json!({"body":"Cube","faces":[[1,1,2]],"color":"#00ff00"}));
+    let copied = copy(&mut s, part);
+    let new = copied["component"].as_u64().unwrap();
+    let props = run(&mut s, "component.properties", json!({"component":new}));
+    near(props["total"]["mass_g"].as_f64().unwrap(), 0.068);
+    let copied_body = s.model.state().bodies.iter().find(|b| b.component == new).unwrap().name.clone();
+    assert_eq!(s.doc.appearances.bodies[&copied_body], s.doc.appearances.bodies["Cube"]);
+    let state = s.model.state();
+    let body = state.body(&copied_body).unwrap();
+    assert!(s.doc.face_colors(body).iter().any(|(_, look)| look.color == [0, 255, 0]));
+    run(&mut s, "appearance.assign", json!({"bodies":[copied_body],"color":"#ff0000"}));
+    assert_eq!(s.doc.appearances.bodies["Cube"].color, [0xab, 0xcd, 0xef]);
+    assert_eq!(s.doc.appearances.components[&new].opacity, 0.4);
+}
+
+#[test]
+fn reassigned_body_owned_move_replays_once_and_original_stays_unchanged() {
+    let mut s = Session::default();
+    box2(&mut s);
+    let part = component(&mut s, "Part");
+    run(&mut s, "component.move_bodies", json!({"component":part,"bodies":["Cube"]}));
+    run(&mut s, "solid.move", json!({"bodies":["Cube"],"translate":[10,0,0]}));
+    let before = run(&mut s, "component.properties", json!({"component":part}));
+    let copied = copy(&mut s, part);
+    let new = copied["component"].as_u64().unwrap();
+    let after = run(&mut s, "component.properties", json!({"component":new}));
+    near(after["total"]["center_of_mass"][0].as_f64().unwrap(), 31.0);
+    assert_eq!(run(&mut s, "component.properties", json!({"component":part})), before);
+}
+
+#[test]
+fn copied_external_destructive_target_is_atomic() {
+    let mut s = Session::default();
+    box2(&mut s);
+    let part = component(&mut s, "Part");
+    run(&mut s, "solid.move", json!({"bodies":["Cube"],"translate":[10,0,0]}));
+    let saved = s.doc.to_json();
+    let selection = s.selection.clone();
+    let active = s.active_component;
+    let pending = s.pending_moves.clone();
+    assert!(s.execute("component.paste_new", &json!({"component":part})).is_err());
+    assert_eq!(s.doc.to_json(), saved);
+    assert_eq!(s.selection, selection);
+    assert_eq!(s.active_component, active);
+    assert_eq!(s.pending_moves, pending);
+}
+
+#[test]
+fn generated_feature_parameter_dependencies_are_independent() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Part");
+    let source = box2(&mut s);
+    let source_names = s.doc.feature(source).unwrap().param_names.clone();
+    run(&mut s, "parameters.change", json!({"name":source_names[1],"expression":format!("{} * 2",source_names[0])}));
+    let result = copy(&mut s, part);
+    let clone = result["component"].as_u64().unwrap();
+    near(volume(&mut s, clone), 16.0);
+    let clone_names = s
+        .doc
+        .features
+        .iter()
+        .find(|f| f.component == clone && matches!(f.kind, solvecraft_doc::FeatureKind::Box { .. }))
+        .unwrap()
+        .param_names
+        .clone();
+    assert_ne!(clone_names, source_names);
+    run(&mut s, "parameters.change", json!({"name":source_names[0],"expression":"3 mm"}));
+    near(volume(&mut s, part), 36.0);
+    near(volume(&mut s, clone), 16.0);
+    run(&mut s, "parameters.change", json!({"name":clone_names[0],"expression":"4 mm"}));
+    near(volume(&mut s, clone), 64.0);
+    near(volume(&mut s, part), 36.0);
+}
+
+#[test]
+fn selected_nested_pending_placement_survives_copy_and_undo() {
+    let mut s = Session::default();
+    let parent = component(&mut s, "Parent");
+    let parent_first = s.doc.occurrence_of(parent).unwrap().id;
+    let child = component(&mut s, "Child");
+    let leaf = s.doc.occurrence_of(child).unwrap().id;
+    box2(&mut s);
+    let second = run(&mut s, "occurrence.copy", json!({"component":parent,"translate":[50,0,0]}))["occurrence"].as_u64().unwrap();
+    run(&mut s, "occurrence.move", json!({"occurrence":leaf,"capture":false,"translate":[5,0,0]}));
+    run(&mut s, "occurrence.move", json!({"occurrence":second,"capture":false,"translate":[2,0,0]}));
+    let pending = s.pending_moves.clone();
+    let prior_context = (s.active_component, s.active_occurrence_path.clone(), s.active_sketch);
+    let copied = run(&mut s, "component.paste_new", json!({"component":child,"occurrence":leaf,"path":[second,leaf],"translate":[10,0,0]}));
+    let new_leaf = copied["occurrence"].as_u64().unwrap();
+    assert_eq!((s.active_component, s.active_occurrence_path.clone(), s.active_sketch), prior_context);
+    assert_eq!(s.selection, vec![crate::Sel::Occurrence { path: vec![second, new_leaf] }]);
+    assert_eq!(s.pending_moves, pending);
+    assert_eq!(s.occurrence_placement(&[parent_first, leaf]).unwrap().world[3][0], 5.0);
+    let props = run(&mut s, "occurrence.properties", json!({"occurrence":new_leaf,"path":[second,new_leaf]}));
+    near(props["total"]["center_of_mass"][0].as_f64().unwrap(), 68.0);
+    run(&mut s, "edit.undo", json!({}));
+    assert!(!s.doc.occurrences.iter().any(|o| o.id == new_leaf));
+    assert_eq!(s.pending_moves, pending);
+}
+
+#[test]
+fn copied_sheet_base_targets_its_own_sketch_history() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Sheet");
+    let sketch = run(&mut s, "sketch.create", json!({"plane":"XY","name":"Base"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[10,10]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "sheet.flange", json!({"sketch":"Base"}));
+    let source_volume = volume(&mut s, part);
+    let copied = copy(&mut s, part);
+    let new = copied["component"].as_u64().unwrap();
+    near(volume(&mut s, new), source_volume);
+    let clone_sketch = s.doc.features.iter().find(|f| f.component == new && matches!(f.kind, solvecraft_doc::FeatureKind::Sketch { .. })).unwrap().id;
+    assert_ne!(clone_sketch, sketch);
+    let base = s.doc.features.iter().find(|f| f.component == new && matches!(f.kind, solvecraft_doc::FeatureKind::SheetBase { .. })).unwrap();
+    assert_eq!(base.kind.input_sketches(), vec![clone_sketch]);
+    // Mutate only source geometry, then verify the copied base remains unchanged.
+    if let solvecraft_doc::FeatureKind::Sketch { sketch, .. } = &mut s.doc_mut().feature_mut(sketch).unwrap().kind {
+        for p in &mut sketch.points {
+            p.pos.x *= 2.0;
+        }
+    }
+    s.refresh();
+    near(volume(&mut s, new), source_volume);
+}
+
+#[test]
+fn renamed_pattern_outputs_and_later_body_operands_follow_clone() {
+    let mut s = Session::default();
+    let part = component(&mut s, "PatternPart");
+    box2(&mut s);
+    run(&mut s, "solid.pattern.rectangular", json!({"bodies":["Cube"],"dir1":[1,0,0],"count1":3,"spacing1":5}));
+    let last = s.model.state().bodies.last().unwrap().name.clone();
+    run(&mut s, "body.rename", json!({"body":last,"name":"Custom Output"}));
+    run(&mut s, "solid.move", json!({"bodies":["Custom Output"],"translate":[0,5,0]}));
+    let copied = copy(&mut s, part);
+    let new = copied["component"].as_u64().unwrap();
+    near(volume(&mut s, new), 24.0);
+    let state = s.model.state();
+    let target = state.bodies.iter().find(|b| b.name == "Custom Output (copy)").unwrap();
+    near(solvecraft_kernel::measure(&target.body).unwrap().centroid.y, 6.0);
+    assert_eq!(s.doc.features.iter().filter(|f| f.component == new && matches!(f.kind, solvecraft_doc::FeatureKind::Move { .. })).count(), 1);
+}
+
+#[test]
+fn configuration_rows_follow_copied_parameters_material_and_strict_face_lineage() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Configured");
+    let source = box2(&mut s);
+    let length = s.doc.feature(source).unwrap().param_names[0].clone();
+    let target = solvecraft_doc::config::ConfigFaceTarget {
+        body: "Cube".into(),
+        origin_feature: source,
+        name: format!("F{source}:+z"),
+        point: solvecraft_geom::Vec3::new(1.0, 1.0, 2.0),
+        certificate: None,
+    };
+    run(&mut s, "config.configure", json!({"params":[length],"materials":["Cube"],"component_appearances":[part],"face_appearances":[target]}));
+    let face_key = s.doc.config_key(&solvecraft_doc::config::Column::FaceAppearance(target.clone()));
+    run(
+        &mut s,
+        "config.row",
+        json!({"name":"Large","values":{length.clone():"4 mm","material:Cube":"Brass",face_key:{"name":"Custom","color":[0,255,0],"opacity":1.0}}}),
+    );
+    let result = copy(&mut s, part);
+    let new = result["component"].as_u64().unwrap();
+    assert_eq!(s.doc.configs.columns.len(), 8);
+    run(&mut s, "config.activate", json!({"row":"Large"}));
+    near(volume(&mut s, part), 16.0);
+    near(volume(&mut s, new), 16.0);
+    let props = run(&mut s, "component.properties", json!({"component":new}));
+    near(props["total"]["mass_g"].as_f64().unwrap(), 0.136);
+    let state = s.model.state();
+    let body = state.bodies.iter().find(|b| b.component == new).unwrap();
+    assert!(s.doc.face_colors(body).iter().any(|(_, look)| look.color == [0, 255, 0]));
+    assert!(s.doc.configuration_style_status(&state).is_ok());
+    assert!(s.doc.configuration_matches());
+}
+
+#[test]
+fn configured_extrude_cap_copy_keeps_independent_semantic_lineage() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Extruded");
+    run(&mut s, "sketch.create", json!({"plane":"XY"}));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[2,2]}));
+    run(&mut s, "sketch.finish", json!({}));
+    let feature = run(&mut s, "solid.extrude", json!({"distance":2}))["feature"].as_u64().unwrap();
+    let body_name = s.model.state().bodies.last().unwrap().name.clone();
+    let target = solvecraft_doc::config::ConfigFaceTarget {
+        body: body_name,
+        origin_feature: feature,
+        name: format!("F{feature}:top"),
+        point: solvecraft_geom::Vec3::new(1.0, 1.0, 2.0),
+        certificate: None,
+    };
+    run(&mut s, "config.configure", json!({"face_appearances":[target]}));
+    let key = s.doc.config_key(&solvecraft_doc::config::Column::FaceAppearance(target));
+    run(&mut s, "config.row", json!({"name":"Painted","values":{key:{"name":"Custom","color":[0,255,0],"opacity":1.0}}}));
+    let copied = copy(&mut s, part)["component"].as_u64().unwrap();
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    let state = s.model.state();
+    let body = state.bodies.iter().find(|b| b.component == copied).unwrap();
+    assert!(solvecraft_doc::naming::face_names(body).contains(&format!("F{}:top", body.feature)));
+    assert!(s.doc.face_colors(body).iter().any(|(_, look)| look.color == [0, 255, 0]));
+    assert!(s.doc.configuration_style_status(&state).is_ok());
+    let saved = s.doc.to_json();
+    let reopened = solvecraft_doc::Document::from_json(&saved).unwrap();
+    let mut model = solvecraft_doc::Model::default();
+    model.evaluate(&reopened);
+    assert!(reopened.configuration_style_status(&model.state()).is_ok());
+}
+
+#[test]
+fn selected_second_occurrence_emboss_copy_remaps_target_and_author_paths_and_reopens() {
+    let mut s = Session::default();
+    let part = component(&mut s, "SleevePart");
+    let cylinder = run(&mut s, "solid.cylinder", json!({"radius":10,"height":20,"body_name":"Sleeve"}))["feature"].as_u64().unwrap();
+    let second = run(&mut s, "occurrence.copy", json!({"component":part,"translate":[80,0,0]}))["occurrence"].as_u64().unwrap();
+    run(&mut s, "component.activate", json!({"component":part,"occurrence":second,"path":[second]}));
+    run(&mut s, "sketch.create", json!({"name":"Badge","plane":{"origin":[80,10,0],"x_dir":[-1,0,0],"y_dir":[0,0,1]}}));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[-2,5],"p1":[2,10]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.emboss", json!({"sketch":"Badge","face":[80,10,7.5],"depth":1}));
+    let original_volume = volume(&mut s, part);
+    let copied = run(&mut s, "component.paste_new", json!({"component":part,"occurrence":second,"path":[second],"translate":[20,0,0]}));
+    let new = copied["component"].as_u64().unwrap();
+    let placement = copied["occurrence"].as_u64().unwrap();
+    let emboss = s.doc.features.iter().find(|f| f.component == new && matches!(f.kind, solvecraft_doc::FeatureKind::Emboss { .. })).unwrap();
+    let solvecraft_doc::FeatureKind::Emboss { face: Some(face), .. } = &emboss.kind else { panic!("missing selected face") };
+    assert_eq!(face.body, "Sleeve (copy)");
+    assert_eq!(face.path, vec![placement]);
+    assert_eq!(face.author_path, vec![placement]);
+    near(volume(&mut s, new), original_volume);
+    let clone_volume = volume(&mut s, new);
+    let height = s.doc.feature(cylinder).unwrap().param_names[1].clone();
+    run(&mut s, "parameters.change", json!({"name":height,"expression":"30 mm"}));
+    near(volume(&mut s, new), clone_volume);
+    assert!(volume(&mut s, part) > original_volume);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!(reopened.doc.features.iter().all(|f| reopened.model.result(f.id).is_some_and(|r| r.error.is_none())));
+    near(volume(&mut reopened, new), clone_volume);
+}
+
+#[test]
+fn reassigned_sample_plate_paste_new_preserves_complex_frozen_geometry() {
+    let mut s = Session::default();
+    s.run_script(&crate::sample::script()).unwrap();
+    let body = s.model.state().bodies.first().unwrap().name.clone();
+    let created = run(&mut s, "component.from_bodies", json!({"bodies":[body]}));
+    let part = created["components"][0]["component"].as_u64().unwrap();
+    run(&mut s, "component.activate", json!({"component":part}));
+    let occurrence = s.doc.occurrence_of(part).unwrap().id;
+    run(&mut s, "occurrence.ground", json!({"occurrence":occurrence,"grounded":true}));
+    let original_volume = volume(&mut s, part);
+    let source_mesh = s.model.state().body(&body).unwrap().mesh();
+    let boss_probe = solvecraft_geom::Vec3::new(40.0, 35.0, 12.0);
+    let source_boss = source_mesh.contains(boss_probe);
+    let copied = run(&mut s, "component.paste_new", json!({"component":part,"translate":[10,10,0]}));
+    assert_eq!(s.doc.components.len(), 2);
+    let new = copied["component"].as_u64().unwrap();
+    // Imported curved faces may tessellate differently; keep the same geometric
+    // accuracy required by copy, and independently probe plate and hole material.
+    assert!((volume(&mut s, new) - original_volume).abs() < 1e-5 * original_volume);
+    near(volume(&mut s, part), original_volume);
+    let state = s.model.state();
+    let copied_body = state.bodies.iter().find(|body| body.component == new).unwrap();
+    let mesh = copied_body.mesh();
+    for (point, expected) in
+        [([5.0, 25.0, 4.0], true), ([12.0, 25.0, 4.0], false), ([68.0, 25.0, 4.0], false), ([40.0, 25.0, 12.0], false), ([0.0, 0.0, 4.0], false)]
+    {
+        assert_eq!(mesh.contains(solvecraft_geom::Vec3::new(point[0], point[1], point[2])), expected, "{point:?}");
+    }
+    assert_eq!(mesh.contains(boss_probe), source_boss);
+    assert_eq!(state.body(&body).unwrap().mesh().contains(boss_probe), source_boss);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!((volume(&mut reopened, new) - original_volume).abs() < 1e-5 * original_volume);
+}
+
+#[test]
+fn generated_copy_parameters_cannot_heal_an_unrelated_missing_reference() {
+    let mut s = Session::default();
+    let part = component(&mut s, "Valid");
+    let valid = box2(&mut s);
+    run(&mut s, "component.activate", json!({"component":0}));
+    let kind = s.doc.feature(valid).unwrap().kind.clone();
+    let broken = s.doc_mut().add_feature(kind, Some("Broken reference")).unwrap();
+    let mut probe = (*s.doc).clone();
+    let missing = probe.new_model_param("2 mm", "mm");
+    let feature = s.doc_mut().feature_mut(broken).unwrap();
+    feature.component = 0;
+    if let solvecraft_doc::FeatureKind::Box { width, .. } = &mut feature.kind {
+        *width = missing;
+    }
+    s.refresh();
+    let original_error = s.model.result(broken).unwrap().error.clone();
+    assert!(original_error.is_some());
+    let saved = s.doc.to_json();
+    let context = (s.active_component, s.active_occurrence_path.clone(), s.active_sketch);
+    let selection = s.selection.clone();
+    let pending = s.pending_moves.clone();
+    let error = s.execute("component.paste_new", &json!({"component":part})).unwrap_err();
+    assert!(error.to_string().contains("original feature's error state"), "{error}");
+    assert_eq!(s.doc.to_json(), saved);
+    assert_eq!(s.model.result(broken).unwrap().error, original_error);
+    assert_eq!((s.active_component, s.active_occurrence_path.clone(), s.active_sketch), context);
+    assert_eq!(s.selection, selection);
+    assert_eq!(s.pending_moves, pending);
+}
+
+#[test]
+fn external_transfer_entry_and_internal_rotated_transfer_clone_once() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":4,"width":3,"height":2,"body_name":"Foreign"}));
+    let parent = component(&mut s, "Assembly");
+    let a = component(&mut s, "A");
+    let ao = s.doc.occurrence_of(a).unwrap().id;
+    run(&mut s, "occurrence.move", json!({"occurrence":ao,"translate":[10,0,0],"angle":90,"axis":[0,0,1],"capture":true}));
+    run(&mut s, "component.move_bodies", json!({"component":a,"bodies":["Foreign"]}));
+    run(&mut s, "component.activate", json!({"component":parent}));
+    let b = component(&mut s, "B");
+    let bo = s.doc.occurrence_of(b).unwrap().id;
+    run(&mut s, "occurrence.move", json!({"occurrence":bo,"translate":[0,20,0],"angle":90,"axis":[1,0,0],"capture":true}));
+    run(&mut s, "component.move_bodies", json!({"component":b,"bodies":["Foreign"]}));
+    run(&mut s, "solid.move", json!({"bodies":["Foreign"],"translate":[0,0,5]}));
+    let before = s.model.state().body("Foreign").unwrap().mesh().bounds();
+    let copied = copy(&mut s, parent);
+    assert_eq!(copied["frozen_bodies"], json!(["Foreign"]));
+    let state = s.model.state();
+    let body = state.body("Foreign (copy)").unwrap();
+    let after = body.mesh().bounds();
+    assert!(before.min.dist(after.min) < 1e-6);
+    assert!(before.max.dist(after.max) < 1e-6);
+    assert!(body.transferred);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!(reopened.model.state().body("Foreign (copy)").unwrap().mesh().bounds().min.dist(before.min) < 1e-6);
+}
+
+#[test]
+fn suppressed_external_entry_does_not_supply_clone_baseline() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":4,"width":3,"height":2,"body_name":"Foreign"}));
+    let part = component(&mut s, "Part");
+    let occurrence = s.doc.occurrence_of(part).unwrap().id;
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[25,0,0],"angle":90,"axis":[0,0,1],"capture":true}));
+    let skipped = s
+        .doc_mut()
+        .add_feature(
+            solvecraft_doc::FeatureKind::BodyTransfer { bodies: vec!["Foreign".into()], from: 0, to: part, transform: solvecraft_doc::IDENTITY },
+            None,
+        )
+        .unwrap();
+    s.doc_mut().feature_mut(skipped).unwrap().suppressed = true;
+    s.refresh();
+    run(&mut s, "component.move_bodies", json!({"component":part,"bodies":["Foreign"]}));
+    let before = s.model.state().body("Foreign").unwrap().mesh().bounds();
+    copy(&mut s, part);
+    let after = s.model.state().body("Foreign (copy)").unwrap().mesh().bounds();
+    assert!(before.min.dist(after.min) < 1e-6);
+    assert!(before.max.dist(after.max) < 1e-6);
+}
+
+#[test]
+fn transferred_frozen_face_paint_ignores_consumed_legacy_offset() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Foreign"}));
+    run(&mut s, "appearance.assign", json!({"body":"Foreign","faces":[[1,1,2]],"color":"#00ff00"}));
+    s.doc_mut().body_offsets.insert(
+        "Foreign".into(),
+        solvecraft_doc::rigid(solvecraft_geom::Vec3::new(7.0, 0.0, 0.0), solvecraft_geom::Vec3::ZERO, solvecraft_geom::Vec3::Z, 0.0),
+    );
+    s.refresh();
+    let part = component(&mut s, "Part");
+    run(&mut s, "component.move_bodies", json!({"component":part,"bodies":["Foreign"]}));
+    let original = s.doc.appearances.faces.iter().find(|face| face.body == "Foreign").unwrap();
+    let expected = solvecraft_doc::naming::point_on_face(&s.model.state(), original.name.as_ref().unwrap(), original.point).unwrap().0;
+    copy(&mut s, part);
+    let paint = s.doc.appearances.faces.iter().find(|face| face.body == "Foreign (copy)").unwrap();
+    assert!(paint.point.dist(expected) < 1e-6, "{:?} versus {expected:?}", paint.point);
+}
+
+#[test]
+fn boundary_material_proof_requires_resolvable_stock_and_void() {
+    use solvecraft_geom::Vec3;
+    let a = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(10., 10., 10.)).unwrap().tessellate(1e-3).unwrap();
+    let b = solvecraft_kernel::box_solid(Vec3::new(1e-5, 0., 0.), Vec3::new(10.00001, 10., 10.)).unwrap().tessellate(1e-3).unwrap();
+    let p = Vec3::new(5e-6, 5., 5.);
+    assert_ne!(a.contains(p), b.contains(p));
+    assert!((super::mesh_distance(&a, p) - 5e-6).abs() < 1e-12);
+    assert!((super::mesh_distance(&b, p) - 5e-6).abs() < 1e-12);
+    assert!(super::material_probe_matches(&a, &b, p, 1e-3, 1e-3));
+    let shifted = solvecraft_kernel::box_solid(Vec3::new(1., 0., 0.), Vec3::new(11., 10., 10.)).unwrap().tessellate(1e-3).unwrap();
+    assert!(!super::material_probe_matches(&a, &shifted, p, 1e-3, 1e-3));
+    let thin = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(10., 10., 1e-4)).unwrap().tessellate(1e-6).unwrap();
+    let thin_shifted = solvecraft_kernel::box_solid(Vec3::new(0., 0., 1e-4), Vec3::new(10., 10., 2e-4)).unwrap().tessellate(1e-6).unwrap();
+    // Every resolvable replacement is void: thin ambiguous material is refused.
+    assert!(!super::material_probe_matches(&thin, &thin_shifted, Vec3::new(5., 5., 5e-5), 1e-3, 1e-3));
+    assert!(!super::material_probe_matches(&a, &b, p, f64::INFINITY, 1e-3));
+}
+
+#[test]
+fn frozen_bore_boundary_copy_preserves_stock_void_and_reopen() {
+    use solvecraft_geom::Vec3;
+    let bore = |center: f64| {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length":30,"width":20,"height":10,"body_name":"Drilled"}));
+        run(&mut s, "solid.cylinder", json!({"base":[center,10,0],"radius":4,"height":10,"operation":"cut"}));
+        s
+    };
+    let mut s = bore(10.);
+    let source = s.model.state().body("Drilled").unwrap().body.tessellate(1e-3).unwrap();
+    // The exact R4 wall passes through x6; a chord may end either side of that
+    // cardinal angle, so its distance is bounded by the requested sag tolerance.
+    assert!(super::mesh_distance(&source, Vec3::new(6., 10., 5.)) <= 1e-3);
+    let shifted = bore(11.).model.state().body("Drilled").unwrap().body.tessellate(1e-3).unwrap();
+    let lost = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(30., 20., 10.)).unwrap().tessellate(1e-3).unwrap();
+    assert!(!super::material_probe_matches(&source, &shifted, Vec3::new(6.5, 10., 5.), 1e-3, 1e-3));
+    assert!(!super::material_probe_matches(&source, &lost, Vec3::new(10., 10., 5.), 1e-3, 1e-3));
+    let created = run(&mut s, "component.from_bodies", json!({"bodies":["Drilled"]}));
+    let part = created["components"][0]["component"].as_u64().unwrap();
+    let copied = copy(&mut s, part)["component"].as_u64().unwrap();
+    let check = |session: &Session| {
+        let state = session.model.state();
+        let body = state.bodies.iter().find(|body| session.doc.model_body_component(body) == copied).unwrap();
+        let mesh = body.body.tessellate(1e-3).unwrap();
+        for (point, stock) in
+            [(Vec3::new(5.5, 10., 5.), true), (Vec3::new(6.5, 10., 5.), false), (Vec3::new(10., 10., 5.), false), (Vec3::new(18., 10., 5.), true)]
+        {
+            assert_eq!(mesh.contains(point), stock, "{point:?}");
+        }
+    };
+    check(&s);
+    check(&Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap()));
+}
+
+#[test]
+fn frozen_r6_bore_copy_uses_current_geometry_despite_mesh_measure_bias() {
+    use solvecraft_geom::Vec3;
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":20,"width":20,"height":10,"body_name":"Drilled"}));
+    run(&mut s, "solid.cylinder", json!({"base":[10,10,0],"radius":6,"height":10,"operation":"cut"}));
+    let source = s.model.state().body("Drilled").unwrap().body.clone();
+    let original = solvecraft_kernel::step_export(&[&source], "source").unwrap();
+    let created = run(&mut s, "component.from_bodies", json!({"bodies":["Drilled"]}));
+    let part = created["components"][0]["component"].as_u64().unwrap();
+    let before = s.doc.to_json();
+    let copied = copy(&mut s, part)["component"].as_u64().unwrap();
+    let check = |session: &Session| {
+        let state = session.model.state();
+        let body = state.bodies.iter().find(|b| session.doc.model_body_component(b) == copied).unwrap();
+        assert_eq!(solvecraft_kernel::certified_prism_equivalent(&source, &body.body).unwrap(), Some(true));
+        let mesh = body.body.tessellate(1e-3).unwrap();
+        for (point, material) in
+            [(Vec3::new(3., 10., 5.), true), (Vec3::new(5., 10., 5.), false), (Vec3::new(10., 10., 5.), false), (Vec3::new(18., 10., 5.), true)]
+        {
+            assert_eq!(mesh.contains(point), material, "{point:?}");
+        }
+        let original_body = state.body("Drilled").unwrap();
+        assert_eq!(solvecraft_kernel::step_export(&[&original_body.body], "source").unwrap(), original);
+    };
+    check(&s);
+    check(&Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap()));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.to_json(), before);
+    run(&mut s, "edit.redo", json!({}));
+    check(&s);
+}

