Remove premature craft family affiliation claims

feat(ui): allow disabling wheel zoom smoothing

.github/release-notes.md

@@ -1,14 +1,19 @@
-SolveCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
-parameter to watch the timeline rebuild. [Documentation](https://bherbruck.github.io/solvecraft/)
-· [try it in the browser](https://bherbruck.github.io/solvecraft/app/) ·
-[contributing](https://github.com/bherbruck/solvecraft/blob/main/CONTRIBUTING.md) ·
-[issues](https://github.com/bherbruck/solvecraft/issues). AI agents can model with it over MCP:
-`solvecraft-cli mcp` ([how](https://bherbruck.github.io/solvecraft/guide/mcp.html)).
+SolidCraft is open-source parametric 3D CAD in Rust: sketch, constrain, extrude, and change a
+parameter to watch the timeline rebuild. [Documentation](https://bherbruck.github.io/solidcraft/)
+· [try it in the browser](https://bherbruck.github.io/solidcraft/app/) ·
+[contributing](https://github.com/bherbruck/solidcraft/blob/main/CONTRIBUTING.md) ·
+[issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
+`solvecraft-cli mcp` ([how](https://bherbruck.github.io/solidcraft/guide/mcp.html)).
+
+Compatibility names are unchanged: existing `.solvecraft` designs, `solvecraft-cli`, package
+IDs and archive filenames still work. Published 0.2.0 and 0.2.1 releases keep their original
+SolveCraft branding. Documentation, the browser app and the Flatpak feed use the new
+SolidCraft project Pages URLs; old-name Pages addresses are not permanent aliases.
 
 **Which file?**
 - **Windows:** `SolveCraft-{version}-windows-x64.exe` runs as is. Or install the `.msi`, or unzip the
   `-portable.zip` (x64, x86 and arm64).
-- **macOS 11+** (Apple silicon and Intel): open the `.dmg` and drag SolveCraft onto Applications.
+- **macOS 11+** (Apple silicon and Intel): open the `.dmg` and drag `SolveCraft.app` onto Applications.
   The CLI is in `solvecraft-cli-{version}-macos-universal.zip`.
 - **Linux** (x86_64 and aarch64, glibc 2.35+): the `.AppImage` (`chmod +x`, then run it), the
   `.deb` or `.rpm`, the `.flatpak` (`flatpak install --user <file>`), or the `.tar.gz`.
@@ -16,10 +21,23 @@ parameter to watch the timeline rebuild. [Documentation](https://bherbruck.githu
 - **Web:** `solvecraft-web-{version}.zip` is a static site to host yourself.
 - `SHA256SUMS.txt`: `sha256sum -c SHA256SUMS.txt --ignore-missing`.
 
-The builds aren't signed yet. On macOS, right-click SolveCraft in Applications and choose
+For Flatpak feed installation and updates, add Flathub for the required runtime before
+installing SolidCraft; keep both remotes in the same user installation:
+
+```sh
+flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+flatpak remote-add --user --if-not-exists solvecraft https://bherbruck.github.io/solidcraft/flatpak/solvecraft.flatpakrepo
+flatpak install --user solvecraft ai.storyteller.solvecraft
+flatpak run ai.storyteller.solvecraft
+```
+
+Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
+still need an internet connection. [Linux installation details](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
+
+The builds aren't signed yet. On macOS, right-click `SolveCraft.app` in Applications and choose
 **Open** the first time (or run `xattr -dr com.apple.quarantine /Applications/SolveCraft.app`).
 On Windows, SmartScreen may say "Windows protected your PC": **More info**, then **Run anyway**.
 Licences are built in (Help ▸ About ▸ Licences, `solvecraft-cli licences`); the packages also
 install `THIRD-PARTY-LICENSES.txt`. Known limitations:
-[ROADMAP.md](https://github.com/bherbruck/solvecraft/blob/main/ROADMAP.md#known-limitations).
+[ROADMAP.md](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations).
 

.github/workflows/packaging-lint.yml

@@ -37,6 +37,10 @@ jobs:
         run: shellcheck packaging/*.sh packaging/*/*.sh packaging/linux/AppRun
       - name: Nightly release selection regression
         run: python3 packaging/tests/nightly_test.py
+      - name: Windows executable icon validation regression
+        run: python3 packaging/tests/windows_icon_test.py
+      - name: Flatpak desktop smoke validation regression
+        run: python3 packaging/tests/flatpak_test.py
       - name: PowerShell
         shell: pwsh
         run: |

.github/workflows/pages.yml

@@ -1,5 +1,5 @@
-# The documentation site on GitHub Pages: the book (docs/book) at /solvecraft/ and the web app
-# at /solvecraft/app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
+# The documentation site on GitHub Pages: the book (docs/book) at /solidcraft/ and the web app
+# at /solidcraft/app/. Needs Settings → Pages → Source = GitHub Actions; skipped while the
 # repository is private.
 name: Pages
 
@@ -49,7 +49,7 @@ jobs:
         run: cargo xtask book
       - name: Build the web app
         working-directory: apps/solvecraft-web
-        run: trunk build --release --public-url /solvecraft/app/
+        run: trunk build --release --public-url /solidcraft/app/
       - name: Assemble the site
         run: |
           mkdir -p site

.github/workflows/release.yml

@@ -77,7 +77,7 @@ jobs:
           fi
           case "$VERSION" in *-*) pre=true ;; *) pre=false ;; esac
           { echo "version=$VERSION"; echo "date=$(date -u +%Y-%m-%d)"; echo "prerelease=$pre"; } >>"$GITHUB_OUTPUT"
-          echo "### SolveCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
+          echo "### SolidCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
 
   # The app icon in every size, drawn by solvecraft-cli (no image files are committed), for the
   # Windows jobs: the ARM64 build is cross-compiled and can't run there to draw its own.
@@ -177,7 +177,7 @@ jobs:
       - name: Install flatpak-builder
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
+          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common xvfb xauth weston dbus-x11
           # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Build the Flatpak bundle
@@ -357,7 +357,7 @@ jobs:
           sha256sum --check SHA256SUMS.txt
           # Stage all packages before publishing. Published tags are never replaced.
           gh release create "$tag" --draft --prerelease --latest=false \
-            --title "SolveCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
+            --title "SolidCraft v$VERSION (nightly)" --target "$GITHUB_SHA" \
             --notes-file ../notes.md --generate-notes -- *
           gh release edit "$tag" --draft=false --prerelease --latest=false
           echo "### Published nightly: $tag (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
@@ -386,15 +386,15 @@ jobs:
             while IFS= read -r asset; do
               if [ -n "$asset" ]; then gh release delete-asset "$tag" "$asset" --yes; fi
             done <<<"$assets"
-            gh release edit "$tag" --draft --title "SolveCraft v$VERSION" \
+            gh release edit "$tag" --draft --title "SolidCraft v$VERSION" \
               --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
             gh release upload "$tag" --clobber -- *
           else
-            gh release create "$tag" --draft --title "SolveCraft v$VERSION" \
+            gh release create "$tag" --draft --title "SolidCraft v$VERSION" \
               --target "$GITHUB_SHA" --notes-file ../notes.md --generate-notes "${pre[@]}" -- *
           fi
           {
-            echo "Draft **SolveCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"
+            echo "Draft **SolidCraft v$VERSION** at \`${GITHUB_SHA::9}\`:"
             echo
             sed 's/^/    /' SHA256SUMS.txt
           } >>"$GITHUB_STEP_SUMMARY"

AGENTS.md

@@ -1,11 +1,18 @@
-# SolveCraft — instructions for agents
+# SolidCraft — instructions for agents
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
-it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
-`gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
-code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
+kernel, and a desktop UI that agents can drive. Projects published by
+[storytold](https://github.com/storytold) can serve as references for implementation conventions.
+Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+
+## Product name and compatibility
+SolidCraft is the displayed product name; `solidcraft` is the repository name. Keep existing
+`solvecraft` crate/binary names, `.solvecraft` files, format markers, environment variables,
+settings/recovery paths and package IDs compatible. Published SolveCraft release artifacts
+and attribution records keep their historical names. Public docs/web/Flatpak deployments
+use project Pages `/solidcraft/`; do not add permanent old-name Pages aliases. See README's
+compatibility notes.
 
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
@@ -20,7 +27,7 @@ code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
   `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
@@ -44,7 +51,7 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
   copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
   CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
   operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
+- **Assets — absolutely essential.** SolidCraft contains **no Autodesk iconography, images,
   fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
   file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
   (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
@@ -64,7 +71,7 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
 - **Rust only.** Units are millimetres and radians internally; Z is up.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. After each commit that
   passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
   then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
   produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.

ATTRIBUTION.md

@@ -18,7 +18,8 @@ Generated-in-code assets are original and have no file to list:
 | File | Author | Source | Licence |
 |---|---|---|---|
 | docs/screenshots/sample-plate.png | SolveCraft contributors | screenshot of SolveCraft itself (`solvecraft --sample`) | MIT OR Apache-2.0 |
-| docs/screenshots/demo.gif | SolveCraft contributors | original screen recording of the actual SolveCraft 0.2.0 English desktop UI (2× GIF preview; full video at real-time speed) | MIT OR Apache-2.0 |
+| docs/screenshots/enclosure-demo-0.2.1.gif | SolveCraft contributors | original electronics enclosure screen recording of the actual SolveCraft 0.2.1 English desktop UI, generated with examples/demo/record_ui.sh and its original animated pointer overlay (4× playback) | MIT OR Apache-2.0 |
+| docs/screenshots/enclosure-demo-0.2.1.mp4 | SolveCraft contributors | original electronics enclosure screen recording of the actual SolveCraft 0.2.1 English desktop UI, generated with examples/demo/record_ui.sh and its original animated pointer overlay (4× playback) | MIT OR Apache-2.0 |
 | docs/book/src/generated/sample-plate.png | SolveCraft contributors | copy of docs/screenshots/sample-plate.png made by `cargo xtask book` (gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/bracket.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot examples/bracket.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/enclosure.png | SolveCraft contributors | rendered by `cargo xtask book` (`solvecraft-cli snapshot docs/book/scripts/enclosure.json`; gitignored) | MIT OR Apache-2.0 |
@@ -56,3 +57,12 @@ Generated-in-code assets are original and have no file to list:
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
 | vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; trace macro (vendor/README.md) |
 | vendor/matext4cgmath | matext4cgmath 0.1.0, https://github.com/ricosjp/matext4cgmath (RICOS Co. Ltd.) | Apache-2.0 | root refinement stops after 100 Newton steps (vendor/README.md) |
+
+## Vendored renderer compatibility fix
+
+`vendor/egui-wgpu` is egui-wgpu 0.36.2 from https://github.com/emilk/egui
+(MIT OR Apache-2.0; both original licence texts are included). Rust sources and
+its original `egui.wgsl` shader are retained; no images or other artwork are copied.
+SolidCraft's narrow patch selects a safe 1x MSAA path on the chosen OpenGL adapter
+and shares that effective count with the surface attachments and CAD callbacks.
+Vulkan, DirectX 12, Metal and WebGPU retain their requested multisampling.

CLAUDE.md

@@ -1,11 +1,18 @@
-# SolveCraft — instructions for agents
+# SolidCraft — instructions for agents
 
-SolveCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application in the style of
-Autodesk Fusion: sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Siblings with the same conventions live next to
-it in `storytold/`: `cadcraft` (AutoCAD-style, the closest relative), `photocraft`, `vectorcraft`,
-`gridcraft`, `designcraft`, `wordcraft`, `deckcraft`, `soundcraft`. Repos don't share code; when
-code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
+sketches with a constraint solver, a parametric timeline of features, a B-rep
+kernel, and a desktop UI that agents can drive. Projects published by
+[storytold](https://github.com/storytold) can serve as references for implementation conventions.
+Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+
+## Product name and compatibility
+SolidCraft is the displayed product name; `solidcraft` is the repository name. Keep existing
+`solvecraft` crate/binary names, `.solvecraft` files, format markers, environment variables,
+settings/recovery paths and package IDs compatible. Published SolveCraft release artifacts
+and attribution records keep their historical names. Public docs/web/Flatpak deployments
+use project Pages `/solidcraft/`; do not add permanent old-name Pages aliases. See README's
+compatibility notes.
 
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
@@ -20,7 +27,7 @@ code is adapted from a sibling (MIT OR Apache-2.0) it is noted in ATTRIBUTION.md
 `plan/` is gitignored (local only).
 
 ## Never crash
-People trust SolveCraft with their designs; a crash loses their work. **This outranks feature work.**
+People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
   `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
@@ -44,7 +51,7 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
   copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs), SolveSpace,
   CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. The sketch solver and the blend
   operations are our own.
-- **Assets — absolutely essential.** SolveCraft contains **no Autodesk iconography, images,
+- **Assets — absolutely essential.** SolidCraft contains **no Autodesk iconography, images,
   fonts or artwork — ever.** Every icon is drawn in code (`crates/ui-egui/src/icons.rs`). Any
   file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
   (`cargo xtask assets` enforces it). Screenshots of Autodesk software are never committed.
@@ -64,7 +71,7 @@ People trust SolveCraft with their designs; a crash loses their work. **This out
 - **Rust only.** Units are millimetres and radians internally; Z is up.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
-- **Publishing**: `origin` is github.com/bherbruck/solvecraft (private). After each commit that
+- **Publishing**: `origin` is github.com/bherbruck/solidcraft. After each commit that
   passes `cargo xtask ci`: `git pull --rebase origin main` (re-run ci if it brought changes),
   then `git push`. Never force-push. Never commit `plan/`, build dirs (`target*/`) or anything
   produced by Fusion (oracle STEP/STL/PNG); check `git ls-files` before pushing.

CONTRIBUTING.md

@@ -1,7 +1,7 @@
-# Contributing to SolveCraft
+# Contributing to SolidCraft
 
-SolveCraft is an open-source parametric 3D CAD app written in pure Rust, in the style of
-Autodesk Fusion. You sketch on a plane, constrain the sketch, turn profiles into solids, and
+SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
+You sketch on a plane, constrain the sketch, turn profiles into solids, and
 change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.
@@ -12,16 +12,23 @@ needed most.
 
 ## Get it running (about 10 minutes on a fast machine)
 
-You need stable Rust 1.90 or newer. For the web
+You need stable Rust 1.95 or newer (required by egui/eframe 0.36). For the web
 build you also need `rustup target add wasm32-unknown-unknown` and [`trunk`](https://trunkrs.dev).
 
 ```sh
-git clone https://github.com/bherbruck/solvecraft && cd solvecraft
+git clone https://github.com/bherbruck/solidcraft && cd solidcraft
 cargo run --release -p solvecraft -- --sample      # desktop app with a sample part
 cargo xtask test                                   # unit, engine and UI-scenario tests
 cargo xtask ci                                     # everything a PR must pass (see below)
 ```
 
