Release 0.14.0

Version 0.14.0; the pending design-format changes are folded into format 25. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 09:19:14 +00:00 · 2026-10-16 09:19:10 +00:00 · 2026-10-16 04:55:20 -04:00 · 2026-10-16 04:35:53 -04:00 · 2026-10-16 07:38:05 +00:00 · 2026-10-16 03:26:20 -04:00
720 changed files with 141939 additions and 12161 deletions
@@ -3,7 +3,8 @@

 [profile.ci]
 # Heavy tests (one to four minutes each on a CI runner) that pull requests skip. They run on
-# every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`.
+# every push to main and nightly (`--ignore-default-filter`), and in `cargo xtask test`. The
+# boolean_props property tests run only nightly (ci.yml excludes them from pushes to main).
 # Keep this list in sync with docs/book/src/dev/testing.md and CONTRIBUTING.md.
 default-filter = """
 not (
@@ -16,6 +17,8 @@ not (
        | test(=cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall)
    ))
    | (package(solidcraft-kernel) & test(=tests::boolean_identity_on_tangent_primitives))
+    | (package(solidcraft-kernel) & binary(boolean_props))
+    | (package(solidcraft-engine) & binary(atomic_commands))
    | (package(solidcraft-ui-egui) & binary(scenarios) & test(=acceptance_sensor_enclosure))
 )
 """
@@ -28,3 +31,11 @@ slow-timeout = { period = "60s" }

 [profile.ci.junit]
 path = "junit.xml"
+
+# The action matrix sample runs its designs in parallel worker processes, one per CPU. Run with
+# other tests beside it (the heavy ones on main), a pi-case hole that takes 8 s alone (#952 makes
+# it a real hole) went past the matrix's 90 s action limit. It runs on its own.
+[[profile.ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = "num-cpus"
+
@@ -14,6 +14,8 @@ What did you expect, and what happened instead?

 Include steps, SolidCraft version/commit and relevant environment details. Prefer a small example without private design data.

+When the problem shows on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+
 ## Screenshots of the behavior (when observable)

 For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.
@@ -5,91 +5,9 @@ parameter to watch the timeline rebuild. [Documentation](https://bherbruck.githu
 [issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
 `solidcraft-cli mcp` ([how](https://bherbruck.github.io/solidcraft/guide/mcp.html)).

-**Why 0.9:** this is a minor bump because the design file format moved to version 17, and
-because it adds many new features.
-
-**What's new**
- **Face actions work on about 90% of flat faces.** Sketches, offset planes and press-pull now
-  attach to sheet metal rims and holes, plastic features (Boss, Lip, Rest, Snap Fit), lofts,
-  revolved faces, pieces Offset Face moved and walls a Join merged
-  ([#677](https://github.com/bherbruck/solidcraft/pull/677), fixing
-  [#681](https://github.com/bherbruck/solidcraft/issues/681)). Across the test models: sketch
-  75% → 90%, offset plane 75% → 90%, press-pull 64% → 85%.
- **Joins:** a logo-style part with pieces extruded up and down from one sketch now joins
-  ([#679](https://github.com/bherbruck/solidcraft/issues/679)), faces that only partly overlap
-  fuse correctly ([#704](https://github.com/bherbruck/solidcraft/pull/704), fixing
-  [#674](https://github.com/bherbruck/solidcraft/issues/674)), and booleans build the same body
-  every time ([#748](https://github.com/bherbruck/solidcraft/pull/748)), so a design rebuilds
-  identically on every run.
- **Sketch:** type a dimension right after picking (D, click, type;
-  [#695](https://github.com/bherbruck/solidcraft/pull/695)); redundant but consistent
-  constraints are accepted, such as a rectangle clover
-  ([#699](https://github.com/bherbruck/solidcraft/pull/699)); tool windows for Scale, Offset,
-  Mirror, Move/Copy, Fillet and Chamfer and the rectangular pattern (thanks @wdunn001), shown
-  next to the Sketch Palette, which now lists the running tool's options; a typed Rho for the
-  conic; a Construction Geometries row in the Sketch Palette that hides construction geometry
-  ([#804](https://github.com/bherbruck/solidcraft/pull/804)); sketch tool shortcuts open a sketch on the selected plane; Edit Sketch from the viewport
-  menu.
- **Features:** feature history on the left side with folders (opt in under Preferences;
-  [#449](https://github.com/bherbruck/solidcraft/pull/449)); Convert to Sheet Metal from a solid
-  or shelled body by its bend edges ([#725](https://github.com/bherbruck/solidcraft/pull/725));
-  a tear corner relief ([#809](https://github.com/bherbruck/solidcraft/pull/809)); tapered and
-  variable fillet radii ([#675](https://github.com/bherbruck/solidcraft/pull/675),
-  [#749](https://github.com/bherbruck/solidcraft/pull/749)) with a radius spline you drag on the
-  edge ([#752](https://github.com/bherbruck/solidcraft/pull/752)); free-form cut-outs stay exact
-  in sheet-metal flat patterns ([#692](https://github.com/bherbruck/solidcraft/pull/692)) and edge
-  flanges run along what cut-outs leave of an edge
-  ([#702](https://github.com/bherbruck/solidcraft/pull/702)); and Surface Extrude, sheets from
-  open curves and profile walls ([#815](https://github.com/bherbruck/solidcraft/pull/815)).
- **View:** Home and Fit frame only what is shown, and a middle double-click goes Home
-  ([#701](https://github.com/bherbruck/solidcraft/pull/701)); a cube navigator option
-  (thanks @Karl-VonRichter, [#664](https://github.com/bherbruck/solidcraft/pull/664)); the window
-  stays responsive and draggable while a design opens, with a Cancel button that stays put
-  ([#643](https://github.com/bherbruck/solidcraft/pull/643),
-  [#686](https://github.com/bherbruck/solidcraft/pull/686)).
- **Quality:** cuts no longer split walls they don't touch
-  ([#670](https://github.com/bherbruck/solidcraft/pull/670)); booleans are faster and use less
-  memory ([#714](https://github.com/bherbruck/solidcraft/pull/714)); STL export welds shared
-  vertices ([#816](https://github.com/bherbruck/solidcraft/pull/816)); complete Japanese
-  translation ([#753](https://github.com/bherbruck/solidcraft/pull/753)).
- **Fixes:** pasted features act on the pasted bodies (#613); a refused OK's error clears when
-  you change the inputs (#641); dialogs show the units of their sizes (#630); the wheel over a
-  dialog's list scrolls only the list (#678); a Single hole picked at a circle's centre lands on
-  the centre (#657); axis or tangent plane on a drill tip works (#567); sketch text edits from
-  letter interiors and moves as a whole; a projected edge stays the edge you picked; a size from
-  a bare diameter keeps its unit (#716); Convert Mesh says how big a mesh is and what converts;
-  the Save changes prompt takes arrow keys and Enter.
- **MCP:** agent skills for modeling and editing over MCP
-  ([#728](https://github.com/bherbruck/solidcraft/pull/728)).
- A new README demo and the SELENE rover showcase.
-
-**File format 17.** Designs are now format 17 (`solidcraft/17`). SolidCraft 0.8 and older can't
-open designs saved by 0.9, as a container or as JSON; they ask you to update instead. Keep a
-copy of a file you may still open in 0.8. Files from every earlier version still open in 0.9.
-
-**Upgrading from 0.8.** Nothing to do: open your designs and save (they're saved as format 17
-from then on). Feature-history folders on
-the left are off by default; turn them on in Preferences.
-
-**Known limitations**
- Some through-all holes along a wall or beside curved faces still fail
-  ([#559](https://github.com/bherbruck/solidcraft/issues/559)), as does a hole crossing an
-  equal-radius hole ([#788](https://github.com/bherbruck/solidcraft/issues/788)).
- Some fillets are still refused, such as along an outline of lines and arcs
-  ([#431](https://github.com/bherbruck/solidcraft/issues/431)).
- Some faces still can't take an attached sketch: a revolve's flat faces before a later feature
-  ([#726](https://github.com/bherbruck/solidcraft/issues/726)) and faces after Split Body or
-  Combine Intersect ([#565](https://github.com/bherbruck/solidcraft/issues/565)).
- Fillet and chamfer accept an edge pick far from any edge and change the nearest one
-  ([#783](https://github.com/bherbruck/solidcraft/issues/783)); Press Pull fails on faces beside
-  rounds ([#562](https://github.com/bherbruck/solidcraft/issues/562)).
- `sheet.fold` refuses a fixed point exactly on the sheet face
-  ([#685](https://github.com/bherbruck/solidcraft/issues/685)), and some tabs on L-shaped or
-  collinear blanks can't be folded ([#638](https://github.com/bherbruck/solidcraft/issues/638),
-  [#639](https://github.com/bherbruck/solidcraft/issues/639)); an edge flange with different
-  per-edge angles leaves gaps at the corners
-  ([#501](https://github.com/bherbruck/solidcraft/issues/501)).
- More in [ROADMAP.md](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations).
+**What's new** in SolidCraft {version} is listed below, and the
+[ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
+the known limitations. Designs from every earlier version open in this one.

 **Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
 `flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
@@ -1,4 +1,10 @@
 # Fast checks always run; native builds run for code/CI changes.
+# PRs test what they touch; main and nightly test everything. On a pull request the "Select
+# checks" job maps the changed files to workspace packages (scripts/ci/affected.py), adds the
+# packages that depend on them, and Clippy, the test archive and the test shards cover only
+# those. Changes to the lockfile, root manifest, toolchain/cargo/nextest config, .github/,
+# vendor/, tests/, scripts/ or any file no package owns select the whole workspace, as do
+# pushes to main, the nightly run and Run workflow.
 # Tests are built once and run in 4 shards. A few heavy tests (see .config/nextest.toml) are
 # skipped on pull requests and run on pushes to main and nightly.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
@@ -49,6 +55,8 @@ jobs:
    outputs:
      native: ${{ steps.paths.outputs.native }}
      kernel: ${{ steps.paths.outputs.kernel }}
+      full: ${{ steps.paths.outputs.full }}
+      packages: ${{ steps.paths.outputs.packages }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
@@ -62,6 +70,8 @@ jobs:
        run: |
          native=false
          kernel=false
+          full=true
+          packages=
          if [ "$EVENT_NAME" != pull_request ]; then
            native=true
          else
@@ -76,9 +86,20 @@ jobs:
                *) native=true ;;
              esac
            done < "$RUNNER_TEMP/ci-paths"
+            # Pull requests build and test the touched packages and their dependents.
+            python3 -I scripts/ci/affected.py --paths "$RUNNER_TEMP/ci-paths" > "$RUNNER_TEMP/ci-affected"
+            cat "$RUNNER_TEMP/ci-affected"
+            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
+            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
+            # Code changed but nothing was selected: be safe and test everything.
+            if [ "$native" = true ] && [ "$full" != true ] && [ -z "$packages" ]; then full=true; fi
          fi
-          echo "native=$native" >> "$GITHUB_OUTPUT"
-          echo "kernel=$kernel" >> "$GITHUB_OUTPUT"
+          {
+            echo "native=$native"
+            echo "kernel=$kernel"
+            echo "full=$full"
+            echo "packages=$packages"
+          } >> "$GITHUB_OUTPUT"

  checks:
    name: Format and repository checks
@@ -102,6 +123,10 @@ jobs:
        run: cargo xtask layers
      - name: Web app offline use and updates (headless Chrome)
        run: cargo xtask web-offline-test
+      - name: Affected-package selection self-test
+        run: python3 -I scripts/ci/test_affected.py
+      - name: Claim bot tests
+        run: node --test scripts/claim/*.test.js

  clippy:
    name: Native Linux Clippy
@@ -117,7 +142,15 @@ jobs:
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: native-clippy
-      - run: cargo clippy --workspace --all-targets --profile ci --locked -- -D warnings
+      - name: Clippy
+        env:
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
+        run: |
+          # Pull requests lint the affected packages (scripts/ci/affected.py); everything else, all.
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          cargo clippy "${scope[@]}" --all-targets --profile ci --locked -- -D warnings

  build-tests:
    name: Build tests
@@ -144,7 +177,14 @@ jobs:
        with:
          tool: cargo-nextest
      - name: Compile tests into a nextest archive
-        run: cargo nextest archive --workspace --cargo-profile ci --locked --archive-file tests.tar.zst
+        env:
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
+        run: |
+          # Pull requests archive only the affected packages (scripts/ci/affected.py).
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          cargo nextest archive "${scope[@]}" --cargo-profile ci --locked --archive-file tests.tar.zst
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: nextest-archive
@@ -164,8 +204,18 @@ jobs:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
+    env:
+      # Pictures (snapshots, screenshots, ui.render, the viewport's offscreen tests) are drawn on
+      # the GPU. The runner has none: Mesa's lavapipe (software Vulkan) draws them, and a test that
+      # would skip for want of an adapter fails instead.
+      SOLIDCRAFT_GPU: software
+      SOLIDCRAFT_REQUIRE_GPU: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install a software Vulkan driver (lavapipe)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
        with:
          tool: cargo-nextest
@@ -179,11 +229,15 @@ jobs:
        run: |
          # Pull requests skip the heavy tests (default-filter in .config/nextest.toml).
          all=()
-          if [ "$EVENT_NAME" != pull_request ]; then all=(--ignore-default-filter); fi
+          # The boolean property tests draw new random inputs every run; they run only in the
+          # nightly property-tests job, so a known kernel bug cannot turn main red at random.
+          if [ "$EVENT_NAME" != pull_request ]; then
+            all=(--ignore-default-filter -E 'not (package(solidcraft-kernel) & binary(boolean_props))')
+          fi
          # Extract into ./target: tests that run a built binary (env!("CARGO_BIN_EXE_*")) have
          # the build job's path, which is the same checkout path here.
          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --partition "slice:$SHARD/4" "${all[@]}"
+            --profile ci --partition "slice:$SHARD/4" --no-tests=pass "${all[@]}"
      - name: Robustness goldens sample (pull requests that touch the kernel)
        # Every 8th seed of tests/robustness/goldens.json, a quarter per shard; pushes to main and
        # the nightly run every seed in the step above.
@@ -205,16 +259,17 @@ jobs:
  action-matrix:
    # Every ordinary action on every face, edge, vertex and body of the design corpus, against
    # tests/action_matrix/baseline.json (docs/action-matrix.md). Every test run checks a sample;
-    # the whole matrix runs nightly (or by hand), a quarter per job.
-    name: Action matrix (${{ matrix.part }}/4)
+    # the whole matrix runs nightly (or by hand) in shards of about equal cost, cut by
+    # tests/action_matrix/costs.json. Keep SHARDS in step with the matrix below.
+    name: Action matrix (${{ matrix.shard }}/16)
    needs: build-tests
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
-    timeout-minutes: 60
+    timeout-minutes: 55
    strategy:
      fail-fast: false
      matrix:
-        part: [1, 2, 3, 4]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
@@ -223,12 +278,75 @@ jobs:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: nextest-archive
-      - name: Run a quarter of the matrix
+      - name: Run one shard of the matrix
+        # A step limit below the job's, so the outcomes so far are still uploaded.
+        timeout-minutes: 45
        env:
-          PART: ${{ matrix.part }}
+          SHARDS: 16
+          SHARD: ${{ matrix.shard }}
+          OUT: ${{ github.workspace }}/action-matrix
+        run: |
+          mkdir -p "$OUT"
+          export ACTION_MATRIX_SHARD="$SHARD/$SHARDS" ACTION_MATRIX_RESULTS="$OUT/results-$SHARD.json" \
+            ACTION_MATRIX_TIMINGS="$OUT/timings-$SHARD.jsonl" ACTION_MATRIX_WORKDIR="$OUT/raw-$SHARD"
+          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
+            --profile ci --success-output final --run-ignored only -E "binary(action_matrix) & test(=action_matrix_shard)"
+      - name: Upload the outcomes and timings
+        # `cargo xtask action-matrix --from DIR --bless` (with every shard's files in DIR)
+        # records them in the baseline and costs.json.
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: action-matrix-${{ matrix.shard }}
+          path: action-matrix
+          retention-days: 14
+
+  action-matrix-determinism:
+    # A sample of the matrix run twice on one runner: every action must come out the same.
+    name: Action matrix determinism
+    needs: build-tests
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: nextest-archive
+      - name: Run a sample twice
        run: |
          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --run-ignored only -E "binary(action_matrix) & test(=action_matrix_full_$PART)"
+            --profile ci --success-output final --run-ignored only -E "binary(action_matrix) & test(=action_matrix_determinism)"
+
+  property-tests:
+    # The boolean property tests and the atomic command tests with many cases. Pull requests skip
+    # them (.config/nextest.toml); pushes to main run atomic_commands with small defaults (seeds
+    # 0..4) and skip boolean_props, whose random inputs would fail main at random.
+    name: Property tests (many cases)
+    needs: build-tests
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: nextest-archive
+      - name: Boolean properties and atomic commands
+        # The defaults (8 cases, seeds 0..4) take 159 s and 802 s on a 2-core VM; four times the
+        # cases and twice the seeds are estimated at about 40 minutes there (not yet timed on CI).
+        env:
+          PROPTEST_CASES: "32"
+          ATOMIC_SEEDS: "0..8"
+        run: |
+          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
+            --profile ci --ignore-default-filter --success-output final -E "binary(boolean_props) | binary(atomic_commands)"

  doc-tests:
    name: Doc tests
@@ -289,7 +407,8 @@ jobs:
  # D3D12's older shader compiler (FXC, used where dxcompiler.dll is absent) is stricter than
  # DXC, Vulkan and Metal: a shader it cannot compile once crashed the app at startup. Build the
  # GPU tessellation pipeline with FXC on the runner's WARP software adapter and compare its
-  # results with the CPU.
+  # results with the CPU, and draw headless pictures with the viewport's pipelines there
+  # (crates/gpu/tests/capture.rs).
  windows-fxc:
    name: Windows D3D12 FXC shaders
    needs: changes
@@ -299,6 +418,8 @@ jobs:
    env:
      WGPU_BACKEND: dx12
      WGPU_DX12_COMPILER: fxc
+      # WARP is a software (Cpu) adapter.
+      SOLIDCRAFT_GPU: software
      SOLIDCRAFT_REQUIRE_GPU: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -306,11 +427,41 @@ jobs:
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: windows-fxc
-      - run: cargo test -p solidcraft-gpu --profile ci --locked
+      # One test at a time: WARP's shader JIT crashes now and then (a null read in
+      # d3d10warp.dll's JIT optimizer, about 1 run in 60) when several devices compile compute
+      # pipelines at once, which the parallel tests do. Minidumps showed it in WARP itself, not
+      # in SolidCraft or FXC; serial runs never hit it.
+      - run: cargo test -p solidcraft-gpu --profile ci --locked -- --test-threads=1
+
+  # The Windows app starts D3D12 first and only the backend it uses (a Vulkan driver crashed the
+  # app at startup on Intel). Start the real app on the runner (its D3D12 adapter is WARP) with
+  # several saved settings and safe mode, and check each draws a frame and quits cleanly.
+  windows-startup:
+    name: Windows app startup
+    needs: changes
+    if: needs.changes.outputs.native == 'true'
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows-startup
+      - name: Backend order and probing on Windows
+        run: cargo test -p solidcraft --profile ci --locked -- startup::tests native_crash::tests native_frame::tests
+      - name: Build the app
+        run: cargo build -p solidcraft --profile ci --locked
+      - name: Start the app under different settings
+        shell: pwsh
+        run: tools/windows-startup-smoke.ps1 -Exe target/ci/solidcraft.exe
+      - name: Resize border from the first frame
+        shell: pwsh
+        run: tools/windows-resize-smoke.ps1 -Exe target/ci/solidcraft.exe