crates/engine/src/cmd/component_properties.rs

@@ -0,0 +1,157 @@
+//! Physical properties of an assembly placement, with original body material assignments.
+use serde_json::{Value, json};
+use solvecraft_doc::{Document, Mat};
+use solvecraft_geom::Vec3;
+
+use crate::params::bad;
+use crate::{Result, Session};
+
+fn descendants(p: &Value, cmd: &str) -> Result<bool> {
+    match p.get("descendants") {
+        None => Ok(true),
+        Some(Value::Bool(v)) => Ok(*v),
+        Some(_) => Err(bad(cmd, "`descendants` must be a boolean")),
+    }
+}
+
+fn placed_doc(s: &Session) -> Document {
+    let mut doc = (*s.doc).clone();
+    for occurrence in &mut doc.occurrences {
+        if let Some(transform) = s.pending_moves.get(&occurrence.id) {
+            occurrence.transform = *transform;
+        }
+    }
+    doc
+}
+
+/// A property total must cover the entire assembly. The display traversal intentionally
+/// truncates hostile designs, so use an explicit error instead of accepting its prefix.
+pub(in crate::cmd) fn placements(doc: &Document, cmd: &str) -> Result<Vec<(u64, Vec<u64>, Mat)>> {
+    let mut out = vec![(0, Vec::new(), solvecraft_doc::IDENTITY)];
+    let mut stack = vec![(0, Vec::<u64>::new(), solvecraft_doc::IDENTITY)];
+    let mut children: std::collections::BTreeMap<u64, Vec<_>> = std::collections::BTreeMap::new();
+    for occurrence in &doc.occurrences {
+        children.entry(occurrence.parent).or_default().push(occurrence);
+    }
+    while let Some((component, path, transform)) = stack.pop() {
+        for occurrence in children.get(&component).into_iter().flatten() {
+            if path.len() >= 64 || out.len() >= 100_000 {
+                return Err(bad(cmd, "assembly exceeds physical-properties traversal limits (64 levels or 100000 placements)"));
+            }
+            let mut child_path = path.clone();
+            child_path.push(occurrence.id);
+            let world = solvecraft_doc::mat_mul(&transform, &occurrence.transform);
+            out.push((occurrence.component, child_path.clone(), world));
+            stack.push((occurrence.component, child_path, world));
+        }
+    }
+    Ok(out)
+}
+
+pub(super) fn component(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "component.properties";
+    let id = if p.get("component").is_some() { super::component(s, p, "component", cmd)? } else { s.active_component };
+    let doc = placed_doc(s);
+    let path = doc.first_path(id);
+    let name = if id == 0 {
+        doc.name.clone()
+    } else {
+        doc.components.iter().find(|c| c.id == id).map(|c| c.name.clone()).ok_or_else(|| bad(cmd, "no active component"))?
+    };
+    let mut out = properties(s, &doc, &path, descendants(p, cmd)?, cmd)?;
+    out["component"] = json!(id);
+    out["name"] = json!(name);
+    Ok(out)
+}
+
+pub(super) fn occurrence(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "occurrence.properties";
+    let id = super::occurrence(s, p, cmd)?;
+    let doc = placed_doc(s);
+    let path = if p.get("path").is_some() {
+        super::occurrence_path(s, p, id, cmd)?
+    } else {
+        let paths: Vec<Vec<u64>> =
+            placements(&doc, cmd)?.into_iter().filter(|(_, path, _)| path.last() == Some(&id)).map(|(_, path, _)| path).collect();
+        match paths.as_slice() {
+            [path] => path.clone(),
+            [] => return Err(bad(cmd, "occurrence has no placement")),
+            _ => return Err(bad(cmd, "occurrence has multiple placements; supply its `path`")),
+        }
+    };
+    let mut out = properties(s, &doc, &path, descendants(p, cmd)?, cmd)?;
+    out["occurrence"] = json!(id);
+    out["name"] = json!(doc.occurrences.iter().find(|o| o.id == id).map(|o| o.name.as_str()));
+    Ok(out)
+}
+
+fn properties(s: &Session, doc: &Document, selected: &[u64], descendants: bool, cmd: &str) -> Result<Value> {
+    let state = s.model.state();
+    let mut bodies = Vec::new();
+    let (mut volume, mut area, mut mass) = (0.0, 0.0, 0.0);
+    let mut moment = Vec3::ZERO;
+    let (mut min, mut max) =
+        (Vec3::new(f64::INFINITY, f64::INFINITY, f64::INFINITY), Vec3::new(f64::NEG_INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY));
+    let (mut faces, mut edges, mut vertices) = (0, 0, 0);
+    let mut placement_count = 0;
+    let selected_placements = if selected.is_empty() {
+        if descendants { placements(doc, cmd)? } else { vec![(0, Vec::new(), solvecraft_doc::IDENTITY)] }
+    } else {
+        let placement = s.occurrence_placement(selected).map_err(|e| bad(cmd, e.to_string()))?;
+        let mut out = vec![(placement.component, selected.to_vec(), placement.world)];
+        let mut stack = if descendants { out.clone() } else { Vec::new() };
+        while let Some((component, path, transform)) = stack.pop() {
+            for occurrence in doc.occurrences.iter().filter(|o| o.parent == component) {
+                if path.len() >= 64 || out.len() >= 100_000 {
+                    return Err(bad(cmd, "assembly exceeds physical-properties traversal limits (64 levels or 100000 placements)"));
+                }
+                let mut child = path.clone();
+                child.push(occurrence.id);
+                let world = solvecraft_doc::mat_mul(&transform, &occurrence.transform);
+                out.push((occurrence.component, child.clone(), world));
+                stack.push((occurrence.component, child, world));
+            }
+        }
+        out
+    };
+    for (component, path, transform) in selected_placements {
+        placement_count += 1;
+        for body in state.bodies.iter().filter(|b| doc.model_body_component(b) == component) {
+            let transform: Mat = doc.model_body_offset(body).map(|offset| solvecraft_doc::mat_mul(&transform, offset)).unwrap_or(transform);
+            let placed = solvecraft_kernel::transform_matrix(&body.body, transform)?;
+            let measured = solvecraft_kernel::measure(&placed)?;
+            let density = doc.density(&body.name);
+            let body_mass = measured.volume * density / 1000.0;
+            volume += measured.volume;
+            area += measured.area;
+            mass += body_mass;
+            moment += measured.centroid * body_mass;
+            min = Vec3::new(min.x.min(measured.bbox.min.x), min.y.min(measured.bbox.min.y), min.z.min(measured.bbox.min.z));
+            max = Vec3::new(max.x.max(measured.bbox.max.x), max.y.max(measured.bbox.max.y), max.z.max(measured.bbox.max.z));
+            faces += measured.merged.faces;
+            edges += measured.merged.edges;
+            vertices += measured.merged.vertices;
+            bodies.push(json!({"name": body.name, "component": component, "path": path,
+                "material": doc.materials.get(&body.name).map(String::as_str).unwrap_or("Default"),
+                "density_g_cm3": density, "mass_g": body_mass, "volume_mm3": measured.volume,
+                "area_mm2": measured.area, "center_of_mass": measured.centroid,
+                "bbox": {"min": measured.bbox.min, "max": measured.bbox.max}}));
+        }
+    }
+    if !(volume.is_finite() && area.is_finite() && mass.is_finite() && moment.is_finite()) {
+        return Err(bad(cmd, "physical properties exceed supported numeric range"));
+    }
+    let centroid = if mass > 0.0 { Some(moment / mass) } else { None };
+    if centroid.is_some_and(|point| !point.is_finite()) {
+        return Err(bad(cmd, "center of mass exceeds supported numeric range"));
+    }
+    let bbox = if bodies.is_empty() { Value::Null } else { json!({"min": min, "max": max}) };
+    Ok(json!({"path": selected, "coordinate_frame": "world", "descendants": descendants,
+        "placement_count": placement_count, "body_count": bodies.len(), "bodies": bodies,
+        "total": {"volume_mm3": volume, "area_mm2": area, "mass_g": mass,
+            "center_of_mass": centroid, "bbox": bbox, "faces": faces, "edges": edges, "vertices": vertices}}))
+}
+
+#[cfg(test)]
+#[path = "component_properties_tests.rs"]
+mod tests;

crates/engine/src/cmd/component_properties_tests.rs

@@ -0,0 +1,129 @@
+use crate::Session;
+use serde_json::{Value, json};
+
+fn run(s: &mut Session, cmd: &str, params: Value) -> Value {
+    s.execute(cmd, &params).unwrap()
+}
+fn close(actual: &Value, expected: f64) {
+    assert!((actual.as_f64().unwrap() - expected).abs() < 1e-6, "{actual} != {expected}");
+}
+fn box_in(s: &mut Session, name: &str) -> (u64, u64, String) {
+    let c = run(s, "component.create", json!({"name": name}));
+    run(s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+    let body = s.model.state().bodies.last().unwrap().name.clone();
+    (c["component"].as_u64().unwrap(), c["occurrence"].as_u64().unwrap(), body)
+}
+
+#[test]
+fn assembly_counts_instances_and_resolves_original_materials() {
+    let mut s = Session::default();
+    let (component, occurrence, body) = box_in(&mut s, "Block");
+    run(&mut s, "material.assign", json!({"bodies": [body], "material": "Steel"}));
+    let copy = run(&mut s, "occurrence.copy", json!({"component": component, "translate": [20, 0, 0]}));
+    let rho = s.doc.density(&body);
+    let root = run(&mut s, "component.properties", json!({"component": "root"}));
+    assert_eq!(root["body_count"], 2);
+    close(&root["total"]["mass_g"], 2.0 * rho);
+    close(&root["total"]["volume_mm3"], 2000.0);
+    close(&root["total"]["center_of_mass"][0], 15.0);
+    let first = run(&mut s, "component.properties", json!({"component": component}));
+    assert_eq!(first["body_count"], 1);
+    close(&first["total"]["center_of_mass"][0], 5.0);
+    let second = run(&mut s, "occurrence.properties", json!({"occurrence": copy["occurrence"]}));
+    close(&second["total"]["center_of_mass"][0], 25.0);
+    assert_eq!(second["bodies"][0]["material"], "Steel");
+    assert_eq!(first["path"], json!([occurrence]));
+}
+
+#[test]
+fn mass_centroid_is_density_weighted_and_pending_moves_are_read_only() {
+    let mut s = Session::default();
+    let (a, oa, steel) = box_in(&mut s, "Steel block");
+    run(&mut s, "material.assign", json!({"bodies": [steel], "material": "Steel"}));
+    run(&mut s, "component.activate", json!({"component": "root"}));
+    let (_, ob, plastic) = box_in(&mut s, "Plastic block");
+    run(&mut s, "material.assign", json!({"bodies": [plastic], "material": "ABS Plastic"}));
+    run(&mut s, "occurrence.move", json!({"occurrence": ob, "translate": [30, 0, 0], "capture": false}));
+    let doc = s.doc.clone();
+    let moves = s.pending_moves.clone();
+    let r = run(&mut s, "component.properties", json!({"component": 0}));
+    let ra = s.doc.density(&steel);
+    let rb = s.doc.density(&plastic);
+    close(&r["total"]["center_of_mass"][0], (5.0 * ra + 35.0 * rb) / (ra + rb));
+    close(&r["total"]["bbox"]["max"][0], 40.0);
+    assert!(std::sync::Arc::ptr_eq(&s.doc, &doc));
+    assert_eq!(s.pending_moves, moves);
+    run(&mut s, "occurrence.move", json!({"occurrence": oa, "translate": [10, 0, 0], "axis": [0, 0, 1], "angle": "90 deg"}));
+    let r = run(&mut s, "component.properties", json!({"component": a}));
+    close(&r["total"]["center_of_mass"][0], 5.0);
+    close(&r["total"]["center_of_mass"][1], 5.0);
+}
+
+#[test]
+fn nested_instances_require_a_path_and_can_exclude_descendants() {
+    let mut s = Session::default();
+    let parent = run(&mut s, "component.create", json!({"name": "Assembly"}));
+    let (_, child_occurrence, _) = box_in(&mut s, "Child");
+    let copy = run(&mut s, "occurrence.copy", json!({"component": parent["component"], "translate": [100, 0, 0]}));
+    assert!(s.execute("occurrence.properties", &json!({"occurrence": child_occurrence})).is_err());
+    let r = run(&mut s, "occurrence.properties", json!({"occurrence": child_occurrence, "path": [copy["occurrence"], child_occurrence]}));
+    close(&r["total"]["center_of_mass"][0], 105.0);
+    let r = run(&mut s, "component.properties", json!({"component": parent["component"]}));
+    assert_eq!(r["body_count"], 1);
+    let r = run(&mut s, "component.properties", json!({"component": parent["component"], "descendants": false}));
+    assert_eq!(r["body_count"], 0);
+    assert!(r["total"]["center_of_mass"].is_null());
+    assert!(r["total"]["bbox"].is_null());
+}
+
+#[test]
+fn body_reassignment_offsets_preserve_world_properties() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+    let body = s.model.state().bodies.first().unwrap().name.clone();
+    let c = run(&mut s, "component.create", json!({"name": "Moved"}));
+    run(&mut s, "occurrence.move", json!({"occurrence": c["occurrence"], "translate": [100, 0, 0]}));
+    run(&mut s, "component.move_bodies", json!({"bodies": [body], "component": c["component"]}));
+    let r = run(&mut s, "component.properties", json!({"component": c["component"]}));
+    close(&r["total"]["center_of_mass"][0], 5.0);
+}
+
+#[test]
+fn properties_reject_hostile_identifiers_and_options() {
+    let mut s = Session::default();
+    let (_, occurrence, _) = box_in(&mut s, "Block");
+    for p in [json!({"component": []}), json!({"component": "missing"}), json!({"descendants": 1})] {
+        assert!(s.execute("component.properties", &p).is_err());
+    }
+    for path in [json!([]), json!(["bad"]), json!([0]), json!(vec![occurrence; 65])] {
+        assert!(s.execute("occurrence.properties", &json!({"occurrence": occurrence, "path": path})).is_err());
+    }
+}
+
+#[test]
+fn compact_exponentially_instanced_assembly_refuses_partial_totals() {
+    let mut s = Session::default();
+    let mut last_occurrence = 0;
+    // Only 17 component definitions and 34 occurrences, but over 100000 placements.
+    for _ in 0..17 {
+        let parent = s.active_component;
+        let component = s.doc_mut().add_component(None, parent).unwrap();
+        last_occurrence = s.doc_mut().add_occurrence(component, parent, solvecraft_doc::IDENTITY).unwrap();
+        s.active_component = component;
+    }
+    for command in ["component.properties", "occurrence.properties"] {
+        let error = s.execute(command, &json!({"component": 0, "occurrence": last_occurrence})).unwrap_err();
+        assert!(error.to_string().contains("traversal limits"), "{error}");
+    }
+}
+
+#[test]
+fn excessively_nested_assembly_refuses_partial_totals() {
+    let mut s = Session::default();
+    for _ in 0..65 {
+        let parent = s.active_component;
+        s.active_component = s.doc_mut().add_component(None, parent).unwrap();
+    }
+    let error = s.execute("component.properties", &json!({"component": 0})).unwrap_err();
+    assert!(error.to_string().contains("traversal limits"), "{error}");
+}

crates/engine/src/cmd/component_transfer.rs

@@ -0,0 +1,153 @@
+//! Atomic timeline ownership changes, preserving the selected world geometry.
+use super::*;
+use std::collections::{BTreeMap, BTreeSet};
+
+type UniqueFrames = BTreeMap<u64, Option<(Vec<u64>, Mat)>>;
+
+fn unique_frames(s: &Session, cmd: &str) -> Result<UniqueFrames> {
+    let doc = s.placed_document();
+    let mut children = BTreeMap::<u64, Vec<&Occurrence>>::new();
+    for occurrence in &doc.occurrences {
+        children.entry(occurrence.parent).or_default().push(occurrence);
+    }
+    let mut frames = BTreeMap::from([(0, Some((Vec::new(), solvecraft_doc::IDENTITY)))]);
+    let mut stack = vec![(0, Vec::new(), solvecraft_doc::IDENTITY)];
+    let mut work = 0usize;
+    while let Some((component, path, matrix)) = stack.pop() {
+        for occurrence in children.get(&component).into_iter().flatten() {
+            work += 1;
+            if path.len() >= 64 || work > 100_000 {
+                return Err(bad(cmd, "transfer assembly exceeds 64 levels or 100000 placements"));
+            }
+            let mut child_path = path.clone();
+            child_path.push(occurrence.id);
+            let frame = solvecraft_doc::mat_mul(&matrix, &occurrence.transform);
+            frames.entry(occurrence.component).and_modify(|entry| *entry = None).or_insert_with(|| Some((child_path.clone(), frame)));
+            stack.push((occurrence.component, child_path, frame));
+        }
+    }
+    Ok(frames)
+}
+
+fn body_names(s: &Session, p: &Value, cmd: &str, allow_boundary: bool) -> Result<Vec<String>> {
+    if p.get("bodies").and_then(Value::as_array).is_none_or(|names| names.iter().any(|name| !name.is_string())) {
+        return Err(bad(cmd, "bodies must be an array of body names"));
+    }
+    let names = string_list(p, "bodies");
+    if names.is_empty() || names.len() > 1000 || names.iter().collect::<BTreeSet<_>>().len() != names.len() {
+        return Err(bad(cmd, "bodies must list 1..1000 distinct existing definition bodies"));
+    }
+    if s.doc.marker.is_some() && !allow_boundary {
+        return Err(bad(cmd, "finish timeline rollback before transferring bodies"));
+    }
+    let state = s.model.state();
+    for name in &names {
+        if state.body(name).is_none() {
+            return Err(bad(cmd, format!("no body `{name}`")));
+        }
+    }
+    Ok(names)
+}
+
+fn transfer(s: &mut Session, name: &str, to: u64, frames: &UniqueFrames, cmd: &str) -> Result<u64> {
+    let state = s.model.state();
+    let body = state.body(name).ok_or_else(|| bad(cmd, "body is missing"))?;
+    let from = s.doc.model_body_component(body);
+    let doc = s.placed_document();
+    let unique = |component| {
+        frames.get(&component).and_then(Option::as_ref).ok_or_else(|| {
+            bad(cmd, "body transfer requires one source and destination placement; shared instances cannot preserve a unique world pose")
+        })
+    };
+    let source = unique(from)?;
+    let destination = unique(to)?;
+    let old = doc.model_body_offset(body).map(|offset| solvecraft_doc::mat_mul(&source.1, offset)).unwrap_or(source.1);
+    let inv = solvecraft_doc::mat_inverse(&destination.1).ok_or_else(|| bad(cmd, "destination frame is not invertible"))?;
+    let transform = solvecraft_doc::mat_mul(&inv, &old);
+    if !solvecraft_doc::valid_transfer_matrix(&transform) {
+        return Err(bad(cmd, "body transfer exceeds supported rigid coordinate range"));
+    }
+    let inherited = (!s.doc.appearances.bodies.contains_key(name)).then(|| s.doc.appearances.components.get(&from).cloned()).flatten();
+    let paths: BTreeSet<u64> = source.0.iter().chain(&destination.0).copied().collect();
+    let captures: Vec<_> = paths.into_iter().filter_map(|id| s.pending_moves.get(&id).map(|transform| (id, *transform))).collect();
+    if captures.iter().any(|(_, transform)| !solvecraft_doc::valid_transfer_matrix(transform)) {
+        return Err(bad(cmd, "pending transfer position is not a supported rigid transform"));
+    }
+    drop(doc);
+    for (id, transform) in captures {
+        if let Some(occurrence) = s.doc_mut().occurrences.iter_mut().find(|occurrence| occurrence.id == id) {
+            occurrence.transform = transform;
+        }
+        s.pending_moves.remove(&id);
+    }
+    if let Some(look) = inherited {
+        s.doc_mut().appearances.bodies.insert(name.to_string(), look);
+    }
+    let id = s.doc_mut().add_feature(FeatureKind::BodyTransfer { bodies: vec![name.to_string()], from, to, transform }, None)?;
+    if let Some(feature) = s.doc_mut().feature_mut(id) {
+        feature.component = to;
+    }
+    Ok(id)
+}
+
+fn finish(s: &mut Session, scratch: &mut Session, features: &[u64], cmd: &str) -> Result<()> {
+    scratch.refresh();
+    for id in features {
+        if let Some(error) = scratch.model.result(*id).and_then(|result| result.error.as_ref()) {
+            return Err(bad(cmd, error));
+        }
+    }
+    s.accept_computed(std::mem::take(scratch));
+    Ok(())
+}
+
+pub(super) fn from_bodies(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "component.from_bodies";
+    let bodies = body_names(s, p, cmd, false)?;
+    let mut scratch = s.scratch();
+    let parent = s.active_component;
+    let mut made = Vec::new();
+    let mut targets = Vec::new();
+    for name in &bodies {
+        let component = scratch.doc_mut().add_component(Some(name), parent)?;
+        targets.push(component);
+    }
+    let frames = unique_frames(&scratch, cmd)?;
+    let mut features = Vec::new();
+    for (name, component) in bodies.into_iter().zip(targets) {
+        let feature = transfer(&mut scratch, &name, component, &frames, cmd)?;
+        features.push(feature);
+        made.push(json!({"component":component,"body":name,"feature":feature}));
+    }
+    finish(s, &mut scratch, &features, cmd)?;
+    Ok(json!({"components":made}))
+}
+
+pub(super) fn move_bodies(s: &mut Session, p: &Value) -> Result<Value> {
+    move_at_boundary(s, p, false)
+}
+
+/// A solid constructor can attach its result immediately after the new feature,
+/// including inside the scratch timeline used by Edit Feature.
+pub(super) fn move_result(s: &mut Session, p: &Value) -> Result<Value> {
+    move_at_boundary(s, p, true)
+}
+
+fn move_at_boundary(s: &mut Session, p: &Value, allow_boundary: bool) -> Result<Value> {
+    let cmd = "component.move_bodies";
+    let to = super::component(s, p, "component", cmd)?;
+    let bodies = body_names(s, p, cmd, allow_boundary)?;
+    let mut scratch = s.scratch();
+    let frames = unique_frames(&scratch, cmd)?;
+    let mut features = Vec::new();
+    for name in &bodies {
+        features.push(transfer(&mut scratch, name, to, &frames, cmd)?);
+    }
+    finish(s, &mut scratch, &features, cmd)?;
+    Ok(json!({"bodies":bodies,"component":to,"features":features}))
+}
+
+#[cfg(test)]
+#[path = "component_transfer_tests.rs"]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod tests;