+SolidCraft is the product and repository name. Cargo packages and executables retain
+their `solvecraft` names for compatibility with existing scripts and MCP clients.
+Build the desktop app with `cargo build --release -p solvecraft`, or the CLI with
+`cargo build --release -p solvecraft-cli`. Run the CLI with
+`cargo run --release -p solvecraft-cli -- commands` (or `target/release/solvecraft-cli commands`
+after building). There is no Cargo package named `solidcraft`.
+
 Web: `cd apps/solvecraft-web && trunk serve --release`, then open the printed URL (`?sample`
 opens the sample part, `?webgl` forces WebGL2). Saving and opening files in the browser needs
 HTTPS or localhost, because it uses the Origin Private File System.
@@ -41,32 +48,21 @@ ERROR eframe::native::run: Exiting because of error: WGPU error: Failed to creat
 ERROR rfd::backend::xdg_desktop_portal::portal::libdbus: Can't connect to a portal: libdbus-1.so not found
 ```
 
-`nix develop` (the [`flake.nix`](flake.nix) in the repository root) puts the Wayland, X11,
-EGL-loader and D-Bus libraries on `LD_LIBRARY_PATH`, so `cargo run --release -p solvecraft` works
-from that shell as on any other distribution, file dialogs included. `nix run` builds the app and
-wraps the binary the same way. The Mesa drivers stay the system's, from `/run/opengl-driver`
-(`hardware.graphics.enable`): that is the driver stack the compositor runs on, and wgpu reaches the
-integrated GPU through the EGL loader. The shell deliberately brings no Rust toolchain — the one on
-`PATH` keeps its build cache, where a second `rustc` would make every build recompile the workspace
-from scratch; `nix develop .#rust` is there for a machine with no Rust at all.
+`nix develop` (the [`flake.nix`](flake.nix) in the repository root) supplies Wayland,
+X11, EGL, Vulkan-loader and D-Bus runtime libraries. It also exposes the NixOS
+driver manifests in `/run/opengl-driver/share`, so Vulkan can discover the system
+drivers. Enable `hardware.graphics.enable` on NixOS; other Linux distributions
+may need a matching [nixGL wrapper](https://github.com/nix-community/nixGL).
+The default development shell retains the Rust/C toolchain already on `PATH`;
+`nix develop .#rust` supplies the pinned toolchain and builds in `target/nix`.
 
-**Anti-aliasing on the OpenGL backend.** NixOS keeps the Vulkan ICD descriptions
-(`/run/opengl-driver/share/vulkan/icd.d`) off the Vulkan loader's search path, so wgpu picks its
-OpenGL backend on the integrated GPU. On that backend any multisampling above 1× — the default is
-4× — draws a black window: the UI still lays out and the control channel still answers, but every
-frame, `ui.screenshot` included, comes out empty. Set **Preferences ▸ Graphics ▸ Anti-aliasing** to
-1× and restart (the setting applies on the next start), or write it before the first run, since a
-black window is no way to reach the dialog:
-
-```sh
-mkdir -p ~/.local/share/solvecraft
-echo '{"msaa": 1}' > ~/.local/share/solvecraft/graphics.json
-```
-
-`apps/solvecraft/src/main.rs` reads that file (`graphics_path()`, eframe's storage dir) before the
-window opens; 2× and 4× are the same black window. The Vulkan backend is no way out of it either:
-`libvulkan.so.1` is not on `LD_LIBRARY_PATH`, so `WGPU_BACKEND=vulkan` exits with a
-`CreateSurfaceError` instead.
+To launch, use `nix run .#solidcraft -- --sample`. To install the app's terminal
+commands, desktop entry and generated icons, use `nix profile install .#solidcraft`.
+`nix build` alone creates a build result; it does not install a launcher in your
+desktop menu. The installed `solidcraft` command and compatible `solvecraft`
+command run the same wrapped app; `solvecraft-cli` is included as well. See
+[Nix installation and troubleshooting](docs/nix.md) for remote-flake commands,
+desktop integration and how to distinguish an old executable on `PATH`.
 
 ## How the code is laid out
 
@@ -97,7 +93,7 @@ The [README](README.md#architecture) has the layer table. The short version:
    tooltips, templates or materials, and we never commit files Fusion produced. Command ids are
    our own (`solid.fillet`, not Fusion's internal names).
 2. **No GPL/LGPL/AGPL code, not even reading it.** That rules out OpenCASCADE, FreeCAD
-   (including planegcs), SolveSpace, CadQuery/OCP, LibreCAD and QCAD. SolveCraft is
+   (including planegcs), SolveSpace, CadQuery/OCP, LibreCAD and QCAD. SolidCraft is
    MIT OR Apache-2.0, and its solver and blends are written from the maths. Permissive
    dependencies are fine. Note which one you're adding and why in the PR, and run
    `cargo xtask licences` so THIRD-PARTY-LICENSES.txt lists it (CI checks that it is current).
@@ -151,14 +147,14 @@ in the PR. `cargo xtask test` builds the tests with it and then runs every test
 depend on wall-clock timing.
 
 **The Fusion oracle** is a set of 76 reference parts, each built in Fusion from a recipe.
-SolveCraft rebuilds the same recipe and compares volume, area and topology counts with Fusion's
+SolidCraft rebuilds the same recipe and compares volume, area and topology counts with Fusion's
 measurements; [docs/oracle.md](docs/oracle.md) has the current results. The recipes and
 measurements live outside the repo (`plan/`, gitignored), because they come from a Fusion
 install. If you work on geometry and want to check against it, ask in an issue.
 
 ## Sending a change
 
-1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solvecraft/issues), labelled
+1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solidcraft/issues), labelled
    by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). Before starting,
    comment on the issue so it gets the `in progress` label and two people don't build the same
    thing. For anything bigger than a bug fix that has no issue yet, open one first.
@@ -189,15 +185,15 @@ CI if it brought changes, and push without force. Report the upstream/PR state y
 any conflicts resolved and validation results. While a task remains active, follow an open
 PR through its status changes; at handoff, clearly identify anything still awaiting merge.
 
-Much of SolveCraft so far was written by AI coding agents (Claude) working in parallel, each
+Much of SolidCraft so far was written by AI coding agents (Claude) working in parallel, each
 owning one area, with a human setting direction and reporting bugs. Their working notes are in
 [AGENTS.md](AGENTS.md). Human contributors are just as welcome. Use whatever tools you like, as
 long as the change meets the rules above.
 
 ## Where help is wanted most
 
-See the [`help wanted`](https://github.com/bherbruck/solvecraft/labels/help%20wanted) and
-[`good first issue`](https://github.com/bherbruck/solvecraft/labels/good%20first%20issue) labels.
+See the [`help wanted`](https://github.com/bherbruck/solidcraft/labels/help%20wanted) and
+[`good first issue`](https://github.com/bherbruck/solidcraft/labels/good%20first%20issue) labels.
 In order of how much they'd help users:
 
 1. **Fillet and blend robustness.** Fillets are our own code (truck has no fillet operation).
@@ -206,7 +202,7 @@ In order of how much they'd help users:
    faces, and fillets that consume neighbouring faces.
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
    through without a kernel error. Each failing seed is a reproducible bug.
-3. **Y-up / Z-up.** SolveCraft is Z-up only, so most STEP files (from SolidWorks, Onshape, or
+3. **Y-up / Z-up.** SolidCraft is Z-up only, so most STEP files (from SolidWorks, Onshape, or
    Fusion's default) open lying on their backs. Fusion solves this with a "default modeling
    orientation" preference.
 4. **Imported appearances.** Colours from STEP files are lost when a feature changes the
@@ -217,4 +213,4 @@ In order of how much they'd help users:
 ## Licence
 
 By contributing you agree that your contribution is licensed as MIT OR Apache-2.0, like the rest
-of SolveCraft. SolveCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.
+of SolidCraft. SolidCraft isn't affiliated with Autodesk. Fusion is a trademark of Autodesk, Inc.

Cargo.lock

@@ -971,8 +971,6 @@ dependencies = [
 [[package]]
 name = "egui-wgpu"
 version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1041,6 +1039,20 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "embed-resource"
+version = "3.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6168487b5e7eb2673e6efe1200b1848016e436a6ca0b8031bf04bd9d493a249f"
+dependencies = [
+ "cc",
+ "memchr",
+ "rustc_version",
+ "toml",
+ "vswhom",
+ "winreg",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -1553,6 +1565,19 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hidapi"
+version = "2.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818c0e1d27887aaf76fe737042e27a66b796a7b099e6d2e1a72d106c2dff3fa6"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "pkg-config",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -3093,6 +3118,15 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -3256,10 +3290,12 @@ dependencies = [
 
 [[package]]
 name = "solvecraft"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "eframe",
  "egui",
+ "embed-resource",
+ "hidapi",
  "log",
  "rfd",
  "serde_json",
@@ -3270,7 +3306,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-cli"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
  "solvecraft-engine",
@@ -3279,7 +3315,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-doc"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
@@ -3294,7 +3330,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-engine"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
@@ -3310,7 +3346,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-geom"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -3318,7 +3354,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-io"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "quick-xml 0.38.4",
  "solvecraft-doc",
@@ -3330,7 +3366,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-kernel"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "log",
  "serde",
@@ -3345,7 +3381,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-mcp"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
  "solvecraft-engine",
@@ -3353,16 +3389,17 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-render"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "image",
  "serde",
+ "serde_json",
  "solvecraft-geom",
 ]
 
 [[package]]
 name = "solvecraft-sketch"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -3373,7 +3410,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-ui-egui"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "egui",
  "egui-wgpu",
@@ -3388,7 +3425,7 @@ dependencies = [
 
 [[package]]
 name = "solvecraft-web"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "eframe",
  "egui",
@@ -3574,10 +3611,25 @@ dependencies = [
 ]
 
 [[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+name = "toml"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
@@ -3596,13 +3648,19 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_writer"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -3898,6 +3956,26 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "vswhom"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
+dependencies = [
+ "libc",
+ "vswhom-sys",
+]
+
+[[package]]
+name = "vswhom-sys"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -4683,6 +4761,16 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winreg"
+version = "0.56.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -4760,7 +4848,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.2.0"
+version = "0.3.2"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -5,12 +5,12 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.3.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
-rust-version = "1.90"
-authors = ["SolveCraft contributors"]
-repository = "https://github.com/bherbruck/solvecraft"
+rust-version = "1.95"
+authors = ["SolidCraft contributors"]
+repository = "https://github.com/bherbruck/solidcraft"
 
 [workspace.dependencies]
 # internal
@@ -100,3 +100,6 @@ truck-shapeops = { path = "vendor/truck-shapeops" }
 truck-stepio = { path = "vendor/truck-stepio" }
 truck-meshalgo = { path = "vendor/truck-meshalgo" }
 matext4cgmath = { path = "vendor/matext4cgmath" }
+
+# Keep OpenGL pipelines, resolve textures and CAD callbacks at the same safe sample count.
+egui-wgpu = { path = "vendor/egui-wgpu" }

README.md

@@ -1,26 +1,40 @@
-# SolveCraft
+# SolidCraft
 
-**Parametric 3D CAD; an open-source, [clean-room](CLAUDE.md) reimplementation of Autodesk
-Fusion 360, built in pure Rust.**
+**An open-source parametric 3D CAD application built in pure Rust.**
 
 Sketch, constrain, and build solids with a parametric feature timeline. Change a dimension
 and watch your model rebuild. Run it on your desktop, in your browser, or let AI agents
-model through the built-in MCP server. Part of the storytold "craft" family.
+model through the built-in MCP server.
 
-![SolveCraft 0.2.0: dimension a line, extrude a plate with an elliptical hole, and change its width while preserving the hole](docs/screenshots/demo.gif)
+![SolidCraft: draw a rounded electronics enclosure, sketch its USB port directly on a face, add four mounting bosses and resize it through Parameters](docs/screenshots/enclosure-demo-0.2.1.gif)
 
-*The actual 0.2.0 desktop UI: dimension a line from its endpoints, build a plate with an elliptical hole, then change its width from 25 → 35 mm and watch it rebuild. Includes the new axis navigation. 2× GIF preview; [full video at real-time speed](https://github.com/bherbruck/solvecraft/releases/download/v0.2.0/solvecraft-0.2.0-demo.mp4).*
+*Start with an empty design and draw the original parametric electronics enclosure in the English desktop UI: rounded corners, a shell, a USB port sketched directly on the wall and a four-boss pattern. Change width from 80 → 100 mm and wall thickness from 2 → 3 mm in Parameters and watch it rebuild. Original animated pointer and click cues; 4× playback. [Full video](https://github.com/bherbruck/solidcraft/raw/refs/heads/main/docs/screenshots/enclosure-demo-0.2.1.mp4), generated with the [demo script](examples/demo/record_ui.sh).*
 
-**Documentation:** the [SolveCraft book](https://bherbruck.github.io/solvecraft/) (user guide,
+**Documentation:** the [SolidCraft book](https://bherbruck.github.io/solidcraft/) (user guide,
 developer guide and command reference; sources in [docs/book](docs/book)), and the
-[web app](https://bherbruck.github.io/solvecraft/app/) to try it in the browser.
+[web app](https://bherbruck.github.io/solidcraft/app/) to try it in the browser.
 
-**Status: early but usable for simple parts.** 76 of 76 reference parts built in Fusion
-rebuild in SolveCraft with the same volume, area and topology ([docs/oracle.md](docs/oracle.md));
-command parity with Fusion's Design workspace is tracked in [docs/parity.md](docs/parity.md).
-Open work and known bugs are in [GitHub issues](https://github.com/bherbruck/solvecraft/issues),
+Linux Flatpak installation needs the Freedesktop runtime from Flathub as well as the
+SolidCraft application feed. See [install and launch commands](https://bherbruck.github.io/solidcraft/guide/getting-started.html#linux-flatpak).
+
+**Status: early but usable for simple parts.** The historical benchmark report records
+76 of 76 reference parts matching volume, area and topology ([docs/oracle.md](docs/oracle.md)).
+These checks do not establish complete geometric or workflow equivalence. Feature coverage
+is tracked in [docs/parity.md](docs/parity.md) and [ROADMAP.md](ROADMAP.md).
+Open work and known bugs are in [GitHub issues](https://github.com/bherbruck/solidcraft/issues),
 and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
 
+## Name and compatibility
+
+SolidCraft was previously called SolveCraft. The product display name and repository are
+changing; existing identifiers remain compatible: `.solvecraft` designs, `solvecraft-cli`,
+Cargo package names, settings/recovery locations and package IDs keep their existing names.
+Published 0.2.0 and 0.2.1 packages and demo recordings retain their original SolveCraft branding
+and filenames.
+
+Use the SolidCraft documentation and web-app URLs above. GitHub redirects links to the
+renamed repository; old-name Pages and Flatpak URLs are not maintained as permanent aliases.
+
 ## What works
 
 - **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
@@ -74,7 +88,7 @@ and help is welcome: see [CONTRIBUTING.md](CONTRIBUTING.md).
   Feature errors and Help can open an editable **Create Issue** draft with relevant context
   and an optional reviewed screenshot; opening GitHub does not submit the report.
 - **Headless CLI** `solvecraft-cli`: run command scripts, measure (volume, area, centre of mass,
-  face/edge/vertex counts), export, render PNG snapshots, replay Fusion oracle recipes.
+  face/edge/vertex counts), export, render PNG snapshots and replay reference recipes.
 - **MCP server** `solvecraft-cli mcp`: AI agents model, measure and look at parts headless or
   in the running app (see below).
 
@@ -92,6 +106,11 @@ cargo xtask ci                                          # fmt, clippy, tests, as
 
 Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solvecraft`.
 
+On Windows, SolidCraft detects a connected 3Dconnexion SpaceNavigator or SpaceMouse through its
+multi-axis HID interface. Move the cap to pan and zoom, and tilt or twist it to rotate the 3D view.
+While editing a sketch, the cap pans and zooms without changing the sketch view. The Navigation
+page in Preferences has an on/off switch and a speed control for the 3D mouse.
+
 In the browser: `cd apps/solvecraft-web && trunk build --release --public-url ./` (WebGPU, or
 WebGL2 with `?webgl`; `?sample` opens the sample part).
 
@@ -134,10 +153,19 @@ configuration and an example session: [docs/mcp.md](docs/mcp.md).
 
 ## Contributing
 
+Coming from Autodesk Fusion? SolidCraft uses familiar parametric CAD workflows: constrained
+sketches, solid features, an editable timeline, parameters and assemblies. See the
+[roadmap](ROADMAP.md) for supported operations and current limitations.
+
 See [CONTRIBUTING.md](CONTRIBUTING.md): how to build and test, the code map, the clean-room
 and licence rules, and where help is wanted most.
 
 ## Licence
 
-MIT OR Apache-2.0, at your option. SolveCraft is not affiliated with Autodesk; Fusion is a
-trademark of Autodesk, Inc.
+MIT OR Apache-2.0, at your option. Developed under the
+[clean-room contribution rules](CLAUDE.md); third-party code and assets retain their
+documented licences and attribution.
+
+References to other products describe workflow comparisons and benchmark provenance.
+SolidCraft is not affiliated with, sponsored by or endorsed by Autodesk. Autodesk and
+Fusion are trademarks of Autodesk, Inc.

ROADMAP.md

@@ -1,6 +1,6 @@
-# SolveCraft roadmap
+# SolidCraft roadmap
 
-Status as of **2026-10-11**. SolveCraft targets Fusion-style parametric modelling (sketch →
+Status as of **2026-10-11**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.
 
 ## At a glance
@@ -54,7 +54,7 @@ headline counts in-scope tabs only and lists the deferred ones separately.
 | M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, reorder with dependency checks, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
 | M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
 | M8 | Surface workspace | deferred | — |
-| M9 | Components and assemblies (Fusion-style): New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
 | M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done (oracle 67-76). PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, no Fusion oracle (licence), tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
 | M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
@@ -72,6 +72,9 @@ headline counts in-scope tabs only and lists the deferred ones separately.
   useful reproduction context. The draft is editable, with optional capture of the actual
   viewport and copy/save controls. Opening GitHub does not submit the issue. Help also exposes
   reporting for unexpected results that did not produce an error.
+- The header exposes **Report a bug**, including an accessible compact control on
+  narrow windows. It opens the same editable report and screenshot review without
+  changing the active model or a pending dimension.
 
 ## 0.2.0 release batch
 
@@ -85,9 +88,31 @@ headline counts in-scope tabs only and lists the deferred ones separately.
   preventing the reproduced thin-web loss. Unknown additional trims refuse; inherited
   common-cylinder trims retain their existing policy, so this is not a general Boolean proof.
 - Exact full-path assembly joint editing remains separate work and is not part of this batch.
-- The replacement README demo records the actual English 0.2.0 UI, with a 2× preview and
-  a full video at real-time speed. Package verification and publication follow
-  [the release workflow](docs/releasing.md); development pushes are not application releases.
+- Stable 0.2.0 is published: all release payload checksums, native cold reopening, deployed
+  web app and both Flatpak architectures were verified. The replacement README demo uses
+  the original electronics enclosure story and animated pointer in the actual English
+  0.2.0 UI, at 4× playback. Publication follows [the release workflow](docs/releasing.md).
+
+## 0.2.1 critical fixes
+
+- Axis view and navigation controls stay anchored to the viewport when feature dialogs or
+  the command palette open, at normal and enlarged display scales. Fit still accounts for
+  dialog coverage; covered controls do not receive clicks through dialogs.
+- Eligible planar faces survive fillet, chamfer and shell operations with exact source
+  certificates. Sketches placed directly on the enclosure wall and inner floor follow
+  width and wall changes, including after the USB cut and cold reopening.
+- Remove artificial straight-wall and rounded-corner subdivisions left by shell and
+  extrusion cuts. Identical generated wall segments span adjacent slabs as one physical
+  face, with exact full-height supports and boundary stitching. Preserve authored face
+  splits and face appearances. Permanent regressions cover material, STEP, reopening and
+  unaffected bodies across the extrusion end plane.
+- Feature dialogs use the available screen height for their fields, with OK and Cancel
+  outside the scrolling region, including enlarged display scales.
+- Design format 13 records shell-face attachments. Older designs remain readable;
+  newly saved designs require 0.2.1 or later. Ambiguous or unsupported faces still refuse
+  attachment rather than guessing a plane.
+- Saved projections from a removed strip retain their geometry and report the lost
+  reference. Explicitly reselect the wall to repair that projection.
 
 ## View navigation
 
@@ -98,6 +123,8 @@ headline counts in-scope tabs only and lists the deferred ones separately.
 
 ## Known limitations
 
+- Associative shell-face sketches require a unique certified planar source. Nested shell
+  attachments and ambiguous coincident sources remain unsupported.
 - Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
   rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
   meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
@@ -223,6 +250,21 @@ headline counts in-scope tabs only and lists the deferred ones separately.
   record their coordinate frame; legacy wires migrate from known provenance without changing
   coordinates. Broken legacy links with missing provenance can require explicit refresh or relink.
   See [occurrence workflows](docs/occurrence-workflows.md).
+- Parameters and Configurations have distinct actions in the SOLID toolbar's CONFIGURE panel.
+  Parameters opens the user/model variable editor; Configurations opens the configuration table.
+  Configure remains available in the panel dropdown.
+- Parameter creation supports Enter with validation and continued keyboard entry. Shared
+  expression autocomplete supports Up/Down selection, Enter/Tab acceptance and Escape dismissal;
+  accepting a suggestion does not submit a parameter or trigger viewport shortcuts.
+- Movable window title bars follow the app's dark/light header palette. Radial right-click
+  menus are opt-in in Preferences > Navigation; ordinary context menus remain the default.
+- Desktop distribution: running Windows windows and executable resources use the app icon;
+  packaging validates icon resources. Nix installs launchers, MIME data and generated icons,
+  with explicit launch apps and Vulkan-loader/driver discovery. Flatpak feed instructions
+  register the required runtime source; release checks exercise desktop modelling on X11/Wayland.
+- OpenGL rendering clamps effective anti-aliasing to 1x across UI pipelines, textures and CAD
+  callbacks to prevent black frames. Other backends retain the requested sample count, and
+  stored preferences remain unchanged.
 - Configuration rules: ordered typed conditions can drive parameters and suppressions or
   restrict values. Preview explains effective values without modifying the document; applying
   rules validates rows atomically. Length expressions retain their authoring units across
@@ -247,7 +289,26 @@ headline counts in-scope tabs only and lists the deferred ones separately.
   continuous collision detection; local thin walls and small details remain limitations.
   See [contact-set limits and recovery](docs/contact-sets.md).
 
+## Document-opening performance
+
+- Cold rebuild profiling separates parsing, geometry, placement, display meshing and
+  thumbnails. Straight-line closest-point projection and exact curved-surface evaluation
+  reuse reduce repeated work without relaxing geometry checks. Three alternating optimized
+  benchmark runs reduce median rebuild time by 26% on the public sensor enclosure and 22%
+  on a local case assembly; shape measurements and topology match the original build.
+  See [performance measurements](docs/perf.md). Further cold Boolean and import costs remain.
+- Prepared assembly geometry survives selection and view changes while real geometry and
+  placement changes invalidate it. A Pi assembly edge-selection probe drops from 9.24 s to
+  0.57 s; initial opening is unchanged. Actual Windows desktop profiling measures 15.87 s
+  median opening, with 82% spent rebuilding geometry; halving full opening remains open.
+
 ## Kernel
 
+- Shell of a stepped, joined planar body no longer creates horizontal subdivisions across
+  continuous walls. Fresh axis-aligned Cut walls are stitched using their exact construction
+  support and shared topology, preserving real steps and intentional boundaries. The local
+  reported case returns from 86 to 49 faces with unchanged material and bounds; regressions
+  cover stepped stock, STEP round trips and saved projections from removed pieces.
+
 truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
 retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.

THIRD-PARTY-LICENSES.txt

@@ -1,8 +1,8 @@
-Third-party software in SolveCraft
+Third-party software in SolidCraft
 
-SolveCraft (the desktop app, solvecraft-cli and the web app) is built from the 453 crates below.
+SolidCraft (the desktop app, solvecraft-cli and the web app) is built from the 454 crates below.
 Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files.
-SolveCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.
+SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.
 
 accesskit 0.24.1  (MIT OR Apache-2.0)
 accesskit_atspi_common 0.18.1  (MIT OR Apache-2.0)
@@ -147,6 +147,7 @@ hashbrown 0.16.1  (MIT OR Apache-2.0)
 hashbrown 0.17.1  (MIT OR Apache-2.0)
 hermit-abi 0.5.3  (MIT OR Apache-2.0)
 hex 0.4.3  (MIT OR Apache-2.0)
+hidapi 2.6.7  (MIT)
 iana-time-zone 0.1.65  (MIT OR Apache-2.0)
 iana-time-zone-haiku 0.1.2  (MIT OR Apache-2.0)
 icu_collections 2.3.0  (Unicode-3.0)
@@ -327,9 +328,9 @@ thiserror-impl 2.0.21  (MIT OR Apache-2.0)
 tiff 0.11.3  (MIT)
 tinystr 0.8.4  (Unicode-3.0)
 tokio 1.53.2  (MIT)
-toml_datetime 1.1.1+spec-1.1.0  (MIT OR Apache-2.0)
+toml_datetime 1.1.2+spec-1.1.0  (MIT OR Apache-2.0)
 toml_edit 0.25.15+spec-1.1.0  (MIT OR Apache-2.0)
-toml_parser 1.1.3+spec-1.1.0  (MIT OR Apache-2.0)
+toml_parser 1.1.5+spec-1.1.0  (MIT OR Apache-2.0)
 tracing 0.1.44  (MIT)
 tracing-attributes 0.1.31  (MIT)
 tracing-core 0.1.36  (MIT)
@@ -2229,7 +2230,7 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
 
 ================================================================================
-bit-set 0.10.0, bit-vec 0.9.1, downcast-rs 1.2.1, presser 0.3.1
+bit-set 0.10.0, bit-vec 0.9.1, downcast-rs 1.2.1, egui-wgpu 0.36.2, presser 0.3.1
 ================================================================================
 
 Apache License
@@ -3416,9 +3417,8 @@ SOFTWARE.
 
 ================================================================================
 crc32fast 1.5.2, dpi 0.1.2, foreign-types 0.5.0, foreign-types-macros 0.2.4, foreign-types-shared
-0.3.1, hex 0.4.3, jni-sys 0.3.1, jni-sys 0.4.1, quick-error 2.0.1, toml_datetime 1.1.1+spec-1.1.0,
-toml_edit 0.25.15+spec-1.1.0, toml_parser 1.1.3+spec-1.1.0, unicode-general-category 1.1.0, winit
-0.30.13
+0.3.1, hex 0.4.3, jni-sys 0.3.1, jni-sys 0.4.1, quick-error 2.0.1, toml_edit 0.25.15+spec-1.1.0,
+unicode-general-category 1.1.0, winit 0.30.13
 ================================================================================
 
 Apache License
@@ -4225,6 +4225,36 @@ and labelled as such in comments in the individual source files. All
 have been licensed under extremely permissive terms.
 ------------------------------------------------------------------------------
 
+================================================================================
+egui-wgpu 0.36.2
+================================================================================
+
+Copyright (c) 2018-2021 Emil Ernerfeldt <[email protected]>
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
 ================================================================================
 either 1.19.0, itertools 0.13.0, itertools 0.15.0
 ================================================================================
@@ -6019,6 +6049,27 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+================================================================================
+hidapi 2.6.7
+================================================================================
+
+Copyright 2017 The hidapi-rs Developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 ================================================================================
 iana-time-zone 0.1.65, iana-time-zone-haiku 0.1.2
 ================================================================================
@@ -10185,7 +10236,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ================================================================================
-toml_datetime 1.1.1+spec-1.1.0, toml_edit 0.25.15+spec-1.1.0, toml_parser 1.1.3+spec-1.1.0
+toml_datetime 1.1.2+spec-1.1.0, toml_edit 0.25.15+spec-1.1.0, toml_parser 1.1.5+spec-1.1.0
 ================================================================================
 
 Copyright (c) Individual contributors
@@ -10208,6 +10259,212 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+================================================================================
+toml_datetime 1.1.2+spec-1.1.0, toml_parser 1.1.5+spec-1.1.0
+================================================================================
+
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright Individual contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
 ================================================================================
 tracing 0.1.44, tracing-attributes 0.1.31, tracing-core 0.1.36
 ================================================================================
@@ -13017,7 +13274,7 @@ freely, subject to the following restrictions:
 
 ================================================================================
 Crates whose package carries no licence file (their licence is named in Cargo.toml; the MIT and Apache-2.0
-texts are as in SolveCraft's own LICENSE-MIT and LICENSE-APACHE)
+texts are as in SolidCraft's own LICENSE-MIT and LICENSE-APACHE)
 ================================================================================
 
 accesskit 0.24.1: MIT OR Apache-2.0 (https://github.com/AccessKit/accesskit)
@@ -13039,7 +13296,6 @@ dispatch2 0.3.1: Zlib OR Apache-2.0 OR MIT (https://github.com/madsmtm/objc2)
 ecolor 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui)
 eframe 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui/tree/main/crates/eframe)
 egui 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui)
-egui-wgpu 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui/tree/main/crates/egui-wgpu)
 egui-winit 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui/tree/main/crates/egui-winit)
 egui_glow 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui/tree/main/crates/egui_glow)
 emath 0.36.2: MIT OR Apache-2.0 (https://github.com/emilk/egui/tree/main/crates/emath)

apps/app_icon.rs

@@ -0,0 +1,126 @@
+//! Original SolidCraft mark, shared by desktop, packaging and CLI.
+/// This block is the icon image data
+pub fn rgba(size: usize) -> Result<Vec<u8>, String> {
+    if !(1..=2048).contains(&size) {
+        return Err("icon size must be 1..=2048".into());
+    }
+    type P = (f32, f32);
+    // Coverage buffer at 4x4 samples per pixel (2x2 for big sizes), averaged down at the end.
+    let ss = if size > 512 { 2 } else { 4 };
+    let n = size * ss;
+    let mut buf = vec![[0u8; 4]; n * n];
+    let s = n as f32 / 412.217; // SVG units -> samples: the logo fills the height
+    let ox = (n as f32 - 357.0 * s) / 2.0; // and is centred sideways
+    // Fill a convex polygon given in SVG units.
+    let mut fill = |pts: &[P], col: [u8; 3]| {
+        let v: Vec<P> = pts.iter().map(|p| (ox + p.0 * s, p.1 * s)).collect();
+        let (top, bottom) = v.iter().fold((f32::MAX, f32::MIN), |(a, b), p| (a.min(p.1), b.max(p.1)));
+        for y in ((top - 0.5).ceil() as i32).max(0)..=((bottom - 0.5).floor() as i32).min(n as i32 - 1) {
+            let cy = y as f32 + 0.5;
+            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
+            for i in 0..v.len() {
+                let (a, b) = (v[i], v[(i + 1) % v.len()]);
+                if (a.1 <= cy) != (b.1 <= cy) {
+                    let x = a.0 + (cy - a.1) / (b.1 - a.1) * (b.0 - a.0);
+                    lo = lo.min(x);
+                    hi = hi.max(x);
+                }
+            }
+            if lo > hi {
+                continue;
+            }
+            for x in ((lo - 0.5).ceil() as i32).max(0)..=((hi - 0.5).floor() as i32).min(n as i32 - 1) {
+                buf[y as usize * n + x as usize] = [col[0], col[1], col[2], 255];
+            }
+        }
+    };
+    // Faces: each is a few overlapping convex pieces (the filler only does convex shapes).
+    let (light, mid, dark) = ([96, 158, 236], [58, 136, 238], [55, 108, 197]);
+    fill(&[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)], light);
+    fill(&[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], light);
+    fill(&[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)], mid);
+    fill(&[(3.5, 105.9), (3.5, 205.7), (90.3, 256.2), (177.0, 206.1)], mid);
+    fill(&[(177.0, 206.1), (90.3, 256.2), (90.0, 356.2), (177.0, 406.4)], mid);
+    fill(&[(264.1, 155.8), (177.0, 206.1), (177.0, 406.4), (263.8, 256.2)], dark);
+    fill(&[(263.8, 256.2), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)], dark);
+    fill(&[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)], dark);
+    fill(&[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)], dark);
+    // White edge lines, 10 units wide: a rectangle per segment and a disc at each inner corner.
+    let white = [255, 255, 255];
+    let mut stroke = |pts: &[P], closed: bool| {
+        let m = pts.len();
+        for i in 0..(if closed { m } else { m - 1 }) {
+            let (a, b) = (pts[i], pts[(i + 1) % m]);
+            let l = ((b.0 - a.0).powi(2) + (b.1 - a.1).powi(2)).sqrt();
+            let (nx, ny) = (-(b.1 - a.1) / l * 5.0, (b.0 - a.0) / l * 5.0);
+            fill(&[(a.0 + nx, a.1 + ny), (b.0 + nx, b.1 + ny), (b.0 - nx, b.1 - ny), (a.0 - nx, a.1 - ny)], white);
+        }
+        for c in &pts[if closed { 0 } else { 1 }..if closed { m } else { m - 1 }] {
+            let disc: Vec<P> = (0..16)
+                .map(|k| {
+                    let t = k as f32 * std::f32::consts::TAU / 16.0;
+                    (c.0 + 5.0 * t.cos(), c.1 + 5.0 * t.sin())
+                })
+                .collect();
+            fill(&disc, white);
+        }
+    };
+    stroke(&[(263.8, 55.9), (177.1, 105.9), (263.8, 156.0), (263.8, 256.2), (350.6, 206.1)], false);
+    stroke(&[(5.0, 105.9), (178.5, 206.1), (178.5, 406.4)], false);
+    stroke(&[(177.0, 206.1), (263.8, 156.0)], false);
+    stroke(
+        &[
+            (178.5, 5.8),
+            (5.0, 105.9),
+            (5.0, 206.1),
+            (91.7, 256.2),
+            (91.7, 356.4),
+            (178.5, 406.4),
+            (352.0, 306.3),
+            (352.0, 206.1),
+            (265.2, 156.0),
+            (265.2, 55.9),
+        ],
+        true,
+    );
+    // Average each ss x ss block down to one pixel (straight alpha = covered share).
+    let mut rgba = Vec::with_capacity(size * size * 4);
+    for y in 0..size {
+        for x in 0..size {
+            let (mut sum, mut cnt) = ([0u32; 3], 0u32);
+            for j in 0..ss {
+                for i in 0..ss {
+                    let p = buf[(y * ss + j) * n + x * ss + i];
+                    if p[3] != 0 {
+                        cnt += 1;
+                        for k in 0..3 {
+                            sum[k] += u32::from(p[k]);
+                        }
+                    }
+                }
+            }
+            if cnt == 0 {
+                rgba.extend_from_slice(&[0, 0, 0, 0]);
+            } else {
+                let a = 255 * cnt / (ss * ss) as u32;
+                rgba.extend_from_slice(&[(sum[0] / cnt) as u8, (sum[1] / cnt) as u8, (sum[2] / cnt) as u8, a as u8]);
+            }
+        }
+    }
+    Ok(rgba)
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn shared_mark_has_transparency_and_original_colors_at_window_and_package_sizes() {
+        for size in [16, 24, 32, 48, 64, 128, 256] {
+            let pixels = super::rgba(size).expect("valid size");
+            assert_eq!(pixels.len(), size * size * 4);
+            assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] == 0));
+            assert!(pixels.as_chunks::<4>().0.iter().any(|p| p[3] == 255 && p[2] > p[0]));
+        }
+        assert!(super::rgba(0).is_err());
+        assert!(super::rgba(2049).is_err());
+    }
+}

apps/solvecraft-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-cli"
-description = "SolveCraft headless CLI: run command scripts, measure, export, render snapshots, replay oracle recipes"
+description = "SolidCraft headless CLI: run command scripts, measure, export, render snapshots, replay oracle recipes"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

apps/solvecraft-cli/src/main.rs

@@ -25,6 +25,9 @@ mod seams;
 use std::process::ExitCode;
 
 use serde_json::{Value, json};
+#[path = "../../app_icon.rs"]
+mod app_icon;
+
 use solvecraft_engine::Session;
 use solvecraft_engine::render::{StandardView, render_png};
 
@@ -53,8 +56,17 @@ fn main() -> ExitCode {
         Some("snapshot") => cmd_snapshot(&args[1..]),
         Some("exec") => cmd_exec(&args[1..]),
         Some("commands") => {
+            use std::io::Write as _;
             let mut s = Session::default();
-            s.execute("engine.commands", &json!({})).map(|v| println!("{}", pretty(&v))).map_err(|e| e.to_string())
+            s.execute("engine.commands", &json!({})).map_err(|e| e.to_string()).and_then(|v| {
+                // A pipeline consumer may stop early (e.g. `commands | head`).
+                // Unlike println!, writing explicitly lets us handle that without a panic.
+                match writeln!(std::io::stdout().lock(), "{}", pretty(&v)) {
+                    Ok(()) => Ok(()),
+                    Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => Ok(()),
+                    Err(e) => Err(format!("stdout: {e}")),
+                }
+            })
         }
         Some("recipe") => args.get(1).ok_or_else(|| USAGE.to_string()).and_then(|p| {
             let v = read_json(p)?;
@@ -97,7 +109,9 @@ fn pretty(v: &Value) -> String {
 }
 
 pub fn read_json(path: &str) -> Result<Value, String> {
-    let s = std::fs::read_to_string(path).map_err(|e| format!("{path}: {e}"))?;
+    // Through the engine's file access, which refuses anything that is not a regular file and
+    // reads no more than the cap: a character device or a FIFO would otherwise never end.
+    let s = solvecraft_engine::io::vfs::read_to_string(path, solvecraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
     serde_json::from_str(&s).map_err(|e| format!("{path}: {e}"))
 }
 
@@ -152,28 +166,31 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
         Some(b) => load(b)?,
         None => Session::default(),
     };
-    if args.iter().any(|a| a == "--results") {
-        // Print every command's result (scripts only).
+    let results = if args.iter().any(|a| a == "--results") {
+        // Collect every command's result (scripts only), then process requested files too.
         let v = read_json(path.ok_or("--results needs a script")?)?;
         let r = s.run_script(&v).map_err(|e| e.to_string())?;
-        println!("{}", pretty(&Value::Array(r)));
-        return Ok(());
-    }
-    match (base, path) {
-        (Some(_), Some(p)) => {
-            let v = read_json(p)?;
-            s.run_script(&v).map_err(|e| e.to_string())?;
+        Some(Value::Array(r))
+    } else {
+        match (base, path) {
+            (Some(_), Some(p)) => {
+                let v = read_json(p)?;
+                s.run_script(&v).map_err(|e| e.to_string())?;
+            }
+            (None, Some(p)) => s = load(p)?,
+            _ => {}
         }
-        (None, Some(p)) => s = load(p)?,
-        _ => {}
-    }
+        None
+    };
     for out in flags(args, "--out") {
         s.execute("file.export", &json!({"path": out})).map_err(|e| e.to_string())?;
     }
     if let Some(p) = flag(args, "--save") {
         s.execute("file.save_as", &json!({"path": p})).map_err(|e| e.to_string())?;
     }
-    if !args.iter().any(|a| a == "--quiet") {
+    if let Some(results) = results {
+        println!("{}", pretty(&results));
+    } else if !args.iter().any(|a| a == "--quiet") {
         let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
         println!("{}", pretty(&m));
     }
@@ -214,7 +231,7 @@ fn cmd_snapshot(args: &[String]) -> Result<(), String> {
     Ok(())
 }
 
-/// The app icon: a blue block with a bore, drawn by the CPU renderer on a transparent background
+/// The app icon: the SolidCraft logo, drawn in code on a transparent background
 /// (so packages need no committed image). `.ico` holds the Windows sizes as PNGs.
 fn cmd_icon(args: &[String]) -> Result<(), String> {
     let out = flag(args, "--out").ok_or("icon needs --out FILE.png or FILE.ico")?;
@@ -232,29 +249,7 @@ fn cmd_icon(args: &[String]) -> Result<(), String> {
 }
 
 fn icon_png(size: usize) -> Result<Vec<u8>, String> {
-    use solvecraft_engine::render::{Rgb, Scene, SceneLine, SceneMesh, png, render_transparent};
-    let mut s = Session::default();
-    for (cmd, p) in [
-        ("solid.box", json!({"length": 20, "width": 20, "height": 20, "center": [0, 0, 0]})),
-        ("solid.cylinder", json!({"diameter": 9, "height": 30, "base": [0, 0, -15], "operation": "cut"})),
-    ] {
-        s.execute(cmd, &p).map_err(|e| format!("icon: {e}"))?;
-    }
-    let mut cam = solvecraft_engine::view::home_camera(&s);
-    cam.distance *= 0.95;
-    let mut scene = Scene { radius: 60.0, ..Default::default() };
-    let px = size as f64 / 256.0;
-    for body in &s.world_state().bodies {
-        let mesh = body.mesh();
-        scene.meshes.push(SceneMesh { mesh: std::sync::Arc::clone(&mesh), color: Rgb(90, 160, 240), face_colors: Vec::new() });
-        for (i, e) in mesh.edges.iter().enumerate() {
-            if mesh.shaded_edge_visible(i) {
-                scene.lines.push(SceneLine { points: e.clone(), color: Rgb(24, 52, 96), width: (3.0 * px).max(0.8), on_top: false });
-            }
-        }
-    }
-    let c = render_transparent(&mut scene, &cam, size, size);
-    png(c.w, c.h, c.rgba).ok_or_else(|| "icon: PNG encoding failed".to_string())
+    solvecraft_engine::render::png(size, size, app_icon::rgba(size)?).ok_or_else(|| "icon: PNG encoding failed".to_string())
 }
 
 /// A Windows icon file holding PNG images (Vista and later read these).
@@ -359,13 +354,9 @@ fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
 fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     let path = args.first().ok_or("usage: solvecraft-cli bench-open <design.solvecraft | part.step> [--parse-only]")?;
     let t = std::time::Instant::now();
-    let len = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?.len();
     let step = solvecraft_engine::io::is_step_path(path);
     let limit = if step { solvecraft_engine::io::MAX_STEP_BYTES } else { solvecraft_engine::io::MAX_DESIGN_BYTES };
-    if len > limit as u64 {
-        return Err(format!("{path}: file too large"));
-    }
-    let bytes = std::fs::read(path).map_err(|e| format!("{path}: {e}"))?;
+    let bytes = solvecraft_engine::io::vfs::read(path, limit).map_err(|e| format!("{path}: {e}"))?;
     let read_ms = t.elapsed().as_secs_f64() * 1000.0;
     println!("{}", json!({"step": "read", "ms": read_ms, "bytes": bytes.len()}));
     let t = std::time::Instant::now();

apps/solvecraft-cli/src/oracle.rs

@@ -12,7 +12,7 @@ pub const REL_TOL: f64 = 1e-3;
 const APPROXIMATE: [(&str, f64, &str); 1] = [(
     "49-helical-sweep",
     5e-3,
-    "Fusion sweeps along a spline fitted through helix points; SolveCraft builds the true helix (a coil), so the size is compared within 0.5% and the topology not at all",
+    "Fusion sweeps along a spline fitted through helix points; SolidCraft builds the true helix (a coil), so the size is compared within 0.5% and the topology not at all",
 )];
 
 fn check_case(dir: &str) -> Value {
@@ -77,7 +77,7 @@ fn check_case(dir: &str) -> Value {
                     })
                     .collect();
                 seam_note = Some(format!(
-                    "topology compared seam-normalised: Fusion's {}/{}/{} faces/edges/vertices become {f}/{e}/{v} with closed-surface patches counted once and seam edges and vertices dropped (raw SolveCraft/Fusion: {})",
+                    "topology compared seam-normalised: Fusion's {}/{}/{} faces/edges/vertices become {f}/{e}/{v} with closed-surface patches counted once and seam edges and vertices dropped (raw SolidCraft/Fusion: {})",
                     want["total"]["faces"],
                     want["total"]["edges"],
                     want["total"]["vertices"],
@@ -120,7 +120,7 @@ fn check_case(dir: &str) -> Value {
         .collect();
     if !effective.is_empty() {
         out["note"] = json!(format!(
-            "known Fusion difference: {} replayed with the extent Fusion actually used (its through-all is sized as 1.1 × the farthest vertex, so curved tops stop it short; SolveCraft's through-all goes truly through)",
+            "known Fusion difference: {} replayed with the extent Fusion actually used (its through-all is sized as 1.1 × the farthest vertex, so curved tops stop it short; SolidCraft's through-all goes truly through)",
             effective.join(", ")
         ));
     }

apps/solvecraft-cli/tests/commands_output.rs

@@ -0,0 +1,26 @@
+//! The registry remains valid JSON and a closed pipeline reader must not cause a panic.
+
+use std::process::{Command, Stdio};
+
+#[test]
+fn registry_output_is_complete_json() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("commands").output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    let registry: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    let commands = registry.as_array().unwrap();
+    assert!(commands.iter().any(|command| command["id"] == "solid.box"));
+    assert!(commands.iter().any(|command| command["id"] == "engine.commands"));
+    assert!(output.stdout.ends_with(b"\n"));
+    assert!(output.stderr.is_empty());
+}
+
+#[test]
+fn closed_registry_pipe_exits_without_panicking() {
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solvecraft-cli")).arg("commands").stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+    // Close our read end before waiting. No sleeps or timing threshold are needed:
+    // the registry is larger than the pipe buffer, so it cannot all be written first.
+    drop(child.stdout.take());
+    let output = child.wait_with_output().unwrap();
+    assert!(output.status.success(), "status: {}; stderr: {}", output.status, String::from_utf8_lossy(&output.stderr));
+    assert!(output.stderr.is_empty(), "{}", String::from_utf8_lossy(&output.stderr));
+}

apps/solvecraft-cli/tests/design_corpus.rs

@@ -150,6 +150,30 @@ fn try_bytes(bytes: &[u8]) {
     }
 }
 
+/// Hostile shapes that no mutation of a saved file produces: plane references that close a
+/// cycle, which resolve through the model and back into the document.
+fn generated() -> Vec<(String, Vec<u8>)> {
+    let to = |name: &str| json!({"type": "plane", "plane": {"type": "construction", "name": name}});
+    let plane = |id: u64, name: &str, side: Value| {
+        json!({"id": id, "name": name, "suppressed": false, "type": "construction_plane",
+               "plane": {"type": "midplane", "a": side, "b": {"type": "plane", "plane": {"type": "origin", "name": "XZ"}}}})
+    };
+    let design = |name: &str, features: Value| {
+        json!({"format": "solvecraft/11", "name": name, "units": "mm", "params": [], "next_id": 9, "features": features}).to_string().into_bytes()
+    };
+    // A sketch past the caps interactive editing enforces: solving it would size dense matrices
+    // by the point count and abort on the allocation.
+    let point = json!({"id": "p1", "pos": [0.0, 0.0], "fixed": false});
+    let oversized = json!([{"id": 1, "name": "Sketch1", "suppressed": false, "type": "sketch",
+                            "plane": {"type": "origin", "name": "XY"},
+                            "sketch": {"points": vec![point; 200_000], "curves": [], "constraints": []}}]);
+    vec![
+        ("construction plane is its own side".into(), design("selfplane", json!([plane(1, "P1", to("P1"))]))),
+        ("two construction planes refer to each other".into(), design("twoplanes", json!([plane(1, "P1", to("P2")), plane(2, "P2", to("P1"))]))),
+        ("sketch with 200,000 points".into(), design("bigsketch", oversized)),
+    ]
+}
+
 #[test]
 fn damaged_and_hostile_design_files_never_panic() {
     let mut rng = Rng(0x5eed_cafe_f00d_d00d);
@@ -201,6 +225,7 @@ fn damaged_and_hostile_design_files_never_panic() {
         cases.push(("binary".into(), (0..4096u32).map(|i| (i.wrapping_mul(2_654_435_761) >> 24) as u8).collect()));
         all_cases.extend(cases.into_iter().map(|(what, b)| (name.clone(), what, b)));
     }
+    all_cases.extend(generated().into_iter().map(|(what, b)| ("generated".to_string(), what, b)));
     let next = std::sync::atomic::AtomicUsize::new(0);
     let threads = std::thread::available_parallelism().map_or(4, |n| n.get());
     let failures: Vec<String> = std::thread::scope(|scope| {

apps/solvecraft-cli/tests/run_results.rs

@@ -0,0 +1,97 @@
+//! Result reporting must not skip requested files or execute a script twice.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solvecraft-run-results-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    fn script(&self) -> PathBuf {
+        let path = self.0.join("box.json");
+        std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
+        path
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn cli() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_solvecraft-cli"))
+}
+
+fn json_output(output: Output) -> Value {
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    serde_json::from_slice(&output.stdout).unwrap()
+}
+
+fn body_count(path: &Path) -> Value {
+    json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
+}
+
+#[test]
+fn results_still_save_and_export_the_script_once() {
+    let dir = Scratch::new();
+    let saved = dir.0.join("box.solvecraft");
+    let stl = dir.0.join("box.stl");
+    let obj = dir.0.join("box.obj");
+    let result = json_output(
+        cli().arg("run").arg(dir.script()).arg("--results").arg("--save").arg(&saved).arg("--out").arg(&stl).arg("--out").arg(&obj).output().unwrap(),
+    );
+    assert_eq!(result.as_array().unwrap().len(), 1);
+    assert_eq!(body_count(&saved), 1);
+    for exported in [&stl, &obj] {
+        assert!(std::fs::metadata(exported).unwrap().len() > 0);
+        assert_eq!(body_count(exported), 1);
+    }
+}
+
+#[test]
+fn results_with_base_design_and_quiet_still_report_and_save() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let base = dir.0.join("base.solvecraft");
+    let saved = dir.0.join("combined.solvecraft");
+    json_output(cli().arg("run").arg(&script).arg("--save").arg(&base).output().unwrap());
+    let result = json_output(cli().args(["run", "--results", "--quiet", "--in"]).arg(&base).arg(&script).arg("--save").arg(&saved).output().unwrap());
+    assert_eq!(result.as_array().unwrap().len(), 1);
+    assert_eq!(body_count(&saved), 2);
+    assert_eq!(body_count(&base), 1);
+}
+
+#[test]
+fn results_propagate_output_errors() {
+    let dir = Scratch::new();
+    for flag in ["--save", "--out"] {
+        let path = dir.0.join("missing").join(if flag == "--save" { "box.solvecraft" } else { "box.stl" });
+        let output = cli().arg("run").arg(dir.script()).arg("--results").arg(flag).arg(&path).output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        assert!(!output.stderr.is_empty());
+        assert!(output.stdout.is_empty());
+        assert!(!path.exists());
+    }
+}
+
+#[test]
+fn results_without_script_still_fail() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solvecraft");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let output = cli().args(["run", "--results", "--in"]).arg(&base).output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&output.stderr).contains("--results needs a script"));
+}

apps/solvecraft-web/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-web"
-description = "SolveCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
+description = "SolidCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

apps/solvecraft-web/index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
-  <title>SolveCraft</title>
+  <title>SolidCraft</title>
   <link data-trunk rel="rust" data-bin="solvecraft-web" data-wasm-opt="z" data-weak-refs />
   <style>
     html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: #e8ebf0; }
@@ -14,6 +14,6 @@
 </head>
 <body>
   <canvas id="solvecraft_canvas"></canvas>
-  <div id="solvecraft_loading">Loading SolveCraft&hellip;</div>
+  <div id="solvecraft_loading">Loading SolidCraft&hellip;</div>
 </body>
 </html>

apps/solvecraft-web/src/files.rs

@@ -349,7 +349,7 @@ pub fn rename(files: &Rc<Files>, from: &str, to: &str) -> Result<(), String> {
     if files.entries.borrow().iter().any(|e| e.name == to) {