  # Preserve the existing check name for branch protection, including docs-only PRs.
  ci:
-    needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc]
+    needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
    if: always()
    runs-on: ubuntu-24.04
    steps:
@@ -325,6 +476,7 @@ jobs:
          DOCS: ${{ needs.doc-tests.result }}
          ORACLE: ${{ needs.oracle.result }}
          WINDOWS_FXC: ${{ needs.windows-fxc.result }}
+          WINDOWS_STARTUP: ${{ needs.windows-startup.result }}
        run: |
          test "$CHANGES" = success
          test "$CHECKS" = success
@@ -335,6 +487,7 @@ jobs:
            test "$DOCS" = success
            test "$ORACLE" = success
            test "$WINDOWS_FXC" = success
+            test "$WINDOWS_STARTUP" = success
          fi

  wasm:
@@ -0,0 +1,44 @@
+# `/claim` and `/unclaim` on issues (CONTRIBUTING.md, "Sending a change"), and a daily sweep that
+# frees claims nobody is working on. The logic is in scripts/claim/claim.js (tested in ci.yml).
+name: Claim
+
+on:
+  issue_comment:
+    types: [created]
+  schedule:
+    - cron: '17 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read # to check out scripts/claim
+  issues: write
+  pull-requests: read
+
+# One run at a time per issue, so two simultaneous /claim comments can't both win.
+concurrency:
+  group: claim-${{ github.event.issue.number || 'sweep' }}
+  cancel-in-progress: false
+
+jobs:
+  claim:
+    name: Claim bot
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    if: >-
+      github.event_name != 'issue_comment' ||
+      (!github.event.issue.pull_request && github.event.comment.user.type != 'Bot' &&
+      (startsWith(github.event.comment.body, '/claim') || startsWith(github.event.comment.body, '/unclaim')))
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/claim
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const claim = require('./scripts/claim/claim.js');
+            if (context.eventName === 'issue_comment') {
+              await claim.handleComment({ github, context });
+            } else {
+              const released = await claim.sweep({ github, context });
+              core.info(`Released: ${released.join(', ') || 'none'}`);
+            }
@@ -0,0 +1,48 @@
+# Files generated from the code are rewritten here, on main, after each merge, so pull requests
+# never edit them (two pull requests that each regenerated one would always conflict):
+# THIRD-PARTY-LICENSES.txt (`cargo xtask licences`) and docs/features.md (`cargo xtask features`).
+name: Generated files
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+# One run at a time; a burst of merges leaves one run waiting, which sees all of them.
+concurrency:
+  group: generated-files
+  cancel-in-progress: false
+
+jobs:
+  regenerate:
+    name: Regenerate and commit
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      # Always main itself, never pull request code, since this job can push.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: generated-files
+      - name: THIRD-PARTY-LICENSES.txt
+        run: cargo xtask licences
+      - name: docs/features.md
+        run: cargo xtask features
+      - name: Commit if changed
+        run: |
+          if git diff --quiet -- THIRD-PARTY-LICENSES.txt docs/features.md; then echo "unchanged"; exit 0; fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add THIRD-PARTY-LICENSES.txt docs/features.md
+          git commit -m "Regenerate THIRD-PARTY-LICENSES.txt and docs/features.md [skip ci]"
+          for _ in 1 2 3; do
+            git pull --rebase origin main && git push origin HEAD:main && exit 0
+            sleep 10
+          done
+          exit 1
@@ -0,0 +1,32 @@
+# Files many pull requests add to are kept so that additions don't conflict: one file per change
+# or one sorted line per item (CONTRIBUTING.md, "Lists many changes add to"). Fast, no build.
+name: Lists
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  format-changes:
+    name: Design format changes merge cleanly
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: bash scripts/test-format-pending.sh
+
+  sorted:
+    name: Lists are sorted one item per line
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: lists
+      - run: cargo xtask lists
@@ -45,7 +45,14 @@ jobs:
          curl -sSL "https://github.com/rust-lang/mdBook/releases/download/${MDBOOK_VERSION}/mdbook-${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
          curl -sSL "https://github.com/trunk-rs/trunk/releases/download/${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" | tar -xz -C "$HOME/.local/bin"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - name: Install a software Vulkan driver (lavapipe)
+        # The book's pictures are `solidcraft-cli snapshot`s, drawn on the GPU; the runner has none.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
      - name: Build the book
+        env:
+          SOLIDCRAFT_GPU: software
        run: cargo xtask book
      - name: Build the web app
        working-directory: apps/solidcraft-web
@@ -429,6 +429,32 @@ jobs:
        run: |
          (cd artifacts && sha256sum -- * | tee SHA256SUMS.txt)
          sed "s/{version}/$VERSION/g" .github/release-notes.md >notes.md
+      - name: Sign the checksum list for in-app updates
+        # Optional until the UPDATE_SIGNING_KEY secret exists (docs/releasing.md, "Update
+        # signing"). The trusted comment names the release, which the app checks.
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+        run: |
+          # The key the app checks against (crates/ui-egui/src/update/install.rs, PUBLIC_KEY).
+          public_key=$(sed -n 's/^pub const PUBLIC_KEY: Option<&str> = Some("\([^"]*\)");/\1/p' crates/ui-egui/src/update/install.rs)
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            if [ -n "$public_key" ]; then
+              echo "::error::the app expects signed updates (PUBLIC_KEY is set) but the UPDATE_SIGNING_KEY secret is missing"
+              exit 1
+            fi
+            echo "UPDATE_SIGNING_KEY isn't set: SHA256SUMS.txt stays unsigned"
+            exit 0
+          fi
+          sudo apt-get update -q
+          sudo apt-get install -y --no-install-recommends minisign
+          umask 077
+          printf '%s\n' "$UPDATE_SIGNING_KEY" >"$RUNNER_TEMP/update.key"
+          minisign -S -s "$RUNNER_TEMP/update.key" -m artifacts/SHA256SUMS.txt \
+            -x artifacts/SHA256SUMS.txt.minisig -t "SolidCraft v$VERSION" </dev/null
+          rm -f "$RUNNER_TEMP/update.key"
+          if [ -n "$public_key" ]; then
+            minisign -V -P "$public_key" -m artifacts/SHA256SUMS.txt -x artifacts/SHA256SUMS.txt.minisig
+          fi
      - name: Publish nightly pre-release
        if: github.event_name == 'schedule'
        working-directory: artifacts
@@ -0,0 +1,77 @@
+# Publishing a GitHub release (not a prerelease) opens a pull request at microsoft/winget-pkgs
+# that adds the new version of bherbruck.SolidCraft, so `winget install bherbruck.SolidCraft`
+# and `winget upgrade` get it. Komac (https://github.com/russellbanks/Komac) downloads the three
+# versioned MSIs, reads their product codes and copies the rest from the previous manifest.
+# Skipped until the owner adds the WINGET_TOKEN secret, and while the package isn't in
+# winget-pkgs yet; see docs/releasing.md.
+name: WinGet
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published release tag to submit (e.g. v0.11.1)
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: winget
+  cancel-in-progress: false
+
+env:
+  PACKAGE_ID: bherbruck.SolidCraft
+  KOMAC_VERSION: 2.16.0
+  KOMAC_SHA256: 7d2707fa6210f2789a3702de49fbd150b736dbf426ee0b9bc8e098736f9fd82d
+
+jobs:
+  submit:
+    runs-on: ubuntu-latest
+    steps:
+      - id: check
+        name: Check for the token and the package
+        env:
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          if [ -z "$WINGET_TOKEN" ]; then
+            echo "No WINGET_TOKEN secret: nothing to submit."
+            exit 0
+          fi
+          case "$TAG" in
+            v[0-9]*.[0-9]*.[0-9]*-*|*nightly*) echo "$TAG is a prerelease: not submitted."; exit 0 ;;
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "::error::Unexpected tag '$TAG'"; exit 1 ;;
+          esac
+          if ! gh api "repos/microsoft/winget-pkgs/contents/manifests/b/bherbruck/SolidCraft" --silent; then
+            echo "$PACKAGE_ID isn't in winget-pkgs yet: nothing to update."
+            exit 0
+          fi
+          echo "version=${TAG#v}" >>"$GITHUB_OUTPUT"
+          echo "tag=$TAG" >>"$GITHUB_OUTPUT"
+      - name: Install Komac
+        if: steps.check.outputs.version != ''
+        run: |
+          archive="komac-${KOMAC_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+          curl -fsSLo "$RUNNER_TEMP/$archive" \
+            "https://github.com/russellbanks/Komac/releases/download/v${KOMAC_VERSION}/$archive"
+          echo "$KOMAC_SHA256  $RUNNER_TEMP/$archive" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" komac
+      - name: Open the winget-pkgs pull request
+        if: steps.check.outputs.version != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          VERSION: ${{ steps.check.outputs.version }}
+          TAG: ${{ steps.check.outputs.tag }}
+        run: |
+          base="https://github.com/${GITHUB_REPOSITORY}/releases/download/$TAG"
+          "$RUNNER_TEMP/komac" update "$PACKAGE_ID" --version "$VERSION" \
+            --urls "$base/solidcraft-$VERSION-windows-x64.msi" \
+                   "$base/solidcraft-$VERSION-windows-x86.msi" \
+                   "$base/solidcraft-$VERSION-windows-arm64.msi" \
+            --release-notes-url "https://github.com/${GITHUB_REPOSITORY}/releases/tag/$TAG" \
+            --submit
@@ -27,7 +27,13 @@ new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pa
 ## Never crash
 People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
  returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, design files, control-channel
@@ -75,6 +81,10 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
  `app.start(id)`. Colours come from `theme::Tokens`.
+- **One set of camera controls**: every page or canvas with a camera (viewport, Render
+  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
+  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
+  camera input (a test rejects it).
 - **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
@@ -113,6 +123,23 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
  keep monitoring it while the task is active and make its pending status clear at handoff;
  do not claim it merged without checking.

+## Claim = a draft PR
+- Before working on issue #N, check nobody has it: `gh pr list -R bherbruck/solidcraft --state open --search "#N"`.
+- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
+  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
+  issue wins**; if yours lost, close it. Don't claim by commenting or by editing files.
+- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
+  comment on it first, then open your own claim (you may start from its branch).
+- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
+  and wait while it is over 24; build with `nice`.
+
+## Design file format
+A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
+(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
+`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
+works out the number (the next one while anything is pending), and the release folds pending
+changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
+
 ## Application releases
 Development pushes are not application releases. Follow `docs/releasing.md` when asked to
 prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
@@ -143,5 +170,11 @@ before the draft is verified.

 ## Roadmap
 `ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `cargo xtask features` regenerates `docs/features.md` (SolidCraft's
-commands by area, from the registry) when commands are added or renamed.
+milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
+`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
+workflow; never regenerate them in a PR.
+
+## Lists many PRs add to
+Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
+(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
+then by id, generated files left to `main`, and a design-format change as one new file.
@@ -14,6 +14,9 @@ Editable drawing code, native projects and shipped exports are collected under `

 | File | Author | Source | Licence |
 |---|---|---|---|
+| examples/render-studio.json | SolidCraft contributors | original procedural box/cylinder enclosure script for the integrated Render workspace | MIT OR Apache-2.0 |
+| examples/render-opaque-studio.json | SolidCraft contributors | original procedural sphere study varying opaque metal fraction and roughness independently; no external assets or engineering data | MIT OR Apache-2.0 |
+| crates/gpu/src/pbr.rs | SolidCraft contributors | original WGSL translation of SolidCraft's opaque surface and fixed studio reference, embedded as Rust source; no external shader code | MIT OR Apache-2.0 |
 | assets/archive/icons/macos-v1/exports/icon.svg | SolidCraft contributors | original macOS adaptation of the code-drawn SolidCraft mark, edited and exported with VectorCraft; Apple HIG and production templates consulted as layout references only | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/icon.json | SolidCraft contributors | approved Icon Composer composition and appearance settings for the original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/app/macos/source/SolidCraft.icon/Assets/02-grid.svg | SolidCraft contributors | original perspective grid with elliptical radial alpha, exported from VectorCraft | MIT OR Apache-2.0 |
@@ -33,6 +36,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/archive/icons/macos-v1/exports/icon.iconset/icon_256x256@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
 | assets/archive/icons/macos-v1/exports/icon.iconset/icon_512x512.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
 | assets/archive/icons/macos-v1/exports/icon.iconset/icon_512x512@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch through two sketch lines built by `surface.boundary` with `crown: 0.4` (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
 | docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
 | docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
 | docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
@@ -89,8 +93,12 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/source/pointer.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/de.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/en.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/fr.json | rlartot | French translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/tr.json | macrulz54 | Turkish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/uk.json | Igor Bronovskyi (BrunIF) | Ukrainian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
@@ -103,6 +111,8 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/shaders/viewport.wgsl | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/styles/ui/palettes.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| crates/io/src/native_cad/fixtures/block.FCStd | SolidCraft contributors | original 10 × 20 × 30 mm test box saved by FreeCAD 1.1.4 run as an external program (`make_block_fcstd.py` beside it); no third-party geometry | MIT OR Apache-2.0 |
+| crates/io/src/native_cad/fixtures/block.3dm | SolidCraft contributors | original 10 × 20 × 30 mm test box written with McNeel's MIT-licensed rhino3dm Python package (`make_block_3dm.py` beside it); no third-party geometry | MIT OR Apache-2.0 |

 | docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |

@@ -119,6 +129,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | crates/mcp/src/tools.rs (tool schema helpers and argument checking) | CADCraft `crates/mcp/src/tools.rs`, GridCraft `crates/mcp/src/tools.rs` | MIT OR Apache-2.0 |
 | crates/io/src/threemf.rs (bounded zip part reading and writing) | GridCraft `crates/xlsx/src/package.rs` | MIT OR Apache-2.0 |
 | crates/ui-egui/src/titlebar.rs (title bar drag, caption buttons, resize zones, their tests) and the window setup in apps/solidcraft/src/main.rs | VectorCraft `crates/ui-egui/src/titlebar.rs`, `apps/vectorcraft/src/main.rs` | MIT OR Apache-2.0 |
+| apps/solidcraft/src/open_documents.rs (macOS: files opened from Finder and the Dock, its test) | VectorCraft `apps/vectorcraft/src/open_documents.rs` (https://github.com/storytold/vectorcraft) | MIT OR Apache-2.0 |
 | LICENSE-MIT, LICENSE-APACHE (licence text) | CADCraft | — |
 | .github/workflows/release.yml, .github/workflows/packaging-lint.yml and packaging/ (release pipeline: Linux AppImage/deb/rpm/Flatpak/tar.gz, FreeBSD, macOS dmg, Windows MSI/portable zip, web zip; AppRun, nfpm, Flatpak, WiX and Info.plist templates) | PhotoCraft (https://github.com/storytold/photocraft) `.github/workflows/{release,packaging-lint}.yml`, `packaging/` | Apache-2.0 |

@@ -132,6 +143,27 @@ work cooperative and adds checked run lengths, zero-run rejection, width validat
 header/input/radiance bounds and cancellation. Original licence texts are retained
 in THIRD-PARTY-LICENSES.txt; no images or artwork from that project are copied.

+## File-format crates
+
+| Crate | Used for | Licence |
+|---|---|---|
+| gltf 1.4.1, gltf-json 1.4.1, gltf-derive 1.4.1 (https://github.com/gltf-rs/gltf) | glTF 2.0 import (crates/io/src/gltf_in.rs): the JSON document model and its reference checks; the GLB container, buffers and accessors are read by SolidCraft's own code | MIT OR Apache-2.0 |
+| inflections 1.1.1 (build-time, through gltf-derive) | case conversion in gltf's derive macros | MIT |
+| lazy_static 1.5.1 (through gltf-json) | | MIT OR Apache-2.0 |
+
+The glTF test files are built by the tests themselves (crates/io/src/gltf_in_tests.rs,
+crates/engine/src/tests/gltf_import.rs); no third-party models are committed.
+
+## FreeCAD and Rhino import library
+
+FreeCAD `.FCStd` and Rhino `.3dm` files are read with [cadmpeg](https://github.com/cadmpeg/cadmpeg)
+0.6.1 (Apache-2.0), linked as the crates `cadmpeg-core`, `cadmpeg-ir`, `cadmpeg-registry`,
+`cadmpeg-container`, `cadmpeg-codec-freecad`, `cadmpeg-codec-rhino` and `cadmpeg-codec-step`
+in native builds (`crates/io/src/native_cad.rs`). Only those open-format codecs are built: no
+default features, so cadmpeg's codecs for commercial CAD formats and its ShapeManager/ACIS
+codec are not compiled in. Its licence text is in THIRD-PARTY-LICENSES.txt; no code from it is
+copied into SolidCraft.
+
 ## Recovered contributions

 | SolidCraft file | Original contribution | Licence |
@@ -144,7 +176,8 @@ in THIRD-PARTY-LICENSES.txt; no images or artwork from that project are copied.
 |---|---|---|---|
 | vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: bounded parameter searches, collapsed-boundary projection, subdivision and provisional fixed-grid previews (vendor/README.md) |
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
-| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro (vendor/README.md) |
+| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro; corner choice at vertices several intersection curves end on (vendor/README.md) |
+| vendor/truck-geometry | truck-geometry 0.5.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | intersection curves divided from their neighbours' surface parameters (vendor/README.md) |
 | vendor/matext4cgmath | matext4cgmath 0.1.0, https://github.com/ricosjp/matext4cgmath (RICOS Co. Ltd.) | Apache-2.0 | root refinement stops after 100 Newton steps (vendor/README.md) |

 ## Vendored renderer compatibility fix
@@ -155,3 +188,5 @@ its original `egui.wgsl` shader are retained; no images or other artwork are cop
 SolidCraft's narrow patch selects a safe 1x MSAA path on the chosen OpenGL adapter
 and shares that effective count with the surface attachments and CAD callbacks.
 Vulkan, DirectX 12, Metal and WebGPU retain their requested multisampling.
+A frame whose meshes the GPU refuses to stage (device lost or out of memory) is
+skipped with a warning instead of panicking (#1469).
@@ -27,7 +27,13 @@ new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pa
 ## Never crash
 People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
  returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, design files, control-channel
@@ -90,6 +96,23 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
 - **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
  (`cargo xtask wasm`, part of `cargo xtask ci`).