crates/engine/src/cmd/component_transfer_tests.rs

@@ -0,0 +1,287 @@
+use super::*;
+
+fn run(s: &mut Session, command: &str, params: Value) -> Value {
+    s.execute(command, &params).unwrap()
+}
+
+#[test]
+fn recorded_assignment_preserves_sample_joined_material_and_timeline() {
+    let mut s = Session::default();
+    s.run_script(&crate::sample::script()).unwrap();
+    let before = s.model.state();
+    assert_eq!(before.bodies.len(), 1);
+    let volume = solvecraft_kernel::measure(&before.body("Plate").unwrap().body).unwrap().volume;
+    let created = run(&mut s, "component.from_bodies", json!({"bodies":["Plate"]}));
+    let to = created["components"][0]["component"].as_u64().unwrap();
+    let feature = created["components"][0]["feature"].as_u64().unwrap();
+    let after = s.model.state();
+    assert_eq!(after.bodies.len(), 1);
+    let body = after.body("Plate").unwrap();
+    assert_eq!(body.component, to);
+    assert!(body.transferred);
+    assert!((solvecraft_kernel::measure(&body.body).unwrap().volume - volume).abs() < 1e-6);
+    assert!(body.mesh().contains(Vec3::new(40.0, 35.0, 12.0)));
+    let index = s.doc.feature_index(feature).unwrap();
+    s.doc_mut().marker = Some(index);
+    s.refresh();
+    assert_eq!(s.world_state().body("Plate").unwrap().component, 0);
+    s.doc_mut().marker = None;
+    s.refresh();
+    assert_eq!(s.world_state().body("Plate").unwrap().component, to);
+}
+
+#[test]
+fn transformed_pending_destination_repeated_transfer_preserves_world_pose() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    let created = run(&mut s, "component.create", json!({"name":"Destination"}));
+    let to = created["component"].as_u64().unwrap();
+    let occurrence = created["occurrence"].as_u64().unwrap();
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[30,20,0],"angle":90,"axis":[0,0,1],"capture":false}));
+    run(&mut s, "component.move_bodies", json!({"component":to,"bodies":["Block"]}));
+    let state = s.world_state();
+    let bounds = state.body("Block").unwrap().mesh().bounds();
+    assert!(bounds.min.dist(Vec3::ZERO) < 1e-6);
+    assert!(bounds.max.dist(Vec3::new(10.0, 10.0, 10.0)) < 1e-6);
+    assert!(!s.pending_moves.contains_key(&occurrence));
+    let mut destination_reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    destination_reopened.refresh();
+    assert!(destination_reopened.world_state().body("Block").unwrap().mesh().bounds().min.dist(Vec3::ZERO) < 1e-6);
+    run(&mut s, "component.move_bodies", json!({"component":0,"bodies":["Block"]}));
+    assert!(s.world_state().body("Block").unwrap().mesh().bounds().min.dist(Vec3::ZERO) < 1e-6);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!(reopened.world_state().body("Block").unwrap().mesh().bounds().min.dist(Vec3::ZERO) < 1e-6);
+}
+
+#[test]
+fn shared_destination_refuses_without_mutating_document_or_session() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    let c = run(&mut s, "component.create", json!({"name":"Shared"}))["component"].as_u64().unwrap();
+    run(&mut s, "occurrence.copy", json!({"component":c,"translate":[20,0,0]}));
+    let document = s.doc.to_json();
+    let active = s.active_component;
+    assert!(s.execute("component.move_bodies", &json!({"component":c,"bodies":["Block"]})).is_err());
+    assert_eq!(s.doc.to_json(), document);
+    assert_eq!(s.active_component, active);
+}
+
+#[test]
+fn historical_join_cut_and_new_destination_modeling_keep_material() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    run(&mut s, "solid.box", json!({"corner":[8,0,0],"length":10,"width":10,"height":10,"operation":"join"}));
+    run(&mut s, "solid.box", json!({"corner":[2,2,0],"length":2,"width":2,"height":10,"operation":"cut"}));
+    let original = s.model.state();
+    assert_eq!(original.bodies.len(), 1);
+    let v = solvecraft_kernel::measure(&original.body("Block").unwrap().body).unwrap().volume;
+    assert!((v - 1760.0).abs() < 1e-6);
+    run(&mut s, "material.assign", json!({"bodies":["Block"],"material":"Brass"}));
+    run(&mut s, "appearance.assign", json!({"bodies":["Block"],"color":"#bc8537"}));
+    let created = run(&mut s, "component.from_bodies", json!({"bodies":["Block"]}));
+    let c = created["components"][0]["component"].as_u64().unwrap();
+    assert_eq!(s.doc.materials["Block"], "Brass");
+    assert_eq!(s.doc.appearances.bodies["Block"].color, [188, 133, 55]);
+    run(&mut s, "component.activate", json!({"component":c}));
+    run(&mut s, "solid.box", json!({"corner":[18,0,0],"length":2,"width":10,"height":10,"operation":"join"}));
+    assert_eq!(s.model.state().bodies.len(), 1);
+    assert_eq!(s.model.state().body("Block").unwrap().component, c);
+    let final_volume = solvecraft_kernel::measure(&s.model.state().body("Block").unwrap().body).unwrap().volume;
+    assert!((final_volume - 1960.0).abs() < 1e-6);
+    run(&mut s, "component.move_bodies", json!({"component":0,"bodies":["Block"]}));
+    assert_eq!(s.model.state().body("Block").unwrap().component, 0);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.model.state().body("Block").unwrap().component, c);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!((solvecraft_kernel::measure(&reopened.model.state().body("Block").unwrap().body).unwrap().volume - final_volume).abs() < 1e-6);
+}
+
+#[test]
+fn ownership_only_boundary_invalidates_old_boolean_cache() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    run(&mut s, "solid.box", json!({"corner":[8,0,0],"length":10,"width":10,"height":10,"operation":"join"}));
+    assert_eq!(s.model.state().bodies.len(), 1);
+    let c = s.doc_mut().add_component(Some("Destination"), 0).unwrap();
+    let id = s
+        .doc_mut()
+        .add_feature(FeatureKind::BodyTransfer { bodies: vec!["Block".into()], from: 0, to: c, transform: solvecraft_doc::IDENTITY }, None)
+        .unwrap();
+    let index = s.doc.feature_index(id).unwrap();
+    let transfer = s.doc_mut().features.remove(index);
+    s.doc_mut().features.insert(1, transfer);
+    s.refresh();
+    assert_eq!(s.model.state().bodies.len(), 2);
+    assert_eq!(s.model.state().body("Block").unwrap().component, c);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert_eq!(reopened.model.state().bodies.len(), 2);
+    assert_eq!(reopened.model.state().body("Block").unwrap().component, c);
+}
+
+#[test]
+fn failed_transfer_cannot_change_evaluated_world_owner() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    let c = s.doc_mut().add_component(Some("Destination"), 0).unwrap();
+    let id = s
+        .doc_mut()
+        .add_feature(FeatureKind::BodyTransfer { bodies: vec!["Block".into()], from: c, to: c, transform: solvecraft_doc::IDENTITY }, None)
+        .unwrap();
+    s.refresh();
+    assert!(s.model.result(id).unwrap().error.is_some());
+    assert_eq!(s.world_state().body("Block").unwrap().component, 0);
+}
+
+#[test]
+fn transferred_thread_follows_body_frame_without_changing_world_axis() {
+    let mut s = Session::default();
+    run(&mut s, "solid.cylinder", json!({"radius":4,"height":20,"body_name":"Shaft"}));
+    run(&mut s, "solid.thread", json!({"face":[4,0,10],"designation":"M8"}));
+    let before = s.world_state().threads[0].clone();
+    let c = run(&mut s, "component.create", json!({"name":"Threaded"}));
+    let to = c["component"].as_u64().unwrap();
+    let occurrence = c["occurrence"].as_u64().unwrap();
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[30,20,10],"axis":[1,0,0],"angle":90,"capture":true}));
+    run(&mut s, "component.move_bodies", json!({"component":to,"bodies":["Shaft"]}));
+    let after = s.world_state().threads[0].clone();
+    assert!(after.axis_point.dist(before.axis_point) < 1e-6);
+    assert!(after.axis.dist(before.axis) < 1e-6);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!(reopened.world_state().threads[0].axis.dist(before.axis) < 1e-6);
+}
+
+#[test]
+fn inherited_component_appearance_and_legacy_assignment_survive_transfer() {
+    let mut s = Session::default();
+    let source = run(&mut s, "component.create", json!({"name":"Source"}))["component"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Block"}));
+    s.doc_mut().appearances.components.insert(source, solvecraft_doc::appearance::Look { name: "Green".into(), color: [0, 150, 0], opacity: 0.7 });
+    s.refresh();
+    let look = s.doc.model_body_look(s.model.state().body("Block").unwrap()).unwrap();
+    run(&mut s, "component.move_bodies", json!({"component":0,"bodies":["Block"]}));
+    assert_eq!(s.doc.model_body_look(s.model.state().body("Block").unwrap()), Some(look));
+    // An unrecorded legacy assignment retains its established replay policy.
+    let mut legacy = Session::default();
+    run(&mut legacy, "solid.box", json!({"length":10,"width":10,"height":10,"body_name":"Old"}));
+    let c = legacy.doc_mut().add_component(Some("Legacy"), 0).unwrap();
+    legacy.doc_mut().body_components.insert("Old".into(), c);
+    legacy.doc_mut().body_offsets.insert("Old".into(), solvecraft_doc::rigid(Vec3::new(7.0, 0.0, 0.0), Vec3::ZERO, Vec3::Z, 0.0));
+    legacy.refresh();
+    assert!(!legacy.model.state().body("Old").unwrap().transferred);
+    run(&mut legacy, "component.move_bodies", json!({"component":0,"bodies":["Old"]}));
+    assert!((legacy.world_state().body("Old").unwrap().mesh().bounds().min.x - 7.0).abs() < 1e-6);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&legacy.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!((reopened.world_state().body("Old").unwrap().mesh().bounds().min.x - 7.0).abs() < 1e-6);
+}
+
+#[test]
+fn deleting_external_transfer_source_refuses_without_dangling_archive() {
+    let mut s = Session::default();
+    let a = run(&mut s, "component.create", json!({"name":"Source"}))["component"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Block"}));
+    run(&mut s, "component.activate", json!({"component":0}));
+    let b = run(&mut s, "component.create", json!({"name":"Destination"}))["component"].as_u64().unwrap();
+    run(&mut s, "component.move_bodies", json!({"component":b,"bodies":["Block"]}));
+    let document = s.doc.to_json();
+    assert!(s.execute("component.delete", &json!({"component":a})).is_err());
+    assert_eq!(s.doc.to_json(), document);
+    assert!(solvecraft_doc::Document::from_json(&document).is_ok());
+}
+
+#[test]
+fn earlier_selected_cylinder_emboss_keeps_source_frame_after_transfer_and_edit() {
+    let mut s = Session::default();
+    let source = run(&mut s, "component.create", json!({"name":"Source"}));
+    let occurrence = source["occurrence"].as_u64().unwrap();
+    run(&mut s, "solid.cylinder", json!({"radius":10,"height":20,"body_name":"Sleeve"}));
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[30,0,0],"capture":true}));
+    run(&mut s, "sketch.create", json!({"name":"Badge","plane":{"origin":[30,10,0],"x_dir":[-1,0,0],"y_dir":[0,0,1]}}));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[-2,5],"p1":[2,10]}));
+    run(&mut s, "sketch.finish", json!({}));
+    let emboss = run(&mut s, "solid.emboss", json!({"sketch":"Badge","face":[30,10,7.5],"depth":1}))["feature"].as_u64().unwrap();
+    let before = solvecraft_kernel::measure(&s.world_state().body("Sleeve").unwrap().body).unwrap().volume;
+    run(&mut s, "component.activate", json!({"component":0}));
+    let destination = run(&mut s, "component.create", json!({"name":"Destination"}));
+    let to = destination["component"].as_u64().unwrap();
+    let destination_occurrence = destination["occurrence"].as_u64().unwrap();
+    run(&mut s, "occurrence.move", json!({"occurrence":destination_occurrence,"translate":[0,40,0],"axis":[1,0,0],"angle":90,"capture":true}));
+    run(&mut s, "component.move_bodies", json!({"component":to,"bodies":["Sleeve"]}));
+    assert!(s.doc.features.iter().all(|feature| s.model.result(feature.id).is_some_and(|result| result.error.is_none())));
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert!(reopened.doc.features.iter().all(|feature| reopened.model.result(feature.id).is_some_and(|result| result.error.is_none())));
+    assert!((solvecraft_kernel::measure(&reopened.world_state().body("Sleeve").unwrap().body).unwrap().volume - before).abs() < 1e-5);
+    let depth = reopened.doc.feature(emboss).unwrap().param_names[0].clone();
+    run(&mut reopened, "parameters.change", json!({"name":depth,"expression":"2 mm"}));
+    assert!(solvecraft_kernel::measure(&reopened.world_state().body("Sleeve").unwrap().body).unwrap().volume > before);
+}
+
+#[test]
+fn transfer_undo_redo_restores_original_pending_source_world_pose() {
+    let mut s = Session::default();
+    let created = run(&mut s, "component.create", json!({"name":"Source"}));
+    let source = created["component"].as_u64().unwrap();
+    let occurrence = created["occurrence"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Block"}));
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[10,0,0],"capture":false}));
+    let pending = s.pending_moves.clone();
+    let before = s.world_state().body("Block").unwrap().mesh().bounds();
+    run(&mut s, "component.move_bodies", json!({"component":0,"bodies":["Block"]}));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.pending_moves, pending);
+    assert_eq!(s.world_state().body("Block").unwrap().component, source);
+    assert!(s.world_state().body("Block").unwrap().mesh().bounds().min.dist(before.min) < 1e-6);
+    run(&mut s, "edit.redo", json!({}));
+    assert!(s.pending_moves.is_empty());
+    assert_eq!(s.world_state().body("Block").unwrap().component, 0);
+    assert!(s.world_state().body("Block").unwrap().mesh().bounds().min.dist(before.min) < 1e-6);
+}
+
+#[test]
+fn transfer_checkpoint_restores_pending_world_pose_and_history() {
+    let mut s = Session::default();
+    let created = run(&mut s, "component.create", json!({"name":"Source"}));
+    let source = created["component"].as_u64().unwrap();
+    let occurrence = created["occurrence"].as_u64().unwrap();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Block"}));
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[10,0,0],"capture":false}));
+    let pending = s.pending_moves.clone();
+    let before = s.world_state().body("Block").unwrap().mesh().bounds();
+    let undo_count = s.undo.len();
+    let checkpoint = s.checkpoint();
+    run(&mut s, "component.move_bodies", json!({"component":0,"bodies":["Block"]}));
+    s.restore_checkpoint(checkpoint).unwrap();
+    assert_eq!(s.pending_moves, pending);
+    assert_eq!(s.undo.len(), undo_count);
+    assert_eq!(s.world_state().body("Block").unwrap().component, source);
+    assert!(s.world_state().body("Block").unwrap().mesh().bounds().min.dist(before.min) < 1e-6);
+}
+
+#[test]
+fn edited_transfer_destination_updates_history_owner_copy_and_reopen() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length":2,"width":2,"height":2,"body_name":"Block"}));
+    let a = run(&mut s, "component.create", json!({"name":"A","parent":0}))["component"].as_u64().unwrap();
+    let b = run(&mut s, "component.create", json!({"name":"B","parent":0}))["component"].as_u64().unwrap();
+    let transferred = run(&mut s, "component.move_bodies", json!({"component":a,"bodies":["Block"]}));
+    let feature = transferred["features"][0].as_u64().unwrap();
+    run(&mut s, "timeline.edit", json!({"feature":feature,"set":{"to":b,"component":a}}));
+    assert_eq!(s.doc.feature(feature).unwrap().component, b);
+    assert_eq!(s.model.state().body("Block").unwrap().component, b);
+    let saved = s.doc.to_json();
+    let pending = s.pending_moves.clone();
+    assert!(s.execute("timeline.edit", &json!({"feature":feature,"set":{"to":u64::MAX}})).is_err());
+    assert_eq!(s.doc.to_json(), saved);
+    assert_eq!(s.pending_moves, pending);
+    let copied = run(&mut s, "component.paste_new", json!({"component":b}))["component"].as_u64().unwrap();
+    assert_eq!(s.model.state().body("Block (copy)").unwrap().component, copied);
+    let mut reopened = Session { doc: solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap().into(), ..Session::default() };
+    reopened.refresh();
+    assert_eq!(reopened.model.state().body("Block").unwrap().component, b);
+    assert_eq!(reopened.model.state().body("Block (copy)").unwrap().component, copied);
+}

crates/engine/src/cmd/config.rs

@@ -9,22 +9,91 @@ use crate::params::{bad, bool_, str_, string_list};
 use crate::{Result, Session};
 
 pub static COMMANDS: &[CommandSpec] = &[
-    CommandSpec::new("FusionStartDesignConfigModeCmd", "Configure", configure).at("SOLID", "CONFIGURE").icon("params").params(
-        "params?: [parameter names]; features?: [feature names] (columns to add; with no rows yet, a \"Default\" row takes the current values)",
+    CommandSpec::new("config.configure", "Configure", configure).at("SOLID", "CONFIGURE").icon("params").params(
+        "params?: [parameter names]; features?: [feature names]; materials?: [body names]; appearances?: [body names] (columns to add; with no rows yet, a \"Default\" row takes the current values)",
     ),
-    CommandSpec::new("FusionShowDesignConfigPanelCmd", "Display Configuration Table", show)
+    CommandSpec::new("config.table", "Display Configuration Table", show)
         .at("SOLID", "CONFIGURE")
         .icon("params")
         .noundo()
         .params("→ columns (param:<name> or suppress:<feature>), rows, the active row and whether the design still matches it"),
-    CommandSpec::new("config.column", "Configuration Column", column).params("param? | feature? (name); delete?: bool"),
+    CommandSpec::new("config.column", "Configuration Column", column).params("param? | feature? | material? | appearance? (target name); delete?: bool"),
     CommandSpec::new("config.row", "Configuration Row", row).params(
-        "name; from? (row to copy; default the current values); values?: {param name or feature name: expression or true/false}; rename?; delete?: bool",
+        "name; from? (row to copy; default current values); values?: {column key: expression, suppression, material name, appearance name or Look object}; rename?; delete?: bool",
     ),
     CommandSpec::new("config.activate", "Activate Configuration", activate).params("row: name — sets its parameter values and suppressions"),
+    CommandSpec::new("config.preview", "Preview Configuration", preview).noundo().params("row: name — validates a rebuild without changing the design or history"),
+    CommandSpec::new("config.rule", "Configuration Rule", rule).params("rule?: {id,name,enabled,condition,effect}; id? + delete?; id? + index? (ordered move)"),
+    CommandSpec::new("config.rules", "Configuration Rules", show).noundo().params("ordered typed rules, rows and active state"),
 ];
 
 fn column_of(s: &Session, p: &Value, cmd: &str) -> Result<Column> {
+    if ["param", "feature", "material", "appearance", "component_appearance", "face_appearance"].iter().filter(|k| p.get(**k).is_some()).count() != 1
+    {
+        return Err(bad(cmd, "give exactly one configuration target"));
+    }
+    if let Some(value) = p.get("component_appearance") {
+        let key = value
+            .as_str()
+            .map(str::to_string)
+            .or_else(|| value.as_u64().map(|id| id.to_string()))
+            .ok_or_else(|| bad(cmd, "component name or ID required"))?;
+        if bool_(p, "delete") == Some(true)
+            && let Some(column) = s.doc.configs.columns.iter().find(|column| matches!(column,Column::ComponentAppearance(id) if id.to_string()==key))
+        {
+            return Ok(column.clone());
+        }
+        let id = s
+            .doc
+            .find_component(&key)
+            .or_else(|| s.doc.occurrences.iter().find(|occurrence| occurrence.name == key).map(|occurrence| occurrence.component))
+            .filter(|id| *id != 0)
+            .ok_or_else(|| bad(cmd, "no component definition"))?;
+        return Ok(Column::ComponentAppearance(id));
+    }
+    if let Some(value) = p.get("face_appearance") {
+        if bool_(p, "delete") == Some(true) {
+            let key = value.as_str().ok_or_else(|| bad(cmd, "face column key required for deletion"))?;
+            return s
+                .doc
+                .configs
+                .columns
+                .iter()
+                .find(|column| matches!(column, Column::FaceAppearance(_)) && s.doc.config_key(column) == key)
+                .cloned()
+                .ok_or_else(|| bad(cmd, "no face column"));
+        }
+        if let Some(target) = value.get("target") {
+            solvecraft_doc::config::validate_face_target_json(target).map_err(|error| bad(cmd, error.to_string()))?;
+            let target: solvecraft_doc::config::ConfigFaceTarget =
+                serde_json::from_value(target.clone()).map_err(|error| bad(cmd, error.to_string()))?;
+            let state = s.model.state();
+            let body = state.body(&target.body).ok_or_else(|| bad(cmd, "no face definition"))?;
+            s.doc.configuration_face_indices(body, &target).map_err(|error| bad(cmd, error.to_string()))?;
+            return Ok(Column::FaceAppearance(target));
+        }
+        let body_name = value.get("body").and_then(Value::as_str).ok_or_else(|| bad(cmd, "face body required"))?;
+        let point = value.get("point").and_then(crate::params::vec3).ok_or_else(|| bad(cmd, "finite face point required"))?;
+        let world = s.world_state();
+        let body = world.body(body_name).ok_or_else(|| bad(cmd, "no face body"))?;
+        if body.body.is_mesh() {
+            return Err(bad(cmd, "mesh faces have no supported semantic lineage"));
+        }
+        let index = solvecraft_doc::appearance::face_index_at(body, point).ok_or_else(|| bad(cmd, "no face at picked point"))?;
+        let target = s.doc.configuration_face_target(body, index, point).map_err(|error| bad(cmd, error.to_string()))?;
+        s.doc.certify_config_face(&target).map_err(|error| bad(cmd, error.to_string()))?;
+        s.doc.configuration_face_indices(body, &target).map_err(|error| bad(cmd, error.to_string()))?;
+        return Ok(Column::FaceAppearance(target));
+    }
+    for (key, appearance) in [("material", false), ("appearance", true)] {
+        if let Some(body) = str_(p, key) {
+            let c = if appearance { Column::Appearance(body.to_string()) } else { Column::Material(body.to_string()) };
+            if !s.doc.configs.columns.contains(&c) && s.model.state().body(body).is_none() {
+                return Err(bad(cmd, format!("no body `{body}`")));
+            }
+            return Ok(c);
+        }
+    }
     if let Some(n) = str_(p, "param") {
         if !s.doc.all_param_exprs().iter().any(|(m, _, _)| m == n) {
             return Err(bad(cmd, format!("no parameter `{n}`")));
@@ -38,7 +107,9 @@ fn column_of(s: &Session, p: &Value, cmd: &str) -> Result<Column> {
 
 /// Add a column, filling existing rows with the design's current value.
 fn add_column(s: &mut Session, c: Column, cmd: &str) -> Result<()> {
-    if s.doc.configs.columns.contains(&c) {
+    if s.doc.configs.columns.iter().any(|existing| {
+        *existing == c || matches!((existing,&c),(Column::FaceAppearance(a),Column::FaceAppearance(b)) if a.body == b.body && a.name == b.name)
+    }) {
         return Ok(());
     }
     if s.doc.configs.columns.len() >= MAX_COLUMNS {
@@ -54,7 +125,7 @@ fn add_column(s: &mut Session, c: Column, cmd: &str) -> Result<()> {
 }
 
 fn configure(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "FusionStartDesignConfigModeCmd";
+    let cmd = "config.configure";
     for n in string_list(p, "params") {
         let c = column_of(s, &json!({ "param": n }), cmd)?;
         add_column(s, c, cmd)?;
@@ -63,6 +134,25 @@ fn configure(s: &mut Session, p: &Value) -> Result<Value> {
         let c = column_of(s, &json!({ "feature": n }), cmd)?;
         add_column(s, c, cmd)?;
     }
+    for key in ["materials", "appearances"] {
+        for n in string_list(p, key) {
+            let field = if key == "materials" { "material" } else { "appearance" };
+            let c = column_of(s, &json!({ field: n }), cmd)?;
+            add_column(s, c, cmd)?;
+        }
+    }
+    for (plural, singular) in [("component_appearances", "component_appearance"), ("face_appearances", "face_appearance")] {
+        if let Some(values) = p.get(plural) {
+            let values = values
+                .as_array()
+                .filter(|values| values.len() <= MAX_COLUMNS)
+                .ok_or_else(|| bad(cmd, "configuration targets must be a bounded array"))?;
+            for value in values {
+                let c = column_of(s, &json!({singular:value}), cmd)?;
+                add_column(s, c, cmd)?;
+            }
+        }
+    }
     if s.doc.configs.rows.is_empty() {
         let cells = s.doc.configs.columns.iter().map(|c| s.doc.config_current(c).unwrap_or_default()).collect();
         let t = &mut s.doc_mut().configs;
@@ -80,7 +170,26 @@ fn show(s: &mut Session, _p: &Value) -> Result<Value> {
         .iter()
         .map(|r| json!({"name": r.name, "values": keys.iter().zip(&r.cells).map(|(k, v)| (k.clone(), json!(v))).collect::<serde_json::Map<_, _>>()}))
         .collect();
-    Ok(json!({"columns": keys, "rows": rows, "active": t.active, "matches": s.doc.configuration_matches()}))
+    let targets: Vec<Value> = t
+        .columns
+        .iter()
+        .map(|column| {
+            let label = match column {
+                Column::ComponentAppearance(id) => {
+                    format!("Component: {}", s.doc.components.iter().find(|c| c.id == *id).map(|c| c.name.clone()).unwrap_or_else(|| id.to_string()))
+                }
+                Column::FaceAppearance(target) => {
+                    format!("Face: {} / {}", target.body, target.name.split_once(':').map(|(_, role)| role).unwrap_or(&target.name))
+                }
+                _ => s.doc.config_key(column),
+            };
+            json!({"key":s.doc.config_key(column),"label":label,"target":column})
+        })
+        .collect();
+    let styles = s.doc.configuration_style_status(&s.model.state());
+    Ok(
+        json!({"columns": keys, "targets":targets, "rows": rows, "rules": t.rules, "active": t.active, "matches": s.doc.configuration_matches() && styles.is_ok(), "style_status":styles.as_ref().ok(),"style_error":styles.err().map(|error|error.to_string())}),
+    )
 }
 
 fn column(s: &mut Session, p: &Value) -> Result<Value> {
@@ -98,6 +207,9 @@ fn column(s: &mut Session, p: &Value) -> Result<Value> {
     } else {
         add_column(s, c, cmd)?;
     }
+    if !s.doc.configs.rules.is_empty() {
+        validate_rows(s, cmd)?;
+    }
     show(s, p)
 }
 