         return Err(format!("there is already a file named {to}"));
     }
-    let bytes = vfs::read(&format!("{OPFS}{from}")).map_err(|e| e.to_string())?;
+    let bytes = vfs::read(&format!("{OPFS}{from}"), solvecraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
     vfs::write(&format!("{OPFS}{to}"), &bytes).map_err(|e| e.to_string())?;
     delete(files, from);
     flush(files);

apps/solvecraft-web/src/main.rs

@@ -234,7 +234,7 @@ mod web {
                     self.app.insert_path(&path);
                     self.files.panel.set(false);
                 }
-                "download" => match vfs::read(&path) {
+                "download" => match vfs::read(&path, solvecraft_engine::io::MAX_DESIGN_BYTES) {
                     Ok(b) => {
                         if let Err(e) = files::download(&name, &b) {
                             self.app.set_status(e, true);
@@ -406,7 +406,7 @@ mod web {
                 match result {
                     Ok(()) => el.remove(),
                     Err(e) => {
-                        el.set_inner_html(&format!("<p>SolveCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>"))
+                        el.set_inner_html(&format!("<p>SolidCraft failed to start: {e:?}</p><p>A browser with WebGPU or WebGL2 is required.</p>"))
                     }
                 }
             }

apps/solvecraft/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft"
-description = "SolveCraft desktop app"
+description = "SolidCraft desktop app"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -19,5 +19,11 @@ serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
 
+[target.'cfg(target_os = "windows")'.dependencies]
+hidapi = { version = "2.6.7", default-features = false, features = ["windows-native"] }
+
 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }
+
+[build-dependencies]
+embed-resource = "3.0.11"

apps/solvecraft/build.rs

@@ -0,0 +1,61 @@
+#![forbid(unsafe_code)]
+#[path = "../app_icon.rs"]
+mod app_icon;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-changed=../app_icon.rs");
+    println!("cargo:rerun-if-changed=build.rs");
+    if std::env::var("CARGO_CFG_TARGET_OS")? != "windows" {
+        return Ok(());
+    }
+    let out = std::path::PathBuf::from(std::env::var_os("OUT_DIR").ok_or("missing OUT_DIR")?);
+    let sizes = [16usize, 24, 32, 48, 64, 128, 256];
+    let mut images = Vec::new();
+    for size in sizes {
+        let rgba = app_icon::rgba(size)?;
+        // ICO DIB: bottom-up BGRA plus a padded one-bit transparency mask.
+        let mask_stride = size.div_ceil(32) * 4;
+        let mut dib = Vec::new();
+        dib.extend_from_slice(&40u32.to_le_bytes());
+        dib.extend_from_slice(&(size as i32).to_le_bytes());
+        dib.extend_from_slice(&((size * 2) as i32).to_le_bytes());
+        dib.extend_from_slice(&1u16.to_le_bytes());
+        dib.extend_from_slice(&32u16.to_le_bytes());
+        dib.extend_from_slice(&[0; 24]);
+        for row in rgba.chunks_exact(size * 4).rev() {
+            for p in row.as_chunks::<4>().0.iter() {
+                dib.extend_from_slice(&[p[2], p[1], p[0], p[3]]);
+            }
+        }
+        for row in rgba.chunks_exact(size * 4).rev() {
+            let mut mask = vec![0u8; mask_stride];
+            for (x, p) in row.as_chunks::<4>().0.iter().enumerate() {
+                if p[3] == 0 {
+                    mask[x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+            dib.extend_from_slice(&mask);
+        }
+        images.push((size, dib));
+    }
+    let mut ico = vec![0, 0, 1, 0];
+    ico.extend_from_slice(&(images.len() as u16).to_le_bytes());
+    let mut offset = 6 + 16 * images.len();
+    for (size, data) in &images {
+        let dim = if *size == 256 { 0 } else { *size as u8 };
+        ico.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
+        ico.extend_from_slice(&(data.len() as u32).to_le_bytes());
+        ico.extend_from_slice(&(offset as u32).to_le_bytes());
+        offset += data.len();
+    }
+    for (_, data) in images {
+        ico.extend_from_slice(&data);
+    }
+    let icon = out.join("solidcraft.ico");
+    std::fs::write(&icon, ico)?;
+    let rc = out.join("solidcraft.rc");
+    std::fs::write(&rc, format!("1 ICON \"{}\"\n", icon.display().to_string().replace('\\', "/")))?;
+    // Missing resource tools are a build error, rather than silently shipping a generic icon.
+    embed_resource::compile_for(&rc, ["solvecraft"], embed_resource::NONE).manifest_required()?;
+    Ok(())
+}

apps/solvecraft/src/control_server.rs

@@ -3,12 +3,22 @@
 
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpListener, TcpStream};
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::mpsc::{Receiver, Sender, channel};
 use std::time::Duration;
 
 use serde_json::{Value, json};
+use solvecraft_engine::MAX_LINE;
 use solvecraft_ui_egui::ControlRequest;
 
+/// Connections served at once. The channel has no authentication beyond being bound to
+/// loopback, so a flood must not be able to spawn threads without end.
+const MAX_CONNECTIONS: usize = 16;
+/// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
+const MAX_BAD_LINES: usize = 8;
+
+static OPEN: AtomicUsize = AtomicUsize::new(0);
+
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
@@ -21,19 +31,69 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     eprintln!("solvecraft: control server listening on 127.0.0.1:{port}");
     std::thread::spawn(move || {
         for stream in listener.incoming().flatten() {
+            if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
+                OPEN.fetch_sub(1, Ordering::Relaxed);
+                let mut refused = stream;
+                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                continue;
+            }
             let tx = tx.clone();
             let ctx = ctx.clone();
-            std::thread::spawn(move || serve(stream, tx, ctx));
+            std::thread::spawn(move || {
+                serve(stream, tx, ctx);
+                OPEN.fetch_sub(1, Ordering::Relaxed);
+            });
         }
     });
     rx
 }
 
+/// One line without its newline, or `None` at the end of the stream. A client that sends
+/// gigabytes with no newline would otherwise make this thread allocate until the process is
+/// killed, so the line is refused as soon as it passes `max`.
+fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>>> {
+    let mut line = Vec::new();
+    loop {
+        let (done, used) = {
+            let available = r.fill_buf()?;
+            if available.is_empty() {
+                return Ok((!line.is_empty()).then_some(line));
+            }
+            match available.iter().position(|b| *b == b'\n') {
+                Some(i) => {
+                    line.extend_from_slice(available.get(..i).unwrap_or(&[]));
+                    (true, i + 1)
+                }
+                None => {
+                    line.extend_from_slice(available);
+                    (false, available.len())
+                }
+            }
+        };
+        r.consume(used);
+        if done {
+            return Ok(Some(line));
+        }
+        if line.len() > max {
+            return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "request too large"));
+        }
+    }
+}
+
 fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
-    for line in BufReader::new(read).lines() {
-        let Ok(line) = line else { break };
+    let mut reader = BufReader::new(read);
+    let mut bad = 0usize;
+    loop {
+        let line = match read_line(&mut reader, MAX_LINE) {
+            Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
+            Ok(None) => break,
+            Err(e) => {
+                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                break;
+            }
+        };
         if line.trim().is_empty() {
             continue;
         }
@@ -53,10 +113,58 @@ fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
                 }
                 r
             }
-            Err(e) => json!({"ok": false, "error": format!("bad JSON: {e}")}),
+            Err(e) => {
+                bad += 1;
+                json!({"ok": false, "error": format!("bad JSON: {e}")})
+            }
         };
         if writeln!(out, "{reply}").is_err() {
             break;
         }
+        if bad >= MAX_BAD_LINES {
+            break;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A request longer than the cap is refused instead of allocated.
+    #[test]
+    fn lines_past_the_cap_are_refused() {
+        let flood = vec![b'A'; MAX_LINE + 2];
+        let mut r = BufReader::new(flood.as_slice());
+        let e = read_line(&mut r, MAX_LINE).unwrap_err();
+        assert_eq!(e.kind(), std::io::ErrorKind::InvalidData);
+        assert!(e.to_string().contains("request too large"), "{e}");
+    }
+
+    /// Ordinary framing: lines split on newlines, blank lines kept, no trailing newline needed.
+    #[test]
+    fn lines_split_on_newlines() {
+        let text = b"{\"a\":1}\n\n{\"b\":2}\nlast".to_vec();
+        let mut r = BufReader::new(text.as_slice());
+        let mut got = Vec::new();
+        while let Some(line) = read_line(&mut r, MAX_LINE).unwrap() {
+            got.push(String::from_utf8(line).unwrap());
+        }
+        assert_eq!(got, vec!["{\"a\":1}", "", "{\"b\":2}", "last"]);
+        assert!(read_line(&mut r, MAX_LINE).unwrap().is_none());
+    }
+
+    /// A line that spans several reads of the underlying stream still arrives whole.
+    #[test]
+    fn lines_longer_than_one_buffer_arrive_whole() {
+        let long = "x".repeat(200_000);
+        let text = format!("{long}\n{long}\n").into_bytes();
+        let mut r = BufReader::with_capacity(64, text.as_slice());
+        assert_eq!(read_line(&mut r, MAX_LINE).unwrap().unwrap().len(), long.len());
+        assert_eq!(read_line(&mut r, MAX_LINE).unwrap().unwrap().len(), long.len());
+        assert!(read_line(&mut r, MAX_LINE).unwrap().is_none());
+        // The same line against a smaller cap is refused.
+        let mut r = BufReader::with_capacity(64, text.as_slice());
+        assert!(read_line(&mut r, 1000).is_err());
     }
 }

apps/solvecraft/src/main.rs

@@ -12,37 +12,47 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+#[path = "../../app_icon.rs"]
+mod app_icon;
 mod control_server;
+#[cfg(target_os = "windows")]
+mod space_mouse;
 
 use solvecraft_engine::Session;
 use solvecraft_ui_egui::{Services, SolveApp};
 
-struct App(SolveApp);
+struct App {
+    solve: SolveApp,
+    #[cfg(target_os = "windows")]
+    space_mouse: space_mouse::SpaceMouse,
+}
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         // The OS closing the window (Alt+F4, Cmd+Q, the window manager): ask about unsaved
         // designs first; the window closes once they are answered (`quit_requested`).
-        if ctx.input(|i| i.viewport().close_requested()) && !self.0.quit_requested {
+        if ctx.input(|i| i.viewport().close_requested()) && !self.solve.quit_requested {
             ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
-            solvecraft_ui_egui::documents::request_quit(&mut self.0);
+            solvecraft_ui_egui::documents::request_quit(&mut self.solve);
         }
-        self.0.logic(ctx);
-        if self.0.quit_requested {
+        self.solve.logic(ctx);
+        #[cfg(target_os = "windows")]
+        self.space_mouse.tick(&mut self.solve, ctx);
+        if self.solve.quit_requested {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+        self.solve.raw_input_hook(raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
-        self.0.ui(ui);
+        self.solve.ui(ui);
     }
     fn save(&mut self, storage: &mut dyn eframe::Storage) {
-        storage.set_string(PREFS_KEY, self.0.prefs());
+        storage.set_string(PREFS_KEY, self.solve.prefs());
     }
     fn on_exit(&mut self) {
-        solvecraft_ui_egui::recovery_ui::close(&mut self.0);
+        solvecraft_ui_egui::recovery_ui::close(&mut self.solve);
     }
 }
 
@@ -57,7 +67,7 @@ fn services() -> Services {
                     "Designs, STEP, IGES and meshes",
                     &["solvecraft", "step", "stp", "STEP", "STP", "igs", "iges", "IGS", "IGES", "3mf", "3MF", "stl", "STL"],
                 )
-                .add_filter("SolveCraft design", &["solvecraft"])
+                .add_filter("SolidCraft design", &["solvecraft"])
                 .add_filter("STEP", &["step", "stp", "STEP", "STP"])
                 .add_filter("IGES", &["igs", "iges", "IGS", "IGES"])
                 .add_filter("Mesh (3MF, STL)", &["3mf", "3MF", "stl", "STL"])
@@ -116,6 +126,24 @@ const DEPTH_BITS: u8 = 24;
 const STENCIL_BITS: u8 = 8;
 const MSAA: u16 = 4;
 
+fn app_viewport() -> Result<egui::ViewportBuilder, eframe::Error> {
+    Ok(egui::ViewportBuilder::default()
+        .with_title("SolidCraft")
+        .with_icon(egui::IconData {
+            rgba: app_icon::rgba(64).map_err(|e| eframe::Error::AppCreation(std::io::Error::other(e).into()))?,
+            width: 64,
+            height: 64,
+        })
+        .with_inner_size([1600.0, 1000.0])
+        .with_min_inner_size([960.0, 600.0])
+        .with_drag_and_drop(true)
+        .with_decorations(!CUSTOM_TITLEBAR)
+        .with_fullsize_content_view(true)
+        .with_titlebar_shown(false)
+        .with_title_shown(false)
+        .with_app_id("ai.storyteller.solvecraft"))
+}
+
 fn main() -> eframe::Result {
     let samples = msaa();
     let mut control_port: Option<u16> = std::env::var("SOLVECRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
@@ -138,16 +166,7 @@ fn main() -> eframe::Result {
         }
     }
     let options = eframe::NativeOptions {
-        viewport: egui::ViewportBuilder::default()
-            .with_title("SolveCraft")
-            .with_inner_size([1600.0, 1000.0])
-            .with_min_inner_size([960.0, 600.0])
-            .with_drag_and_drop(true)
-            .with_decorations(!CUSTOM_TITLEBAR)
-            .with_fullsize_content_view(true)
-            .with_titlebar_shown(false)
-            .with_title_shown(false)
-            .with_app_id("ai.storyteller.solvecraft"),
+        viewport: app_viewport()?,
         depth_buffer: DEPTH_BITS,
         stencil_buffer: STENCIL_BITS,
         multisampling: samples,
@@ -166,7 +185,7 @@ fn main() -> eframe::Result {
         }));
     }
     eframe::run_native(
-        "SolveCraft",
+        "SolidCraft",
         options,
         Box::new(move |cc| {
             solvecraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
@@ -177,7 +196,8 @@ fn main() -> eframe::Result {
                 app.load_prefs(&p);
             }
             if let Some(rs) = &cc.wgpu_render_state {
-                app.set_wgpu(rs, DEPTH_BITS, STENCIL_BITS, u32::from(samples));
+                eprintln!("SolidCraft graphics: {:?}, MSAA {}x (requested {}x)", rs.adapter.get_info().backend, rs.msaa_samples, samples);
+                app.set_wgpu(rs, DEPTH_BITS, STENCIL_BITS, rs.msaa_samples);
             }
             if let Some(port) = control_port {
                 let rx = control_server::start(port, cc.egui_ctx.clone());
@@ -205,7 +225,39 @@ fn main() -> eframe::Result {
                 let every = if app.autosave_minutes > 0.0 { app.autosave_minutes * 60.0 } else { f64::MAX / 4.0 };
                 solvecraft_ui_egui::recovery_ui::start(&mut app, &dir, std::time::Duration::from_secs_f64(every.min(1e9)));
             }
-            Ok(Box::new(App(app)))
+            #[cfg(target_os = "windows")]
+            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            Ok(Box::new(App {
+                solve: app,
+                #[cfg(target_os = "windows")]
+                space_mouse,
+            }))
         }),
     )
 }
+
+#[cfg(test)]
+mod icon_tests {
+    #[test]
+    fn desktop_viewport_supplies_the_original_mark_to_the_window() {
+        let viewport = super::app_viewport().expect("viewport");
+        let icon = viewport.icon.expect("running window must have an icon");
+        assert_eq!((icon.width, icon.height), (64, 64));
+        assert_eq!(icon.rgba, super::app_icon::rgba(64).expect("original mark"));
+        assert_eq!(viewport.app_id.as_deref(), Some("ai.storyteller.solvecraft"));
+    }
+}
+
+#[cfg(test)]
+mod msaa_tests {
+    #[test]
+    fn saved_multisampling_uses_the_selected_backend_policy() {
+        use eframe::wgpu::Backend;
+        for requested in [1, 2, 4, 8] {
+            assert_eq!(eframe::egui_wgpu::effective_msaa_samples(Backend::Gl, requested), 1);
+            for backend in [Backend::Vulkan, Backend::Dx12, Backend::Metal] {
+                assert_eq!(eframe::egui_wgpu::effective_msaa_samples(backend, requested), requested);
+            }
+        }
+    }
+}

apps/solvecraft/src/space_mouse.rs

@@ -0,0 +1,206 @@
+//! Windows 3Dconnexion HID navigation. The device reader never touches the document or UI;
+//! it publishes the latest axes, and the egui thread applies them once per frame.
+
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use egui::Context;
+use hidapi::{DeviceInfo, HidApi};
+use solvecraft_engine::render::Camera;
+use solvecraft_ui_egui::SolveApp;
+
+const STALE_AFTER: Duration = Duration::from_millis(150);
+const RETRY_AFTER: Duration = Duration::from_secs(2);
+
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+struct Axes {
+    translation: [i16; 3],
+    rotation: [i16; 3],
+}
+
+#[derive(Clone, Copy)]
+struct Reading {
+    axes: Axes,
+    translation_at: Instant,
+    rotation_at: Instant,
+}
+
+impl Reading {
+    fn new(now: Instant) -> Self {
+        Self { axes: Axes::default(), translation_at: now, rotation_at: now }
+    }
+
+    fn current(self, now: Instant) -> Axes {
+        Axes {
+            translation: if now.duration_since(self.translation_at) < STALE_AFTER { self.axes.translation } else { [0; 3] },
+            rotation: if now.duration_since(self.rotation_at) < STALE_AFTER { self.axes.rotation } else { [0; 3] },
+        }
+    }
+}
+
+/// The old SpaceNavigator uses Logitech's VID; newer 3Dconnexion devices use their own.
+/// The HID usage excludes ordinary Logitech mice and the keyboard interfaces of SpaceMice.
+fn is_3d_mouse(info: &DeviceInfo) -> bool {
+    matches!(info.vendor_id(), 0x046d | 0x256f) && info.usage_page() == 0x01 && info.usage() == 0x08
+}
+
+fn three_axes(bytes: &[u8]) -> Option<[i16; 3]> {
+    let &[x0, x1, y0, y1, z0, z1] = bytes.get(..6)? else { return None };
+    Some([i16::from_le_bytes([x0, x1]), i16::from_le_bytes([y0, y1]), i16::from_le_bytes([z0, z1])])
+}
+
+/// SpaceNavigator reports 1 (translation) and 2 (rotation), each with three signed
+/// little-endian 16-bit values. The HID layer may pad either report to its maximum size.
+fn decode_report(report: &[u8], reading: &mut Reading, now: Instant) -> bool {
+    match report.first().copied() {
+        Some(1) => {
+            let Some(translation) = report.get(1..).and_then(three_axes) else { return false };
+            reading.axes.translation = translation;
+            reading.translation_at = now;
+            true
+        }
+        Some(2) => {
+            let Some(rotation) = report.get(1..).and_then(three_axes) else { return false };
+            reading.axes.rotation = rotation;
+            reading.rotation_at = now;
+            true
+        }
+        _ => false,
+    }
+}
+
+fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
+    let Ok(mut api) = HidApi::new() else {
+        log::warn!("3D mouse: HID initialization failed");
+        return;
+    };
+    loop {
+        if let Err(error) = api.refresh_devices() {
+            log::warn!("3D mouse: device scan failed: {error}");
+        } else if let Some(device) = api.device_list().find(|info| is_3d_mouse(info)).and_then(|info| info.open_device(&api).ok()) {
+            let mut report = [0_u8; 64];
+            loop {
+                match device.read_timeout(&mut report, 100) {
+                    Ok(0) => {}
+                    Ok(size) => {
+                        if let Ok(mut reading) = shared.lock()
+                            && decode_report(&report[..size], &mut reading, Instant::now())
+                        {
+                            ctx.request_repaint();
+                        }
+                    }
+                    Err(error) => {
+                        log::info!("3D mouse disconnected: {error}");
+                        break;
+                    }
+                }
+            }
+            if let Ok(mut reading) = shared.lock() {
+                *reading = Reading::new(Instant::now());
+            }
+            ctx.request_repaint();
+        }
+        std::thread::sleep(RETRY_AFTER);
+    }
+}
+
+pub struct SpaceMouse {
+    shared: Arc<Mutex<Reading>>,
+    last_frame: Instant,
+}
+
+impl SpaceMouse {
+    pub fn start(ctx: &Context) -> Self {
+        let now = Instant::now();
+        let shared = Arc::new(Mutex::new(Reading::new(now)));
+        let worker_state = Arc::clone(&shared);
+        let worker_ctx = ctx.clone();
+        if let Err(error) = std::thread::Builder::new().name("solvecraft-3d-mouse".into()).spawn(move || reader(worker_ctx, worker_state)) {
+            log::warn!("3D mouse: reader could not start: {error}");
+        }
+        Self { shared, last_frame: now }
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
+        let now = Instant::now();
+        let seconds = now.duration_since(self.last_frame).as_secs_f64().min(0.05);
+        self.last_frame = now;
+        if !app.preferences.space_mouse_enabled || app.home.open {
+            return;
+        }
+        let axes = match self.shared.lock() {
+            Ok(reading) => reading.current(now),
+            Err(_) => return,
+        };
+        if axes == Axes::default() {
+            return;
+        }
+        let speed = f64::from(app.preferences.space_mouse_speed);
+        if !speed.is_finite() {
+            return;
+        }
+        app.begin_external_navigation();
+        let height = app.viewport.rect.map_or(600.0, |rect| f64::from(rect.height().max(1.0)));
+        navigate(&mut app.cam, axes, seconds * speed.clamp(0.1, 5.0), height, app.session.active_sketch.is_some());
+        ctx.request_repaint_after(Duration::from_millis(16));
+    }
+}
+
+/// A small dead zone avoids drift at rest. A full cap deflection takes roughly one viewport
+/// per second to pan and about two radians per second to turn, independent of frame rate.
+fn normalized(value: i16) -> f64 {
+    let v = f64::from(value);
+    if v.abs() <= 20.0 { 0.0 } else { v.signum() * ((v.abs() - 20.0) / 330.0).min(1.0) }
+}
+
+fn navigate(cam: &mut Camera, axes: Axes, seconds: f64, height: f64, sketch: bool) {
+    if !(seconds > 0.0) || !seconds.is_finite() {
+        return;
+    }
+    let [x, y, z] = axes.translation.map(normalized);
+    let [rx, ry, rz] = axes.rotation.map(normalized);
+    cam.pan(x * height * 0.6 * seconds, -y * height * 0.6 * seconds, height);
+    cam.zoom_at((-z * 1.5 * seconds).exp(), None);
+    if !sketch {
+        cam.orbit(ry * 250.0 * seconds, rx * 250.0 * seconds);
+        cam.roll_by(rz * 2.0 * seconds);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn decodes_separate_reports_without_stale_motion_or_padding_interference() {
+        let now = Instant::now();
+        let mut reading = Reading::new(now);
+        assert!(!decode_report(&[1, 1, 2], &mut reading, now));
+        assert_eq!(reading.current(now), Axes::default());
+        assert!(decode_report(&[1, 0x9c, 0xff, 0x2c, 0x01, 0, 0], &mut reading, now));
+        assert_eq!(reading.current(now).translation, [-100, 300, 0]);
+        assert!(decode_report(&[2, 0, 0, 1, 0, 0xff, 0xff], &mut reading, now));
+        assert_eq!(reading.current(now).rotation, [0, 1, -1]);
+        let later = now + STALE_AFTER + Duration::from_millis(1);
+        assert_eq!(reading.current(later), Axes::default());
+        assert!(decode_report(&[2, 4, 0, 5, 0, 6, 0], &mut reading, later));
+        assert!(decode_report(&[1, 1, 0, 2, 0, 3, 0, 0, 0, 0, 0, 0, 0], &mut reading, later));
+        assert_eq!(reading.current(later), Axes { translation: [1, 2, 3], rotation: [4, 5, 6] });
+    }
+
+    #[test]
+    fn six_axes_move_the_camera_and_sketches_keep_their_orientation() {
+        let mut cam = Camera::default();
+        let before = cam;
+        navigate(&mut cam, Axes { translation: [350, 350, 350], rotation: [350, 350, 350] }, 0.02, 600.0, false);
+        assert_ne!(cam.target, before.target);
+        assert!(cam.distance < before.distance);
+        assert_ne!(cam.yaw, before.yaw);
+        assert_ne!(cam.pitch, before.pitch);
+        assert_ne!(cam.roll, before.roll);
+        let orientation = (cam.yaw, cam.pitch, cam.roll);
+        navigate(&mut cam, Axes { translation: [350, 0, 0], rotation: [350, 350, 350] }, 0.02, 600.0, true);
+        assert_eq!((cam.yaw, cam.pitch, cam.roll), orientation);
+        assert!(cam.is_valid());
+    }
+}

crates/doc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-doc"
-description = "SolveCraft document model: parameters and expressions, sketches and features on a parametric timeline, incremental evaluation"
+description = "SolidCraft document model: parameters and expressions, sketches and features on a parametric timeline, incremental evaluation"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/doc/src/config_certificates.rs

@@ -154,10 +154,19 @@ pub enum FaceCertificate {
     ExtrudeCap { sketch: u64, high: bool, outer: Vec<String>, holes: Vec<Vec<String>> },
     ExtrudeSide { sketch: u64, curve: String },
     Imported { payload_sha256: String, item: u64, face: u64 },
+    ShellPlanar { source_producer: u64, source: Box<FaceCertificate>, inner: bool },
 }
 
 impl FaceCertificate {
     pub fn remap_features(&mut self, features: &std::collections::BTreeMap<u64, u64>) {
+        if let Self::ShellPlanar { source_producer, source, .. } = self {
+            if let Some(mapped) = features.get(source_producer) {
+                *source_producer = *mapped;
+            }
+            if !matches!(source.as_ref(), Self::ShellPlanar { .. }) {
+                source.remap_features(features);
+            }
+        }
         if let Self::ExtrudeSide { sketch, .. } | Self::ExtrudeCap { sketch, .. } = self
             && let Some(mapped) = features.get(sketch)
         {
@@ -175,6 +184,9 @@ impl FaceCertificate {
                     && payload_sha256.len() == 64
                     && payload_sha256.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
             }
+            Self::ShellPlanar { source_producer, source, .. } => {
+                *source_producer != 0 && !matches!(source.as_ref(), Self::ShellPlanar { .. }) && source.validate().is_ok()
+            }
         };
         if valid { Ok(()) } else { Err(DocError::Invalid("invalid face source certificate".into())) }
     }
@@ -216,11 +228,83 @@ pub(crate) fn validate_certificate_json(value: &serde_json::Value) -> Result<()>
                     .and_then(serde_json::Value::as_str)
                     .is_some_and(|digest| digest.len() == 64 && digest.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)))
         }
+        Some("shell_planar") => {
+            fields.len() == 4
+                && fields.keys().all(|key| ["kind", "source_producer", "source", "inner"].contains(&key.as_str()))
+                && nonzero("source_producer")
+                && fields.get("inner").and_then(serde_json::Value::as_bool).is_some()
+                && fields.get("source").is_some_and(|source| {
+                    source.as_object().is_some_and(|source| source.get("kind").and_then(serde_json::Value::as_str) != Some("shell_planar"))
+                        && validate_certificate_json(source).is_ok()
+                })
+        }
         _ => false,
     };
     if valid { Ok(()) } else { Err(DocError::Invalid("malformed or oversized face source certificate".into())) }
 }
 
+/// Canonical diagnostic role; producer identity remains in the typed certificate.
+pub(crate) fn shell_certificate_role(source: &FaceCertificate, inner: bool) -> Result<String> {
+    source.validate()?;
+    let role = match source {
+        FaceCertificate::Box { axis, high } => {
+            let axis = ["x", "y", "z"].get(*axis as usize).ok_or_else(|| DocError::Invalid("invalid shell source axis".into()))?;
+            format!("box:{}{axis}", if *high { "+" } else { "-" })
+        }
+        FaceCertificate::ExtrudeSide { curve, .. } => format!("side:{curve}"),
+        FaceCertificate::ExtrudeCap { high, outer, holes, .. } => format!("cap:{}:{}", if *high { "high" } else { "low" }, cap_key(outer, holes)),
+        FaceCertificate::Imported { payload_sha256, item, face } => format!("import:{payload_sha256}:{item}:{face}"),
+        FaceCertificate::ShellPlanar { .. } => return Err(DocError::Invalid("nested shell source certificates are unsupported".into())),
+    };
+    Ok(format!("shell:{}:{role}", if inner { "inner" } else { "outer" }))
+}
+
+pub(crate) fn flat_source_certificate(source: &solvecraft_kernel::FaceSource) -> Option<(u64, FaceCertificate)> {
+    use solvecraft_kernel::FaceSource;
+    match source {
+        FaceSource::Box { producer: Some(producer), axis, high, .. } => Some((*producer, FaceCertificate::Box { axis: *axis, high: *high })),
+        FaceSource::CertifiedExtrudeSide { producer, sketch, curve, .. } => {
+            Some((*producer, FaceCertificate::ExtrudeSide { sketch: *sketch, curve: curve.clone() }))
+        }
+        FaceSource::CertifiedExtrudeCap { producer, sketch, high, outer, holes, .. } => {
+            Some((*producer, FaceCertificate::ExtrudeCap { sketch: *sketch, high: *high, outer: outer.clone(), holes: holes.clone() }))
+        }
+        FaceSource::Imported { producer: Some(producer), payload_sha256: Some(digest), item, face } => {
+            Some((*producer, FaceCertificate::Imported { payload_sha256: digest.clone(), item: *item, face: *face }))
+        }
+        _ => None,
+    }
+}
+
+pub(crate) fn flat_source_matches(certificate: &FaceCertificate, source: &solvecraft_kernel::FaceSource, producer: u64) -> bool {
+    use solvecraft_kernel::FaceSource;
+    match (certificate, source) {
+        (FaceCertificate::Box { axis, high }, FaceSource::Box { producer: Some(current), axis: current_axis, high: current_high, .. }) => {
+            producer == *current && axis == current_axis && high == current_high
+        }
+        (
+            FaceCertificate::ExtrudeSide { sketch, curve },
+            FaceSource::CertifiedExtrudeSide { producer: current, sketch: current_sketch, curve: current_curve, .. },
+        ) => producer == *current && sketch == current_sketch && curve == current_curve,
+        (
+            FaceCertificate::ExtrudeCap { sketch, high, outer, holes },
+            FaceSource::CertifiedExtrudeCap {
+                producer: current,
+                sketch: current_sketch,
+                high: current_high,
+                outer: current_outer,
+                holes: current_holes,
+                ..
+            },
+        ) => producer == *current && sketch == current_sketch && high == current_high && outer == current_outer && holes == current_holes,
+        (
+            FaceCertificate::Imported { payload_sha256, item, face },
+            FaceSource::Imported { producer: Some(current), payload_sha256: Some(digest), item: current_item, face: current_face },
+        ) => producer == *current && payload_sha256 == digest && item == current_item && face == current_face,
+        _ => false,
+    }
+}
+
 /// Match a generated segment to one exact analytic sketch curve. Coincident
 /// candidates are ambiguous and never resolved by distance or candidate order.
 pub(crate) fn exact_sketch_curve(sketch: &SolvedSketch, generated: &Seg2) -> Option<String> {
@@ -306,6 +390,7 @@ impl Document {
             Some(solvecraft_kernel::FaceSource::Imported { producer: Some(producer), .. })
             | Some(solvecraft_kernel::FaceSource::CertifiedExtrudeSide { producer, .. })
             | Some(solvecraft_kernel::FaceSource::CertifiedExtrudeCap { producer, .. })
+            | Some(solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), .. })
             | Some(solvecraft_kernel::FaceSource::Box { producer: Some(producer), .. }) => *producer,
             _ => name
                 .strip_prefix('F')
@@ -316,6 +401,8 @@ impl Document {
         let certificate = self.configuration_face_certificate(body, index)?;
         if let Some(FaceCertificate::ExtrudeSide { curve, .. }) = &certificate {
             name = format!("F{origin}:side:{curve}");
+        } else if let Some(FaceCertificate::ShellPlanar { source, inner, .. }) = &certificate {
+            name = format!("F{origin}:{}", shell_certificate_role(source, *inner)?);
         } else if !name.starts_with(&format!("F{origin}:")) {
             name = format!("F{origin}:face:{index}");
         }
@@ -332,6 +419,19 @@ impl Document {
         let Some(source) = body.body.face_sources().and_then(|sources| sources.get(index)).and_then(Option::as_ref) else {
             return Ok(None);
         };
+        if let solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), source, inner, .. } = source {
+            if !self.feature(*producer).is_some_and(|feature| matches!(feature.kind, FeatureKind::Shell { .. })) {
+                return Err(DocError::Invalid("shell source producer missing".into()));
+            }
+            let (source_producer, source) =
+                flat_source_certificate(source).ok_or_else(|| DocError::Invalid("shell has no flat certified source".into()))?;
+            if !self.flat_certificate_producer_matches(source_producer, &source) {
+                return Err(DocError::Invalid("shell original source producer missing".into()));
+            }
+            let certificate = FaceCertificate::ShellPlanar { source_producer, source: Box::new(source), inner: *inner };
+            certificate.validate()?;
+            return Ok(Some(certificate));
+        }
         if let solvecraft_kernel::FaceSource::Imported { item, face, payload_sha256: Some(digest), producer: Some(producer) } = source {
             if !self.feature(*producer).is_some_and(|feature| matches!(feature.kind, FeatureKind::Import { .. })) {
                 return Err(DocError::Invalid("import source producer missing".into()));
@@ -378,6 +478,10 @@ pub(crate) fn payload_digest(payload: &str) -> String {
     format!("{:x}", Sha256::digest(payload.as_bytes()))
 }
 
+#[cfg(test)]
+#[path = "config_shell_tests.rs"]
+mod shell_tests;
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/doc/src/config_shell_tests.rs

@@ -0,0 +1,580 @@
+use super::*;
+use crate::{FeatureKind, Model, PlaneRef};
+use serde_json::json;
+use solvecraft_geom::{Vec2, Vec3};
+
+fn shell_document() -> (Document, u64, u64) {
+    let mut doc = Document::new("certified shell");
+    doc.set_param("width", "20", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    let base = doc
+        .add_feature(
+            serde_json::from_value(json!({"type":"box","corner":[0,0,0],"length":"width","width":"12","height":"10"})).unwrap(),
+            Some("Case"),
+        )
+        .unwrap();
+    doc.feature_mut(base).unwrap().body_names = vec!["Case".into()];
+    let shell = doc
+        .add_feature(
+            FeatureKind::Shell {
+                faces: vec![Vec3::new(5., 6., 10.)],
+                thickness: "wall".into(),
+                body: Some("Case".into()),
+                direction: "inside".into(),
+                tangent_chain: false,
+            },
+            Some("Shell"),
+        )
+        .unwrap();
+    (doc, base, shell)
+}
+
+fn face_index(body: &ModelBody, inner: bool) -> usize {
+    body.body
+        .face_sources()
+        .unwrap()
+        .iter()
+        .position(|source| {
+            matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { inner: current, source, .. })
+            if *current == inner && matches!(source.as_ref(), solvecraft_kernel::FaceSource::Box { axis:0,high:true,.. }))
+        })
+        .unwrap()
+}
+
+#[test]
+fn shell_planar_raw_bounds_flat_identity_and_clone_remap() {
+    let plane = solvecraft_geom::Plane::XY;
+    let same = |planes: &[Option<solvecraft_geom::Plane>]| super::super::styles::shell_plane_family(planes.iter().copied());
+    assert!(same(&[Some(plane), Some(plane)]));
+    assert!(!same(&[]));
+    assert!(!same(&[Some(plane), None]));
+    for different in [
+        solvecraft_geom::Plane { origin: Vec3::X, ..plane },
+        solvecraft_geom::Plane { x: -plane.x, y: -plane.y, ..plane },
+        solvecraft_geom::Plane { y: -plane.y, ..plane },
+    ] {
+        assert!(!same(&[Some(plane), Some(different)]));
+    }
+    let valid = json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"extrude_side","sketch":2,"curve":"c4"},"inner":true});
+    assert!(validate_certificate_json(&valid).is_ok());
+    let mut certificate: FaceCertificate = serde_json::from_value(valid.clone()).unwrap();
+    certificate.remap_features(&[(2, 20), (3, 30)].into_iter().collect());
+    assert_eq!(serde_json::to_value(&certificate).unwrap()["source_producer"], 30);
+    assert_eq!(serde_json::to_value(&certificate).unwrap()["source"]["sketch"], 20);
+    for bad in [
+        json!({"kind":"shell_planar","source_producer":0,"source":{"kind":"box","axis":0,"high":true},"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":null,"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":valid,"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"extrude_side","sketch":2,"curve":"x".repeat(1_000_000)},"inner":false}),
+        json!({"kind":"shell_planar","source_producer":3,"source":{"kind":"box","axis":0,"high":true,"extra":[[[]]]},"inner":false}),
+    ] {
+        assert!(validate_certificate_json(&bad).is_err());
+    }
+}
+
+#[test]
+fn shell_planar_anchor_rebuild_cold_geometry_and_missing_source_errors() {
+    let (mut doc, base, shell) = shell_document();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|result| result.error.is_none()), "{:?}", model.results);
+    let state = model.state();
+    let body = state.body("Case").unwrap();
+    let outer = doc.strong_face_target(body, face_index(body, false), Vec3::default()).unwrap();
+    let outer_matches: Vec<_> = body.body.face_sources().unwrap().iter().enumerate().filter_map(|(index, source)| {
+        matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { inner: false, source, .. }) if matches!(source.as_ref(), solvecraft_kernel::FaceSource::Box { axis: 0, high: true, .. })).then_some((index, body.body.face_plane(index)))
+    }).collect();
+    assert_eq!(outer_matches.len(), 1, "outer support must be one physical face: {outer_matches:?}");
+    assert!(super::super::styles::shell_plane_family(outer_matches.iter().map(|(_, plane)| *plane)));
+    let outer_plane = body.body.face_plane(face_index(body, false)).unwrap();
+    let outer_anchor = doc.capture_face_anchor(body, face_index(body, false), &outer_plane, &[], 0, &[]).unwrap();
+    let projected = crate::project::resolve_anchored_face(&doc, &state, &outer_plane, solvecraft_sketch::LinkKind::Project, &outer_anchor).unwrap();
+    let mut linked = solvecraft_sketch::Sketch::new();
+    let link = linked.add_link(solvecraft_sketch::LinkKind::Project, projected.source, &projected.geom).unwrap();
+    assert!(!linked.update_link(&link, &projected.geom).unwrap());
+    let inner_index = face_index(body, true);
+    let inner = doc.strong_face_target(body, inner_index, Vec3::default()).unwrap();
+    assert_ne!(outer.key(), inner.key());
+    assert!(matches!(&inner.certificate, Some(FaceCertificate::ShellPlanar { source_producer,inner:true,.. }) if *source_producer==base));
+    assert_eq!(inner.origin_feature, shell);
+    let picked = body.body.face_plane(inner_index).unwrap();
+    assert!((picked.origin.x - 18.).abs() < 1e-8);
+    let anchor = doc.capture_face_anchor(body, inner_index, &picked, &[], 0, &[]).unwrap();
+    let mut sketch = solvecraft_sketch::Sketch::new();
+    let points: Vec<_> =
+        [(2., 2.), (4., 2.), (4., 4.), (2., 4.)].into_iter().map(|(x, y)| sketch.add_point(Vec2::new(x, y), None).unwrap()).collect();
+    for edge in 0..4 {
+        sketch.add_line_pts(points[edge], points[(edge + 1) % 4], None).unwrap();
+    }
+    let sk = doc
+        .add_feature(
+            FeatureKind::Sketch {
+                plane: PlaneRef::Face { plane: picked, at: picked.origin, name: None, anchor: Some(Box::new(anchor.clone())) },
+                sketch,
+            },
+            Some("Inner face sketch"),
+        )
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"2"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Face boss"),
+        )
+        .unwrap();
+    model.evaluate(&doc);
+    let before = model.state().bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    doc.set_param("width", "30", Some("mm"), None).unwrap();
+    doc.set_param("wall", "3", Some("mm"), None).unwrap();
+    model.evaluate(&doc);
+    let changed = model.state();
+    let plane = doc.resolve_face_anchor(&anchor, 0, &changed).unwrap();
+    assert!((plane.origin.x - 27.).abs() < 1e-8);
+    let after = changed.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    assert!((solvecraft_kernel::measure(&changed.bodies.iter().find(|body| body.feature == boss).unwrap().body).unwrap().volume - 8.).abs() < 1e-8);
+    assert!((doc.resolve_face_anchor(&outer_anchor, 0, &changed).unwrap().origin.x - 30.).abs() < 1e-8);
+    let changed_outer_plane = doc.resolve_face_anchor(&outer_anchor, 0, &changed).unwrap();
+    let refreshed =
+        crate::project::resolve_anchored_face(&doc, &changed, &changed_outer_plane, solvecraft_sketch::LinkKind::Project, &outer_anchor).unwrap();
+    assert!(!linked.update_link(&link, &refreshed.geom).unwrap(), "same exterior boundary must retain projected IDs");
+    assert!((after.min.x - before.min.x - 9.).abs() < 1e-8, "{before:?} -> {after:?}");
+    assert!((after.max.x - before.max.x - 9.).abs() < 1e-8, "{before:?} -> {after:?}");
+    assert!((after.min.y - before.min.y).abs() < 1e-8 && (after.min.z - before.min.z).abs() < 1e-8);
+    let saved = doc.to_json();
+    assert!(saved.contains("solvecraft/13"));
+    let loaded = crate::format::read(&saved).unwrap();
+    let mut cold = Model::new();
+    cold.evaluate(&loaded);
+    let cold_state = cold.state();
+    let cold_bounds = cold_state.bodies.iter().find(|body| body.feature == boss).unwrap().mesh().bounds();
+    assert!(after.min.dist(cold_bounds.min) < 1e-9 && after.max.dist(cold_bounds.max) < 1e-9);
+    assert!(loaded.resolve_face_anchor(&anchor, 0, &cold_state).unwrap().origin.dist(plane.origin) < 1e-9);
+    let mut wrong = anchor.clone();
+    wrong.target.origin_feature = base;
+    assert!(doc.resolve_face_anchor(&wrong, 0, &changed).is_err());
+    let mut wrong_source = anchor.clone();
+    if let Some(FaceCertificate::ShellPlanar { source_producer, .. }) = &mut wrong_source.target.certificate {
+        *source_producer = shell;
+    }
+    assert!(doc.resolve_face_anchor(&wrong_source, 0, &changed).is_err());
+    doc.feature_mut(shell).unwrap().suppressed = true;
+    model.evaluate(&doc);
+    let lost = model.state();
+    assert!(doc.resolve_face_anchor(&anchor, 0, &lost).is_err());
+    assert!(!lost.bodies.iter().any(|body| body.feature == boss), "lost attachment must prevent downstream geometry");
+}
+
+#[test]
+fn shell_planar_format13_keeps_v12_documents_and_refuses_future() {
+    let (doc, _, _) = shell_document();
+    let mut legacy: serde_json::Value = serde_json::from_str(&doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/12");
+    let loaded = crate::format::read(&legacy.to_string()).unwrap();
+    let mut current: serde_json::Value = serde_json::from_str(&loaded.to_json()).unwrap();
+    assert_eq!(current["format"], "solvecraft/13");
+    current["format"] = json!("solvecraft/12");
+    assert_eq!(legacy, current, "identity migration must preserve every prior field");
+    legacy["format"] = json!("solvecraft/14");
+    assert!(crate::format::read(&legacy.to_string()).is_err());
+}
+
+#[test]
+fn regularized_shell_keeps_legacy_and_explicit_single_face_projections_closed() {
+    let (mut doc, _, _) = shell_document();
+    let mut model = Model::new();
+    for (width, wall) in [(20., 2.), (30., 3.)] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for state in [model.state(), cold.state()] {
+            let body = state.body("Case").unwrap();
+            let index = face_index(body, false);
+            let mesh = body.mesh();
+            assert_eq!(body.body.face_sources().unwrap().iter().filter(|source|matches!(source,Some(solvecraft_kernel::FaceSource::ShellPlanar {inner:false,source,..}) if matches!(source.as_ref(),solvecraft_kernel::FaceSource::Box {axis:0,high:true,..}))).count(),1,"no physical outer-wall strip face may remain");
+            let plane = body.body.face_plane(index).unwrap();
+            let point = mesh
+                .triangles
+                .iter()
+                .zip(&mesh.tri_face)
+                .find_map(|(tri, face)| (*face as usize == index).then(|| mesh.tri(tri)).flatten())
+                .map(|[a, b, c]| (a + b + c) / 3.)
+                .unwrap();
+            let source = solvecraft_sketch::LinkSource::Face { body: "Case".into(), at: point };
+            let (values, _) = doc.param_values();
+            let legacy = crate::project::resolve(&doc, &values, &state, &plane, solvecraft_sketch::LinkKind::Project, &source).unwrap();
+            let explicit = crate::project::resolve_face_indices(&state, &plane, solvecraft_sketch::LinkKind::Project, "Case", &[index]).unwrap();
+            assert_eq!(legacy.geom, explicit.geom);
+            assert_eq!(explicit.geom.len(), 4, "raw planar piece keeps all four edges");
+            let mut sketch = solvecraft_sketch::Sketch::new();
+            let link = sketch.add_link(solvecraft_sketch::LinkKind::Project, source, &legacy.geom).unwrap();
+            sketch.links[0].face_name = Some(crate::naming::face_names(body)[index].clone());
+            let warnings = crate::project::refresh_links(&doc, &values, &state, &plane, &mut sketch);
+            assert!(warnings.is_empty(), "{warnings:?}");
+            assert!(!sketch.links[0].lost);
+            assert!(!sketch.update_link(&link, &explicit.geom).unwrap());
+        }
+    }
+}
+
+#[test]
+fn saved_former_strip_projection_reports_lost_without_expanding_healthy_material() {
+    let (mut doc, _, shell) = shell_document();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    let state = model.state();
+    let body = state.body("Case").unwrap();
+    let index = face_index(body, false);
+    let plane = body.body.face_plane(index).unwrap();
+    let stem = crate::naming::face_names(body)[index].clone();
+    assert_eq!(crate::naming::strip_piece(&stem), stem);
+    // Reconstruct the original raw shell before certificate stamping/regularization,
+    // and run the unchanged historical naming/capture path on its actual strip.
+    let before = model.state_before(shell);
+    // Legacy Shell did not propagate construction certificates. Omit transient
+    // metadata here; operand paint also disables new wall-run coalescence so
+    // this control retains the actual historical raw pieces.
+    let raw_source = solvecraft_kernel::box_solid(Vec3::ZERO, Vec3::new(20., 12., 10.)).unwrap().with_paint(Some(solvecraft_kernel::Paint {
+        opacity: 1.,
+        faces: vec![solvecraft_kernel::FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }],
+    }));
+    let raw = solvecraft_kernel::shell(&raw_source, &[Vec3::new(5., 6., 10.)], 2.).unwrap();
+    let mut old_body = ModelBody::new("Case".into(), raw, shell);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(shell).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let former = crate::naming::face_name_at_body(&old_body, Vec3::new(20., 6., 1.)).unwrap();
+    assert_eq!(former, format!("{stem}#1"), "historical actual strip capture records full piece name");
+    let mut sketch = solvecraft_sketch::Sketch::new();
+    let corners = [Vec2::new(0., 0.), Vec2::new(12., 0.), Vec2::new(12., 2.), Vec2::new(0., 2.)];
+    let geometry: Vec<_> = (0..4).map(|i| solvecraft_sketch::LinkGeom::Line(corners[i], corners[(i + 1) % 4])).collect();
+    sketch
+        .add_link(
+            solvecraft_sketch::LinkKind::Project,
+            solvecraft_sketch::LinkSource::Face { body: "Case".into(), at: Vec3::new(20., 6., 1.) },
+            &geometry,
+        )
+        .unwrap();
+    sketch.links[0].face_name = Some(former.clone());
+    let original = sketch.clone();
+    let sk = doc
+        .add_feature(
+            FeatureKind::Sketch { plane: PlaneRef::Face { plane, at: Vec3::new(20., 6., 1.), name: Some(former), anchor: None }, sketch },
+            Some("Saved strip sketch"),
+        )
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Saved strip profile material"),
+        )
+        .unwrap();
+    let mut legacy: serde_json::Value = serde_json::from_str(&doc.to_json()).unwrap();
+    legacy["format"] = json!("solvecraft/12");
+    let mut doc = crate::format::read(&legacy.to_string()).unwrap();
+    for width in [20., 30.] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", "3", Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for current in [&model, &cold] {
+            let warning = current.results.iter().find(|r| r.id == sk).unwrap().warning.as_deref().unwrap();
+            assert!(warning.contains("no longer exists; last geometry retained"), "{warning}");
+            let state = current.state();
+            let solved = state.sketch(sk).unwrap();
+            assert!(solved.sketch.links[0].lost);
+            assert_eq!(solved.sketch.curves, original.curves);
+            assert_eq!(solved.sketch.points, original.points);
+            let material = state.bodies.iter().find(|body| body.feature == boss).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&material.body).unwrap().volume - 24.).abs() < 1e-8,
+                "old24mm3 profile must not silently become120mm3 wall profile"
+            );
+            let bounds = material.mesh().bounds();
+            assert!((bounds.min.x - width).abs() < 1e-8 && (bounds.max.x - width - 1.).abs() < 1e-8);
+            assert!((bounds.max.y - 12.).abs() < 1e-8 && (bounds.max.z - 2.).abs() < 1e-8);
+        }
+    }
+}
+
+#[test]
+fn saved_curved_strip_projection_is_lost_after_exact_wall_coalescence() {
+    use solvecraft_kernel::{FacePaint, Paint};
+    use solvecraft_sketch::{LinkKind, LinkSource, Sketch};
+    let mut doc = Document::new("saved curved strip");
+    doc.set_param("width", "80", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    let base = doc
+        .add_feature(
+            serde_json::from_value(json!({"type":"box","corner":["-width/2",-30,0],"length":"width","width":"60","height":"30"})).unwrap(),
+            Some("Case"),
+        )
+        .unwrap();
+    doc.feature_mut(base).unwrap().body_names = vec!["Case".into()];
+    doc.add_feature(
+        serde_json::from_value(json!({"type":"fillet","body":"Case","edges":[[40,30,15],[-40,30,15],[-40,-30,15],[40,-30,15]],"radius":"6"}))
+            .unwrap(),
+        Some("Corners"),
+    )
+    .unwrap();
+    let shell = doc
+        .add_feature(
+            FeatureKind::Shell {
+                faces: vec![Vec3::new(0., 0., 30.)],
+                thickness: "wall".into(),
+                body: Some("Case".into()),
+                direction: "inside".into(),
+                tangent_chain: false,
+            },
+            Some("Shell"),
+        )
+        .unwrap();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|r| r.error.is_none()), "{:?}", model.results);
+    let before = model.state_before(shell);
+    // Per-face paint disables the construction optimization: this control keeps
+    // the real pre-repair slab faces without forging a name or source witness.
+    let old_source = before
+        .body("Case")
+        .unwrap()
+        .body
+        .clone()
+        .with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] }));
+    let cavity_box = solvecraft_kernel::box_solid(Vec3::new(-38., -28., 2.), Vec3::new(38., 28., 35.)).unwrap();
+    let cavity = solvecraft_kernel::fillet(
+        &cavity_box,
+        &[Vec3::new(38., 28., 15.), Vec3::new(-38., 28., 15.), Vec3::new(-38., -28., 15.), Vec3::new(38., -28., 15.)],
+        4.,
+    )
+    .unwrap();
+    let raw = solvecraft_kernel::boolean(&old_source, &cavity, solvecraft_kernel::BoolOp::Cut).unwrap().unwrap();
+    let mut old_body = ModelBody::new("Case".into(), raw, shell);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(shell).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let t = std::f64::consts::FRAC_1_SQRT_2;
+    let at = Vec3::new(34. + 6. * t, 24. + 6. * t, 1.);
+    let former = crate::naming::face_name_at_body(&old_body, at).unwrap();
+    let stem = crate::naming::strip_piece(&former).to_string();
+    assert_ne!(former, stem, "actual old cylindrical strip must have a piece suffix");
+    let state = model.state();
+    let current = state.body("Case").unwrap();
+    let names = crate::naming::face_names(current);
+    let index = names.iter().position(|name| name == &stem).unwrap();
+    assert!(current.body.face_was_coalesced(index));
+    assert!(current.body.face_plane(index).is_none(), "witness grants no planar attachment authority");
+    assert!(old_body.body.face_sources().is_none_or(|sources| sources.iter().enumerate().all(|(index, _)| !old_body.body.face_was_coalesced(index))));
+    let mut old_state = (*model.state()).clone();
+    old_state.bodies = vec![old_body];
+    let source = LinkSource::Face { body: "Case".into(), at };
+    // Recover the saved projection from the old face's complete raw topology.
+    // Display seam suppression must not discard a historical strip boundary.
+    let old_body = old_state.body("Case").unwrap();
+    let old_index = crate::naming::face_on_body(old_body, &former, at).unwrap().0;
+    let mesh = old_body.mesh();
+    let mut geometry = Vec::new();
+    for (index, faces) in mesh.edge_faces.iter().enumerate() {
+        if !faces.contains(&(old_index as u32)) {
+            continue;
+        }
+        let points = &mesh.edges[index];
+        let a = solvecraft_geom::Plane::YZ.to_local(*points.first().unwrap());
+        let b = solvecraft_geom::Plane::YZ.to_local(*points.last().unwrap());
+        let (a, b) = (Vec2::new(a.x, a.y), Vec2::new(b.x, b.y));
+        assert!(a.dist(b) > 1e-6);
+        for point in points {
+            let q = solvecraft_geom::Plane::YZ.to_local(*point);
+            let q = Vec2::new(q.x, q.y);
+            let direction = b - a;
+            let t = ((q - a).dot(direction) / direction.dot(direction)).clamp(0., 1.);
+            assert!(q.dist(a + direction * t) < 1e-7, "exact cylindrical quadrant projects to a straight support");
+        }
+        geometry.push(solvecraft_sketch::LinkGeom::Line(a, b));
+    }
+    assert_eq!(geometry.len(), 4, "historical curved strip has a complete four-edge rectangular projection");
+    let mut sketch = Sketch::new();
+    sketch.add_link(LinkKind::Project, source, &geometry).unwrap();
+    sketch.links[0].face_name = Some(former);
+    let original = sketch.clone();
+    let sk = doc
+        .add_feature(FeatureKind::Sketch { plane: PlaneRef::Custom { plane: solvecraft_geom::Plane::YZ }, sketch }, Some("Saved corner strip"))