+## Claim = a draft PR
+- Before working on issue #N, check nobody has it: `gh pr list -R bherbruck/solidcraft --state open --search "#N"`.
+- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
+  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
+  issue wins**; if yours lost, close it. Don't claim by commenting or by editing files.
+- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
+  comment on it first, then open your own claim (you may start from its branch).
+- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
+  and wait while it is over 24; build with `nice`.
+
+## Design file format
+A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
+(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
+`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
+works out the number (the next one while anything is pending), and the release folds pending
+changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
+
 ## Application releases
 Development pushes are not application releases. Follow `docs/releasing.md` when asked to
 prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
@@ -120,5 +143,11 @@ before the draft is verified.

 ## Roadmap
 `ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `cargo xtask features` regenerates `docs/features.md` (SolidCraft's
-commands by area, from the registry) when commands are added or renamed.
+milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
+`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
+workflow; never regenerate them in a PR.
+
+## Lists many PRs add to
+Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
+(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
+then by id, generated files left to `main`, and a design-format change as one new file.
@@ -98,8 +98,8 @@ The [README](README.md#architecture) has the layer table. The short version:
   MIT OR Apache-2.0, and its solver and blends are written from the maths. (Running an
   open-source application to get reference values for a test is fine; reading its source is
   not.) Permissive
-   dependencies are fine. Note which one you're adding and why in the PR, and run
-   `cargo xtask licences` so THIRD-PARTY-LICENSES.txt lists it (CI checks that it is current).
+   dependencies are fine. Note which one you're adding and why in the PR. THIRD-PARTY-LICENSES.txt
+   lists it once the change lands: the Generated files workflow rewrites it on `main`.
   Nightly/manual CI also scans advisories, bans and sources with cargo-deny; see
   [the local command and coverage limits](docs/book/src/dev/testing.md#dependency-advisories).
 3. **Every asset is original or openly licensed and has a row in
@@ -107,13 +107,21 @@ The [README](README.md#architecture) has the layer table. The short version:
   `cargo xtask assets` enforces this.
 4. **Never crash.** People trust a CAD app with their work.
   - Non-test code never uses `unwrap`, `expect`, `panic!` or indexing on input-derived data.
-     There's no `unsafe`, and clippy denies it.
+     There's no `unsafe` outside `apps/solidcraft/src/open_documents.rs` (macOS file-open events)
+     and `apps/solidcraft/src/native_crash.rs` (Windows native crash capture), and the compiler
+     denies it.
   - An unsupported case returns an error ("not supported yet: …"); it never panics.
   - Every call into truck goes through `solidcraft_kernel::guard`.
   - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
   face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
+   viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
+   `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
+   `NavCaps` saying whether it can orbit (off for flat 2D pages) and pick. New canvases must use
+   `navigation::handle`; never read drags, the wheel or pinch to move the camera yourself. The
+   `hand_rolled_camera_input_is_rejected` test fails if a page does.

 [AGENTS.md](AGENTS.md) has the long form of these rules. It's written for AI agents, but it's
 the most complete description of the house style.
@@ -155,6 +163,13 @@ in the PR. `cargo xtask test` builds the tests with it and then runs every test
 `cargo xtask test -- shell`. Tests run beside each other on a busy machine, so a test must not
 depend on wall-clock timing.

+**PRs test what they touch; main and nightly test everything.** On a pull request, CI maps the
+changed files to workspace packages and runs Clippy, the test build and the tests for those and
+the packages that depend on them (`scripts/ci/affected.py`, self-tested in the `checks` job). A
+change to `Cargo.lock`, the root `Cargo.toml`, `.cargo/`, `.config/`, `.github/`, `vendor/`,
+`tests/`, `scripts/` or any file outside a package runs the whole workspace, as does every push
+to `main`, the nightly run and Run workflow.
+
 **CI shards the tests.** One job builds them into a cargo-nextest archive and four jobs run a
 quarter each, so every test runs in its own process: don't rely on state left by another test.
 Pull requests skip a few heavy tests (one to four minutes each), which run on every push to
@@ -165,8 +180,9 @@ Pull requests skip a few heavy tests (one to four minutes each), which run on ev
  `tests::robustness_goldens` (pull requests that touch `crates/kernel` run its `sample_*` part),
  `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
  `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
-  `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`
- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`
+  `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`, the `atomic_commands` contract tests
+- `solidcraft-kernel`: `tests::boolean_identity_on_tangent_primitives`, and the `boolean_props` property tests
+  (these run only in the nightly "Property tests" job: their inputs are random, so main skips them too)
 - `solidcraft-ui-egui` scenarios: `acceptance_sensor_enclosure`

 **The action matrix** tries every ordinary action on every face, edge, vertex and body of a
@@ -184,18 +200,75 @@ the current results, and CI runs `cargo xtask oracle` on every pull request. A c
 because of a known bug names its issue in `expected.json` (`"known_failure": "#123"`); never
 change an expected value to match SolidCraft's output.

+## Changing the design file format
+
+A design file says which format it is in (`"format": "solidcraft/N"`). If your change saves
+something new in a design (a field, a feature type, a new kind of name), or makes older designs
+mean something else, it needs a format change. **Add one file, and edit nothing shared:**
+
+1. Create `crates/doc/src/format/pending/<what-it-is>.rs` (lowercase, dashes). Start it with a
+   `//!` note: what is saved, what older designs get without it, and that the last release asks
+   for an update instead of meeting it.
+2. If older designs must be rewritten as they open, put `pub fn step(v: &mut Value) ->
+   crate::Result<()>` in the same file. Pending steps run in file-name order, after the older
+   formats' steps.
+3. Don't touch `FORMAT`, `JSON_STEPS`, the history in `crates/doc/src/format.rs`, another
+   change's file, or any `v<N>/` folder: those are fixed once released.
+
+That's all. The build counts the files: while any are pending it writes the next format number,
+which no release reads, so a release refuses a design that has your change instead of losing it.
+A file also lists the pending changes it has (`format_pending`), so a later development build
+runs only the steps that file is missing. Two pull requests that each add a change merge without
+a conflict. `crates/doc/src/format/pending/README.md` has an example.
+
+**At release time** the maintainer runs `scripts/fold-format-pending.sh`, which moves the pending
+files into `crates/doc/src/format/v<N>/` and fixes that number for good (see
+[docs/releasing.md](docs/releasing.md)). Never add a file to a `v<N>/` folder afterwards.
+
+## Lists many changes add to
+
+Some files gain an item in many pull requests at once. They are kept so that two changes that
+each add an item only meet when their items are neighbours, which spares everyone a conflict
+and a fresh CI run:
+
+- **Message catalogs** (`assets/locales/*.json`): one message per line, sorted by id. Add your
+  message anywhere and run `cargo xtask lists --fix`; `cargo xtask lists` (in `cargo xtask ci`
+  and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
+- **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
+  sorted). Add a new module into the existing group, not as a new group at the end.
+- **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
+  checks it).
+- **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
+  after each merge by the Generated files workflow (`cargo xtask licences`, `cargo xtask
+  features`). Don't regenerate or edit them in a pull request.
+- **Design format**: one file per change, never an edit to a shared number (above).
+
 ## Sending a change

 1. Work is tracked in [GitHub issues](https://github.com/bherbruck/solidcraft/issues), labelled
-   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). Before starting,
-   comment on the issue so it gets the `in progress` label and two people don't build the same
-   thing. For anything bigger than a bug fix that has no issue yet, open one first.
+   by area (`area:kernel`, `area:sketch`, `area:doc`, `area:ui`, `area:infra`). For anything
+   bigger than a bug fix that has no issue yet, open one first. **Claim the issue with a draft
+   PR** before you start, so two people don't build the same thing:
+   - Check nobody has it: `gh pr list -R bherbruck/solidcraft --state open --search "#N"`.
+   - Branch from the latest `main`, commit `git commit --allow-empty -m "claim: #N"`, push, and
+     open a **draft** PR titled `<summary> (#N)`, e.g. `Fillet: variable radius along a chain (#123)`.
+   - **The lowest-numbered open PR for an issue wins.** If yours lost, close it (or offer to help
+     on the other one).
+   - Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
+     comment on it first, then open your own claim.
+   - Mark the PR ready for review when it is done.
 2. Branch from `main` and keep the PR to one topic.
 3. Run `cargo xtask ci` before pushing. It runs fmt, the asset, licence and layer checks,
   clippy (`-D warnings`), then the tests with the wasm build check alongside. A PR has to pass it.
 4. Reference the issue (`Fixes #12`). In the PR, say what you tested and how. For geometry work, include the measured numbers (and
   the expected ones).

+Comment `/claim` on an issue to take it: you are assigned, it gets the `in progress` label, and
+the bot replies with the deadline. Open a draft PR referencing the issue within 72 hours, or the
+claim lapses and the issue is freed again; a claim with a PR is freed after 14 days without
+pushes. `/unclaim` releases it early (only you or a maintainer can). Issues a maintainer has
+taken are never freed automatically.
+
 Help reviewers see what the words mean. For observable CAD, UI or model behavior, please
 include actual descriptive screenshots or a short recording in the issue or PR. This evidence
 is required for changes or bugs that can be demonstrated in the app, including kernel,
@@ -224,6 +297,8 @@ long as the change meets the rules above.

 ## Where help is wanted most

+**Kernel speed (slow fillets, booleans, STEP):** please don't rewrite the current kernel code for speed; it is being replaced by [solidcore](https://github.com/bherbruck/solidcore) ([progress](https://bherbruck.github.io/solidcore/)). Report slow cases with a file under the `kernel-perf` label, and put kernel effort into solidcore instead. See [#1597](https://github.com/bherbruck/solidcraft/issues/1597).
+
 See the [`help wanted`](https://github.com/bherbruck/solidcraft/labels/help%20wanted) and
 [`good first issue`](https://github.com/bherbruck/solidcraft/labels/good%20first%20issue) labels.
 In order of how much they'd help users:
@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]

 [workspace.package]
-version = "0.10.1"
+version = "0.14.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -24,13 +24,20 @@ solidcraft-io = { path = "crates/io" }
 solidcraft-engine = { path = "crates/engine" }
 solidcraft-ui-egui = { path = "crates/ui-egui" }
 solidcraft-mcp = { path = "crates/mcp" }
+solidcraft-derive = { path = "crates/derive" }

 # foundation
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
+# derive macros (crates/derive); already in the tree through serde_derive
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 sha2 = "0.10"
+moxcms = { version = "0.8.1", default-features = false, features = ["extended_range"] }
+semver = "1"

 # geometry kernel (Apache-2.0; see plan/adr/0001-geometry-kernel.md). Only crates/kernel uses it.
 truck-modeling = "0.6"
@@ -46,12 +53,24 @@ rayon = "1.12"
 # packages (3MF)
 zip = { version = "3", default-features = false, features = ["deflate"] }
 quick-xml = "0.41"
+# glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
+# read by crates/io itself, so no image decoding or file access comes with it.
+gltf = { version = "1.4", default-features = false, features = ["names"] }
+
+# FreeCAD and Rhino import (Apache-2.0, pure Rust apart from zstd; native builds only).
+# Pinned: its IR and codec APIs change between minor versions. Open formats only: no default
+# features, so cadmpeg's codecs for commercial formats (f3d, sldprt, inventor, catia, creo, nx)
+# and its ShapeManager/ACIS `sat` codec are not compiled in. `step` is the writer we restate through.
+cadmpeg-core = "=0.6.1"
+cadmpeg-ir = "=0.6.1"
+cadmpeg-registry = { version = "=0.6.1", default-features = false, features = ["fcstd", "rhino", "step"] }

 # fonts (sketch text outlines; MIT OR Apache-2.0, pure Rust)
 ttf-parser = { version = "0.25", default-features = false, features = ["std"] }

 # images
 image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
+png = "0.18.1"

 # ui
 egui = "0.36"
@@ -107,6 +126,7 @@ debug = "line-tables-only"

 # truck-shapeops with SolidCraft fixes (Apache-2.0, see vendor/truck-shapeops and ATTRIBUTION.md).
 [patch.crates-io]
+truck-geometry = { path = "vendor/truck-geometry" }
 truck-shapeops = { path = "vendor/truck-shapeops" }
 truck-stepio = { path = "vendor/truck-stepio" }
 truck-meshalgo = { path = "vendor/truck-meshalgo" }
@@ -21,6 +21,8 @@ model through the built-in MCP server.
 - **Windows:** download and run the [installer][windows-msi].
  Also for [ARM64][windows-arm64-msi] and [32-bit][windows-x86-msi] PCs, or as a
  [portable zip][windows-portable] that runs without installing.
+  With [WinGet](https://learn.microsoft.com/windows/package-manager/winget/):
+  `winget install bherbruck.SolidCraft`.
 - **macOS:** open the [disk image][macos-dmg] and drag SolidCraft into Applications
  (Apple silicon and Intel).
 - **Linux:** download the [AppImage][linux-appimage], allow it to run as a program and open it.
@@ -80,6 +82,9 @@ rebuild with no errors, replayed here at 2× speed.

 ## What works

+- **Current-view DXF export** from File → Export Current View as DXF, with hidden edges
+  omitted or dashed, shown body placements and the current camera. See [view DXF](docs/view-dxf.md).
+
 - **Sketches** on origin planes, offset planes or planar faces: lines, rectangles, circles,
  arcs, polygons, slots, ellipses, fit/control splines, conics and text; construction geometry,
  projection, trimming, fillets and chamfers, including corners at the origin.
@@ -127,13 +132,30 @@ rebuild with no errors, replayed here at 2× speed.
  components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ, and
  assemblies with joints as URDF for robot simulators (docs/urdf.md);
-  3MF, STL and OBJ import as mesh bodies (they render, measure, move and export; solid features
-  need B-rep bodies). Convert Mesh reconstructs supported closed constant-section parts
+  3MF, STL, OBJ and glTF 2.0 (`.glb`/`.gltf`, its node tree as components and its materials as
+  appearances) import as mesh bodies (they render, measure, move and export; solid features
+  need B-rep bodies). The `mesh.convert` command reconstructs supported closed constant-section parts
  as parametric solids with planar and circular cylindrical faces;
  STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
  (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
  that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
-  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)).
+  design, or drop it on the window ([docs/step-import.md](docs/step-import.md)); FreeCAD
+  `.FCStd` and Rhino `.3dm` solids import the same way through
+  [cadmpeg](https://github.com/cadmpeg/cadmpeg) in the desktop app and CLI.
+- **Render:** opaque surfaces can use metal fraction, roughness and dielectric IOR in the
+  integrated product viewport and CPU preview PNGs. Existing simple colors remain supported.
+  Fixed direct lighting is a preview; HDRI, refraction and texture maps are not implemented.
+  See [opaque surfaces](docs/render-opaque-pbr.md).
+- **Display meshes** from our own tessellation planner: each face becomes a plan of (u, v)
+  points and triangles that shares its edge nodes with its neighbours, so the mesh is watertight.
+  Facets follow the chord tolerance, the facet angle and a longest side, with cells at most 2:1
+  along straight directions. Box-bounded and four-cornered faces mesh as structured grids.
+  Trimmed faces are cut into four-sided patches: squares around holes, butterflies in round
+  faces, motorcycle traces from concave corners (after Lyon et al. 2019). Each patch then meshes
+  as a Coons grid. Intersection edges are evaluated by Newton on both surfaces. A compute shader
+  evaluates the plans for the whole scene in one dispatch, with a CPU fallback when the GPU
+  can't build it. Planning and evaluating the 78 reference bodies takes about 65 ms, 50–65×
+  faster than the previous mesher.
 - **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
  axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
  control channel so agents and tests can drive it.
@@ -151,6 +173,7 @@ cargo run --release -p solidcraft -- --sample          # desktop app with a samp
 cargo run --release -p solidcraft-cli -- commands      # the command registry
 cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
 cargo run --release -p solidcraft-cli -- snapshot examples/bracket.json --out bracket.png
+cargo run --release -p solidcraft-cli -- render examples/render-studio.json --out product.png
 cargo run --release -p solidcraft -- part.step          # open a STEP file as a new design
 cargo run --release -p solidcraft-cli -- eval part.step # measure an imported STEP file
 cargo xtask ci                                          # fmt, clippy, tests, assets, layers, wasm
@@ -161,7 +184,13 @@ Windows builds: `cargo xwin build --release --target x86_64-pc-windows-msvc -p s
 On Windows and Linux, SolidCraft detects a connected 3Dconnexion SpaceNavigator or SpaceMouse through its
 multi-axis HID interface. Move the cap to pan and zoom, and tilt or twist it to rotate the 3D view.
 While editing a sketch, the cap pans and zooms without changing the sketch view. The Navigation
-page in Preferences has an on/off switch and a speed control for the 3D mouse.
+page in Preferences has an on/off switch and a speed control for the 3D mouse. The web app reads
+it too, through the browser; Firefox needs a 3DxWare setting first (see
+[Getting started › 3D mouse in the browser](docs/book/src/guide/getting-started.md#3d-mouse-in-the-browser)).
+
+With 3DxWare on Windows, SolidCraft follows 3DxWare's profile for it when there is one, and
+3DxWare's object mode (tilt to roll, twist to spin) until there is. The mouse-wheel turns that
+3DxWare makes from the cap's motion are ignored, so the view doesn't zoom in steps as the cap tilts.

 On Linux SolidCraft reads `/dev/hidrawN` directly, so the logged-in user needs access to the
 device. A udev rule that adds the `uaccess` tag does that, for example
@@ -211,11 +240,11 @@ configuration and an example session: [docs/mcp.md](docs/mcp.md).
 | Layer | Crates | Role |
 |---|---|---|
 | L0 | `geom` | vectors, planes, profiles, meshes and their measures |
-| L1 | `sketch`, `kernel`, `render` | constraint solver and profiles; the B-rep kernel boundary (truck); view math and CPU rasterizer |
+| L1 | `sketch`, `kernel`, `render` | constraint solver and profiles; the B-rep kernel boundary (truck); view math and the headless scene description |
 | L2 | `doc` | parameters, expressions, the feature timeline and its incremental evaluation |
-| L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL import features |
+| L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL/OBJ/glTF import features |
 | L4 | `engine` | the session and the command registry (everything is a command) |
-| L5 | `ui-egui`, `mcp` | the swappable desktop front end; the MCP server (headless or bridged to the app) |
+| L5 | `gpu`, `ui-egui`, `mcp` | compute-shader evaluation of display tessellation plans; the swappable desktop front end; the MCP server (headless or bridged to the app) |
 | apps | `solidcraft`, `solidcraft-cli` | desktop app, headless CLI |
 <!-- ANCHOR_END: architecture -->

@@ -1,15 +1,15 @@
 # SolidCraft roadmap

-Status as of **2026-10-11**. SolidCraft supports parametric modelling (sketch →
+Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.