@@ -107,6 +219,9 @@ fn row(s: &mut Session, p: &Value) -> Result<Value> {
     let idx = s.doc.configs.rows.iter().position(|r| r.name == name);
     if bool_(p, "delete").unwrap_or(false) {
         let i = idx.ok_or_else(|| bad(cmd, format!("no row `{name}`")))?;
+        if s.doc.configs.rows.len() == 1 && !s.doc.configs.rules.is_empty() {
+            return Err(bad(cmd, "delete rules before deleting the last configuration row"));
+        }
         let t = &mut s.doc_mut().configs;
         t.rows.remove(i);
         if t.active.as_deref() == Some(name.as_str()) {
@@ -122,33 +237,58 @@ fn row(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(vals) = p.get("values") {
         let vals = vals.as_object().ok_or_else(|| bad(cmd, "`values` must map columns to values"))?;
         for (k, v) in vals {
-            let text = match v {
+            let mut text = match v {
                 Value::String(t) => t.clone(),
                 Value::Bool(b) => b.to_string(),
                 Value::Number(n) => n.to_string(),
+                Value::Object(_) if k.starts_with("appearance:") || k.starts_with("component_appearance:") || k.starts_with("face_appearance:") => {
+                    serde_json::to_string(v).map_err(|e| bad(cmd, e.to_string()))?
+                }
                 _ => return Err(bad(cmd, format!("value for `{k}` must be an expression or true/false"))),
             };
             if text.len() > 4096 {
                 return Err(bad(cmd, "value too long"));
             }
-            let key = k.strip_prefix("param:").or_else(|| k.strip_prefix("suppress:")).unwrap_or(k);
             let col = s
                 .doc
                 .configs
                 .columns
                 .iter()
-                .position(|c| match c {
-                    Column::Param(n) => n == key,
-                    Column::Suppress(id) => s.doc.feature(*id).is_some_and(|f| f.name == key),
+                .position(|c| {
+                    s.doc.config_key(c) == *k
+                        || match c {
+                            Column::Param(n) => n == k,
+                            Column::Suppress(id) => s.doc.feature(*id).is_some_and(|f| f.name == *k),
+                            Column::Material(_) | Column::Appearance(_) | Column::ComponentAppearance(_) | Column::FaceAppearance(_) => false,
+                        }
                 })
                 .ok_or_else(|| bad(cmd, format!("`{k}` is not a column (config.column adds one)")))?;
+            match s.doc.configs.columns.get(col) {
+                Some(Column::Material(_)) => {
+                    text = solvecraft_doc::config::material_cell(&text).map_err(|e| bad(cmd, e.to_string()))?.unwrap_or_else(|| "Default".into());
+                }
+                Some(Column::Appearance(_) | Column::ComponentAppearance(_) | Column::FaceAppearance(_)) => {
+                    text = match solvecraft_doc::config::appearance_cell(&text).map_err(|e| bad(cmd, e.to_string()))? {
+                        Some(look) => serde_json::to_string(&look).map_err(|e| bad(cmd, e.to_string()))?,
+                        None => String::new(),
+                    };
+                }
+                _ => {}
+            }
             if let Some(cell) = cells.get_mut(col) {
                 *cell = text;
             }
         }
     }
     let rename = str_(p, "rename").map(str::trim).filter(|n| !n.is_empty() && n.len() <= 128).map(str::to_string);
+    if p.get("rename").is_some() && (rename.is_none() || idx.is_none()) {
+        return Err(bad(cmd, "rename requires an existing row and a nonempty name up to 128 bytes"));
+    }
+    if rename.as_ref().is_some_and(|n| n != &name && s.doc.configs.rows.iter().any(|r| &r.name == n)) {
+        return Err(bad(cmd, "configuration name already exists"));
+    }
     let t = &mut s.doc_mut().configs;
+    let validated_name = rename.clone().unwrap_or_else(|| name.clone());
     match idx {
         Some(i) => {
             if let Some(r) = t.rows.get_mut(i) {
@@ -168,20 +308,118 @@ fn row(s: &mut Session, p: &Value) -> Result<Value> {
             t.rows.push(ConfigRow { name, cells });
         }
     }
+    if !s.doc.configs.rules.is_empty() {
+        let mut trial = s.scratch();
+        activate(&mut trial, &json!({"row":validated_name})).map_err(|e| bad(cmd, e.to_string()))?;
+    }
+    show(s, p)
+}
+
+fn validate_rows(s: &Session, cmd: &str) -> Result<()> {
+    if !s.doc.configs.rules.is_empty() && s.doc.configs.rows.is_empty() {
+        return Err(bad(cmd, "rules require at least one configuration row"));
+    }
+    for row in &s.doc.configs.rows {
+        let mut trial = s.scratch();
+        activate(&mut trial, &json!({"row":row.name})).map_err(|e| bad(cmd, format!("row `{}`: {e}", row.name)))?;
+    }
+    Ok(())
+}
+
+fn rule(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "config.rule";
+    if let Some(value) = p.get("rule") {
+        solvecraft_doc::config::validate_rules_json(&json!({"configs":{"rules":[value]}})).map_err(|e| bad(cmd, e.to_string()))?;
+        let mut rule: solvecraft_doc::config::ConfigRule = serde_json::from_value(value.clone()).map_err(|e| bad(cmd, e.to_string()))?;
+        if rule.length_unit.is_none() {
+            rule.length_unit = s
+                .doc
+                .configs
+                .rules
+                .iter()
+                .find(|existing| existing.id == rule.id)
+                .and_then(|existing| existing.length_unit.clone())
+                .or_else(|| Some(s.doc.units.clone()));
+        }
+        let rules = &mut s.doc_mut().configs.rules;
+        if let Some(index) = rules.iter().position(|r| r.id == rule.id) {
+            rules[index] = rule;
+        } else {
+            if rules.len() >= solvecraft_doc::config::MAX_RULES {
+                return Err(bad(cmd, "too many rules"));
+            }
+            rules.push(rule);
+        }
+    } else {
+        let id = str_(p, "id").ok_or_else(|| bad(cmd, "give rule or id"))?;
+        let rules = &mut s.doc_mut().configs.rules;
+        let index = rules.iter().position(|r| r.id == id).ok_or_else(|| bad(cmd, "unknown rule"))?;
+        if bool_(p, "delete").unwrap_or(false) {
+            rules.remove(index);
+        } else {
+            let position = p
+                .get("index")
+                .and_then(Value::as_u64)
+                .and_then(|v| usize::try_from(v).ok())
+                .filter(|v| *v < rules.len())
+                .ok_or_else(|| bad(cmd, "valid index required"))?;
+            let rule = rules.remove(index);
+            rules.insert(position, rule);
+        }
+    }
+    validate_rows(s, cmd)?;
     show(s, p)
 }
 
 fn activate(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "config.activate";
     let r = str_(p, "row").ok_or_else(|| bad(cmd, "`row` is required"))?.to_string();
-    s.doc_mut().apply_configuration(&r).map_err(|e| bad(cmd, e.to_string()))?;
+    let mut trial = s.scratch();
+    let trace = trial.doc_mut().apply_configuration_with_trace(&r).map_err(|e| bad(cmd, e.to_string()))?;
+    trial.refresh();
+    let new_errors: Vec<String> = trial
+        .model
+        .results
+        .iter()
+        .filter_map(|result| {
+            result
+                .error
+                .as_ref()
+                .filter(|error| s.model.result(result.id).is_none_or(|before| before.error.as_ref() != Some(*error)))
+                .map(|error| format!("{}: {error}", result.name))
+        })
+        .collect();
+    if !new_errors.is_empty() {
+        return Err(bad(cmd, format!("configuration `{r}` would fail to rebuild: {}", new_errors.join("; "))));
+    }
+    let styles = trial.doc.configuration_style_status(&trial.model.state()).map_err(|error| bad(cmd, format!("configuration `{r}`: {error}")))?;
+    s.doc = trial.doc;
     s.refresh();
     let errors: Vec<String> = s.model.results.iter().filter_map(|x| x.error.clone()).collect();
     let mut out = show(s, p)?;
     out["errors"] = json!(errors);
+    out["trace"] = json!(trace);
+    out["styles"] = json!(styles);
     Ok(out)
 }
 
+fn preview(s: &mut Session, p: &Value) -> Result<Value> {
+    let mut trial = s.scratch();
+    let mut out = activate(&mut trial, p)?;
+    out["preview"] = json!(true);
+    out["parameters"] = json!(trial.doc.param_rows());
+    Ok(out)
+}
+
+#[cfg(test)]
+#[path = "config_certificate_tests.rs"]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod certificate_tests;
+#[cfg(test)]
+#[path = "config_style_tests.rs"]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod style_tests;
+
 #[cfg(test)]
 mod tests {
     use serde_json::{Value, json};
@@ -196,17 +434,197 @@ mod tests {
     }
 
     fn volume(s: &mut Session) -> f64 {
-        run(s, "MeasureCommand", json!({}))["total"]["volume_mm3"].as_f64().unwrap_or(f64::NAN)
+        run(s, "inspect.measure", json!({}))["total"]["volume_mm3"].as_f64().unwrap_or(f64::NAN)
+    }
+
+    #[test]
+    fn configuration_activation_tolerates_identical_existing_errors_but_rejects_reenabled_failure() {
+        let mut s = Session::default();
+        run(&mut s, "parameters.change", json!({"name":"radius","expression":"10 mm"}));
+        run(&mut s, "solid.sphere", json!({"radius":"radius"}));
+        let feature = s.doc.features[0].name.clone();
+        run(&mut s, "config.configure", json!({"params":["radius"],"features":[feature]}));
+        run(&mut s, "config.row", json!({"name":"Existing error","values":{"radius":"-1 mm"}}));
+        run(&mut s, "parameters.change", json!({"name":"radius","expression":"-1 mm"}));
+        assert!(s.model.results[0].error.is_some());
+        let existing = run(&mut s, "config.activate", json!({"row":"Existing error"}));
+        assert_eq!(existing["errors"].as_array().unwrap().len(), 1);
+        s.doc_mut().features[0].suppressed = true;
+        s.refresh();
+        assert!(s.model.results[0].error.is_none());
+        run(&mut s, "config.row", json!({"name":"Reenabled failure","values":{"radius":"-1 mm",format!("suppress:{feature}"):false}}));
+        let before = s.doc.clone();
+        assert!(s.execute("config.activate", &json!({"row":"Reenabled failure"})).is_err());
+        assert_eq!(s.doc, before);
+        assert!(s.model.results[0].error.is_none());
+    }
+
+    #[test]
+    fn configuration_rows_and_literal_rule_thresholds_keep_physical_units_on_switch() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10}));
+        let length = s.doc.features[0].param_names[0].clone();
+        run(&mut s, "config.configure", json!({"params":[length]}));
+        run(
+            &mut s,
+            "config.rule",
+            json!({"rule":{"id":"limit","name":"Metric stock","condition":{"type":"parameter","parameter":length,"operator":"le","expression":"20"},"effect":{"type":"parameter_range","parameter":length,"minimum":"5","maximum":"20"}}}),
+        );
+        run(&mut s, "document.units", json!({"units":"in"}));
+        assert_eq!(s.doc.configs.rows[0].cells[0], "10 mm");
+        let rule = serde_json::to_value(&s.doc.configs.rules[0]).unwrap();
+        assert_eq!(rule["condition"]["expression"], "20 mm");
+        assert_eq!(rule["effect"]["minimum"], "5 mm");
+        let preview = run(&mut s, "config.preview", json!({"row":"Default"}));
+        assert_eq!(preview["trace"][0]["matched"], true);
+        run(&mut s, "config.activate", json!({"row":"Default"}));
+        assert!((volume(&mut s) - 1000.0).abs() < 1e-6);
+        assert!(s.doc.configuration_matches());
+        run(&mut s, "edit.undo", json!({}));
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(s.doc.units, "mm");
+        assert_eq!(s.doc.configs.rows[0].cells[0], "10");
+    }
+
+    #[test]
+    fn configuration_mixed_rule_expressions_keep_authoring_units_without_rewriting_source() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length":10,"width":20,"height":10}));
+        let length = s.doc.features[0].param_names[0].clone();
+        let width = s.doc.features[0].param_names[1].clone();
+        run(&mut s, "config.configure", json!({"params":[length,width]}));
+        let expression = format!("{width} + 1");
+        run(
+            &mut s,
+            "config.rule",
+            json!({"rule":{"id":"drive","name":"Stock extra","condition":{"type":"always"},"effect":{"type":"drive_parameter","parameter":length,"expression":expression}}}),
+        );
+        run(
+            &mut s,
+            "config.rule",
+            json!({"rule":{"id":"range","name":"Stock bound","condition":{"type":"parameter","parameter":length,"operator":"lt","expression":format!("{width} + 2")},"effect":{"type":"parameter_range","parameter":length,"minimum":width,"maximum":format!("{width} + 2")}}}),
+        );
+        run(&mut s, "config.activate", json!({"row":"Default"}));
+        let before = volume(&mut s);
+        assert!((before - 4200.0).abs() < 1e-6);
+        run(&mut s, "document.units", json!({"units":"in"}));
+        assert!((volume(&mut s) - before).abs() < 1e-6, "matched row rederives drives in their authoring unit");
+        assert!(s.doc.configuration_matches());
+        let rule = serde_json::to_value(&s.doc.configs.rules[0]).unwrap();
+        assert_eq!(rule["effect"]["expression"], expression);
+        assert_eq!(rule["length_unit"], "mm");
+        let preview = run(&mut s, "config.preview", json!({"row":"Default"}));
+        assert_eq!(preview["trace"][1]["matched"], true);
+    }
+
+    #[test]
+    fn configuration_rule_edits_enforce_existing_rows_and_are_undoable() {
+        let mut s = Session::default();
+        run(&mut s, "parameters.change", json!({"name":"length","expression":"10 mm"}));
+        run(&mut s, "solid.box", json!({"length":"length","width":10,"height":10}));
+        run(&mut s, "config.configure", json!({"params":["length"]}));
+        let rule = json!({"id":"limit","name":"Length limit","condition":{"type":"always"},"effect":{"type":"parameter_range","parameter":"length","minimum":"5 mm","maximum":"20 mm"}});
+        run(&mut s, "config.rule", json!({"rule":rule}));
+        let before = s.doc.clone();
+        assert!(s.execute("config.row", &json!({"name":"Default","delete":true})).is_err());
+        assert_eq!(s.doc, before, "last row remains while rules exist");
+        assert!(s.execute("config.row", &json!({"name":"Too large","values":{"length":"30 mm"}})).is_err());
+        assert_eq!(s.doc, before);
+        let impossible = json!({"id":"limit","name":"Length limit","condition":{"type":"always"},"effect":{"type":"parameter_range","parameter":"length","minimum":"15 mm","maximum":"20 mm"}});
+        assert!(s.execute("config.rule", &json!({"rule":impossible})).is_err());
+        assert_eq!(s.doc, before);
+        let preview = run(&mut s, "config.preview", json!({"row":"Default"}));
+        assert_eq!(preview["trace"][0]["name"], "Length limit");
+        assert_eq!(preview["trace"][0]["matched"], true);
+        assert_eq!(s.doc, before);
+        run(&mut s, "config.rule", json!({"id":"limit","delete":true}));
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(s.doc, before);
+        let reopened = solvecraft_doc::format::read(&s.doc.to_json()).unwrap();
+        assert_eq!(reopened.configs.rules, s.doc.configs.rules);
+    }
+
+    #[test]
+    fn configuration_preview_and_failed_geometry_leave_design_unchanged() {
+        let mut s = Session::default();
+        run(&mut s, "parameters.change", json!({"name":"length", "expression":"10 mm"}));
+        run(&mut s, "solid.box", json!({"length":"length", "width":10, "height":10}));
+        run(&mut s, "config.configure", json!({"params":["length"]}));
+        run(&mut s, "config.row", json!({"name":"Large", "values":{"length":"20 mm"}}));
+        run(&mut s, "config.row", json!({"name":"Degenerate", "values":{"length":"0 mm"}}));
+        let before = s.doc.clone();
+        let revision = s.revision;
+        assert_eq!(run(&mut s, "config.preview", json!({"row":"Large"}))["preview"], true);
+        assert_eq!(s.doc, before);
+        assert_eq!(s.revision, revision);
+        assert!(s.execute("config.preview", &json!({"row":"Degenerate"})).is_err());
+        assert_eq!(s.doc, before);
+        assert!(s.execute("config.activate", &json!({"row":"Degenerate"})).is_err());
+        assert_eq!(s.doc, before);
+        assert!((volume(&mut s) - 1000.0).abs() < 1e-6);
+        run(&mut s, "config.activate", json!({"row":"Large"}));
+        assert!((volume(&mut s) - 2000.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn configured_feature_inputs_and_suppression_match_typed_cells() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length":10, "width":10, "height":10}));
+        let feature = s.doc.features[0].name.clone();
+        let length = s.doc.features[0].param_names[0].clone();
+        s.doc_mut().units = "in".into();
+        run(&mut s, "config.configure", json!({"params":[length], "features":[feature]}));
+        assert_eq!(s.doc.configs.rows[0].cells[0], "10 mm", "Default captures stored feature literals in their base unit");
+        run(&mut s, "config.activate", json!({"row":"Default"}));
+        assert!((volume(&mut s) - 1000.0).abs() < 1e-6, "captured Default preserves geometry in an inch design");
+        run(&mut s, "config.row", json!({"name":"Inches", "values":{length.clone():"2", format!("suppress:{feature}"):"NO"}}));
+        run(&mut s, "config.activate", json!({"row":"Inches"}));
+        assert_eq!(s.doc.config_current(&solvecraft_doc::config::Column::Param(length.clone())).as_deref(), Some("2 in"));
+        assert!(s.doc.configuration_matches());
+        assert!((volume(&mut s) - 5080.0).abs() < 1e-6);
+        let feature_id = s.doc.features[0].id;
+        run(
+            &mut s,
+            "config.rule",
+            json!({"rule":{"id":"inch-condition","name":"Inch condition","condition":{"type":"parameter","parameter":length,"operator":"gt","expression":"5"},"effect":{"type":"drive_suppression","feature":feature_id,"value":true}}}),
+        );
+        run(
+            &mut s,
+            "config.rule",
+            json!({"rule":{"id":"inch-range","name":"Inch range","condition":{"type":"always"},"effect":{"type":"parameter_range","parameter":length,"minimum":"0","maximum":"5"}}}),
+        );
+        let preview = run(&mut s, "config.preview", json!({"row":"Inches"}));
+        assert_eq!(preview["trace"][0]["matched"], false, "bare comparison means inches for a feature length");
+        assert_eq!(preview["trace"][1]["matched"], true);
+    }
+
+    #[test]
+    fn configured_parameters_cannot_be_deleted_and_deleted_features_prune_columns() {
+        let mut s = Session::default();
+        run(&mut s, "parameters.change", json!({"name":"spare", "expression":"10 mm"}));
+        run(&mut s, "config.configure", json!({"params":["spare"]}));
+        assert!(s.doc_mut().remove_param("spare").is_err());
+        run(&mut s, "config.column", json!({"param":"spare", "delete":true}));
+        s.doc_mut().remove_param("spare").unwrap();
+        run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10}));
+        let feature = &s.doc.features[0];
+        let id = feature.id;
+        let length = feature.param_names[0].clone();
+        let name = feature.name.clone();
+        run(&mut s, "config.configure", json!({"params":[length], "features":[name]}));
+        s.doc_mut().delete_feature(id).unwrap();
+        assert!(s.doc.configs.columns.is_empty());
+        assert!(s.doc.configs.rows.iter().all(|row| row.cells.is_empty()));
     }
 