+        .unwrap();
+    let boss = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Retained strip material"),
+        )
+        .unwrap();
+    for (width, wall) in [(80., 2.), (100., 3.)] {
+        doc.set_param("width", &width.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let loaded = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&loaded);
+        for current in [&model, &cold] {
+            let result = current.results.iter().find(|r| r.id == sk).unwrap();
+            assert!(result.error.is_none());
+            assert!(result.warning.as_deref().unwrap().contains("no longer exists; last geometry retained"));
+            let state = current.state();
+            let solved = state.sketch(sk).unwrap();
+            assert!(solved.sketch.links[0].lost);
+            assert_eq!(solved.sketch.points, original.points);
+            assert_eq!(solved.sketch.curves, original.curves);
+            let material = state.bodies.iter().find(|body| body.feature == boss).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&material.body).unwrap().volume - 12.).abs() < 1e-7,
+                "two-mm strip cannot expand to a full thirty-mm wall"
+            );
+        }
+    }
+}
+
+#[test]
+fn saved_stepped_tab_cut_piece_projection_is_lost_without_expanding_material() {
+    use solvecraft_kernel::{BoolOp, FacePaint, Paint};
+    use solvecraft_sketch::{LinkKind, LinkSource, Sketch};
+    let mut doc = Document::new("public stepped tab case");
+    doc.set_param("length", "40", Some("mm"), None).unwrap();
+    doc.set_param("wall", "2", Some("mm"), None).unwrap();
+    for (name, kind) in [
+        ("Case", json!({"type":"box","corner":[0,0,0],"length":"length","width":"30","height":"20"})),
+        ("Tab", json!({"type":"box","corner":["length",10,12],"length":"8","width":"10","height":"8"})),
+    ] {
+        let id = doc.add_feature(serde_json::from_value(kind).unwrap(), Some(name)).unwrap();
+        doc.feature_mut(id).unwrap().body_names = vec![name.into()];
+    }
+    doc.add_feature(
+        FeatureKind::Combine { target: "Case".into(), tools: vec!["Tab".into()], operation: crate::Operation::Join, keep_tools: false },
+        None,
+    )
+    .unwrap();
+    let tool = doc
+        .add_feature(
+            serde_json::from_value(
+                json!({"type":"box","corner":["wall","wall","wall"],"length":"length-2*wall","width":"30-2*wall","height":"22-wall"}),
+            )
+            .unwrap(),
+            Some("Pocket tool"),
+        )
+        .unwrap();
+    doc.feature_mut(tool).unwrap().body_names = vec!["Pocket tool".into()];
+    let cut = doc
+        .add_feature(
+            FeatureKind::Combine { target: "Case".into(), tools: vec!["Pocket tool".into()], operation: crate::Operation::Cut, keep_tools: false },
+            Some("Pocket"),
+        )
+        .unwrap();
+    let mut model = Model::new();
+    model.evaluate(&doc);
+    assert!(model.results.iter().all(|r| r.error.is_none()), "{:?}", model.results);
+    let before = model.state_before(cut);
+    // A real per-face paint control preserves the former slab construction;
+    // no historical names or geometry are fabricated.
+    let old_stock = before
+        .body("Case")
+        .unwrap()
+        .body
+        .clone()
+        .with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] }));
+    let old_cut = solvecraft_kernel::boolean(&old_stock, &before.body("Pocket tool").unwrap().body, BoolOp::Cut).unwrap().unwrap();
+    let mut old_body = ModelBody::new("Case".into(), old_cut, cut);
+    old_body.names = crate::naming::NameCell::new(Some(std::sync::Arc::new(crate::naming::NamingOrigin {
+        feature: doc.feature(cut).unwrap().clone(),
+        before,
+        depth: 1,
+        mats: vec![],
+    })));
+    let at = Vec3::new(0., 15., 1.);
+    let former = crate::naming::face_name_at_body(&old_body, at).unwrap();
+    assert_ne!(former, crate::naming::strip_piece(&former), "actual former bounded wall patch has a full piece name");
+    let index = crate::naming::face_on_body(&old_body, &former, at).unwrap().0;
+    let mut old_state = crate::ModelState::default();
+    old_state.bodies.push(old_body);
+    let plane = solvecraft_geom::Plane::YZ;
+    let resolved = crate::project::resolve_face_indices(&old_state, &plane, LinkKind::Project, "Case", &[index]).unwrap();
+    let current_state = model.state();
+    let current = current_state.body("Case").unwrap();
+    let stem = crate::naming::strip_piece(&former);
+    let current_names = crate::naming::face_names(current);
+    let merged = current_names.iter().position(|name| name == stem).unwrap();
+    assert!(current.body.face_was_coalesced(merged), "new exact generated-wall construction supplies the loss-only witness");
+    assert!(!current_names.contains(&former));
+    let mut sketch = Sketch::new();
+    sketch.add_link(LinkKind::Project, LinkSource::Face { body: "Case".into(), at }, &resolved.geom).unwrap();
+    sketch.links[0].face_name = Some(former);
+    let original = sketch.clone();
+    let captured = original.points.iter().filter(|p| p.link.is_some()).map(|p| p.pos).collect::<Vec<_>>();
+    assert_eq!(captured.len(), 4);
+    assert!(captured.iter().all(|p| (p.x == 10. || p.x == 20.) && (p.y == 0. || p.y == 20.)));
+    let sk = doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Custom { plane }, sketch }, Some("Saved wall patch")).unwrap();
+    let material = doc
+        .add_feature(
+            FeatureKind::Extrude {
+                sketch: sk,
+                profiles: crate::ProfileSel::All,
+                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
+                operation: crate::Operation::NewBody,
+                targets: vec![],
+            },
+            Some("Saved band stock"),
+        )
+        .unwrap();
+    for (length, wall) in [(40., 2.), (50., 3.)] {
+        doc.set_param("length", &length.to_string(), Some("mm"), None).unwrap();
+        doc.set_param("wall", &wall.to_string(), Some("mm"), None).unwrap();
+        model.evaluate(&doc);
+        let reopened = crate::format::read(&doc.to_json()).unwrap();
+        let mut cold = Model::new();
+        cold.evaluate(&reopened);
+        for current in [&model, &cold] {
+            let result = current.results.iter().find(|r| r.id == sk).unwrap();
+            assert!(result.error.is_none(), "{result:?}");
+            assert!(result.warning.as_deref().is_some_and(|w| w.contains("no longer exists; last geometry retained")), "{result:?}");
+            let state = current.state();
+            let saved = state.sketch(sk).unwrap();
+            assert!(saved.sketch.links[0].lost);
+            assert_eq!(saved.sketch.points, original.points);
+            assert_eq!(saved.sketch.curves, original.curves);
+            let stock = state.bodies.iter().find(|b| b.feature == material).unwrap();
+            assert!(
+                (solvecraft_kernel::measure(&stock.body).unwrap().volume - 200.).abs() < 1e-7,
+                "saved10x20 patch must not become30x20 wall; actualvolume={}, bounds={:?}, originalpoints={:?}",
+                solvecraft_kernel::measure(&stock.body).unwrap().volume,
+                stock.mesh().bounds(),
+                original.points
+            );
+            let case = state.body("Case").unwrap();
+            let expected = length * 30. * 20. + 8. * 10. * 8. - (length - 2. * wall) * (30. - 2. * wall) * (20. - wall);
+            assert!((solvecraft_kernel::measure(&case.body).unwrap().volume - expected).abs() < 1e-6);
+        }
+    }
+}

crates/doc/src/config_styles.rs

@@ -5,6 +5,12 @@ use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use solvecraft_geom::Vec3;
 
+pub(crate) fn shell_plane_family(planes: impl IntoIterator<Item = Option<solvecraft_geom::Plane>>) -> bool {
+    let mut planes = planes.into_iter();
+    let Some(Some(first)) = planes.next() else { return false };
+    first.origin.is_finite() && first.x.is_finite() && first.y.is_finite() && planes.all(|plane| plane == Some(first))
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ConfigFaceTarget {
@@ -98,6 +104,20 @@ pub fn validate_styles_json(value: &Value) -> Result<()> {
 }
 
 impl Document {
+    pub(crate) fn flat_certificate_producer_matches(&self, producer: u64, certificate: &super::FaceCertificate) -> bool {
+        use super::FaceCertificate;
+        let Some(feature) = self.feature(producer) else { return false };
+        match (certificate, &feature.kind) {
+            (FaceCertificate::Box { .. }, FeatureKind::Box { operation: crate::Operation::NewBody, .. }) => true,
+            (FaceCertificate::ExtrudeCap { sketch, .. }, FeatureKind::Extrude { sketch: current, extent, operation: crate::Operation::NewBody, .. }) => sketch == current && extent.taper.is_none(),
+            (FaceCertificate::ExtrudeSide { sketch, curve }, FeatureKind::Extrude { sketch: current, extent, operation: crate::Operation::NewBody, .. }) => {
+                sketch == current && extent.taper.is_none()
+                    && self.feature(*sketch).is_some_and(|feature| matches!(&feature.kind, FeatureKind::Sketch { sketch, .. } if sketch.curves.iter().any(|candidate| candidate.id == *curve && !candidate.construction && matches!(candidate.kind, solvecraft_sketch::CurveKind::Line { .. } | solvecraft_sketch::CurveKind::Circle { .. } | solvecraft_sketch::CurveKind::Arc { .. }))))
+            }
+            (FaceCertificate::Imported { .. }, FeatureKind::Import { .. }) => true,
+            _ => false,
+        }
+    }
     /// Certify named generator lineage; generic index-derived naming is unsupported.
     pub fn certify_config_face(&self, target: &ConfigFaceTarget) -> Result<()> {
         target.validate()?;
@@ -121,6 +141,11 @@ impl Document {
                         && self.feature(*sketch).is_some_and(|feature| matches!(&feature.kind, FeatureKind::Sketch { sketch, .. } if sketch.curves.iter().any(|candidate| candidate.id == *curve && !candidate.construction && matches!(candidate.kind, solvecraft_sketch::CurveKind::Line { .. } | solvecraft_sketch::CurveKind::Circle { .. } | solvecraft_sketch::CurveKind::Arc { .. }))))
                 }
                 (super::FaceCertificate::Imported { .. }, FeatureKind::Import { .. }) => role.strip_prefix("face:").is_some_and(|index| index.parse::<usize>().is_ok()),
+                (super::FaceCertificate::ShellPlanar { source_producer, source, inner }, FeatureKind::Shell { .. }) => {
+                    *source_producer != target.origin_feature
+                        && self.flat_certificate_producer_matches(*source_producer, source)
+                        && super::shell_certificate_role(source, *inner).is_ok_and(|expected| role == expected)
+                }
                 _ => false,
             };
             return if valid { Ok(()) } else { Err(DocError::Invalid("face certificate no longer matches its producer".into())) };
@@ -156,6 +181,17 @@ impl Document {
         if body.body.is_mesh() || body.definition_name() != target.body {
             return Err(DocError::Invalid("configured face definition does not match".into()));
         }
+        if let Some(super::FaceCertificate::ShellPlanar { source_producer, source, inner }) = &target.certificate {
+            let indices: Vec<_> = body.body.face_sources().into_iter().flatten().enumerate().filter_map(|(index, current)| {
+                matches!(current, Some(solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(producer), source: current_source, inner: current_inner, .. }) if *producer == target.origin_feature && inner == current_inner && super::flat_source_matches(source, current_source, *source_producer)).then_some(index)
+            }).collect();
+            // A shell can split one original support into several pieces. All pieces
+            // must retain the same canonical frame, not merely lie on a common plane.
+            if !shell_plane_family(indices.iter().map(|index| body.body.face_plane(*index))) {
+                return Err(DocError::Unknown("shell planar face certificate is missing or ambiguous".into()));
+            }
+            return Ok(indices);
+        }
         if matches!(target.certificate, Some(super::FaceCertificate::Box { .. } | super::FaceCertificate::ExtrudeCap { .. })) {
             let indices: Vec<_> = body
                 .body

crates/doc/src/construct.rs

@@ -105,6 +105,10 @@ pub(crate) struct Ctx<'a> {
     pub doc: &'a Document,
     pub vals: &'a BTreeMap<String, Value>,
     pub st: &'a ModelState,
+    /// How deep the plane resolution that led here already is. A plane built from model
+    /// geometry resolves its sides through the document again, so the count has to continue
+    /// across that hop; restarting it lets a plane that refers to itself recurse forever.
+    pub depth: usize,
 }
 
 fn bad(m: impl Into<String>) -> DocError {
@@ -281,7 +285,7 @@ pub(crate) fn line(ctx: &Ctx, g: &GeoRef) -> Result<(Vec3, Vec3)> {
 /// A reference as a plane.
 pub(crate) fn plane(ctx: &Ctx, g: &GeoRef) -> Result<Plane> {
     match g {
-        GeoRef::Plane { plane } => ctx.doc.resolve_plane_in(ctx.vals, plane, 0, Some(ctx.st)),
+        GeoRef::Plane { plane } => ctx.doc.resolve_plane_in(ctx.vals, plane, ctx.depth + 1, Some(ctx.st)),
         GeoRef::Face { at, name } => {
             let (b, fi, q) = face_of(ctx.st, *at, name)?;
             match kernel::face_surface(&b.body, fi) {
@@ -527,7 +531,7 @@ pub(crate) fn resolve_geo_plane(ctx: &Ctx, p: &PlaneRef) -> Result<Plane> {
             let (p, tan) = along(&path_points(ctx, path)?, t).ok_or_else(|| bad("the path has no length"))?;
             Plane::from_normal(p, tan).ok_or_else(degenerate)
         }
-        _ => ctx.doc.resolve_plane_in(ctx.vals, p, 0, Some(ctx.st)),
+        _ => ctx.doc.resolve_plane_in(ctx.vals, p, ctx.depth + 1, Some(ctx.st)),
     }
 }
 

crates/doc/src/document.rs

@@ -2132,7 +2132,7 @@ impl Document {
             | PlaneRef::AlongPath { .. }
             | PlaneRef::Perpendicular { .. } => {
                 let st = st.ok_or_else(|| DocError::Invalid("this plane is built from the model: evaluate first".into()))?;
-                crate::construct::resolve_geo_plane(&crate::construct::Ctx { doc: self, vals, st }, p)
+                crate::construct::resolve_geo_plane(&crate::construct::Ctx { doc: self, vals, st, depth }, p)
             }
         }
     }

crates/doc/src/eval.rs

@@ -924,13 +924,40 @@ fn apply_op(state: &mut ModelState, f: &Feature, tools: Vec<Body>, op: Operation
     }
     match op {
         Operation::Join => {
-            let Some(&first) = target_idx.first() else { return Ok(()) };
-            let Some(mut acc) = state.bodies.get(first).map(|b| b.body.clone()) else { return Ok(()) };
-            for t in &tools {
-                acc = kernel::boolean(&acc, t, BoolOp::Union)?.ok_or_else(|| DocError::Invalid("join produced nothing".into()))?;
-            }
-            if let Some(mb) = state.bodies.get_mut(first) {
-                *mb = ModelBody::new(mb.name.clone(), acc, mb.feature);
+            // Each tool joins every target it meets into one body, kept under the first one's
+            // name; a tool that meets none joins the first target as a separate lump. A sheet
+            // metal body keeps its own identity: only the first body met may be one.
+            let mut live: Vec<String> = target_idx.iter().filter_map(|i| state.bodies.get(*i).map(|b| b.name.clone())).collect();
+            let union = |a: &Body, b: &Body| kernel::boolean(a, b, BoolOp::Union)?.ok_or_else(|| DocError::Invalid("join produced nothing".into()));
+            for tool in &tools {
+                let mut met: Vec<String> = Vec::new();
+                for name in &live {
+                    let Some(mb) = state.body(name) else { continue };
+                    let sheet = state.sheets.iter().any(|s| &s.body == name);
+                    if mb.body.is_mesh() || (!met.is_empty() && sheet) {
+                        continue;
+                    }
+                    if mb.body.meets(tool)? {
+                        met.push(name.clone());
+                    }
+                }
+                let Some(keep) = met.first().or(live.first()).cloned() else { return Ok(()) };
+                let Some(base) = state.body(&keep).map(|b| b.body.clone()) else { continue };
+                let mut acc = union(&base, tool)?;
+                for name in met.iter().skip(1) {
+                    if let Some(b) = state.body(name) {
+                        acc = union(&acc, &b.body)?;
+                    }
+                }
+                let absorbed: std::collections::BTreeSet<String> = met.into_iter().skip(1).collect();
+                if let Some(mb) = state.bodies.iter_mut().find(|b| b.name == keep) {
+                    *mb = ModelBody::new(mb.name.clone(), acc, mb.feature);
+                }
+                state.bodies.retain(|b| !absorbed.contains(&b.name));
+                for t in state.threads.iter_mut().filter(|t| absorbed.contains(&t.body)) {
+                    t.body = keep.clone();
+                }
+                live.retain(|n| !absorbed.contains(n));
             }
         }
         Operation::Cut | Operation::Intersect => {
@@ -2883,6 +2910,7 @@ fn eval_feature(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st:
                 }
                 o => return Err(DocError::Invalid(format!("unknown shell direction `{o}` (inside, outside or both)"))),
             };
+            let nb = nb.with_shell_certificate(f.id)?;
             if let Some(slot) = st.bodies.get_mut(i) {
                 *slot = ModelBody::new(mb.name, nb, mb.feature);
             }
@@ -2905,7 +2933,7 @@ fn eval_feature(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st:
             Ok(())
         }
         FeatureKind::ConstructionAxis { def } => {
-            let (origin, dir) = crate::construct::resolve_axis(&crate::construct::Ctx { doc, vals, st }, def)?;
+            let (origin, dir) = crate::construct::resolve_axis(&crate::construct::Ctx { doc, vals, st, depth: 0 }, def)?;
             st.construct.push(crate::construct::Construct {
                 feature: f.id,
                 name: f.name.clone(),
@@ -2914,7 +2942,7 @@ fn eval_feature(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st:
             Ok(())
         }
         FeatureKind::ConstructionPoint { def } => {
-            let p = crate::construct::resolve_point(&crate::construct::Ctx { doc, vals, st }, def)?;
+            let p = crate::construct::resolve_point(&crate::construct::Ctx { doc, vals, st, depth: 0 }, def)?;
             st.construct.push(crate::construct::Construct { feature: f.id, name: f.name.clone(), geom: crate::construct::ConstructGeom::Point(p) });
             Ok(())
         }
@@ -3132,6 +3160,7 @@ fn eval_feature(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st:
                 FeatureKind::Chamfer { distance2, angle, flip, .. } => chamfer_with(vals, &mb.body, &edges, r, distance2, angle, *flip)?,
                 _ => return Err(DocError::Invalid("blend".into())),
             };
+            let nb = nb.with_preserved_planar_sources(&mb.body)?;
             let (name, feat) = (mb.name.clone(), mb.feature);
             if let Some(slot) = st.bodies.get_mut(ti) {
                 *slot = ModelBody::new(name, nb, feat);
@@ -3407,9 +3436,18 @@ pub fn world_state(doc: &Document, st: &ModelState) -> ModelState {
             let name = doc.world_body_name(st, &b.name, comp, &path);
             // A body moved in from another component keeps its place (its offset).
             let bm = doc.model_body_offset(b).map(|o| crate::mat_mul(&m, o)).unwrap_or(m);
-            let body =
-                if crate::is_identity(&bm) { b.body.clone() } else { kernel::transform_matrix(&b.body, bm).unwrap_or_else(|_| b.body.clone()) };
-            let mut placed = ModelBody::new(name, body, b.feature);
+            // Identical geometry also shares its display mesh cell with the definition.
+            // A changed placement keeps a distinct mesh, at that placement's coordinates.
+            let mut placed = if crate::is_identity(&bm) {
+                let mut placed = b.clone();
+                placed.name = name;
+                placed
+            } else {
+                let body = kernel::transform_matrix(&b.body, bm).unwrap_or_else(|_| b.body.clone());
+                ModelBody::new(name, body, b.feature)
+            };
+            // World states keep their previous display-only evaluation-key semantics.
+            placed.key = 0;
             placed.source_name = Some(b.definition_name().to_string());
             placed.source_transform = crate::mat_mul(&bm, &b.source_transform);
             placed.component = comp;
@@ -3452,6 +3490,87 @@ pub fn world_state(doc: &Document, st: &ModelState) -> ModelState {
     out
 }
 
+#[cfg(test)]
+mod world_placement_cache_tests {
+    use super::*;
+
+    #[test]
+    fn placed_real_feature_retains_names_from_its_original_feature_context() {
+        let mut doc = Document::new("authored names");
+        let component = doc.add_component(Some("Part"), 0).unwrap();
+        let feature = doc
+            .add_feature(
+                FeatureKind::Box {
+                    corner: crate::point_expr(Vec3::ZERO),
+                    length: "2 mm".into(),
+                    width: "3 mm".into(),
+                    height: "4 mm".into(),
+                    operation: crate::Operation::NewBody,
+                },
+                Some("AuthoredBox"),
+            )
+            .unwrap();
+        doc.feature_mut(feature).unwrap().component = component;
+        let matrix = crate::rigid(Vec3::new(15., -2., 8.), Vec3::ZERO, Vec3::X, 0.7);
+        doc.occurrences.iter_mut().find(|o| o.component == component).unwrap().transform = matrix;
+        let mut model = Model::default();
+        model.evaluate(&doc);
+        let state = model.state();
+        let source = &state.bodies[0];
+        assert!(source.names.origin.is_some());
+        assert!(source.mesh.get().is_none());
+        let world = world_state(&doc, &state);
+        assert!(source.mesh.get().is_some(), "source naming is prepared before adoption, as before");
+        let names = crate::naming::face_names(&world.bodies[0]);
+        assert!(Arc::ptr_eq(&names, &crate::naming::face_names(source)));
+        assert!(names.iter().all(|name| name.starts_with(&format!("F{feature}:"))));
+        let local = source.mesh();
+        let placed = world.bodies[0].mesh();
+        assert_eq!(local.tri_face, placed.tri_face);
+        let mapped: Vec<_> = local.positions.iter().map(|p| crate::apply_point(&matrix, *p)).collect();
+        assert!(mapped.iter().all(|p| placed.positions.iter().any(|q| p.dist(*q) < 1e-8)));
+        assert!(placed.positions.iter().all(|p| mapped.iter().any(|q| p.dist(*q) < 1e-8)));
+    }
+
+    #[test]
+    fn identity_shares_mesh_but_rotated_instances_keep_distinct_physical_coordinates_and_source_names() {
+        let mut doc = Document::new("placements");
+        let component = doc.add_component(Some("Part"), 0).unwrap();
+        doc.body_components.insert("Block".into(), component);
+        let matrix = crate::rigid(Vec3::new(10., 20., 0.), Vec3::ZERO, Vec3::Z, std::f64::consts::FRAC_PI_2);
+        let second = doc.add_occurrence(component, 0, matrix).unwrap();
+        let mut state = ModelState::default();
+        state.bodies.push(ModelBody::new("Block".into(), kernel::box_solid(Vec3::ZERO, Vec3::new(2., 3., 4.)).unwrap(), 1));
+        state.bodies[0].key = 1234;
+        let source = &state.bodies[0];
+        let world = world_state(&doc, &state);
+        assert_eq!(world.bodies.len(), 2);
+        let first = world.body("Block").unwrap();
+        let second_name = doc.world_body_name(&state, "Block", component, &[second]);
+        let placed = world.body(&second_name).unwrap();
+        assert!(source.mesh.get().is_some(), "persistent source names stay prepared before adoption");
+        assert!(Arc::ptr_eq(&source.mesh, &first.mesh), "unchanged geometry must retain the shared display mesh cell");
+        assert_eq!(first.key, 0);
+        assert_eq!(placed.key, 0);
+        assert!(!Arc::ptr_eq(&source.mesh, &placed.mesh), "a transformed mesh cannot be reused without mapping coordinates");
+        assert_eq!(first.source_name.as_deref(), Some("Block"));
+        assert_eq!(placed.source_name.as_deref(), Some("Block"));
+        assert_eq!(placed.source_transform, matrix);
+        assert_eq!(doc.model_body_component(placed), component);
+        let bounds = placed.mesh().bounds();
+        assert!(bounds.min.dist(Vec3::new(7., 20., 0.)) < 1e-9);
+        assert!(bounds.max.dist(Vec3::new(10., 22., 4.)) < 1e-9);
+        let names = crate::naming::face_names(source);
+        assert!(Arc::ptr_eq(&names, &crate::naming::face_names(first)));
+        assert!(Arc::ptr_eq(&names, &crate::naming::face_names(placed)));
+        let original_mesh = source.mesh();
+        assert!(Arc::ptr_eq(&original_mesh, &first.mesh()));
+        let again = world_state(&doc, &state);
+        assert!(Arc::ptr_eq(&original_mesh, &again.body("Block").unwrap().mesh()));
+        assert!(Arc::ptr_eq(&names, &crate::naming::face_names(again.body(&second_name).unwrap())));
+    }
+}
+
 #[cfg(test)]
 mod chain_tests {
     use super::*;

crates/doc/src/format.rs

@@ -36,13 +36,16 @@
 //! - 12: persistent analytic offset boundary roles and association profile references.
 //!   Older analytic chains retain their source/output correspondence and saved geometry;
 //!   migration never invents retired entities or renumbers existing curves.
+//! - 13: exact planar shell face anchors retain the shell producer, original certified
+//!   source and distinct inner/outer role. Version 12 anchors retain their identities;
+//!   migration never guesses attachments for older designs.
 
 use serde_json::Value;
 
 use crate::{DocError, Document, Result};
 
 /// The format this build writes.
-pub const FORMAT: u32 = 12;
+pub const FORMAT: u32 = 13;
 
 pub fn format_string(n: u32) -> String {
     format!("solvecraft/{n}")
@@ -55,8 +58,8 @@ pub fn version_of(s: &str) -> Option<u32> {
 
 /// JSON-level upgrades: entry `i` turns format `i + 1` into `i + 2`.
 type JsonStep = fn(&mut Value) -> Result<()>;
-const JSON_STEPS: [JsonStep; 11] =
-    [|_| Ok(()), v2_to_v3, v3_to_v4, v4_to_v5, v5_to_v6, |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(())];
+const JSON_STEPS: [JsonStep; 12] =
+    [|_| Ok(()), v2_to_v3, v3_to_v4, v4_to_v5, v5_to_v6, |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(()), |_| Ok(())];
 
 /// Old XZ references retain their exact frame, including nested offset and angled planes.
 /// New origin references use +Y; freezing the old frame avoids changing sketch coordinates,
@@ -129,21 +132,21 @@ fn v2_to_v3(v: &mut Value) -> Result<()> {
 
 /// Read a design file's JSON, upgrading older formats.
 pub fn read(s: &str) -> Result<Document> {
-    let mut v: Value = serde_json::from_str(s).map_err(|e| DocError::Invalid(format!("not a SolveCraft design: {e}")))?;
+    let mut v: Value = serde_json::from_str(s).map_err(|e| DocError::Invalid(format!("not a SolidCraft design: {e}")))?;
     let Some(obj) = v.as_object() else {
-        return Err(DocError::Invalid("not a SolveCraft design (expected a JSON object)".into()));
+        return Err(DocError::Invalid("not a SolidCraft design (expected a JSON object)".into()));
     };
     let version = match obj.get("format") {
         None => 1,
-        Some(Value::String(f)) => version_of(f).ok_or_else(|| DocError::Invalid(format!("not a SolveCraft design (format `{f}`)")))?,
-        Some(_) => return Err(DocError::Invalid("not a SolveCraft design (format is not a string)".into())),
+        Some(Value::String(f)) => version_of(f).ok_or_else(|| DocError::Invalid(format!("not a SolidCraft design (format `{f}`)")))?,
+        Some(_) => return Err(DocError::Invalid("not a SolidCraft design (format is not a string)".into())),
     };
     if version == 0 {
-        return Err(DocError::Invalid("not a SolveCraft design (format 0)".into()));
+        return Err(DocError::Invalid("not a SolidCraft design (format 0)".into()));
     }
     if version > FORMAT {
         return Err(DocError::Invalid(format!(
-            "this design was saved by a newer SolveCraft (file format {version}; this version reads formats up to {FORMAT}): update SolveCraft to open it"
+            "this design was saved by a newer SolidCraft (file format {version}; this version reads formats up to {FORMAT}): update SolidCraft to open it"
         )));
     }
     check_numbers(&v, 0)?;
@@ -153,6 +156,7 @@ pub fn read(s: &str) -> Result<Document> {
     validate_versioned_geometry(&v)?;
     validate_emboss_targets(&v)?;
     validate_freeform_offsets(&v)?;
+    validate_sketch_sizes(&v)?;
     crate::format_offsets::validate_raw(&v)?;
     let legacy_wires = validate_wires(&v, version)?;
     validate_body_transfers(&v)?;
@@ -213,6 +217,29 @@ pub fn read(s: &str) -> Result<Document> {
     Ok(d)
 }
 
+/// The caps interactive editing enforces, applied to the raw JSON so an oversized sketch is
+/// never deserialised. Every sketch in the timeline is solved when the design opens, and the
+/// solver sizes its dense matrices by the sketch, so a file with hundreds of thousands of
+/// points would ask the allocator for terabytes and abort before anything could report it.
+fn validate_sketch_sizes(value: &Value) -> Result<()> {
+    let Some(features) = value.get("features").and_then(Value::as_array) else { return Ok(()) };
+    let invalid = || DocError::Invalid("damaged design: sketch too large".into());
+    for feature in features {
+        if feature.get("type").and_then(Value::as_str) != Some("sketch") {
+            continue;
+        }
+        let Some(sketch) = feature.get("sketch") else { continue };
+        let len = |key: &str| sketch.get(key).and_then(Value::as_array).map_or(0, Vec::len);
+        if len("points") > solvecraft_sketch::MAX_POINTS
+            || len("curves") > solvecraft_sketch::MAX_CURVES
+            || len("constraints") > solvecraft_sketch::MAX_CONSTRAINTS
+        {
+            return Err(invalid());
+        }
+    }
+    Ok(())
+}
+
 /// Bound arrays before typed allocation; only old files with absent markers need migration.
 fn validate_wires(value: &Value, version: u32) -> Result<Vec<(usize, usize)>> {
     let invalid = || DocError::Invalid("damaged design: 3D curve arrays, ids or coordinate spaces are invalid".into());
@@ -923,7 +950,7 @@ mod tests {
             let error = read(&value.to_string()).unwrap_err().to_string();
             assert!(error.contains("free-form offset metadata"), "{error}");
             value["format"] = Value::from(format_string(FORMAT + 1));
-            assert!(read(&value.to_string()).unwrap_err().to_string().contains("newer SolveCraft"));
+            assert!(read(&value.to_string()).unwrap_err().to_string().contains("newer SolidCraft"));
         }
     }
 
@@ -948,7 +975,7 @@ mod tests {
             assert!(error.contains("emboss face"), "{error}");
             value["format"] = Value::from(format_string(FORMAT + 1));
             let error = read(&value.to_string()).unwrap_err().to_string();
-            assert!(error.contains("newer SolveCraft"), "{error}");
+            assert!(error.contains("newer SolidCraft"), "{error}");
         }
     }
 
@@ -1011,7 +1038,7 @@ mod tests {
         value["configs"]["columns"] = serde_json::json!([{"unknown_future_column":"Body"}]);
         value["configs"]["rules"] = serde_json::json!({"unknown_future_rule": true});
         let error = read(&value.to_string()).unwrap_err().to_string();
-        assert!(error.contains("newer SolveCraft") && error.contains("update SolveCraft"), "{error}");
+        assert!(error.contains("newer SolidCraft") && error.contains("update SolidCraft"), "{error}");
         assert!(!error.contains("unknown variant"), "format refusal precedes decoding new variants");
     }
 
@@ -1063,7 +1090,7 @@ mod tests {
         saved["format"] = Value::from(format_string(FORMAT + 1));
         saved["features"][0]["sketch"]["constraints"][0]["type"] = Value::from("future_dimension");
         let error = read(&saved.to_string()).unwrap_err().to_string();
-        assert!(error.contains("newer SolveCraft") && !error.contains("unknown variant"), "{error}");
+        assert!(error.contains("newer SolidCraft") && !error.contains("unknown variant"), "{error}");
     }
 
     #[test]
@@ -1175,7 +1202,7 @@ mod tests {
         assert!(read(&v.to_string()).is_ok(), "a file without a format is format 1");
         v["format"] = Value::from(format_string(FORMAT + 1));
         let e = read(&v.to_string()).unwrap_err().to_string();
-        assert!(e.contains("newer SolveCraft"), "{e}");
+        assert!(e.contains("newer SolidCraft"), "{e}");
         for bad in ["solvecraft/0", "acad/3", "solvecraft/-1", "solvecraft/99999999999999999999"] {
             v["format"] = Value::from(bad);
             assert!(read(&v.to_string()).is_err(), "{bad}");
@@ -1199,4 +1226,35 @@ mod tests {
         assert!(read(&v.to_string()).is_err(), "out-of-range numbers anywhere");
         assert!(read("{\"format\": 2}").is_err());
     }
+
+    /// Every sketch in the timeline is solved when the design opens, and the solver sizes its
+    /// dense matrices by the sketch. The caps interactive editing enforces have to hold for a
+    /// file too, before the arrays are deserialised.
+    #[test]
+    fn oversized_sketches_are_refused_before_typed_decoding() {
+        use solvecraft_sketch::{MAX_CONSTRAINTS, MAX_CURVES, MAX_POINTS, Sketch};
+
+        // A sketch right at the point cap, chained by coincident constraints.
+        let mut sketch = Sketch::new();
+        let mut previous = 0;
+        while sketch.points.len() < MAX_POINTS {
+            let i = sketch.add_point(solvecraft_geom::Vec2::new(0.001 * sketch.points.len() as f64, 0.0), None).unwrap();
+            sketch.add_constraint(solvecraft_sketch::ConstraintKind::Coincident { p: previous, q: i }, None).unwrap();
+            previous = i;
+        }
+        let mut doc = Document::new("big sketch");
+        doc.add_feature(crate::FeatureKind::Sketch { plane: crate::PlaneRef::Origin { name: "XY".into() }, sketch }, None).unwrap();
+        let at_cap: Value = serde_json::from_str(&doc.to_json()).unwrap();
+        assert!(read(&at_cap.to_string()).is_ok(), "a sketch at the caps must still load");
+
+        // One past each cap, grown at the JSON level: no typed array is ever built.
+        for (key, cap) in [("points", MAX_POINTS), ("constraints", MAX_CONSTRAINTS), ("curves", MAX_CURVES)] {
+            let mut value = at_cap.clone();
+            let slot = &mut value["features"][0]["sketch"][key];
+            let first = slot.as_array().and_then(|a| a.first()).cloned().unwrap_or(Value::Null);
+            *slot = Value::Array(vec![first; cap + 1]);
+            let error = read(&value.to_string()).unwrap_err().to_string();
+            assert!(error.contains("sketch too large"), "{key}: {error}");
+        }
+    }
 }

crates/doc/src/format_offsets.rs

@@ -369,7 +369,7 @@ mod tests {
             damaged["features"][1]["profiles"]["associations"] = associations;
             assert!(validate_raw(&damaged).is_err());
             damaged["format"] = json!(crate::format::format_string(crate::format::FORMAT + 1));
-            assert!(crate::format::read(&damaged.to_string()).unwrap_err().to_string().contains("newer SolveCraft"));
+            assert!(crate::format::read(&damaged.to_string()).unwrap_err().to_string().contains("newer SolidCraft"));
         }
         // Absent metadata preserves the historical one-to-one chain representation.
         let mut legacy = fixture();

crates/doc/src/project.rs

@@ -141,15 +141,13 @@ fn resolve_uncached(
                 LinkKind::Intersect => section(plane, &mesh, Some(f)),
                 _ => {
                     let mut g = Vec::new();
-                    for e in order::face_edges(&mesh, f, plane)? {
-                        if mesh.seams.get(e).copied().unwrap_or(false) {
-                            continue;
-                        }
+                    let target = st.bodies.get(bi).ok_or_else(|| lost("the projection body"))?;
+                    for e in projection_face_edges(target, &mesh, f, plane)? {
                         if let Some(pts) = mesh.edges.get(e) {
                             g.extend(fit_world(plane, pts));
                         }
                     }
-                    g
+                    if certified_planar_construction(target, f as usize) { merge_family_lines(g)? } else { g }
                 }
             }
         }
@@ -293,15 +291,13 @@ fn resolve_named_face(st: &ModelState, plane: &Plane, kind: LinkKind, body: &str
         section(plane, &mesh, Some(index))
     } else {
         let mut geom = Vec::new();
-        for edge in order::face_edges(&mesh, index, plane)? {
-            if mesh.seams.get(edge).copied().unwrap_or(false) {
-                continue;
-            }
+        for edge in projection_face_edges(target, &mesh, index, plane)? {
             if let Some(points) = mesh.edges.get(edge) {
                 geom.extend(fit_world(plane, points));
             }
         }
-        merge_split_circles(geom)
+        let geom = merge_split_circles(geom);
+        if certified_planar_construction(target, index as usize) { merge_family_lines(geom)? } else { geom }
     };
     if geom.is_empty() {
         return Err(DocError::Invalid("named face projects to nothing on this sketch plane".into()));
@@ -309,6 +305,29 @@ fn resolve_named_face(st: &ModelState, plane: &Plane, kind: LinkKind, body: &str
     Ok(Resolved { geom, wires: Vec::new(), source: LinkSource::Face { body: body.into(), at }, moved: false, face_index })
 }
 
+fn projection_face_edges(body: &crate::ModelBody, mesh: &Mesh, index: u32, plane: &Plane) -> Result<Vec<usize>> {
+    let shell_plane = body
+        .body
+        .face_sources()
+        .and_then(|sources| sources.get(index as usize))
+        .is_some_and(|source| matches!(source, Some(solvecraft_kernel::FaceSource::ShellPlanar { .. })));
+    if shell_plane { order::raw_face_edges(mesh, index, plane) } else { order::face_edges(mesh, index, plane) }
+}
+
+fn certified_planar_construction(body: &crate::ModelBody, index: usize) -> bool {
+    body.body.face_sources().and_then(|sources| sources.get(index)).is_some_and(|source| {
+        matches!(
+            source,
+            Some(
+                solvecraft_kernel::FaceSource::ShellPlanar { producer: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::Box { producer: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::CertifiedExtrudeSide { plane: Some(_), .. }
+                    | solvecraft_kernel::FaceSource::CertifiedExtrudeCap { .. }
+            )
+        )
+    })
+}
+
 pub fn resolve_anchored_face(doc: &Document, st: &ModelState, plane: &Plane, kind: LinkKind, anchor: &crate::FaceAnchor) -> Result<Resolved> {
     let body = st.body(&anchor.target.body).ok_or_else(|| lost("anchored projection body"))?;
     let indices = doc.configuration_face_indices(body, &anchor.target)?;
@@ -329,21 +348,31 @@ pub fn resolve_face_indices(st: &ModelState, plane: &Plane, kind: LinkKind, body
     }
     let selected: std::collections::BTreeSet<_> = indices.iter().copied().collect();
     let mut geometry = Vec::new();
-    for index in indices {
-        let index = u32::try_from(*index).map_err(|_| DocError::Invalid("anchored face index exceeds format bounds".into()))?;
-        if kind == LinkKind::Intersect {
+    if kind == LinkKind::Intersect {
+        for index in indices {
+            let index = u32::try_from(*index).map_err(|_| DocError::Invalid("anchored face index exceeds format bounds".into()))?;
             geometry.extend(section(plane, &mesh, Some(index)));
+        }
+    } else {
+        let edges = if let [index] = indices {
+            projection_face_edges(
+                body,
+                &mesh,
+                u32::try_from(*index).map_err(|_| DocError::Invalid("face index exceeds format bounds".into()))?,
+                plane,
+            )?
         } else {
-            for edge in order::face_edges(&mesh, index, plane)? {
-                if mesh.seams.get(edge).copied().unwrap_or(false) {
-                    continue;
-                }
-                if let Some(points) = mesh.edges.get(edge) {
-                    geometry.extend(fit_world(plane, points));
-                }
+            order::family_edges(&mesh, &selected, plane)?
+        };
+        for edge in edges {
+            if let Some(points) = mesh.edges.get(edge) {
+                geometry.extend(fit_world(plane, points));
             }
         }
     }
+    if kind != LinkKind::Intersect && (indices.len() > 1 || indices.first().is_some_and(|index| certified_planar_construction(body, *index))) {
+        geometry = merge_family_lines(geometry)?;
+    }
     let point = mesh
         .triangles
         .iter()
@@ -373,6 +402,75 @@ pub fn refresh_face_anchor_links(
     refresh_links_in(doc, vals, st, plane, sk, Some(anchor))
 }
 
+/// Remove degree-two straight stations introduced by coplanar face subdivision.
+/// The walk uses endpoint incidence; geometric sorting does not imply adjacency.
+fn merge_family_lines(geom: Vec<LinkGeom>) -> Result<Vec<LinkGeom>> {
+    if geom.len().saturating_mul(geom.len()).saturating_mul(3) > 10_000_000 {
+        return Err(DocError::Invalid("face family straight-boundary work limit exceeded".into()));
+    }
+    let ends = |curve: &LinkGeom| match curve {
+        LinkGeom::Line(a, b) | LinkGeom::Arc { a, b, .. } | LinkGeom::Conic { a, b, .. } => Some((*a, *b)),
+        LinkGeom::Spline { pts, periodic: false, .. } => pts.first().zip(pts.last()).map(|(a, b)| (*a, *b)),
+        _ => None,
+    };
+    let scale = geom.iter().filter_map(&ends).flat_map(|(a, b)| [a.len(), b.len()]).fold(1., f64::max);
+    let tol = scale * f64::EPSILON * 512.;
+    let mut used = vec![false; geom.len()];
+    let mut result = Vec::new();
+    for (index, curve) in geom.iter().enumerate() {
+        if used.get(index).copied().unwrap_or(true) {
+            continue;
+        }
+        if let Some(slot) = used.get_mut(index) {
+            *slot = true;
+        }
+        let LinkGeom::Line(a, b) = curve else {
+            result.push(curve.clone());
+            continue;
+        };
+        let mut endpoints = [*a, *b];
+        for side in 0..2 {
+            let mut current = index;
+            for _ in 0..geom.len() {
+                let Some(point) = endpoints.get(side).copied() else { break };
+                let mut incidence = geom
+                    .iter()
+                    .enumerate()
+                    .filter_map(|(other, curve)| ends(curve).filter(|(a, b)| a.dist(point) <= tol || b.dist(point) <= tol).map(|_| other));
+                let (Some(one), Some(two), None) = (incidence.next(), incidence.next(), incidence.next()) else { break };
+                let other = if one == current {
+                    two
+                } else if two == current {
+                    one
+                } else {
+                    break;
+                };
+                if used.get(other).copied().unwrap_or(true) {
+                    break;
+                }
+                let Some(LinkGeom::Line(a, b)) = geom.get(other) else { break };
+                let next = if a.dist(point) <= tol { *b } else { *a };
+                let Some(opposite) = endpoints.get(1 - side).copied() else { break };
+                let (Some(incoming), Some(outgoing)) = ((point - opposite).normalized(), (next - point).normalized()) else { break };
+                if incoming.dot(outgoing) <= 0. || incoming.cross(outgoing).abs() > f64::EPSILON * 512. {
+                    break;
+                }
+                if let Some(slot) = used.get_mut(other) {
+                    *slot = true;
+                }
+                if let Some(slot) = endpoints.get_mut(side) {
+                    *slot = next;
+                }
+                current = other;
+            }
+        }
+        if let (Some(a), Some(b)) = (endpoints.first(), endpoints.get(1)) {
+            result.push(LinkGeom::Line(*a, *b));
+        }
+    }
+    Ok(result)
+}
+
 pub fn refresh_links(doc: &Document, vals: &BTreeMap<String, Value>, st: &ModelState, plane: &Plane, sk: &mut Sketch) -> Vec<String> {
     refresh_links_in(doc, vals, st, plane, sk, None)
 }
@@ -394,6 +492,18 @@ fn refresh_links_in(
             && let (Some(name), LinkSource::Face { body, at }) = (&l.face_name, &mut source)
         {
             if let Some((index, p, split)) = st.body(body).and_then(|target| crate::naming::face_on_body(target, name, *at)) {
+                let stem = crate::naming::strip_piece(name);
+                let removed_piece = split
+                    && name != stem
+                    && st.body(body).is_some_and(|target| {
+                        (certified_planar_construction(target, index) || target.body.face_was_coalesced(index))
+                            && crate::naming::face_names(target).get(index).is_some_and(|current| current == stem)
+                    });
+                if removed_piece {
+                    sk.set_link_lost(&l.id, true);
+                    warn.push(format!("projected face piece `{name}` no longer exists; last geometry retained"));
+                    continue;
+                }
                 *at = p;
                 named_face = Some((body.clone(), index, p));
                 if split {

crates/doc/src/project_order.rs

@@ -10,6 +10,36 @@ use crate::{DocError, Result};
 type Key = (i64, i64, i64);
 
 pub(super) fn face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<usize>> {
+    let edges = mesh.face_edges(face).into_iter().filter(|e| !mesh.seams.get(*e).copied().unwrap_or(false)).collect();
+    boundary_edges(mesh, edges, plane)
+}
+
+/// Full boundary of an explicitly selected analytic planar piece. Display seams
+/// hide subdivisions for picking, but cannot remove a raw piece's closing edge.
+pub(super) fn raw_face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<usize>> {
+    boundary_edges(mesh, mesh.face_edges(face), plane)
+}
+
+/// Exterior of an exact current face family. Shared topological edges are internal;
+/// geometric proximity never merges distinct edges or chooses a different face.
+pub(super) fn family_edges(mesh: &Mesh, selected: &std::collections::BTreeSet<usize>, plane: &Plane) -> Result<Vec<usize>> {
+    let mut edges = Vec::new();
+    for (index, faces) in mesh.edge_faces.iter().enumerate() {
+        let count = faces.iter().filter(|face| selected.contains(&(**face as usize))).count();
+        if count == 0 {
+            continue;
+        }
+        if faces.len() > 2 || (faces.len() == 2 && faces.first() == faces.get(1)) {
+            return Err(DocError::Invalid("face family has ambiguous edge adjacency".into()));
+        }
+        if count == 1 && !mesh.seams.get(index).copied().unwrap_or(false) {
+            edges.push(index);
+        }
+    }
+    boundary_edges(mesh, edges, plane)
+}
+
+fn boundary_edges(mesh: &Mesh, mut edges: Vec<usize>, plane: &Plane) -> Result<Vec<usize>> {
     let bounds = mesh.bounds();
     let origin = bounds.min;
     let local_origin = plane.to_local(origin);
@@ -21,7 +51,6 @@ pub(super) fn face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<us
         let p = p - origin;
         ((p.x / tol).round() as i64, (p.y / tol).round() as i64, (p.z / tol).round() as i64)
     };
-    let mut edges: Vec<usize> = mesh.face_edges(face).into_iter().filter(|e| !mesh.seams.get(*e).copied().unwrap_or(false)).collect();
     if edges.iter().any(|e| !mesh.edges.get(*e).is_some_and(|p| p.len() >= 2 && p.iter().all(|p| p.is_finite()))) {
         return Err(DocError::Invalid("face projection has an invalid boundary edge".into()));
     }
@@ -119,6 +148,79 @@ pub(super) fn face_edges(mesh: &Mesh, face: u32, plane: &Plane) -> Result<Vec<us
 mod tests {
     use super::*;
 
+    #[test]
+    fn face_family_omits_only_exact_shared_topological_edges() {
+        let mut mesh = Mesh::default();
+        for (a, b, faces) in [
+            ((0., 0.), (2., 0.), vec![0]),
+            ((2., 0.), (2., 1.), vec![0]),
+            ((2., 1.), (0., 1.), vec![0, 1]),
+            ((0., 1.), (0., 0.), vec![0]),
+            ((2., 1.), (2., 2.), vec![1]),
+            ((2., 2.), (0., 2.), vec![1]),
+            ((0., 2.), (0., 1.), vec![1]),
+        ] {
+            mesh.edges.push(vec![Vec3::new(a.0, a.1, 0.), Vec3::new(b.0, b.1, 0.)]);
+            mesh.positions.extend([Vec3::new(a.0, a.1, 0.), Vec3::new(b.0, b.1, 0.)]);
+            mesh.edge_faces.push(faces);
+        }
+        let selected = [0, 1].into_iter().collect();
+        let edges = family_edges(&mesh, &selected, &Plane::XY).unwrap();
+        assert_eq!(edges.len(), 6);
+        assert!(!edges.contains(&2));
+        let geometry: Vec<_> = edges.iter().flat_map(|edge| super::super::fit_world(&Plane::XY, &mesh.edges[*edge])).collect();
+        assert_eq!(super::super::merge_family_lines(geometry).unwrap().len(), 4);
+        assert_eq!(family_edges(&mesh, &[0].into_iter().collect(), &Plane::XY).unwrap().len(), 4);
+        mesh.edge_faces[2] = vec![0, 1, 2];
+        assert!(family_edges(&mesh, &selected, &Plane::XY).is_err());
+        mesh.edge_faces[2] = vec![0, 0];
+        assert!(family_edges(&mesh, &selected, &Plane::XY).is_err());
+    }
+
+    #[test]
+    fn distinct_crossing_boundaries_are_not_geometrically_cancelled() {
+        let mut mesh = Mesh::default();
+        for (face, x, y) in [(0, 0., 0.), (1, 1., 1.)] {
+            let corners = [Vec3::new(x, y, 0.), Vec3::new(x + 2., y, 0.), Vec3::new(x + 2., y + 2., 0.), Vec3::new(x, y + 2., 0.)];
+            mesh.positions.extend(corners);
+            for i in 0..4 {
+                mesh.edges.push(vec![corners[i], corners[(i + 1) % 4]]);
+                mesh.edge_faces.push(vec![face]);
+            }
+        }
+        let edges = family_edges(&mesh, &[0, 1].into_iter().collect(), &Plane::XY).unwrap();
+        assert_eq!(edges.len(), 8);
+        let geom: Vec<_> = edges.iter().flat_map(|edge| super::super::fit_world(&Plane::XY, &mesh.edges[*edge])).collect();
+        let mut sk = solvecraft_sketch::Sketch::new();
+        let link = sk
+            .add_link(solvecraft_sketch::LinkKind::Project, solvecraft_sketch::LinkSource::Face { body: "ambiguous".into(), at: Vec3::ZERO }, &geom)
+            .unwrap();
+        assert!(sk.update_link(&link, &geom).is_err());
+    }
+
+    #[test]
+    fn family_line_normalization_preserves_corners_arcs_branches_and_retracing() {
+        use solvecraft_geom::Vec2;
+        use solvecraft_sketch::LinkGeom;
+        let line = |a, b| LinkGeom::Line(Vec2::new(a, 0.), Vec2::new(b, 0.));
+        assert_eq!(super::super::merge_family_lines(vec![line(0., 1.), line(2., 1.)]).unwrap(), vec![line(0., 2.)]);
+        for geometry in [
+            vec![line(0., 1.), line(1., 0.5)],
+            vec![line(0., 1.), LinkGeom::Line(Vec2::new(1., 0.), Vec2::new(2., 1e-8))],
+            vec![line(0., 1.), line(1., 2.), LinkGeom::Line(Vec2::new(1., 0.), Vec2::new(1., 1.))],
+            vec![line(0., 1.), line(1., 2.), LinkGeom::Conic { a: Vec2::new(1., 0.), apex: Vec2::new(2., 1.), b: Vec2::new(3., 1.), rho: 0.5 }],
+            vec![
+                line(0., 1.),
+                line(1., 2.),
+                LinkGeom::Spline { pts: vec![Vec2::new(1., 0.), Vec2::new(2., 1.), Vec2::new(3., 1.)], control: false, degree: 2, periodic: false },
+            ],
+            vec![line(0., 1.), LinkGeom::Arc { c: Vec2::new(1., 1.), a: Vec2::new(1., 0.), b: Vec2::new(2., 1.) }],
+            vec![line(0., 1.), line(1.00001, 2.)],
+        ] {
+            assert_eq!(super::super::merge_family_lines(geometry.clone()).unwrap(), geometry);
+        }
+    }
+
     fn rectangles() -> Mesh {
         let mut mesh = Mesh::default();
         for (x, y) in [(40.0, 30.0), (38.0, 28.0), (4.0, 2.0)] {

crates/doc/src/tests.rs

@@ -367,3 +367,36 @@ fn timeline_clones_share_meshes_even_when_cloned_before_tessellation() {
     assert!(std::sync::Arc::ptr_eq(&a.mesh(), &b.mesh()));
     assert!(!a.mesh().triangles.is_empty());
 }
+
+/// A construction plane that is its own side resolves through the model and back into the
+/// document. The depth count has to survive that hop, or the recursion overflows the stack and
+/// aborts the process, which no panic guard can intercept.
+#[test]
+fn self_referencing_construction_planes_are_errors() {
+    let selfref = |name: &str| Box::new(construct::GeoRef::Plane { plane: PlaneRef::Construction { name: name.into() } });
+    let xz = || Box::new(construct::GeoRef::Plane { plane: PlaneRef::Origin { name: "XZ".into() } });
+
+    // Directly its own first side.
+    let mut doc = Document::new("selfplane");
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P1"), b: xz() } }, Some("P1")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a plane that is its own side must report an error: {:?}", m.results);
+
+    // Two planes that are each other's side.
+    let mut doc = Document::new("twoplanes");
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P2"), b: xz() } }, Some("P1")).unwrap();
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Midplane { a: selfref("P1"), b: xz() } }, Some("P2")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a two-plane cycle must report an error: {:?}", m.results);
+
+    // A perpendicular plane whose base is itself, and a sketch placed on it.
+    let mut doc = Document::new("perpplane");
+    let line = Box::new(construct::GeoRef::World { axis: "X".into() });
+    doc.add_feature(FeatureKind::ConstructionPlane { plane: PlaneRef::Perpendicular { plane: selfref("P1"), line } }, Some("P1")).unwrap();
+    doc.add_feature(FeatureKind::Sketch { plane: PlaneRef::Construction { name: "P1".into() }, sketch: Sketch::new() }, Some("Sketch1")).unwrap();
+    let mut m = Model::new();
+    m.evaluate(&doc);
+    assert!(m.results.iter().any(|r| r.error.is_some()), "a cyclic perpendicular plane must report an error: {:?}", m.results);
+}

crates/engine/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-engine"
-description = "SolveCraft engine: the session, the command registry (everything is a command), undo/redo and selection"
+description = "SolidCraft engine: the session, the command registry (everything is a command), undo/redo and selection"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/engine/src/cmd/component_clone.rs

@@ -314,7 +314,7 @@ pub(super) fn paste(
         let base = entered.as_ref().and_then(|st| st.body(&body.name)).or_else(|| before.as_ref().and_then(|st| st.body(&body.name))).unwrap_or(body);
         let baseline_component = source.model_body_component(base);
         let geometry = solvecraft_kernel::transform_matrix(&base.body, offset)?;
-        let step = solvecraft_kernel::step_export(&[&geometry], "SolveCraft independent reassigned body")?;
+        let step = solvecraft_kernel::step_export(&[&geometry], "SolidCraft independent reassigned body")?;
         let new_name = unique(&body.name, &mut used);
         bodies.insert(body.name.clone(), new_name.clone());