 ## At a glance

 | Question | Answer |
 |---|---|
-| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
+| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; FreeCAD/Rhino import; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
 | Features | Every registered command by area — [docs/features.md](docs/features.md) (`cargo xtask features`); registry breadth does not establish workflow or geometric depth |
-| Reference tests | **76 / 76 parts match** — [docs/oracle.md](docs/oracle.md): public cases in `tests/oracle/` with analytic (55) or FreeCAD-computed (21) expected values, run by CI on every PR. |
+| Reference tests | **82 / 82 parts match** — [docs/oracle.md](docs/oracle.md): public cases in `tests/oracle/` with analytic (61) or FreeCAD-computed (21) expected values, run by CI on every PR. |
 | Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
 | Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
 | Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
@@ -21,6 +21,8 @@ offsets and plastic face placements, XZ (+Y normal) with a v6 migration preservi
 designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
 toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
 acceptance scenarios now include board resizes; STEP reopening is automated. See [WIP reconciliation](docs/wip-reconciliation.md).
+Face-based Extrude Join (including outward Press Pull) now defaults to the picked body,
+so edge-touching assembly neighbours stay separate regardless of body order (#226).

 In scope, in priority order:
 1. SOLID and SKETCH (now).
@@ -47,18 +49,38 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 | M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
 | M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
+| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
 | M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
 | M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; optional compact named left feature history with rollback bar, multi-selection and persistent folders above the parts browser), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
-| M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Patch with G1/G2 and general loops (#759), Blend surface (#764), sweep rails, twist and scale (#771, loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
+| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops of any shape and number of sides as one face, G0/G1/G2 to the faces beside each edge, through points, #759), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Blend surface (#764), sweep guide rails and two-rail sweeps (#771; orientation, twist and end scale done; loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Patch with G1/G2 and general loops (#759), Blend surface (#764), sweep guide rails and two-rail sweeps (#771; orientation, twist and end scale done; loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), gears, rack and pinion and screws (motion links whose ratio follows picked radii, parameters or a pitch, also inside closed loops), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Motion Trace (a picked point's path as a joint is driven or a study plays, closed loops following; kept as a 3D sketch spline), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Gear, Rack and Pinion, Screw and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), gears, rack and pinion and screws (motion links whose ratio follows picked radii, parameters or a pitch, also inside closed loops), inverse kinematics (`joint.reach`: a part's point to a target through the joints on its chain, within limits and with loops closed, nearest pose and its stopper when out of reach; dragging a jointed part in the viewport moves it as far as its joints allow), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Gear, Rack and Pinion, Screw and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
 | M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
 | M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
 | M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
 | M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |

+M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
+pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
+retain their saved two-finger scroll preference; camera motion is available through
+`view.navigate` and modifier-aware `ui.move` automation.
+
+M11 precursor: File → Export Current View as DXF exports shown placed bodies from the current
+camera as a 2D millimetre drawing, with hidden edges omitted or dashed. Vector occlusion splits
+partly hidden edges and includes curved silhouettes. Curves are approximated; drawing sheets,
+annotations and exact projected curves remain deferred. See [view DXF](docs/view-dxf.md).
+
+## Interactive modelling
+
+- New Body extrusion and face-offset previews show completed intermediate geometry while a
+  drag continues, then catch up to the exact final value. Changes to the selected geometry,
+  operation or feature still discard obsolete results. Distance arrows and their value boxes
+  follow the current frame's input.
+
 ## Physical material data

 - Physical material card validation (#923/#922) provides typed SI mechanical and
@@ -67,8 +89,18 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
  persist properties, provide a solver or enable rendering; see
  [the contract and staged follow-ups](docs/physical-material-cards.md).

+- Directional elasticity (#994) queries the validated card in material-local axes
+  through read-only `material.properties.directional`, with source/condition review.
+  It does not assign body frames, predict structural behavior or enable a solver.
+
 ## Library foundations (#785, #786, #787)

+- Local scalar libraries (#846) inspect/export bounded portable catalogs and copy exact
+  selected appearance/material revisions into existing design definitions in one undo step.
+  Appearance offers local loading/search/export; physical materials use existing commands.
+  This slice is independent of the render stack and does not change the document format.
+  See [the contract and limits](docs/book/src/dev/local-libraries.md).
+
 - Proposed phases cover offline bundled/project/user packs, physical materials and
  appearances, editable wood mapping, and parameterized component/assembly families.
  Stable identity/revision, copied design definitions, provenance and resource limits
@@ -79,14 +111,57 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.

 ## Render foundation

+- Explicit texture normalization (#1218) produces completed float RGBA with
+  role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
+  opt-in EXIF orientation. It retains high-precision raw samples and records lossy
+  gamut clipping only when explicitly requested. It is not a renderer/resource
+  consumer; see [the supported policy and limits](docs/render-texture-normalization.md).
+
+- Opt-in opaque PBR (#1046) connects persisted surface parameters to the integrated
+  product viewport and CPU PNG, using a fixed direct-light studio. Geometry and mass
+  stay unchanged. HDRI, transmission and textures remain separate gates.
+  See [the consumer and limitations](docs/render-opaque-pbr.md).
+
+- Combined integration is tracked in #842, with independent scalar libraries in
+  #863 and richer PBR/material-card transport in #1086. See [phase boundaries and validation gates](docs/render-integration.md).
+  Render/library consumers use the merged asynchronous picker (#1127). Material-card
+  UI (#1094), texture mapping and HDRI lighting remain explicit follow-ups.
+
+- R4a adds bounded CPU product-image jobs, cancellation and atomic PNG export through
+  engine commands, the Render panel, CLI and persistent MCP. Immutable captures and
+  results stay outside persistence/undo; native workers and cooperative browser tasks
+  share the same work protocol. See [jobs, limits and export](docs/render-jobs.md).
+
+- R3 adds an overlay-free product scene and the integrated Render workspace, with
+  runtime GPU host capabilities, per-document drafts and named camera/background
+  controls. Design keeps its camera and drawing policy. Raster transparency remains
+  approximate; PBR and environments are later slices. See
+  [workspace and scene contracts](docs/render-workspace.md).
+
+- R2 adds bounded named render setups in document format 21 and the read/save
+  `render.settings.get/set` commands. Proven render-only changes preserve geometry
+  and prepared world data through undo/redo and checkpoint restore. This slice does
+  not add a Render workspace, PBR, environments or image jobs; see
+  [settings and refresh policy](docs/render-settings.md).
+- Bounded PNG/JPEG texture admission (#900) validates in-memory sources and returns
+  completed RGBA8 pixels with explicit color/data roles. It is an input utility only:
+  ICC/16-bit normalization, local wood mapping, resource persistence and the renderer
+  consumer remain separate work. See [limits and licensed-file probes](docs/render-texture-input.md).
+
+- The initial opaque surface numerical contract for #1004 provides bounded linear
+  color/metallic/roughness/IOR admission and an original tested direct-light BRDF.
+  The numerical module alone advertises no capabilities; the installed consumer above
+  provides rendering. See
+  [the model, evidence and remaining consumer gates](docs/render-surface.md).
+
 - A bounded cooperative Radiance RGBE input utility is available in L1 render;
  it does not yet enable HDRI/PBR rendering or a document import command. See
  [the input contract](docs/render-hdr-input.md) and #813 for integration work.
 - R1 adds renderer-independent backend/profile metadata, strict request resolution and
  bounded image/scratch admission checks, exposed by the read-only `render.backends`
  command. It describes the current CPU raster snapshot path without evaluating the model.
-  Existing snapshot and viewport routes remain unchanged. The Render workspace, HDRI/PBR,
-  render jobs and optional engines remain future work; see [the contract](docs/render-backends.md)
+  The legacy Design snapshot route remains unchanged. Later slices above provide the
+  workspace/jobs and opaque PBR; HDRI and optional engines remain future work. See [the contract](docs/render-backends.md)
  and [the phased proposal (#620)](https://github.com/bherbruck/solidcraft/issues/620).

 ## Dimensioning and error reporting
@@ -155,6 +230,21 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
  Crash Reports…) with a reviewed issue draft; agents read them through
  `diagnostics.crash_reports`, the MCP `crash_reports` tool or the CLI. Nothing is sent
  anywhere. See [crash reports](docs/crash-reports.md).
+- Agent chat (off by default, desktop): a side panel that drives a coding agent the user
+  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, Grok Build, …) over the
+  Agent Client Protocol, under the user's own login; SolidCraft stores no keys. The agent works
+  through SolidCraft's MCP tools on a gated endpoint of its own: file actions wait for Allow or
+  Deny, crash reports are off limits, 24 changes per message, one undo step per message, and
+  the agent's whole process group ends with the panel or the app. Docks left or right,
+  minimises to a strip. Grok Build discovery includes `~/.grok/bin` and reuses the user's
+  Grok login. See [agent chat](docs/agent-chat.md).
+- Command scripts from designs (#886): `timeline.export_script` (CLI `solidcraft-cli script`)
+  writes a design's history as a script that `eval` and `run` replay into the same design —
+  user parameters, units, sheet metal and plastic rules and materials as their own commands,
+  then each feature through `timeline.add` with its ids, names and dimension parameters kept,
+  so every feature kind replays exactly and a failing feature fails the same way. Trimming the
+  script after a step gives the design at that step. Appearances, folders, views and
+  configurations are listed as left out; components and joints are not supported yet.

 ## 0.2.0 release batch

@@ -220,11 +310,15 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
  is an equivalent circular setback. Curved faces/edges, sloped ends and corner junctions remain unsupported.
 - Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
  rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
-  meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
+  meet (a sphere for equal radii); perpendicular corner fillets after a closed ring of earlier
+  rounds preserve the ring's radii and the enclosed planar face (#1557);
+  straight edges (convex or concave) between planar faces with perpendicular
  planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
  basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
  corners around pocket rims, with unequal wall slopes and extensions confined to the face;
  connected equal-distance chamfers also trim each other across unequal sloped rim walls;
+  curved chamfer chains with straight planar ends can terminate across two existing planar
+  bevel faces, splitting their shared seam; picks on the same tangent chain are applied once (#1303);
  whole smooth loops of a planar face, picked whole or by one edge (tangent
  chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
  plate outlines), loops with sharp corners between straight edges (the blends meet in mitres), runs of
@@ -242,7 +336,8 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
  of two edges at a vertex meet in a crease, as on a box), picked together or one after the
  other, except a round after a round of the edge between the wall and a flat face that it
  would run over; the three edges at a vertex of any smooth faces, of one radius, end in a
-  piece of sphere.
+  piece of sphere. A limiting blend that collapses a side wall into coincident boundary
+  curves is refused as too large rather than returning an unmeshable face (#1113).
 - Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
  sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
  annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
@@ -276,6 +371,9 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
  and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
  touch (no clean crossing) enter that profile as polylines.
  Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
+  A sweep with a twist, an end scale or a parallel or direction orientation (#771) follows its
+  path that way too, even along sketch lines and arcs: B-spline walls through stations, ruled
+  walls through denser stations where the path has corners or the profile has holes.
 - Extend intersects exact ellipses and rational/high-degree splines without moving the line or
  circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
  certificate and refine within bounded node limits while retaining existing IDs.
@@ -421,6 +519,15 @@ editing. Construction planes and points resolve drawn 3D wires without applying
 plane a second time. Curved paths use sampled segments; multi-curve chains, absolute distance
 and reference-object placement remain separate work, as do loft rails and centerlines.

+## Design properties (#1015)
+
+- Designs carry project, part number, revision, author, organization, description and licence
+  in an optional `metadata` object (File → Design Properties…, `document.metadata.*`,
+  `inspect_design`). STEP and IGES headers and 3MF model metadata take the fields their format
+  has a place for. Other tools keep their own data under a reverse-DNS key, kept as it is
+  through open, edit and save and never exported. See [design properties](docs/book/src/guide/files.md#design-properties).
+  Per-component properties (a part number per component) can follow with the same type.
+
 ## Document-opening performance

 - Desktop STEP import prepares consecutive independent solids in bounded batches with up
@@ -466,6 +573,14 @@ and reference-object placement remain separate work, as do loft rails and center
  events by strategy and reports any bounded-log truncation. Existing geometry
  acceptance checks remain in force.

+- Cylinders of one radius whose axes cross (a second bore across a bore of the same size, a pipe
+  tee of equal pipes) touch at two points, where the mesh intersection cannot trace the curves
+  and a boolean cannot tell the four arms of the crossing apart. When the ordinary boolean fails
+  on such a pair, both faces are split along the line of their cylinder through the touching
+  points (the solids are unchanged), the boolean is taken of those, and its history is composed
+  back over the operands as given (#788). The result keeps the split lines as edges of the bore
+  walls. A crossing the ordinary route fails on and the split faces do not help (a radius of 17.5
+  in a 45 mm block with a tool of 80 mm) is still refused.
 - Boolean intersection-curve construction refuses point-only, collapsed and non-finite
  polylines without panicking. Direct constructor regressions retain valid open endpoints
  and closed spherical intersections; the original interactive trigger remains unidentified.
@@ -21,5 +21,10 @@ path = "src/alias.rs"