     #[test]
     fn configurations_switch_sizes_and_suppressions() {
         let mut s = Session::default();
-        run(&mut s, "ChangeParameterCommand", json!({"name": "len", "expression": "40 mm"}));
-        run(&mut s, "PrimitiveBox", json!({"length": "len", "width": 20, "height": 10}));
-        run(&mut s, "FusionFilletEdgesCommand", json!({"edges": [[0, 0, 5]], "radius": 3}));
+        run(&mut s, "parameters.change", json!({"name": "len", "expression": "40 mm"}));
+        run(&mut s, "solid.box", json!({"length": "len", "width": 20, "height": 10}));
+        run(&mut s, "solid.fillet", json!({"edges": [[0, 0, 5]], "radius": 3}));
         let fillet = s.doc.features.last().map(|f| f.name.clone()).unwrap_or_default();
-        let t = run(&mut s, "FusionStartDesignConfigModeCmd", json!({"params": ["len"], "features": [fillet]}));
+        let t = run(&mut s, "config.configure", json!({"params": ["len"], "features": [fillet]}));
         assert_eq!(t["rows"][0]["name"], "Default");
         run(&mut s, "config.row", json!({"name": "Long", "values": {"len": "80 mm"}}));
         run(&mut s, "config.row", json!({"name": "Sharp", "from": "Long", "values": {fillet.clone(): true}}));
@@ -216,17 +634,17 @@ mod tests {
         assert!((volume(&mut s) - (16000.0 - (9.0 - std::f64::consts::PI * 9.0 / 4.0) * 10.0)).abs() < 0.5, "{}", volume(&mut s));
         run(&mut s, "config.activate", json!({"row": "Sharp"}));
         assert!((volume(&mut s) - 16000.0).abs() < 1e-6);
-        let t = run(&mut s, "FusionShowDesignConfigPanelCmd", json!({}));
+        let t = run(&mut s, "config.table", json!({}));
         assert_eq!((t["active"].as_str(), t["matches"].as_bool()), (Some("Sharp"), Some(true)), "{t}");
         // Undo goes back to the previous configuration's values.
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert!(volume(&mut s) > 15000.0 && volume(&mut s) < 16000.0);
         // Renaming the parameter keeps the column; editing it by hand breaks the match.
         run(&mut s, "parameters.rename", json!({"name": "len", "new_name": "length"}));
-        let t = run(&mut s, "FusionShowDesignConfigPanelCmd", json!({}));
+        let t = run(&mut s, "config.table", json!({}));
         assert_eq!(t["columns"][0], "param:length", "{t}");
-        run(&mut s, "ChangeParameterCommand", json!({"name": "length", "expression": "50 mm"}));
-        assert_eq!(run(&mut s, "FusionShowDesignConfigPanelCmd", json!({}))["matches"], false);
+        run(&mut s, "parameters.change", json!({"name": "length", "expression": "50 mm"}));
+        assert_eq!(run(&mut s, "config.table", json!({}))["matches"], false);
         // Bad input.
         assert!(s.execute("config.row", &json!({"name": "X", "values": {"nope": 1}})).is_err());
         assert!(s.execute("config.activate", &json!({"row": "Missing"})).is_err());
@@ -234,6 +652,138 @@ mod tests {
         assert!(s.execute("config.activate", &json!({"row": "Broken"})).is_err());
         run(&mut s, "config.row", json!({"name": "Broken", "delete": true}));
         run(&mut s, "config.column", json!({"feature": fillet, "delete": true}));
-        assert_eq!(run(&mut s, "FusionShowDesignConfigPanelCmd", json!({}))["columns"].as_array().map(Vec::len), Some(1));
+        assert_eq!(run(&mut s, "config.table", json!({}))["columns"].as_array().map(Vec::len), Some(1));
+    }
+
+    #[test]
+    fn configuration_materials_and_looks_are_undoable_and_persistent() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        let body = s.model.state().bodies.first().unwrap().name.clone();
+        run(&mut s, "config.configure", json!({"materials": [body], "appearances": [body]}));
+        let material = format!("material:{body}");
+        let appearance = format!("appearance:{body}");
+        run(&mut s, "config.row", json!({"name": "Metal", "values": {material.clone(): "steel", appearance.clone(): "ABS - Red"}}));
+        run(
+            &mut s,
+            "config.row",
+            json!({"name": "Custom", "from": "Metal", "values": {
+                material.clone(): "Aluminum", appearance.clone(): {"name": "Ocean", "color": [1, 2, 3], "opacity": 0.4}
+            }}),
+        );
+        run(&mut s, "config.activate", json!({"row": "Metal"}));
+        assert_eq!(s.doc.materials.get(&body).map(String::as_str), Some("Steel"));
+        assert_eq!(s.doc.appearances.bodies.get(&body).unwrap().color, [196, 40, 40]);
+        let mass = run(&mut s, "inspect.measure", json!({}));
+        assert!((mass["bodies"][0]["mass_g"].as_f64().unwrap() - 7.85).abs() < 1e-6);
+        assert_eq!(run(&mut s, "config.table", json!({}))["matches"], true);
+        run(&mut s, "config.activate", json!({"row": "Custom"}));
+        let mass = run(&mut s, "inspect.measure", json!({}));
+        assert!((mass["bodies"][0]["mass_g"].as_f64().unwrap() - 2.7).abs() < 1e-6);
+        assert_eq!(s.doc.appearances.bodies.get(&body).unwrap().opacity, 0.4);
+        let reopened = solvecraft_doc::format::read(&s.doc.to_json()).unwrap();
+        assert_eq!(reopened, *s.doc);
+        assert!(reopened.configuration_matches());
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(s.doc.materials.get(&body).map(String::as_str), Some("Steel"));
+        run(&mut s, "config.activate", json!({"row": "Default"}));
+        assert!(!s.doc.materials.contains_key(&body));
+        assert!(!s.doc.appearances.bodies.contains_key(&body));
+        run(&mut s, "config.activate", json!({"row": "Metal"}));
+        run(&mut s, "appearance.assign", json!({"bodies": [body], "appearance": "ABS - Blue"}));
+        assert!(!s.doc.configuration_matches());
+        run(&mut s, "config.column", json!({"appearance": body, "delete": true}));
+        assert_eq!(s.doc.configs.columns.len(), 1);
+        assert!(s.doc.configs.rows.iter().all(|r| r.cells.len() == 1));
+    }
+
+    #[test]
+    fn configuration_styles_reject_hostile_values_without_changes() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        let body = s.model.state().bodies.first().unwrap().name.clone();
+        run(&mut s, "config.configure", json!({"materials": [body], "appearances": [body]}));
+        let material = format!("material:{body}");
+        let appearance = format!("appearance:{body}");
+        for params in [
+            json!({"name": "Bad", "values": {material: "Unobtainium"}}),
+            json!({"name": "Bad", "values": {appearance.clone(): "#oops"}}),
+            json!({"name": "Bad", "values": {appearance.clone(): {"name": "Invalid", "color": [1, 2, 300], "opacity": 1}}}),
+            json!({"name": "Bad", "values": {appearance: {"name": "Invalid", "color": [1, 2, 3], "opacity": -1}}}),
+            json!({"name": "Default", "rename": ""}),
+        ] {
+            let before = s.doc.clone();
+            assert!(s.execute("config.row", &params).is_err(), "{params}");
+            assert_eq!(s.doc, before);
+        }
+        assert!(s.execute("config.column", &json!({"appearance": "missing"})).is_err());
+        assert!(s.execute("config.column", &json!({"appearance": body, "material": body})).is_err());
+        run(&mut s, "config.row", json!({"name": "Other"}));
+        assert!(s.execute("config.row", &json!({"name": "Other", "rename": "Default"})).is_err());
+        // A malformed persisted row must fail atomically rather than silently apply its prefix.
+        s.doc_mut().configs.rows.first_mut().unwrap().cells.pop();
+        let before = s.doc.clone();
+        assert!(s.execute("config.activate", &json!({"row": "Default"})).is_err());
+        assert_eq!(s.doc, before);
+    }
+
+    #[test]
+    fn configuration_captures_unicode_custom_appearance_names() {
+        let mut s = Session::default();
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+        let body = s.model.state().bodies.first().unwrap().name.clone();
+        let name = "é".repeat(128);
+        run(&mut s, "appearance.assign", json!({"bodies": [body], "appearance": name, "color": [40, 90, 186]}));
+        run(&mut s, "config.configure", json!({"appearances": [body]}));
+        run(&mut s, "appearance.assign", json!({"bodies": [body]}));
+        run(&mut s, "config.activate", json!({"row": "Default"}));
+        assert_eq!(s.doc.appearances.bodies.get(&body).unwrap().name, name);
+        assert!(s.doc.configuration_matches());
+        let reopened = solvecraft_doc::format::read(&s.doc.to_json()).unwrap();
+        assert!(reopened.configuration_matches());
+    }
+
+    #[test]
+    fn configuration_styles_survive_parameter_and_body_renames() {
+        let mut s = Session::default();
+        run(&mut s, "parameters.change", json!({"name": "Steel", "expression": "10 mm"}));
+        run(&mut s, "parameters.change", json!({"name": "double", "expression": "Steel * 2"}));
+        run(&mut s, "solid.box", json!({"length": "double", "width": 10, "height": 10, "body_name": "Block"}));
+        run(&mut s, "config.configure", json!({"params": ["Steel", "double"], "materials": ["Block"], "appearances": ["Block"]}));
+        run(
+            &mut s,
+            "config.row",
+            json!({"name": "Styled", "values": {
+                "param:Steel": "20 mm", "param:double": "Steel * 3", "material:Block": "Steel", "appearance:Block": "Steel - Satin"
+            }}),
+        );
+        run(&mut s, "config.activate", json!({"row": "Styled"}));
+        let styles: Vec<Vec<String>> = s.doc.configs.rows.iter().map(|r| r.cells.iter().skip(2).cloned().collect()).collect();
+        run(&mut s, "parameters.rename", json!({"name": "Steel", "new_name": "gauge"}));
+        let after: Vec<Vec<String>> = s.doc.configs.rows.iter().map(|r| r.cells.iter().skip(2).cloned().collect()).collect();
+        assert_eq!(after, styles, "renaming an expression reference must preserve style cells verbatim");
+        let table = run(&mut s, "config.table", json!({}));
+        assert_eq!(table["columns"][0], "param:gauge");
+        assert_eq!(table["rows"][1]["values"]["param:double"], "gauge * 3");
+        assert!(s.doc.configuration_matches());
+        run(&mut s, "body.rename", json!({"body": "Block", "name": "Housing"}));
+        let table = run(&mut s, "config.table", json!({}));
+        assert_eq!(table["columns"][2], "material:Housing");
+        assert_eq!(table["columns"][3], "appearance:Housing");
+        assert!(s.doc.configuration_matches());
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(run(&mut s, "config.table", json!({}))["columns"][2], "material:Block");
+        run(&mut s, "edit.redo", json!({}));
+        let mut reopened = Session::new(solvecraft_doc::format::read(&s.doc.to_json()).unwrap());
+        run(&mut reopened, "config.activate", json!({"row": "Default"}));
+        assert!(!reopened.doc.materials.contains_key("Housing"));
+        assert!(!reopened.doc.appearances.bodies.contains_key("Housing"));
+        run(&mut reopened, "config.activate", json!({"row": "Styled"}));
+        assert_eq!(reopened.doc.materials.get("Housing").map(String::as_str), Some("Steel"));
+        assert_eq!(reopened.doc.appearances.bodies.get("Housing").unwrap().name, "Steel - Satin");
+        assert!(!reopened.doc.materials.contains_key("Block"));
+        assert!(!reopened.doc.appearances.bodies.contains_key("Block"));
+        assert!((volume(&mut reopened) - 6000.0).abs() < 1e-6);
+        assert!(reopened.doc.configuration_matches());
     }
 }

crates/engine/src/cmd/config_certificate_tests.rs

@@ -0,0 +1,251 @@
+use crate::Session;
+use serde_json::{Value, json};
+use solvecraft_doc::{
+    FeatureKind,
+    config::{Column, FaceCertificate},
+};
+use solvecraft_geom::Vec3;
+
+fn run(session: &mut Session, command: &str, params: Value) -> Value {
+    session.execute(command, &params).unwrap_or_else(|error| panic!("{command} {params}: {error}"))
+}
+fn paint(session: &mut Session, body: &str, point: Value) {
+    let table = run(session, "config.configure", json!({"face_appearances":[{"body":body,"point":point}]}));
+    let key = table["columns"][0].as_str().unwrap();
+    run(session, "config.row", json!({"name":"Painted","values":{key:"ABS - Red"}}));
+    run(session, "config.activate", json!({"row":"Painted"}));
+}
+fn painted_radius(session: &Session, name: &str, radius: f64) -> usize {
+    let state = session.model.state();
+    let body =
+        state.body(name).unwrap_or_else(|| panic!("missing {name}; bodies {:?}", state.bodies.iter().map(|body| &body.name).collect::<Vec<_>>()));
+    let painted = session.doc.face_colors(body);
+    let mesh = body.body.tessellate(0.001).unwrap();
+    let inverse = solvecraft_doc::mat_inverse(&body.source_transform).unwrap();
+    for (triangle, face) in mesh.triangles.iter().zip(&mesh.tri_face) {
+        if painted.iter().any(|(index, _)| *index == *face as usize) {
+            for vertex in mesh.tri(triangle).unwrap() {
+                let vertex = solvecraft_doc::apply_point(&inverse, vertex);
+                assert!((vertex.x.hypot(vertex.y) - radius).abs() < 1e-7, "{name}: {vertex:?}");
+            }
+        }
+    }
+    assert!(!painted.is_empty());
+    painted.len()
+}
+
+#[test]
+fn certified_annulus_side_rows_follow_radius_edits_and_clone() {
+    let mut s = Session::default();
+    let part = run(&mut s, "component.create", json!({"name":"RingPart"}))["component"].as_u64().unwrap();
+    let sketch = run(&mut s, "sketch.create", json!({"plane":"XY"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":10,"id":"outer"}));
+    run(&mut s, "sketch.dimension", json!({"entities":["outer"],"type":"radius","value":10}));
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":9,"id":"inner"}));
+    run(&mut s, "sketch.dimension", json!({"entities":["inner"],"type":"radius","value":9}));
+    let FeatureKind::Sketch { sketch: source_sketch, .. } = &s.doc.feature(sketch).unwrap().kind else { panic!() };
+    let dimensions: Vec<_> = source_sketch.constraints.iter().filter_map(|dimension| dimension.param.clone()).collect();
+    assert_eq!(dimensions.len(), 2);
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"distance":10,"profiles":[{"point":[9.5,0]}],"body_name":"Ring"}));
+    paint(&mut s, "Ring", json!([10, 0, 5]));
+    assert_eq!(painted_radius(&s, "Ring", 10.), 2, "both constructed arc pieces share outer curve");
+    let Column::FaceAppearance(target) = &s.doc.configs.columns[0] else { panic!() };
+    assert_eq!(target.certificate, Some(FaceCertificate::ExtrudeSide { sketch, curve: "outer".into() }));
+    run(&mut s, "parameters.change", json!({"name":dimensions[0],"expression":"12 mm"}));
+    run(&mut s, "parameters.change", json!({"name":dimensions[1],"expression":"9.25 mm"}));
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Ring", 12.), 2);
+    run(&mut s, "component.paste_new", json!({"component":part,"translate":[30,0,0]}));
+    assert_eq!(s.doc.configs.columns.len(), 2);
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Ring (copy)", 12.), 2);
+    let reopened = solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap();
+    let mut reopened = Session::new(reopened);
+    run(&mut reopened, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&reopened, "Ring", 12.), 2);
+    assert_eq!(painted_radius(&reopened, "Ring (copy)", 12.), 2);
+    run(&mut reopened, "config.activate", json!({"row":"Default"}));
+    assert!(reopened.doc.appearances.faces.is_empty());
+}
+
+fn imported(session: &mut Session, step: String, name: &str) -> u64 {
+    let owner = session.active_component;
+    let id = session.doc_mut().add_feature(FeatureKind::Import { file: "fixture.step".into(), step, components: vec![] }, Some(name)).unwrap();
+    let feature = session.doc_mut().feature_mut(id).unwrap();
+    feature.body_names = vec![name.into()];
+    feature.component = owner;
+    session.refresh();
+    assert!(session.model.result(id).unwrap().error.is_none());
+    id
+}
+
+#[test]
+fn legacy_v9_imported_emboss_anchor_and_ordinary_face_paint_replay_without_renaming() {
+    let mut s = Session::default();
+    let cylinder = solvecraft_kernel::cylinder(Vec3::ZERO, Vec3::Z, 10., 20.).unwrap();
+    let step = solvecraft_kernel::step_export(&[&cylinder], "legacy anchored cylinder").unwrap();
+    let source = imported(&mut s, step, "Sleeve");
+    run(&mut s, "material.assign", json!({"bodies":["Sleeve"],"material":"Steel"}));
+    let before_volume = s.model.state().body("Sleeve").unwrap().body.tessellate_with(1e-4, true).unwrap().measure().volume;
+    let legacy_names = solvecraft_doc::naming::face_names(s.model.state().body("Sleeve").unwrap());
+    assert!(legacy_names.iter().all(|name| name.starts_with(&format!("F{source}:face:"))));
+    run(&mut s, "appearance.assign", json!({"faces":[{"body":"Sleeve","point":[6,0,20]}],"appearance":"ABS - Blue"}));
+    assert!(s.doc.appearances.faces[0].certificate.is_none());
+    let badge = run(&mut s, "sketch.create", json!({"plane":{"face":[0,0,20]},"name":"Badge","project_edges":false}))["sketch"].as_u64().unwrap();
+    let FeatureKind::Sketch { plane: saved_plane, .. } = &s.doc.feature(badge).unwrap().kind else { panic!() };
+    let saved_plane = saved_plane.clone();
+    assert!(matches!(&saved_plane, solvecraft_doc::PlaneRef::Face { name: Some(name), .. } if legacy_names.contains(name)));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[-2,-2],"p1":[2,2]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.emboss", json!({"sketch":"Badge","profiles":"all","depth":1,"targets":["Sleeve"],"name":"Raised Badge"}));
+    let anchored = s.doc.find_feature("Raised Badge").unwrap().clone();
+    assert!(matches!(anchored.kind, FeatureKind::Emboss { face: None, .. }));
+    let volume = s.model.state().body("Sleeve").unwrap().body.tessellate_with(1e-4, true).unwrap().measure().volume;
+    assert!((volume - std::f64::consts::PI * 2000. - 16.).abs() < 0.1, "volume {volume}");
+    assert!((volume - before_volume - 16.).abs() < 0.01, "addedvolume {} baseline {before_volume}", volume - before_volume);
+    let paint = s.doc.appearances.faces.clone();
+    let mut legacy: Value = serde_json::from_str(&s.doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/9");
+    let reopened = Session::new(solvecraft_doc::Document::from_json(&legacy.to_string()).unwrap());
+    assert_eq!(reopened.doc.feature(anchored.id).unwrap(), &anchored);
+    let FeatureKind::Sketch { plane, .. } = &reopened.doc.feature(badge).unwrap().kind else { panic!() };
+    assert_eq!(plane, &saved_plane);
+    assert_eq!(reopened.doc.appearances.faces, paint);
+    assert_eq!(reopened.doc.materials.get("Sleeve"), Some(&"Steel".to_string()));
+    assert!(reopened.model.result(anchored.id).unwrap().error.is_none());
+    let state = reopened.model.state();
+    let body = state.body("Sleeve").unwrap();
+    assert!((body.body.tessellate_with(1e-4, true).unwrap().measure().volume - volume).abs() < 1e-8);
+    assert!(!reopened.doc.face_colors(body).is_empty());
+}
+
+#[test]
+fn certified_side_refuses_reused_body_name_from_a_new_producer() {
+    let mut s = Session::default();
+    let sketch = run(&mut s, "sketch.create", json!({"plane":"XY"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":10,"id":"circle"}));
+    run(&mut s, "sketch.finish", json!({}));
+    let source = run(&mut s, "solid.extrude", json!({"distance":10,"body_name":"Round"}))["feature"].as_u64().unwrap();
+    paint(&mut s, "Round", json!([10, 0, 5]));
+    let Column::FaceAppearance(target) = s.doc.configs.columns[0].clone() else { panic!() };
+    let mut replacement = s.doc.feature(source).unwrap().clone();
+    replacement.id = s.doc.next_id;
+    assert!(matches!(replacement.kind, FeatureKind::Extrude { sketch: original, .. } if original == sketch));
+    s.doc_mut().feature_mut(source).unwrap().suppressed = true;
+    s.doc_mut().next_id += 1;
+    s.doc_mut().features.push(replacement);
+    s.refresh();
+    let state = s.model.state();
+    let body = state.body("Round").unwrap();
+    assert!(s.doc.configuration_face_indices(body, &target).is_err());
+    assert!(s.doc.face_colors(body).is_empty());
+    let before = s.doc.clone();
+    let history = s.undo.len();
+    assert!(s.execute("config.activate", &json!({"row":"Painted"})).is_err());
+    assert_eq!(s.doc, before);
+    assert_eq!(s.undo.len(), history);
+}
+
+#[test]
+fn legacy_v9_annulus_outer_side_emboss_keeps_its_original_heuristic_anchor() {
+    let mut s = Session::default();
+    run(&mut s, "sketch.create", json!({"plane":"XY"}));
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":10,"id":"outer"}));
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":9,"id":"inner"}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"distance":20,"profiles":[{"point":[9.5,0]}],"body_name":"Sleeve"}));
+    let names = solvecraft_doc::naming::face_names(s.model.state().body("Sleeve").unwrap());
+    // Preserve the legacy centroid-family name even though strict paint uses
+    // the separately certified outer source curve.
+    let name = solvecraft_doc::naming::face_names_at(&s.model.state(), &[Vec3::new(0., 10., 7.5)]).remove(0);
+    assert!(name.contains("side:inner"));
+    run(&mut s, "sketch.create", json!({"plane":{"origin":[0,10,0],"x_dir":[-1,0,0],"y_dir":[0,0,1]},"name":"Badge"}));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[-2,5],"p1":[2,10]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.emboss", json!({"sketch":"Badge","profiles":"all","face":[0,10,7.5],"depth":1,"targets":["Sleeve"],"name":"Raised Badge"}));
+    let feature = s.doc.find_feature("Raised Badge").unwrap();
+    assert_eq!(feature.face_names, vec![name]);
+    assert!(feature.face_names.iter().all(|name| names.contains(name)));
+    let feature_id = feature.id;
+    let volume = s.model.state().body("Sleeve").unwrap().body.tessellate_with(1e-4, true).unwrap().measure().volume;
+    assert!((volume - std::f64::consts::PI * 380. - 21.).abs() < 0.2, "volume {volume}");
+    let mut legacy: Value = serde_json::from_str(&s.doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/9");
+    let reopened = Session::new(solvecraft_doc::Document::from_json(&legacy.to_string()).unwrap());
+    assert!(reopened.model.result(feature_id).unwrap().error.is_none());
+    assert!((reopened.model.state().body("Sleeve").unwrap().body.tessellate_with(1e-4, true).unwrap().measure().volume - volume).abs() < 1e-8);
+}
+
+#[test]
+fn certified_side_transfer_preserves_geometry_and_unsupported_taper_refuses_atomically() {
+    let mut s = Session::default();
+    run(&mut s, "sketch.create", json!({"plane":"XY"}));
+    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":10}));
+    run(&mut s, "sketch.finish", json!({}));
+    let source = run(&mut s, "solid.extrude", json!({"distance":10,"body_name":"Round"}))["feature"].as_u64().unwrap();
+    paint(&mut s, "Round", json!([10, 0, 5]));
+    let created = run(&mut s, "component.create", json!({"name":"Placed"}));
+    let destination = created["component"].as_u64().unwrap();
+    let occurrence = created["occurrence"].as_u64().unwrap();
+    run(&mut s, "occurrence.move", json!({"occurrence":occurrence,"translate":[30,20,0],"angle":90,"axis":[0,0,1],"capture":false}));
+    run(&mut s, "component.move_bodies", json!({"component":destination,"bodies":["Round"]}));
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Round", 10.), 2);
+    let before = s.world_state().body("Round").unwrap().mesh().bounds();
+    let mut s = Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap());
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Round", 10.), 2);
+    assert!(
+        s.world_state().body("Round").unwrap().mesh().bounds().min.dist(before.min) < 1e-8,
+        "before {before:?}, reopened {:?}",
+        s.world_state().body("Round").unwrap().mesh().bounds()
+    );
+    // A successful ordinary modifier has no exact untapered source certificate.
+    let FeatureKind::Extrude { extent, .. } = &mut s.doc_mut().feature_mut(source).unwrap().kind else { panic!() };
+    extent.taper = Some("5 deg".into());
+    s.refresh();
+    assert!(s.model.result(source).unwrap().error.is_none());
+    assert!(s.doc.face_colors(s.model.state().body("Round").unwrap()).is_empty());
+    let document = s.doc.clone();
+    let history = s.undo.len();
+    assert!(s.execute("config.preview", &json!({"row":"Painted"})).is_err());
+    assert!(s.execute("config.activate", &json!({"row":"Painted"})).is_err());
+    assert_eq!(s.doc, document);
+    assert_eq!(s.undo.len(), history);
+}
+
+#[test]
+fn certified_import_payload_binding_roundtrip_clone_and_replacement_refusal() {
+    let geometry = solvecraft_kernel::cylinder(Vec3::ZERO, Vec3::Z, 10., 10.).unwrap();
+    let step = solvecraft_kernel::step_export(&[&geometry], "certificate fixture").unwrap();
+    let mut s = Session::default();
+    let part = run(&mut s, "component.create", json!({"name":"ImportedPart"}))["component"].as_u64().unwrap();
+    let source = imported(&mut s, step.clone(), "Imported");
+    paint(&mut s, "Imported", json!([10, 0, 5]));
+    let pieces = painted_radius(&s, "Imported", 10.);
+    let Column::FaceAppearance(target) = &s.doc.configs.columns[0] else { panic!() };
+    assert!(
+        matches!(&target.certificate, Some(FaceCertificate::Imported { item, face, payload_sha256 }) if *item != 0 && *face != 0 && payload_sha256.len() == 64)
+    );
+    run(&mut s, "component.paste_new", json!({"component":part,"translate":[30,0,0]}));
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Imported (copy)", 10.), pieces);
+    let reopened = solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap();
+    let mut s = Session::new(reopened);
+    run(&mut s, "config.activate", json!({"row":"Painted"}));
+    assert_eq!(painted_radius(&s, "Imported", 10.), pieces);
+    // Identical geometry, entity IDs and item IDs, but a replaced embedded payload.
+    let FeatureKind::Import { step: payload, .. } = &mut s.doc_mut().feature_mut(source).unwrap().kind else { panic!() };
+    *payload = step.replace("certificate fixture", "replacement fixture");
+    assert_ne!(*payload, step);
+    s.refresh();
+    assert!(s.doc.face_colors(s.model.state().body("Imported").unwrap()).is_empty());
+    assert_eq!(painted_radius(&s, "Imported (copy)", 10.), pieces);
+    let before = s.doc.clone();
+    let history = s.undo.len();
+    assert!(s.execute("config.preview", &json!({"row":"Painted"})).is_err());
+    assert!(s.execute("config.activate", &json!({"row":"Painted"})).is_err());
+    assert_eq!(s.doc, before);
+    assert_eq!(s.undo.len(), history);
+}