         let feature_name = unique(&format!("{} Base", body.name), &mut used);

crates/engine/src/cmd/face_tests.rs

@@ -10,7 +10,7 @@ fn run(s: &mut Session, command: &str, params: Value) -> Value {
 }
 fn check(s: &mut Session, want: f64, hole: bool, height: f64) {
     s.refresh();
-    assert!(s.model.results.iter().all(|result| result.error.is_none()));
+    assert!(s.model.results.iter().all(|result| result.error.is_none() && result.warning.is_none()), "{:?}", s.model.results);
     let state = s.model.state();
     let got: f64 = state.bodies.iter().map(|b| solvecraft_kernel::measure(&b.body).unwrap().volume).sum();
     // Legacy linked outlines fit tessellated curves; enforce the existing 1e-4 material envelope.
@@ -22,10 +22,10 @@ fn check(s: &mut Session, want: f64, hole: bool, height: f64) {
     }
 }
 #[test]
-fn generated_face_profiles_keep_certified_and_internal_legacy_links_live_after_edit_and_reopen() {
+fn generated_face_profiles_keep_exact_links_live_after_edit_and_reopen() {
     for hole in [false, true] {
         let mut s = Session::default();
-        run(&mut s, "solid.box", json!({"length":40,"width":30,"height":20,"name":"Base"}));
+        let base = run(&mut s, "solid.box", json!({"length":40,"width":30,"height":20,"name":"Base"}))["feature"].as_u64().unwrap();
         if hole {
             run(&mut s, "sketch.create", json!({"plane":"XY"}));
             run(&mut s, "sketch.circle.center", json!({"center":[20,15],"radius":5}));
@@ -37,9 +37,11 @@ fn generated_face_profiles_keep_certified_and_internal_legacy_links_live_after_e
         let FeatureKind::Extrude { sketch, .. } = pad.kind else { panic!("extrude") };
         let generated = s.doc.feature(sketch).unwrap();
         let FeatureKind::Sketch { plane, sketch: profile } = &generated.kind else { panic!("sketch") };
-        assert!(matches!(plane,PlaneRef::Face{anchor,..} if anchor.is_some()!=hole));
+        let PlaneRef::Face { anchor: Some(anchor), .. } = plane else { panic!("the original Box cap remains exact after a hole cut") };
+        assert_eq!(anchor.target.origin_feature, base);
+        assert!(matches!(anchor.target.certificate, Some(solvecraft_doc::config::FaceCertificate::Box { axis: 2, high: true })));
         assert!(!profile.links.is_empty());
-        assert!(profile.links.iter().all(|link| link.auto_face != hole && !link.lost));
+        assert!(profile.links.iter().all(|link| link.auto_face && !link.lost));
         let area = 1200.0 - if hole { 25.0 * PI } else { 0.0 };
         check(&mut s, area * 30.0, hole, 30.0);
         run(&mut s, "timeline.edit", json!({"feature":"Base","set":{"height":"25","length":"50"}}));
@@ -48,7 +50,7 @@ fn generated_face_profiles_keep_certified_and_internal_legacy_links_live_after_e
         let edited = s.model.state();
         assert!(edited.bodies.iter().any(|body| body.body.contains(Vec3::new(49.0, 5.0, 34.0))));
         assert!(!edited.bodies.iter().any(|body| body.body.contains(Vec3::new(51.0, 5.0, 34.0))));
-        assert!(edited.sketch(sketch).unwrap().sketch.links.iter().all(|link| !link.lost));
+        assert!(edited.sketch(sketch).unwrap().sketch.links.iter().all(|link| link.auto_face && !link.lost));
         let solved = edited.sketch(sketch).unwrap().plane;
         assert!((solved.origin.z - 25.0).abs() < 1e-6);
         let before = s.model.state();

crates/engine/src/cmd/file.rs

@@ -51,11 +51,7 @@ fn path_arg<'a>(p: &'a Value, cmd: &str) -> Result<&'a str> {
 
 /// Read a STEP file as an Import feature.
 fn read_step(path: &str) -> Result<solvecraft_io::StepFeature> {
-    let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    if meta > solvecraft_io::MAX_STEP_BYTES as u64 {
-        return Err(EngineError::Other(format!("{path}: file too large")));
-    }
-    let bytes = solvecraft_io::vfs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let bytes = solvecraft_io::vfs::read(path, solvecraft_io::MAX_STEP_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
     solvecraft_io::step_import_feature(&bytes, path).map_err(|e| EngineError::Other(format!("{path}: {e}")))
 }
 
@@ -80,11 +76,7 @@ fn add_step(s: &mut Session, path: &str, name: Option<&str>) -> Result<Value> {
 
 /// Add a MeshImport feature for a 3MF or STL file.
 fn add_mesh(s: &mut Session, path: &str, name: Option<&str>) -> Result<Value> {
-    let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    if meta > solvecraft_io::MAX_3MF_BYTES as u64 {
-        return Err(EngineError::Other(format!("{path}: file too large")));
-    }
-    let bytes = solvecraft_io::vfs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let bytes = solvecraft_io::vfs::read(path, solvecraft_io::MAX_3MF_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
     let mf = solvecraft_io::mesh_import_feature(&bytes, path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
     let fname = name.filter(|n| !n.trim().is_empty()).unwrap_or(&mf.name).to_string();
     let id = s.doc_mut().add_feature(mf.kind, Some(&fname))?;
@@ -132,11 +124,7 @@ fn open(s: &mut Session, p: &Value) -> Result<Value> {
         let errors = s.model.results.iter().filter(|r| r.error.is_some()).count();
         return Ok(json!({"path": path, "features": s.doc.features.len(), "errors": errors, "bodies": r["bodies"], "warnings": r["warnings"]}));
     }
-    let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    if meta as usize > solvecraft_io::MAX_DESIGN_BYTES {
-        return Err(EngineError::Other(format!("{path}: file too large")));
-    }
-    let bytes = solvecraft_io::vfs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let bytes = solvecraft_io::vfs::read(path, solvecraft_io::MAX_DESIGN_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
     let doc = solvecraft_io::read_design(&bytes)?;
     *s = Session::new(doc);
     s.path = Some(path.to_string());

crates/engine/src/cmd/parameters.rs

@@ -226,16 +226,15 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"format": format, "path": path, "text": text}))
 }
 
+/// Largest parameter table we read from a file.
+const MAX_PARAMETER_BYTES: usize = 16 << 20;
+
 fn import(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "parameters.import";
     let text = match (str_(p, "text"), str_(p, "path")) {
         (Some(t), _) => t.to_string(),
         (None, Some(path)) => {
-            let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-            if meta > 16 << 20 {
-                return Err(bad(cmd, "file too large"));
-            }
-            solvecraft_io::vfs::read_to_string(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?
+            solvecraft_io::vfs::read_to_string(path, MAX_PARAMETER_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?
         }
         _ => return Err(bad(cmd, "give `text` or `path`")),
     };

crates/engine/src/cmd/sketch.rs

@@ -114,7 +114,7 @@ pub static COMMANDS: &[CommandSpec] = &[
         .at("SKETCH", "CONSTRAINTS")
         .icon("c_coincident")
         .enabled(in_sketch)
-        .params("a: point, b: point or curve"),
+        .params("a, b: points, a point and a curve, or two distinct lines (joins their closest endpoints)"),
     CommandSpec::new("sketch.constraint.tangent", "Tangent", c_tangent)
         .at("SKETCH", "CONSTRAINTS")
         .icon("c_tangent")
@@ -1235,13 +1235,17 @@ fn c_coincident(s: &mut Session, p: &Value) -> Result<Value> {
     // Already tied (e.g. connected when it was drawn there): nothing to add.
     let sk = s.doc.sketch(target_sketch(s, p, cmd)?)?;
     let pt = |k: &str| p.get(k).and_then(Value::as_str).and_then(|r| sk.resolve_point(r));
-    if let (Some(a), Some(b)) = (pt("a"), pt("b"))
+    let line_points = coincident_line_points(sk, p, cmd)?;
+    if let Some((a, b)) = line_points.or_else(|| pt("a").zip(pt("b")))
         && let Some(c) = sk.constraints.iter().find(|c| matches!(c.kind, ConstraintKind::Coincident { p, q } if (p, q) == (a, b) || (p, q) == (b, a)))
     {
         let rep = solve(&mut sk.clone());
         return Ok(json!({"constraint": c.id, "existing": true, "sketch": {"solved": rep.ok(), "dof": rep.dof}}));
     }
     constrain(s, p, cmd, |sk| {
+        if let Some((a, b)) = line_points {
+            return Ok(ConstraintKind::Coincident { p: a, q: b });
+        }
         let aref = p.get("a").and_then(Value::as_str).unwrap_or_default();
         let bref = p.get("b").and_then(Value::as_str).ok_or_else(|| bad(cmd, "`b` must be a point or curve"))?;
         // A curve picked first and a point second: the point goes onto the curve.
@@ -1257,6 +1261,37 @@ fn c_coincident(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+/// Four endpoint pairs, ordered independently of pick order when distances tie.
+fn coincident_line_points(sk: &Sketch, p: &Value, cmd: &str) -> Result<Option<(usize, usize)>> {
+    let curve = |key: &str| p.get(key).and_then(Value::as_str).and_then(|id| sk.curve_index(id));
+    let (Some(a), Some(b)) = (curve("a"), curve("b")) else { return Ok(None) };
+    if a == b {
+        return Err(bad(cmd, "choose two distinct lines"));
+    }
+    let ends = |i: usize| match sk.curves.get(i).map(|curve| &curve.kind) {
+        Some(CurveKind::Line { a, b }) => Some([*a, *b]),
+        _ => None,
+    };
+    let (Some(first), Some(second)) = (ends(a), ends(b)) else {
+        return Err(bad(cmd, "two curves must both be straight lines; otherwise choose a point and a curve"));
+    };
+    let mut best: Option<(f64, usize, usize)> = None;
+    for a in first {
+        for b in second {
+            let (Some(pa), Some(pb)) = (sk.point(a), sk.point(b)) else { return Err(bad(cmd, "line endpoint is missing")) };
+            let candidate = (pa.dist(pb), a.min(b), a.max(b));
+            if best.is_none_or(|old| candidate < old) {
+                best = Some(candidate);
+            }
+        }
+    }
+    let (_, a, b) = best.ok_or_else(|| bad(cmd, "line endpoints are missing"))?;
+    if a == b {
+        return Err(bad(cmd, "the lines already share an endpoint"));
+    }
+    Ok(Some((a, b)))
+}
+
 fn two_curves(sk: &Sketch, p: &Value, cmd: &str) -> Result<(usize, usize)> {
     Ok((curve_ref(sk, p.get("a"), cmd, "a")?, curve_ref(sk, p.get("b"), cmd, "b")?))
 }
@@ -1703,14 +1738,18 @@ fn construction(s: &mut Session, p: &Value) -> Result<Value> {
         let cs: Vec<usize> =
             ids.iter().map(|id| sk.curve_index(id).ok_or_else(|| bad(cmd, format!("unknown curve `{id}`")))).collect::<Result<_>>()?;
         // The selection switches together (a slot or polygon as a whole): to construction
-        // unless all of it already is. Projected curves may switch too.
+        // unless all of it already is. Projected curves may switch too. A centerline that
+        // becomes construction stops being a centerline (one line type at a time).
         let to = want.unwrap_or_else(|| !cs.iter().all(|c| sk.curves.get(*c).is_some_and(|c| c.construction)));
         let mut n = 0;
         for c in cs {
             if let Some(cu) = sk.curves.get_mut(c)
-                && cu.construction != to
+                && (cu.construction != to || to && cu.centerline)
             {
                 cu.construction = to;
+                if to {
+                    cu.centerline = false;
+                }
                 n += 1;
             }
         }

crates/engine/src/cmd/sketch_canvas.rs

@@ -31,11 +31,7 @@ fn image_bytes(p: &Value, cmd: &str) -> Result<Vec<u8>> {
         base64_decode(d).ok_or_else(|| bad(cmd, "`data` is not base64"))?
     } else {
         let path = str_(p, "path").filter(|x| !x.trim().is_empty() && x.len() < 4096).ok_or_else(|| bad(cmd, "give `path` or `data`"))?;
-        let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-        if meta as usize > MAX_CANVAS_BYTES {
-            return Err(bad(cmd, "the image is too large"));
-        }
-        solvecraft_io::vfs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?
+        solvecraft_io::vfs::read(path, MAX_CANVAS_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?
     };
     if b.len() > MAX_CANVAS_BYTES {
         return Err(bad(cmd, "the image is too large"));

crates/engine/src/cmd/sketch_face_tests.rs

@@ -399,3 +399,184 @@ fn angled_attachment_tracks_source_plane_and_reopens() {
     let reopened = Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap());
     assert_eq!(reopened.model.state().sketch(id).unwrap().plane, placed);
 }
+
+#[test]
+fn rounded_enclosure_shell_side_and_floor_attach_through_width_wall_and_reopen() {
+    use solvecraft_doc::{FeatureKind, config::FaceCertificate, face_anchor::plane_face_anchor};
+    let mut s = Session::default();
+    for (name, expression) in [("width", "80 mm"), ("depth", "60 mm"), ("height", "30 mm"), ("wall", "2 mm")] {
+        run(&mut s, "parameters.add", json!({"name":name,"expression":expression}));
+    }
+    let base = run(&mut s, "sketch.create", json!({"plane":"XY","name":"Outline"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.rectangle.center", json!({"center":[0,0],"corner":[40,30]}));
+    run(&mut s, "sketch.dimension", json!({"entities":["l1"],"value":"width"}));
+    run(&mut s, "sketch.dimension", json!({"entities":["l2"],"value":"depth"}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"sketch":base,"distance":"height","operation":"new","body_name":"Case"}));
+    run(&mut s, "solid.fillet", json!({"body":"Case","edges":[[40,30,15],[-40,30,15],[-40,-30,15],[40,-30,15]],"radius":6}));
+    run(&mut s, "solid.shell", json!({"body":"Case","faces":[[0,0,30]],"thickness":"wall","name":"Hollow"}));
+    assert_eq!(s.model.state().body("Case").unwrap().body.face_count(), 19, "rounded Shell has no separate base strips");
+    let pick = |s: &Session, normal: Vec3, point: Vec3| {
+        let state = s.model.state();
+        let body = state.body("Case").unwrap();
+        let face = body
+            .body
+            .faces(0.01)
+            .unwrap()
+            .into_iter()
+            .find(|f| f.plane_normal.is_some_and(|n| n.dot(normal) > 0.999) && (f.centroid - point).dot(normal).abs() < 1e-6)
+            .unwrap();
+        json!({"body":"Case","index":face.index,"face":[point.x,point.y,point.z]})
+    };
+    let side_pick = pick(&s, Vec3::X, Vec3::new(40., 10., 20.));
+    let side = run(&mut s, "sketch.create", json!({"name":"USB","plane":side_pick,"project_edges":true}))["sketch"].as_u64().unwrap();
+    let port_plane = s.model.state().sketch(side).unwrap().plane;
+    let p0 = port_plane.to_local(Vec3::new(40., -6., 8.5));
+    let p1 = port_plane.to_local(Vec3::new(40., 6., 15.5));
+    let port_curves = run(&mut s, "sketch.rectangle.two_point", json!({"p0":[p0.x,p0.y],"p1":[p1.x,p1.y]}))["curves"].clone();
+    run(&mut s, "sketch.finish", json!({}));
+    run(
+        &mut s,
+        "solid.extrude",
+        json!({"sketch":side,"profiles":[{"curves":port_curves}],"distance":"wall","direction":"negative","operation":"cut","targets":["Case"],"name":"USBcut"}),
+    );
+    let floor_pick = pick(&s, Vec3::Z, Vec3::new(6., -9., 2.));
+    let floor = run(&mut s, "sketch.create", json!({"name":"Bosses","plane":floor_pick,"project_edges":true}))["sketch"].as_u64().unwrap();
+    let boss_curves = run(&mut s, "sketch.circle.center", json!({"center":[30,20],"radius":3.5}))["curves"].clone();
+    let centre = format!("{}.center", boss_curves[0].as_str().unwrap());
+    run(&mut s, "sketch.dimension", json!({"entities":["origin",centre],"type":"horizontal","value":"width / 2 - 10 mm"}));
+    run(&mut s, "sketch.dimension", json!({"entities":["origin",centre],"type":"vertical","value":"depth / 2 - 10 mm"}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(
+        &mut s,
+        "solid.extrude",
+        json!({"sketch":floor,"profiles":[{"curves":boss_curves}],"distance":12,"operation":"join","targets":["Case"],"name":"Boss"}),
+    );
+    run(
+        &mut s,
+        "solid.pattern.rectangular",
+        json!({"features":["Boss"],"dir1":[-1,0,0],"count1":2,"spacing1":"width - 20 mm","dir2":[0,-1,0],"count2":2,"spacing2":"depth - 20 mm","name":"BossPattern"}),
+    );
+    for id in [side, floor] {
+        let FeatureKind::Sketch { plane, .. } = &s.doc.feature(id).unwrap().kind else { panic!() };
+        assert!(matches!(plane_face_anchor(plane).unwrap().target.certificate, Some(FaceCertificate::ShellPlanar { .. })));
+    }
+    run(&mut s, "parameters.change", json!({"name":"width","expression":"100 mm"}));
+    run(&mut s, "parameters.change", json!({"name":"wall","expression":"3 mm"}));
+    let reopened = Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap());
+    for session in [&s, &reopened] {
+        for id in [side, floor] {
+            let result = session.model.result(id).unwrap();
+            assert!(result.error.is_none(), "{}: {:?}", result.name, result.error);
+            assert!(result.warning.is_none(), "{}: {:?}", result.name, result.warning);
+            assert!(
+                session.model.state().sketch(id).unwrap().sketch.links.iter().all(|link| !link.lost),
+                "projected boundary must resolve current geometry"
+            );
+        }
+        let state = session.model.state();
+        assert!(state.body("Case").is_some());
+        assert!((state.sketch(side).unwrap().plane.origin.x - 50.).abs() < 1e-6);
+        assert!((state.sketch(floor).unwrap().plane.origin.z - 3.).abs() < 1e-6);
+        assert!(state.sketch(floor).unwrap().plane.normal().dot(Vec3::Z) > 0.999);
+        let mesh = state.body("Case").unwrap().body.tessellate_with(1e-4, true).unwrap();
+        let case = &state.body("Case").unwrap().body;
+        let corners: Vec<_> = (0..case.face_count()).filter(|i| matches!(solvecraft_kernel::face_surface(case, *i), Some(solvecraft_kernel::FaceSurface::Cylinder { radius, .. }) if (radius - 6.).abs() < 1e-6)).collect();
+        assert_eq!(corners.len(), 4, "later port/boss features must not subdivide untouched outer corners");
+        for index in corners {
+            let points: Vec<_> = mesh
+                .edge_faces
+                .iter()
+                .enumerate()
+                .filter(|(_, faces)| faces.contains(&(index as u32)))
+                .flat_map(|(edge, _)| &mesh.edges[edge])
+                .collect();
+            assert!(points.iter().any(|p| p.z.abs() < 1e-8));
+            assert!(points.iter().any(|p| (p.z - 30.).abs() < 1e-8));
+        }
+
+        assert!(!mesh.contains(Vec3::new(49., 0., 12.)), "USB must remain open after resize/reopen");
+        assert!(mesh.contains(Vec3::new(49., 15., 12.)), "adjacent right wall remains solid");
+        assert!(mesh.contains(Vec3::new(-49., 0., 12.)), "opposite wall must stay solid");
+        let seed = state.sketch(floor).unwrap().plane.to_world(solvecraft_geom::Vec2::new(40., 20.)) + Vec3::Z * 6.;
+        assert!(mesh.contains(seed), "seed boss starts on current floor");
+        for shift in [Vec3::ZERO, Vec3::new(-80., 0., 0.), Vec3::new(0., -40., 0.), Vec3::new(-80., -40., 0.)] {
+            assert!(mesh.contains(seed + shift), "each patterned boss must survive resize/reopen at {:?}", seed + shift);
+        }
+        assert!(!mesh.contains(Vec3::new(0., 0., 6.)), "the cavity remains hollow");
+        let area = |w: f64, d: f64, r: f64| w * d - (4. - std::f64::consts::PI) * r * r;
+        let expected = area(100., 60., 6.) * 30. - area(94., 54., 3.) * 27. - 12. * 7. * 3. + 4. * std::f64::consts::PI * 3.5 * 3.5 * 12.;
+        assert!((mesh.measure().volume - expected).abs() < 0.1, "actual {}, analytic {expected}", mesh.measure().volume);
+    }
+    run(&mut s, "timeline.suppress", json!({"feature":"Hollow","suppressed":true}));
+    assert!(s.model.result(side).unwrap().error.is_some());
+    assert!(s.model.result(floor).unwrap().error.is_some());
+}
+
+#[test]
+fn offset_rectangle_pocket_has_one_logical_outer_wall_and_closed_face_projection() {
+    let mut s = Session::default();
+    let base = run(&mut s, "sketch.create", json!({"plane":"XY"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.rectangle.center", json!({"center":[0,0],"corner":[30,27]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"sketch":base,"distance":10,"operation":"new","body_name":"Stock"}));
+    let control_sketch = run(&mut s, "sketch.create", json!({"plane":"XY"}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.rectangle.two_point", json!({"p0":[100,100],"p1":[104,104]}));
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"sketch":control_sketch,"distance":10,"operation":"new","body_name":"Control"}));
+    let untouched = s.model.state().body("Control").unwrap().body.clone();
+    let before_control = solvecraft_kernel::step_export(&[&untouched], "control snapshot").unwrap();
+    let pick = top_pick(&s, "Stock");
+    let pocket = run(&mut s, "sketch.create", json!({"plane":pick}))["sketch"].as_u64().unwrap();
+    let side = {
+        let state = s.model.state();
+        let sk = &state.sketch(pocket).unwrap().sketch;
+        let curve = sk.curves.iter().find(|c| c.id == "l1").unwrap();
+        let solvecraft_sketch::CurveKind::Line { a, b } = curve.kind else { panic!() };
+        sk.point(a).unwrap() + sk.point(b).unwrap()
+    };
+    let outer = run(&mut s, "sketch.offset", json!({"curves":["l1"],"distance":0.3425231845240546,"side":[side.x,side.y]}))["curves"].clone();
+    let inner = run(&mut s, "sketch.offset", json!({"curves":[outer[0]],"distance":5.609348914858092,"side":[0,0]}))["curves"].clone();
+    run(&mut s, "sketch.finish", json!({}));
+    run(&mut s, "solid.extrude", json!({"sketch":pocket,"profiles":[{"curves":inner}],"distance":-9,"operation":"cut"}));
+    let control = s.model.state().body("Control").unwrap().body.clone();
+    assert!(control.same(&untouched), "a separate body crossing the cutter end plane remains the exact same solid");
+    assert_eq!(solvecraft_kernel::step_export(&[&control], "control snapshot").unwrap(), before_control);
+    let state = s.model.state();
+    let body = state.body("Stock").unwrap();
+    let display = body.body.display_mesh(0.01).unwrap();
+    let face = body
+        .body
+        .faces(0.01)
+        .unwrap()
+        .into_iter()
+        .find(|face| face.plane_normal.is_some_and(|n| n.dot(Vec3::X) > 0.999) && (face.centroid.x - 30.).abs() < 1e-6)
+        .unwrap();
+    assert_eq!(body.body.faces(0.01).unwrap().len(), 11, "actual pocket topology has no outer floor-height strips");
+    assert_eq!(display.surface_patch(face.index).len(), 1);
+    let attached = run(&mut s, "sketch.create", json!({"plane":{"body":"Stock","index":face.index,"face":[30,0,0.5]}}))["sketch"].as_u64().unwrap();
+    run(&mut s, "sketch.finish", json!({}));
+    let reopened = Session::new(solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap());
+    for session in [&s, &reopened] {
+        let result = session.model.result(attached).unwrap();
+        assert!(result.error.is_none(), "{:?}", result.error);
+        assert!(result.warning.is_none(), "{:?}", result.warning);
+        let state = session.model.state();
+        let sketch = &state.sketch(attached).unwrap().sketch;
+        assert!(sketch.links.iter().all(|link| !link.lost));
+        assert_eq!(sketch.curves.len(), 4, "whole outer-wall rectangle has no floor-height stations");
+        let mesh = state.body("Stock").unwrap().body.display_mesh(0.01).unwrap();
+        assert!(mesh.contains(Vec3::new(0., 0., 0.5)));
+        assert!(!mesh.contains(Vec3::new(0., 0., 5.)));
+        assert!(mesh.contains(Vec3::new(28., 0., 5.)));
+        let control = &state.body("Control").unwrap().body;
+        assert_eq!(control.faces(0.01).unwrap().len(), 6);
+        assert_eq!(control.edges(0.01).unwrap().len(), 12);
+        let control_mesh = control.tessellate(0.01).unwrap();
+        assert!((control_mesh.measure().volume - 160.).abs() < 1e-6);
+        assert!(control_mesh.contains(Vec3::new(102., 102., 0.5)));
+        assert!(control_mesh.contains(Vec3::new(102., 102., 5.)));
+        let expected = 60. * 54. * 10. - 4. * 24.73317426966596 * 21.733174269665962 * 9.;
+        assert!((mesh.measure().volume - expected).abs() < 1e-6, "actual {}, expected {expected}", mesh.measure().volume);
+    }
+}

crates/engine/src/cmd/sketch_import.rs

@@ -34,11 +34,7 @@ fn source_text(p: &Value, cmd: &str) -> Result<String> {
         return Ok(t.to_string());
     }
     let path = str_(p, "path").filter(|x| !x.trim().is_empty() && x.len() < 4096).ok_or_else(|| bad(cmd, "give `path` or `text`"))?;
-    let meta = solvecraft_io::vfs::len(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    if meta as usize > MAX_DRAWING_BYTES {
-        return Err(EngineError::Other(format!("{path}: file too large")));
-    }
-    let bytes = solvecraft_io::vfs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let bytes = solvecraft_io::vfs::read(path, MAX_DRAWING_BYTES).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
     Ok(String::from_utf8_lossy(&bytes).to_string())
 }
 
@@ -113,7 +109,7 @@ fn insert(s: &mut Session, p: &Value, cmd: &str, svg: bool) -> Result<Value> {
     let text = source_text(p, cmd)?;
     let geom = if svg { solvecraft_io::read_svg(&text) } else { solvecraft_io::read_dxf(&text) }.map_err(|e| bad(cmd, e.to_string()))?;
     if geom.is_empty() {
-        return Err(bad(cmd, "the drawing has no geometry SolveCraft reads"));
+        return Err(bad(cmd, "the drawing has no geometry SolidCraft reads"));
     }
     let k = num(p, "scale").filter(|k| *k > 1e-9 && *k < 1e6).unwrap_or(1.0);
     let off = p.get("at").and_then(vec2).unwrap_or(Vec2::ZERO);

crates/engine/src/cmd/sketch_ux_tests.rs

@@ -237,6 +237,21 @@ fn construction_toggle_takes_shapes_out_of_profiles_and_back() {
     assert!(s.execute("sketch.construction", &json!({"curves": ["nope"]})).is_err());
 }
 
+#[test]
+fn centerline_can_become_construction_directly() {
+    let mut s = new_sketch();
+    let l = curve_ids(&run(&mut s, "sketch.line", json!({"points": [[0, 0], [20, 0]]})));
+    run(&mut s, "sketch.centerline", json!({ "curves": l, "value": true }));
+    let r = run(&mut s, "sketch.construction", json!({ "curves": l, "value": true }));
+    assert_eq!(r["changed"], 1);
+    let sk = sketch(&s);
+    assert!(sk.curves.iter().filter(|c| l.contains(&c.id)).all(|c| c.construction && !c.centerline));
+    // And back to a centerline.
+    run(&mut s, "sketch.centerline", json!({ "curves": l, "value": true }));
+    let sk = sketch(&s);
+    assert!(sk.curves.iter().filter(|c| l.contains(&c.id)).all(|c| c.centerline && !c.construction));
+}
+
 #[test]
 fn projected_geometry_can_become_construction() {
     let mut s = Session::default();
@@ -401,6 +416,39 @@ fn point_constraints_keep_the_first_pick() {
     assert!(pt(&s, "p2").dist(solvecraft_geom::Vec2::new(3.0, -7.0)) < 1e-6, "{:?}", pt(&s, "p2"));
 }
 
+#[test]
+fn coincident_line_pairs_resolve_ties_independently_of_pick_order() {
+    for (a, b) in [("l1", "l2"), ("l2", "l1")] {
+        let mut s = new_sketch();
+        run(&mut s, "sketch.line", json!({"points":[[10,10],[30,10]],"infer":false,"connect":false}));
+        run(&mut s, "sketch.line", json!({"points":[[10,20],[30,20]],"infer":false,"connect":false}));
+        run(&mut s, "sketch.constraint.coincident", json!({"a":a,"b":b}));
+        let sk = sketch(&s);
+        let p = sk.resolve_point("l1.start").unwrap();
+        let q = sk.resolve_point("l2.start").unwrap();
+        assert!(sk.point(p).unwrap().dist(sk.point(q).unwrap()) < 1e-6);
+        let count = sk.constraints.len();
+        let result = run(&mut s, "sketch.constraint.coincident", json!({"a":b,"b":a}));
+        assert_eq!(result["existing"], true);
+        assert_eq!(sketch(&s).constraints.len(), count);
+    }
+}
+
+#[test]
+fn coincident_refuses_invalid_curve_pairs_atomically() {
+    let mut s = new_sketch();
+    run(&mut s, "sketch.line", json!({"points":[[10,10],[30,10]],"infer":false,"connect":false}));
+    run(&mut s, "sketch.circle.center", json!({"center":[40,40],"radius":5}));
+    let before = serde_json::to_value(&s.doc).unwrap();
+    let undo = s.undo.len();
+    for (a, b, message) in [("l1", "l1", "distinct lines"), ("l1", "c1", "straight lines"), ("c1", "l1", "straight lines")] {
+        let error = s.execute("sketch.constraint.coincident", &json!({"a":a,"b":b})).unwrap_err();
+        assert!(error.to_string().contains(message), "{error}");
+        assert_eq!(serde_json::to_value(&s.doc).unwrap(), before);
+        assert_eq!(s.undo.len(), undo);
+    }
+}
+
 // ---------------------------------------------------------------------------------------------
 // Sketch Palette options
 

crates/engine/src/lib.rs

@@ -33,6 +33,10 @@ pub use solvecraft_kernel as kernel;
 pub use solvecraft_render as render;
 pub use solvecraft_sketch as sketch;
 
+/// Longest accepted request line on the JSON-lines channels (MCP over stdio and the control
+/// server over loopback), so both refuse runaway input at the same size.
+pub const MAX_LINE: usize = 16 << 20;
+
 #[derive(Debug, thiserror::Error)]
 pub enum EngineError {
     #[error("unknown command `{0}`")]
@@ -146,6 +150,28 @@ pub struct Preview {
     pub after: Arc<ModelState>,
 }
 
+/// Prepared world geometry depends on design/model identity and placement context, not
+/// selection or the view revision. Retained Arcs prevent pointer reuse after a design closes.
+#[derive(Clone)]
+struct WorldCache {
+    doc: Arc<Document>,
+    model: Arc<solvecraft_doc::ModelState>,
+    pending_moves: std::collections::BTreeMap<u64, solvecraft_doc::Mat>,
+    active_component: u64,
+    active_occurrence_path: Option<Vec<u64>>,
+    world: Arc<solvecraft_doc::ModelState>,
+}
+
+impl WorldCache {
+    fn matches(&self, session: &Session, model: &Arc<solvecraft_doc::ModelState>) -> bool {
+        Arc::ptr_eq(&self.doc, &session.doc)
+            && Arc::ptr_eq(&self.model, model)
+            && self.pending_moves == session.pending_moves
+            && self.active_component == session.active_component
+            && self.active_occurrence_path == session.active_occurrence_path
+    }
+}
+
 /// An editing session on one design.
 pub struct Session {
     pub doc: Arc<Document>,
@@ -169,7 +195,7 @@ pub struct Session {
     pub active_occurrence_path: Option<Vec<u64>>,
     /// Occurrence moves not captured yet (Capture Position keeps them, a recompute drops them).
     pub pending_moves: std::collections::BTreeMap<u64, solvecraft_doc::Mat>,
-    world_cache: std::sync::Mutex<Option<(u64, Arc<solvecraft_doc::ModelState>)>>,
+    world_cache: std::sync::Mutex<Option<WorldCache>>,
     occurrence_visibility_cache: std::sync::Mutex<Option<occurrences::VisibilityCache>>,
     /// Features copied with `timeline.copy` (pasted by `timeline.paste`).
     pub clipboard: Vec<solvecraft_doc::Feature>,
@@ -304,10 +330,10 @@ impl Session {
             return st;
         }
         if let Ok(c) = self.world_cache.lock()
-            && let Some((rev, w)) = c.as_ref()
-            && *rev == self.revision
+            && let Some(cached) = c.as_ref()
+            && cached.matches(self, &st)
         {
-            return w.clone();
+            return cached.world.clone();
         }
         let mut w = if self.pending_moves.is_empty() {
             solvecraft_doc::world_state(&self.doc, &st)
@@ -346,7 +372,14 @@ impl Session {
         }
         let w = Arc::new(w);
         if let Ok(mut c) = self.world_cache.lock() {
-            *c = Some((self.revision, w.clone()));
+            *c = Some(WorldCache {
+                doc: self.doc.clone(),
+                model: st,
+                pending_moves: self.pending_moves.clone(),
+                active_component: self.active_component,
+                active_occurrence_path: self.active_occurrence_path.clone(),
+                world: w.clone(),
+            });
         }
         w
     }
@@ -499,7 +532,7 @@ impl Session {
             active_component: self.active_component,
             active_occurrence_path: self.active_occurrence_path.clone(),
             pending_moves: self.pending_moves.clone(),
-            world_cache: Default::default(),
+            world_cache: std::sync::Mutex::new(self.world_cache.lock().ok().and_then(|cache| cache.clone())),
             occurrence_visibility_cache: Default::default(),
             clipboard: self.clipboard.clone(),
             section: None,
@@ -515,12 +548,6 @@ impl Session {
     pub fn invalidate_view(&mut self, previous_revision: u64) {
         let old = self.revision;
         self.revision = old.max(previous_revision) + 1;
-        if let Ok(mut cache) = self.world_cache.lock()
-            && let Some((revision, _)) = cache.as_mut()
-            && *revision == old
-        {
-            *revision = self.revision;
-        }
     }
 
     /// Commit commands evaluated on a scratch copy without losing this session's file,
@@ -647,3 +674,5 @@ mod split_face_tests;
 mod tests;
 #[cfg(test)]
 mod thread_tests;
+#[cfg(test)]
+mod world_placement_cache_tests;

crates/engine/src/licences.rs

@@ -11,7 +11,7 @@ pub const THIRD_PARTY: &str = include_str!("../../../THIRD-PARTY-LICENSES.txt");
 pub fn all() -> String {
     let rule = "=".repeat(80);
     format!(
-        "SolveCraft is licensed under the MIT License or the Apache License, Version 2.0, at your option.\n\n{rule}\nNOTICE\n{rule}\n\n{NOTICE}\n{rule}\nLICENSE-MIT\n{rule}\n\n{LICENSE_MIT}\n{rule}\nLICENSE-APACHE\n{rule}\n\n{LICENSE_APACHE}\n{rule}\n{THIRD_PARTY}"
+        "SolidCraft is licensed under the MIT License or the Apache License, Version 2.0, at your option.\n\n{rule}\nNOTICE\n{rule}\n\n{NOTICE}\n{rule}\nLICENSE-MIT\n{rule}\n\n{LICENSE_MIT}\n{rule}\nLICENSE-APACHE\n{rule}\n\n{LICENSE_APACHE}\n{rule}\n{THIRD_PARTY}"
     )
 }
 

crates/engine/src/recovery.rs

@@ -100,7 +100,9 @@ pub fn load(dir: &Path, id: &str) -> Result<(Document, Entry)> {
         .ok()
         .and_then(|b| serde_json::from_slice(&b).ok())
         .ok_or_else(|| EngineError::Other(format!("no recovered design `{id}`")))?;
-    let bytes = fs::read(file(dir, id, "solvecraft")).map_err(|e| EngineError::Other(format!("recovered design `{id}`: {e}")))?;
+    let path = file(dir, id, "solvecraft");
+    let bytes = solvecraft_io::vfs::read(&path.to_string_lossy(), solvecraft_io::MAX_DESIGN_BYTES)
+        .map_err(|e| EngineError::Other(format!("recovered design `{id}`: {e}")))?;
     Ok((solvecraft_io::read_design(&bytes)?, entry))
 }
 

crates/engine/src/tests.rs

@@ -23,28 +23,97 @@ fn rel(a: f64, b: f64) -> f64 {
 #[test]
 fn join_extrude_from_a_chamfered_top_face() {
     let mut s = Session::default();
+    run(&mut s, "parameters.add", json!({"name":"height","expression":"20 mm"}));
+    run(&mut s, "parameters.add", json!({"name":"bevel","expression":"2 mm"}));
     run(&mut s, "sketch.create", json!({"plane": "XY"}));
     run(&mut s, "sketch.circle.center", json!({"center": [0, 0], "radius": 10}));
-    run(&mut s, "solid.extrude", json!({"distance": 20}));
-    run(&mut s, "solid.chamfer", json!({"edges": [[10, 0, 20]], "distance": 2}));
+    let source = run(&mut s, "solid.extrude", json!({"distance": "height","name":"Stem"}))["feature"].as_u64().unwrap();
+    run(&mut s, "solid.chamfer", json!({"edges": [[10, 0, 20]], "distance": "bevel"}));
     let base = volume(&mut s);
-    let before = s.doc.to_json();
-    let active = s.active_sketch;
-    assert!(s.execute("sketch.create", &json!({"plane":{"face":[0,0,20]}})).is_err(), "modified faces require an explicit fixed plane");
-    assert_eq!(s.doc.to_json(), before);
-    assert_eq!(s.active_sketch, active);
-    assert!(rel(volume(&mut s), base) < 1e-12);
-    let id = run(&mut s, "sketch.create", json!({"plane": {"face": [0, 0, 20],"fixed":true}}))["sketch"].as_u64().unwrap();
-    let solvecraft_doc::FeatureKind::Sketch { plane: solvecraft_doc::PlaneRef::Custom { plane }, sketch } = &s.doc.feature(id).unwrap().kind else {
-        panic!("explicit fixed face must become a custom plane");
+    let id = run(&mut s, "sketch.create", json!({"plane": {"face": [0, 0, 20]}}))["sketch"].as_u64().unwrap();
+    let solvecraft_doc::FeatureKind::Sketch { plane: solvecraft_doc::PlaneRef::Face { anchor: Some(anchor), .. }, sketch } =
+        &s.doc.feature(id).unwrap().kind
+    else {
+        panic!("the chamfered cap retains its exact original construction support");
     };
-    assert!((plane.origin.z - 20.).abs() < 1e-9);
-    assert!(sketch.links.is_empty(), "fresh fixed plane does not create live auto-projections");
-    run(&mut s, "sketch.circle.center", json!({"center":[0,0],"radius":8}));
+    assert_eq!(anchor.target.origin_feature, source);
+    assert!(matches!(anchor.target.certificate, Some(solvecraft_doc::config::FaceCertificate::ExtrudeCap { high: true, .. })));
+    assert!(!sketch.links.is_empty());
+    assert!(sketch.links.iter().all(|link| link.auto_face && !link.lost));
+    // The default linked cap outline is radius8; no explicit fixed plane or
+    // duplicate manually drawn circle is required to join a pad to that face.
     run(&mut s, "sketch.finish", json!({}));
     run(&mut s, "solid.extrude", json!({"distance": 5, "operation": "join"}));
     assert_eq!(s.model.state().bodies.len(), 1);
     assert!(rel(volume(&mut s), base + PI * 64.0 * 5.0) < 5e-4);
+    for (height, bevel) in [(20., 2.), (25., 3.)] {
+        run(&mut s, "parameters.change", json!({"name":"height","expression":format!("{height} mm")}));
+        run(&mut s, "parameters.change", json!({"name":"bevel","expression":format!("{bevel} mm")}));
+        let expected = PI * (100. * height - (10. * bevel * bevel - bevel * bevel * bevel / 3.) + (10. - bevel) * (10. - bevel) * 5.);
+        let loaded = solvecraft_doc::Document::from_json(&s.doc.to_json()).unwrap();
+        let mut cold = Session::new(loaded);
+        let warm_volume = volume(&mut s);
+        let cold_volume = volume(&mut cold);
+        assert!(rel(warm_volume, expected) < 5e-4, "{warm_volume} vs {expected}");
+        assert!((warm_volume - cold_volume).abs() < 1e-8);
+        for current in [&s, &cold] {
+            assert!(current.model.results.iter().all(|result| result.error.is_none() && result.warning.is_none()), "{:?}", current.model.results);
+            let state = current.model.state();
+            assert_eq!(state.bodies.len(), 1);
+            let solved = state.sketch(id).unwrap();
+            assert!((solved.plane.origin.z - height).abs() < 1e-8);
+            assert!(solved.sketch.links.iter().all(|link| link.auto_face && !link.lost));
+            let body = &state.bodies[0];
+            assert!(body.body.contains(solvecraft_geom::Vec3::new(0., 0., height + 4.)));
+            assert!(!body.body.contains(solvecraft_geom::Vec3::new(0., 0., height + 6.)));
+            assert!(body.body.contains(solvecraft_geom::Vec3::new(10. - bevel - 0.5, 0., height + 4.)));
+            assert!(!body.body.contains(solvecraft_geom::Vec3::new(10. - bevel + 0.5, 0., height + 4.)));
+        }
+    }
+}
+
+/// A join that bridges two bodies makes them one body, not an overlap of the first and the second.
+#[test]
+fn join_bridging_two_bodies_merges_them() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0], "operation": "new_body"}));
+    run(&mut s, "solid.box", json!({"length": 20, "width": 4, "height": 4, "corner": [5, 3, 3], "operation": "join"}));
+    let st = s.model.state();
+    assert_eq!(st.bodies.len(), 1, "both boxes and the bar are one body");
+    assert_eq!(st.bodies[0].name, "Body1");
+    assert_eq!(st.bodies[0].body.lumps().unwrap().len(), 1);
+    // 2 boxes + the bar's 10 mm outside them.
+    assert!(rel(volume(&mut s), 2000.0 + 10.0 * 16.0) < 1e-6);
+}
+
+/// A join touching only the second body merges into that body and leaves the first alone.
+#[test]
+fn join_merges_into_the_body_it_meets() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10, "corner": [20, 0, 0], "operation": "new_body"}));
+    // Sits on Body2's top face: a face contact, no shared volume.
+    run(&mut s, "solid.box", json!({"length": 4, "width": 4, "height": 4, "corner": [23, 3, 10], "operation": "join"}));
+    let st = s.model.state();
+    assert_eq!(st.bodies.len(), 2);
+    let b1 = st.bodies.iter().find(|b| b.name == "Body1").unwrap();
+    let b2 = st.bodies.iter().find(|b| b.name == "Body2").unwrap();
+    assert_eq!(b1.body.face_count(), 6, "Body1 is untouched");
+    assert_eq!(b2.body.lumps().unwrap().len(), 1);
+    assert!(rel(volume(&mut s), 2064.0) < 1e-6);
+}
+
+/// A join that meets no body still joins the first body, as a separate lump.
+#[test]
+fn join_meeting_nothing_keeps_the_first_body() {
+    let mut s = Session::default();
+    run(&mut s, "solid.box", json!({"length": 10, "width": 10, "height": 10}));
+    run(&mut s, "solid.box", json!({"length": 4, "width": 4, "height": 4, "corner": [40, 0, 0], "operation": "join"}));
+    let st = s.model.state();
+    assert_eq!(st.bodies.len(), 1);
+    assert_eq!(st.bodies[0].body.lumps().unwrap().len(), 2);
+    assert!(rel(volume(&mut s), 1064.0) < 1e-6);
 }
 
 mod component_frames;
@@ -2255,3 +2324,29 @@ fn adopting_a_computed_component_keeps_its_warm_world_geometry() {
     s.invalidate_view(100);
     assert!(std::sync::Arc::ptr_eq(&prepared, &s.world_state()));
 }
+
+/// Every file command checked the size with the metadata and then read to the end. A character
+/// device reports a length of 0, so the cap passed and the read never finished; a FIFO blocked
+/// the calling thread, which over the control channel is the thread drawing the window.
+#[cfg(unix)]
+#[test]
+fn special_files_are_refused_by_every_file_command() {
+    let mut s = Session::default();
+    for cmd in ["doc.open", "parameters.import"] {
+        let r = s.execute(cmd, &json!({"path": "/dev/zero"}));
+        assert!(r.as_ref().is_err_and(|e| e.to_string().contains("not a regular file")), "{cmd}: {r:?}");
+    }
+    // The commands that check the extension first need a special file with the right name.
+    let dir = std::env::temp_dir().join(format!("solvecraft-special-{}", std::process::id()));
+    let _ = std::fs::create_dir_all(&dir);
+    for (cmd, name) in [("file.insert_step", "x.step"), ("file.insert_mesh", "x.3mf"), ("sketch.insert_dxf", "x.dxf")] {
+        let p = dir.join(name);
+        let _ = std::fs::remove_file(&p);
+        if !std::process::Command::new("mkfifo").arg(&p).status().map(|st| st.success()).unwrap_or(false) {
+            continue;
+        }
+        let r = s.execute(cmd, &json!({"path": p.to_string_lossy()}));
+        assert!(r.as_ref().is_err_and(|e| e.to_string().contains("not a regular file")), "{cmd}: {r:?}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}

crates/engine/src/world_placement_cache_tests.rs

@@ -0,0 +1,177 @@
+//! Placement-cache changes must retain physical picking, pending positions and named joints.
+use crate::{Session, geom::Vec3};
+use serde_json::{Value, json};
+use std::sync::Arc;
+
+fn run(session: &mut Session, command: &str, params: Value) -> Value {
+    session.execute(command, &params).unwrap_or_else(|error| panic!("{command}: {error}"))
+}
+
+#[test]
+fn world_placement_cache_preserves_pending_picks_materials_scratch_and_named_joint_frames() {
+    let mut session = Session::default();
+    let created = run(&mut session, "component.create", json!({"name":"Part"}));
+    let component = created["component"].as_u64().unwrap();
+    let first = created["occurrence"].as_u64().unwrap();
+    run(&mut session, "solid.box", json!({"length":2,"width":3,"height":4,"body_name":"Block","operation":"new"}));
+    run(&mut session, "material.assign", json!({"bodies":["Block"],"material":"Brass"}));
+    let second = run(&mut session, "occurrence.copy", json!({"occurrence":first}))["occurrence"].as_u64().unwrap();
+    run(&mut session, "occurrence.move", json!({"occurrence":second,"translate":[10,20,0],"axis":[0,0,1],"angle":"90 deg","capture":false}));
+    let pending = session.pending_moves.clone();
+    let path = vec![second];
+    let placement = session.occurrence_placement(&path).unwrap();
+    let name = placement.bodies[0].world.clone();
+    let world = session.world_state();
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    let source_state = session.model.state();
+    let source = source_state.body("Block").unwrap();
+    let placed = world.body(&name).unwrap();
+    assert_eq!(placed.source_name.as_deref(), Some("Block"));
+    assert_eq!(placed.component, component);
+    let bounds = placed.mesh().bounds();
+    assert!(bounds.min.dist(Vec3::new(7., 20., 0.)) < 1e-9);
+    assert!(bounds.max.dist(Vec3::new(10., 22., 4.)) < 1e-9);
+    assert_eq!(session.doc.model_body_look(placed), session.doc.model_body_look(source));
+    let source_names = crate::doc::naming::face_names(source);
+    assert_eq!(source_names, crate::doc::naming::face_names(placed));
+    let pick = Vec3::new(8.5, 21., 4.);
+    let top = placed.body.faces(0.001).unwrap().into_iter().find(|face| face.plane_normal.is_some_and(|n| n.z > 0.99)).unwrap().index;
+    run(&mut session, "select.set", json!({"items":[{"type":"face","body":name,"index":top,"point":[pick.x,pick.y,pick.z]}]}));
+    assert!(matches!(&session.selection[0], crate::Sel::Face { body, index, .. } if body == &name && *index == top));
+    assert!(Arc::ptr_eq(&world, &session.world_state()), "selection changes must not discard prepared placements");
+    let scratch = session.scratch();
+    assert_eq!(scratch.pending_moves, pending);
+    let scratch_world = scratch.world_state();
+    assert!(Arc::ptr_eq(&world, &scratch_world));
+    let scratch_body = scratch_world.body(&name).unwrap();
+    assert!(scratch_body.mesh().bounds().min.dist(bounds.min) < 1e-9);
+    assert_eq!(crate::doc::naming::face_names(scratch_body), source_names);
+    run(&mut session, "component.capture_position", json!({}));
+    run(&mut session, "joint.origin", json!({"name":"Top joint","occurrence":second,"face":[pick.x,pick.y,pick.z]}));
+    let joint = session.doc.assembly.origins[0].origin.clone();
+    let local_frame = crate::doc::joints::resolve_origin(&session.doc, &session.model.state(), &joint).unwrap();
+    let before_joint = crate::doc::mat_mul(&crate::doc::joints::occurrence_world(&session.doc, second), &local_frame);
+    assert!(crate::doc::apply_point(&before_joint, Vec3::ZERO).dist(pick) < 1e-9);
+    run(&mut session, "occurrence.move", json!({"occurrence":second,"translate":[5,0,0],"capture":true}));
+    let moved = session.world_state();
+    assert!(!Arc::ptr_eq(&world, &moved), "a changed transform must invalidate placed meshes");
+    assert!(moved.body(&name).unwrap().mesh().bounds().min.dist(bounds.min + Vec3::new(5., 0., 0.)) < 1e-9);
+    assert!(world.body(&name).unwrap().mesh().bounds().min.dist(bounds.min) < 1e-9, "prior snapshots must remain immutable");
+    assert_eq!(crate::doc::naming::face_names(moved.body(&name).unwrap()), source_names);
+    let local_frame = crate::doc::joints::resolve_origin(&session.doc, &session.model.state(), &joint).unwrap();
+    let after_joint = crate::doc::mat_mul(&crate::doc::joints::occurrence_world(&session.doc, second), &local_frame);
+    assert!(crate::doc::apply_point(&after_joint, Vec3::ZERO).dist(pick + Vec3::new(5., 0., 0.)) < 1e-9);
+    let reopened = Session::new(crate::doc::Document::from_json(&session.doc.to_json()).unwrap());
+    assert!(reopened.world_state().body(&name).unwrap().mesh().bounds().min.dist(bounds.min + Vec3::new(5., 0., 0.)) < 1e-9);
+    assert_eq!(reopened.model.results.iter().filter(|r| r.error.is_some()).count(), 0);
+}
+
+#[test]
+fn selection_visibility_section_and_view_revisions_reuse_world_geometry() {
+    let mut session = Session::default();
+    run(&mut session, "component.create", json!({"name":"Part"}));
+    run(&mut session, "solid.box", json!({"length":2,"width":3,"height":4,"body_name":"Block","operation":"new"}));
+    let world = session.world_state();
+    let revision = session.revision;
+    run(&mut session, "select.set", json!({"items":[{"type":"body","name":"Block"}]}));
+    assert!(session.revision > revision);
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    run(&mut session, "select.clear", json!({}));
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    run(&mut session, "browser.visibility", json!({"items":["Block"],"visible":false}));
+    assert!(!session.body_visible("Block"));
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    run(&mut session, "inspect.section", json!({"plane":{"origin":[0,0,2],"normal":[0,0,1]}}));
+    assert!(session.section.is_some());
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    session.invalidate_view(session.revision + 10);
+    assert!(Arc::ptr_eq(&world, &session.world_state()));
+    assert!(Arc::ptr_eq(&world, &session.scratch().world_state()));
+}
+
+#[test]
+fn world_cache_requires_exact_design_model_pending_and_author_context() {
+    let mut session = Session::default();
+    let created = run(&mut session, "component.create", json!({"name":"Part"}));
+    let component = created["component"].as_u64().unwrap();
+    let first = created["occurrence"].as_u64().unwrap();
+    run(&mut session, "solid.box", json!({"length":2,"width":3,"height":4,"body_name":"Block","operation":"new"}));
+    let sketch = run(&mut session, "sketch.create", json!({"plane":"XY"}))["sketch"].as_u64().unwrap();
+    run(&mut session, "sketch.finish", json!({}));
+    let second = run(&mut session, "occurrence.copy", json!({"occurrence":first}))["occurrence"].as_u64().unwrap();
+    let initial = session.world_state();
+    run(&mut session, "occurrence.move", json!({"occurrence":second,"translate":[10,20,0],"capture":false}));
+    let pending = session.world_state();
+    assert!(!Arc::ptr_eq(&initial, &pending));
+    let name = session.occurrence_placement(&[second]).unwrap().bodies[0].world.clone();
+    assert!(pending.body(&name).unwrap().mesh().bounds().min.dist(Vec3::new(10., 20., 0.)) < 1e-9);
+    run(&mut session, "component.activate", json!({"component":component,"occurrence":second,"path":[second]}));
+    let authored = session.world_state();
+    assert!(!Arc::ptr_eq(&pending, &authored));
+    assert!(authored.sketch(sketch).unwrap().plane.origin.dist(Vec3::new(10., 20., 0.)) < 1e-9);
+    let mut scratch = session.scratch();
+    assert!(Arc::ptr_eq(&authored, &scratch.world_state()));
+    scratch.active_occurrence_path = Some(vec![first]);
+    let scratch_world = scratch.world_state();
+    assert!(!Arc::ptr_eq(&authored, &scratch_world));
+    assert!(scratch_world.sketch(sketch).unwrap().plane.origin.dist(Vec3::ZERO) < 1e-9);
+    assert!(Arc::ptr_eq(&authored, &session.world_state()), "scratch context must not replace the source cache");
+    run(&mut session, "appearance.assign", json!({"bodies":["Block"],"color":"#ff0000"}));
+    let painted = session.world_state();
+    assert!(!Arc::ptr_eq(&authored, &painted));
+    assert_ne!(session.doc.model_body_look(painted.body("Block").unwrap()), None);
+    run(&mut session, "edit.undo", json!({}));
+    let undone = session.world_state();
+    assert!(!Arc::ptr_eq(&painted, &undone));
+    run(&mut session, "edit.redo", json!({}));
+    let redone = session.world_state();
+    assert!(!Arc::ptr_eq(&undone, &redone));
+    assert!(session.doc.model_body_look(redone.body("Block").unwrap()).is_some());
+    let before_edit = session.world_state();
+    run(&mut session, "solid.box", json!({"length":5,"width":6,"height":7,"body_name":"Other","operation":"new"}));
+    let edited = session.world_state();
+    assert!(!Arc::ptr_eq(&before_edit, &edited));
+    assert!(edited.body("Other").is_some());
+    session.doc = Arc::new(crate::doc::Document::from_json(&session.doc.to_json()).unwrap());
+    let replaced = session.world_state();
+    assert!(!Arc::ptr_eq(&edited, &replaced), "equal contents in a different document cannot share the cache key");
+    session.model = crate::doc::Model::default();
+    session.model.evaluate(&session.doc);
+    assert!(!Arc::ptr_eq(&replaced, &session.world_state()), "a new evaluated model must invalidate even when the document Arc is unchanged");
+}
+
+#[test]
+fn adopted_scratch_keeps_its_warm_geometry_and_history_stages_invalidate_it() {
+    let mut session = Session::default();
+    run(&mut session, "component.create", json!({"name":"Part"}));
+    run(&mut session, "solid.box", json!({"length":2,"width":3,"height":4,"body_name":"Block","operation":"new"}));
+    let source = session.world_state();
+    let source_json = session.doc.to_json();
+    let mut scratch = session.scratch();
+    run(&mut scratch, "solid.box", json!({"length":5,"width":6,"height":7,"body_name":"Draft","operation":"new"}));
+    let warmed = scratch.world_state();
+    assert!(!Arc::ptr_eq(&source, &warmed));
+    assert_eq!(session.doc.to_json(), source_json);
+    assert!(Arc::ptr_eq(&source, &session.world_state()));
+    assert!(source.body("Draft").is_none());
+    let feature = warmed.body("Draft").unwrap().feature;
+    session.accept_computed(scratch);
+    assert!(Arc::ptr_eq(&warmed, &session.world_state()), "adoption/view revision must retain the worker's prepared geometry");
+    session.invalidate_view(session.revision + 20);
+    assert!(Arc::ptr_eq(&warmed, &session.world_state()));
+    run(&mut session, "timeline.rollback", json!({"position":1}));
+    let rolled = session.world_state();
+    assert!(!Arc::ptr_eq(&warmed, &rolled));
+    assert!(rolled.body("Block").is_some());
+    assert!(rolled.body("Draft").is_none());
+    run(&mut session, "timeline.rollback", json!({}));
+    let restored = session.world_state();
+    assert!(!Arc::ptr_eq(&rolled, &restored));
+    assert!(restored.body("Draft").is_some());
+    run(&mut session, "timeline.suppress", json!({"feature":feature,"suppressed":true}));
+    let suppressed = session.world_state();
+    assert!(!Arc::ptr_eq(&restored, &suppressed));
+    assert!(suppressed.body("Draft").is_none());
+    run(&mut session, "timeline.suppress", json!({"feature":feature,"suppressed":false}));
+    assert!(session.world_state().body("Draft").is_some());
+}

crates/geom/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-geom"
-description = "SolveCraft geometry foundation: vectors, planes, frames, meshes and their measures"
+description = "SolidCraft geometry foundation: vectors, planes, frames, meshes and their measures"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/geom/src/profile.rs

@@ -244,8 +244,24 @@ impl Seg2 {
             }
         }
     }
-    /// Parameter of the point of the segment closest to `p` (sampling, then Newton).
+    /// Parameter of the closest point: exact projection for lines,
+    /// sampling followed by Newton for the remaining curves.
     pub fn closest_param(&self, p: Vec2) -> f64 {
+        let finite = |p: Vec2| p.x.is_finite() && p.y.is_finite();
+        match *self {
+            Seg2::Line { a, b } if finite(a) && finite(b) && finite(p) => {
+                let d = b - a;
+                if a == b {
+                    return 0.0;
+                }
+                let denominator = d.len2();
+                let t = (p - a).dot(d) / denominator;
+                if denominator > 0.0 && denominator.is_finite() && t.is_finite() {
+                    return t.clamp(0.0, 1.0);
+                }
+            }
+            _ => {}
+        }
         let n = 64;
         let mut t =
             (0..=n).map(|i| i as f64 / n as f64).min_by(|x, y| self.point_at(*x).dist(p).total_cmp(&self.point_at(*y).dist(p))).unwrap_or(0.0);
@@ -540,6 +556,76 @@ impl Region2 {