 [dependencies]
 solidcraft-engine = { workspace = true }
+solidcraft-gpu = { workspace = true }
 solidcraft-mcp = { workspace = true }
 serde_json = { workspace = true }
+
+[dev-dependencies]
+# Snapshot tests decode the pictures to compare them with a tolerance.
+image = { workspace = true }
@@ -0,0 +1,239 @@
+//! `bench-agent`: a large design built the way an agent builds one over MCP, one small command
+//! at a time, timed as it grows and then opened again.
+//!
+//! The design is a bicycle of about 1,300 bodies: frame tubes joined at root and then moved into
+//! a component, two wheels whose spokes and nipples are placed one by one, a chainring with
+//! patterned teeth, a cassette, a chain of individual links, cockpit, seat and a few hundred
+//! fasteners. Nothing is read from a file; the script is generated here, so the benchmark needs
+//! no fixture.
+//!
+//! ```text
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! ```
+//! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
+//! build total, then the phases `bench-open` prints for the saved design.
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+struct Script {
+    commands: Vec<Value>,
+}
+
+impl Script {
+    fn c(&mut self, command: &str, params: Value) {
+        self.commands.push(json!({"command": command, "params": params}));
+    }
+
+    /// A round tube from `a` to `b` (an agent's frame tube, spoke or post).
+    fn tube(&mut self, a: [f64; 3], b: [f64; 3], radius: f64, body: &str) {
+        let d = [b[0] - a[0], b[1] - a[1], b[2] - a[2]];
+        let len = (d[0] * d[0] + d[1] * d[1] + d[2] * d[2]).sqrt();
+        let axis = [d[0] / len, d[1] / len, d[2] / len];
+        self.c(
+            "solid.cylinder",
+            json!({"radius": radius, "height": round3(len), "base": a.map(round3), "axis": axis.map(round6), "body_name": body}),
+        );
+    }
+
+    fn component(&mut self, name: &str) {
+        self.c("component.create", json!({"name": name}));
+    }
+
+    fn root(&mut self) {
+        self.c("component.activate", json!({"component": "root"}));
+    }
+
+    /// A wheel built at the origin in its own component, then placed where it goes (the
+    /// component's occurrence moved), as an agent builds one part and positions it.
+    fn wheel(&mut self, label: &str, at: f64, spokes: usize) {
+        let cx = 0.0;
+        self.component(&format!("{label} wheel"));
+        self.c("solid.torus", json!({"major": 311, "minor": 12, "center": [cx, 0, 340], "body_name": format!("{label} rim")}));
+        self.c("solid.torus", json!({"major": 330, "minor": 18, "center": [cx, 0, 340], "body_name": format!("{label} tyre")}));
+        self.c("solid.cylinder", json!({"radius": 18, "height": 110, "base": [cx, -55, 340], "axis": "Y", "body_name": format!("{label} hub")}));
+        for k in 0..spokes {
+            let a = std::f64::consts::TAU * k as f64 / spokes as f64;
+            let side = if k % 2 == 1 { 1.0 } else { -1.0 };
+            let hub = [cx + 30.0 * a.cos(), side * 40.0, 340.0 + 30.0 * a.sin()];
+            let (ca, sa) = ((a + 0.12).cos(), (a + 0.12).sin());
+            let rim = [cx + 300.0 * ca, side * 4.0, 340.0 + 300.0 * sa];
+            self.tube(hub, rim, 1.0, &format!("{label} spoke {k}"));
+            let nipple = json!({"radius": 2, "height": 12, "base": rim.map(round3), "axis": [round6(ca), 0, round6(sa)], "body_name": format!("{label} nipple {k}")});
+            self.c("solid.cylinder", nipple);
+        }
+        self.root();
+        self.c("occurrence.move", json!({"occurrence": format!("{label} wheel:1"), "translate": [at, 0, 0]}));
+    }
+}
+
+fn round3(v: f64) -> f64 {
+    (v * 1e3).round() / 1e3
+}
+
+fn round6(v: f64) -> f64 {
+    (v * 1e6).round() / 1e6
+}
+
+/// The bicycle's command script. `scale` multiplies the counts of repeated parts (spokes,
+/// chain links, fasteners); 1.0 gives about 1,300 bodies.
+pub fn bicycle(scale: f64) -> Value {
+    let n = |k: f64| ((k * scale).round() as usize).max(1);
+    let mut s = Script { commands: Vec::new() };
+    // Frame: tubes at root, the main triangle joined, then everything moved into its component.
+    let (bb, head_top, head_bot, seat_top) = ([0.0, 0.0, 300.0], [600.0, 0.0, 860.0], [580.0, 0.0, 740.0], [-150.0, 0.0, 820.0]);
+    s.tube(bb, head_bot, 19.0, "Down tube");
+    s.tube(seat_top, head_top, 16.0, "Top tube");
+    s.tube(bb, seat_top, 16.0, "Seat tube");
+    s.tube(head_bot, head_top, 22.0, "Head tube");
+    for (side, y) in [("L", 60.0), ("R", -60.0)] {
+        s.tube([0.0, y * 0.3, 300.0], [-420.0, y, 340.0], 10.0, &format!("Chainstay {side}"));
+        s.tube([-140.0, y * 0.3, 800.0], [-420.0, y, 340.0], 9.0, &format!("Seatstay {side}"));
+        s.c("solid.box", json!({"length": 20, "width": 6, "height": 40, "corner": [-430.0, y - 3.0, 320], "body_name": format!("Dropout {side}")}));
+    }
+    s.c("solid.cylinder", json!({"radius": 24, "height": 80, "base": [0, -40, 300], "axis": "Y", "body_name": "BB shell"}));
+    s.c("solid.combine", json!({"target": "Down tube", "tools": ["Top tube", "Seat tube", "Head tube", "BB shell"]}));
+    s.component("Frame");
+    s.root();
+    let frame = ["Down tube", "Chainstay L", "Seatstay L", "Dropout L", "Chainstay R", "Seatstay R", "Dropout R"];
+    s.c("component.move_bodies", json!({"bodies": frame, "component": "Frame"}));
+    // Wheels: every spoke and nipple a body of its own.
+    s.wheel("Front", 640.0, n(36.0));
+    s.wheel("Rear", -420.0, n(36.0));
+    // Drivetrain: patterned chainring teeth, a cassette and a chain of separate links.
+    s.component("Drivetrain");
+    s.c("solid.cylinder", json!({"radius": 95, "height": 4, "base": [0, 50, 300], "axis": "Y", "body_name": "Chainring"}));
+    s.c("solid.box", json!({"length": 6, "width": 4, "height": 8, "corner": [-3, 50, 395], "name": "Tooth", "body_name": "Tooth"}));
+    s.c("solid.pattern.circular", json!({"bodies": ["Tooth"], "axis": {"origin": [0, 50, 300], "dir": [0, 1, 0]}, "count": 44}));
+    for g in 0..11 {
+        let r = 22.0 + 3.5 * g as f64;
+        s.c(
+            "solid.cylinder",
+            json!({"radius": r, "height": 2, "base": [-420.0, round3(30.0 + 2.6 * g as f64), 340.0], "axis": "Y", "body_name": format!("Cog {g}")}),
+        );
+    }
+    let links = n(112.0);
+    for k in 0..links {
+        let a = std::f64::consts::TAU * k as f64 / links as f64;
+        let (x, z) = (round3(-210.0 + 230.0 * a.cos()), round3(320.0 + 80.0 * a.sin()));
+        for (side, y) in [("in", 46), ("out", 56)] {
+            s.c("solid.box", json!({"length": 12, "width": 1, "height": 8, "corner": [round3(x - 6.0), y, round3(z - 4.0)], "body_name": format!("Link {k} {side}")}));
+        }
+        s.c("solid.cylinder", json!({"radius": 3.5, "height": 10, "base": [x, 46, z], "axis": "Y", "body_name": format!("Roller {k}")}));
+    }
+    for (side, y) in [("L", -90.0), ("R", 90.0)] {
+        let x0 = if side == "L" { -15.0 } else { 0.0 };
+        s.c("solid.box", json!({"length": 170, "width": 12, "height": 30, "corner": [x0, y - 6.0, 285], "body_name": format!("Crank {side}")}));
+        let py = if y > 0.0 { y + 8.0 } else { y - 68.0 };
+        s.c("solid.box", json!({"length": 90, "width": 60, "height": 15, "corner": [150.0, py, 280], "body_name": format!("Pedal {side}")}));
+    }
+    s.root();
+    // Cockpit and seat.
+    s.component("Cockpit");
+    s.tube([600.0, 0.0, 860.0], [620.0, 0.0, 940.0], 14.0, "Steerer");
+    s.tube([620.0, 0.0, 940.0], [700.0, 0.0, 950.0], 16.0, "Stem");
+    s.tube([700.0, -380.0, 950.0], [700.0, 380.0, 950.0], 11.0, "Handlebar");
+    s.c("solid.cylinder", json!({"radius": 16, "height": 120, "base": [700, 260, 950], "axis": "Y", "body_name": "Grip R"}));
+    s.c("solid.mirror", json!({"bodies": ["Grip R"], "plane": "XZ"}));
+    s.root();
+    s.component("Seat");
+    s.tube([-150.0, 0.0, 820.0], [-170.0, 0.0, 960.0], 13.0, "Seatpost");
+    s.c("solid.box", json!({"length": 260, "width": 140, "height": 40, "center": [-180, 0, 980], "body_name": "Saddle"}));
+    s.root();
+    // Fasteners: head, shank and washer, each its own body.
+    s.component("Hardware");
+    let bolts = n(240.0);
+    for k in 0..bolts {
+        let a = std::f64::consts::TAU * k as f64 / bolts as f64;
+        let p = [round3(-300.0 + 2.5 * k as f64), round3(120.0 + 10.0 * a.sin()), round3(400.0 + 10.0 * a.cos())];
+        s.c("solid.cylinder", json!({"radius": 5, "height": 4, "base": p, "axis": "Z", "body_name": format!("Bolt {k} head")}));
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 2.5, "height": 16, "base": [p[0], p[1], round3(p[2] - 16.0)], "axis": "Z", "body_name": format!("Bolt {k} shank")}),
+        );
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 4.5, "height": 1, "base": [p[0], p[1], round3(p[2] - 1.0)], "axis": "Z", "body_name": format!("Bolt {k} washer")}),
+        );
+    }
+    s.root();
+    json!({"commands": s.commands})
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let flag = |name: &str| args.iter().position(|a| a == name).and_then(|i| args.get(i + 1));
+    let scale = match flag("--scale") {
+        Some(v) => v.parse::<f64>().ok().filter(|v| v.is_finite() && *v > 0.0 && *v <= 20.0).ok_or("--scale takes a number from 0 to 20")?,
+        None => 1.0,
+    };
+    let script = bicycle(scale);
+    if let Some(path) = flag("--script-out") {
+        let text = serde_json::to_string_pretty(&script).map_err(|e| e.to_string())?;
+        return solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"));
+    }
+    let commands = script["commands"].as_array().cloned().unwrap_or_default();
+    let mut s = Session::default();
+    let began = std::time::Instant::now();
+    // Per command: the command itself, then what a window needs to draw its result (the
+    // bodies placed in the world and their display meshes).
+    let (mut run, mut shown): (Vec<f64>, Vec<f64>) = (Vec::new(), Vec::new());
+    for (i, c) in commands.iter().enumerate() {
+        let id = c["command"].as_str().unwrap_or_default();
+        let t = std::time::Instant::now();
+        s.execute(id, &c["params"]).map_err(|e| format!("command {i} ({id}): {e}"))?;
+        run.push(t.elapsed().as_secs_f64() * 1000.0);
+        let t = std::time::Instant::now();
+        s.world_state().warm_meshes(|| true);
+        shown.push(t.elapsed().as_secs_f64() * 1000.0);
+        if run.len() == 100 || i + 1 == commands.len() {
+            let mean = |v: &[f64]| v.iter().sum::<f64>() / v.len().max(1) as f64;
+            let bodies = s.model.state().bodies.len();
+            println!(
+                "{}",
+                json!({"step": "build", "commands": i + 1, "bodies": bodies, "command_ms": mean(&run), "display_ms": mean(&shown),
+                       "max_ms": run.iter().zip(&shown).map(|(a, b)| a + b).fold(0.0, f64::max)})
+            );
+            run.clear();
+            shown.clear();
+        }
+    }
+    let world = s.world_state();
+    println!(
+        "{}",
+        json!({"step": "built", "ms": began.elapsed().as_secs_f64() * 1000.0, "commands": commands.len(), "features": s.doc.features.len(), "bodies": world.bodies.len()})
+    );
+    let path = match flag("--save") {
+        Some(p) => p.clone(),
+        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+    };
+    s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
+    let r = crate::cmd_bench_open(std::slice::from_ref(&path));
+    if flag("--save").is_none() {
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_file(format!("{path}.bak"));
+    }
+    r
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The generated commands stay valid as the command set changes: a small bicycle builds
+    /// without a failing command or feature.
+    #[test]
+    fn a_small_bicycle_builds() {
+        let script = bicycle(0.03);
+        let mut s = Session::default();
+        for c in script["commands"].as_array().into_iter().flatten() {
+            let id = c["command"].as_str().unwrap_or_default();
+            if let Err(e) = s.execute(id, &c["params"]) {
+                panic!("{id}: {e}");
+            }
+        }
+        assert!(s.model.results.iter().all(|r| r.error.is_none()));
+        let world = s.world_state();
+        assert!(world.bodies.len() > 40, "{} bodies", world.bodies.len());
+        assert!(world.bodies.iter().any(|b| b.name.contains("spoke")));
+    }
+}
@@ -1,10 +1,12 @@
 //! SolidCraft headless command line.
 //!
 //! ```text
-//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--allow-errors]
-//! solidcraft-cli eval <script.json|design.solidcraft|part.step> (alias: inspect) measurements as JSON
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] loading timings as JSON lines
-//! solidcraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|top|…]
+//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--json-out FILE] [--allow-errors]
+//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]] loading timings as JSON lines
+//! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
+//! solidcraft-cli snapshot <script|design> [--in design|part.step] --out shot.png [--width W] [--height H] [--view iso|front|top|…|NAME | --camera JSON] [--no-grid] [--no-axes]
 //! solidcraft-cli exec <command> [json-params]                 run one command on an empty design
 //! solidcraft-cli commands                                     the command registry as JSON
 //! solidcraft-cli recipe <recipe.json>                         translate an oracle recipe to a script
@@ -17,10 +19,12 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]

+mod bench_agent;
 mod crashes;
 mod fuzz;
 mod oracle;
 mod recipe;
+mod render;
 mod spatial;

 use std::process::ExitCode;
@@ -30,15 +34,26 @@ use serde_json::{Value, json};
 mod app_icon;

 use solidcraft_engine::Session;
-use solidcraft_engine::render::{StandardView, render_png};
+use solidcraft_engine::view::Guides;

 const USAGE: &str = "usage:
-  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--allow-errors]
+  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--json-out FILE] [--allow-errors]
  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...
      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)
-  solidcraft-cli eval <script.json|design.solidcraft|part.step>     (alias: inspect; or --in FILE)
-  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]
-  solidcraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|back|top|bottom|left|right]
+  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)
+      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,
+       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)
+  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]
+      (the design's history as a command script that eval and run replay)
+  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]]
+  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]
+  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]
+  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...
+      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;
+       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;
+       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);
+       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture)
+  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]
  solidcraft-cli exec <command> [json-params]
  solidcraft-cli commands
  solidcraft-cli recipe <recipe.json>
@@ -47,6 +62,10 @@ const USAGE: &str = "usage:
  solidcraft-cli mcp [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]
  solidcraft-cli licences
+  solidcraft-cli gpu [--policy auto|hardware|software|cpu]
+      (the GPU adapters a headless render can open, best first, the one the policy picks and the tier it
+       lands on: gpu, gpu-software, or the CPU rasterizer (auto with no adapter, or cpu); the policy defaults
+       to SOLIDCRAFT_GPU, else auto; exits with an error when hardware or software finds no such adapter)
  solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico
 ";

@@ -55,8 +74,11 @@ fn main() -> ExitCode {
    let r = match args.first().map(String::as_str) {
        Some("run") => cmd_run(&args[1..]),
        Some("eval" | "inspect") => cmd_eval(&args[1..]),
+        Some("script") => cmd_script(&args[1..]),
        Some("snapshot") => cmd_snapshot(&args[1..]),
+        Some("render") => render::run(&args[1..]),
        Some("exec") => cmd_exec(&args[1..]),
+        Some("gpu") => cmd_gpu(&args[1..]),
        Some("commands") => {
            use std::io::Write as _;
            let mut s = Session::default();
@@ -91,6 +113,8 @@ fn main() -> ExitCode {
        // Hidden: time recomputes after parameter edits (docs/perf.md).
        Some("bench-edit") => cmd_bench_edit(&args[1..]),
        Some("bench-open") => cmd_bench_open(&args[1..]),
+        // A ~1,300-body design built command by command, as an agent builds one over MCP.
+        Some("bench-agent") => bench_agent::run(&args[1..]),
        Some("--version" | "-V") => {
            println!("solidcraft-cli {}", env!("CARGO_PKG_VERSION"));
            Ok(())
@@ -156,7 +180,7 @@ fn positional(args: &[String]) -> Option<&String> {
    let mut i = 0;
    while let Some(a) = args.get(i) {
        if a.starts_with("--") {
-            i += if matches!(a.as_str(), "--quiet" | "--results" | "--allow-errors") { 1 } else { 2 };
+            i += if matches!(a.as_str(), "--quiet" | "--results" | "--allow-errors" | "--no-grid" | "--no-axes") { 1 } else { 2 };
            continue;
        }
        return Some(a);
@@ -164,32 +188,53 @@ fn positional(args: &[String]) -> Option<&String> {
    None
 }

+/// `--json-out FILE`: where the JSON a command prints goes instead of stdout.
+fn json_out(args: &[String]) -> Result<Option<&str>, String> {
+    if !args.iter().any(|a| a == "--json-out") {
+        return Ok(None);
+    }
+    match flag(args, "--json-out") {
+        Some(file) if !file.starts_with("--") => Ok(Some(file)),
+        _ => Err("--json-out needs a FILE".to_string()),
+    }
+}
+
+/// `v` as indented JSON with a final newline: on stdout, or in `file`. The file is plain UTF-8
+/// with no byte-order mark, whatever the platform's shell does to redirected output (Windows
+/// PowerShell's `>` writes UTF-16, or UTF-8 with a BOM), so strict JSON readers take it.
+fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
+    match file {
+        Some(file) => {
+            let mut text = pretty(v);
+            text.push('\n');
+            std::fs::write(file, text).map_err(|e| format!("{file}: {e}"))
+        }
+        None => {
+            println!("{}", pretty(v));
+            Ok(())
+        }
+    }
+}
+
 fn cmd_run(args: &[String]) -> Result<(), String> {
+    install_renderer();
+    let json_out = json_out(args)?;
    let base = flag(args, "--in");
    let path = positional(args);
    if path.is_none() && base.is_none() {
        return Err(USAGE.to_string());
    }
-    // `--in` starts from a design or STEP file; the positional script then runs on top of it.
-    let mut s = match base {
-        Some(b) => load(b)?,
-        None => Session::default(),
-    };
-    let results = if args.iter().any(|a| a == "--results") {
+    let (mut s, results) = if args.iter().any(|a| a == "--results") {
        // Collect every command's result (scripts only), then process requested files too.
+        let mut s = match base {
+            Some(b) => load(b)?,
+            None => Session::default(),
+        };
        let v = read_json(path.ok_or("--results needs a script")?)?;
        let r = s.run_script(&v).map_err(|e| e.to_string())?;
-        Some(Value::Array(r))
+        (s, Some(Value::Array(r)))
    } else {
-        match (base, path) {
-            (Some(_), Some(p)) => {
-                let v = read_json(p)?;
-                s.run_script(&v).map_err(|e| e.to_string())?;
-            }
-            (None, Some(p)) => s = load(p)?,
-            _ => {}
-        }
-        None
+        (open(base, path)?, None)
    };
    // A feature that fails leaves the bodies as they were before it (a parameter change can
    // break a feature without failing the command that made it): writing them would hand out
@@ -204,10 +249,45 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
        s.execute("file.save_as", &json!({"path": p})).map_err(|e| e.to_string())?;
    }
    if let Some(results) = results {
-        println!("{}", pretty(&results));
-    } else if !args.iter().any(|a| a == "--quiet") {
+        print_json(&results, json_out)?;
+    } else if json_out.is_some() || !args.iter().any(|a| a == "--quiet") {
+        // `--quiet` silences stdout; a file that was asked for is still written.
        let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
-        println!("{}", pretty(&m));
+        print_json(&m, json_out)?;
+    }
+    Ok(())
+}
+
+/// The session `run` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// positional script run on top of it, or either one alone.
+fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
+    match (base, path) {
+        (Some(b), Some(p)) => {
+            let mut s = load(b)?;
+            s.run_script(&read_json(p)?).map_err(|e| e.to_string())?;
+            Ok(s)
+        }
+        (Some(b), None) => load(b),
+        (None, Some(p)) => load(p),
+        (None, None) => Err(USAGE.to_string()),
+    }
+}
+
+/// Refuses an option `cmd` doesn't take, and one missing its value: a typo, or another
+/// command's option, would otherwise be ignored without a word.
+fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -> Result<(), String> {
+    let mut i = 0;
+    while let Some(a) = args.get(i) {
+        if valued.contains(&a.as_str()) {
+            match args.get(i + 1) {
+                Some(v) if !v.starts_with("--") => i += 2,
+                _ => return Err(format!("{cmd}: {a} needs a value")),
+            }
+        } else if a.starts_with("--") && !switches.contains(&a.as_str()) {
+            return Err(format!("{cmd} doesn't take {a} (it takes {})", [valued, switches].concat().join(", ")));
+        } else {
+            i += 1;
+        }
    }
    Ok(())
 }
@@ -226,6 +306,7 @@ fn timeline_ok(s: &Session) -> Result<(), String> {
 }

 fn cmd_eval(args: &[String]) -> Result<(), String> {
+    let json_out = json_out(args)?;
    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(|| USAGE.to_string())?;
    let mut s = load(path)?;
    let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
@@ -238,24 +319,110 @@ fn cmd_eval(args: &[String]) -> Result<(), String> {
        "params": d["params"],
        "sketches": d["sketches"],
    });
-    println!("{}", pretty(&out));
+    print_json(&out, json_out)
+}
+
+/// A design's history as a command script (`timeline.export_script`): printed, or written to
+/// `--out`; what the script leaves out goes to stderr.
+fn cmd_script(args: &[String]) -> Result<(), String> {
+    let path = positional(args).ok_or_else(|| USAGE.to_string())?;
+    let s = &mut load(path)?;
+    let out = flag(args, "--out");
+    let r = s.execute("timeline.export_script", &json!({"path": out})).map_err(|e| e.to_string())?;
+    for what in r["omitted"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        eprintln!("note: the script leaves out {what}");
+    }
+    match out {
+        Some(out) => eprintln!("{out}: {} steps", r["steps"]),
+        None => println!("{}", pretty(&r["script"])),
+    }
    Ok(())
 }