crates/engine/src/cmd/config_style_tests.rs

@@ -0,0 +1,232 @@
+use crate::Session;
+use serde_json::{Value, json};
+use solvecraft_doc::config::{Column, ConfigFaceTarget};
+fn run(s: &mut Session, command: &str, params: Value) -> Value {
+    s.execute(command, &params).unwrap_or_else(|error| panic!("{command} {params}: {error}"))
+}
+fn block(s: &mut Session) -> String {
+    run(s, "solid.box", json!({"length":10,"width":10,"height":10}));
+    s.model.state().bodies[0].name.clone()
+}
+fn face_column(s: &mut Session, body: &str, point: Value) -> String {
+    run(s, "config.configure", json!({"face_appearances":[{"body":body,"point":point}]}))["columns"][0].as_str().unwrap().into()
+}
+
+#[test]
+fn component_appearance_shared_definition_inheritance_and_delete() {
+    let mut s = Session::default();
+    let component = run(&mut s, "component.create", json!({"name":"Part"}))["component"].as_u64().unwrap();
+    let body = block(&mut s);
+    run(&mut s, "material.assign", json!({"bodies":[body],"material":"Steel"}));
+    run(&mut s, "occurrence.copy", json!({"component":component,"translate":[30,0,0]}));
+    let table = run(&mut s, "config.configure", json!({"component_appearances":[component]}));
+    let key = table["columns"][0].as_str().unwrap().to_string();
+    run(&mut s, "config.row", json!({"name":"Red","values":{key.clone():"ABS - Red"}}));
+    run(&mut s, "config.activate", json!({"row":"Red"}));
+    let world = s.world_state();
+    assert_eq!(world.bodies.len(), 2);
+    assert!(world.bodies.iter().all(|body| s.doc.model_body_look(body).unwrap().name == "ABS - Red"));
+    run(&mut s, "appearance.assign", json!({"bodies":[body],"appearance":"ABS - Yellow"}));
+    assert!(s.world_state().bodies.iter().all(|body| s.doc.model_body_look(body).unwrap().name == "ABS - Yellow"));
+    run(&mut s, "config.activate", json!({"row":"Default"}));
+    assert!(!s.doc.appearances.components.contains_key(&component));
+    assert_eq!(s.doc.appearances.bodies[&body].name, "ABS - Yellow");
+    run(&mut s, "component.rename", json!({"component":component,"name":"Renamed"}));
+    assert_eq!(run(&mut s, "config.table", json!({}))["columns"][0], key);
+    run(&mut s, "appearance.assign", json!({"components":[component.to_string()],"appearance":"ABS - Blue"}));
+    run(&mut s, "component.delete", json!({"component":component}));
+    assert!(s.doc.configs.columns.is_empty());
+    assert!(s.doc.configs.rows.iter().all(|row| row.cells.is_empty()));
+    assert!(!s.doc.appearances.components.contains_key(&component));
+}
+
+#[test]
+fn strict_face_rows_resize_rename_preview_suppress_and_roundtrip() {
+    let mut s = Session::default();
+    let body = block(&mut s);
+    let key = face_column(&mut s, &body, json!([5, 5, 10]));
+    let feature = s.doc.features[0].name.clone();
+    let height = s.doc.features[0].param_names[2].clone();
+    run(&mut s, "config.column", json!({"param":height}));
+    run(&mut s, "config.column", json!({"feature":feature}));
+    run(&mut s, "config.row", json!({"name":"Tall","values":{key:"ABS - Red",height:"20 mm"}}));
+    let before = s.doc.clone();
+    let revision = s.revision;
+    let history = s.undo.len();
+    let preview = run(&mut s, "config.preview", json!({"row":"Tall"}));
+    assert_eq!(s.doc, before);
+    assert_eq!(s.revision, revision);
+    assert_eq!(s.undo.len(), history);
+    assert_eq!(preview["styles"][0]["dormant"], false);
+    run(&mut s, "config.activate", json!({"row":"Tall"}));
+    let state = s.model.state();
+    let mb = state.body(&body).unwrap();
+    let colors = s.doc.face_colors(mb);
+    assert_eq!(colors.len(), 1);
+    let names = solvecraft_doc::naming::face_names(mb);
+    assert!(names[colors[0].0].ends_with(":+z"));
+    assert!(s.doc.appearances.faces[0].strict_name);
+    run(&mut s, "appearance.assign", json!({"faces":[{"body":body,"point":[5,5,20]}]}));
+    assert!(s.doc.appearances.faces.is_empty(), "clear resolves semantic name after configured resize");
+    run(&mut s, "config.activate", json!({"row":"Tall"}));
+    run(&mut s, "body.rename", json!({"body":body,"name":"Housing"}));
+    let key = s.doc.config_key(&s.doc.configs.columns[0]);
+    let suppress = format!("suppress:{feature}");
+    run(&mut s, "config.row", json!({"name":"Hidden","values":{key:"ABS - Blue",suppress:true}}));
+    let hidden = run(&mut s, "config.activate", json!({"row":"Hidden"}));
+    assert_eq!(hidden["styles"][0]["dormant"], true);
+    assert!(s.model.state().bodies.is_empty());
+    let reopened = solvecraft_doc::format::read(&s.doc.to_json()).unwrap();
+    assert_eq!(reopened, *s.doc);
+    run(&mut s, "config.activate", json!({"row":"Tall"}));
+    assert_eq!(s.doc.face_colors(s.model.state().body("Housing").unwrap())[0].1.name, "ABS - Red");
+    run(&mut s, "config.activate", json!({"row":"Default"}));
+    assert!(s.doc.appearances.faces.is_empty());
+    let before_delete = s.doc.clone();
+    run(&mut s, "timeline.delete", json!({"feature":feature}));
+    assert!(s.doc.configs.columns.is_empty());
+    assert!(s.doc.configs.rows.iter().all(|row| row.cells.is_empty()));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc, before_delete);
+    run(&mut s, "config.activate", json!({"row":"Tall"}));
+    assert!(s.doc.appearances.faces[0].strict_name);
+}
+
+#[test]
+fn strict_face_split_pieces_share_lineage_without_index_targets() {
+    let mut s = Session::default();
+    let body = block(&mut s);
+    let key = face_column(&mut s, &body, json!([5, 5, 10]));
+    run(&mut s, "config.row", json!({"name":"Paint","values":{key:"ABS - Red"}}));
+    run(&mut s, "solid.split_face", json!({"body":body,"faces":[[5,5,10]],"plane":{"origin":[5,0,0],"normal":[1,0,0]}}));
+    run(&mut s, "config.activate", json!({"row":"Paint"}));
+    let state = s.model.state();
+    let body = state.body(&body).unwrap();
+    let colors = s.doc.face_colors(body);
+    let names = solvecraft_doc::naming::face_names(body);
+    assert!(colors.len() >= 2, "split should create multiple painted pieces: {names:?}");
+    assert!(colors.iter().all(|(index, look)| solvecraft_doc::naming::strip_piece(&names[*index]).ends_with(":+z") && look.name == "ABS - Red"));
+}
+
+#[test]
+fn strict_face_missing_lineage_never_retargets_and_rolls_back() {
+    let mut s = Session::default();
+    let body = block(&mut s);
+    let key = face_column(&mut s, &body, json!([5, 5, 10]));
+    run(&mut s, "config.row", json!({"name":"Paint","values":{key:"ABS - Red"}}));
+    run(&mut s, "solid.box", json!({"length":10,"width":10,"height":10,"corner":[30,0,0],"operation":"new"}));
+    let other = s.doc.features.last().unwrap().id;
+    let Column::FaceAppearance(target) = &mut s.doc_mut().configs.columns[0] else { panic!() };
+    target.origin_feature = other;
+    target.name = format!("F{other}:+z");
+    let before = s.doc.clone();
+    let revision = s.revision;
+    let history = s.undo.len();
+    assert!(s.execute("config.activate", &json!({"row":"Paint"})).is_err());
+    assert!(s.execute("config.preview", &json!({"row":"Paint"})).is_err());
+    assert_eq!(s.doc, before);
+    assert_eq!(s.revision, revision);
+    assert_eq!(s.undo.len(), history);
+    let look = solvecraft_doc::appearance::library("ABS - Red").unwrap();
+    s.doc_mut().appearances.faces.push(solvecraft_doc::appearance::FaceLook {
+        body: body.clone(),
+        point: solvecraft_geom::Vec3::new(5., 5., 10.),
+        name: Some(format!("F{other}:+z")),
+        strict_name: true,
+        certificate: None,
+        look,
+    });
+    assert!(s.doc.face_colors(s.model.state().body(&body).unwrap()).is_empty());
+    s.doc_mut().appearances.faces[0].strict_name = false;
+    assert_eq!(s.doc.face_colors(s.model.state().body(&body).unwrap()).len(), 1);
+}
+
+#[test]
+fn face_occurrence_pick_uses_definition_identity_and_coordinates() {
+    let mut s = Session::default();
+    let component = run(&mut s, "component.create", json!({"name":"Part"}))["component"].as_u64().unwrap();
+    let body = block(&mut s);
+    run(&mut s, "occurrence.copy", json!({"component":component,"translate":[30,0,0]}));
+    let world = s.world_state();
+    let placed = world.bodies.iter().find(|body| body.name != body.definition_name()).unwrap();
+    let placed_name = placed.name.clone();
+    let point = solvecraft_doc::apply_point(&placed.source_transform, solvecraft_geom::Vec3::new(5., 5., 10.));
+    let key = face_column(&mut s, &placed_name, json!(point));
+    let Column::FaceAppearance(target) = &s.doc.configs.columns[0] else { panic!() };
+    assert_eq!(target.body, body);
+    assert!(target.point.dist(solvecraft_geom::Vec3::new(5., 5., 10.)) < 1e-8);
+    run(&mut s, "config.row", json!({"name":"Paint","values":{key:"ABS - Blue"}}));
+    run(&mut s, "config.activate", json!({"row":"Paint"}));
+    assert!(s.world_state().bodies.iter().all(|body| s.doc.face_colors(body).len() == 1));
+}
+
+#[test]
+fn extrude_cap_certification_follows_actual_positive_negative_and_symmetric_names() {
+    for direction in ["positive", "negative", "symmetric"] {
+        let mut s = Session::default();
+        run(&mut s, "sketch.create", json!({"plane":"xy"}));
+        run(&mut s, "sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[10,10]}));
+        run(&mut s, "sketch.finish", json!({}));
+        run(&mut s, "solid.extrude", json!({"distance":10,"direction":direction,"body_name":"Pad"}));
+        let state = s.model.state();
+        let body = state.body("Pad").unwrap();
+        let faces = body.body.faces(0.01).unwrap();
+        let names = solvecraft_doc::naming::face_names(body);
+        let mut caps = 0;
+        for face in faces {
+            let name = solvecraft_doc::naming::strip_piece(&names[face.index]);
+            let origin = name.strip_prefix('F').unwrap().split_once(':').unwrap().0.parse().unwrap();
+            let target = ConfigFaceTarget { body: "Pad".into(), origin_feature: origin, name: name.into(), point: face.centroid, certificate: None };
+            if name.ends_with(":start") || name.ends_with(":top") || name.ends_with(":bottom") {
+                s.doc.certify_config_face(&target).unwrap();
+                s.doc.configuration_face_indices(body, &target).unwrap();
+                caps += 1;
+            } else {
+                assert!(s.doc.certify_config_face(&target).is_err());
+            }
+        }
+        assert_eq!(caps, 2, "{direction}");
+    }
+}
+
+#[test]
+fn ordinary_extent_edits_never_transfer_strict_cap_paint_to_ambiguous_caps() {
+    let mut s = Session::default();
+    run(&mut s, "sketch.create", json!({"plane":"xy"}));
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[0,0],"p1":[10,10]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"distance":10,"body_name":"Pad","name":"PadFeature","start_offset":"0 mm"}));
+    let key = face_column(&mut s, "Pad", json!([5, 5, 10]));
+    run(&mut s, "config.row", json!({"name":"Paint","values":{key:"ABS - Red"}}));
+    run(&mut s, "config.activate", json!({"row":"Paint"}));
+    assert_eq!(s.doc.face_colors(s.model.state().body("Pad").unwrap()).len(), 1);
+    run(&mut s, "timeline.redefine", json!({"feature":"PadFeature","command":"solid.extrude","params":{"distance":10,"start_offset":5}}));
+    assert!(s.doc.face_colors(s.model.state().body("Pad").unwrap()).is_empty(), "ordinary offset edit must not paint both new top-named caps");
+    let before = s.doc.clone();
+    assert!(s.execute("config.activate", &json!({"row":"Paint"})).is_err());
+    assert_eq!(s.doc, before);
+}
+
+#[test]
+fn hostile_and_uncertified_face_targets_are_rejected() {
+    let mut s = Session::default();
+    let body = block(&mut s);
+    let id = s.doc.features[0].id;
+    let target = ConfigFaceTarget {
+        body: body.clone(),
+        origin_feature: id,
+        name: format!("F{id}:face:0"),
+        point: solvecraft_geom::Vec3::ZERO,
+        certificate: None,
+    };
+    assert!(s.doc.certify_config_face(&target).is_err());
+    for value in [
+        json!({"body":body,"origin_feature":id,"name":"x".repeat(1_000_000),"point":[0,0,0]}),
+        json!({"body":body,"origin_feature":id,"name":format!("F{id}:+z"),"point":[0,0,1e20]}),
+        json!({"body":body,"origin_feature":id,"name":format!("F{id}:+z"),"point":[0,0,0],"extra":[[]]}),
+    ] {
+        assert!(solvecraft_doc::config::validate_styles_json(&json!({"configs":{"columns":[{"face_appearance":value}]}})).is_err());
+    }
+    assert!(s.execute("config.column", &json!({"component_appearance":0})).is_err());
+    assert!(s.execute("config.column", &json!({"face_appearance":{"body":body,"point":[0,0,1e20]}})).is_err());
+}

crates/engine/src/cmd/construct.rs

@@ -0,0 +1,260 @@
+//! SOLID ▸ CONSTRUCT: construction axes, points and the planes built from model geometry.
+//!
+//! References are given as `{face: [x,y,z]}`, `{edge: [x,y,z]}`, `{vertex: [x,y,z]}`,
+//! `{point: [x,y,z]}`, `{plane: XY|name|{origin, normal}}`, `{axis: X|Y|Z|name}`,
+//! `{construct_point: name}`, `{sketch, point}` or `{sketch, curve}`, or as a tagged
+//! `GeoRef` (`{"type": "edge", "at": …}`). Picked faces and edges are stored with their
+//! persistent names.
+
+use serde_json::Value;
+use solvecraft_doc::construct::{AxisDef, GeoRef, PointDef};
+use solvecraft_doc::{FeatureKind, PlaneRef};
+
+use super::CommandSpec;
+use super::features::{add_feature, check_expr, plane_param, sketch_id};
+use crate::params::{bad, req_expr, str_, vec3};
+use crate::{Result, Session};
+
+const REF: &str =
+    "{face|edge|vertex|point: [x,y,z]} | {plane: XY|name|{origin, normal}} | {axis: X|Y|Z|name} | {construct_point: name} | {sketch, point|curve}";
+
+pub static COMMANDS: &[CommandSpec] = &[
+    CommandSpec::new("construct.axis.through_cylinder", "Axis Through Cylinder/Cone/Torus", axis_face)
+        .at("SOLID", "CONSTRUCT")
+        .icon("axis")
+        .params("face: ref (a cylinder, cone or torus face, or a circular edge); name?"),
+    CommandSpec::new("construct.axis.normal_to_face", "Axis Perpendicular To Face", axis_normal)
+        .at("SOLID", "CONSTRUCT")
+        .icon("axis")
+        .params("face: ref; point: ref (the axis goes through it, square to the face); name?"),
+    CommandSpec::new("construct.axis.two_planes", "Axis Through Two Planes", axis_planes)
+        .at("SOLID", "CONSTRUCT")
+        .icon("axis")
+        .params("a, b: plane or planar face refs; name?"),
+    CommandSpec::new("construct.axis.two_points", "Axis Through Two Points", axis_points)
+        .at("SOLID", "CONSTRUCT")
+        .icon("axis")
+        .params("a, b: point refs (vertices, sketch points, points); name?"),
+    CommandSpec::new("construct.axis.edge", "Axis Through Edge", axis_edge)
+        .at("SOLID", "CONSTRUCT")
+        .icon("axis")
+        .params("edge: ref (a straight edge or sketch line); name?"),
+    CommandSpec::new("construct.point.vertex", "Point At Vertex", point_at)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("point: ref (vertex, sketch point, point); name?"),
+    CommandSpec::new("construct.point.two_edges", "Point Through Two Edges", point_edges)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("a, b: edge or line refs (where they meet, or come closest); name?"),
+    CommandSpec::new("construct.point.three_planes", "Point Through Three Planes", point_planes)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("a, b, c: plane or planar face refs; name?"),
+    CommandSpec::new("construct.point.center", "Point At Center Of Circle/Sphere/Torus", point_center)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("of: ref (circular edge, sketch circle or arc, sphere or torus face); name?"),
+    CommandSpec::new("construct.point.edge_plane", "Point At Edge And Plane", point_edge_plane)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("edge: edge or line ref; plane: plane or planar face ref; name?"),
+    CommandSpec::new("construct.point.along_path", "Point Along Path", point_along)
+        .at("SOLID", "CONSTRUCT")
+        .icon("point")
+        .params("path: edge or sketch curve ref; t: expr, 0…1 along it (default 0.5); name?"),
+    CommandSpec::new("construct.plane.midplane", "Midplane", plane_mid)
+        .at("SOLID", "CONSTRUCT")
+        .icon("plane")
+        .params("a, b: plane or planar face refs (halfway between; bisecting when they meet at an angle); name?"),
+    CommandSpec::new("construct.plane.two_edges", "Plane Through Two Edges", plane_edges)
+        .at("SOLID", "CONSTRUCT")
+        .icon("plane")
+        .params("a, b: straight edge or line refs in one plane; name?"),
+    CommandSpec::new("construct.plane.three_points", "Plane Through Three Points", plane_points)
+        .at("SOLID", "CONSTRUCT")
+        .icon("plane")
+        .params("a, b, c: point refs; name?"),
+    CommandSpec::new("construct.plane.tangent", "Tangent Plane", plane_tangent)
+        .at("SOLID", "CONSTRUCT")
+        .icon("plane")
+        .params("face: ref (cylinder, cone, sphere or torus); at?: [x,y,z] where it touches (default: the face pick); name?"),
+    CommandSpec::new("construct.plane.along_path", "Plane Along Path", plane_along)
+        .at("SOLID", "CONSTRUCT")
+        .icon("plane")
+        .params("path: edge or sketch curve ref; t: expr, 0…1 along it (default 0.5); name? The plane is square to the path there"),
+    CommandSpec::new("construct.plane.perpendicular", "Perpendicular Plane", plane_perpendicular).at("SOLID", "CONSTRUCT").icon("plane").params(
+        "plane: plane or planar face ref; line: straight edge, sketch line or axis ref; name? The plane holds the line and is square to the plane",
+    ),
+];
+
+/// A reference from its JSON form.
+fn geo(s: &Session, v: Option<&Value>, cmd: &str, what: &str) -> Result<GeoRef> {
+    let v = v.ok_or_else(|| bad(cmd, format!("`{what}` is required: {REF}")))?;
+    let p3 = |k: &str| v.get(k).and_then(vec3);
+    let mut g = if v.get("type").is_some() {
+        serde_json::from_value::<GeoRef>(v.clone()).map_err(|e| bad(cmd, format!("`{what}`: {e}")))?
+    } else if let Some(at) = p3("face") {
+        GeoRef::Face { at, name: None }
+    } else if let Some(at) = p3("edge") {
+        GeoRef::Edge { at, name: None }
+    } else if let Some(at) = p3("vertex") {
+        GeoRef::Vertex { at }
+    } else if let Some(sk) = v.get("sketch") {
+        let sketch = sketch_id(s, Some(sk), cmd, what)?;
+        match (str_(v, "point"), str_(v, "curve")) {
+            (Some(point), _) => GeoRef::SketchPoint { sketch, point: point.to_string() },
+            (None, Some(curve)) => GeoRef::SketchCurve { sketch, curve: curve.to_string() },
+            _ => return Err(bad(cmd, format!("`{what}`: a sketch reference needs `point` or `curve`"))),
+        }
+    } else if let Some(p) = p3("point") {
+        GeoRef::Point { p }
+    } else if v.get("plane").is_some() {
+        GeoRef::Plane { plane: plane_param(s, v.get("plane"), cmd)? }
+    } else if let Some(a) = str_(v, "axis") {
+        if ["x", "y", "z"].contains(&a.to_ascii_lowercase().as_str()) {
+            GeoRef::World { axis: a.to_ascii_uppercase() }
+        } else {
+            match s.doc.find_feature(a).map(|f| &f.kind) {
+                Some(FeatureKind::ConstructionAxis { .. }) => GeoRef::Axis { name: a.to_string() },
+                _ => return Err(bad(cmd, format!("no axis `{a}`"))),
+            }
+        }
+    } else if let Some(n) = str_(v, "construct_point") {
+        match s.doc.find_feature(n).map(|f| &f.kind) {
+            Some(FeatureKind::ConstructionPoint { .. }) => GeoRef::ConstructPoint { name: n.to_string() },
+            _ => return Err(bad(cmd, format!("no construction point `{n}`"))),
+        }
+    } else if v.as_str().is_some() {
+        // A bare string: a plane.
+        GeoRef::Plane { plane: plane_param(s, Some(v), cmd)? }
+    } else {
+        return Err(bad(cmd, format!("`{what}` must be {REF}")));
+    };
+    g.name_picks(&s.model.state());
+    Ok(g)
+}
+
+fn t_param(s: &Session, p: &Value, cmd: &str) -> Result<String> {
+    let t = if p.get("t").is_some() { req_expr(cmd, p, "t")? } else { "0.5".to_string() };
+    check_expr(s, &t, solvecraft_doc::expr::Kind::Unitless, cmd, "t")?;
+    Ok(t)
+}
+
+fn axis(s: &mut Session, p: &Value, def: AxisDef) -> Result<Value> {
+    add_feature(s, p, FeatureKind::ConstructionAxis { def })
+}
+
+fn point(s: &mut Session, p: &Value, def: PointDef) -> Result<Value> {
+    add_feature(s, p, FeatureKind::ConstructionPoint { def })
+}
+
+fn plane(s: &mut Session, p: &Value, plane: PlaneRef) -> Result<Value> {
+    add_feature(s, p, FeatureKind::ConstructionPlane { plane })
+}
+
+fn axis_face(s: &mut Session, p: &Value) -> Result<Value> {
+    let face = geo(s, p.get("face"), "construct.axis.through_cylinder", "face")?;
+    axis(s, p, AxisDef::ThroughFace { face })
+}
+
+fn axis_normal(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.axis.normal_to_face";
+    let face = geo(s, p.get("face"), cmd, "face")?;
+    let point = geo(s, p.get("point"), cmd, "point")?;
+    axis(s, p, AxisDef::NormalToFace { face, point })
+}
+
+fn axis_planes(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.axis.two_planes";
+    let (a, b) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?);
+    axis(s, p, AxisDef::TwoPlanes { a, b })
+}
+
+fn axis_points(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.axis.two_points";
+    let (a, b) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?);
+    axis(s, p, AxisDef::TwoPoints { a, b })
+}
+
+fn axis_edge(s: &mut Session, p: &Value) -> Result<Value> {
+    let edge = geo(s, p.get("edge"), "construct.axis.edge", "edge")?;
+    axis(s, p, AxisDef::Edge { edge })
+}
+
+fn point_at(s: &mut Session, p: &Value) -> Result<Value> {
+    let at = geo(s, p.get("point"), "construct.point.vertex", "point")?;
+    point(s, p, PointDef::At { point: at })
+}
+
+fn point_edges(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.point.two_edges";
+    let (a, b) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?);
+    point(s, p, PointDef::TwoEdges { a, b })
+}
+
+fn point_planes(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.point.three_planes";
+    let (a, b, c) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?, geo(s, p.get("c"), cmd, "c")?);
+    point(s, p, PointDef::ThreePlanes { a, b, c })
+}
+
+fn point_center(s: &mut Session, p: &Value) -> Result<Value> {
+    let of = geo(s, p.get("of"), "construct.point.center", "of")?;
+    point(s, p, PointDef::Center { of })
+}
+
+fn point_edge_plane(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.point.edge_plane";
+    let (edge, pl) = (geo(s, p.get("edge"), cmd, "edge")?, geo(s, p.get("plane"), cmd, "plane")?);
+    point(s, p, PointDef::EdgeAndPlane { edge, plane: pl })
+}
+
+fn point_along(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.point.along_path";
+    let path = geo(s, p.get("path"), cmd, "path")?;
+    let t = t_param(s, p, cmd)?;
+    point(s, p, PointDef::AlongPath { path, t })
+}
+
+fn plane_mid(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.midplane";
+    let (a, b) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?);
+    plane(s, p, PlaneRef::Midplane { a: Box::new(a), b: Box::new(b) })
+}
+
+fn plane_edges(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.two_edges";
+    let (a, b) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?);
+    plane(s, p, PlaneRef::TwoEdges { a: Box::new(a), b: Box::new(b) })
+}
+
+fn plane_points(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.three_points";
+    let (a, b, c) = (geo(s, p.get("a"), cmd, "a")?, geo(s, p.get("b"), cmd, "b")?, geo(s, p.get("c"), cmd, "c")?);
+    plane(s, p, PlaneRef::ThreePoints { a: Box::new(a), b: Box::new(b), c: Box::new(c) })
+}
+
+fn plane_tangent(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.tangent";
+    let face = geo(s, p.get("face"), cmd, "face")?;
+    let at = match (p.get("at").and_then(vec3), &face) {
+        (Some(a), _) => a,
+        (None, GeoRef::Face { at, .. }) => *at,
+        _ => return Err(bad(cmd, "`at` is required: where the plane touches the face")),
+    };
+    plane(s, p, PlaneRef::Tangent { face: Box::new(face), at })
+}
+
+fn plane_along(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.along_path";
+    let path = geo(s, p.get("path"), cmd, "path")?;
+    let t = t_param(s, p, cmd)?;
+    plane(s, p, PlaneRef::AlongPath { path: Box::new(path), t })
+}
+
+fn plane_perpendicular(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "construct.plane.perpendicular";
+    let (base, line) = (geo(s, p.get("plane"), cmd, "plane")?, geo(s, p.get("line"), cmd, "line")?);
+    plane(s, p, PlaneRef::Perpendicular { plane: Box::new(base), line: Box::new(line) })
+}