 mod tests {
     use super::*;
 
+    #[test]
+    fn closest_line_projection_and_degeneracy() {
+        let line = Seg2::Line { a: Vec2::new(-3.0, 4.0), b: Vec2::new(7.0, 4.0) };
+        for (p, t) in [(Vec2::new(-9.0, 20.0), 0.0), (Vec2::new(2.0, -5.0), 0.5), (Vec2::new(15.0, 4.0), 1.0)] {
+            assert_eq!(line.closest_param(p), t);
+            assert_eq!(line.reversed().closest_param(p), 1.0 - t);
+        }
+        let a = Vec2::new(1e100, -1e100);
+        let b = a + Vec2::new(1e90, 2e90);
+        let large = Seg2::Line { a, b };
+        assert!((large.closest_param(a.lerp(b, 0.5)) - 0.5).abs() < 1e-6);
+        assert_eq!(Seg2::Line { a, b: a }.closest_param(Vec2::ZERO), 0.0);
+        let tiny = Seg2::Line { a: Vec2::ZERO, b: Vec2::new(1e-12, 0.0) };
+        assert_eq!(tiny.closest_param(Vec2::new(0.5e-12, 1.0)), 0.5);
+        for line in [line, line.reversed(), tiny] {
+            for k in 0..53 {
+                let p = Vec2::new((k * 17 % 37) as f64 - 18.0, (k * 31 % 29) as f64 - 14.0);
+                let closest = line.point_at(line.closest_param(p)).dist(p);
+                let dense = (0..=8192).map(|i| line.point_at(i as f64 / 8192.0).dist(p)).fold(f64::INFINITY, f64::min);
+                assert!(closest <= dense + 1e-12);
+            }
+        }
+    }
+
+    fn sampled_closest(s: &Seg2, p: Vec2) -> f64 {
+        let mut t = (0..=64).map(|i| i as f64 / 64.0).min_by(|x, y| s.point_at(*x).dist(p).total_cmp(&s.point_at(*y).dist(p))).unwrap_or(0.0);
+        for _ in 0..30 {
+            let (q, d) = (s.point_at(t), s.derivative(t));
+            let (d2, h) = ((s.derivative((t + 1e-6).min(1.0)) - s.derivative((t - 1e-6).max(0.0))) / 2e-6, q - p);
+            let df = d.dot(d) + h.dot(d2);
+            if df.abs() < 1e-300 {
+                break;
+            }
+            let nt = (t - h.dot(d) / df).clamp(0.0, 1.0);
+            if (nt - t).abs() < 1e-14 {
+                t = nt;
+                break;
+            }
+            t = nt;
+        }
+        t
+    }
+
+    #[test]
+    fn closest_projection_preserves_clearance_tolerance_and_generic_fallback() {
+        use std::f64::consts::TAU;
+        let curves = [
+            Seg2::Line { a: Vec2::new(-4.0, 7.0), b: Vec2::new(3.0, -2.0) },
+            Seg2::Arc { center: Vec2::new(3.0, -2.0), radius: 6.0, start: 5.9, sweep: 1.3 },
+            Seg2::Arc { center: Vec2::ZERO, radius: 2.0, start: 0.2, sweep: -TAU },
+            Seg2::Arc { center: Vec2::ZERO, radius: 2.0, start: 0.0, sweep: TAU },
+            Seg2::Arc { center: Vec2::ZERO, radius: 2.0, start: 0.0, sweep: 0.0 },
+            Seg2::Arc { center: Vec2::ZERO, radius: 2.0, start: 0.0, sweep: 1e-12 },
+            Seg2::Cubic { p0: Vec2::ZERO, p1: Vec2::new(2.0, 7.0), p2: Vec2::new(6.0, -3.0), p3: Vec2::new(8.0, 4.0) },
+        ];
+        for (i, s) in curves.iter().enumerate() {
+            for k in 0..101 {
+                let p = Vec2::new((k * 17 % 37) as f64 - 18.0, (k * 31 % 29) as f64 - 14.0);
+                let old = sampled_closest(s, p);
+                let new = s.closest_param(p);
+                if i > 0 {
+                    assert_eq!(new.to_bits(), old.to_bits());
+                }
+                assert!(s.point_at(new).dist(p) <= s.point_at(old).dist(p) + 1e-10);
+                let on_curve = s.point_at(k as f64 / 100.0);
+                assert!(s.point_at(s.closest_param(on_curve)).dist(on_curve) < 1e-9);
+            }
+        }
+    }
+
     #[test]
     fn triangulated_area() {
         let sq = Loop2::polygon(&[Vec2::new(0.0, 0.0), Vec2::new(10.0, 0.0), Vec2::new(10.0, 8.0), Vec2::new(5.0, 3.0), Vec2::new(0.0, 8.0)]);

crates/io/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-io"
-description = "SolveCraft file formats: designs (JSON), STL, OBJ, STEP and 3MF"
+description = "SolidCraft file formats: designs (JSON), STL, OBJ, STEP and 3MF"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/io/src/dxf.rs

@@ -90,7 +90,7 @@ pub fn read_dxf(text: &str) -> Result<Vec<Geom2>> {
         }
     }
     let mut out = Vec::new();
-    convert(&ents, k, &blocks, 0, &mut out)?;
+    convert(&ents, k, &blocks, 0, &mut out, &mut 0)?;
     Ok(out)
 }
 
@@ -120,16 +120,22 @@ fn section(p: &[(i32, String)], start: usize) -> Result<Vec<Ent>> {
 
 /// Deepest block nesting expanded.
 const MAX_BLOCK_DEPTH: usize = 16;
+/// Entities visited and array cells placed while expanding blocks. Every bound below this one
+/// is on the geometry that comes out, and a block that emits none trips none of them: N blocks
+/// that each insert the same empty block N times fan out to N^MAX_BLOCK_DEPTH visits for no
+/// output at all. This counts the work instead.
+const MAX_WORK: usize = 4 * MAX_ENTITIES;
 
 /// Entities to geometry (millimetres), expanding block references.
-fn convert(ents: &[Ent], k: f64, blocks: &HashMap<String, (Vec2, Vec<Ent>)>, depth: usize, out: &mut Vec<Geom2>) -> Result<()> {
+fn convert(ents: &[Ent], k: f64, blocks: &HashMap<String, (Vec2, Vec<Ent>)>, depth: usize, out: &mut Vec<Geom2>, work: &mut usize) -> Result<()> {
     let pt = |x: f64, y: f64| Vec2::new(x * k, y * k);
     let mut i = 0;
     while i < ents.len() {
         let Some(e) = ents.get(i) else { break };
         i += 1;
-        if out.len() > MAX_ENTITIES {
-            return Err(IoError::Invalid("too many entities".into()));
+        *work = work.saturating_add(1);
+        if out.len() > MAX_ENTITIES || *work > MAX_WORK {
+            return Err(IoError::Invalid("the drawing is too complex".into()));
         }
         // Paper space (layouts) is not the drawing.
         if e.get(67).is_some_and(|v| v != 0.0) {
@@ -142,13 +148,18 @@ fn convert(ents: &[Ent], k: f64, blocks: &HashMap<String, (Vec2, Vec<Ent>)>, dep
                     continue;
                 }
                 let mut inner = Vec::new();
-                convert(list, k, blocks, depth + 1, &mut inner)?;
+                convert(list, k, blocks, depth + 1, &mut inner, work)?;
+                if inner.is_empty() {
+                    continue;
+                }
                 let (sx, sy) = (e.get(41).unwrap_or(1.0), e.get(42).unwrap_or(1.0));
                 let rot = e.get(50).unwrap_or(0.0).to_radians();
                 let ins = pt(e.get(10).unwrap_or(0.0), e.get(20).unwrap_or(0.0));
                 let (cols, rows) = (e.get(70).unwrap_or(1.0).clamp(1.0, 10_000.0) as usize, e.get(71).unwrap_or(1.0).clamp(1.0, 10_000.0) as usize);
-                if cols.saturating_mul(rows).saturating_mul(inner.len()) > MAX_ENTITIES {
-                    return Err(IoError::Invalid("too many entities".into()));
+                let cells = cols.saturating_mul(rows);
+                *work = work.saturating_add(cells);
+                if cells > MAX_ENTITIES || cells.saturating_mul(inner.len()) > MAX_ENTITIES || *work > MAX_WORK {
+                    return Err(IoError::Invalid("the drawing is too complex".into()));
                 }
                 let (dc, dr) = (e.get(44).unwrap_or(0.0) * k, e.get(45).unwrap_or(0.0) * k);
                 for r in 0..rows {
@@ -492,4 +503,27 @@ mod tests {
         assert_eq!(read_dxf(selfref).unwrap().len(), 16);
         assert!(read_dxf("AutoCAD Binary DXF\r\n").is_err());
     }
+
+    /// Bounds on the geometry that comes out do not see a block that emits none: six
+    /// self-inserts fan out to 6^16 visits for no output. Both shapes must be refused quickly.
+    #[test]
+    fn empty_blocks_do_not_fan_out() {
+        let t = std::time::Instant::now();
+
+        let fanout = format!(
+            "0\nSECTION\n2\nBLOCKS\n0\nBLOCK\n2\nA\n{}0\nENDBLK\n0\nENDSEC\n0\nSECTION\n2\nENTITIES\n0\nINSERT\n2\nA\n0\nENDSEC\n0\nEOF\n",
+            "0\nINSERT\n2\nA\n".repeat(6)
+        );
+        assert!(read_dxf(&fanout).is_err(), "a block of six self-inserts must be refused");
+
+        // An empty block placed as a 10,000 by 10,000 array, a thousand times over.
+        let array = format!(
+            "0\nSECTION\n2\nBLOCKS\n0\nBLOCK\n2\nE\n0\nENDBLK\n0\nENDSEC\n0\nSECTION\n2\nENTITIES\n{}0\nENDSEC\n0\nEOF\n",
+            "0\nINSERT\n2\nE\n70\n10000\n71\n10000\n".repeat(1000)
+        );
+        let g = read_dxf(&array).unwrap_or_default();
+        assert!(g.is_empty(), "an empty block has no geometry to place");
+
+        assert!(t.elapsed() < std::time::Duration::from_secs(5), "took {:?}", t.elapsed());
+    }
 }

crates/io/src/lib.rs

@@ -202,7 +202,7 @@ pub fn export_mesh(b: &solvecraft_kernel::Body) -> Result<Mesh> {
 pub fn stl_binary(meshes: &[Mesh], name: &str) -> Vec<u8> {
     let n: usize = meshes.iter().map(|m| m.triangles.len()).sum();
     let mut out = Vec::with_capacity(84 + n * 50);
-    let mut header = format!("SolveCraft STL {name}").into_bytes();
+    let mut header = format!("SolidCraft STL {name}").into_bytes();
     header.resize(80, b' ');
     out.extend_from_slice(&header);
     out.extend_from_slice(&u32::try_from(n).unwrap_or(u32::MAX).to_le_bytes());
@@ -242,7 +242,7 @@ pub fn stl_ascii(meshes: &[Mesh], name: &str) -> String {
 
 /// Wavefront OBJ, one object per body.
 pub fn obj(meshes: &[(String, Mesh)]) -> String {
-    let mut s = String::from("# SolveCraft OBJ export (mm)\n");
+    let mut s = String::from("# SolidCraft OBJ export (mm)\n");
     let mut base = 1usize;
     for (name, m) in meshes {
         s += &format!("o {}\n", name.replace(char::is_whitespace, "_"));

crates/io/src/threemf.rs

@@ -211,7 +211,7 @@ pub fn model_xml(objects: &[MeshObject]) -> String {
     let mut x = String::new();
     x.push_str("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
     let _ = writeln!(x, "<model unit=\"millimeter\" xml:lang=\"en-US\" xmlns=\"{CORE_NS}\">");
-    x.push_str(" <metadata name=\"Application\">SolveCraft</metadata>\n <resources>\n");
+    x.push_str(" <metadata name=\"Application\">SolidCraft</metadata>\n <resources>\n");
     let colored = objects.iter().any(|o| o.color.is_some() || o.transparency > 0.0 || !o.looks.is_empty());
     // Base material group id 1 (each object's own colour, then its faces' colours); objects
     // from 2. A see-through colour carries its alpha (#RRGGBBAA).
@@ -528,20 +528,44 @@ fn flatten(m: &Model, id: u32, xf: &Xf, out: &mut MeshObject, stack: &mut Vec<u3
         return bad("components nested too deeply or recursive");
     }
     let o = m.objects.get(&id).ok_or_else(|| IoError::Invalid(format!("3MF: missing object {id}")))?;
-    *total += o.triangles.len();
+    *total = total.saturating_add(o.triangles.len());
     if *total > MAX_ELEMENTS {
         return bad("too many triangles after placing components");
     }
-    let base = u32::try_from(out.positions.len()).map_err(|_| IoError::Invalid("3MF: too many vertices".into()))?;
     let n = o.positions.len();
-    out.positions.extend(o.positions.iter().map(|p| apply(xf, *p) * m.unit));
+    // One object can be placed by thousands of build items and components, and each placement
+    // needs its own transformed copy of the vertices. Copying only the vertices the triangles
+    // reach keeps that cost tied to the triangle budget above; copying the whole vertex array
+    // let an object with many vertices and one triangle multiply into tens of gigabytes.
+    let mut used: Vec<u32> = o.triangles.iter().flatten().copied().collect();
+    used.sort_unstable();
+    used.dedup();
+    if used.last().is_some_and(|v| *v as usize >= n) {
+        return bad(format!("object {id}: triangle refers to a missing vertex"));
+    }
+    let base = u32::try_from(out.positions.len()).map_err(|_| IoError::Invalid("3MF: too many vertices".into()))?;
+    if base as usize + used.len() > u32::MAX as usize {
+        return bad("too many vertices");
+    }
+    for v in &used {
+        let Some(p) = o.positions.get(*v as usize) else {
+            return bad(format!("object {id}: triangle refers to a missing vertex"));
+        };
+        out.positions.push(apply(xf, *p) * m.unit);
+    }
+    // Vertices keep their relative order, so a mesh whose triangles use all of them is
+    // numbered exactly as it was in the file.
+    let at = |v: u32| used.binary_search(&v).ok().map(|i| base + i as u32);
     let flip = det(xf) < 0.0;
     for t in &o.triangles {
-        if t.iter().any(|v| *v as usize >= n) {
-            return bad(format!("object {id}: triangle refers to a missing vertex"));
+        let mut q = [0u32; 3];
+        for (slot, v) in q.iter_mut().zip(t) {
+            let Some(i) = at(*v) else {
+                return bad(format!("object {id}: triangle refers to a missing vertex"));
+            };
+            *slot = i;
         }
-        let t = t.map(|v| v + base);
-        out.triangles.push(if flip { [t[0], t[2], t[1]] } else { t });
+        out.triangles.push(if flip { [q[0], q[2], q[1]] } else { q });
     }
     if out.color.is_none() {
         out.color = o.material.and_then(|(g, i)| m.materials.get(&g).and_then(|g| g.get(i).copied().flatten()));
@@ -734,4 +758,41 @@ mod tests {
                 .is_err()
         );
     }
+
+    /// Every placement needs its own transformed copy of the vertices, so an object with many
+    /// vertices and one triangle used to cost its whole vertex array per build item: 100k
+    /// vertices times 10,000 items asked for about 140 GB and the process aborted on the
+    /// allocation, which no panic guard can intercept.
+    #[test]
+    fn many_placements_of_a_big_object_stay_bounded() {
+        let t = std::time::Instant::now();
+        let verts: String = (0..100_000).map(|i| format!("<vertex x=\"{}\" y=\"{}\" z=\"0\"/>", i % 100, i / 100)).collect();
+        let model = format!(
+            "{}<object id=\"1\" type=\"model\"><mesh><vertices>{verts}</vertices>\
+             <triangles><triangle v1=\"0\" v2=\"1\" v3=\"2\"/></triangles></mesh></object></resources><build>{}</build></model>",
+            r#"<model unit="millimeter" xmlns="http://schemas.microsoft.com/3dmanufacturing/core/2015/02"><resources>"#,
+            "<item objectid=\"1\"/>".repeat(10_000)
+        );
+        let (objs, _) = read_3mf(&package(&model, None)).unwrap();
+        assert_eq!(objs.len(), 10_000);
+        // Only the three vertices the one triangle reaches are copied per placement.
+        assert!(objs.iter().all(|o| o.positions.len() == 3 && o.triangles.len() == 1), "{:?}", objs.first().map(|o| o.positions.len()));
+        assert!(t.elapsed() < std::time::Duration::from_secs(30), "took {:?}", t.elapsed());
+    }
+
+    /// Triangles are budgeted across every placement, so fan-out cannot outrun the cap.
+    #[test]
+    fn placements_share_the_triangle_budget() {
+        let verts: String = (0..30_000).map(|i| format!("<vertex x=\"{}\" y=\"0\" z=\"0\"/>", i % 100)).collect();
+        let tris: String = (0..10_000).map(|i| format!("<triangle v1=\"{}\" v2=\"{}\" v3=\"{}\"/>", 3 * i, 3 * i + 1, 3 * i + 2)).collect();
+        let model = format!(
+            "{}<object id=\"1\" type=\"model\"><mesh><vertices>{verts}</vertices><triangles>{tris}</triangles></mesh></object>\
+             </resources><build>{}</build></model>",
+            r#"<model unit="millimeter" xmlns="http://schemas.microsoft.com/3dmanufacturing/core/2015/02"><resources>"#,
+            "<item objectid=\"1\"/>".repeat(4_000)
+        );
+        let (objs, warnings) = read_3mf(&package(&model, None)).unwrap();
+        assert!(objs.len() < 4_000, "the shared budget must stop the later items: {} built", objs.len());
+        assert!(warnings.iter().any(|w| w.contains("too many triangles")), "{warnings:?}");
+    }
 }

crates/io/src/vfs.rs

@@ -9,8 +9,30 @@ use std::io::{Error, ErrorKind, Result};
 mod imp {
     use super::*;
 
-    pub fn read(path: &str) -> Result<Vec<u8>> {
-        std::fs::read(path)
+    /// At most `max` bytes of a regular file. A character device such as `/dev/zero` reports a
+    /// length of 0, so checking the metadata and then reading to the end is unbounded; a FIFO
+    /// blocks the caller instead. Refuse anything that is not a regular file, and never read
+    /// more than the caller's cap plus the byte that proves it was exceeded.
+    pub fn read(path: &str, max: usize) -> Result<Vec<u8>> {
+        // Cheap and non-blocking: refuse before opening, in case the open itself would block.
+        let meta = std::fs::metadata(path)?;
+        if !meta.is_file() {
+            return Err(Error::new(ErrorKind::InvalidInput, "not a regular file"));
+        }
+        if meta.len() > max as u64 {
+            return Err(Error::new(ErrorKind::InvalidData, "file too large"));
+        }
+        let f = std::fs::File::open(path)?;
+        // The path may have been swapped between the two calls; the handle decides.
+        if !f.metadata()?.is_file() {
+            return Err(Error::new(ErrorKind::InvalidInput, "not a regular file"));
+        }
+        let mut out = Vec::with_capacity(meta.len().min(16 << 20) as usize);
+        std::io::Read::read_to_end(&mut std::io::Read::take(f, max as u64 + 1), &mut out)?;
+        if out.len() > max {
+            return Err(Error::new(ErrorKind::InvalidData, "file too large"));
+        }
+        Ok(out)
     }
     pub fn write(path: &str, bytes: &[u8]) -> Result<()> {
         std::fs::write(path, bytes)
@@ -42,8 +64,13 @@ mod imp {
         Error::new(ErrorKind::NotFound, format!("{path}: no such file in this browser"))
     }
 
-    pub fn read(path: &str) -> Result<Vec<u8>> {
-        FILES.with(|f| f.borrow().get(path).cloned()).ok_or_else(|| missing(path))
+    /// At most `max` bytes, to match the native signature.
+    pub fn read(path: &str, max: usize) -> Result<Vec<u8>> {
+        let bytes = FILES.with(|f| f.borrow().get(path).cloned()).ok_or_else(|| missing(path))?;
+        if bytes.len() > max {
+            return Err(Error::new(ErrorKind::InvalidData, "file too large"));
+        }
+        Ok(bytes)
     }
     pub fn write(path: &str, bytes: &[u8]) -> Result<()> {
         FILES.with(|f| f.borrow_mut().insert(path.to_string(), bytes.to_vec()));
@@ -77,9 +104,9 @@ mod imp {
 
 pub use imp::*;
 
-/// A file's text.
-pub fn read_to_string(path: &str) -> Result<String> {
-    String::from_utf8(read(path)?).map_err(|e| Error::new(ErrorKind::InvalidData, e))
+/// A file's text, at most `max` bytes.
+pub fn read_to_string(path: &str, max: usize) -> Result<String> {
+    String::from_utf8(read(path, max)?).map_err(|e| Error::new(ErrorKind::InvalidData, e))
 }
 
 #[cfg(test)]
@@ -90,13 +117,50 @@ mod tests {
         let _ = std::fs::create_dir_all(&dir);
         let p = dir.join("a.txt").to_string_lossy().to_string();
         assert!(!super::exists(&p));
-        assert!(super::read(&p).is_err());
+        assert!(super::read(&p, 16).is_err());
         super::write(&p, b"hello").unwrap();
         assert!(super::exists(&p));
         assert_eq!(super::len(&p).unwrap(), 5);
-        assert_eq!(super::read_to_string(&p).unwrap(), "hello");
+        assert_eq!(super::read_to_string(&p, 16).unwrap(), "hello");
+        // The cap is the caller's, not the file's.
+        assert!(super::read(&p, 4).is_err());
+        assert_eq!(super::read(&p, 5).unwrap(), b"hello");
         super::remove(&p).unwrap();
         assert!(!super::exists(&p));
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    /// `metadata().len()` is 0 for a character device and for a FIFO, so a cap checked against
+    /// it passes and the read then runs to an end that never comes. Refuse what is not a
+    /// regular file, and do it before opening: opening a FIFO blocks until a writer appears.
+    #[cfg(all(unix, not(target_arch = "wasm32")))]
+    #[test]
+    fn special_files_are_refused_without_blocking() {
+        let e = super::read("/dev/zero", 1024).unwrap_err();
+        assert!(e.to_string().contains("not a regular file"), "{e}");
+        assert!(super::read_to_string("/dev/zero", 1024).is_err());
+
+        let dir = std::env::temp_dir().join(format!("solvecraft-vfs-fifo-{}", std::process::id()));
+        let _ = std::fs::create_dir_all(&dir);
+        let fifo = dir.join("p");
+        let made = std::process::Command::new("mkfifo").arg(&fifo).status().map(|s| s.success()).unwrap_or(false);
+        if made {
+            let path = fifo.to_string_lossy().to_string();
+            let (tx, rx) = std::sync::mpsc::channel();
+            std::thread::spawn(move || {
+                let _ = tx.send(super::read(&path, 1024).is_err());
+            });
+            let refused = rx.recv_timeout(std::time::Duration::from_secs(5));
+            assert_eq!(refused, Ok(true), "reading a FIFO must be refused, not block");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A directory is not a file either.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn directories_are_not_files() {
+        let dir = std::env::temp_dir().to_string_lossy().to_string();
+        assert!(super::read(&dir, 1024).is_err());
+    }
 }

crates/kernel/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-kernel"
-description = "SolveCraft B-rep kernel boundary: solids, extrude/revolve/booleans/fillets, tessellation, measures and STEP, behind our own API (implemented with truck)"
+description = "SolidCraft B-rep kernel boundary: solids, extrude/revolve/booleans/fillets, tessellation, measures and STEP, behind our own API (implemented with truck)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/kernel/src/body.rs

@@ -5,6 +5,10 @@ use truck_modeling as mt;
 
 use crate::{KernelError, Result, guard};
 
+#[path = "planar_regularize.rs"]
+mod planar_regularize;
+#[path = "planar_sources.rs"]
+mod planar_sources;
 #[path = "shell_groups.rs"]
 mod shell_groups;
 
@@ -29,15 +33,18 @@ pub struct Body {
     pub(crate) splits: Option<std::sync::Arc<Vec<Vec<Vec3>>>>,
     /// Exact construction/import source identities, in this body's face order.
     pub(crate) face_sources: Option<std::sync::Arc<Vec<Option<FaceSource>>>>,
+    /// Sticky transient veto: authored face boundaries must survive later rebuilds.
+    pub(crate) regularization_protected: bool,
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub enum FaceSource {
-    ExtrudeSide { segment: solvecraft_geom::Seg2, plane: Option<solvecraft_geom::Plane> },
+    ExtrudeSide { segment: solvecraft_geom::Seg2, plane: Option<solvecraft_geom::Plane>, coalesced: bool },
     CertifiedExtrudeSide { producer: u64, sketch: u64, curve: String, plane: Option<solvecraft_geom::Plane> },
     ExtrudeCap { high: bool, region: solvecraft_geom::Region2, plane: solvecraft_geom::Plane },
     CertifiedExtrudeCap { producer: u64, sketch: u64, high: bool, outer: Vec<String>, holes: Vec<Vec<String>>, plane: solvecraft_geom::Plane },
     Box { producer: Option<u64>, axis: u8, high: bool, plane: solvecraft_geom::Plane },
+    ShellPlanar { producer: Option<u64>, source: Box<FaceSource>, inner: bool, plane: solvecraft_geom::Plane },
     Imported { item: u64, face: u64, payload_sha256: Option<String>, producer: Option<u64> },
 }
 
@@ -48,7 +55,9 @@ impl FaceSource {
     fn plane_mut(&mut self) -> Option<&mut solvecraft_geom::Plane> {
         match self {
             Self::ExtrudeSide { plane, .. } | Self::CertifiedExtrudeSide { plane, .. } => plane.as_mut(),
-            Self::ExtrudeCap { plane, .. } | Self::CertifiedExtrudeCap { plane, .. } | Self::Box { plane, .. } => Some(plane),
+            Self::ExtrudeCap { plane, .. } | Self::CertifiedExtrudeCap { plane, .. } | Self::Box { plane, .. } | Self::ShellPlanar { plane, .. } => {
+                Some(plane)
+            }
             Self::Imported { .. } => None,
         }
     }
@@ -113,6 +122,11 @@ fn mesh_shells(solid: &Solid, tol: f64) -> Vec<MeshedShell> {
 /// `None` when nothing needs splitting or the parameters don't match the surface.
 #[allow(clippy::type_complexity)]
 fn refined(pm: &PolygonMesh, surf: &mt::Surface, tol: f64) -> Option<Vec<[(Vec3, Vec3); 3]>> {
+    refined_with_cache(pm, surf, tol, true)
+}
+
+#[allow(clippy::type_complexity)]
+fn refined_with_cache(pm: &PolygonMesh, surf: &mt::Surface, tol: f64, memoize: bool) -> Option<Vec<[(Vec3, Vec3); 3]>> {
     use mt::{ParametricSurface, ParametricSurface3D};
     let (pos, uvs, nor) = (pm.positions(), pm.uv_coords(), pm.normals());
     if uvs.is_empty() {
@@ -141,6 +155,15 @@ fn refined(pm: &PolygonMesh, surf: &mt::Surface, tol: f64) -> Option<Vec<[(Vec3,
     // Edges on the face's boundary are shared with the next face: never split them.
     let k = |x: &V| ((x.1.0 * 1e9).round() as i64, (x.1.1 * 1e9).round() as i64);
     let ek = |a: &V, b: &V| if k(a) < k(b) { (k(a), k(b)) } else { (k(b), k(a)) };
+    // Only exact finite values identify reusable evaluations. In particular,
+    // the rounded UV keys used for boundary incidence cannot identify a point
+    // whose derivatives or midpoint may be reused.
+    let vertex_key = |v: &V| {
+        let values = [v.0.x, v.0.y, v.0.z, v.1.0, v.1.1, v.2.x, v.2.y, v.2.z];
+        values.iter().all(|x| x.is_finite()).then(|| values.map(f64::to_bits))
+    };
+    let cache_limit = cap * 3;
+    let mut singular_cache = std::collections::HashMap::<(u64, u64), bool>::new();
     let mut changed = false;
     for _ in 0..4 {
         let mut uses: std::collections::HashMap<((i64, i64), (i64, i64)), u32> = std::collections::HashMap::new();
@@ -149,34 +172,60 @@ fn refined(pm: &PolygonMesh, surf: &mt::Surface, tol: f64) -> Option<Vec<[(Vec3,
                 *uses.entry(e).or_default() += 1;
             }
         }
-        let at = |a: &V, b: &V| -> Option<V> {
-            if uses.get(&ek(a, b)).copied().unwrap_or(0) < 2 {
-                return None;
+        let mut edge_cache = std::collections::HashMap::<([u64; 8], [u64; 8]), Option<V>>::new();
+        let mut at = |a: &V, b: &V| -> Option<V> {
+            let key = if memoize { vertex_key(a).zip(vertex_key(b)).map(|(a, b)| if a < b { (a, b) } else { (b, a) }) } else { None };
+            if let Some(key) = key
+                && let Some(value) = edge_cache.get(&key)
+            {
+                return *value;
             }
-            // Not at a degenerate point (a cone's apex: its parameters there are arbitrary).
-            let singular = |x: &V| {
-                let (du, dv) = (surf.uder(x.1.0, x.1.1), surf.vder(x.1.0, x.1.1));
-                let c = du.cross(dv);
-                c.x * c.x + c.y * c.y + c.z * c.z
-                    <= 1e-12 * (du.x * du.x + du.y * du.y + du.z * du.z + dv.x * dv.x + dv.y * dv.y + dv.z * dv.z).powi(2) + 1e-300
+            let mut calculate = || -> Option<V> {
+                if uses.get(&ek(a, b)).copied().unwrap_or(0) < 2 {
+                    return None;
+                }
+                // Not at a degenerate point (a cone's apex: its parameters there are arbitrary).
+                let mut singular = |x: &V| {
+                    let key = (x.1.0.to_bits(), x.1.1.to_bits());
+                    let cacheable = memoize && x.1.0.is_finite() && x.1.1.is_finite();
+                    if cacheable && let Some(value) = singular_cache.get(&key) {
+                        return *value;
+                    }
+                    let (du, dv) = (surf.uder(x.1.0, x.1.1), surf.vder(x.1.0, x.1.1));
+                    let c = du.cross(dv);
+                    let value = c.x * c.x + c.y * c.y + c.z * c.z
+                        <= 1e-12 * (du.x * du.x + du.y * du.y + du.z * du.z + dv.x * dv.x + dv.y * dv.y + dv.z * dv.z).powi(2) + 1e-300;
+                    if cacheable && singular_cache.len() < cache_limit {
+                        singular_cache.insert(key, value);
+                    }
+                    value
+                };
+                if singular(a) || singular(b) {
+                    return None;
+                }
+                let (u, v) = ((a.1.0 + b.1.0) / 2.0, (a.1.1 + b.1.1) / 2.0);
+                let q = from_p3(surf.subs(u, v));
+                // Within tolerance, or so far off that the parameters wrapped (a seam).
+                let sag = q.dist((a.0 + b.0) * 0.5);
+                if sag <= tol || sag >= 0.5 * a.0.dist(b.0) {
+                    return None;
+                }
+                let n = surf.normal(u, v);
+                let mut n = Vec3::new(n.x, n.y, n.z);
+                // Keep the mesh's normal side.
+                if n.dot(a.2 + b.2) < 0.0 {
+                    n = -n;
+                }
+                Some((q, (u, v), n))
             };
-            if singular(a) || singular(b) {
-                return None;
+            let value = calculate();
+            if let Some(key) = key
+                && edge_cache.len() < cache_limit
+                && value.is_none_or(|v| vertex_key(&v).is_some())
+            {
+                edge_cache.insert(key, value);
             }
-            let (u, v) = ((a.1.0 + b.1.0) / 2.0, (a.1.1 + b.1.1) / 2.0);
-            let q = from_p3(surf.subs(u, v));
-            // Within tolerance, or so far off that the parameters wrapped (a seam).
-            let sag = q.dist((a.0 + b.0) * 0.5);
-            if sag <= tol || sag >= 0.5 * a.0.dist(b.0) {
-                return None;
-            }
-            let n = surf.normal(u, v);
-            let mut n = Vec3::new(n.x, n.y, n.z);
-            // Keep the mesh's normal side.
-            if n.dot(a.2 + b.2) < 0.0 {
-                n = -n;
-            }
-            Some((q, (u, v), n))
+            value
         };
         let mut next = Vec::with_capacity(tris.len());
         let mut any = false;
@@ -313,6 +362,7 @@ impl Body {
             && self.paint == other.paint
             && self.splits == other.splits
             && self.face_sources == other.face_sources
+            && self.regularization_protected == other.regularization_protected
     }
 
     pub(crate) fn new(solid: Solid) -> Result<Body> {
@@ -351,13 +401,25 @@ impl Body {
             paint: None,
             splits: None,
             face_sources: None,
+            regularization_protected: false,
         })
     }
 
+    pub(crate) fn inherit_regularization_protection(mut self, input: &Body) -> Self {
+        self.regularization_protected |= input.regularization_protected;
+        self
+    }
+
     pub fn face_sources(&self) -> Option<&[Option<FaceSource>]> {
         self.face_sources.as_deref().map(Vec::as_slice)
     }
 
+    /// A current wall reconstructed from an exact contiguous section run.
+    /// This transient witness grants no durable source/producer identity.
+    pub fn face_was_coalesced(&self, index: usize) -> bool {
+        matches!(self.face_sources().and_then(|s| s.get(index)), Some(Some(FaceSource::ExtrudeSide { coalesced: true, .. })))
+    }
+
     /// An exact construction/import plane; never inferred from tessellation.
     pub fn face_plane(&self, index: usize) -> Option<solvecraft_geom::Plane> {
         if index >= 50_000 {
@@ -366,7 +428,10 @@ impl Body {
         let source = self.face_sources()?.get(index)?.as_ref()?;
         match source {
             FaceSource::ExtrudeSide { plane, .. } | FaceSource::CertifiedExtrudeSide { plane, .. } => *plane,
-            FaceSource::ExtrudeCap { plane, .. } | FaceSource::CertifiedExtrudeCap { plane, .. } | FaceSource::Box { plane, .. } => Some(*plane),
+            FaceSource::ExtrudeCap { plane, .. }
+            | FaceSource::CertifiedExtrudeCap { plane, .. }
+            | FaceSource::Box { plane, .. }
+            | FaceSource::ShellPlanar { plane, .. } => Some(*plane),
             FaceSource::Imported { .. } => self.planar_face(index),
         }
     }
@@ -572,6 +637,7 @@ impl Body {
     /// The same body with the lines its faces were split along on purpose.
     pub fn with_split_lines(mut self, s: Option<std::sync::Arc<Vec<Vec<Vec3>>>>) -> Body {
         self.splits = s.filter(|l| !l.is_empty());
+        self.regularization_protected |= self.splits.is_some();
         self
     }
 
@@ -596,6 +662,7 @@ impl Body {
             })
             .filter(|p| p.opacity < 1.0 || !p.faces.is_empty())
             .map(std::sync::Arc::new);
+        self.regularization_protected |= self.paint().is_some_and(|paint| !paint.faces.is_empty());
         self
     }
 
@@ -642,11 +709,15 @@ impl Body {
                 let flip = !face.orientation();
                 let base = u32::try_from(out.positions.len()).unwrap_or(u32::MAX);
                 // Curved faces: split triangles that cut through the surface.
-                if refine
-                    && let Some(sf) = solid_faces.get(fi)
-                    && !matches!(sf.surface(), mt::Surface::Plane(_))
-                    && let Some(tris) = refined(&pm, &sf.surface(), tol)
-                {
+                let refinement = if refine {
+                    solid_faces.get(fi).and_then(|sf| {
+                        let surface = sf.surface();
+                        if matches!(surface, mt::Surface::Plane(_)) { None } else { refined(&pm, &surface, tol) }
+                    })
+                } else {
+                    None
+                };
+                if let Some(tris) = refinement {
                     let fid = u32::try_from(fi).unwrap_or(u32::MAX);
                     for t in tris {
                         let mut idx = [0u32; 3];
@@ -884,6 +955,15 @@ impl Body {
         self.lumps_with_clearance(0.0)
     }
 
+    /// Whether this body and `other` share material or touch (within a fine mesh tolerance).
+    pub fn meets(&self, other: &Body) -> Result<bool> {
+        self.require_brep("contact test")?;
+        other.require_brep("contact test")?;
+        let tol = (self.size().max(other.size()) * 1e-4).max(1e-6);
+        let (a, b) = (self.tessellate(tol)?, other.tessellate(tol)?);
+        shell_groups::meshes_meet(&a, &b, 2.0 * tol)
+    }
+
     /// A boolean shortcut needs clearance larger than both shell mesh deflections.
     pub(crate) fn separated_lumps(&self) -> Result<Vec<Body>> {
         self.lumps_with_clearance(4.0 * (self.size() * 1e-3).max(1e-3))
@@ -994,7 +1074,7 @@ impl Body {
                             })
                             .collect()
                     });
-                    Ok(result.with_face_sources(sources.map(std::sync::Arc::new)))
+                    Ok(result.with_face_sources(sources.map(std::sync::Arc::new)).inherit_regularization_protection(self))
                 })
                 .collect()
         })
@@ -1004,3 +1084,11 @@ impl Body {
 #[cfg(test)]
 #[path = "body_lump_tests.rs"]
 mod lump_tests;
+
+#[cfg(test)]
+#[path = "refine_cache_tests.rs"]
+mod refine_cache_tests;
+
+#[cfg(test)]
+#[path = "regularization_protection_tests.rs"]
+mod regularization_protection_tests;

crates/kernel/src/build.rs

@@ -179,7 +179,7 @@ pub fn extrude(plane: &Plane, regions: &[Region2], start: f64, end: f64) -> Resu
                             }
                             _ => None,
                         };
-                        Some(crate::FaceSource::ExtrudeSide { segment: **segment, plane: basis })
+                        Some(crate::FaceSource::ExtrudeSide { segment: **segment, plane: basis, coalesced: false })
                     } else {
                         None
                     };

crates/kernel/src/face_source_tests.rs

@@ -116,18 +116,32 @@ fn construction_planes_follow_reflected_and_sheared_affine_images() {
 }
 
 #[test]
-fn material_changes_discard_producer_certificates() {
+fn material_changes_preserve_only_unchanged_planar_support_certificates() {
     let base = crate::box_solid(Vec3::ZERO, Vec3::new(10., 10., 10.)).unwrap().with_box_certificate(42).unwrap();
     let tool = crate::box_solid(Vec3::new(5., -1., -1.), Vec3::new(11., 11., 11.)).unwrap();
     let cut = crate::boolean(&base, &tool, crate::BoolOp::Cut).unwrap().unwrap();
     assert!((cut.tessellate(1e-4).unwrap().measure().volume - 500.).abs() < 1e-8);
-    assert!(cut.face_sources().into_iter().flatten().flatten().all(|source| matches!(
-        source,
-        FaceSource::ExtrudeSide { .. }
-            | FaceSource::ExtrudeCap { .. }
-            | FaceSource::Box { producer: None, .. }
-            | FaceSource::Imported { producer: None, .. }
-    )));
+    // Unchanged uniquely certified supports retain their role; a newly cut
+    // support must never inherit the removed opposite wall's source identity.
+    let mut retained = 0;
+    let mut new_wall = 0;
+    for index in 0..cut.face_count() {
+        let actual = cut.planar_face(index).unwrap();
+        let source = cut.face_sources().and_then(|s| s.get(index)).and_then(Option::as_ref);
+        if let Some(FaceSource::Box { producer: Some(42), axis, high, .. }) = source {
+            assert!(!(*axis == 0 && *high));
+            let canonical = cut.face_plane(index).unwrap();
+            assert!(actual.normal().dot(canonical.normal()) > 1. - 1e-10);
+            assert!(actual.height(canonical.origin).abs() < 1e-10);
+            retained += 1;
+        }
+        if actual.normal().x > 0.9 {
+            assert!((actual.origin.x - 5.).abs() < 1e-10);
+            assert!(!matches!(source, Some(FaceSource::Box { producer: Some(_), .. })));
+            new_wall += 1;
+        }
+    }
+    assert_eq!((retained, new_wall), (5, 1));
 }
 
 #[test]

crates/kernel/src/iges_in.rs

@@ -14,6 +14,12 @@ pub const MAX_IGES_BYTES: usize = 512 << 20;
 const MAX_ENTITIES: usize = 2_000_000;
 const MAX_DEPTH: usize = 32;
 const MAX_LIST: usize = 1_000_000;
+/// Entities visited and segments produced while expanding model curves. A composite curve
+/// (102) lists its children by pointer, and nothing stops a tree whose every node names the
+/// same child twice: 30 levels under the depth cap is 2^30 leaf visits and about 160 GB of
+/// segments. The depth cap alone does not see fan-out, and a node that produces no segment
+/// trips no output bound, so the visits are counted too.
+const MAX_CURVE_WORK: usize = 4 * MAX_ENTITIES;
 
 type R<T> = Result<T, String>;
 type V3 = [f64; 3];
@@ -249,7 +255,16 @@ fn parse(text: &str) -> R<Iges> {
         des.insert(2 * k + 1, de);
     }
     let mut params = HashMap::new();
+    // Nothing stops thousands of directory entries from naming the same parameter range, and
+    // each one materialises that range as its own string and token list. Keep the total text
+    // proportional to the parameter section the file actually carries.
+    let max_lines = p_lines.len().saturating_mul(4).saturating_add(1024);
+    let mut lines_used = 0usize;
     for (seq, de) in &des {
+        lines_used = lines_used.saturating_add(de.lines.max(1));
+        if lines_used > max_lines {
+            return Err("the file's parameter data is too large".into());
+        }
         let mut s = String::new();
         for l in de.pd..de.pd.saturating_add(de.lines.max(1)) {
             // Columns 1–64 run on (a long string may continue on the next line).
@@ -368,6 +383,10 @@ struct Tr<'a> {
     /// Sewing tolerance (mm).
     tol: f64,
     surf_cache: HashMap<(usize, [u64; 12]), u64>,
+    /// Entities visited and segments produced while expanding curves (see `MAX_CURVE_WORK`).
+    curve_work: usize,
+    /// Composite curves (102) on the path being expanded.
+    composites: Vec<i64>,
 }
 
 fn xf_key(x: &Xf) -> [u64; 12] {
@@ -442,6 +461,19 @@ impl<'a> Tr<'a> {
         if depth > MAX_DEPTH {
             return Err("curves nested too deeply".into());
         }
+        self.curve_work = self.curve_work.saturating_add(1);
+        if self.curve_work > MAX_CURVE_WORK {
+            return Err("the file's curves are too complex".into());
+        }
+        let out = self.curve_parts(seq, xf, depth)?;
+        self.curve_work = self.curve_work.saturating_add(out.len());
+        if self.curve_work > MAX_CURVE_WORK {
+            return Err("a curve has too many segments".into());
+        }
+        Ok(out)
+    }
+
+    fn curve_parts(&mut self, seq: i64, xf: &Xf, depth: usize) -> R<Vec<Seg>> {
         let de = self.de(seq)?;
         let x = xf.then(&self.own_xf(seq, 0)?);
         match de.typ {
@@ -479,13 +511,23 @@ impl<'a> Tr<'a> {
                 Ok(vec![Seg::along(cid, |t| at(a0 + (a1 - a0) * t))])
             }
             102 => {
+                // A composite curve that contains itself, directly or through another, would
+                // expand until the depth cap; refusing it on the way down is clearer.
+                if self.composites.contains(&seq) {
+                    return Err(format!("entity {seq}: composite curve contains itself"));
+                }
                 let n = self.i(seq, 1)?.clamp(0, MAX_LIST as i64) as usize;
                 let mut out = Vec::new();
-                for k in 0..n {
-                    let s = self.i(seq, 2 + k)?;
-                    out.extend(self.curve(s, &x, depth + 1)?);
-                }
-                Ok(out)
+                self.composites.push(seq);
+                let r = (|| {
+                    for k in 0..n {
+                        let s = self.i(seq, 2 + k)?;
+                        out.extend(self.curve(s, &x, depth + 1)?);
+                    }
+                    Ok(out)
+                })();
+                self.composites.pop();
+                r
             }
             126 => {
                 let nb = self.nurbs_curve(seq, &x)?;
@@ -833,7 +875,9 @@ struct Sewer {
 
 impl Sewer {
     fn vertex(&mut self, p: V3) -> usize {
-        let c = |x: f64| (x / self.tol).floor() as i64;
+        // Neighbouring buckets are this key plus or minus one, so leave room for that: a
+        // coordinate near f64's range saturates the cast and the addition would overflow.
+        let c = |x: f64| (x / self.tol).floor().clamp(-9e15, 9e15) as i64;
         let key = [c(p[0]), c(p[1]), c(p[2])];
         for dx in -1..=1 {
             for dy in -1..=1 {
@@ -1008,13 +1052,23 @@ fn write_shell(o: &mut Out, sw: &Sewer, faces: &[FaceB], styles: &mut Vec<(u64,
 }
 
 /// IGES text restated as a STEP exchange (millimetres), with what could not be read.
+/// This was the one importer stage outside every panic guard, so a panic here reached the CLI
+/// and the wasm build, where nothing catches it.
 pub fn iges_to_step(text: &str) -> std::result::Result<(String, Vec<String>), String> {
+    crate::guard("IGES import", || translate(text).map_err(crate::KernelError::Invalid)).map_err(|e| match e {
+        crate::KernelError::Invalid(m) => m,
+        other => other.to_string(),
+    })
+}
+
+fn translate(text: &str) -> std::result::Result<(String, Vec<String>), String> {
     if text.len() > MAX_IGES_BYTES {
         return Err("IGES file too large".into());
     }
     let f = parse(text)?;
     let tol = (f.resolution * f.unit).clamp(1e-6, 0.05).max(1e-5);
-    let mut t = Tr { f: &f, o: Out { lines: Vec::new() }, warnings: Vec::new(), tol, surf_cache: HashMap::new() };
+    let mut t =
+        Tr { f: &f, o: Out { lines: Vec::new() }, warnings: Vec::new(), tol, surf_cache: HashMap::new(), curve_work: 0, composites: Vec::new() };
     // Header: units and context.
     let mm = t.o.add("(LENGTH_UNIT()NAMED_UNIT(*)SI_UNIT(.MILLI.,.METRE.))");
     let rad = t.o.add("(NAMED_UNIT(*)PLANE_ANGLE_UNIT()SI_UNIT($,.RADIAN.))");
@@ -1110,7 +1164,7 @@ pub fn iges_to_step(text: &str) -> std::result::Result<(String, Vec<String>), St
         t.o.add(format!("STYLED_ITEM('color',(#{psa}),#{item})"));
     }
     let mut s = String::from(
-        "ISO-10303-21;\nHEADER;\nFILE_DESCRIPTION(('IGES import'),'2;1');\nFILE_NAME('','',(''),(''),'SolveCraft IGES','','');\nFILE_SCHEMA(('AUTOMOTIVE_DESIGN'));\nENDSEC;\nDATA;\n",
+        "ISO-10303-21;\nHEADER;\nFILE_DESCRIPTION(('IGES import'),'2;1');\nFILE_NAME('','',(''),(''),'SolidCraft IGES','','');\nFILE_SCHEMA(('AUTOMOTIVE_DESIGN'));\nENDSEC;\nDATA;\n",
     );
     for (i, l) in t.o.lines.iter().enumerate() {
         let _ = writeln!(s, "#{}={l};", i + 1);

crates/kernel/src/iges_in/tests.rs

@@ -157,3 +157,55 @@ fn a_drill_point_round_trips_through_iges() {
     assert!(rel(measure(&drilled).unwrap().volume, v) < 1e-3);
     round_trip(&drilled);
 }
+
+/// A composite curve (102) names its children by pointer, and nothing stops a tree whose every
+/// node names the same child twice. Twenty levels under the depth cap is a million leaf visits
+/// and thirty is 2^30; only counting the work sees that, because the depth never grows past the
+/// cap and a node that yields no segment trips no bound on the output.
+#[test]
+fn composite_curve_fan_out_is_bounded() {
+    let quad = |z: f64| {
+        let c = [[0.0, 0.0, z], [10.0, 0.0, z], [10.0, 20.0, z], [0.0, 20.0, z]];
+        let fmt = |p: [f64; 3]| format!("{:?},{:?},{:?}", p[0], p[1], p[2]);
+        format!("1,1,1,1,0,0,1,0,0,0.,0.,1.,1.,0.,0.,1.,1.,1.,1.,1.,1.,{},{},{},{},0.,1.,0.,1.", fmt(c[0]), fmt(c[1]), fmt(c[3]), fmt(c[2]))
+    };
+    let mut ents: Vec<(i64, i64, String)> = vec![(128, 0, quad(0.0)), (110, 0, "0.,0.,0.,10.,0.,0.".into())];
+    let (surface, mut child) = (1, 3);
+    // Twenty composites, each naming the one below it twice.
+    for _ in 0..20 {
+        ents.push((102, 0, format!("2,{child},{child}")));
+        child = 2 * ents.len() - 1;
+    }
+    ents.push((142, 0, format!("0,{surface},0,{child},2")));
+    let cos = 2 * ents.len() - 1;
+    ents.push((144, 0, format!("{surface},1,0,{cos}")));
+
+    let reported = match iges_to_step(&iges_file(&ents)) {
+        Ok((_, warnings)) => warnings.join(" "),
+        Err(error) => error,
+    };
+    // Check the work-budget rejection, not elapsed time: CI runs test binaries concurrently.
+    assert!(reported.contains("too complex") || reported.contains("too many segments"), "{reported}");
+}
+
+/// Nothing stops directory entries from all naming the same parameter range, and each one
+/// materialises it as its own string and token list. Ten thousand entries over a million
+/// shared lines retained about a gigabyte each.
+#[test]
+fn directory_entries_cannot_share_their_way_past_the_file_size() {
+    let mut out = vec![format!("{:<72}S{:>7}", "test", 1), format!("{:<72}G{:>7}", "1H,,1H;,,,,,,,,,,,1.,2,2HMM,,,,1.E-6;", 1)];
+    // 1,000 entries, each claiming the same 2,000 parameter lines.
+    for k in 0..1_000 {
+        out.push(format!("{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}D{:>7}", 110, 1, 0, 0, 0, 0, 0, 0, "00000000", 2 * k + 1));
+        out.push(format!("{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}{:>8}D{:>7}", 110, 0, 0, 2_000, 0, 0, 0, "", 0, 2 * k + 2));
+    }
+    for i in 0..2_000 {
+        out.push(format!("{:<64}{:>8}P{:>7}", "0.,0.,0.,1.,0.,0.;", 1, i + 1));
+    }
+    out.push(format!("{:<72}T{:>7}", "", 1));
+
+    let t = std::time::Instant::now();
+    let error = iges_to_step(&out.join("\n")).unwrap_err();
+    assert!(error.contains("parameter data is too large"), "{error}");
+    assert!(t.elapsed() < std::time::Duration::from_secs(10), "took {:?}", t.elapsed());
+}

crates/kernel/src/iges_out.rs

@@ -609,7 +609,7 @@ fn layout(w: &W, header: &StepHeader, max_coord: f64) -> String {
     let line = |out: &mut String, data: &str, sect: char, seq: usize| {
         let _ = writeln!(out, "{data:<72}{sect}{seq:>7}");
     };
-    line(&mut out, "SolveCraft IGES export", 'S', 1);
+    line(&mut out, "SolidCraft IGES export", 'S', 1);
     let stamp = {
         let t = header.time_stamp.replace(['-', ':', 'T'], "");
         let t: String = t.chars().filter(char::is_ascii_digit).collect();
@@ -618,10 +618,10 @@ fn layout(w: &W, header: &StepHeader, max_coord: f64) -> String {
     let g = [
         "1H,".to_string(),
         "1H;".to_string(),
-        holl("SolveCraft"),
+        holl("SolidCraft"),
         holl(&header.file_name),
-        holl("SolveCraft"),
-        holl("SolveCraft IGES 5.3"),
+        holl("SolidCraft"),
+        holl("SolidCraft IGES 5.3"),
         "32".into(),
         "38".into(),
         "6".into(),

crates/kernel/src/meshbody.rs

@@ -109,6 +109,7 @@ pub fn mesh_body(positions: &[Vec3], triangles: &[[u32; 3]]) -> Result<Body> {
         paint: None,
         splits: None,
         face_sources: None,
+        regularization_protected: false,
     })
 }
 
@@ -201,6 +202,7 @@ impl Body {
             paint: self.paint.clone(),
             splits: self.splits.clone(),
             face_sources: None,
+            regularization_protected: self.regularization_protected,
         })
     }
 }

crates/kernel/src/ops.rs

@@ -221,6 +221,10 @@ pub fn boolean(a: &Body, b: &Body, op: BoolOp) -> Result<Option<Body>> {
             )),
         };
     }
+    r = r.map(|result| result.map(|body| body.inherit_regularization_protection(a).inherit_regularization_protection(b)));
+    if matches!(op, BoolOp::Cut | BoolOp::Union) {
+        r = r.and_then(|result| result.map(|body| body.with_preserved_boolean_planar_sources(a, b, op == BoolOp::Cut)).transpose());
+    }
     r
 }
 
@@ -535,7 +539,11 @@ pub(crate) fn join_pieces(pieces: Vec<Body>) -> Result<Option<Body>> {
         _ => {
             let shells: Vec<mt::Shell> = pieces.iter().flat_map(|p| p.solid.boundaries().clone()).collect();
             let solid = guard("pieces", || Solid::try_new(shells).map_err(|e| KernelError::Failed(e.to_string())))?;
-            Body::new(solid).map(Some)
+            let protected = pieces.iter().any(|piece| piece.regularization_protected);
+            Body::new(solid).map(|mut body| {
+                body.regularization_protected = protected;
+                Some(body)
+            })
         }
     }
 }
@@ -555,8 +563,9 @@ pub fn transform_matrix(body: &Body, m: [[f64; 4]; 4]) -> Result<Body> {
         );
         // An affine placement retains face order and appearance metadata.
         let sources = body.transformed_sources(m)?;
-        Body::new(placed_topology(&body.solid, mat)?)
-            .map(|placed| placed.with_color(body.color()).with_paint(body.paint().cloned()).with_face_sources(sources))
+        Body::new(placed_topology(&body.solid, mat)?).map(|placed| {
+            placed.with_color(body.color()).with_paint(body.paint().cloned()).with_face_sources(sources).inherit_regularization_protection(body)
+        })
     })
 }
 

crates/kernel/src/planar_regularize.rs

@@ -0,0 +1,330 @@
+//! Exact topological removal of construction-induced planar subdivisions.
+//! Shared edge identity and complete construction lineage select the groups.
+use super::{Body, from_p3};
+use crate::{Result, guard};
+use solvecraft_geom::Plane;
+use std::collections::{BTreeMap, HashMap, HashSet};
+use std::sync::Arc;
+use truck_modeling as mt;
+
+fn root(parent: &mut [usize], mut i: usize) -> usize {
+    while parent[i] != i {
+        parent[i] = parent[parent[i]];
+        i = parent[i];
+    }
+    i
+}
+
+fn merged_face(faces: &[&mt::Face], members: &[usize], plane: Plane, eligible: &HashSet<mt::EdgeID>) -> Option<mt::Face> {
+    let mut counts = HashMap::<mt::EdgeID, (usize, bool)>::new();
+    for i in members {
+        for edge in faces.get(*i)?.boundary_iters().into_iter().flatten() {
+            // Whole linear supports, not a sampled plane fit.
+            let mt::Curve::Line(line) = edge.curve() else { return None };
+            let (a, b) = (from_p3(line.0), from_p3(line.1));
+            if !a.is_finite() || !b.is_finite() || a.len().max(b.len()) > 1e9 {
+                return None;
+            }
+            let front = from_p3(edge.absolute_front().point());
+            let back = from_p3(edge.absolute_back().point());
+            if !front.is_finite() || !back.is_finite() {
+                return None;
+            }
+            let error = 4096. * f64::EPSILON * (1. + a.len() + b.len() + plane.origin.len());
+            if plane.height(a).abs() > error || plane.height(b).abs() > error || a.dist(front) > error || b.dist(back) > error {
+                return None;
+            }
+            let count = counts.entry(edge.id()).or_insert((0, edge.orientation()));
+            if count.0 == 1 && (!eligible.contains(&edge.id()) || count.1 == edge.orientation()) {
+                return None;
+            }
+            count.0 += 1;
+            if count.0 > 2 {
+                return None;
+            }
+        }
+    }
+    let mut boundary = Vec::new();
+    for i in members {
+        for edge in faces.get(*i)?.boundary_iters().into_iter().flatten() {
+            if counts.get(&edge.id()).is_some_and(|(n, _)| *n == 1) {
+                boundary.push(edge);
+            }
+        }
+    }
+    let mut next = HashMap::new();
+    let mut incoming = HashMap::new();
+    for (i, edge) in boundary.iter().enumerate() {
+        if next.insert(edge.front().id(), i).is_some() || incoming.insert(edge.back().id(), i).is_some() {
+            return None;
+        }
+    }
+    if next.len() != incoming.len() || next.keys().any(|id| !incoming.contains_key(id)) {
+        return None;
+    }
+    let mut used = vec![false; boundary.len()];
+    let mut outer = None;
+    let mut holes = Vec::new();
+    for first in 0..boundary.len() {
+        if used[first] {
+            continue;
+        }
+        let start = boundary.get(first)?.front().id();
+        let origin = from_p3(boundary.get(first)?.front().point());
+        let mut index = first;
+        let mut edges = Vec::new();
+        let (mut area, mut magnitude, mut arithmetic_error) = (0., 0., 0.);
+        loop {
+            if *used.get(index)? {
+                return None;
+            }
+            used[index] = true;
+            let edge = boundary.get(index)?.clone();
+            let da = from_p3(edge.front().point()) - origin;
+            let db = from_p3(edge.back().point()) - origin;
+            let a = solvecraft_geom::Vec2::new(da.dot(plane.x), da.dot(plane.y));
+            let b = solvecraft_geom::Vec2::new(db.dot(plane.x), db.dot(plane.y));
+            let term = a.cross(b);
+            area += term;
+            magnitude += term.abs();
+            let coordinate_error =
+                128. * f64::EPSILON * (1. + origin.len() + from_p3(edge.front().point()).len() + from_p3(edge.back().point()).len());
+            arithmetic_error += coordinate_error * (da.len() + db.len() + coordinate_error) * 16.;
+            let back = edge.back().id();
+            edges.push(edge);
+            if back == start {
+                break;
+            }
+            index = *next.get(&back)?;
+        }
+        if edges.len() < 3 || !area.is_finite() || area.abs() <= arithmetic_error + 64. * f64::EPSILON * (edges.len() as f64 + 1.) * magnitude.max(1.)
+        {
+            return None;
+        }
+        let wire = mt::Wire::from(edges);
+        if area > 0. {
+            if outer.replace(wire).is_some() {
+                return None;
+            }
+        } else {
+            holes.push(wire);
+        }
+    }
+    let mut wires = vec![outer?];
+    wires.extend(holes);
+    mt::Face::try_new(wires, faces.get(*members.first()?)?.oriented_surface()).ok()
+}
+
+impl Body {
+    pub(crate) fn regularize_certified_planar_faces(self) -> Result<Self> {
+        self.regularize_planar_faces(false)
+    }
+
+    /// Only newly produced Cut walls call this path. The temporary planes carry
+    /// construction support, never persistent ancestor/source-role authority.
+    pub(crate) fn regularize_generated_planar_faces(self) -> Result<Self> {
+        let body = self.regularize_planar_faces(true)?;
+        let sources = body.face_sources().map(|sources| {
+            sources
+                .iter()
+                .map(|source| {
+                    let mut source = source.clone();