-fn cmd_snapshot(args: &[String]) -> Result<(), String> {
-    let path = args.first().ok_or_else(|| USAGE.to_string())?;
-    let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
-    let w = flag(args, "--width").and_then(|x| x.parse().ok()).unwrap_or(1280usize);
-    let h = flag(args, "--height").and_then(|x| x.parse().ok()).unwrap_or(800usize);
-    let s = load(path)?;
-    let mut cam = solidcraft_engine::view::home_camera(&s);
-    if let Some(v) = flag(args, "--view") {
-        cam.set_view(StandardView::parse(v).ok_or_else(|| format!("unknown view `{v}`"))?);
+/// `gpu`: the headless adapter survey and the policy's pick.
+fn cmd_gpu(args: &[String]) -> Result<(), String> {
+    use solidcraft_gpu::select::{Policy, survey};
+    let policy = match args {
+        [] => Policy::from_env()?,
+        [flag, v] if flag == "--policy" => Policy::parse(v).ok_or_else(|| format!("--policy must be auto, hardware, software or cpu, not `{v}`"))?,
+        _ => return Err("usage: solidcraft-cli gpu [--policy auto|hardware|software|cpu]".into()),
+    };
+    let s = survey(policy);
+    let chosen = s.chosen.and_then(|i| s.adapters.get(i)).cloned();
+    // The tier pictures land on: a hardware GPU, a software adapter, or the CPU rasterizer.
+    let renderer = s.lands_on.map(|l| l.renderer());
+    println!(
+        "{}",
+        pretty(&json!({
+            "policy": policy.name(),
+            "backends": s.backends,
+            "adapters": s.adapters,
+            "chosen": chosen,
+            "lands_on": s.lands_on,
+            "renderer": renderer,
+        }))
+    );
+    match s.lands_on {
+        Some(solidcraft_gpu::select::Landing::Cpu) => {
+            eprintln!("warning: {}", solidcraft_engine::capture::CPU_WARNING);
+            Ok(())
+        }
+        Some(_) => Ok(()),
+        None => Err(format!("no adapter qualifies under the {} policy", policy.name())),
    }
-    let scene = solidcraft_engine::view::scene(&s, &cam);
-    let png = render_png(&scene, &cam, w, h).ok_or("render failed")?;
-    std::fs::write(out, &png).map_err(|e| format!("{out}: {e}"))?;
-    println!("{}", pretty(&json!({"path": out, "width": w, "height": h, "bytes": png.len()})));
+}
+
+/// Draw this process's pictures (snapshots, MCP screenshots, saved thumbnails) on the GPU with the
+/// viewport's pipelines: the headless device the `SOLIDCRAFT_GPU` policy picks, opened on the first
+/// picture; under `auto` with no qualifying adapter (or `cpu`), the CPU rasterizer, and the
+/// picture says so. Under `hardware` or `software` with no such adapter a picture fails with an
+/// error that names the policy.
+fn install_renderer() {
+    solidcraft_engine::capture::install(std::sync::Arc::new(|scene, cam, w, h| {
+        let (rgba, renderer) = solidcraft_gpu::capture::headless_rgba(scene, cam, w, h)?;
+        Ok(solidcraft_engine::capture::Picture { rgba, renderer })
+    }));
+}
+
+fn cmd_snapshot(args: &[String]) -> Result<(), String> {
+    install_renderer();
+    known_flags("snapshot", args, &["--in", "--out", "--width", "--height", "--view", "--camera"], &["--no-grid", "--no-axes"])?;
+    if positional(args).is_none() && flag(args, "--in").is_none() {
+        return Err(USAGE.to_string());
+    }
+    let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
+    let size = |name: &str, default: u32| match flag(args, name) {
+        None => Ok(default),
+        Some(x) => x.parse().ok().filter(|n| (16..=8192).contains(n)).ok_or_else(|| format!("{name} must be 16 to 8192 pixels, not `{x}`")),
+    };
+    let (w, h) = (size("--width", 1280)?, size("--height", 800)?);
+    let mut s = open(flag(args, "--in"), positional(args))?;
+    // The camera choices of the MCP `screenshot`, through the same command (`view.apply`): a
+    // standard view, a view saved in the design, or an explicit camera. A script that applies a
+    // view itself sets the camera too; without any, the iso view framing the model.
+    match (flag(args, "--view"), flag(args, "--camera")) {
+        (Some(_), Some(_)) => return Err("snapshot: give --view or --camera, not both".into()),
+        (Some(v), None) => {
+            let hint = "standard views: iso, front, back, top, bottom, left, right";
+            s.execute("view.apply", &json!({"view": v})).map_err(|e| format!("--view {v}: {e} ({hint}; or a view saved with view.save)"))?;
+        }
+        (None, Some(c)) => {
+            let camera: Value = serde_json::from_str(c).map_err(|e| format!("--camera: not JSON: {e}"))?;
+            s.execute("view.apply", &json!({"camera": camera})).map_err(|e| format!("--camera: {e}"))?;
+        }
+        (None, None) => {}
+    }
+    let cam = s.camera.unwrap_or_else(|| solidcraft_engine::view::home_camera(&s));
+    let guides = Guides { grid: !args.iter().any(|a| a == "--no-grid"), axes: !args.iter().any(|a| a == "--no-axes") };
+    let scene = solidcraft_engine::view::scene_with_guides(&s, &cam, s.section, guides);
+    let png = solidcraft_engine::capture::png(&scene, &cam, w, h)?;
+    std::fs::write(out, &png.bytes).map_err(|e| format!("{out}: {e}"))?;
+    let mut reply = json!({"path": out, "width": w, "height": h, "bytes": png.bytes.len(), "renderer": png.renderer});
+    if let Some(w) = solidcraft_engine::capture::warning(png.renderer) {
+        eprintln!("warning: {w}");
+        reply["warning"] = json!(w);
+    }
+    println!("{}", pretty(&reply));
    Ok(())
 }

@@ -301,6 +468,7 @@ fn ico(images: &[(usize, Vec<u8>)]) -> Result<Vec<u8>, String> {
 }

 fn cmd_exec(args: &[String]) -> Result<(), String> {
+    install_renderer();
    let id = args.first().ok_or_else(|| USAGE.to_string())?;
    let p: Value = match args.get(1) {
        Some(t) => serde_json::from_str(t).map_err(|e| format!("params: {e}"))?,
@@ -316,6 +484,7 @@ fn cmd_exec(args: &[String]) -> Result<(), String> {
 /// a running app's control port. stdout carries only protocol messages. Files the agent's tool
 /// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
 fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    install_renderer();
    let scope = (!args.iter().any(|a| a == "--allow-any-path"))
        .then(|| solidcraft_mcp::agent_scope(flags(args, "--allow-path").into_iter().map(std::path::PathBuf::from)));
    if let Some(s) = &scope {
@@ -333,13 +502,20 @@ fn cmd_mcp(args: &[String]) -> Result<(), String> {
    }
    let backend: Box<dyn solidcraft_mcp::Backend> = match (flag(args, "--connect"), flag(args, "--in")) {
        (Some(_), Some(_)) => return Err("mcp: use either --connect or --in, not both".into()),
-        (Some(addr), None) => Box::new(solidcraft_mcp::Remote::connect_with_token(addr, flag(args, "--token")).map_err(|e| {
-            let port = addr.rsplit(':').next().filter(|p| p.parse::<u16>().is_ok()).unwrap_or("PORT");
-            format!(
-                "cannot connect to {addr}: {e}\nno SolidCraft app is listening there; start it with \
-                 `solidcraft --control {port}` (or SOLIDCRAFT_CONTROL_PORT={port}) and retry"
-            )
-        })?),
+        (Some(addr), None) => {
+            let Some(port) = addr.rsplit_once(':').and_then(|(_, p)| p.parse::<u16>().ok()).filter(|p| *p != 0) else {
+                return Err(format!("mcp: --connect wants HOST:PORT, such as 127.0.0.1:7878, not `{addr}`"));
+            };
+            // Serve without the app too: the tools connect once it runs, and say it isn't until then.
+            let mut remote = solidcraft_mcp::Remote::new(addr, flag(args, "--token"));
+            if let Err(e) = remote.try_connect() {
+                eprintln!(
+                    "solidcraft mcp: no SolidCraft app at {addr} yet ({e}); start it with `solidcraft --control {port}` \
+                     (or SOLIDCRAFT_CONTROL_PORT={port}), tool calls connect once it runs"
+                );
+            }
+            Box::new(remote)
+        }
        (None, Some(path)) => Box::new(solidcraft_mcp::Headless::new(load(path)?)),
        (None, None) => Box::new(solidcraft_mcp::Headless::default()),
    };
@@ -401,7 +577,7 @@ fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
 }

 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
-fn cmd_bench_open(args: &[String]) -> Result<(), String> {
+pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
    let t = std::time::Instant::now();
    let step = solidcraft_engine::io::is_step_path(path);
@@ -439,5 +615,37 @@ fn cmd_bench_open(args: &[String]) -> Result<(), String> {
    st.warm_meshes(|| true);
    let triangles: usize = st.bodies.iter().map(|b| b.mesh().triangles.len()).sum();
    println!("{}", json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "bodies": st.bodies.len(), "triangles": triangles}));
+    // `--display LEVEL`: the display plans the viewport draws at that display quality, made as
+    // the GPU viewport makes them; `--edit NAME EXPR` then changes a parameter and times the
+    // evaluation and the plans of the bodies it changed.
+    let flag = |name: &str| args.iter().position(|a| a == name);
+    let Some(level) = flag("--display").and_then(|i| args.get(i + 1)) else { return Ok(()) };
+    let q = solidcraft_engine::doc::display_quality::DisplayQuality::parse(level).ok_or("--display: coarse, normal, fine or ultra")?;
+    let plans = |st: &solidcraft_engine::doc::ModelState| {
+        let t = std::time::Instant::now();
+        solidcraft_engine::kernel::for_each_on_threads(&st.bodies, 16, |b| {
+            let _ = b.plan_mesh_at(q);
+        });
+        let triangles: usize = st.bodies.iter().filter_map(|b| b.plan_mesh_at(q)).map(|m| m.triangles.len()).sum();
+        (t.elapsed().as_secs_f64() * 1000.0, triangles)
+    };
+    let (ms, triangles) = plans(&st);
+    println!("{}", json!({"step": "display", "quality": q.id(), "ms": ms, "triangles": triangles}));
+    if let Some(i) = flag("--edit") {
+        let (Some(name), Some(expr)) = (args.get(i + 1), args.get(i + 2)) else { return Err("--edit NAME EXPR".into()) };
+        let mut s = s;
+        let t = std::time::Instant::now();
+        s.execute("parameters.change", &json!({"name": name, "expression": expr})).map_err(|e| e.to_string())?;
+        let eval_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let st = s.world_state();
+        let t = std::time::Instant::now();
+        st.warm_meshes(|| true);
+        let mesh_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let (ms, triangles) = plans(&st);
+        println!(
+            "{}",
+            json!({"step": "edit", "quality": q.id(), "evaluate_ms": eval_ms, "mesh_ms": mesh_ms, "display_ms": ms, "triangles": triangles})
+        );
+    }
    Ok(())
 }
@@ -92,7 +92,7 @@ fn extent(f: &Value, p: &mut Value) {
        "symmetric" => {
            let full = e.get("is_full_length").and_then(Value::as_bool).unwrap_or(false);
            p["direction"] = json!("symmetric");
-            p["distance"] = if full { json!(format!("({}) / 2", expr_text(&dist))) } else { dist };
+            p["distance"] = if full { dist } else { json!(format!("({}) * 2", expr_text(&dist))) };
        }
        "two_sides" => {
            p["distance"] = e.get("side1").cloned().unwrap_or(Value::Null);
@@ -296,6 +296,17 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
            Some("sketch") => sketch_cmds(f, &mut out)?,
            Some("extrude") => {
                let mut p = json!({"sketch": profile_sketch(f), "profiles": profiles_of(f), "operation": op(f), "name": name, "body_names": bodies});
+                // Thin: {sketch, curves, thickness, side?, thickness2?} instead of profiles.
+                if let (Some(thin), Some(params)) = (f.get("thin"), p.as_object_mut()) {
+                    params.remove("profiles");
+                    params.insert("thin".into(), json!(true));
+                    params.insert("sketch".into(), thin.get("sketch").cloned().unwrap_or(Value::Null));
+                    for key in ["curves", "thickness", "side", "thickness2"] {
+                        if let Some(v) = thin.get(key) {
+                            params.insert(key.into(), v.clone());
+                        }
+                    }
+                }
                extent(f, &mut p);
                out.push(json!({"command": "solid.extrude", "params": p}));
            }
@@ -0,0 +1,79 @@
+//! Complete headless image-job workflow through the same engine commands as the UI/MCP.
+use serde_json::json;
+use solidcraft_engine::{
+    doc::render_settings::RenderSetup,
+    render::job::{CpuHost, JobId, Phase},
+};
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
+    let mut out = None;
+    let mut setup = None;
+    let mut width = None;
+    let mut height = None;
+    let mut transparent = false;
+    let mut overwrite = false;
+    let mut timeout = 120u64;
+    let mut i = 1;
+    while let Some(arg) = args.get(i) {
+        match arg.as_str() {
+            "--transparent" => transparent = true,
+            "--overwrite" => overwrite = true,
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" => {
+                i += 1;
+                let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
+                match arg.as_str() {
+                    "--out" => out = Some(value.clone()),
+                    "--setup" => setup = Some(value.clone()),
+                    "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
+                    "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
+                    _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
+                }
+            }
+            _ => return Err(format!("unknown render option: {arg}")),
+        }
+        i += 1;
+    }
+    if !(1..=3600).contains(&timeout) {
+        return Err("render timeout must be 1..3600 seconds".into());
+    }
+    let out = out.ok_or("render requires --out FILE.png")?;
+    let mut session = crate::load(input)?;
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    let mut settings = if let Some(name) = setup {
+        session.doc.render.setups.get(&name).cloned().ok_or("no saved render setup with that name")?
+    } else {
+        let mut settings = RenderSetup::default();
+        if let Some(camera) = session.camera {
+            settings.camera = camera;
+        } else {
+            settings.camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+        }
+        settings
+    };
+    if let Some(width) = width {
+        settings.width = width;
+    }
+    if let Some(height) = height {
+        settings.height = height;
+    }
+    let params = json!({"settings":settings,"transparent_background":transparent});
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    let status = match handle.wait_timeout(std::time::Duration::from_secs(timeout)) {
+        Ok(status) => status,
+        Err(e) => {
+            let _ = session.execute("render.cancel", &json!({"job":id}));
+            return Err(e.to_string());
+        }
+    };
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render cancelled".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":out,"overwrite":overwrite})).map_err(|e| e.to_string())?;
+    println!("{}", crate::pretty(&json!({"preflight":preflight,"export":exported})));
+    Ok(())
+}
@@ -13,8 +13,10 @@
 //! fails the test (a regression). Newly passing actions are reported; record them with
 //! `cargo xtask action-matrix --bless` (or `ACTION_MATRIX_BLESS=1` on [`action_matrix_all`]).
 //! Every CI run checks a fixed sample ([`action_matrix_sample`], under a minute); the full matrix
-//! is four ignored tests (`action_matrix_full_N`) that the nightly "Action matrix" job runs side by
-//! side. See docs/action-matrix.md.
+//! is the ignored [`action_matrix_shard`], which the nightly "Action matrix" jobs run one shard
+//! each (`ACTION_MATRIX_SHARD=k/n`), cut by what each design costs (`tests/action_matrix/costs.json`).
+//! [`action_matrix_determinism`] runs a sample twice and lists any action whose outcome changed.
+//! See docs/action-matrix.md.
 //!
 //! Each design runs in a child process (this test binary, [`action_matrix_worker`]) so an action
 //! that hangs or aborts is recorded as such and the rest of the design still runs.
@@ -33,6 +35,10 @@ use solidcraft_engine::geom::Vec3;

 /// One in this many actions runs on pull requests (by a stable hash of its key).
 const PR_SAMPLE: u64 = 40;
+/// One in this many actions runs twice in the nightly determinism check, on the designs whose
+/// whole matrix takes at most [`DETERMINISM_MAX_SECS`] on a runner (most of the corpus).
+const DETERMINISM_SAMPLE: u64 = 8;
+const DETERMINISM_MAX_SECS: f64 = 300.0;
 /// Designs that take seconds to build: the full matrix only.
 const SLOW: [&str; 7] = [
    "oracle/41-tube-radial-holes",
@@ -623,17 +629,25 @@ fn action_matrix_worker() {
        out.flush().unwrap();
    };
    let Some((_, path)) = designs().into_iter().find(|(n, _)| *n == design) else { panic!("no design {design}") };
+    // A slice of a heavy design (`j/n`): the actions whose name hashes to `j` modulo `n` (by
+    // index, slices would take whole kinds of action when n shares a factor with the number of
+    // actions per entity, and a slice of only fillets runs three times as long); the first
+    // slice records the load.
+    let slice: Option<(usize, usize)> = std::env::var("ACTION_MATRIX_SLICE").ok().and_then(|v| parse_part(&v));
+    let first = slice.is_none_or(|(j, _)| j == 0);
    let t0 = Instant::now();
    let s = match load(&path) {
        Ok(s) => s,
        Err(e) => {
-            emit(outcome(&design, "design", "load", &Err(("load".into(), e)), t0.elapsed().as_millis()));
+            if first {
+                emit(outcome(&design, "design", "load", &Err(("load".into(), e)), t0.elapsed().as_millis()));
+            }
            emit(json!({"done": true}));
            return;
        }
    };
    let before = errors(&s);
-    if from == 0 {
+    if from == 0 && first {
        let r = if before.is_empty() { Ok(()) } else { Err(("timeline_error".into(), before.values().cloned().collect::<Vec<_>>().join("; "))) };
        emit(outcome(&design, "design", "load", &r, t0.elapsed().as_millis()));
    }
@@ -647,6 +661,9 @@ fn action_matrix_worker() {
        if only.as_ref().is_some_and(|o| !o.iter().any(|x| x == a.action)) {
            continue;
        }
+        if slice.is_some_and(|(j, n)| stable_hash(&format!("{} {}", a.entity, a.action)) % n as u64 != j as u64) {
+            continue;
+        }
        // Whole families of pieces are sampled together (see [`family`]).
        let k = key(&design, &family(&a.entity), a.action);
        if !stable_hash(&k).is_multiple_of(sample) {
@@ -693,6 +710,8 @@ fn action_matrix_worker() {
            && let Some((name, expr)) = &edit
            && stable_hash(&format!("{k} edit")).is_multiple_of(EDIT_SAMPLE)
        {
+            // Marked like an action, so a hang here is put down to the edit round (not to loading).
+            emit(json!({"start": i, "edit": true}));
            let t = Instant::now();
            let start = s.doc.features.len();
            let r = scratch
@@ -706,46 +725,155 @@ fn action_matrix_worker() {
    emit(json!({"done": true, "actions": list.len()}));
 }