crates/engine/src/cmd/contact_sweep.rs

@@ -0,0 +1,251 @@
+//! Bounded, chronological checks of a joint trajectory. This samples tessellated geometry;
+//! it is deliberately not advertised as exact continuous collision detection.
+use std::collections::{BTreeSet, HashMap};
+use std::sync::Arc;
+
+use solvecraft_doc::joints;
+use solvecraft_doc::{IDENTITY, Mat, apply_point, mat_mul};
+use solvecraft_geom::{Aabb3, Mesh, Vec3};
+
+use crate::params::bad;
+use crate::{Result, Session};
+
+const MAX_SAMPLES: usize = 4096;
+const MAX_PLACEMENTS: usize = 4096;
+const MAX_BODIES: usize = 256;
+const MAX_TRIANGLES: usize = 50_000;
+const MAX_WORK: usize = 50_000_000;
+
+fn limit(message: &str) -> crate::EngineError {
+    bad("contact.sweep", message)
+}
+
+struct CachedBody {
+    path: Vec<u64>,
+    offset: Mat,
+    mesh: Arc<Mesh>,
+    size: f64,
+}
+
+pub(super) struct ContactGeometry {
+    bodies: Vec<CachedBody>,
+    pairs: Vec<(usize, usize, String, String)>,
+    step: f64,
+}
+
+impl ContactGeometry {
+    pub(super) fn new(s: &Session) -> Result<Self> {
+        let assembly = &s.doc.assembly;
+        let sets: Vec<Vec<u64>> = if assembly.contact_all {
+            vec![s.doc.occurrences.iter().map(|o| o.id).collect()]
+        } else {
+            assembly.contact_sets.iter().filter(|set| !set.suppressed).map(|set| set.occurrences.clone()).collect()
+        };
+        let mut out = Self { bodies: Vec::new(), pairs: Vec::new(), step: f64::INFINITY };
+        if sets.is_empty() {
+            return Ok(out);
+        }
+        let state = s.model.state();
+        let mut meshes: HashMap<String, Arc<Mesh>> = HashMap::new();
+        let mut stack = vec![(0, Vec::<u64>::new())];
+        let mut count = 0;
+        while let Some((component, path)) = stack.pop() {
+            count += 1;
+            if count > MAX_PLACEMENTS || path.len() > 64 {
+                return Err(limit("assembly exceeds contact sweep placement budget"));
+            }
+            for occurrence in s.doc.occurrences.iter().filter(|o| o.parent == component) {
+                let mut child = path.clone();
+                child.push(occurrence.id);
+                stack.push((occurrence.component, child));
+                if stack.len() > MAX_PLACEMENTS {
+                    return Err(limit("assembly exceeds contact sweep placement budget"));
+                }
+            }
+            if !sets.iter().any(|set| path.iter().any(|id| set.contains(id))) {
+                continue;
+            }
+            for body in state.bodies.iter().filter(|b| s.doc.model_body_component(b) == component) {
+                if body.body.is_mesh() {
+                    return Err(limit("contact sweep does not support mesh bodies; disable their contact set to move them"));
+                }
+                if out.bodies.len() >= MAX_BODIES {
+                    return Err(limit("too many bodies for a contact sweep"));
+                }
+                let mesh = if let Some(mesh) = meshes.get(&body.name) {
+                    mesh.clone()
+                } else {
+                    let mesh = body.body.tessellate((body.body.size() * 1e-3).max(1e-3))?;
+                    if mesh.triangles.len() > MAX_TRIANGLES || mesh.positions.len().saturating_add(mesh.triangles.len().saturating_mul(4)) > 200_000 {
+                        return Err(limit("body exceeds contact sweep tessellation budget"));
+                    }
+                    let extent = mesh.bounds().size();
+                    // Whole-body widths along bounded distinct facet normals catch tilted
+                    // plates without interpreting skinny mesh triangles as thin material.
+                    // Local thin walls of a wider body remain a sampling limitation.
+                    let mut thickness = extent.x.min(extent.y).min(extent.z);
+                    let mut directions: Vec<Vec3> = Vec::new();
+                    for triangle in &mesh.triangles {
+                        let Some([a, b, c]) = mesh.tri(triangle) else {
+                            return Err(limit("invalid contact tessellation"));
+                        };
+                        let Some(direction) = (b - a).cross(c - a).normalized() else { continue };
+                        if directions.len() < 32 && !directions.iter().any(|d| d.dot(direction).abs() > 1.0 - 1e-6) {
+                            directions.push(direction);
+                        }
+                    }
+                    for direction in directions {
+                        let (mut low, mut high) = (f64::INFINITY, f64::NEG_INFINITY);
+                        for point in &mesh.positions {
+                            let projected = point.dot(direction);
+                            low = low.min(projected);
+                            high = high.max(projected);
+                        }
+                        thickness = thickness.min(high - low);
+                    }
+                    if !thickness.is_finite() || thickness <= 1e-9 {
+                        return Err(limit("body is too thin for a bounded contact sweep"));
+                    }
+                    out.step = out.step.min(thickness * 0.25);
+                    let mesh = Arc::new(mesh);
+                    meshes.insert(body.name.clone(), mesh.clone());
+                    mesh
+                };
+                out.bodies.push(CachedBody {
+                    path: path.clone(),
+                    offset: s.doc.model_body_offset(body).copied().unwrap_or(IDENTITY),
+                    mesh,
+                    size: body.body.size(),
+                });
+            }
+        }
+        let mut pairs = BTreeSet::new();
+        for set in &sets {
+            let tagged: Vec<(usize, u64)> =
+                out.bodies.iter().enumerate().filter_map(|(i, b)| b.path.iter().rev().find(|id| set.contains(id)).map(|id| (i, *id))).collect();
+            for (i, (a, oa)) in tagged.iter().enumerate() {
+                for (b, ob) in tagged.iter().skip(i + 1) {
+                    if oa != ob {
+                        pairs.insert((*a, *b, *oa, *ob));
+                    }
+                }
+            }
+        }
+        let name = |id| s.doc.occurrences.iter().find(|o| o.id == id).map(|o| o.name.clone()).unwrap_or_default();
+        out.pairs = pairs.into_iter().map(|(a, b, oa, ob)| (a, b, name(oa), name(ob))).collect();
+        Ok(out)
+    }
+
+    pub(super) fn has_pairs(&self) -> bool {
+        !self.pairs.is_empty()
+    }
+
+    fn frame(body: &CachedBody, s: &Session) -> Result<Mat> {
+        let mut frame = IDENTITY;
+        for id in &body.path {
+            let occurrence = s.doc.occurrences.iter().find(|o| o.id == *id).ok_or_else(|| limit("contact occurrence disappeared"))?;
+            frame = mat_mul(&frame, &occurrence.transform);
+        }
+        Ok(mat_mul(&frame, &body.offset))
+    }
+
+    fn bounds(&self, s: &Session) -> Result<Aabb3> {
+        let mut bounds = Aabb3::EMPTY;
+        for body in &self.bodies {
+            let frame = Self::frame(body, s)?;
+            for point in &body.mesh.positions {
+                bounds.add(apply_point(&frame, *point));
+            }
+        }
+        Ok(bounds)
+    }
+
+    pub(super) fn samples(&self, start: &Session, end: &Session) -> Result<usize> {
+        let a = joints::joint_values(&start.doc.assembly);
+        let b = joints::joint_values(&end.doc.assembly);
+        let bounds = self.bounds(start)?.union(&self.bounds(end)?);
+        let state = start.model.state();
+        let (mut linear, mut angular, mut radius) = (0.0, 0.0, 0.0_f64);
+        for joint in start.doc.assembly.joints.iter().filter(|j| !j.suppressed) {
+            for (index, _) in joint.kind.dofs().iter().enumerate() {
+                let delta = (a.get(&joint.id).and_then(|q| q.get(index)).copied().unwrap_or(0.0)
+                    - b.get(&joint.id).and_then(|q| q.get(index)).copied().unwrap_or(0.0))
+                .abs();
+                if joint.kind.is_angle(index) {
+                    angular += delta;
+                    if delta == 0.0 {
+                        continue;
+                    }
+                    for session in [start, end] {
+                        for origin in [&joint.a, &joint.b] {
+                            let frame = session.doc.origin_world(&state, origin)?;
+                            let pivot = apply_point(&frame, Vec3::ZERO);
+                            let far = Vec3::new(
+                                (bounds.min.x - pivot.x).abs().max((bounds.max.x - pivot.x).abs()),
+                                (bounds.min.y - pivot.y).abs().max((bounds.max.y - pivot.y).abs()),
+                                (bounds.min.z - pivot.z).abs().max((bounds.max.z - pivot.z).abs()),
+                            );
+                            radius = radius.max(far.len());
+                        }
+                    }
+                } else {
+                    linear += delta;
+                }
+            }
+        }
+        let required = ((linear + angular * (radius + linear)) / self.step).max(angular / 1_f64.to_radians()).ceil().max(1.0);
+        if !required.is_finite() || required > MAX_SAMPLES as f64 {
+            return Err(limit("motion exceeds contact sweep sampling budget; drive the joint in smaller increments"));
+        }
+        let vertices: usize = self.bodies.iter().map(|body| body.mesh.positions.len()).sum();
+        if (required as usize).saturating_mul(vertices.saturating_add(self.pairs.len())) > MAX_WORK {
+            return Err(limit("motion exceeds contact sweep transform budget; simplify the contact set or use smaller increments"));
+        }
+        Ok(required as usize)
+    }
+
+    pub(super) fn first_hit(&self, s: &Session, work: &mut usize) -> Result<Option<(String, String, f64)>> {
+        let meshes: Vec<Mesh> = self
+            .bodies
+            .iter()
+            .map(|body| {
+                let frame = Self::frame(body, s)?;
+                let positions = body.mesh.positions.iter().map(|p| apply_point(&frame, *p)).collect();
+                Ok(Mesh { positions, triangles: body.mesh.triangles.clone(), ..Mesh::default() })
+            })
+            .collect::<Result<_>>()?;
+        for (a, b, aname, bname) in &self.pairs {
+            let (Some(ma), Some(mb), Some(ba), Some(bb)) = (meshes.get(*a), meshes.get(*b), self.bodies.get(*a), self.bodies.get(*b)) else {
+                return Err(limit("invalid contact geometry pair"));
+            };
+            let (aabb, bbb) = (ma.bounds(), mb.bounds());
+            if aabb.max.x < bbb.min.x
+                || bbb.max.x < aabb.min.x
+                || aabb.max.y < bbb.min.y
+                || bbb.max.y < aabb.min.y
+                || aabb.max.z < bbb.min.z
+                || bbb.max.z < aabb.min.z
+            {
+                continue;
+            }
+            let cost = ma
+                .positions
+                .len()
+                .saturating_add(ma.triangles.len().saturating_mul(4))
+                .saturating_mul(mb.triangles.len())
+                .saturating_add(mb.positions.len().saturating_add(mb.triangles.len().saturating_mul(4)).saturating_mul(ma.triangles.len()));
+            *work = work.saturating_add(cost);
+            if *work > MAX_WORK {
+                return Err(limit("motion exceeds contact sweep collision budget; simplify the contact set or use smaller increments"));
+            }
+            if let Some(depth) = super::mesh_overlap(ma, mb, 1e-4 * ba.size.max(bb.size).max(1.0)) {
+                return Ok(Some((aname.clone(), bname.clone(), depth)));
+            }
+        }
+        Ok(None)
+    }
+}
+
+#[cfg(test)]
+#[path = "contact_sweep_tests.rs"]
+mod tests;

crates/engine/src/cmd/contact_sweep_tests.rs

@@ -0,0 +1,170 @@
+use crate::Session;
+use serde_json::{Value, json};
+use solvecraft_geom::Vec3;
+
+fn run(s: &mut Session, command: &str, p: Value) -> Value {
+    s.execute(command, &p).unwrap()
+}
+fn occurrence(s: &Session, name: &str) -> u64 {
+    s.doc.occurrence_of(s.doc.find_component(name).unwrap()).unwrap().id
+}
+fn slider() -> Session {
+    let mut s = Session::default();
+    for (name, x) in [("A", 0), ("B", 20)] {
+        run(&mut s, "component.activate", json!({"component": 0}));
+        run(&mut s, "component.create", json!({"name": name}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [x, 0, 0]}));
+    }
+    let a = occurrence(&s, "A");
+    run(&mut s, "occurrence.ground", json!({"occurrence": a, "grounded": true}));
+    run(&mut s, "joint.create", json!({"type": "slider", "a": {"face": [10, 5, 5]}, "b": {"face": [20, 5, 5]}, "name": "Rail"}));
+    run(&mut s, "joint.drive", json!({"joint": "Rail", "value": 10}));
+    run(&mut s, "contact.create", json!({"occurrences": ["A", "B"]}));
+    s
+}
+fn rail_value(s: &Session) -> f64 {
+    s.doc.assembly.joints.iter().find(|j| j.name == "Rail").unwrap().values[0]
+}
+
+#[test]
+fn slider_cannot_tunnel_to_a_collision_free_endpoint() {
+    let mut s = slider();
+    let result = run(&mut s, "joint.drive", json!({"joint": "Rail", "value": -30}));
+    assert!(result["stopped_by_contact"].is_object(), "{result}");
+    assert!(rail_value(&s).abs() < 2e-3, "{}", rail_value(&s));
+    run(&mut s, "joint.drive", json!({"joint": "Rail", "value": 10}));
+    assert!((rail_value(&s) - 10.0).abs() < 1e-6, "can move away from contact");
+    run(&mut s, "contact.disable_all", json!({}));
+    run(&mut s, "joint.drive", json!({"joint": "Rail", "value": -100000}));
+    assert!((rail_value(&s) + 100000.0).abs() < 1e-6, "disabled contact skips sweep budget");
+}
+
+#[test]
+fn revolute_cannot_cross_a_blocker_between_clear_endpoints() {
+    let mut s = Session::default();
+    for (name, corner) in [("Arm", [20, -2, -2]), ("Blocker", [-2, 20, -2])] {
+        run(&mut s, "component.activate", json!({"component": 0}));
+        run(&mut s, "component.create", json!({"name": name}));
+        run(&mut s, "solid.box", json!({"length": 4, "width": 4, "height": 4, "corner": corner}));
+    }
+    run(
+        &mut s,
+        "joint.create",
+        json!({"type": "revolute", "a": {"occurrence": 0, "point": [0,0,0]}, "b": {"occurrence": "Arm", "point": [0,0,0]}, "flip": true, "name": "Pivot"}),
+    );
+    run(&mut s, "contact.create", json!({"occurrences": ["Arm", "Blocker"]}));
+    let result = run(&mut s, "joint.drive", json!({"joint": "Pivot", "value": "180 deg"}));
+    assert!(result["stopped_by_contact"].is_object(), "{result}");
+    let angle = s.doc.assembly.joints.iter().find(|j| j.name == "Pivot").unwrap().values[0];
+    assert!(angle > 60_f64.to_radians() && angle < 90_f64.to_radians(), "angle={angle}");
+    let arm = solvecraft_doc::apply_point(&solvecraft_doc::joints::occurrence_world(&s.doc, occurrence(&s, "Arm")), Vec3::new(22.0, 0.0, 0.0));
+    assert!(arm.y > 20.0 && arm.x > 2.0, "{arm:?}");
+}
+
+#[test]
+fn linked_slider_uses_effective_travel_for_contact() {
+    let mut s = slider();
+    run(&mut s, "component.activate", json!({"component": 0}));
+    run(&mut s, "component.create", json!({"name": "Input"}));
+    run(
+        &mut s,
+        "joint.create",
+        json!({"type": "slider", "a": {"occurrence": 0, "point": [0,0,0]}, "b": {"occurrence": "Input", "point": [0,0,0]}, "flip": true, "name": "Input Joint"}),
+    );
+    run(&mut s, "joint.drive", json!({"joint": "Input Joint", "value": 1}));
+    run(&mut s, "joint.motion_link", json!({"a": "Input Joint", "b": "Rail", "ratio": 10}));
+    let result = run(&mut s, "joint.drive", json!({"joint": "Input Joint", "value": -3}));
+    assert!(result["stopped_by_contact"].is_object(), "{result}");
+    let input = s.doc.assembly.joints.iter().find(|j| j.name == "Input Joint").unwrap().values[0];
+    assert!(input.abs() < 2e-4, "{input}");
+}
+
+#[test]
+fn motion_play_and_sparse_export_share_swept_contact_checks() {
+    let mut s = slider();
+    run(&mut s, "motion.study", json!({"name": "Crossing", "steps": 100, "keys": [{"joint": "Rail", "points": [[0,10], [100,-30]]}]}));
+    let doc = s.doc.clone();
+    let exported = run(&mut s, "motion.export", json!({"study": "Crossing", "samples": 2}));
+    assert!(std::sync::Arc::ptr_eq(&doc, &s.doc), "export leaves document untouched");
+    assert!(exported["samples"][1]["stopped_by_contact"].is_object(), "{exported}");
+    let played = run(&mut s, "motion.play", json!({"study": "Crossing", "step": 100}));
+    assert!(played["stopped_by_contact"].is_object(), "{played}");
+    assert!(rail_value(&s).abs() < 2e-3);
+}
+
+#[test]
+fn over_budget_sweep_errors_and_restores_document() {
+    let mut s = slider();
+    let doc = s.doc.clone();
+    let error = s.execute("joint.drive", &json!({"joint": "Rail", "value": -100000})).unwrap_err();
+    assert!(error.to_string().contains("sampling budget"), "{error}");
+    assert_eq!(*s.doc, *doc);
+    assert!((rail_value(&s) - 10.0).abs() < 1e-6);
+}
+
+#[test]
+fn thin_tilted_plates_cannot_cross_between_axis_bound_samples() {
+    let mut s = Session::default();
+    let normal = solvecraft_doc::apply_vector(&solvecraft_doc::rigid(Vec3::ZERO, Vec3::ZERO, Vec3::new(1.0, 1.0, 0.0), 55_f64.to_radians()), Vec3::Z);
+    for name in ["Plate A", "Plate B"] {
+        run(&mut s, "component.activate", json!({"component": 0}));
+        run(&mut s, "component.create", json!({"name": name}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 0.05, "corner": [-5,-5,-0.025], "body_name": name}));
+        run(&mut s, "solid.move", json!({"bodies": [name], "axis": [1,1,0], "angle": "55 deg"}));
+    }
+    let (a, b) = (occurrence(&s, "Plate A"), occurrence(&s, "Plate B"));
+    run(&mut s, "occurrence.move", json!({"occurrence": b, "translate": normal * 2.0}));
+    run(&mut s, "occurrence.ground", json!({"occurrence": a, "grounded": true}));
+    run(
+        &mut s,
+        "joint.as_built",
+        json!({"type": "slider", "a": "Plate A", "b": "Plate B", "at": {"occurrence": 0, "point": [0,0,0], "z": normal}, "name": "Slide"}),
+    );
+    run(&mut s, "contact.create", json!({"occurrences": ["Plate A", "Plate B"]}));
+    let result = run(&mut s, "joint.drive", json!({"joint": "Slide", "value": -4}));
+    assert!(result["stopped_by_contact"].is_object(), "{result}");
+    let value = s.doc.assembly.joints.iter().find(|j| j.name == "Slide").unwrap().values[0];
+    assert!(value > -2.0 && value < -1.9, "{value}");
+}
+
+#[test]
+fn ordinary_curved_bodies_keep_a_practical_sampling_step() {
+    for curved in ["sphere", "fillet"] {
+        let mut s = Session::default();
+        run(&mut s, "component.create", json!({"name": "Blocker"}));
+        run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [0,-5,-5]}));
+        run(&mut s, "component.activate", json!({"component": 0}));
+        run(&mut s, "component.create", json!({"name": "Curved"}));
+        if curved == "sphere" {
+            run(&mut s, "solid.sphere", json!({"radius": 5, "center": [20,0,0]}));
+        } else {
+            run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [15,-5,-5]}));
+            run(&mut s, "solid.fillet", json!({"edges": [[15,-5,0]], "radius": 2}));
+        }
+        run(
+            &mut s,
+            "joint.as_built",
+            json!({"type": "slider", "a": 0, "b": "Curved", "at": {"occurrence": 0, "point": [0,0,0], "z": [1,0,0]}, "name": "Slide"}),
+        );
+        run(&mut s, "contact.create", json!({"occurrences": ["Blocker", "Curved"]}));
+        let geometry = super::ContactGeometry::new(&s).unwrap();
+        assert!(geometry.step > 1.0, "{curved}: tessellation must not force tiny steps: {}", geometry.step);
+        let result = run(&mut s, "joint.drive", json!({"joint": "Slide", "value": -30}));
+        assert!(result["stopped_by_contact"].is_object(), "{curved}: {result}");
+        let value = s.doc.assembly.joints.iter().find(|j| j.name == "Slide").unwrap().values[0];
+        assert!(value > -5.02 && value < -4.9, "{curved}: {value}");
+    }
+}
+
+#[test]
+fn initially_overlapping_assembly_can_move_out_for_recovery() {
+    let mut s = slider();
+    run(&mut s, "contact.disable_all", json!({}));
+    run(&mut s, "joint.drive", json!({"joint": "Rail", "value": -5}));
+    run(&mut s, "contact.enable_sets", json!({"enabled": true}));
+    assert!(!run(&mut s, "contact.check", json!({}))["collisions"].as_array().unwrap().is_empty());
+    let result = run(&mut s, "joint.drive", json!({"joint": "Rail", "value": 10}));
+    assert!(result["stopped_by_contact"].is_null(), "recovery must not stick: {result}");
+    assert!((rail_value(&s) - 10.0).abs() < 1e-6);
+    assert!(run(&mut s, "contact.check", json!({}))["collisions"].as_array().unwrap().is_empty());
+}

crates/engine/src/cmd/delete.rs

@@ -6,6 +6,7 @@
 
 use serde_json::{Value, json};
 use solvecraft_doc::FeatureKind;
+use solvecraft_geom::Vec3;
 
 use super::CommandSpec;
 use crate::params::{bad, bool_};
@@ -63,8 +64,13 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     let mut entities = Vec::new();
     let mut features: Vec<u64> = Vec::new();
     let mut bodies: Vec<String> = Vec::new();
+    let mut faces: Vec<(String, Vec<Vec3>)> = Vec::new();
+    let mut selected_occurrences = Vec::new();
     for x in &items {
         match x {
+            Sel::Occurrence { path } => {
+                selected_occurrences.push(s.occurrence_placement(path)?.occurrence.to_string());
+            }
             Sel::SketchCurve { id } | Sel::SketchPoint { id } | Sel::SketchConstraint { id } => entities.push(id.clone()),
             Sel::Feature { id } => {
                 if s.doc.feature(*id).is_none() {
@@ -78,7 +84,10 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
             },
             Sel::Axis { .. } => skip("the origin axes can't be deleted".into()),
             Sel::Body { name } => bodies.push(name.clone()),
-            Sel::Face { .. } => skip("Delete Face: not available yet".into()),
+            Sel::Face { body, point, .. } => match faces.iter_mut().find(|(b, _)| b == body) {
+                Some((_, ps)) => ps.push(*point),
+                None => faces.push((body.clone(), vec![*point])),
+            },
             Sel::Edge { .. } | Sel::Vertex { .. } => skip("edges and vertices are deleted with their body or face".into()),
             Sel::Profile { .. } => skip("a profile goes with its sketch".into()),
         }
@@ -93,9 +102,14 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
             done = true;
         }
     }
+    // Faces of a body that is going anyway are left to it; the rest become Delete Face features.
+    for (body, points) in faces.iter().filter(|(b, _)| !bodies.contains(b)) {
+        sub(s, "face.delete", json!({ "faces": points, "body": body }))?;
+        done = true;
+    }
     if !features.is_empty() {
         let ids: Vec<String> = features.iter().map(u64::to_string).collect();
-        sub(s, "FusionDeleteCommand", json!({ "features": ids }))?;
+        sub(s, "timeline.delete", json!({ "features": ids }))?;
         done = true;
     }
     // Bodies still there (not made by a feature deleted above) get a Remove feature.
@@ -103,12 +117,15 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     bodies.retain(|b| st.body(b).is_some());
     bodies.dedup();
     if !bodies.is_empty() {
-        sub(s, "SoftDeleteCommand", json!({ "bodies": bodies }))?;
+        sub(s, "solid.remove", json!({ "bodies": bodies }))?;
         done = true;
     }
     // An occurrence goes alone while its component has others; the last one takes the component.
     let mut components: Vec<u64> = Vec::new();
-    for k in keys(p, "occurrences") {
+    selected_occurrences.extend(keys(p, "occurrences"));
+    selected_occurrences.sort();
+    selected_occurrences.dedup();
+    for k in selected_occurrences {
         let Some(o) = s.doc.occurrences.iter().find(|o| o.id.to_string() == k || o.name == k).cloned() else {
             return Err(bad(cmd, format!("no occurrence `{k}`")));
         };
@@ -174,12 +191,12 @@ mod tests {
     /// A sketch with a rectangle extruded into a body, a second box, and an offset plane.
     fn part() -> (Session, u64) {
         let mut s = Session::default();
-        let sk = run(&mut s, "SketchCreate", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
-        run(&mut s, "ShapeRectangleTwoPoint", json!({"p0": [0, 0], "p1": [10, 20]}));
-        run(&mut s, "SketchStop", json!({}));
-        run(&mut s, "Extrude", json!({"distance": 5}));
-        run(&mut s, "PrimitiveBox", json!({"length": 5, "width": 5, "height": 5, "corner": [50, 0, 0]}));
-        run(&mut s, "ConstructionPlaneOffsetFromPlaneCommand", json!({"base": "XY", "offset": 10}));
+        let sk = run(&mut s, "sketch.create", json!({"plane": "XY"}))["sketch"].as_u64().unwrap();
+        run(&mut s, "sketch.rectangle.two_point", json!({"p0": [0, 0], "p1": [10, 20]}));
+        run(&mut s, "sketch.finish", json!({}));
+        run(&mut s, "solid.extrude", json!({"distance": 5}));
+        run(&mut s, "solid.box", json!({"length": 5, "width": 5, "height": 5, "corner": [50, 0, 0]}));
+        run(&mut s, "construct.plane.offset", json!({"base": "XY", "offset": 10}));
         (s, sk)
     }
 
@@ -192,7 +209,7 @@ mod tests {
         assert!(dry["deleted"].as_array().unwrap().len() >= 2, "the extrude goes with its sketch: {dry}");
         run(&mut s, "selection.delete", json!({"items": [{"type": "feature", "id": sk}]}));
         assert_eq!(bodies(&s), 1);
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!(s.doc.features.len(), n);
         assert_eq!(bodies(&s), 2);
     }
@@ -212,7 +229,7 @@ mod tests {
         assert!(s.doc.find_feature("Plane1").is_none());
         assert_eq!(r["skipped"][0], "the origin planes can't be deleted");
         assert_eq!(s.undo.len(), depth + 1);
-        run(&mut s, "UndoCommand", json!({}));
+        run(&mut s, "edit.undo", json!({}));
         assert_eq!((bodies(&s), s.doc.features.len()), (2, n));
     }
 