+                    if let Some(super::FaceSource::ExtrudeSide { plane, coalesced, .. }) = &mut source {
+                        if plane.is_some() && !*coalesced {
+                            source = None;
+                        } else {
+                            *plane = None;
+                        }
+                    }
+                    source
+                })
+                .collect()
+        });
+        Ok(body.with_face_sources(sources.map(Arc::new)))
+    }
+
+    fn regularize_planar_faces(self, generated: bool) -> Result<Self> {
+        if self.regularization_protected {
+            return Ok(self);
+        }
+        let Some(sources) = self.face_sources() else { return Ok(self) };
+        if sources.len() > 16_384 || self.paint().is_some_and(|p| !p.faces.is_empty()) {
+            return Ok(self);
+        }
+        let split_points = self.split_keep().iter().try_fold(0usize, |sum, line| sum.checked_add(line.len()));
+        let Some(split_points) = split_points.filter(|n| *n <= 65_536) else { return Ok(self) };
+        let result = guard("certified planar topology regularization", || {
+            let mut faces = Vec::new();
+            let mut shell_owner = Vec::new();
+            let mut use_budget = 65_536usize;
+            for (shell_index, shell) in self.solid.boundaries().iter().enumerate() {
+                for face in shell.face_iter() {
+                    if faces.len() >= sources.len() {
+                        return Ok(None);
+                    }
+                    for _ in face.edge_iter() {
+                        let Some(left) = use_budget.checked_sub(1) else { return Ok(None) };
+                        use_budget = left;
+                    }
+                    faces.push(face);
+                    shell_owner.push(shell_index);
+                }
+            }
+            if faces.len() != sources.len() {
+                return Ok(None);
+            }
+            let valid: Vec<_> = faces
+                .iter()
+                .zip(sources)
+                .map(|(f, s)| {
+                    s.as_ref()
+                        .and_then(|source| {
+                            if generated {
+                                match source {
+                                    super::FaceSource::ExtrudeSide { segment: solvecraft_geom::Seg2::Line { .. }, plane: Some(p), .. } => Some(*p),
+                                    _ => None,
+                                }
+                            } else {
+                                super::planar_sources::certified_plane(source)
+                            }
+                        })
+                        .filter(|p| super::planar_sources::actual_plane(f).is_some_and(|actual| super::planar_sources::same_support(p, &actual)))
+                })
+                .collect();
+            let mut adjacency = HashMap::<mt::EdgeID, Vec<(usize, mt::Edge)>>::new();
+            for (i, face) in faces.iter().enumerate() {
+                for edge in face.boundary_iters().into_iter().flatten() {
+                    adjacency.entry(edge.id()).or_default().push((i, edge));
+                }
+            }
+            let mut eligible = HashSet::new();
+            let mut parent: Vec<_> = (0..faces.len()).collect();
+            let mut identity = 16_000_000usize;
+            let mut work = 2_000_000usize;
+            for uses in adjacency.values() {
+                let [(a, ea), (b, eb)] = uses.as_slice() else { continue };
+                if a == b || shell_owner[*a] != shell_owner[*b] || ea.orientation() == eb.orientation() {
+                    continue;
+                }
+                let (Some(pa), Some(pb)) = (valid[*a], valid[*b]) else { continue };
+                if pa != pb {
+                    continue;
+                }
+                let (Some(sa), Some(sb)) = (sources[*a].as_ref(), sources[*b].as_ref()) else { continue };
+                let Some(cost) = super::planar_sources::descriptor_cost(sa)
+                    .and_then(|a| super::planar_sources::descriptor_cost(sb).and_then(|b| a.checked_add(b)))
+                else {
+                    continue;
+                };
+                let Some(left) = identity.checked_sub(cost) else { return Ok(None) };
+                identity = left;
+                if !generated && sa != sb {
+                    continue;
+                }
+                let Some(cost) = split_points.checked_mul(6).and_then(|n| n.checked_add(1)) else { return Ok(None) };
+                let Some(left) = work.checked_sub(cost) else { return Ok(None) };
+                work = left;
+                if crate::heal::on_split_line(&crate::heal::edge_points(ea), self.split_keep()) {
+                    continue;
+                }
+                eligible.insert(ea.id());
+                let (ra, rb) = (root(&mut parent, *a), root(&mut parent, *b));
+                parent[ra.max(rb)] = ra.min(rb);
+            }
+            let mut groups = BTreeMap::<usize, Vec<usize>>::new();
+            for i in 0..faces.len() {
+                groups.entry(root(&mut parent, i)).or_default().push(i);
+            }
+            let mut replacements = HashMap::new();
+            let mut changed = false;
+            let mut metadata = 2_000_000usize;
+            for (leader, members) in &groups {
+                if members.len() < 2 {
+                    continue;
+                }
+                let Some(face) = valid[*leader].and_then(|p| merged_face(&faces, members, p, &eligible)) else { continue };
+                replacements.insert(*leader, face);
+                changed = true;
+            }
+            if !changed {
+                return Ok(None);
+            }
+            let mut shells = Vec::new();
+            let mut output_sources = Vec::new();
+            let mut output_ids = Vec::new();
+            let mut offset = 0;
+            for shell in self.solid.boundaries() {
+                let mut output = Vec::new();
+                for face in shell.face_iter() {
+                    let leader = root(&mut parent, offset);
+                    if let Some(merged) = replacements.get(&leader) {
+                        if offset == leader {
+                            output.push(merged.clone());
+                        } else {
+                            offset += 1;
+                            continue;
+                        }
+                    } else {
+                        output.push(face.clone());
+                    }
+                    output_ids.push(output.last().ok_or_else(|| crate::KernelError::Failed("missing regularized face".into()))?.id());
+                    let source = sources[offset].as_ref();
+                    if let Some(source) = source {
+                        let Some(cost) = super::planar_sources::descriptor_cost(source) else { return Ok(None) };
+                        let Some(left) = metadata.checked_sub(cost) else { return Ok(None) };
+                        metadata = left;
+                    }
+                    let mut source = source.cloned();
+                    if generated
+                        && replacements.contains_key(&leader)
+                        && let Some(super::FaceSource::ExtrudeSide { coalesced, .. }) = &mut source
+                    {
+                        *coalesced = true;
+                    }
+                    output_sources.push(source);
+                    offset += 1;
+                }
+                shells.push(mt::Shell::from(output));
+            }
+            let solid = mt::Solid::try_new(shells).map_err(|e| crate::KernelError::Failed(format!("planar regularization does not close: {e}")))?;
+            let body = Body::new(solid)?.with_color(self.color()).with_paint(self.paint().cloned()).with_split_lines(self.split_lines().cloned());
+            if !body.solid.face_iter().map(|f| f.id()).eq(output_ids) {
+                return Ok(None);
+            }
+            Ok(Some(body.with_face_sources(Some(Arc::new(output_sources)))))
+        })?;
+        Ok(result.unwrap_or(self))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn alternate_adjacency_path_cannot_remove_protected_internal_edge() {
+        let vertices: Vec<_> =
+            (0..9).map(|i| mt::builder::vertex(super::super::p3(solvecraft_geom::Vec3::new((i % 3) as f64, (i / 3) as f64, 0.)))).collect();
+        let mut edges = HashMap::<(usize, usize), mt::Edge>::new();
+        let mut faces = Vec::new();
+        for (x, y) in [(0, 0), (1, 0), (0, 1), (1, 1)] {
+            let ids = [y * 3 + x, y * 3 + x + 1, (y + 1) * 3 + x + 1, (y + 1) * 3 + x];
+            let wire: mt::Wire = (0..4)
+                .map(|i| {
+                    let (a, b) = (ids[i], ids[(i + 1) % 4]);
+                    let key = (a.min(b), a.max(b));
+                    let edge = edges.entry(key).or_insert_with(|| mt::builder::line(&vertices[key.0], &vertices[key.1]));
+                    if a == key.0 { edge.clone() } else { edge.inverse() }
+                })
+                .collect();
+            faces.push(mt::builder::try_attach_plane(&[wire]).unwrap());
+        }
+        let refs: Vec<_> = faces.iter().collect();
+        let mut eligible: HashSet<_> = edges.values().map(|e| e.id()).collect();
+        assert!(merged_face(&refs, &[0, 1, 2, 3], Plane::XY, &eligible).is_some());
+        eligible.remove(&edges[&(1, 4)].id());
+        assert!(
+            merged_face(&refs, &[0, 1, 2, 3], Plane::XY, &eligible).is_none(),
+            "remaining three internal joins cannot bypass authored split protection"
+        );
+    }
+}

crates/kernel/src/planar_sources.rs

@@ -0,0 +1,518 @@
+//! Exact oriented planar support lineage through a trim and an inside shell.
+//! No tessellated face names, centroids, or nearest-plane choices are used.
+use super::{Body, FaceSource, from_p3};
+use crate::{KernelError, Result, guard};
+use solvecraft_geom::{Plane, Vec3};
+use std::sync::Arc;
+use truck_modeling as mt;
+
+pub(super) fn actual_plane(face: &mt::Face) -> Option<Plane> {
+    let mt::Surface::Plane(p) = face.oriented_surface() else { return None };
+    let u = p.u_axis();
+    let v = p.v_axis();
+    let u = Vec3::new(u.x, u.y, u.z);
+    let v = Vec3::new(v.x, v.y, v.z);
+    if !u.is_finite() || !v.is_finite() || u.cross(v).len() <= u.len() * v.len() * 1e-8 {
+        return None;
+    }
+    Plane::new(from_p3(p.origin()), u, v)
+}
+
+pub(super) fn same_support(a: &Plane, b: &Plane) -> bool {
+    let error = 4096. * f64::EPSILON * (1. + a.origin.len() + b.origin.len());
+    a.normal().cross(b.normal()).len() <= 4096. * f64::EPSILON
+        && a.normal().dot(b.normal()) > 0.
+        && (a.origin - b.origin).dot(a.normal()).abs() <= error
+}
+
+fn base_plane(source: &FaceSource, actual: &Plane) -> Option<Plane> {
+    match source {
+        FaceSource::CertifiedExtrudeSide { plane: Some(p), .. }
+        | FaceSource::CertifiedExtrudeCap { plane: p, .. }
+        | FaceSource::Box { producer: Some(_), plane: p, .. }
+        | FaceSource::ShellPlanar { producer: Some(_), plane: p, .. } => Some(*p),
+        FaceSource::Imported { producer: Some(_), payload_sha256: Some(_), .. } => Some(*actual),
+        _ => None,
+    }
+}
+
+pub(super) fn certified_plane(source: &FaceSource) -> Option<Plane> {
+    match source {
+        FaceSource::CertifiedExtrudeSide { plane: Some(p), .. }
+        | FaceSource::CertifiedExtrudeCap { plane: p, .. }
+        | FaceSource::Box { producer: Some(_), plane: p, .. }
+        | FaceSource::ShellPlanar { producer: Some(_), plane: p, .. } => Some(*p),
+        _ => None,
+    }
+}
+
+fn boolean_source(source: &FaceSource, constructed: bool) -> bool {
+    matches!(source, FaceSource::ShellPlanar { producer: Some(_), .. }) || (constructed && certified_plane(source).is_some())
+}
+
+pub(super) fn descriptor_cost(source: &FaceSource) -> Option<usize> {
+    let mut cost = 256usize;
+    match source {
+        FaceSource::CertifiedExtrudeCap { outer, holes, .. } => {
+            if holes.len() > 4096 {
+                return None;
+            }
+            cost = cost.checked_add(holes.len().checked_mul(64)?)?;
+            let mut entries = 4096usize;
+            for id in outer.iter().chain(holes.iter().flatten()) {
+                entries = entries.checked_sub(1)?;
+                if id.len() > 128 {
+                    return None;
+                }
+                cost = cost.checked_add(id.len().checked_add(64)?)?;
+            }
+        }
+        FaceSource::CertifiedExtrudeSide { curve, .. } => {
+            if curve.len() > 128 {
+                return None;
+            }
+            cost = cost.checked_add(curve.len())?;
+        }
+        FaceSource::Imported { payload_sha256: Some(digest), .. } => {
+            if digest.len() > 64 {
+                return None;
+            }
+            cost = cost.checked_add(digest.len())?;
+        }
+        FaceSource::ShellPlanar { source, .. } if !matches!(source.as_ref(), FaceSource::ShellPlanar { .. }) => {
+            cost = cost.checked_add(descriptor_cost(source)?)?;
+        }
+        FaceSource::ExtrudeCap { region, .. } => {
+            if region.holes.len() > 8192 {
+                return None;
+            }
+            cost = cost.checked_add(region.holes.len().checked_mul(64)?)?;
+            let count = region.holes.iter().try_fold(region.outer.segs.len(), |sum, h| sum.checked_add(h.segs.len()))?;
+            if count > 8192 {
+                return None;
+            }
+            cost = cost.checked_add(count.checked_mul(128)?)?;
+        }
+        FaceSource::ExtrudeSide { .. } | FaceSource::Imported { .. } | FaceSource::Box { .. } => {}
+        _ => return None,
+    }
+    Some(cost)
+}
+
+impl Body {
+    /// Preserve uniquely certified unchanged planar construction supports.
+    pub fn with_preserved_planar_sources(self, input: &Body) -> Result<Self> {
+        self.map_planar_sources(input, None, None, &[], false)
+    }
+
+    /// Generate distinct outer/inner roles from the exact original supports of
+    /// an inside shell. Generated rims and curved walls are intentionally absent.
+    pub(crate) fn with_shell_planar_sources(self, input: &Body, thickness: f64, open: &[Vec3]) -> Result<Self> {
+        self.map_planar_sources(input, Some(thickness), None, open, false)
+    }
+
+    /// Retain exact shell roles, and construction roles for Cut, only on unchanged
+    /// supports without a competing coplanar tool. No imported or fitted role is inferred.
+    pub(crate) fn with_preserved_boolean_planar_sources(self, input: &Body, tool: &Body, constructed: bool) -> Result<Self> {
+        let self_ = self.inherit_regularization_protection(input).inherit_regularization_protection(tool);
+        if !input.face_sources().is_some_and(|sources| sources.iter().flatten().any(|s| boolean_source(s, constructed))) {
+            return Ok(self_);
+        }
+        self_.map_planar_sources(input, None, Some(tool), &[], constructed)
+    }
+
+    fn map_planar_sources(mut self, input: &Body, shell: Option<f64>, blocker: Option<&Body>, open: &[Vec3], constructed: bool) -> Result<Self> {
+        self.regularization_protected |= input.regularization_protected;
+        let Some(sources) = input.face_sources() else { return Ok(self) };
+        if input.solid.face_iter().count() > 16_384
+            || self.solid.face_iter().count() > 16_384
+            || blocker.is_some_and(|b| b.solid.face_iter().count() > 16_384)
+        {
+            return Err(KernelError::Invalid("planar source face budget exceeded".into()));
+        }
+        if sources.len() != input.solid.face_iter().count() {
+            return Err(KernelError::Invalid("planar source alignment mismatch".into()));
+        }
+        if shell.is_some_and(|t| !t.is_finite() || t <= 0.) {
+            return Err(KernelError::Invalid("invalid shell source thickness".into()));
+        }
+        if open.len() > 256 {
+            return Ok(self);
+        }
+        let opening_tolerance = if shell.is_some() { input.size() * 1e-4 + 1e-6 } else { 0. };
+        let mapped = guard("exact planar support lineage", || {
+            let competing: Vec<_> = blocker.into_iter().flat_map(|b| b.solid.face_iter()).filter_map(actual_plane).collect();
+            let mut candidates = Vec::new();
+            let mut unknown_supports = Vec::new();
+            for (face, source) in input.solid.face_iter().zip(sources) {
+                let Some(actual) = actual_plane(face) else { continue };
+                let Some(source) = source.as_ref() else {
+                    unknown_supports.push(actual);
+                    continue;
+                };
+                if (blocker.is_some() && !boolean_source(source, constructed))
+                    || (shell.is_some() && matches!(source, FaceSource::ShellPlanar { .. }))
+                {
+                    unknown_supports.push(actual);
+                    continue;
+                }
+                let Some(plane) = base_plane(source, &actual) else {
+                    unknown_supports.push(actual);
+                    continue;
+                };
+                if !same_support(&plane, &actual) || (shell.is_some() && open.iter().any(|p| actual.height(*p).abs() <= opening_tolerance)) {
+                    unknown_supports.push(actual);
+                    continue;
+                }
+                let Some(cost) = descriptor_cost(source) else {
+                    unknown_supports.push(actual);
+                    continue;
+                };
+                candidates.push((plane, source, false, cost));
+                if let Some(t) = shell {
+                    let inner = Plane::new(plane.origin - plane.normal() * t, plane.x, -plane.y)
+                        .ok_or_else(|| KernelError::Invalid("invalid shell inner source plane".into()))?;
+                    candidates.push((inner, source, true, cost));
+                }
+            }
+            let mut work = 2_000_000usize;
+            let mut metadata = 2_000_000usize;
+            let mut identity_bytes = 16_000_000usize;
+            let mut result = Vec::new();
+            for (index, face) in self.solid.face_iter().enumerate() {
+                let mut found = None;
+                if let Some(actual) = actual_plane(face) {
+                    let mut blocked = false;
+                    for plane in &unknown_supports {
+                        work = work.checked_sub(1).ok_or_else(|| KernelError::Invalid("unknown planar source comparison budget exceeded".into()))?;
+                        if same_support(plane, &actual) {
+                            blocked = true;
+                            break;
+                        }
+                    }
+                    for plane in &competing {
+                        work = work.checked_sub(1).ok_or_else(|| KernelError::Invalid("planar tool comparison budget exceeded".into()))?;
+                        if same_support(plane, &actual)
+                            || same_support(
+                                &Plane::new(plane.origin, plane.x, -plane.y).ok_or_else(|| KernelError::Invalid("invalid opposing plane".into()))?,
+                                &actual,
+                            )
+                        {
+                            blocked = true;
+                            break;
+                        }
+                    }
+                    if blocked {
+                        let existing = self
+                            .face_sources()
+                            .and_then(|sources| sources.get(index))
+                            .and_then(|s| s.as_ref())
+                            .filter(|s| (blocker.is_some() || self.face_was_coalesced(index)) && !boolean_source(s, constructed));
+                        let keep = existing.and_then(|s| {
+                            descriptor_cost(s).and_then(|cost| {
+                                metadata.checked_sub(cost).map(|remaining| {
+                                    metadata = remaining;
+                                    s.clone()
+                                })
+                            })
+                        });
+                        result.push(keep);
+                        continue;
+                    }
+                    let mut chosen: Option<(Plane, &FaceSource, bool, usize)> = None;
+                    for (plane, source, inner, cost) in &candidates {
+                        work = work.checked_sub(1).ok_or_else(|| KernelError::Invalid("planar source comparison budget exceeded".into()))?;
+                        if same_support(plane, &actual) {
+                            if let Some((previous_plane, previous_source, previous_inner, _)) = chosen {
+                                let Some(remaining) = identity_bytes.checked_sub(*cost) else {
+                                    chosen = None;
+                                    break;
+                                };
+                                identity_bytes = remaining;
+                                // Several current pieces of one exact source are one
+                                // logical face; distinct source identities remain ambiguous.
+                                if previous_plane != *plane || previous_source != *source || previous_inner != *inner {
+                                    chosen = None;
+                                    break;
+                                }
+                            } else {
+                                chosen = Some((*plane, *source, *inner, *cost));
+                            }
+                        }
+                    }
+                    if let Some((plane, source, inner, cost)) = chosen
+                        && let Some(remaining) = metadata.checked_sub(cost)
+                    {
+                        metadata = remaining;
+                        found = Some(if shell.is_some() {
+                            FaceSource::ShellPlanar { producer: None, source: Box::new(source.clone()), inner, plane }
+                        } else {
+                            source.clone()
+                        });
+                    }
+                }
+                if found.is_none() && (blocker.is_some() || self.face_was_coalesced(index)) {
+                    found = self
+                        .face_sources()
+                        .and_then(|sources| sources.get(index))
+                        .and_then(|s| s.as_ref())
+                        .filter(|s| !boolean_source(s, constructed))
+                        .and_then(|s| {
+                            descriptor_cost(s).and_then(|cost| {
+                                metadata.checked_sub(cost).map(|remaining| {
+                                    metadata = remaining;
+                                    s.clone()
+                                })
+                            })
+                        });
+                }
+                result.push(found);
+            }
+            Ok(result)
+        })?;
+        self.face_sources = Some(Arc::new(mapped));
+        self.regularize_certified_planar_faces()
+    }
+
+    pub fn with_shell_certificate(mut self, producer: u64) -> Result<Self> {
+        if producer == 0 {
+            return Err(KernelError::Invalid("invalid shell source producer".into()));
+        }
+        if let Some(sources) = &self.face_sources {
+            let mut sources = sources.as_ref().clone();
+            for source in sources.iter_mut().flatten() {
+                if let FaceSource::ShellPlanar { producer: id, .. } = source {
+                    *id = Some(producer);
+                }
+            }
+            self.face_sources = Some(Arc::new(sources));
+        }
+        self.regularize_certified_planar_faces()
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{box_solid, fillet, shell, transform_matrix};
+
+    #[test]
+    fn rounded_shell_planar_roles_are_exact_distinct_and_transformable() {
+        for (width, thickness) in [(80., 2.), (100., 3.)] {
+            let box_body = box_solid(Vec3::new(-width / 2., -30., 0.), Vec3::new(width / 2., 30., 30.)).unwrap().with_box_certificate(7).unwrap();
+            let rounded = fillet(
+                &box_body,
+                &[
+                    Vec3::new(width / 2., 30., 15.),
+                    Vec3::new(-width / 2., 30., 15.),
+                    Vec3::new(-width / 2., -30., 15.),
+                    Vec3::new(width / 2., -30., 15.),
+                ],
+                6.,
+            )
+            .unwrap()
+            .with_preserved_planar_sources(&box_body)
+            .unwrap();
+            assert_eq!(rounded.face_sources().unwrap().iter().flatten().count(), 6);
+            let cup = shell(&rounded, &[Vec3::new(0., 0., 30.)], thickness).unwrap().with_shell_certificate(9).unwrap();
+            let sources = cup.face_sources().unwrap();
+            assert!(
+                !sources
+                    .iter()
+                    .flatten()
+                    .any(|s| matches!(s,FaceSource::ShellPlanar {source, ..} if matches!(source.as_ref(),FaceSource::Box {axis:2,high:true,..})))
+            );
+            let right = sources.iter().position(|s| matches!(s, Some(FaceSource::ShellPlanar { inner:false, source, .. }) if matches!(source.as_ref(),FaceSource::Box {axis:0,high:true,..}))).unwrap();
+            let floor = sources.iter().position(|s| matches!(s, Some(FaceSource::ShellPlanar { inner:true, source, .. }) if matches!(source.as_ref(),FaceSource::Box {axis:2,high:false,..}))).unwrap();
+            assert!((cup.face_plane(right).unwrap().origin.x - width / 2.).abs() < 1e-9);
+            let floor_plane = cup.face_plane(floor).unwrap();
+            assert!((floor_plane.origin.z - thickness).abs() < 1e-9);
+            assert!(floor_plane.normal().dot(Vec3::Z) > 0.999999);
+            for (i, s) in sources.iter().enumerate() {
+                if matches!(s, Some(FaceSource::ExtrudeSide { coalesced: true, plane: None, .. })) {
+                    assert!(cup.face_plane(i).is_none(), "loss witness is not source authority");
+                } else if s.is_some() {
+                    assert!(same_support(&cup.face_plane(i).unwrap(), &cup.planar_face(i).unwrap()));
+                }
+            }
+            let moved = transform_matrix(&cup, [[0., 1., 0., 0.], [-1., 0., 0., 0.], [0., 0., 1., 0.], [100., 200., 300., 1.]]).unwrap();
+            assert!((moved.face_plane(floor).unwrap().origin.z - (300. + thickness)).abs() < 1e-9);
+            assert!(matches!(moved.face_sources().unwrap().get(right), Some(Some(FaceSource::ShellPlanar { producer: Some(9), inner: false, .. }))));
+            assert!(moved.face_plane(right).unwrap().normal().dot(Vec3::Y) > 0.999999);
+            let raw = cup.tessellate(0.01).unwrap();
+            let display = cup.display_mesh(0.01).unwrap();
+            let cylindrical: Vec<_> = cup
+                .solid
+                .face_iter()
+                .enumerate()
+                .filter_map(|(i, f)| {
+                    let crate::FaceSurface::Cylinder { radius, .. } = crate::face_surface(&cup, i)? else { return None };
+                    let lo = f.vertex_iter().map(|v| v.point().z).fold(f64::INFINITY, f64::min);
+                    let hi = f.vertex_iter().map(|v| v.point().z).fold(f64::NEG_INFINITY, f64::max);
+                    Some((i, radius, lo, hi))
+                })
+                .collect();
+            eprintln!("roundedShell width{width} thickness{thickness} raw{} cylindrical roles{cylindrical:?}", cup.solid.face_iter().count());
+            let mut corner_joins = 0;
+            for (edge, adjacent) in raw.edge_faces.iter().enumerate() {
+                let [a, b] = adjacent.as_slice() else { continue };
+                if raw.edges[edge].iter().all(|p| (p.z - thickness).abs() < 1e-8)
+                    && cylindrical.iter().any(|(i, r, _, _)| *i == *a as usize && (*r - 6.).abs() < 1e-6)
+                    && cylindrical.iter().any(|(i, r, _, _)| *i == *b as usize && (*r - 6.).abs() < 1e-6)
+                {
+                    corner_joins += 1;
+                    assert!(display.seams[edge], "existing cylindrical corner joins must not draw a floor-height arc");
+                }
+            }
+            assert_eq!(corner_joins, 0, "no physical lower corner strip remains");
+            assert_eq!(cup.face_count(), 19);
+            let outer: Vec<_> = cylindrical.iter().filter(|(_, r, _, _)| (*r - 6.).abs() < 1e-6).collect();
+            assert_eq!(outer.len(), 4);
+            assert!(outer.iter().all(|(i, _, _, _)| cup.face_was_coalesced(*i) && moved.face_was_coalesced(*i)));
+            assert!(outer.iter().all(|(_, _, lo, hi)| lo.abs() < 1e-9 && (*hi - 30.).abs() < 1e-9));
+
+            for axis in 0..2 {
+                for high in [false, true] {
+                    let matching: Vec<_> = sources.iter().enumerate().filter_map(|(i,s)| matches!(s,Some(FaceSource::ShellPlanar {inner:false,source,..}) if matches!(source.as_ref(),FaceSource::Box {axis:a,high:h,..} if *a==axis && *h==high)).then_some(i)).collect();
+                    assert_eq!(matching.len(), 1, "each straight exterior wall is one actual face");
+                    let face = cup.solid.face_iter().nth(matching[0]).unwrap();
+                    let z: Vec<_> = face.vertex_iter().map(|v| v.point().z).collect();
+                    assert!(z.iter().any(|z| z.abs() < 1e-9));
+                    assert!(z.iter().any(|z| (*z - 30.).abs() < 1e-9));
+                }
+            }
+            assert!(display.contains(Vec3::new(width / 2. - thickness / 2., 0., thickness / 2.)));
+            assert!(display.contains(Vec3::new(width / 2. - thickness / 2., 0., 15.)));
+            assert!(!display.contains(Vec3::new(0., 0., 15.)));
+            assert_eq!(raw.measure().volume, display.measure().volume);
+            let expected = (width * 60. - (4. - std::f64::consts::PI) * 36.) * 30.
+                - ((width - 2. * thickness) * (60. - 2. * thickness) - (4. - std::f64::consts::PI) * (6. - thickness).powi(2)) * (30. - thickness);
+            assert!((cup.tessellate(1e-4).unwrap().measure().volume - expected).abs() < 0.2);
+            let imported = crate::step_import(&crate::step_export(&[&cup], "regularized rounded shell").unwrap()).unwrap();
+            assert!(imported.warnings.is_empty());
+            let copy = &imported.bodies[0].body;
+            assert_eq!(copy.face_count(), 19);
+            // STEP may additionally coalesce cylindrical corner patches. The
+            // certified planar wall topology itself must survive unchanged.
+            for (axis, coordinate) in [(Vec3::X, width / 2.), (-Vec3::X, width / 2.), (Vec3::Y, 30.), (-Vec3::Y, 30.)] {
+                let walls: Vec<_> = copy
+                    .solid
+                    .face_iter()
+                    .filter(|f| actual_plane(f).is_some_and(|p| p.normal().dot(axis) > 0.999 && (p.origin.dot(axis) - coordinate).abs() < 1e-8))
+                    .collect();
+                assert_eq!(walls.len(), 1);
+                let z: Vec<_> = walls[0].vertex_iter().map(|v| v.point().z).collect();
+                assert!(z.iter().any(|z| z.abs() < 1e-8));
+                assert!(z.iter().any(|z| (*z - 30.).abs() < 1e-8));
+            }
+            let copy_mesh = copy.tessellate(1e-4).unwrap();
+            assert!((copy_mesh.measure().volume - expected).abs() < 0.2);
+            assert!(copy_mesh.contains(Vec3::new(width / 2. - thickness / 2., 0., 15.)));
+            assert!(!copy_mesh.contains(Vec3::new(0., 0., 15.)));
+        }
+    }
+    #[test]
+    fn simple_shell_has_one_full_height_face_per_outer_wall_and_exports_that_topology() {
+        let source = box_solid(Vec3::ZERO, Vec3::new(40., 30., 20.)).unwrap().with_box_certificate(1).unwrap();
+        let pending = shell(&source, &[Vec3::new(20., 15., 20.)], 2.).unwrap();
+        let cup = pending.clone().with_shell_certificate(2).unwrap();
+        assert_eq!(cup.solid.face_iter().count(), 11);
+        let mesh = cup.tessellate(0.01).unwrap();
+        assert!((mesh.measure().volume - (40. * 30. * 20. - 36. * 26. * 18.)).abs() < 1e-6);
+        assert!(mesh.contains(Vec3::new(20., 1., 1.)));
+        assert!(mesh.contains(Vec3::new(20., 1., 10.)));
+        assert!(!mesh.contains(Vec3::new(20., 15., 10.)));
+        let imported = crate::step_import(&crate::step_export(&[&cup], "regularized shell").unwrap()).unwrap();
+        assert!(imported.warnings.is_empty());
+        let copy = &imported.bodies[0].body;
+        assert_eq!(copy.solid.face_iter().count(), 11);
+        assert!((copy.tessellate(0.01).unwrap().measure().volume - mesh.measure().volume).abs() < 1e-6);
+    }
+    #[test]
+    fn coincident_competing_source_planes_and_tool_planes_stay_unknown() {
+        let a = box_solid(Vec3::ZERO, Vec3::new(10., 10., 10.)).unwrap().with_box_certificate(1).unwrap();
+        let b = box_solid(Vec3::new(20., 0., 0.), Vec3::new(30., 10., 10.)).unwrap().with_box_certificate(2).unwrap();
+        let mut shells = a.solid.boundaries().to_vec();
+        shells.extend(b.solid.boundaries().iter().cloned());
+        let mut combined = Body::new(mt::Solid::try_new(shells).unwrap()).unwrap();
+        combined.face_sources = Some(Arc::new(a.face_sources().unwrap().iter().chain(b.face_sources().unwrap()).cloned().collect()));
+        let result = a.clone().with_preserved_planar_sources(&combined).unwrap();
+        for (i, face) in result.solid.face_iter().enumerate() {
+            if actual_plane(face).unwrap().normal().dot(Vec3::Z).abs() > 0.999 {
+                assert!(result.face_sources().unwrap()[i].is_none());
+            }
+        }
+        let mut mixed = combined.clone();
+        mixed.face_sources =
+            Some(Arc::new(a.face_sources().unwrap().iter().cloned().chain(std::iter::repeat_n(None, b.solid.face_iter().count())).collect()));
+        let guarded = a.clone().with_preserved_planar_sources(&mixed).unwrap();
+        for (i, face) in guarded.solid.face_iter().enumerate() {
+            if actual_plane(face).unwrap().normal().dot(Vec3::Z).abs() > 0.999 {
+                assert!(guarded.face_sources().unwrap()[i].is_none(), "uncertified competing support must not gain identity");
+            }
+        }
+        let cup = shell(&a, &[Vec3::new(5., 5., 10.)], 1.).unwrap().with_shell_certificate(3).unwrap();
+        let tool = box_solid(Vec3::new(2., 2., 1.), Vec3::new(4., 4., 3.)).unwrap();
+        let preserved = cup.clone().with_preserved_boolean_planar_sources(&cup, &tool, false).unwrap();
+        for (i, face) in preserved.solid.face_iter().enumerate() {
+            let Some(p) = actual_plane(face) else { continue };
+            if p.normal().dot(Vec3::Z) > 0.999 && (p.origin.z - 1.).abs() < 1e-9 {
+                assert!(preserved.face_sources().unwrap()[i].is_none());
+            }
+        }
+    }
+
+    #[test]
+    fn pocket_cut_removes_internal_wall_faces_in_actual_topology() {
+        use solvecraft_geom::{Loop2, Region2, Vec2};
+        let region = Region2 {
+            outer: Loop2::polygon(&[Vec2::new(-30., -27.), Vec2::new(30., -27.), Vec2::new(30., 27.), Vec2::new(-30., 27.)]),
+            holes: vec![],
+        };
+        let original = crate::extrude(&Plane::XY, std::slice::from_ref(&region), 0., 10.).unwrap().pop().unwrap();
+        let curves: Vec<_> = original
+            .face_sources()
+            .unwrap()
+            .iter()
+            .enumerate()
+            .map(|(i, source)| matches!(source, Some(FaceSource::ExtrudeSide { .. })).then(|| format!("l{i}")))
+            .collect();
+        let original = original.with_extrude_certificates(2, 1, &curves).unwrap();
+        let (x, y) = (24.73317426966596, 21.733174269665962);
+        let cutter = box_solid(Vec3::new(-x, -y, 1.), Vec3::new(x, y, 10.)).unwrap();
+        let pocket = crate::boolean(&original, &cutter, crate::BoolOp::Cut).unwrap().unwrap();
+        let raw = pocket.tessellate(0.01).unwrap();
+        let display = pocket.display_mesh(0.01).unwrap();
+        let sources = pocket.face_sources().unwrap();
+        assert_eq!(pocket.solid.face_iter().count(), 11, "four outer walls, four inner walls, rim, floor, bottom");
+        let sides: Vec<_> =
+            sources.iter().enumerate().filter_map(|(i, s)| matches!(s, Some(FaceSource::CertifiedExtrudeSide { .. })).then_some(i)).collect();
+        assert_eq!(sides.len(), 4);
+        for i in sides {
+            let face = pocket.solid.face_iter().nth(i).unwrap();
+            let z: Vec<_> = face.vertex_iter().map(|v| v.point().z).collect();
+            assert!(z.iter().any(|z| z.abs() < 1e-9));
+            assert!(z.iter().any(|z| (*z - 10.).abs() < 1e-9));
+            assert!(!face.edge_iter().any(|e| (e.front().point().z - 1.).abs() < 1e-9 && (e.back().point().z - 1.).abs() < 1e-9));
+        }
+        assert!(display.contains(Vec3::new(0., 0., 0.5)));
+        assert!(!display.contains(Vec3::new(0., 0., 5.)));
+        assert!(display.contains(Vec3::new(28., 0., 5.)));
+        assert!((display.measure().volume - (60. * 54. * 10. - 4. * x * y * 9.)).abs() < 1e-7);
+        assert_eq!(raw.measure().volume, display.measure().volume);
+        let imported = crate::step_import(&crate::step_export(&[&pocket], "regularized pocket").unwrap()).unwrap();
+        assert!(imported.warnings.is_empty());
+        let copy = &imported.bodies[0].body;
+        assert_eq!(copy.solid.face_iter().count(), 11);
+        let copy_mesh = copy.tessellate(0.01).unwrap();
+        assert!((copy_mesh.measure().volume - raw.measure().volume).abs() < 1e-6);
+        assert!(copy_mesh.contains(Vec3::new(0., 0., 0.5)));
+        assert!(!copy_mesh.contains(Vec3::new(0., 0., 5.)));
+        let competing = box_solid(Vec3::new(30., -1., 0.), Vec3::new(31., 1., 2.)).unwrap();
+        let guarded = pocket.clone().with_preserved_boolean_planar_sources(&pocket, &competing, true).unwrap();
+        for (index, source) in guarded.face_sources().unwrap().iter().enumerate() {
+            if pocket.face_plane(index).is_some_and(|p| p.normal().dot(Vec3::X) > 0.999 && (p.origin.x - 30.).abs() < 1e-9) {
+                assert!(source.is_none(), "competing tool plane cannot retain source identity");
+            }
+        }
+    }
+}

crates/kernel/src/polyhedron.rs

@@ -130,6 +130,10 @@ pub fn planar_convex(b: &Body) -> Result<Vec<(HalfSpace, Vec3)>> {
 
 /// Hollow a convex planar body: walls of `thickness` inside, faces near `open` removed.
 pub fn shell(b: &Body, open: &[Vec3], thickness: f64) -> Result<Body> {
+    shell_impl(b, open, thickness)?.with_shell_planar_sources(b, thickness, open)
+}
+
+fn shell_impl(b: &Body, open: &[Vec3], thickness: f64) -> Result<Body> {
     b.require_brep("shell")?;
     if !(thickness.is_finite() && thickness > 1e-6) {
         return Err(KernelError::Invalid("shell thickness must be positive".into()));
@@ -338,7 +342,15 @@ pub fn round_all_edges(b: &Body, r: f64) -> Result<Body> {
 /// by the thickness (open faces outward, past the body) keeping the body's topology, which
 /// gives the cavity; the shell is the body minus the cavity.
 fn shell_planar(b: &Body, open: &[Vec3], thickness: f64) -> Result<Body> {
-    let healed = Body::new(crate::heal::heal_keep(b.deep_copy(), b.size(), b.split_keep()))?;
+    // Face paint and authored splits are construction boundaries. Retain their
+    // eligibility veto through the temporary body used for the cavity Cut.
+    // Paint indices stay in source order by avoiding healing in that case.
+    let solid = if b.paint().is_some_and(|paint| !paint.faces.is_empty()) {
+        b.deep_copy()
+    } else {
+        crate::heal::heal_keep(b.deep_copy(), b.size(), b.split_keep())
+    };
+    let healed = Body::new(solid)?.with_paint(b.paint().cloned()).with_split_lines(b.split_lines().cloned()).inherit_regularization_protection(b);
     let size = healed.size();
     let mesh = healed.tessellate((size * 1e-3).max(1e-3))?;
     // Faces to open: the face of the triangle nearest each point.

crates/kernel/src/prism.rs

@@ -683,12 +683,17 @@ fn sew_stack(plane: &Plane, d: Vec3, pa: &Prism, pb: &Prism, tol: f64) -> Option
         };
         slabs.push(oriented(&s));
     }
-    sew_sections(plane, d, &levels, &slabs, tol)
+    sew_sections(plane, d, &levels, &slabs, tol, false)
 }
 
 /// Sew the exact sections between successive levels, including empty gaps.
-fn sew_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>], tol: f64) -> Option<Result<Body>> {
-    if levels.len() != slabs.len() + 1 || slabs.len() > 128 || plane.normal().dot(d) < 1. - 1e-12 {
+fn sew_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>], tol: f64, coalesce: bool) -> Option<Result<Body>> {
+    if levels.len() != slabs.len() + 1
+        || slabs.len() > 128
+        || plane.normal().dot(d) < 1. - 1e-12
+        || levels.iter().any(|z| !z.is_finite())
+        || levels.windows(2).any(|z| z[0] >= z[1])
+    {
         return None;
     }
     let mut blocks = Vec::new();
@@ -732,7 +737,7 @@ fn sew_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>],
                     pieces.push(piece);
                 }
             } else {
-                let piece = sew_connected_sections(plane, d, &levels[first..=end], &slabs[first..end], tol)
+                let piece = sew_connected_sections(plane, d, &levels[first..=end], &slabs[first..end], tol, coalesce)
                     .ok_or_else(|| KernelError::Failed("stepped prism construction failed".into()))??;
                 remaining_faces =
                     remaining_faces.checked_sub(piece.face_count()).ok_or_else(|| KernelError::Failed("prism output face budget".into()))?;
@@ -765,8 +770,18 @@ fn sew_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>],
     })())
 }
 
+/// Stable exact identity for the bounded analytic segment subset.
+fn wall_key(s: &Seg2) -> Option<[u64; 6]> {
+    let bits = |v: f64| v.is_finite().then(|| if v == 0. { 0 } else { v.to_bits() });
+    match s {
+        Seg2::Line { a, b } => Some([0, bits(a.x)?, bits(a.y)?, bits(b.x)?, bits(b.y)?, 0]),
+        Seg2::Arc { center, radius, start, sweep } => Some([1, bits(center.x)?, bits(center.y)?, bits(*radius)?, bits(*start)?, bits(*sweep)?]),
+        _ => None,
+    }
+}
+
 /// A genuinely stepped connected axial block has no single extrusion footprint.
-fn sew_connected_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>], tol: f64) -> Option<Result<Body>> {
+fn sew_connected_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<Region2>], tol: f64, coalesce: bool) -> Option<Result<Body>> {
     use crate::sew::{EdgeSpec, FaceSpec, SurfSpec};
     // Faces at each level: up where the slab below sticks out, down where the one above does.
     let diff = |x: &[Region2], y: &[Region2]| -> Option<Vec<Region2>> {
@@ -800,30 +815,92 @@ fn sew_connected_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<R
             _ => EdgeSpec::Line { a: at(sg.start(), z), b: at(sg.end(), z) },
         }
     };
-    let mut faces: Vec<FaceSpec> = Vec::new();
-    for (i, s) in slabs.iter().enumerate() {
-        let (z0, z1) = (*levels.get(i)?, *levels.get(i + 1)?);
-        for lp in loops_of(s) {
+    // Exact oriented generated segments alone define a run. No support fitting,
+    // proximity matching, or old face lineage is used here.
+    let mut runs: Vec<(usize, usize, Seg2)> = Vec::new();
+    let mut last = std::collections::BTreeMap::new();
+    let mut remaining = MAX_PLANAR_SEGMENTS * 2;
+    for (i, slab) in slabs.iter().enumerate() {
+        for lp in loops_of(slab) {
             for sg0 in &lp.segs {
                 for sg in split_seg(sg0, &pts, tol)? {
-                    let (a, b) = (sg.start(), sg.end());
-                    let lp3 = vec![
-                        edge(&sg, z0),
-                        EdgeSpec::Line { a: at(b, z0), b: at(b, z1) },
-                        edge(&sg.reversed(), z1),
-                        EdgeSpec::Line { a: at(a, z1), b: at(a, z0) },
-                    ];
-                    let tangent = plane.dir_to_world(sg.derivative(0.5));
-                    let outward = tangent.cross(d).normalized()?;
-                    let surface = match sg {
-                        Seg2::Arc { .. } => SurfSpec::Extruded { a: at(a, z0), b: at(b, z0), mid: at(sg.point_at(0.5), z0), dir: d * (z1 - z0) },
-                        _ => SurfSpec::Plane,
-                    };
-                    faces.push(FaceSpec { loops: vec![lp3], surface, probe: Some((at(sg.point_at(0.5), (z0 + z1) / 2.0), outward)) });
+                    remaining = remaining.checked_sub(1)?;
+                    let key = wall_key(&sg)?;
+                    if coalesce {
+                        if let Some(&index) = last.get(&key) {
+                            let run: &mut (usize, usize, Seg2) = runs.get_mut(index)?;
+                            if run.1 == i {
+                                run.1 = i + 1;
+                                continue;
+                            }
+                            // Duplicate oriented boundaries in one slab are not
+                            // a valid reason to reconstruct a larger wall.
+                            if run.1 == i + 1 {
+                                return None;
+                            }
+                        }
+                        last.insert(key, runs.len());
+                    }
+                    runs.push((i, i + 1, sg));
                 }
             }
         }
     }
+    let mut faces: Vec<FaceSpec> = Vec::new();
+    let mut sources = Vec::new();
+    let frame_is_orthonormal = plane.origin.is_finite()
+        && plane.x.is_finite()
+        && plane.y.is_finite()
+        && d.is_finite()
+        && (plane.x.len2() - 1.).abs() <= 64. * f64::EPSILON
+        && (plane.y.len2() - 1.).abs() <= 64. * f64::EPSILON
+        && (d.len2() - 1.).abs() <= 64. * f64::EPSILON
+        && plane.x.dot(plane.y).abs() <= 64. * f64::EPSILON
+        && plane.x.dot(d).abs() <= 64. * f64::EPSILON
+        && plane.y.dot(d).abs() <= 64. * f64::EPSILON;
+    for (first, end, sg) in runs {
+        let (z0, z1) = (levels[first], levels[end]);
+        let (a, b) = (sg.start(), sg.end());
+        let mut lp3 = Vec::with_capacity(2 + 2 * (end - first));
+        lp3.push(edge(&sg, z0));
+        // Keep station vertices at both ends: neighboring stepped walls/caps
+        // must share complete edges rather than create T-junctions.
+        for k in first..end {
+            lp3.push(EdgeSpec::Line { a: at(b, levels[k]), b: at(b, levels[k + 1]) });
+        }
+        lp3.push(edge(&sg.reversed(), z1));
+        for k in (first..end).rev() {
+            lp3.push(EdgeSpec::Line { a: at(a, levels[k + 1]), b: at(a, levels[k]) });
+        }
+        let outward = plane.dir_to_world(sg.derivative(0.5)).cross(d).normalized()?;
+        let surface = match sg {
+            Seg2::Arc { .. } => SurfSpec::Extruded { a: at(a, z0), b: at(b, z0), mid: at(sg.point_at(0.5), z0), dir: d * (z1 - z0) },
+            _ => SurfSpec::Plane,
+        };
+        faces.push(FaceSpec { loops: vec![lp3], surface, probe: Some((at(sg.point_at(0.5), (z0 + z1) / 2.0), outward)) });
+        // Axis-aligned generated lines have a common oriented support frame
+        // independent of axial stations or along-line endpoint interpolation.
+        let generated_plane = if coalesce
+            && frame_is_orthonormal
+            && let Seg2::Line { a, b } = sg
+        {
+            let (origin, x) = if a.y == b.y && a.x != b.x {
+                (at(Vec2::new(0., a.y), 0.), plane.x * (b.x - a.x).signum())
+            } else if a.x == b.x && a.y != b.y {
+                (at(Vec2::new(a.x, 0.), 0.), plane.y * (b.y - a.y).signum())
+            } else {
+                (Vec3::ZERO, Vec3::ZERO)
+            };
+            (origin.is_finite() && x.len2() > 0.).then_some(Plane { origin, x, y: d })
+        } else {
+            None
+        };
+        sources.push((generated_plane.is_some() || end > first + 1).then_some(crate::FaceSource::ExtrudeSide {
+            segment: sg,
+            plane: generated_plane,
+            coalesced: end > first + 1,
+        }));
+    }
     for (z, up, rs) in &caps {
         for r in rs {
             let mut loops = Vec::new();
@@ -836,9 +913,14 @@ fn sew_connected_sections(plane: &Plane, d: Vec3, levels: &[f64], slabs: &[Vec<R
                 loops.push(segs.iter().map(|sg| edge(sg, *z)).collect::<Vec<_>>());
             }
             faces.push(FaceSpec { loops, surface: SurfSpec::Plane, probe: None });
+            sources.push(None);
         }
     }
-    Some(crate::sew::sew_touching(&faces))
+    Some(crate::sew::sew_touching_with_sources(&faces, &sources).and_then(
+        |body| {
+            if coalesce { body.regularize_generated_planar_faces() } else { Ok(body) }
+        },
+    ))
 }
 
 fn simple_prism_boolean(a: &Body, b: &Body, op: BoolOp) -> Option<Result<Option<Body>>> {
@@ -1055,7 +1137,21 @@ fn stack_boolean(a: &Body, b: &Body, op: BoolOp) -> Option<Result<Option<Body>>>
     if slabs.iter().all(Vec::is_empty) {
         return Some(Ok(None));
     }
-    sew_sections(&plane, d, &levels, &slabs, tol).map(|r| r.map(Some))
+    sew_sections(
+        &plane,
+        d,
+        &levels,
+        &slabs,
+        tol,
+        op == BoolOp::Cut
+            && !a.regularization_protected
+            && !b.regularization_protected
+            && a.split_keep().is_empty()
+            && b.split_keep().is_empty()
+            && a.paint().is_none_or(|p| p.faces.is_empty())
+            && b.paint().is_none_or(|p| p.faces.is_empty()),
+    )
+    .map(|r| r.map(Some))
 }
 
 pub(crate) fn prism_boolean(a: &Body, b: &Body, op: BoolOp) -> Option<Result<Option<Body>>> {
@@ -1144,7 +1240,12 @@ mod planar_tests {
                 assert!(mesh.contains(Vec3::new(21., 21., 3.)));
                 assert!(!mesh.contains(Vec3::new(25., 25., 3.)));
                 assert!(mesh.contains(Vec3::new(25., 25., 22.)));
-                assert!(lump.face_sources().is_none_or(|s| s.iter().all(Option::is_none)), "genuinely stepped geometry remains uncertified");
+                assert!(
+                    lump.face_sources().is_none_or(|s| s
+                        .iter()
+                        .all(|s| s.is_none() || matches!(s, Some(crate::FaceSource::ExtrudeSide { coalesced: true, plane: None, .. })))),
+                    "genuinely stepped geometry has no durable certificate"
+                );
                 assert!((mesh.measure().volume - (18. * (100. - 4. * std::f64::consts::PI) + 500.)).abs() < 0.02);
             }
         }
@@ -1152,6 +1253,128 @@ mod planar_tests {
         assert_eq!(crate::step_export(&[&tool], "tool").unwrap(), before_tool);
         assert_eq!(crate::step_export(&[&roof], "roof").unwrap(), before_roof);
     }
+    fn stepped_tab_stock() -> Body {
+        let stock = crate::box_solid(Vec3::new(-20., -15., 0.), Vec3::new(20., 15., 24.)).unwrap();
+        let tab = crate::box_solid(Vec3::new(-12., -25., 8.), Vec3::new(-4., -15., 16.)).unwrap();
+        crate::boolean(&stock, &tab, BoolOp::Union).unwrap().unwrap()
+    }
+
+    fn coplanar_joins(body: &Body) -> usize {
+        let faces: Vec<_> = body.solid.face_iter().collect();
+        let mut adjacency = std::collections::HashMap::<_, Vec<usize>>::new();
+        for (i, face) in faces.iter().enumerate() {
+            for edge in face.edge_iter() {
+                adjacency.entry(edge.id()).or_default().push(i);
+            }
+        }
+        adjacency
+            .values()
+            .filter(|faces| {
+                let [a, b] = faces.as_slice() else { return false };
+                let (Some(pa), Some(pb)) = (body.planar_face(*a), body.planar_face(*b)) else { return false };
+                let (na, nb) = (pa.normal(), pb.normal());
+                na.dot(nb) > 1. - 1e-12 && (pb.origin - pa.origin).dot(na).abs() < 1e-10
+            })
+            .count()
+    }
+
+    #[test]
+    fn shell_of_joined_stepped_tabs_has_no_artificial_planar_stations() {
+        let stock = stepped_tab_stock();
+        let snapshot = crate::step_export(&[&stock], "unchanged stock").unwrap();
+        assert_eq!(coplanar_joins(&stock), 0);
+        let shell = crate::shell(&stock, &[Vec3::new(0., 0., 24.)], 1.).unwrap();
+        assert_eq!(coplanar_joins(&shell), 0, "Shell must not add internal edges across continuous planar walls");
+        assert!(shell.validity().is_empty());
+        let mesh = shell.tessellate(1e-5).unwrap();
+        let expected = 40. * 30. * 24. + 8. * 10. * 8. - (38. * 28. * 23. + 6. * 10. * 6.);
+        assert!((mesh.measure().volume - expected).abs() < 1e-6);
+        for (point, material) in [
+            (Vec3::new(0., 0., 0.5), true),
+            (Vec3::new(0., 0., 10.), false),
+            (Vec3::new(0., -14.5, 10.), true),
+            (Vec3::new(19.5, 0., 10.), true),
+            (Vec3::new(-8., -24.5, 12.), true),
+            (Vec3::new(-8., -20., 12.), false),
+            (Vec3::new(0., -18., 9.), false),
+        ] {
+            assert_eq!(mesh.contains(point), material, "wrong material at {point:?}");
+        }
+        let step = crate::step_export(&[&shell], "stepped tab shell").unwrap();
+        let reopened = crate::step_import(&step).unwrap();
+        let body = &reopened.bodies[0].body;
+        assert_eq!(body.face_count(), shell.face_count());
+        assert_eq!(coplanar_joins(body), 0);
+        assert!((body.tessellate(1e-5).unwrap().measure().volume - expected).abs() < 1e-6);
+        assert_eq!(crate::step_export(&[&stock], "unchanged stock").unwrap(), snapshot);
+    }
+
+    #[test]
+    fn contiguous_analytic_walls_remove_faces_but_retain_vertical_stations() {
+        for curved in [false, true] {
+            let outer = if curved {
+                Region2 { outer: Loop2::circle(Vec2::ZERO, 10.), holes: vec![] }
+            } else {
+                rectangle(Vec2::new(-10., -10.), Vec2::new(10., 10.))
+            };
+            let mut upper = outer.clone();
+            upper.holes.push(if curved {
+                Loop2::circle(Vec2::ZERO, 5.).reversed()
+            } else {
+                rectangle(Vec2::new(-5., -5.), Vec2::new(5., 5.)).outer.reversed()
+            });
+            let slabs = vec![vec![outer], vec![upper]];
+            let old = sew_sections(&Plane::XY, Vec3::Z, &[0., 2., 20.], &slabs, 1e-7, false).unwrap().unwrap();
+            let merged = sew_sections(&Plane::XY, Vec3::Z, &[0., 2., 20.], &slabs, 1e-7, true).unwrap().unwrap();
+            let count = if curved { 2 } else { 4 };
+            assert_eq!(old.face_count() - merged.face_count(), count);
+            let marked: Vec<_> = merged.solid.face_iter().enumerate().filter(|(i, _)| merged.face_was_coalesced(*i)).collect();
+            assert_eq!(marked.len(), count);
+            for (_, face) in marked {
+                assert_eq!(face.boundaries()[0].len(), 6, "all axial station vertices are retained");
+                let heights: Vec<_> = face.vertex_iter().map(|v| v.point().z).collect();
+                for z in [0., 2., 20.] {
+                    assert!(heights.contains(&z));
+                }
+            }
+            assert!(old.face_sources().is_none_or(|s| s.iter().all(Option::is_none)));