-/// Run the actions (one in `sample`) of every design in part `part` of `parts`, in child
-/// processes, `jobs` at a time.
-fn run_matrix(sample: u64, part: usize, parts: usize) -> Vec<Value> {
+/// `"k/n"` (1-based `k`) as `(k - 1, n)`.
+fn parse_part(v: &str) -> Option<(usize, usize)> {
+    let (k, n) = v.split_once('/')?;
+    let (k, n): (usize, usize) = (k.trim().parse().ok()?, n.trim().parse().ok()?);
+    (k >= 1 && k <= n).then_some((k - 1, n))
+}
+
+/// What one design costs on a CI runner (`tests/action_matrix/costs.json`, measured by the
+/// nightly shards): the whole run and the load before its first action, in seconds.
+#[derive(Clone, Copy, Debug)]
+struct Cost {
+    secs: f64,
+    load: f64,
+}
+
+fn costs_path() -> PathBuf {
+    root().join("tests/action_matrix/costs.json")
+}
+
+fn read_costs() -> BTreeMap<String, Cost> {
+    let Some(v) = std::fs::read(costs_path()).ok().and_then(|b| serde_json::from_slice::<Value>(&b).ok()) else { return BTreeMap::new() };
+    v["designs"]
+        .as_object()
+        .into_iter()
+        .flatten()
+        .map(|(d, c)| (d.clone(), Cost { secs: c["secs"].as_f64().unwrap_or(0.0), load: c["load"].as_f64().unwrap_or(0.0) }))
+        .collect()
+}
+
+/// A design new to the corpus (not in costs.json yet) is planned as this.
+const UNKNOWN_COST: Cost = Cost { secs: 120.0, load: 5.0 };
+/// A design that takes longer than this on a runner is split into slices of about this much, or
+/// five loads if that is more (each slice loads the design again), so no shard waits on one design.
+const SLICE_SECS: f64 = 600.0;
+/// Designs that take longer than this to load on a runner stay out of the pull request sample.
+const SAMPLE_MAX_LOAD_SECS: f64 = 8.0;
+
+/// A piece of work: one design, or a slice `(j, n)` of a heavy one, and what it should cost.
+#[derive(Clone, Debug)]
+struct Unit {
+    design: String,
+    slice: Option<(usize, usize)>,
+    cost: f64,
+}
+
+impl Unit {
+    fn name(&self) -> String {
+        match self.slice {
+            Some((j, n)) => format!("{} [{}/{n}]", self.design, j + 1),
+            None => self.design.clone(),
+        }
+    }
+}
+
+/// The whole matrix split into `parts` shards of about equal cost: heavy designs in slices, then
+/// the largest pieces first, each to the shard with the least so far. The same corpus and
+/// costs.json always give the same shards.
+fn plan(designs: &[String], costs: &BTreeMap<String, Cost>, parts: usize) -> Vec<Vec<Unit>> {
+    let mut units = Vec::new();
+    for d in designs {
+        let c = costs.get(d).copied().unwrap_or(UNKNOWN_COST);
+        let n = ((c.secs / SLICE_SECS.max(5.0 * c.load)).ceil() as usize).max(1);
+        if n == 1 {
+            units.push(Unit { design: d.clone(), slice: None, cost: c.secs });
+        } else {
+            let each = c.load + (c.secs - c.load).max(0.0) / n as f64;
+            units.extend((0..n).map(|j| Unit { design: d.clone(), slice: Some((j, n)), cost: each }));
+        }
+    }
+    units.sort_by(|a, b| b.cost.total_cmp(&a.cost).then_with(|| a.name().cmp(&b.name())));
+    let mut shards: Vec<(f64, Vec<Unit>)> = vec![(0.0, Vec::new()); parts];
+    for u in units {
+        let i = (0..parts).min_by(|&a, &b| shards[a].0.total_cmp(&shards[b].0)).unwrap_or(0);
+        shards[i].0 += u.cost;
+        shards[i].1.push(u);
+    }
+    shards.into_iter().map(|(_, v)| v).collect()
+}
+
+/// Every design's name, with `ACTION_MATRIX_FILTER` applied.
+fn design_names() -> Vec<String> {
    let designs = designs();
    assert!(designs.len() > 80, "only {} designs", designs.len());
-    let dir = std::env::temp_dir().join(format!("action-matrix-{}-{part}", std::process::id()));
+    let filter = std::env::var("ACTION_MATRIX_FILTER").ok();
+    designs.into_iter().map(|(n, _)| n).filter(|n| filter.as_deref().is_none_or(|f| n.contains(f))).collect()
+}
+
+/// Run the actions (one in `sample`) of these units in child processes, `jobs` at a time.
+///
+/// `ACTION_MATRIX_WORKDIR` keeps each design's raw outcomes there (one JSON line each, written as
+/// they come, so a run cut short still shows what it did) and `ACTION_MATRIX_TIMINGS` appends
+/// each unit's time to that file (JSON lines).
+fn run_units(sample: u64, queue: &[Unit]) -> Vec<Value> {
+    let keep = std::env::var_os("ACTION_MATRIX_WORKDIR").map(PathBuf::from);
+    static RUN: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let run = RUN.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let dir = keep.clone().unwrap_or_else(|| std::env::temp_dir().join(format!("action-matrix-{}-{run}", std::process::id())));
    std::fs::create_dir_all(&dir).unwrap();
+    let timings = std::env::var_os("ACTION_MATRIX_TIMINGS").map(PathBuf::from);
    let jobs: usize = std::env::var("ACTION_MATRIX_JOBS")
        .ok()
        .and_then(|v| v.parse().ok())
        .unwrap_or_else(|| std::thread::available_parallelism().map_or(2, |n| n.get()))
        .max(1);
-    let filter = std::env::var("ACTION_MATRIX_FILTER").ok();
-    let queue: Vec<(String, PathBuf)> = designs
-        .into_iter()
-        .enumerate()
-        .filter(|(i, (n, _))| i % parts == part && filter.as_deref().is_none_or(|f| n.contains(f)) && (sample == 1 || !SLOW.contains(&n.as_str())))
-        .map(|(_, d)| d)
-        .collect();
    let next = std::sync::atomic::AtomicUsize::new(0);
    let results = std::sync::Mutex::new(Vec::new());
    std::thread::scope(|scope| {
        for _ in 0..jobs {
            scope.spawn(|| {
-                while let Some((name, _)) = queue.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
-                    let out = dir.join(format!("{}.jsonl", name.replace('/', "__")));
-                    let lines = run_design(name, &out, sample);
+                while let Some(u) = queue.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
+                    let file = u.name().replace('/', "__").replace([' ', '[', ']'], "_");
+                    let out = dir.join(format!("{file}.r{run}.jsonl"));
+                    let t = Instant::now();
+                    let lines = run_design(&u.design, &out, sample, u.slice);
+                    let secs = t.elapsed().as_secs_f64();
+                    let load = lines.iter().find(|o| o["entity"] == "design" && o["action"] == "load").and_then(|o| o["ms"].as_f64()).unwrap_or(0.0) / 1000.0;
+                    if let Some(p) = &timings {
+                        let line = json!({"design": u.design, "slice": u.slice.map(|(j, n)| format!("{}/{n}", j + 1)), "secs": round3(secs), "load": round3(load), "actions": lines.len()});
+                        let mut f = std::fs::OpenOptions::new().create(true).append(true).open(p).unwrap();
+                        writeln!(f, "{line}").unwrap();
+                    }
+                    eprintln!("action matrix: {} took {secs:.1} s ({} outcomes, load {load:.1} s)", u.name(), lines.len());
                    results.lock().unwrap().extend(lines);
                }
            });
        }
    });
-    let _ = std::fs::remove_dir_all(&dir);
+    if keep.is_none() {
+        let _ = std::fs::remove_dir_all(&dir);
+    }
    let mut v = results.into_inner().unwrap();
    v.sort_by_key(|o| key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or("")));
    v
 }

+/// Run the actions (one in `sample`) of every design (the pull request sample leaves out the
+/// slow-loading ones).
+fn run_matrix(sample: u64) -> Vec<Value> {
+    let costs = read_costs();
+    let queue: Vec<Unit> = design_names()
+        .into_iter()
+        .filter(|n| sample == 1 || !(SLOW.contains(&n.as_str()) || costs.get(n).is_some_and(|c| c.load > SAMPLE_MAX_LOAD_SECS)))
+        .map(|design| Unit { design, slice: None, cost: 0.0 })
+        .collect();
+    run_units(sample, &queue)
+}
+
 /// One design in child processes, restarting after an action that hangs or aborts.
-fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
+fn run_design(design: &str, out: &Path, sample: u64, slice: Option<(usize, usize)>) -> Vec<Value> {
    let _ = std::fs::remove_file(out);
    let mut from = 0usize;
    let mut results = Vec::new();
@@ -757,6 +885,7 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
            .env("ACTION_MATRIX_OUT", out)
            .env("ACTION_MATRIX_FROM", from.to_string())
            .env("ACTION_MATRIX_SAMPLE", sample.to_string())
+            .env("ACTION_MATRIX_SLICE", slice.map(|(j, n)| format!("{}/{n}", j + 1)).unwrap_or_default())
            .stdout(Stdio::null())
            .stderr(Stdio::null())
            .spawn()
@@ -785,13 +914,18 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
            .map(|f| std::io::BufReader::new(f).lines().map_while(Result::ok).filter_map(|l| serde_json::from_str(&l).ok()).collect())
            .unwrap_or_default();
        let done = lines.iter().any(|l| l.get("done").is_some());
-        let last_start = lines.iter().rev().take_while(|l| l.get("start").is_some() || l.get("design").is_none()).find_map(|l| l["start"].as_u64());
+        let last = lines.iter().rev().take_while(|l| l.get("start").is_some() || l.get("design").is_none()).find(|l| l.get("start").is_some());
+        let last_start = last.and_then(|l| l["start"].as_u64());
+        let in_edit = last.is_some_and(|l| l["edit"] == true);
        results = lines.iter().filter(|l| l.get("design").is_some()).cloned().collect();
        if done {
            break;
        }
        // It stopped inside action `last_start`: record it and go on after it.
        let Some(i) = last_start else {
+            if slice.is_some_and(|(j, _)| j > 0) {
+                break;
+            }
            extra.push(
                json!({"design": design, "entity": "design", "action": "load", "ok": false, "kind": if timed_out { "timeout" } else { "crash" },
                              "message": format!("the design did not load ({status:?})")}),
@@ -800,7 +934,7 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
        };
        // Which action was it? The child enumerates them; ask it by running from there with a
        // marker: simplest is to record the index and let the next run name it.
-        extra.push(json!({"design": design, "index": i, "kind": if timed_out { "timeout" } else { "crash" },
+        extra.push(json!({"design": design, "index": i, "edit": in_edit, "kind": if timed_out { "timeout" } else { "crash" },
                          "message": if timed_out { format!("no result after {} s", ACTION_TIMEOUT.as_secs()) } else { format!("the process ended: {status:?}") }}));
        from = i as usize + 1;
    }
@@ -809,7 +943,10 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
        let names = action_names(design);
        for e in &mut extra {
            if let Some(i) = e.get("index").and_then(Value::as_u64) {
-                let (entity, action) = names.get(i as usize).cloned().unwrap_or_else(|| (format!("action{i}"), "unknown".into()));
+                let (entity, mut action) = names.get(i as usize).cloned().unwrap_or_else(|| (format!("action{i}"), "unknown".into()));
+                if e["edit"] == true {
+                    action += "+edit";
+                }
                *e = json!({"design": design, "entity": entity, "action": action, "ok": false, "kind": e["kind"], "message": e["message"]});
            }
        }
@@ -856,9 +993,12 @@ fn write_baseline(results: &[Value]) {
            m.entry(design).or_default().entry(entity).or_default().extend(actions.as_str().unwrap_or("").split_whitespace().map(str::to_string));
        }
    }
+    // A timeout of an action that passed keeps it passing (see [`ratchet`]).
+    let base = read_baseline();
    for o in results {
        let (design, entity, action) = (o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
-        let mark = if o["ok"].as_bool() == Some(true) { "" } else { "!" };
+        let kept = o["kind"] == "timeout" && base.get(&key(design, entity, action)) == Some(&true);
+        let mark = if o["ok"].as_bool() == Some(true) || kept { "" } else { "!" };
        m.entry(design).or_default().entry(entity).or_default().push(format!("{mark}{action}"));
    }
    // One entity per line, sorted: small diffs when a few actions change.
@@ -887,10 +1027,18 @@ fn ratchet(results: &[Value], full: bool) {
    // baseline, over the same names this run tried, and in this run.
    let mut fam: BTreeMap<String, (usize, usize, Vec<String>, Vec<String>)> = BTreeMap::new();
    let mut fresh = 0usize;
+    // An action that passed in the baseline and now runs past ACTION_TIMEOUT is listed but not
+    // judged: on a busy runner the slowest actions (40-80 s on oracle 41's tube) land either side
+    // of the limit from one night to the next. An error or a crash is judged as usual.
+    let mut slow = Vec::new();
    for o in results {
        let (design, entity, action) = (o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
        let k = key(design, entity, action);
        let ok = o["ok"].as_bool() == Some(true);
+        if o["kind"] == "timeout" && base.get(&k) == Some(&true) {
+            slow.push(k);
+            continue;
+        }
        let f = fam.entry(key(design, &family(entity), action)).or_default();
        match base.get(&k) {
            Some(was) => {
@@ -927,6 +1075,14 @@ fn ratchet(results: &[Value], full: bool) {
        eprintln!("baseline written: {}", baseline_path().display());
        return;
    }
+    if !slow.is_empty() {
+        eprintln!(
+            "{} actions that pass in the baseline ran past the {} s limit this time (not judged):\n{}",
+            slow.len(),
+            ACTION_TIMEOUT.as_secs(),
+            slow.join("\n")
+        );
+    }
    if !fixed.is_empty() || fresh > 0 {
        eprintln!(
            "{} actions pass now that failed in the baseline, and {fresh} are not in it: record them with `cargo xtask action-matrix --bless`:\n{}",
@@ -945,51 +1101,156 @@ fn ratchet(results: &[Value], full: bool) {
 /// Pull requests: a fixed sample of the matrix (one action in [`PR_SAMPLE`]) against the ratchet.
 #[test]
 fn action_matrix_sample() {
-    let results = run_matrix(PR_SAMPLE, 0, 1);
+    let results = run_matrix(PR_SAMPLE);
    assert!(results.len() > 300, "only {} actions ran", results.len());
    ratchet(&results, false);
 }

-/// The whole matrix against the ratchet, in four parts that the nightly CI job runs side by side
-/// (`--run-ignored only`).
-fn full_part(part: usize) {
-    let results = run_matrix(1, part, 4);
+/// One shard of the whole matrix against the ratchet: `ACTION_MATRIX_SHARD=k/n` (the nightly
+/// "Action matrix" CI jobs run the n shards side by side, `--run-ignored only`). Shards are cut by
+/// what each design costs (tests/action_matrix/costs.json), see [`plan`].
+/// `ACTION_MATRIX_SHARD_LIST=1` only prints the plan.
+#[test]
+#[ignore = "heavy: the nightly Action matrix CI jobs run it, one shard each"]
+fn action_matrix_shard() {
+    let Some((k, n)) = std::env::var("ACTION_MATRIX_SHARD").ok().and_then(|v| parse_part(&v)) else { panic!("set ACTION_MATRIX_SHARD=k/n") };
+    let shards = plan(&design_names(), &read_costs(), n);
+    for (i, sh) in shards.iter().enumerate() {
+        let total: f64 = sh.iter().map(|u| u.cost).sum();
+        eprintln!("shard {}/{n}: {} pieces, about {:.0} s of work{}", i + 1, sh.len(), total, if i == k { " (this one)" } else { "" });
+    }
+    eprintln!("this shard: {}", shards[k].iter().map(Unit::name).collect::<Vec<_>>().join(", "));
+    if std::env::var_os("ACTION_MATRIX_SHARD_LIST").is_some() {
+        return;
+    }
+    let results = run_units(1, &shards[k]);
    ratchet(&results, false);
 }

+/// Determinism: a sample of the matrix (one family in [`DETERMINISM_SAMPLE`], the heaviest
+/// designs left out) run twice must give the same outcome for every action. Lists each action
+/// whose outcome changed between the runs.
 #[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_1() {
-    full_part(0);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_2() {
-    full_part(1);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_3() {
-    full_part(2);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_4() {
-    full_part(3);
+#[ignore = "heavy: the nightly Action matrix determinism CI job runs it"]
+fn action_matrix_determinism() {
+    let outcomes = |v: Vec<Value>| -> BTreeMap<String, String> {
+        v.into_iter()
+            .map(|o| {
+                let k = key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
+                let r = if o["ok"].as_bool() == Some(true) {
+                    "pass".to_string()
+                } else {
+                    format!("{}: {}", o["kind"].as_str().unwrap_or(""), o["message"].as_str().unwrap_or(""))
+                };
+                (k, r)
+            })
+            .collect()
+    };
+    let costs = read_costs();
+    let queue: Vec<Unit> = design_names()
+        .into_iter()
+        .filter(|n| costs.get(n).copied().unwrap_or(UNKNOWN_COST).secs <= DETERMINISM_MAX_SECS)
+        .map(|design| Unit { design, slice: None, cost: 0.0 })
+        .collect();
+    let a = outcomes(run_units(DETERMINISM_SAMPLE, &queue));
+    let b = outcomes(run_units(DETERMINISM_SAMPLE, &queue));
+    let keys: BTreeSet<&String> = a.keys().chain(b.keys()).collect();
+    let mut changed = Vec::new();
+    // Pieces that share a name can swap numbers between runs (#569): compare passes per family
+    // too, and report a family whose pass count differs.
+    let mut fam: BTreeMap<String, (usize, usize)> = BTreeMap::new();
+    for k in &keys {
+        let (x, y) = (a.get(*k).map_or("missing", String::as_str), b.get(*k).map_or("missing", String::as_str));
+        let mut parts = k.splitn(3, " :: ");
+        let (d, e, act) = (parts.next().unwrap_or(""), parts.next().unwrap_or(""), parts.next().unwrap_or(""));
+        let f = fam.entry(key(d, &family(e), act)).or_default();
+        f.0 += usize::from(x == "pass");
+        f.1 += usize::from(y == "pass");
+        if x != y {
+            changed.push(format!("{k}\n    first:  {x}\n    second: {y}"));
+        }
+    }
+    let families: Vec<String> = fam.into_iter().filter(|(_, (x, y))| x != y).map(|(k, (x, y))| format!("{k}: {x} then {y} pass")).collect();
+    eprintln!(
+        "action matrix determinism: {} actions, {} changed between two runs, {} families pass a different number of times",
+        keys.len(),
+        changed.len(),
+        families.len()
+    );
+    for c in &changed {
+        eprintln!("  {c}");
+    }
+    assert!(
+        families.is_empty(),
+        "{} families of actions pass a different number of times in two runs of the same build:\n{}",
+        families.len(),
+        families.join("\n")
+    );
 }

 /// The whole matrix at once (`cargo xtask action-matrix`): `ACTION_MATRIX_BLESS=1` rewrites the
 /// baseline; `ACTION_MATRIX_RESULTS=file.json` keeps every outcome with its message.
+/// `ACTION_MATRIX_MERGE=DIR` runs nothing and takes the outcomes from the `results-*.json` files
+/// in DIR instead (the nightly shards' artifacts), and the timings from its `timings-*.jsonl`
+/// files, which `ACTION_MATRIX_BLESS` then also writes to tests/action_matrix/costs.json.
 #[test]
-#[ignore = "cargo xtask action-matrix runs it (CI runs it as the four action_matrix_full parts)"]
+#[ignore = "cargo xtask action-matrix runs it (CI runs it as the action_matrix_shard jobs)"]
 fn action_matrix_all() {
-    let results = run_matrix(1, 0, 1);
+    let Some(dir) = std::env::var_os("ACTION_MATRIX_MERGE").map(PathBuf::from) else {
+        let results = run_matrix(1);
+        ratchet(&results, true);
+        return;
+    };
+    let mut results: Vec<Value> = Vec::new();
+    let mut timings: Vec<Value> = Vec::new();
+    let mut files: Vec<PathBuf> = std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).collect();
+    files.sort();
+    for f in files {
+        let name = f.file_name().unwrap_or_default().to_string_lossy().to_string();
+        let text = std::fs::read_to_string(&f).unwrap_or_default();
+        if name.starts_with("results-") && name.ends_with(".json") {
+            results.extend(serde_json::from_str::<Vec<Value>>(&text).unwrap_or_else(|e| panic!("{name}: {e}")));
+        } else if name.starts_with("timings-") {
+            timings.extend(text.lines().filter_map(|l| serde_json::from_str(l).ok()));
+        }
+    }
+    let ran: BTreeSet<&str> = results.iter().filter_map(|o| o["design"].as_str()).collect();
+    let missing: Vec<String> = design_names().into_iter().filter(|d| !ran.contains(d.as_str())).collect();
+    assert!(missing.is_empty(), "no results for {}", missing.join(", "));
+    results.sort_by_key(|o| key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or("")));
+    if std::env::var_os("ACTION_MATRIX_BLESS").is_some() && !timings.is_empty() {
+        write_costs(&timings);
+    }
    ratchet(&results, true);
 }