@@ -221,7 +238,8 @@ mod tests {
         let (mut s, _) = part();
         let b = s.model.state().bodies[0].name.clone();
         let e = s.execute("selection.delete", &json!({"items": [{"type": "face", "body": b, "index": 0, "point": [0, 0, 0]}]})).unwrap_err();
-        assert!(e.to_string().contains("not available yet"), "{e}");
+        // A side of the part its neighbours can't close: Delete Face refuses it.
+        assert!(e.to_string().contains("Delete Face"), "{e}");
         for p in [
             json!({}),
             json!({"items": "x"}),
@@ -237,7 +255,7 @@ mod tests {
     fn occurrences_components_and_sketch_entities() {
         let (mut s, _) = part();
         let b = s.model.state().bodies[1].name.clone();
-        run(&mut s, "FusionCreateComponentsFromBodiesCommand", json!({"bodies": [b]}));
+        run(&mut s, "component.from_bodies", json!({"bodies": [b]}));
         let c = s.doc.components[0].id;
         let o1 = s.doc.occurrence_of(c).unwrap().id;
         run(&mut s, "occurrence.copy", json!({"component": c, "translate": [0, 30, 0]}));
@@ -249,8 +267,8 @@ mod tests {
         run(&mut s, "selection.delete", json!({"occurrences": [o2]}));
         assert!(s.doc.components.is_empty());
         // Sketch entities while sketching.
-        run(&mut s, "SketchCreate", json!({"plane": "XY"}));
-        run(&mut s, "DrawPolyline", json!({"points": [[0, 0], [10, 0]]}));
+        run(&mut s, "sketch.create", json!({"plane": "XY"}));
+        run(&mut s, "sketch.line", json!({"points": [[0, 0], [10, 0]]}));
         let sk = s.active_sketch.unwrap();
         let id = s.model.state().sketch(sk).unwrap().sketch.curves[0].id.clone();
         run(&mut s, "selection.delete", json!({"items": [{"type": "sketch_curve", "id": id}]}));

crates/engine/src/cmd/edit.rs

@@ -8,17 +8,23 @@ use crate::params::{bad, bool_, num, str_, string_list};
 use crate::{EngineError, Result, Sel, Session, Snapshot};
 
 pub static COMMANDS: &[CommandSpec] = &[
-    CommandSpec::new("UndoCommand", "Undo", undo).icon("undo").key("Ctrl+Z").noundo(),
-    CommandSpec::new("RedoCommand", "Redo", redo).icon("redo").key("Ctrl+Y").noundo(),
-    CommandSpec::new("FusionComputeAllCommand", "Compute All", compute_all).at("SOLID", "MODIFY").icon("compute").noundo(),
-    CommandSpec::new("FusionDeleteCommand", "Delete", delete)
+    CommandSpec::new("edit.undo", "Undo", undo).icon("undo").key("Ctrl+Z").noundo(),
+    CommandSpec::new("edit.redo", "Redo", redo).icon("redo").key("Ctrl+Y").noundo(),
+    CommandSpec::new("edit.checkpoint", "Checkpoint", checkpoint)
+        .noundo()
+        .params("→ {checkpoint: id}: remember the design, active sketch and undo history (restore with edit.restore_checkpoint)"),
+    CommandSpec::new("edit.restore_checkpoint", "Restore Checkpoint", restore_checkpoint)
+        .noundo()
+        .params("checkpoint: id; forget?: bool (true = drop it without going back). Goes back to it, undo history included"),
+    CommandSpec::new("timeline.compute_all", "Compute All", compute_all).at("SOLID", "MODIFY").icon("compute").noundo(),
+    CommandSpec::new("timeline.delete", "Delete", delete)
         .at("SOLID", "MODIFY")
         .icon("delete")
         .key("Delete")
         .params("features: [id or name] (a sketch takes its dependent features with it)"),
-    CommandSpec::new("FusionRenameTimelineEntryCommand", "Rename", rename).params("feature: id|name, name"),
+    CommandSpec::new("timeline.rename", "Rename", rename).params("feature: id|name, name"),
     CommandSpec::new("timeline.rollback", "Move Timeline Marker", rollback).params("position: number of features to keep active (omit = end)"),
-    CommandSpec::new("timeline.rollTo", "Roll History Marker", rollback)
+    CommandSpec::new("timeline.roll_to", "Roll History Marker", rollback)
         .params("position: number of features to keep active (omit = end) | feature: id|name (the marker goes right after it)"),
     CommandSpec::new("timeline.reorder", "Reorder Feature", reorder)
         .params("feature: id|name, position: its new index; refused when a feature that worked would fail"),
@@ -28,8 +34,15 @@ pub static COMMANDS: &[CommandSpec] = &[
         .noundo()
         .params("feature: id|name → features deleted with it, and features that would fail without it"),
     CommandSpec::new("timeline.suppress", "Suppress Feature", suppress).params("feature: id|name, suppressed?: bool (default toggles)"),
-    CommandSpec::new("timeline.edit", "Edit Feature", edit_feature)
-        .params("feature: id|name, set: {fields to change, e.g. {\"extent\": {\"distance\": \"30\"}}}"),
+    CommandSpec::new("timeline.edit", "Edit Feature", edit_feature).params(
+        "feature: id|name, set: {fields to change, merged into the feature's definition as timeline.inspect returns it, \
+         e.g. {\"extent\": {\"distance\": \"30\"}} (extrude), {\"angle\": \"90 deg\"} (revolve); \
+         expressions are text} → recomputed: features rebuilt, restored: features whose earlier result for the same inputs was reused",
+    ),
+    CommandSpec::new("timeline.inspect", "Inspect Feature", inspect_feature).noundo().params(
+        "feature: id|name → type, definition (the fields timeline.edit's set changes, with their current values), \
+         inputs: [{label, param, expression, unit}] (named inputs parameters.change can also set), error, warning",
+    ),
     CommandSpec::new("select.set", "Select", select_set)
         .noundo()
         .params("items: [{type: body|edge|face|feature|sketch_curve|sketch_point|profile, …}], add?: bool"),
@@ -39,9 +52,10 @@ pub static COMMANDS: &[CommandSpec] = &[
 fn undo(s: &mut Session, _p: &Value) -> Result<Value> {
     let Some(prev) = s.undo.pop() else { return Err(EngineError::Other("nothing to undo".into())) };
     let label = prev.label.clone();
-    s.redo.push(Snapshot { label: label.clone(), doc: s.doc.clone(), active_sketch: s.active_sketch });
+    s.redo.push(Snapshot { label: label.clone(), doc: s.doc.clone(), active_sketch: s.active_sketch, pending_moves: s.pending_moves.clone() });
     s.doc = prev.doc;
     s.active_sketch = prev.active_sketch;
+    s.pending_moves = prev.pending_moves;
     s.selection.clear();
     s.refresh();
     Ok(json!({"undone": label}))
@@ -50,14 +64,30 @@ fn undo(s: &mut Session, _p: &Value) -> Result<Value> {
 fn redo(s: &mut Session, _p: &Value) -> Result<Value> {
     let Some(next) = s.redo.pop() else { return Err(EngineError::Other("nothing to redo".into())) };
     let label = next.label.clone();
-    s.undo.push(Snapshot { label: label.clone(), doc: s.doc.clone(), active_sketch: s.active_sketch });
+    s.undo.push(Snapshot { label: label.clone(), doc: s.doc.clone(), active_sketch: s.active_sketch, pending_moves: s.pending_moves.clone() });
     s.doc = next.doc;
     s.active_sketch = next.active_sketch;
+    s.pending_moves = next.pending_moves;
     s.selection.clear();
     s.refresh();
     Ok(json!({"redone": label}))
 }
 
+fn checkpoint(s: &mut Session, _p: &Value) -> Result<Value> {
+    Ok(json!({"checkpoint": s.checkpoint()}))
+}
+
+fn restore_checkpoint(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "edit.restore_checkpoint";
+    let id = p.get("checkpoint").and_then(Value::as_u64).ok_or_else(|| bad(cmd, "`checkpoint` must be an id from edit.checkpoint"))?;
+    if bool_(p, "forget") == Some(true) {
+        s.drop_checkpoint(id);
+        return Ok(json!({"checkpoint": id, "restored": false}));
+    }
+    s.restore_checkpoint(id)?;
+    Ok(json!({"checkpoint": id, "restored": true}))
+}
+
 fn compute_all(s: &mut Session, _p: &Value) -> Result<Value> {
     s.model = solvecraft_doc::Model::new();
     s.refresh();
@@ -75,7 +105,7 @@ fn feature_id(s: &Session, v: Option<&Value>, cmd: &str) -> Result<u64> {
 }
 
 fn delete(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "FusionDeleteCommand";
+    let cmd = "timeline.delete";
     let mut keys = string_list(p, "features");
     if let Some(Value::Array(a)) = p.get("features") {
         keys.extend(a.iter().filter_map(Value::as_u64).map(|n| n.to_string()));
@@ -108,7 +138,7 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn rename(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "FusionRenameTimelineEntryCommand";
+    let cmd = "timeline.rename";
     let id = feature_id(s, p.get("feature"), cmd)?;
     let name =
         str_(p, "name").map(str::trim).filter(|n| !n.is_empty() && n.len() <= 128).ok_or_else(|| bad(cmd, "`name` must be 1…128 characters"))?;
@@ -125,7 +155,7 @@ fn rollback(s: &mut Session, p: &Value) -> Result<Value> {
     let n = s.doc.features.len();
     let pos = match p.get("feature") {
         Some(f) => {
-            let id = feature_id(s, Some(f), "timeline.rollTo")?;
+            let id = feature_id(s, Some(f), "timeline.roll_to")?;
             s.doc.feature_index(id).map(|i| i + 1)
         }
         None => num(p, "position").map(|x| x.max(0.0) as usize),
@@ -165,18 +195,92 @@ fn merge(dst: &mut Value, src: &Value, depth: usize) {
     }
 }
 
+/// `profiles` (also a loft section's) given as the feature commands take it (`"all"`,
+/// `[index]`, `[{curves}]`, `[{point}]`...) becomes the stored form; the stored form passes.
+fn command_profiles(set: &Value, cmd: &str) -> Result<Value> {
+    let conv = |v: &mut Value| -> Result<()> {
+        if let Some(pv) = v.get("profiles").filter(|x| x.get("type").is_none()) {
+            let sel = super::features::profiles(&json!({"profiles": pv}), cmd)?;
+            let sv = serde_json::to_value(sel).map_err(|e| EngineError::Other(e.to_string()))?;
+            if let Some(o) = v.as_object_mut() {
+                o.insert("profiles".into(), sv);
+            }
+        }
+        Ok(())
+    };
+    let mut set = set.clone();
+    conv(&mut set)?;
+    if let Some(secs) = set.get_mut("sections").and_then(Value::as_array_mut) {
+        for sec in secs.iter_mut().take(10_000) {
+            conv(sec)?;
+        }
+    }
+    Ok(set)
+}
+
+/// Fields of a stored feature left out of its definition: bookkeeping timeline.edit recomputes, and
+/// the name and suppression, which timeline.rename and timeline.suppress change.
+const NOT_EDITABLE: &[&str] = &["id", "type", "name", "suppressed", "param_names", "edge_refs", "edge_names", "face_names"];
+
+fn inspect_feature(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "timeline.inspect";
+    let id = feature_id(s, p.get("feature"), cmd)?;
+    let f = s.doc.feature(id).ok_or_else(|| bad(cmd, "feature"))?;
+    let mut def = serde_json::to_value(f).map_err(|e| EngineError::Other(e.to_string()))?;
+    let mut omitted = Vec::new();
+    if let Some(o) = def.as_object_mut() {
+        for k in NOT_EDITABLE {
+            o.remove(*k);
+        }
+        // Large payloads that timeline.edit cannot change.
+        let heavy: &[(&str, &str)] = match &f.kind {
+            FeatureKind::Sketch { .. } => &[("sketch", "the sketch geometry (sketch.inspect; edit it with the sketch commands)")],
+            FeatureKind::Import { .. } => &[("step", "the imported STEP text"), ("components", "the imported product tree")],
+            FeatureKind::MeshImport { .. } => &[("meshes", "the imported meshes")],
+            _ => &[],
+        };
+        for (k, why) in heavy {
+            if o.remove(*k).is_some() {
+                omitted.push(json!({"field": k, "what": why}));
+            }
+        }
+    }
+    let inputs: Vec<Value> = f
+        .kind
+        .inputs()
+        .into_iter()
+        .enumerate()
+        .map(|(i, (label, e, k))| {
+            json!({"label": label, "param": f.param_names.get(i).filter(|n| !n.is_empty()), "expression": e, "unit": k.default_unit()})
+        })
+        .collect();
+    let marker = s.doc.marker.unwrap_or(usize::MAX);
+    let rolled_back = s.doc.features.iter().position(|x| x.id == id).is_some_and(|i| i >= marker);
+    let r = s.model.result(id);
+    Ok(json!({
+        "id": f.id, "name": f.name, "type": f.kind.type_name(), "suppressed": f.suppressed, "rolled_back": rolled_back,
+        "definition": def, "omitted": omitted, "inputs": inputs,
+        "error": r.and_then(|r| r.error.clone()), "warning": r.and_then(|r| r.warning.clone()),
+    }))
+}
+
 fn edit_feature(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "timeline.edit";
     let id = feature_id(s, p.get("feature"), cmd)?;
     let set = p.get("set").filter(|v| v.is_object()).ok_or_else(|| bad(cmd, "`set` must be an object of fields"))?;
     let f = s.doc.feature(id).cloned().ok_or_else(|| bad(cmd, "feature"))?;
     let mut v = serde_json::to_value(&f).map_err(|e| EngineError::Other(e.to_string()))?;
+    let set = &command_profiles(set, cmd)?;
     merge(&mut v, set, 0);
     let mut nf: Feature = serde_json::from_value(v).map_err(|e| bad(cmd, format!("invalid feature: {e}")))?;
     nf.id = f.id;
     if std::mem::discriminant(&nf.kind) != std::mem::discriminant(&f.kind) {
         return Err(bad(cmd, "the feature type cannot change"));
     }
+    if let FeatureKind::BodyTransfer { bodies, from, to, transform } = &nf.kind {
+        solvecraft_doc::validate_body_transfer(&s.doc, bodies, *from, *to, transform)?;
+        nf.component = *to;
+    }
     if let (FeatureKind::Sketch { sketch: a, .. }, FeatureKind::Sketch { sketch: b, .. }) = (&nf.kind, &f.kind)
         && a != b
     {
@@ -193,6 +297,10 @@ fn edit_feature(s: &mut Session, p: &Value) -> Result<Value> {
         nf.edge_refs = solvecraft_doc::edge_refs(&before, body, a);
         nf.edge_names = solvecraft_doc::edge_names_for(&before, body, a);
     }
+    // Profiles picked by index or point are kept by their curves, as when the feature was made.
+    if nf.kind.clone().profile_sels_mut() != f.kind.clone().profile_sels_mut() {
+        super::features::stable_profiles(s, &mut nf.kind)?;
+    }
     // New face points: their faces' names now.
     if nf.kind.face_points() != f.kind.face_points() {
         nf.face_names = solvecraft_doc::naming::face_names_at(&s.model.state_before(id), &nf.kind.face_points());
@@ -204,7 +312,7 @@ fn edit_feature(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(e) = s.model.result(id).and_then(|r| r.error.clone()) {
         return Err(EngineError::Other(e));
     }
-    Ok(json!({"feature": id, "recomputed": s.model.last_recomputed}))
+    Ok(json!({"feature": id, "recomputed": s.model.last_recomputed, "restored": s.model.last_restored}))
 }
 
 fn select_set(s: &mut Session, p: &Value) -> Result<Value> {
@@ -215,6 +323,9 @@ fn select_set(s: &mut Session, p: &Value) -> Result<Value> {
     let mut sel: Vec<Sel> = Vec::new();
     for it in items {
         let one: Sel = serde_json::from_value(it).map_err(|e| bad("select.set", e.to_string()))?;
+        if let Sel::Occurrence { path } = &one {
+            s.occurrence_bodies(path, true).map_err(|e| bad("select.set", e.to_string()))?;
+        }
         sel.push(one);
     }
     if !bool_(p, "add").unwrap_or(false) {
@@ -273,41 +384,174 @@ fn reorder(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"feature": id, "position": to}))
 }
 
+fn input_keys(kind: &FeatureKind) -> Vec<(String, solvecraft_doc::expr::Kind)> {
+    let mut keys: Vec<_> = kind.inputs().into_iter().map(|(label, _, unit)| (label.to_string(), unit)).collect();
+    if let FeatureKind::Fillet { style, .. } = kind {
+        if let Some((key, _)) = keys.first_mut() {
+            *key = "fillet.radius".into();
+        }
+        if let solvecraft_doc::FilletStyle::Variable { mid, .. } = style {
+            for ((key, _), (position, _)) in keys.iter_mut().skip(2).zip(mid) {
+                *key = format!("fillet.mid.{}", position.to_bits());
+            }
+        }
+    }
+    keys
+}
+
 fn redefine(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "timeline.redefine";
     let id = feature_id(s, p.get("feature"), cmd)?;
     let cid = str_(p, "command").ok_or_else(|| bad(cmd, "`command` must name the feature's command"))?;
     let spec = super::find_command(cid).ok_or_else(|| bad(cmd, format!("no command `{cid}`")))?;
-    if cid.starts_with("timeline.") || cid.starts_with("select.") || cid.starts_with("Sketch") {
+    // Only modeling constructors may run here. In particular, a scratch session does not
+    // isolate filesystem writes performed by export commands.
+    let constructor = super::features::COMMANDS
+        .iter()
+        .chain(super::features_more::COMMANDS)
+        .chain(super::construct::COMMANDS)
+        .chain(super::surface::COMMANDS)
+        .any(|candidate| candidate.id == spec.id)
+        || matches!(
+            spec.id,
+            "sheet.flange"
+                | "sheet.hem"
+                | "sheet.fold"
+                | "sheet.unfold"
+                | "sheet.refold"
+                | "sheet.convert"
+                | "plastic.boss"
+                | "plastic.lip"
+                | "plastic.snap_fit"
+                | "plastic.rest"
+        );
+    if !constructor {
         return Err(bad(cmd, format!("`{cid}` does not make a feature")));
     }
-    let params = p.get("params").cloned().unwrap_or_else(|| json!({}));
+    let mut params = p.get("params").cloned().unwrap_or_else(|| json!({}));
     let idx = s.doc.feature_index(id).ok_or_else(|| bad(cmd, "feature"))?;
     let old = s.doc.feature(id).cloned().ok_or_else(|| bad(cmd, "feature"))?;
-    let marker = s.doc.marker;
-    // Build the new definition where the feature sits, against the model before it.
-    s.doc_mut().marker = Some(idx);
-    s.refresh();
-    let r = (spec.run)(s, &params);
-    let made = r.as_ref().ok().and_then(|v| v.get("feature")).and_then(Value::as_u64);
-    let new = made.and_then(|nid| s.doc.feature(nid).cloned());
-    if let Some(nid) = made {
-        s.doc_mut().features.retain(|f| f.id != nid);
+    if let FeatureKind::Revolve { convention, .. } = &old.kind
+        && cid == "solid.revolve"
+        && let Some(parameters) = params.as_object_mut()
+    {
+        parameters.entry("convention").or_insert_with(|| json!(convention));
+    }
+    if !old.participants.is_empty()
+        && let Some(parameters) = params.as_object_mut()
+    {
+        parameters.entry("participants").or_insert_with(|| json!(old.participants));
+    }
+    // Run the constructor on a scratch session: failed edits must not disturb sketch mode,
+    // selections, component authoring state or the original feature's definition.
+    let mut trial = s.scratch();
+    trial.active_component = old.component;
+    if let FeatureKind::Emboss { face: Some(face), .. } = &old.kind {
+        trial.active_occurrence_path = (!face.author_path.is_empty()).then(|| face.author_path.clone());
+    }
+    trial.active_sketch = None;
+    trial.selection = s.selection.clone();
+    // Keep the original identity as a suppressed placeholder. The constructor and
+    // any ownership boundary it adds go AFTER this slot, so discarding its temporary
+    // feature leaves auxiliary history after the rewritten original.
+    if let Some(slot) = trial.doc_mut().feature_mut(id) {
+        slot.suppressed = true;
+    }
+    trial.doc_mut().marker = Some(idx + 1);
+    trial.refresh();
+    (spec.enabled)(&trial).map_err(|why| EngineError::Disabled(spec.id.to_string(), why))?;
+    let r = (spec.run)(&mut trial, &params)?;
+    let made = r.get("feature").and_then(Value::as_u64).ok_or_else(|| bad(cmd, format!("`{cid}` did not make a feature")))?;
+    let mut new = trial.doc.feature(made).cloned().ok_or_else(|| bad(cmd, format!("`{cid}` did not make a feature")))?;
+    if let (FeatureKind::Emboss { face: Some(before), .. }, FeatureKind::Emboss { face: Some(after), .. }) = (&old.kind, &mut new.kind)
+        && before.body == after.body
+        && before.path == after.path
+        && before.author_path == after.author_path
+        && before.at.dist(after.at) < 1e-8
+    {
+        *after = before.clone();
     }
-    s.doc_mut().marker = marker;
-    r?;
-    let new = new.ok_or_else(|| bad(cmd, format!("`{cid}` did not make a feature")))?;
     if std::mem::discriminant(&new.kind) != std::mem::discriminant(&old.kind) {
         return Err(bad(cmd, format!("{} is not a {} feature", old.name, cid)));
     }
-    if let Some(slot) = s.doc_mut().feature_mut(id) {
-        slot.kind = new.kind;
+    // Optional inputs can move other inputs' positions (e.g. Distance 2 goes before Taper).
+    // Keep each existing model parameter attached to its semantic input, rather than its
+    // old index. Constructor-assigned names for new inputs cannot reuse the old dimensions.
+    let mut old_inputs: Vec<_> = input_keys(&old.kind).into_iter().zip(&old.param_names).collect();
+    let param_names: Vec<String> = input_keys(&new.kind)
+        .iter()
+        .enumerate()
+        .map(|(i, (label, kind))| {
+            if let Some(k) = old_inputs.iter().position(|((old_label, old_kind), _)| old_label == label && old_kind == kind) {
+                old_inputs.remove(k).1.clone()
+            } else {
+                new.param_names.get(i).cloned().unwrap_or_default()
+            }
+        })
+        .collect();
+    trial.doc_mut().features.retain(|f| f.id != made);
+    let added = trial.doc.features.len().saturating_sub(s.doc.features.len());
+    trial.doc_mut().marker = s.doc.marker.map(|marker| if marker > idx { marker.saturating_add(added) } else { marker });
+    if made == s.doc.next_id && trial.doc.next_id == made.saturating_add(1) {
+        trial.doc_mut().next_id = s.doc.next_id;
     }
+    if let Some(slot) = trial.doc_mut().feature_mut(id) {
+        slot.suppressed = old.suppressed;
+        slot.kind = new.kind;
+        slot.edge_refs = new.edge_refs;
+        slot.edge_names = new.edge_names;
+        slot.face_names = new.face_names;
+        slot.param_names = param_names;
+        if params.get("participants").is_some() {
+            slot.participants = new.participants;
+        }
+    }
+    // New optional inputs need model parameter names, while existing dimensions keep theirs.
+    trial.doc_mut().name_feature_inputs(id);
+    trial.refresh();
+    if let Some(e) = trial.model.result(id).and_then(|r| r.error.clone()) {
+        return Err(EngineError::Other(e));
+    }
+    let original_ids: std::collections::BTreeSet<u64> = s.doc.features.iter().map(|feature| feature.id).collect();
+    let added_ids: std::collections::BTreeSet<u64> =
+        trial.doc.features.iter().filter(|feature| !original_ids.contains(&feature.id)).map(|feature| feature.id).collect();
+    let adds_transfer =
+        trial.doc.features.iter().any(|feature| added_ids.contains(&feature.id) && matches!(feature.kind, FeatureKind::BodyTransfer { .. }));
+    let baseline = if adds_transfer && s.doc.marker.is_some() {
+        let mut baseline = s.scratch();
+        baseline.doc_mut().marker = None;
+        baseline.refresh();
+        Some(baseline)
+    } else {
+        None
+    };
+    let proof = if (adds_transfer && trial.doc.marker.is_some()) || added_ids.iter().any(|id| trial.model.result(*id).is_none()) {
+        let mut proof = trial.scratch();
+        proof.doc_mut().marker = None;
+        proof.refresh();
+        Some(proof)
+    } else {
+        None
+    };
+    let validated = proof.as_ref().map(|proof| &proof.model).unwrap_or(&trial.model);
+    let original_model = baseline.as_ref().map(|baseline| &baseline.model).unwrap_or(&s.model);
+    for feature in &trial.doc.features {
+        let auxiliary = added_ids.contains(&feature.id);
+        let protected_transfer = matches!(feature.kind, FeatureKind::BodyTransfer { .. })
+            && original_model.result(feature.id).is_some_and(|result| !result.skipped && result.error.is_none());
+        if (auxiliary || protected_transfer)
+            && let Some(error) = validated.result(feature.id).and_then(|result| result.error.as_ref())
+        {
+            return Err(bad(cmd, format!("{}: {error}", feature.name)));
+        }
+    }
+    s.pending_moves = trial.pending_moves;
+    s.doc = trial.doc;
     s.refresh();
     if let Some(e) = s.model.result(id).and_then(|r| r.error.clone()) {
         return Err(EngineError::Other(e));
     }
-    Ok(json!({"feature": id, "recomputed": s.model.last_recomputed}))
+    Ok(json!({"feature": id, "recomputed": s.model.last_recomputed, "restored": s.model.last_restored}))
 }
 
 fn dependents(s: &mut Session, p: &Value) -> Result<Value> {
@@ -321,3 +565,7 @@ fn dependents(s: &mut Session, p: &Value) -> Result<Value> {
     let broken: Vec<String> = newly_broken(&s.model, &after).into_iter().map(|(n, _)| n).collect();
     Ok(json!({"deleted_with_it": names(&gone), "would_fail": broken}))
 }
+
+#[cfg(test)]
+#[path = "edit_tests.rs"]
+mod tests;