+            let expected = if curved { std::f64::consts::PI * (100. * 20. - 25. * 18.) } else { 400. * 20. - 100. * 18. };
+            let mesh = merged.tessellate(1e-5).unwrap();
+            assert!((mesh.measure().volume - expected).abs() < 0.03);
+            assert!(mesh.contains(Vec3::new(0., 0., 1.)));
+            assert!(!mesh.contains(Vec3::new(0., 0., 10.)));
+            assert!(merged.validity().is_empty());
+            assert_ne!(wall_key(&slabs[0][0].outer.segs[0]), wall_key(&slabs[0][0].outer.segs[0].reversed()));
+        }
+    }
+
+    #[test]
+    fn cut_run_coalescing_respects_authored_splits_and_face_paint() {
+        let region = Region2 { outer: Loop2::circle(Vec2::ZERO, 10.), holes: vec![] };
+        let tool_region = Region2 { outer: Loop2::circle(Vec2::ZERO, 5.), holes: vec![] };
+        let stock = crate::extrude(&Plane::XY, &[region], 0., 20.).unwrap().pop().unwrap();
+        let cutter = crate::extrude(&Plane::XY, &[tool_region], 2., 22.).unwrap().pop().unwrap();
+        let merged = stack_boolean(&stock, &cutter, BoolOp::Cut).unwrap().unwrap().unwrap();
+        let protected = [
+            stock.clone().with_split_lines(Some(std::sync::Arc::new(vec![vec![Vec3::new(10., 0., 0.), Vec3::new(10., 0., 20.)]]))),
+            stock.with_paint(Some(crate::Paint { opacity: 1., faces: vec![crate::FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] })),
+        ];
+        for input in protected {
+            let output = stack_boolean(&input, &cutter, BoolOp::Cut).unwrap().unwrap().unwrap();
+            assert_eq!(output.face_count(), merged.face_count() + 2);
+            assert!((0..output.face_count()).all(|i| !output.face_was_coalesced(i)));
+            // Independent circular chord-volume bound: 2*pi*(10*20+5*18)*1e-5 < .019.
+            let expected = std::f64::consts::PI * (100. * 20. - 25. * 18.);
+            for body in [&output, &merged] {
+                let mesh = body.tessellate(1e-5).unwrap();
+                assert!((mesh.measure().volume - expected).abs() < 0.03);
+                assert!(mesh.contains(Vec3::new(0., 0., 1.)));
+                assert!(!mesh.contains(Vec3::new(0., 0., 10.)));
+                assert!(mesh.contains(Vec3::new(7., 0., 10.)));
+            }
+        }
+    }
+
     #[test]
     fn annular_inward_tool_recovers_exact_stacks_before_cap_policy() {
         let plane = Plane::XY;

crates/kernel/src/refine_cache_tests.rs

@@ -0,0 +1,53 @@
+use super::*;
+
+fn bits(v: Vec3) -> [u64; 3] {
+    [v.x.to_bits(), v.y.to_bits(), v.z.to_bits()]
+}
+
+fn check_body(body: &Body) -> usize {
+    let meshes = mesh_shells(&body.solid, 0.5);
+    let mut changed = 0;
+    for (face, meshed) in body.solid.face_iter().zip(meshes.iter().flat_map(|shell| shell.face_iter())) {
+        let Some(mesh) = meshed.surface() else { continue };
+        let surface = face.surface();
+        let cached = refined_with_cache(&mesh, &surface, 0.002, true);
+        let original = refined_with_cache(&mesh, &surface, 0.002, false);
+        match (cached, original) {
+            (None, None) => {}
+            (Some(cached), Some(original)) => {
+                changed += 1;
+                assert_eq!(cached.len(), original.len(), "triangle count/winding must not change");
+                for (cached, original) in cached.into_iter().zip(original) {
+                    for ((point, normal), (old_point, old_normal)) in cached.into_iter().zip(original) {
+                        assert_eq!(bits(point), bits(old_point), "every refined coordinate must remain bit-identical");
+                        assert_eq!(bits(normal), bits(old_normal), "every refined normal must remain bit-identical");
+                    }
+                }
+            }
+            _ => panic!("memoization changed the refine/no-refine decision"),
+        }
+    }
+    changed
+}
+
+#[test]
+fn exact_refinement_cache_preserves_periodic_seams_and_normals() {
+    let cylinder = crate::cylinder(Vec3::ZERO, Vec3::Z, 15., 8.).unwrap();
+    let torus = crate::torus(Vec3::ZERO, 18., 4.).unwrap();
+    assert!(check_body(&cylinder) > 0, "the fixture must actually refine");
+    assert!(check_body(&torus) > 0, "the periodic fixture must actually refine");
+}
+
+#[test]
+fn exact_refinement_cache_preserves_singular_poles_and_placed_surfaces() {
+    let sphere = crate::sphere(Vec3::ZERO, 12.).unwrap();
+    assert!(check_body(&sphere) > 0, "the polar fixture must actually refine");
+    let placed = crate::transform(&sphere, Vec3::new(120., -85., 40.), Vec3::ZERO, Vec3::new(1., 2., 3.), 0.371).unwrap();
+    assert!(check_body(&placed) > 0);
+}
+
+#[test]
+fn exact_refinement_cache_keeps_unnecessary_planar_refinement_absent() {
+    let body = crate::box_solid(Vec3::ZERO, Vec3::new(10., 20., 30.)).unwrap();
+    assert_eq!(check_body(&body), 0);
+}

crates/kernel/src/regularization_protection_tests.rs

@@ -0,0 +1,65 @@
+use super::*;
+use solvecraft_geom::Plane;
+
+fn stamped_stock() -> Body {
+    crate::box_solid(Vec3::new(-20., -15., 0.), Vec3::new(20., 15., 24.)).unwrap().with_box_certificate(7).unwrap()
+}
+
+fn cup(stock: &Body) -> Body {
+    crate::shell(stock, &[Vec3::new(0., 0., 24.)], 1.).unwrap().with_shell_certificate(9).unwrap()
+}
+
+#[test]
+fn stamped_shell_keeps_authored_painted_and_split_boundaries() {
+    let stock = stamped_stock();
+    let ordinary = cup(&stock);
+    assert!(!ordinary.regularization_protected);
+    let painted = stock.clone().with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [1., 0., 0.], opacity: 1. }] }));
+    let side = stock
+        .solid
+        .face_iter()
+        .enumerate()
+        .find(|(i, _)| stock.planar_face(*i).is_some_and(|p| p.normal().dot(Vec3::X) > 0.999 && p.origin.x == 20.))
+        .unwrap()
+        .0;
+    let split = crate::split_faces(&stock, &[side], &crate::SplitTool::Plane(Plane { origin: Vec3::new(0., 0., 8.), ..Plane::XY })).unwrap();
+    assert!(split.split_lines().is_some());
+    for protected in [painted, split] {
+        let result = cup(&protected);
+        assert!(result.regularization_protected);
+        assert!(result.face_count() > ordinary.face_count(), "authored boundaries must survive both Shell regularizers");
+        assert!(result.validity().is_empty());
+        let expected = 40. * 30. * 24. - 38. * 28. * 23.;
+        let mesh = result.tessellate(1e-5).unwrap();
+        assert!((mesh.measure().volume - expected).abs() < 1e-6);
+        assert!(mesh.contains(Vec3::new(19.5, 0., 12.)));
+        assert!(!mesh.contains(Vec3::new(0., 0., 12.)));
+        let count = result.face_count();
+        assert_eq!(result.clone().regularize_certified_planar_faces().unwrap().face_count(), count);
+        assert_eq!(result.clone().regularize_generated_planar_faces().unwrap().face_count(), count);
+        let placed = crate::transform(&result, Vec3::new(30., -40., 7.), Vec3::ZERO, Vec3::Z, 0.3).unwrap();
+        assert!(placed.regularization_protected);
+        for lump in placed.lumps().unwrap() {
+            assert!(lump.regularization_protected);
+        }
+        let cleared = result.clone().with_paint(None).with_split_lines(None);
+        assert!(cleared.regularization_protected, "cleared appearance must not erase inherited boundary protection");
+        assert_eq!(cleared.regularize_certified_planar_faces().unwrap().face_count(), count);
+    }
+}
+
+#[test]
+fn protection_is_identity_and_survives_tool_operand_and_compounds() {
+    let a = stamped_stock();
+    let protected = a.clone().with_paint(Some(Paint { opacity: 1., faces: vec![FacePaint { face: 0, color: [0., 1., 0.], opacity: 1. }] }));
+    let cleared = protected.with_paint(None);
+    assert!(!a.same(&cleared));
+    let tool = crate::box_solid(Vec3::new(-5., -5., 23.), Vec3::new(5., 5., 30.)).unwrap().inherit_regularization_protection(&cleared);
+    let cut = crate::boolean(&a, &tool, crate::BoolOp::Cut).unwrap().unwrap();
+    assert!(cut.regularization_protected);
+    let remote = crate::box_solid(Vec3::new(100., 0., 0.), Vec3::new(110., 10., 10.)).unwrap();
+    let joined = crate::ops::join_pieces(vec![cleared, remote]).unwrap().unwrap();
+    assert!(joined.regularization_protected);
+    assert_eq!(joined.lumps().unwrap().len(), 2);
+    assert!(joined.lumps().unwrap().iter().all(|body| body.regularization_protected));
+}

crates/kernel/src/sew.rs

@@ -97,13 +97,16 @@ impl Cache {
 
 /// Sew the faces into a closed solid.
 pub fn sew(faces: &[FaceSpec]) -> Result<Body> {
-    sew_impl(faces, false)
+    sew_impl(faces, false, None)
 }
 
 /// Separate boundary sheets at a shared geometric edge without moving it.
-/// The face adjacency must still describe one connected solid boundary.
-pub(crate) fn sew_touching(faces: &[FaceSpec]) -> Result<Body> {
-    sew_impl(faces, true)
+/// Optional transient sources follow only unchanged produced face identities.
+pub(crate) fn sew_touching_with_sources(faces: &[FaceSpec], sources: &[Option<crate::FaceSource>]) -> Result<Body> {
+    if sources.len() != faces.len() {
+        return Err(KernelError::Invalid("sew source alignment".into()));
+    }
+    sew_impl(faces, true, Some(sources))
 }
 
 type EdgeUse = (usize, usize, usize);
@@ -347,7 +350,7 @@ fn split_vertex_fans(faces: Vec<mt::Face>) -> Result<Vec<mt::Face>> {
         .collect()
 }
 
-fn sew_impl(faces: &[FaceSpec], touching: bool) -> Result<Body> {
+fn sew_impl(faces: &[FaceSpec], touching: bool, sources: Option<&[Option<crate::FaceSource>]>) -> Result<Body> {
     if faces.len() < 4 || faces.len() > 200_000 {
         return Err(KernelError::Invalid("a solid needs 4…200000 faces".into()));
     }
@@ -396,6 +399,11 @@ fn sew_impl(faces: &[FaceSpec], touching: bool) -> Result<Body> {
             };
             out.push(face);
         }
+        let source_ids: HashMap<_, _> = out
+            .iter()
+            .enumerate()
+            .filter_map(|(i, f)| sources.and_then(|s| s.get(i)).and_then(Option::as_ref).map(|s| (f.id(), (f.orientation(), s))))
+            .collect();
         if !sheets.is_empty() && !faces_connected(&out) {
             return Err(KernelError::Invalid("sew: bodies touch only along an edge".into()));
         }
@@ -404,7 +412,10 @@ fn sew_impl(faces: &[FaceSpec], touching: bool) -> Result<Body> {
         }
         let shells = closed_components(out)?;
         let solid = Solid::try_new(shells).map_err(|e| KernelError::Failed(format!("sew: the faces do not close: {e}")))?;
-        Body::new(solid)
+        let body = Body::new(solid)?;
+        let mapped =
+            body.solid.face_iter().map(|f| source_ids.get(&f.id()).filter(|(o, _)| *o == f.orientation()).map(|(_, s)| (*s).clone())).collect();
+        Ok(body.with_face_sources(sources.map(|_| std::sync::Arc::new(mapped))))
     })
 }
 

crates/kernel/src/shell_groups.rs

@@ -79,6 +79,44 @@ fn triangles_meet(a: &[Vec3; 3], b: &[Vec3; 3], gap: f64) -> bool {
     true
 }
 
+/// Whether two closed meshes share material or touch: a boundary triangle of one comes within
+/// `gap` of one of the other's, or one encloses the other.
+pub(super) fn meshes_meet(a: &Mesh, b: &Mesh, gap: f64) -> Result<bool> {
+    if !gap.is_finite() || gap <= 0.0 {
+        return Err(failed("invalid contact clearance"));
+    }
+    let (ba, bb) = (a.bounds(), b.bounds());
+    if ba.is_empty() || bb.is_empty() || boxes_separate(ba, bb, gap) {
+        return Ok(false);
+    }
+    // Only triangles near the other body can touch it.
+    let near = |m: &Mesh, other: Aabb3| -> Result<Vec<([Vec3; 3], Aabb3)>> {
+        let mut out = Vec::new();
+        for t in &m.triangles {
+            let tri = m.tri(t).ok_or_else(|| failed("invalid contact triangle"))?;
+            let bounds = box_of(&tri);
+            if !boxes_separate(bounds, other, gap) {
+                out.push((tri, bounds));
+            }
+        }
+        Ok(out)
+    };
+    let (ta, tb) = (near(a, bb)?, near(b, ba)?);
+    let work = ta.len().checked_mul(tb.len()).ok_or_else(|| failed("contact work exceeds the limit"))?;
+    if work > MAX_PAIR_WORK {
+        return Err(failed("contact work exceeds the limit"));
+    }
+    for (x, xb) in &ta {
+        for (y, yb) in &tb {
+            if !boxes_separate(*xb, *yb, gap) && triangles_meet(x, y, gap) {
+                return Ok(true);
+            }
+        }
+    }
+    // No boundary contact: they meet only if one lies wholly inside the other.
+    Ok(b.positions.first().is_some_and(|p| a.contains(*p)) || a.positions.first().is_some_and(|p| b.contains(*p)))
+}
+
 pub(super) fn groups(meshes: &[Mesh], volumes: &[f64], gap: f64) -> Result<Vec<Vec<usize>>> {
     if meshes.is_empty() || meshes.len() != volumes.len() || meshes.len() > MAX_SHELLS {
         return Err(failed("shell count exceeds the grouping limit or is invalid"));

crates/kernel/src/splitface.rs

@@ -886,6 +886,7 @@ pub(crate) fn split_any(body: &Body, faces: &[usize], tool: &SplitTool) -> Resul
                 paint: None,
                 splits: body.splits.clone(),
                 face_sources: None,
+                regularization_protected: true,
             },
             imp,
         ))

crates/kernel/src/step_in/brep.rs

@@ -16,6 +16,10 @@ use crate::guard;
 const MAX_FACES: usize = 500_000;
 /// Most edges in one loop.
 const MAX_LOOP: usize = 100_000;
+/// Most boundary loops on one face. Each bound clones its edge handles into a new wire and the
+/// face extent then samples nine points per edge, so one face listing the same 100,000-edge
+/// loop a million times would hold 1e11 handles.
+const MAX_BOUNDS: usize = 10_000;
 
 /// A body read from a brep entity.
 pub(crate) struct BrepOut {
@@ -196,9 +200,18 @@ impl Builder {
         if !matches!(e.name(), "ADVANCED_FACE" | "FACE_SURFACE" | "FACE") {
             return Err(format!("unsupported face {}", e.name()));
         }
+        let bounds = refs(p.get(1));
+        if bounds.len() > MAX_BOUNDS {
+            return Err(format!("a face with more than {MAX_BOUNDS} boundary loops"));
+        }
         let mut wires = Vec::new();
-        for b in refs(p.get(1)) {
+        let mut edges = 0usize;
+        for b in bounds {
             if let Some(w) = self.bound(cx, b)? {
+                edges = edges.saturating_add(w.len());
+                if edges > MAX_LOOP {
+                    return Err(format!("a face with more than {MAX_LOOP} boundary edges"));
+                }
                 wires.push(w);
             }
         }
@@ -263,7 +276,13 @@ impl Builder {
                 .into_iter()
                 .map(|w| {
                     let edges: Vec<mt::Edge> = w.edge_iter().cloned().collect();
-                    let passes = |e: &mt::Edge| edges.iter().filter(|x| x.front().id() == e.front().id()).count();
+                    // Counted once: a loop may hold 100,000 edges, and asking per edge how
+                    // often its front vertex appears would scan them all again each time.
+                    let mut fronts: HashMap<_, usize> = HashMap::new();
+                    for e in &edges {
+                        *fronts.entry(e.front().id()).or_default() += 1;
+                    }
+                    let passes = |e: &mt::Edge| fronts.get(&e.front().id()).copied().unwrap_or(0);
                     match edges.first().map(passes) {
                         Some(n) if n > 1 => {
                             let start = edges.iter().position(|e| passes(e) == 1).unwrap_or(0);

crates/kernel/src/step_in/geom.rs

@@ -146,7 +146,11 @@ pub(crate) fn axis1(cx: &Ctx, id: u64) -> R<(mt::Point3, mt::Vector3)> {
     Ok((o, d))
 }
 
-fn knot_vec(mults: Option<&Param>, knots: Option<&Param>) -> R<mt::KnotVec> {
+/// `expected` is the knot count the control points and degree imply. Multiplicities are
+/// expanded into one value each, so the sum has to be checked before the expansion: 20 million
+/// knots of multiplicity 64 would build a 10 GB vector that the length check then rejects, and
+/// an allocation failure aborts the process where an error does not.
+fn knot_vec(mults: Option<&Param>, knots: Option<&Param>, expected: usize) -> R<mt::KnotVec> {
     let m: Vec<usize> = mults
         .and_then(Param::as_list)
         .ok_or("B-spline without knot multiplicities")?
@@ -157,6 +161,9 @@ fn knot_vec(mults: Option<&Param>, knots: Option<&Param>) -> R<mt::KnotVec> {
     if m.len() != k.len() || k.is_empty() || k.windows(2).any(|w| w.first() > w.get(1)) {
         return Err("inconsistent knot vector".into());
     }
+    if m.len() > expected || m.iter().try_fold(0usize, |a, v| a.checked_add(*v)) != Some(expected) {
+        return Err("knot multiplicities do not match the control points".into());
+    }
     mt::KnotVec::from_single_multi(k, m).map_err(|e| format!("knot vector: {e}"))
 }
 
@@ -238,7 +245,7 @@ fn bspline_curve(cx: &Ctx, e: &Entity) -> R<CurveGeo> {
     }
     let ctrl: Vec<mt::Point3> = ctrl_ids.iter().map(|c| point(cx, c.as_ref_id().ok_or("bad control point")?)).collect::<R<_>>()?;
     let kv = match knots {
-        Some((m, k)) => knot_vec(m, k)?,
+        Some((m, k)) => knot_vec(m, k, ctrl.len() + degree + 1)?,
         None => generated_knots(kind, ctrl.len(), degree)?,
     };
     if kv.len() != ctrl.len() + degree + 1 {
@@ -737,7 +744,7 @@ pub(crate) fn bspline_surface(cx: &Ctx, e: &Entity) -> R<mt::Surface> {
         return Err("ragged B-spline control net".into());
     }
     let (ku, kv) = match knots {
-        Some([mu, mv, ku, kv]) => (knot_vec(mu, ku)?, knot_vec(mv, kv)?),
+        Some([mu, mv, ku, kv]) => (knot_vec(mu, ku, nu + du + 1)?, knot_vec(mv, kv, nv + dv + 1)?),
         None => (generated_knots(kind, nu, du)?, generated_knots(kind, nv, dv)?),
     };
     if ku.len() != nu + du + 1 || kv.len() != nv + dv + 1 {

crates/kernel/src/step_in/tests.rs

@@ -622,3 +622,56 @@ fn glued_halves_export_as_whole_faces() {
     // Box sides and caps (6) and two holes.
     assert_eq!(imp.bodies[0].file_faces, 8);
 }
+
+/// Knot multiplicities are expanded into one value each before the knot count is compared with
+/// the control points, so the sum has to be checked first: 1,000,000 knots of multiplicity 64
+/// against two control points asked for a 500 MB vector (20,000,000 for 10 GB) only to reject
+/// it afterwards, and an allocation failure aborts the process where an error does not.
+#[test]
+fn knot_multiplicities_are_checked_before_they_are_expanded() {
+    let curve = |n: usize, mult: usize| {
+        let knots: Vec<String> = (0..n).map(|i| format!("{i}.")).collect();
+        let mults: Vec<String> = std::iter::repeat_n(mult.to_string(), n).collect();
+        format!(
+            "{HEAD}#1=CARTESIAN_POINT('',(0.,0.,0.));\n#2=CARTESIAN_POINT('',(1.,0.,0.));\n\
+             #3=B_SPLINE_CURVE_WITH_KNOTS('',1,(#1,#2),.UNSPECIFIED.,.F.,.F.,({}),({}),.UNSPECIFIED.);\n{TAIL}",
+            mults.join(","),
+            knots.join(",")
+        )
+    };
+    let read = |text: &str| {
+        let ex = p21::parse(text).unwrap();
+        let cx = Ctx { ex: &ex, len: 1.0, ang: 1.0, tol: 1e-6 };
+        geom::curve(&cx, 3, 0)
+    };
+    let error = read(&curve(1_000_000, 64)).unwrap_err();
+    // This diagnostic comes from the check before expansion; wall-clock time depends on CI load.
+    assert!(error.contains("knot multiplicities do not match"), "{error}");
+    // A degree-1 curve with two control points needs exactly four knot values.
+    assert!(read(&curve(2, 2)).is_ok());
+    assert!(read(&curve(4, 1)).is_ok());
+    assert!(read(&curve(2, 3)).is_err());
+}
+
+/// One `ADVANCED_FACE` may list any number of bounds, and each one clones its edge handles into
+/// a new wire that the face extent then samples. A face naming the same loop a million times
+/// held 1e11 handles.
+#[test]
+fn faces_with_too_many_bounds_are_refused() {
+    let good = step_export(&[&box_solid(Vec3::ZERO, Vec3::new(5.0, 5.0, 5.0)).unwrap()], "t").unwrap();
+    // One extra face on the cube's shell, listing its outer bound 100,000 times.
+    let bounds = std::iter::repeat_n("#900001", 100_000).collect::<Vec<_>>().join(",");
+    let mut extra = format!("#900000=ADVANCED_FACE('',({bounds}),#900010,.T.);\n");
+    extra += "#900001=FACE_OUTER_BOUND('',#900002,.T.);\n#900002=EDGE_LOOP('',(#900003));\n";
+    extra += "#900003=ORIENTED_EDGE('',*,*,#900004,.T.);\n#900004=EDGE_CURVE('',#900005,#900005,#900007,.T.);\n";
+    extra += "#900005=VERTEX_POINT('',#900006);\n#900006=CARTESIAN_POINT('',(0.,0.,0.));\n";
+    extra += "#900007=LINE('',#900006,#900008);\n#900008=VECTOR('',#900009,1.);\n#900009=DIRECTION('',(1.,0.,0.));\n";
+    extra += "#900010=PLANE('',#900011);\n#900011=AXIS2_PLACEMENT_3D('',#900006,#900012,#900009);\n#900012=DIRECTION('',(0.,0.,1.));\n";
+    let text =
+        good.replacen("CLOSED_SHELL('',(", "CLOSED_SHELL('',(#900000,", 1).replacen("ENDSEC;\nEND-ISO", &format!("{extra}ENDSEC;\nEND-ISO"), 1);
+
+    let start = std::time::Instant::now();
+    let imp = step_import(&text).unwrap();
+    assert!(imp.warnings.iter().any(|w| w.contains("boundary loops")), "{:?}", imp.warnings);
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "took {:?}", start.elapsed());
+}

crates/kernel/src/step_out.rs

@@ -1190,7 +1190,7 @@ fn merge_split_faces(ex: &mut p21::Exchange, paint: &mut HashMap<u64, FaceLook>,
 /// The B-rep entities of one body as truck writes them, parsed, and the surfaces of faces
 /// merged from pieces.
 fn brep_exchange(b: &Body, merge: bool) -> Result<(p21::Exchange, HashMap<u64, V3>, HashMap<u64, FaceLook>)> {
-    let text = crate::step::truck_step(&[b], "SolveCraft")?;
+    let text = crate::step::truck_step(&[b], "SolidCraft")?;
     let mut ex = p21::parse(&text).map_err(|e| KernelError::Failed(format!("STEP export: {e}")))?;
     collapse_short_edges(&mut ex);
     // Face colours by exchange face: truck writes each shell's faces in the body's face order.
@@ -1429,10 +1429,10 @@ fn products_text(products: &[ExportProduct], root: usize, header: &StepHeader, m
 
     let mut s = String::new();
     s.push_str("ISO-10303-21;\nHEADER;\n");
-    s.push_str("FILE_DESCRIPTION(('SolveCraft model'),'2;1');\n");
+    s.push_str("FILE_DESCRIPTION(('SolidCraft model'),'2;1');\n");
     let _ = writeln!(
         s,
-        "FILE_NAME({},{},({}),({}),'SolveCraft','SolveCraft','');",
+        "FILE_NAME({},{},({}),({}),'SolidCraft','SolidCraft','');",
         string(&header.file_name),
         string(&header.time_stamp),
         string(&header.author),

crates/kernel/src/surfaces.rs

@@ -30,6 +30,7 @@ fn surface_body(faces: Vec<mt::Face>) -> Body {
         paint: None,
         splits: None,
         face_sources: None,
+        regularization_protected: false,
     }
 }
 
@@ -47,6 +48,7 @@ fn body_of(faces: Vec<mt::Face>) -> Result<Body> {
             paint: None,
             splits: None,
             face_sources: None,
+            regularization_protected: false,
         })
     }
 }

crates/mcp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-mcp"
-description = "SolveCraft MCP server: JSON-RPC 2.0 over stdio, driving a headless session or the running app"
+description = "SolidCraft MCP server: JSON-RPC 2.0 over stdio, driving a headless session or the running app"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/mcp/src/backend.rs

@@ -89,7 +89,7 @@ impl Backend for Remote {
         let reply = match self.roundtrip(&line) {
             Ok(r) => r,
             // One retry on a fresh connection (the app may have restarted).
-            Err(_) => self.roundtrip(&line).map_err(|e| format!("SolveCraft at {}: {e}", self.addr))?,
+            Err(_) => self.roundtrip(&line).map_err(|e| format!("SolidCraft at {}: {e}", self.addr))?,
         };
         let v: Value = serde_json::from_str(&reply).map_err(|e| format!("bad reply from the app: {e}"))?;
         if v.get("ok").and_then(Value::as_bool) == Some(true) {
@@ -102,7 +102,7 @@ impl Backend for Remote {
         true
     }
     fn describe(&self) -> String {
-        format!("connected to the SolveCraft app at {} (the user watches the viewport)", self.addr)
+        format!("connected to the SolidCraft app at {} (the user watches the viewport)", self.addr)
     }
 }
 
@@ -168,6 +168,6 @@ impl Backend for Headless {
         false
     }
     fn describe(&self) -> String {
-        "headless in-process SolveCraft session".into()
+        "headless in-process SolidCraft session".into()
     }
 }

crates/mcp/src/server.rs

@@ -3,6 +3,8 @@
 use std::io::{BufRead, Write};
 
 use serde_json::{Value, json};
+/// Longest accepted request line, shared with the control server.
+use solvecraft_engine::MAX_LINE;
 
 use crate::backend::Backend;
 use crate::tools::{call_tool, check_arguments, tool_definitions};
@@ -18,12 +20,10 @@ const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
 const RESOURCE_NOT_FOUND: i64 = -32002;
 
-/// Longest accepted request line (a guard against runaway input).
-const MAX_LINE: usize = 16 << 20;
 /// Most messages in one JSON-RPC batch.
 const MAX_BATCH: usize = 1000;
 
-const INSTRUCTIONS: &str = "SolveCraft is a parametric 3D CAD app in the style of Autodesk Fusion. Units are millimetres \
+const INSTRUCTIONS: &str = "SolidCraft is a parametric 3D CAD app in the style of Autodesk Fusion. Units are millimetres \
 and degrees in expressions (internally radians), Z is up. Model like in Fusion: `sketch.create {plane: XY}`, draw \
 (`sketch.rectangle.two_point {p0, p1}`, `sketch.circle.center {center, radius}`, `sketch.line {points, closed}`), constrain \
 and dimension (`sketch.dimension {entities, value}`; values may name parameters), `sketch.finish`, then features \
@@ -133,7 +133,7 @@ impl Server {
                 Ok(json!({
                     "protocolVersion": version,
                     "capabilities": {"tools": {"listChanged": false}, "resources": {"listChanged": false}},
-                    "serverInfo": {"name": "solvecraft", "title": "SolveCraft", "version": env!("CARGO_PKG_VERSION")},
+                    "serverInfo": {"name": "solvecraft", "title": "SolidCraft", "version": env!("CARGO_PKG_VERSION")},
                     "instructions": format!("{INSTRUCTIONS} Backend: {}.", self.backend.describe()),
                 }))
             }

crates/render/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-render"
-description = "SolveCraft view math (orbit camera, projection, picking rays) and a CPU rasterizer for headless snapshots"
+description = "SolidCraft view math (orbit camera, projection, picking rays) and a CPU rasterizer for headless snapshots"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -12,3 +12,6 @@ workspace = true
 solvecraft-geom = { workspace = true }
 serde = { workspace = true }
 image = { workspace = true }
+
+[dev-dependencies]
+serde_json = { workspace = true }

crates/render/src/camera.rs

@@ -224,6 +224,9 @@ pub struct Camera {
     pub yaw: f64,
     /// Elevation above the XY plane, in (−π/2, π/2].
     pub pitch: f64,
+    /// Rotation about the viewing direction. Zero keeps the world's up axis vertical.
+    #[serde(default)]
+    pub roll: f64,
     /// Distance from target to eye.
     pub distance: f64,
     /// Vertical field of view (radians); 0 = orthographic.
@@ -236,7 +239,7 @@ pub struct Camera {
 impl Default for Camera {
     fn default() -> Self {
         let (yaw, pitch) = StandardView::Iso.angles();
-        Camera { target: Vec3::ZERO, yaw, pitch, distance: 200.0, fov: 0.0, up: UpAxis::Z }
+        Camera { target: Vec3::ZERO, yaw, pitch, roll: 0.0, distance: 200.0, fov: 0.0, up: UpAxis::Z }
     }
 }
 
@@ -266,7 +269,8 @@ impl Camera {
         let b = self.back();
         let right = self.up.from_frame(Vec3::new(self.yaw.cos(), -self.yaw.sin(), 0.0));
         let up = b.cross(right).normalized().unwrap_or(self.up.dir());
-        (right, up, b)
+        let (s, c) = self.roll.sin_cos();
+        (right * c + up * s, up * c - right * s, b)
     }
     pub fn view(&self) -> Mat4 {
         let (r, u, b) = self.basis();
@@ -349,11 +353,18 @@ impl Camera {
         self.yaw = (self.yaw + dx * 0.008) % std::f64::consts::TAU;
         self.pitch = (self.pitch + dy * 0.008).clamp(-lim, lim);
     }
+    /// Rotate the image about the viewing direction.
+    pub fn roll_by(&mut self, radians: f64) {
+        if radians.is_finite() {
+            self.roll = (self.roll + radians) % std::f64::consts::TAU;
+        }
+    }
     pub fn set_view(&mut self, v: StandardView) {
         let lim = std::f64::consts::FRAC_PI_2 - 1e-6;
         let (y, p) = v.angles();
         self.yaw = y;
         self.pitch = p.clamp(-lim, lim);
+        self.roll = 0.0;
     }
     /// Frame a bounding box.
     pub fn fit(&mut self, b: &Aabb3) {
@@ -376,15 +387,14 @@ impl Camera {
         } else {
             (-b.x).atan2(-b.y)
         };
-        Camera { yaw, pitch, ..*self }
+        Camera { yaw, pitch, roll: 0.0, ..*self }
     }
     /// Orientation as a unit quaternion (camera → world rotation).
     pub fn orientation(&self) -> Quat {
         let (r, u, b) = self.basis();
         Quat::from_basis(r, u, b)
     }
-    /// Blend between two cameras at `s` in [0, 1]: heading (the shorter way), elevation,
-    /// target, distance and field of view linearly. The ends are returned exactly.
+    /// Blend between two cameras at `s` in [0, 1]: heading and roll take the shorter way.
     pub fn interpolate(a: &Camera, b: &Camera, s: f64) -> Camera {
         if !(s > 0.0) {
             return *a;
@@ -392,24 +402,29 @@ impl Camera {
         if s >= 1.0 {
             return *b;
         }
-        // The camera has no roll, so it turns in heading and elevation: both change smoothly
-        // to the very end (the heading the shorter way round). A slerp of orientations would
-        // need a roll-free heading at every step, and near straight up or down that heading
-        // swings fast, so a move to Top spun in its last frames.
+        // Keep heading and elevation smooth near straight up or down. A quaternion slerp
+        // swings the heading sharply there when moving to Top.
         let dy = (b.yaw - a.yaw + std::f64::consts::PI).rem_euclid(std::f64::consts::TAU) - std::f64::consts::PI;
         let yaw = a.yaw + dy * s;
+        let dr = (b.roll - a.roll + std::f64::consts::PI).rem_euclid(std::f64::consts::TAU) - std::f64::consts::PI;
         let pitch = a.pitch + (b.pitch - a.pitch) * s;
         Camera {
             target: a.target + (b.target - a.target) * s,
             yaw,
             pitch,
+            roll: a.roll + dr * s,
             distance: a.distance + (b.distance - a.distance) * s,
             fov: a.fov + (b.fov - a.fov) * s,
             up: b.up,
         }
     }
     pub fn is_valid(&self) -> bool {
-        self.target.is_finite() && self.yaw.is_finite() && self.pitch.is_finite() && self.distance.is_finite() && self.distance > 0.0
+        self.target.is_finite()
+            && self.yaw.is_finite()
+            && self.pitch.is_finite()
+            && self.roll.is_finite()
+            && self.distance.is_finite()
+            && self.distance > 0.0
     }
 }
 
@@ -444,6 +459,26 @@ mod tests {
         assert!(x1 > x0, "dragging right must move the near side right: {x0} -> {x1}");
     }
 
+    #[test]
+    fn roll_rotates_the_picture_and_standard_views_level_it() {
+        let mut c = Camera::default();
+        c.set_view(StandardView::Front);
+        let (_, before_y, _) = c.to_screen(Vec3::X, 800.0, 600.0, 10.0).unwrap();
+        c.roll_by(std::f64::consts::FRAC_PI_2);
+        let (after_x, after_y, _) = c.to_screen(Vec3::X, 800.0, 600.0, 10.0).unwrap();
+        assert!((before_y - 300.0).abs() < 1e-9);
+        assert!((after_x - 400.0).abs() < 1e-9 && after_y > 300.0);
+        let (r, u, b) = c.basis();
+        assert!(r.dot(u).abs() < 1e-12 && r.dot(b).abs() < 1e-12 && u.dot(b).abs() < 1e-12);
+        c.set_view(StandardView::Front);
+        assert_eq!(c.roll, 0.0);
+        let saved = serde_json::to_value(c).unwrap();
+        let mut old = saved.as_object().unwrap().clone();
+        old.remove("roll");
+        let restored: Camera = serde_json::from_value(serde_json::Value::Object(old)).unwrap();
+        assert_eq!(restored.roll, 0.0);
+    }
+
     #[test]
     fn view_animation_interpolates() {
         let mut a = Camera { target: Vec3::new(1.0, 2.0, 3.0), distance: 80.0, ..Default::default() };

crates/sketch/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-sketch"
-description = "SolveCraft sketches: points, curves, geometric constraints and dimensions, the constraint solver, and profile detection"
+description = "SolidCraft sketches: points, curves, geometric constraints and dimensions, the constraint solver, and profile detection"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/sketch/src/lib.rs

@@ -30,7 +30,7 @@ pub use curves::{
 pub use dims::{DimFrame, DimLayout, chain_centres, default_text, dim_frame, dim_layout, encode_text};
 pub use freeform_offset::{FreeformOffset, OFFSET_TOLERANCE};
 pub use link::{Link, LinkGeom, LinkKind, LinkSource, MAX_LINK_ENTITIES};
-pub use model::{Constraint, ConstraintKind, Curve, CurveKind, SPoint, Sketch, SketchError, SketchView};
+pub use model::{Constraint, ConstraintKind, Curve, CurveKind, MAX_CONSTRAINTS, MAX_CURVES, MAX_POINTS, SPoint, Sketch, SketchError, SketchView};
 pub use offset::OffsetChain;
 pub use offset_topology::{OffsetCreated, OffsetRole, OffsetRoleFlags, OffsetRoleKind, OffsetTopology};
 pub use periodic::periodic_beziers;

crates/sketch/src/model.rs

@@ -4,6 +4,8 @@ use solvecraft_geom::{Seg2, Vec2};
 /// Hard caps that keep hostile input from exhausting memory or time.
 pub const MAX_POINTS: usize = 20_000;
 pub const MAX_CONSTRAINTS: usize = 40_000;
+/// Curves need points, so this follows the point cap.
+pub const MAX_CURVES: usize = MAX_POINTS;
 
 #[derive(Debug, Clone, PartialEq, thiserror::Error)]
 pub enum SketchError {

crates/sketch/src/solver.rs

@@ -15,6 +15,12 @@ use crate::linalg::{Mat, determined_vars, solve as lin_solve};
 use crate::model::{ConstraintKind, CurveKind, Sketch};
 
 const MAX_ITERS: usize = 500;
+/// Variables in one connected component. Each component is solved as a dense system: an n by n
+/// matrix for the Levenberg-Marquardt step, rows by n for the Jacobian. 4,000 variables is a
+/// 128 MB matrix; past that the request grows to gigabytes and an allocation failure aborts the
+/// process, which no panic guard can intercept. A component this size is reported as failed and
+/// its geometry left alone.
+const MAX_COMPONENT_VARS: usize = 4_000;
 /// Converged when every residual is below this (mm).
 const TOL: f64 = 1e-9;
 /// A solution is accepted when every residual is below this (mm).
@@ -1050,8 +1056,9 @@ pub fn solve_holding(sk: &mut Sketch, hold: &Hold) -> SolveReport {
     let mut iterations = 0;
     // Solve each component; `blocks` is consumed by index so rebuild per component.
     let all_blocks = blocks;
+    let oversized = |vars: &[usize]| vars.len() > MAX_COMPONENT_VARS;
     for (_, vars, bis) in &comps {
-        if bis.is_empty() {
+        if bis.is_empty() || oversized(vars) {
             continue;
         }
         let sub: Vec<(Block, Vec<usize>)> = bis.iter().filter_map(|&bi| all_blocks.get(bi).map(|(b, v)| (copy_block(b), v.clone()))).collect();
@@ -1064,6 +1071,10 @@ pub fn solve_holding(sk: &mut Sketch, hold: &Hold) -> SolveReport {
     let mut failing: Vec<String> = Vec::new();
     let mut det = vec![false; lay.n];
     let mut rank = 0;
+    // A component too large to solve is a failure, not an allocation.
+    if comps.iter().any(|(_, vars, bis)| !bis.is_empty() && oversized(vars)) {
+        max_residual = f64::MAX;
+    }
     let mut check = |r: &[f64], owner: &[usize], blocks: &[(Block, Vec<usize>)], failing: &mut Vec<String>| {
         max_residual = max_residual.max(max_abs(r));
         for (row, v) in r.iter().enumerate() {
@@ -1077,6 +1088,9 @@ pub fn solve_holding(sk: &mut Sketch, hold: &Hold) -> SolveReport {
         }
     };
     for (_, vars, bis) in &comps {
+        if oversized(vars) {
+            continue;
+        }
         let sub: Vec<(Block, Vec<usize>)> = bis.iter().filter_map(|&bi| all_blocks.get(bi).map(|(b, v)| (copy_block(b), v.clone()))).collect();
         if sub.is_empty() {
             continue;
@@ -1250,4 +1264,39 @@ mod typed_dimension_tests {
         sk.remove_curves(&[l]);
         assert!(sk.constraints.is_empty());
     }
+
+    /// One connected component is solved as a dense system, so its variable count sets the
+    /// allocation: 10,000 chained points are 20,000 variables and a 3.2 GB matrix. The solve
+    /// has to report failure instead of asking for the memory, because an allocation failure
+    /// aborts the process where a failed solve does not.
+    #[test]
+    fn components_too_large_to_solve_fail_instead_of_allocating() {
+        let mut sk = Sketch::new();
+        let mut previous = 0;
+        for i in 1..10_000 {
+            let p = sk.add_point(Vec2::new(0.001 * i as f64, 0.0), None).unwrap();
+            sk.add_constraint(ConstraintKind::Coincident { p: previous, q: p }, None).unwrap();
+            previous = p;
+        }
+        let before = sk.points.clone();
+        let t = std::time::Instant::now();
+        let report = solve(&mut sk);
+        assert_eq!(report.status, SolveStatus::Failed);
+        // Geometry is left as it was.
+        assert_eq!(sk.points, before);
+        assert!(t.elapsed() < std::time::Duration::from_secs(10), "took {:?}", t.elapsed());
+    }
+
+    /// A sketch whose components each stay under the cap still solves.
+    #[test]
+    fn many_small_components_still_solve() {
+        let mut sk = Sketch::new();
+        for i in 0..200 {
+            let a = sk.add_point(Vec2::new(i as f64, 0.0), None).unwrap();
+            let b = sk.add_point(Vec2::new(i as f64, 5.0), None).unwrap();
+            let l = sk.add_line_pts(a, b, None).unwrap();
+            sk.add_constraint(ConstraintKind::Vertical { l }, None).unwrap();
+        }
+        assert!(solve(&mut sk).ok());
+    }
 }

crates/ui-egui/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "solvecraft-ui-egui"
-description = "SolveCraft user interface (egui + wgpu): the swappable front end"
+description = "SolidCraft user interface (egui + wgpu): the swappable front end"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/ui-egui/src/context_menu.rs

@@ -1,9 +1,10 @@
 //! Context menus, one look everywhere.
 //!
-//! The viewport's right-click opens a radial marking menu (eight commands around the cursor,
-//! Repeat at the top) with a list underneath of what fits the selection or the thing under the
-//! cursor: faces, edges, bodies, sketch entities or empty space. Holding the right button opens
-//! it too; releasing over a direction picks that command (a flick). The browser's right-click
+//! The viewport's right-click opens a list of commands for the selection or the thing under the
+//! cursor: faces, edges, bodies, sketch entities or empty space. The optional radial marking
+//! menu adds eight commands around the cursor, with Repeat at the top. With that preference on,
+//! holding the right button opens it too; releasing over a direction picks a command (a flick).
+//! The browser's right-click
 //! opens the same list styling for a body, sketch or component.
 //!
 //! Items are commands (by id, with parameters filled from the target) or `ui.*` actions on view
@@ -1172,7 +1173,7 @@ pub fn open(app: &mut SolveApp, at: Pos2) {
 /// Open a menu for a target (the radial ring only for the viewport).
 pub fn open_for(app: &mut SolveApp, at: Pos2, target: Target) {
     app.menu.key_row = None;
-    app.menu.radial = target == Target::Viewport;
+    app.menu.radial = target == Target::Viewport && app.preferences.radial_context_menu;
     app.menu.target = target;
     app.menu.flick = false;
     app.viewport.context_menu = Some(at);
@@ -1301,6 +1302,12 @@ fn slot_rect(c: Pos2, k: usize, size: Vec2) -> Rect {
 /// Press-and-hold of the right button in the viewport opens the menu; releasing over a
 /// direction picks it.
 fn track_hold(app: &mut SolveApp, ctx: &egui::Context) {
+    if !app.preferences.radial_context_menu {
+        app.menu.press = None;
+        app.menu.flick = false;
+        app.menu.radial = false;
+        return;
+    }
     let (pressed, down, released, pos, time) = ctx.input(|i| {
         (
             i.pointer.button_pressed(egui::PointerButton::Secondary),
@@ -1648,6 +1655,53 @@ fn show_props(app: &mut SolveApp, ctx: &egui::Context) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn viewport_right_click_keeps_list_menu_and_radial_is_opt_in() {
+        let mut h = crate::scenario::Harness::new();
+        h.app.home.open = false;
+        h.settle();
+        let point = h.at(&json!({"world":[0,0,0]})).unwrap();
+        h.step(&json!({"click":point,"button":"right"})).unwrap();
+        assert!(h.app.viewport.context_menu.is_some(), "ordinary right click must still open a menu");
+        let list = describe(&h.app);
+        assert!(list["radial"].as_array().unwrap().is_empty());
+        assert!(list["items"].as_array().unwrap().iter().any(|item| item["id"] == "ui.origin" && item["enabled"] == true));
+        h.step(&json!({"click":{"handle":"menu:ui.origin"}})).unwrap();
+        assert!(!h.app.ui.show_origin && h.app.viewport.context_menu.is_none(), "the ordinary menu must execute Hide Origin and close");
+        h.call("ui.prefs", json!({"radial_context_menu":true}));
+        h.step(&json!({"click":point,"button":"right"})).unwrap();
+        assert_eq!(describe(&h.app)["radial"].as_array().unwrap().len(), DIRS);
+        open_for(&mut h.app, pos2(point[0] as f32, point[1] as f32), Target::Origin);
+        assert!(!h.app.menu.radial, "browser menus remain lists when radial menus are enabled");
+    }
+
+    #[test]
+    fn disabled_radial_menu_does_not_capture_right_button_hold() {
+        let mut app = SolveApp::new(solvecraft_engine::Session::default(), Default::default());
+        let ctx = egui::Context::default();
+        let point = pos2(600.0, 400.0);
+        app.viewport.mouse = Some(point);
+        for (time, events) in [
+            (
+                0.0,
+                vec![
+                    egui::Event::PointerMoved(point),
+                    egui::Event::PointerButton {
+                        pos: point,
+                        button: egui::PointerButton::Secondary,
+                        pressed: true,
+                        modifiers: egui::Modifiers::NONE,
+                    },
+                ],
+            ),
+            (1.0, vec![]),
+        ] {
+            let mut output = ctx.run_ui(egui::RawInput { time: Some(time), events, ..Default::default() }, |_| track_hold(&mut app, &ctx));
+            output.textures_delta.clear();
+        }
+        assert!(app.viewport.context_menu.is_none() && app.menu.press.is_none() && !app.menu.flick);
+    }
+
     #[test]
     fn sectors_go_clockwise_from_the_top() {
         assert_eq!(sector(vec2(0.0, -50.0)), Some(0));

crates/ui-egui/src/dialogs_motion.rs

@@ -1023,6 +1023,29 @@ mod tests {
         assert_eq!(cell_value("param:width", "90 mm"), json!("90 mm"));
     }
 
+    fn click_rule_button(h: &mut crate::scenario::Harness, name: &str) {
+        // The table header also contains this name. Its TextRun may be emitted
+        // after the popup, so select the actual choice rather than matching text.
+        let bounds = h
+            .output
+            .accesskit_update
+            .as_ref()
+            .unwrap()
+            .nodes
+            .iter()
+            .rev()
+            .find_map(|(_, n)| {
+                (n.role() == egui::accesskit::Role::Button && !n.is_disabled() && n.label() == Some(name)).then(|| n.bounds()).flatten()
+            })
+            .expect("rule button");
+        h.step(&json!({"click": [(bounds.x0 + bounds.x1) / 2.0, (bounds.y0 + bounds.y1) / 2.0]})).unwrap();
+    }
+
+    fn select_rule_parameter(h: &mut crate::scenario::Harness, name: &str) {
+        click_rule_button(h, name);
+        assert!(h.widget("Choose…").is_none(), "parameter choice should close and update the dropdown");
+    }
+
     #[test]
     fn configuration_compound_condition_and_rule_order_are_editable_in_dialog() {
         let mut h = crate::scenario::Harness::new();
@@ -1032,9 +1055,11 @@ mod tests {
             {"call":"engine.execute","params":{"command":"config.configure","params":{"params":["length"]}}},
             {"start":"config.table"},{"widget":"Add or edit rule"},
             {"widget":"Always"},{"widget":"All"},{"widget":"Always"},{"widget":"Parameter"},
-            {"widget":"Choose…"},{"widget":"length"},{"widget":"Save Rule"}
+            {"widget":"Choose…"}
         ]))
         .unwrap();
+        select_rule_parameter(&mut h, "length");
+        h.step(&json!({"widget":"Save Rule"})).unwrap();
         assert!(
             matches!(&h.app.session.doc.configs.rules[0].condition,solvecraft_engine::doc::config::RuleCondition::All{conditions} if matches!(&conditions[0],solvecraft_engine::doc::config::RuleCondition::Parameter{..}))
         );
@@ -1044,7 +1069,8 @@ mod tests {
         ])).unwrap();
         assert!(h.widget("length = 20 mm").is_some());
         assert_eq!(h.app.session.doc.param("length").unwrap().expr, "40 mm");
-        h.run(&json!([{"widget":"↑"},{"widget":"Preview Row"}])).unwrap();
+        click_rule_button(&mut h, "↑");
+        h.step(&json!({"widget":"Preview Row"})).unwrap();
         assert_eq!(h.app.session.doc.configs.rules[0].id, "last");
         assert!(h.widget("length = 10 mm").is_some());
         assert_eq!(h.app.session.doc.param("length").unwrap().expr, "40 mm");
@@ -1060,8 +1086,11 @@ mod tests {
             {"call":"engine.execute","params":{"command":"config.configure","params":{"params":["length"]}}},
             {"start":"config.table"},
             {"widget":"Add or edit rule"},
-            {"widget":"Choose…"},
-            {"widget":"length"},
+            {"widget":"Choose…"}
+        ]))
+        .unwrap();
+        select_rule_parameter(&mut h, "length");
+        h.run(&json!([
             {"widget":"Save Rule"}
         ]))
         .unwrap();

crates/ui-egui/src/dim_view.rs

@@ -97,11 +97,19 @@ impl DimensionDraft {
 
 pub fn cancel() {
     EDIT.with(|edit| *edit.borrow_mut() = None);
+    PLACEMENT.with(|preview| *preview.borrow_mut() = None);
 }
 
 /// Infer the measured value through the same command as scripts, without creating a real
 /// parameter or an undo entry. Only accepting the editor executes the command on the design.
 pub fn begin_dimension(app: &SolveApp, entities: Vec<String>, at: Vec2) -> Result<(), String> {
+    let (param, expr, draft) = dimension_draft(app, entities, at)?;
+    EDIT.with(|edit| *edit.borrow_mut() = Some(Edit { param, expr, at: None, fresh: FRESH, wait: 10, draft: Some(draft) }));
+    PLACEMENT.with(|preview| *preview.borrow_mut() = None);
+    Ok(())
+}
+
+fn dimension_draft(app: &SolveApp, entities: Vec<String>, at: Vec2) -> Result<(String, String, DimensionDraft), String> {
     let sketch = app.session.active_sketch.ok_or("Edit a sketch to add a dimension")?;
     if entities.is_empty() || entities.len() > 2 || !at.x.is_finite() || !at.y.is_finite() {
         return Err("Pick one edge or two endpoints, then place the dimension".into());
@@ -126,8 +134,51 @@ pub fn begin_dimension(app: &SolveApp, entities: Vec<String>, at: Vec2) -> Resul
     if !draft.preview.sketch(sketch).is_some_and(|solved| solved.report.ok()) {
         return Err("That dimension conflicts with the sketch constraints".into());
     }
-    EDIT.with(|edit| *edit.borrow_mut() = Some(Edit { param, expr, at: None, fresh: FRESH, wait: 10, draft: Some(draft) }));
-    Ok(())
+    Ok((param, expr, draft))
+}
+
+/// Cache inference at a stationary pointer, including incomplete/unsupported picks.
+#[derive(Clone)]
+struct Placement {
+    baseline: Arc<solvecraft_engine::doc::Document>,
+    sketch: Option<u64>,
+    component: u64,
+    path: Option<Vec<u64>>,
+    pending: std::collections::BTreeMap<u64, solvecraft_engine::doc::Mat>,
+    entities: Vec<String>,
+    at: Vec2,
+    draft: Option<(String, DimensionDraft)>,
+}
+
+fn placement_preview(app: &SolveApp) -> Option<(String, DimensionDraft)> {
+    let tool = app.tool.as_ref().filter(|t| t.kind == crate::tools::Kind::Dimension && !t.picks.is_empty())?;
+    let at = tool.hover.as_ref()?.0;
+    PLACEMENT.with(|preview| {
+        let mut preview = preview.borrow_mut();
+        let current = preview.as_ref().is_some_and(|p| {
+            Arc::ptr_eq(&p.baseline, &app.session.doc)
+                && p.sketch == app.session.active_sketch
+                && p.component == app.session.active_component
+                && p.path == app.session.active_occurrence_path
+                && p.pending == app.session.pending_moves
+                && p.entities == tool.picks
+                && p.at == at
+        });
+        if !current {
+            let draft = dimension_draft(app, tool.picks.clone(), at).ok().map(|(param, _, draft)| (param, draft));
+            *preview = Some(Placement {
+                baseline: app.session.doc.clone(),
+                sketch: app.session.active_sketch,
+                component: app.session.active_component,
+                path: app.session.active_occurrence_path.clone(),
+                pending: app.session.pending_moves.clone(),
+                entities: tool.picks.clone(),
+                at,
+                draft,
+            });
+        }
+        preview.as_ref().and_then(|p| p.draft.clone())
+    })
 }
 
 thread_local! {
@@ -135,6 +186,7 @@ thread_local! {
     /// A text being dragged: dimension id, undo depth at the start, grab offset (sketch).
     static DRAG: RefCell<Option<(String, usize, Vec2)>> = const { RefCell::new(None) };
     static EDIT: RefCell<Option<Edit>> = const { RefCell::new(None) };
+    static PLACEMENT: RefCell<Option<Placement>> = const { RefCell::new(None) };
 }
 
 /// Frames the inline editor holds on to the keyboard after opening.
@@ -258,7 +310,7 @@ pub fn label(k: &ConstraintKind, expr: Option<&str>, driven: bool) -> String {
 /// Draw the active sketch's dimensions and remember where they are for picking.
 pub fn show(app: &mut SolveApp, ui: &egui::Ui, painter: &egui::Painter, proj: &Proj) {
     let mut drawn = Vec::new();
-    let draft = EDIT.with(|edit| {
+    let editor_draft = EDIT.with(|edit| {
         let mut edit = edit.borrow_mut();
         if edit.as_ref().and_then(|e| e.draft.as_ref()).is_some_and(|d| !d.valid(app)) {
             *edit = None;
@@ -282,6 +334,8 @@ pub fn show(app: &mut SolveApp, ui: &egui::Ui, painter: &egui::Painter, proj: &P
             None
         }
     });
+    let placing = !editing();
+    let draft = editor_draft.or_else(|| placing.then(|| placement_preview(app)).flatten());
     let st = app.session.world_state();
     let Some(ss) = app.session.active_sketch.and_then(|s| st.sketch(s)) else {
         DRAWN.with(|d| d.borrow_mut().clear());
@@ -372,13 +426,13 @@ pub fn show(app: &mut SolveApp, ui: &egui::Ui, painter: &egui::Painter, proj: &P
                 .collect();
             painter.add(Shape::line(pts, stroke));
         }
-        if is_draft {
+        if is_draft && !placing {
             EDIT.with(|edit| {
                 if let Some(e) = edit.borrow_mut().as_mut() {
                     e.at = Some(tc);
                 }
             });
-        } else {
+        } else if !is_draft {
             drawn.push(Drawn { id: c.id.clone(), param: c.param.clone(), text: r, segs, at: lay.text });
         }
     }
@@ -502,6 +556,71 @@ pub fn drawn() -> Vec<(String, Pos2)> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn placement_previews_radial_and_angular_dimensions_and_invalidates_on_document_change() {
+        cancel();
+        let mut h = crate::scenario::Harness::new();
+        h.app.run("sketch.create", json!({"plane":"XY"})).unwrap();
+        h.app.run("sketch.circle.center", json!({"center":[30,30],"radius":5})).unwrap();
+        h.app.run("sketch.line", json!({"points":[[10,10],[20,10]],"infer":false,"connect":false})).unwrap();
+        h.app.run("sketch.line", json!({"points":[[10,10],[10,20]],"infer":false,"connect":false})).unwrap();
+        h.call("ui.view", json!({"view":"top"}));
+        for (picks, at, angular) in [(vec![[35, 30]], [40, 40], false), (vec![[15, 10], [10, 15]], [18, 18], true)] {
+            h.step(&json!({"start":"sketch.dimension"})).unwrap();
+            for pick in picks {
+                h.step(&json!({"click":{"sketch":pick}})).unwrap();
+            }
+            h.step(&json!({"move":{"sketch":at}})).unwrap();
+            let (param, draft) = placement_preview(&h.app).unwrap();
+            let constraint =
+                draft.preview.sketch(draft.sketch).unwrap().sketch.constraints.iter().find(|c| c.param.as_deref() == Some(&param)).unwrap();
+            assert_eq!(constraint.kind.is_angle(), angular);
+            assert!(!editing());
+            let (_, cached) = placement_preview(&h.app).unwrap();
+            assert!(Arc::ptr_eq(&draft.preview_doc, &cached.preview_doc), "stationary pointer reuses inference");
+            h.app.run("sketch.point", json!({"point":[50,50]})).unwrap();
+            let (_, refreshed) = placement_preview(&h.app).unwrap();
+            assert!(!Arc::ptr_eq(&draft.preview_doc, &refreshed.preview_doc));
+            h.step(&json!({"key":"Escape"})).unwrap();
+        }
+        cancel();
+    }
+
+    #[test]
+    fn placement_follows_real_pointer_without_editing_or_mutating_design() {
+        cancel();
+        let mut h = crate::scenario::Harness::new();
+        h.app.run("sketch.create", json!({"plane":"XY"})).unwrap();
+        h.app.run("sketch.line", json!({"points":[[10,10],[30,10]],"infer":false})).unwrap();
+        h.call("ui.view", json!({"view":"top"}));
+        let baseline = h.app.session.doc.to_json();
+        let undo = h.app.session.undo.len();
+        h.step(&json!({"start":"sketch.dimension"})).unwrap();
+        h.step(&json!({"click":{"sketch":[20,10]}})).unwrap();
+        for at in [[20., 20.], [20., -5.]] {
+            h.step(&json!({"move":{"sketch":at}})).unwrap();
+            h.settle();
+            let (param, draft) = placement_preview(&h.app).expect("a line has a dimension preview");
+            assert!((draft.at - Vec2::new(at[0], at[1])).len() < 1e-5);
+            let sk = &draft.preview.sketch(draft.sketch).unwrap().sketch;
+            let c = sk.constraints.iter().find(|c| c.param.as_deref() == Some(&param)).unwrap();
+            assert!(matches!(c.kind, ConstraintKind::Length {value,..} if (value-20.).abs()<1e-6));
+            assert!(!editing());
+            assert!(drawn().is_empty(), "preview must not become a selectable committed dimension");
+            assert_eq!(h.app.session.doc.to_json(), baseline);
+            assert_eq!(h.app.session.undo.len(), undo);
+        }
+        h.step(&json!({"click":{"sketch":[20,-5]}})).unwrap();
+        assert!(editing());
+        assert_eq!(h.app.session.doc.to_json(), baseline);
+        h.step(&json!({"key":"Escape"})).unwrap();
+        h.step(&json!({"key":"Escape"})).unwrap();
+        assert!(placement_preview(&h.app).is_none());
+        assert_eq!(h.app.session.doc.to_json(), baseline);
+        assert_eq!(h.app.session.undo.len(), undo);
+        cancel();
+    }
+
     #[test]
     fn labels_show_the_value_or_fx() {
         let k = ConstraintKind::Length { l: 0, value: 25.0 };