+/// tests/action_matrix/costs.json from the shards' timings: per design, its whole time (a sliced
+/// design's slices added up, less the loads all but one of them repeat) and its load.
+fn write_costs(timings: &[Value]) {
+    let mut m: BTreeMap<String, (f64, f64, usize)> = BTreeMap::new();
+    for t in timings {
+        let e = m.entry(t["design"].as_str().unwrap_or("").to_string()).or_default();
+        e.0 += t["secs"].as_f64().unwrap_or(0.0);
+        e.1 = e.1.max(t["load"].as_f64().unwrap_or(0.0));
+        e.2 += 1;
+    }
+    // Designs these timings don't cover keep their old costs.
+    for (d, c) in read_costs() {
+        m.entry(d).or_insert((c.secs, c.load, 1));
+    }
+    let mut s = String::from(
+        "{\n \"about\": \"What each action matrix design costs on a CI runner, in seconds (secs: the whole design, load: before its first action), for cutting the nightly shards (apps/solidcraft-cli/tests/action_matrix.rs, plan). Written with the baseline by cargo xtask action-matrix --bless --from DIR.\",\n \"designs\": {\n",
+    );
+    let n = m.len();
+    for (i, (d, (secs, load, pieces))) in m.into_iter().enumerate() {
+        let secs = (secs - load * pieces.saturating_sub(1) as f64).max(load);
+        s += &format!("  {}: {{\"secs\": {:.1}, \"load\": {:.1}}}{}\n", json!(d), secs, load, if i + 1 < n { "," } else { "" });
+    }
+    s += " }\n}\n";
+    std::fs::write(costs_path(), s).unwrap();
+    eprintln!("costs written: {}", costs_path().display());
+}
+
 // ---------------------------------------------------------------------------------------------
 // The matrix's causes: one small reproduction per open issue, ignored until it is fixed (the
 // issue says how many matrix actions it accounts for). Each runs commands as the desktop sends
@@ -1031,6 +1292,106 @@ fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
    }
 }

+// #1255: a round on a knuckle's cap circle (oracle/63's hinge), 0.73 wide on a ring of radius
+// 4. The run past each end of the circle followed the end tangent so far that its sections
+// wrapped round the ring and the blend was refused; it is shortened now while it still
+// crosses the end face. Before #1101 a 0.13 mm station on the leaf's top edge kept the
+// matrix's radius at 0.013, which never got that far.
+#[test]
+fn a_round_on_a_knuckle_cap_circle() {
+    for (cmd, size, removed) in [("solid.fillet", "radius", (2.4, 2.8)), ("solid.chamfer", "distance", (5.6, 6.3))] {
+        let mut s = load(&root().join("tests/oracle/63-hinge-knuckle/recipe.json")).unwrap();
+        let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate(0.001).unwrap().measure().volume).sum::<f64>();
+        let before = volume(&s);
+        s.execute(cmd, &json!({"edges": [[40.0, 29.837_722, 6.449_490]], size: 0.728})).unwrap_or_else(|e| panic!("{cmd}: {e}"));
+        check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{cmd}: {kind}: {e}"));
+        let st = s.model.state();
+        let body = &st.bodies.first().unwrap().body;
+        assert!(body.validity().is_empty(), "{cmd}: {:?}", body.validity());
+        let gone = before - volume(&s);
+        assert!(gone > removed.0 && gone < removed.1, "{cmd} took {gone} mm³");
+    }
+}
+
+// #1255: a hole 0.133 mm across on the 0.5 mm ledge a loft cut leaves in a pocket floor of a
+// 900 mm slab. The Boolean needed a retry, and its guard meshed the drill as coarsely as the
+// slab's size allows (0.4 mm, three times the drill's width): the mesh had no inside, the drill
+// measured −30272 mm³ and the right cut was refused. Volumes are measured finer than each
+// body's smallest radius now.
+#[test]
+fn a_hair_thin_hole_on_a_ledge_beside_a_loft_cut() {
+    let mut s = load(&root().join("examples/regressions/loft_cut_beside_round_hole.json")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.005, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 0.133, "position": [357.22, -150.993_333, 730.0]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    // The drill goes through the 4 mm ledge and on through the slab below: 690 to 730.
+    let gone = before - volume(&s);
+    let expected = std::f64::consts::PI * 0.0665 * 0.0665 * 40.0;
+    assert!((gone - expected).abs() < 0.2, "the hole took {gone} mm³, not {expected}");
+}
+
+// #1255: a 0.8 mm hole through the side wall of the plastic part's rest. Meshed at the
+// tolerance the 200 mm drill sets, the part with its rounds, bosses and draft measured 6.8 mm³
+// more after the cut than before; ten times finer it is 1.44 mm³ less, the drill's volume
+// through the 2.9 mm wall. A volume out of bounds is measured again finer before it refuses.
+#[test]
+fn a_small_hole_through_the_wall_of_a_plastic_rest() {
+    let mut s = load(&root().join("apps/solidcraft-cli/tests/corpus/modern-plastic.solidcraft")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 0.8, "position": [63.069_841_5, 28.333_333, 4.0]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    let gone = before - volume(&s);
+    assert!(gone > 1.2 && gone < 1.7, "the hole took {gone} mm³");
+}
+
+// #1255: a hole square to a flange bent at 45°. The drill's cap, evaluated at that angle, lay
+// 2.9e-11 mm off the plane it was made on against a bound of 2.2e-11, so the sheet didn't take
+// the hole as a cut-out of its flat pattern and the cut was refused. The sheet keeps the hole
+// and still unfolds and folds back.
+#[test]
+fn a_hole_square_to_a_45_degree_flange() {
+    let mut s = load(&root().join("tests/oracle/70-sm-flange-45/recipe.json")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 3.448, "position": [66.666_667, -4.511_845, 4.511_845]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    // Through the 2.5 mm flange.
+    let gone = before - volume(&s);
+    let expected = std::f64::consts::PI * 1.724 * 1.724 * 2.5;
+    assert!((gone - expected).abs() < 0.1, "the hole took {gone} mm³, not {expected}");
+    let sheets: Vec<String> = s.model.state().sheets.iter().map(|sh| sh.body.clone()).collect();
+    assert!(!sheets.is_empty());
+    for body in sheets {
+        for id in ["sheet.unfold", "sheet.refold"] {
+            s.execute(id, &json!({"body": body})).unwrap_or_else(|e| panic!("{id}: {e}"));
+        }
+    }
+}
+
+// #1255: an axis through a corner round of the sensor enclosure's lid, then a parameter that
+// widens the lid. The round is found again by name, but its point nearest the old pick is the
+// end of its arc, on the edge it shares with the flat side, and picking again by that point
+// took the side: "the face is not a cylinder". The named face is used as found now.
+#[test]
+fn an_axis_through_a_corner_round_that_a_parameter_moves() {
+    let mut s = load(&root().join("examples/acceptance/sensor_enclosure.json")).unwrap();
+    s.execute("construct.axis.through_cylinder", &json!({"face": {"face": [36.242_617, 29.977_740, 27.0]}})).unwrap();
+    let start = s.doc.features.len();
+    s.execute("parameters.change", &json!({"name": "board_w", "expression": "(60 mm) * 1.1"})).unwrap();
+    check(&s, start, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    let st = s.model.state();
+    let axis = st.construct.iter().find_map(|c| match &c.geom {
+        solidcraft_engine::doc::construct::ConstructGeom::Axis { origin, dir } => Some((*origin, *dir)),
+        _ => None,
+    });
+    let (origin, dir) = axis.expect("the axis");
+    // The round's axis moved with the lid's corner, from x = 36 to 39.
+    let off = origin - Vec3::new(39.0, 26.0, 0.0);
+    assert!((off - dir * off.dot(dir)).len() < 1e-6, "the axis passes {origin:?} along {dir:?}");
+}
+
 #[test]
 fn a_sketch_on_a_patterned_boss_top() {
    let mut c: Vec<Value> = rectangle(json!("XY"), [0., 0.], [60., 20.]).into();
@@ -0,0 +1,168 @@
+//! `--json-out FILE` writes the JSON `run` and `eval` would print to a file the CLI makes
+//! itself. A shell's `>` can re-encode stdout (Windows PowerShell writes UTF-16, or UTF-8 with a
+//! byte-order mark), which strict JSON readers refuse; the file is plain UTF-8.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solidcraft-json-out-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A box, and a parameter whose comment has a character outside ASCII.
+    fn script(&self) -> PathBuf {
+        let path = self.0.join("box.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "bore", "expression": "5 mm", "comment": "\u{d8} of the bore"}},
+            {"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+
+    /// A filleted box whose fillet a later parameter change makes impossible: every command
+    /// succeeds, the timeline ends with a failing feature.
+    fn broken_script(&self) -> PathBuf {
+        let path = self.0.join("broken.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "r", "expression": "2 mm"}},
+            {"command": "solid.box", "params": {"length": 20, "width": 20, "height": 10}},
+            {"command": "solid.fillet", "params": {"edges": [[10, 0, 10]], "radius": "r"}},
+            {"command": "parameters.change", "params": {"name": "r", "expression": "50 mm"}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn cli() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+}
+
+fn stdout_of(output: Output) -> Vec<u8> {
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    output.stdout
+}
+
+/// Timings differ from one run to the next.
+fn without_timings(v: &mut Value) {
+    match v {
+        Value::Object(map) => {
+            map.remove("ms");
+            map.values_mut().for_each(without_timings);
+        }
+        Value::Array(items) => items.iter_mut().for_each(without_timings),
+        _ => {}
+    }
+}
+
+/// The file holds what stdout carried in the same command without `--json-out`: the same JSON,
+/// laid out the same way, in UTF-8 with no byte-order mark (UTF-8's or UTF-16's), so a strict
+/// reader accepts it.
+fn assert_plain_utf8_json(file: &Path, stdout: &[u8]) -> Value {
+    let bytes = std::fs::read(file).unwrap();
+    assert!(matches!(bytes.first(), Some(b'{' | b'[')), "the file starts with the JSON itself, not a mark");
+    assert_eq!(bytes.last(), Some(&b'\n'), "like stdout, the file ends with a newline");
+    let lines = |b: &[u8]| b.iter().filter(|c| **c == b'\n').count();
+    assert_eq!(lines(&bytes), lines(stdout), "laid out like stdout");
+    let mut value: Value = serde_json::from_str(std::str::from_utf8(&bytes).unwrap()).unwrap();
+    let mut printed: Value = serde_json::from_slice(stdout).unwrap();
+    without_timings(&mut value);
+    without_timings(&mut printed);
+    assert_eq!(value, printed, "the file is what stdout would have carried");
+    value
+}
+
+#[test]
+fn run_results_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let file = dir.0.join("results.json");
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).arg("--results").output().unwrap());
+    let output = cli().arg("run").arg(&script).arg("--results").arg("--json-out").arg(&file).output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    assert!(output.stdout.is_empty(), "the JSON goes to the file, not to stdout");
+    let results = assert_plain_utf8_json(&file, &on_stdout);
+    assert_eq!(results.as_array().map(Vec::len), Some(2));
+}
+
+#[test]
+fn run_json_out_without_results_holds_the_measurement_even_when_quiet() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).output().unwrap());
+    for (name, extra) in [("plain", &[][..]), ("quiet", &["--quiet"][..])] {
+        let file = dir.0.join(format!("measure-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measure = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measure["body_count"], 1, "{name}");
+    }
+}
+
+#[test]
+fn eval_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("eval").arg(&script).output().unwrap());
+    // The option may come before the file to evaluate, and `inspect` is the same command.
+    for name in ["eval", "inspect"] {
+        let file = dir.0.join(format!("{name}.json"));
+        let output = cli().arg(name).arg("--json-out").arg(&file).arg(&script).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measured = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measured["body_count"], 1, "{name}");
+        // A character outside ASCII is written as it is, in UTF-8.
+        assert!(std::fs::read_to_string(&file).unwrap().contains("\u{d8} of the bore"), "{name}");
+    }
+}
+
+#[test]
+fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    for cmd in ["run", "eval"] {
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
+
+        let missing = dir.0.join("missing").join("out.json");
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(!output.stderr.is_empty(), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
+        assert!(!missing.exists(), "{cmd}");
+    }
+}
+
+#[test]
+fn run_json_out_is_not_written_when_a_feature_fails() {
+    let dir = Scratch::new();
+    let script = dir.broken_script();
+    for (name, extra) in [("plain", &[][..]), ("results", &["--results"][..])] {
+        let file = dir.0.join(format!("failed-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{name}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("nothing was written"), "{name}");
+        assert!(!file.exists(), "{name}");
+    }
+}
@@ -1,18 +1,83 @@
-//! `mcp --connect` to a port where no app listens tells the user how to start one (#270).
+//! `mcp --connect` to a port where no app listens yet (#270): the server still starts, its tools
+//! say how to start the app, and once the app runs they reach it with that launch's token.

+use std::io::{BufRead, BufReader, Write};
 use std::net::TcpListener;
 use std::process::{Command, Stdio};

+use serde_json::{Value, json};
+
 #[test]
-fn mcp_connect_without_a_listening_app_names_the_control_flag() {
+fn mcp_connect_serves_before_the_app_runs_and_reaches_it_once_it_does() {
    // A port that was free a moment ago: nothing listens on it.
    let port = TcpListener::bind("127.0.0.1:0").unwrap().local_addr().unwrap().port();
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .args(["mcp", "--connect", &format!("127.0.0.1:{port}")])
-        .stdin(Stdio::null())
-        .output()
+    let addr = format!("127.0.0.1:{port}");
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-connect-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--connect", &addr, "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
        .unwrap();
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(!output.status.success(), "{stderr}");
-    assert!(stderr.contains("--control"), "say how to start the app with a control port: {stderr}");
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    let mut ask = |id: u64, method: &str, params: Value| -> Value {
+        writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": id, "method": method, "params": params})).unwrap();
+        let mut line = String::new();
+        stdout.read_line(&mut line).unwrap();
+        serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"))
+    };
+    let measure = json!({"name": "measure", "arguments": {}});
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // The server answers without the app, and its instructions say the app isn't running.
+    let init = ask(1, "initialize", json!({"protocolVersion": "2025-06-18"}));
+    let instructions = init["result"]["instructions"].as_str().unwrap_or_default();
+    assert!(instructions.contains("not running") && instructions.contains(&format!("--control {port}")), "{instructions}");
+    let tools = ask(2, "tools/list", json!({}));
+    assert!(tools["result"]["tools"].as_array().is_some_and(|t| !t.is_empty()), "{tools}");
+
+    // A tool call says the app is not running and how to start it.
+    let r = ask(3, "tools/call", measure.clone());
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("not running") && text(&r).contains(&format!("solidcraft --control {port}")), "{r}");
+
+    // The app starts: a token file for this launch, and its control port.
+    let token = "0123456789abcdef".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    let listener = TcpListener::bind(&addr).unwrap();
+    let app = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        let mut line = String::new();
+        BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let reply = if req["token"] == json!(token) {
+            json!({"id": req["id"], "ok": true, "result": {"bodies": [], "method": req["method"]}})
+        } else {
+            json!({"id": req["id"], "ok": false, "error": format!("unauthorized: token {}", req["token"])})
+        };
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let r = ask(4, "tools/call", measure);
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("engine.execute"), "{r}");
+    app.join().unwrap();
+
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+#[test]
+fn mcp_connect_without_a_port_is_refused_at_start() {
+    for addr in ["localhost", "127.0.0.1:0"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--connect", addr]).stdin(Stdio::null()).output().unwrap();
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(!output.status.success(), "{addr}: {stderr}");
+        assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
+    }
 }
@@ -132,3 +132,50 @@ fn legacy_extension_and_format_tag_still_open() {
    let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
    assert!(reopened.to_json().contains("\"solidcraft/"));
 }
+
+/// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
+/// option it doesn't take rather than ignoring it.
+#[test]
+fn snapshot_runs_its_script_on_the_in_design() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solidcraft");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let shifted = dir.0.join("shifted.json");
+    std::fs::write(
+        &shifted,
+        json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
+    )
+    .unwrap();
+    let shot = |name: &str, args: &[&std::ffi::OsStr]| {
+        let png = dir.0.join(name);
+        json_output(cli().arg("snapshot").args(args).arg("--out").arg(&png).args(["--width", "64", "--height", "48"]).output().unwrap());
+        std::fs::read(&png).unwrap()
+    };
+    // Pictures are drawn on the GPU: without an adapter only the option checks below run.
+    match solidcraft_gpu::capture::shared() {
+        Ok(_) => {
+            let alone = shot("alone.png", &[shifted.as_os_str()]);
+            let on_base = shot("on_base.png", &[shifted.as_os_str(), "--in".as_ref(), base.as_os_str()]);
+            let base_only = shot("base.png", &["--in".as_ref(), base.as_os_str()]);
+            assert_ne!(alone, on_base, "the script ran on the --in design");
+            assert_ne!(base_only, on_base);
+        }
+        Err(e @ solidcraft_gpu::GpuError::NoAdapter(_)) if std::env::var_os("SOLIDCRAFT_REQUIRE_GPU").is_none() => {
+            eprintln!("pictures left out: {e}")
+        }
+        Err(e) => panic!("{e}"),
+    }
+    for (bad, says) in [(["--frobnicate", "1"], "doesn't take --frobnicate"), (["--width", "wide"], "--width must be 16 to 8192")] {
+        let output = cli().arg("snapshot").arg(&base).arg("--out").arg(dir.0.join("x.png")).args(bad).output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        assert!(String::from_utf8_lossy(&output.stderr).contains(says), "{}", String::from_utf8_lossy(&output.stderr));
+    }
+}
+
+/// An unknown command's error suggests the id that was meant.
+#[test]
+fn unknown_command_suggests_the_closest_id() {
+    let output = cli().args(["exec", "file.open"]).output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&output.stderr).contains("did you mean `doc.open`?"), "{}", String::from_utf8_lossy(&output.stderr));
+}
@@ -0,0 +1,86 @@
+//! A design's command script (`timeline.export_script`, #886) replays into the same design:
+//! every corpus design that the script supports comes back with the same timeline, parameters,
+//! settings and bodies.
+
+use std::path::{Path, PathBuf};
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+fn corpus() -> Vec<PathBuf> {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
+    let mut v: Vec<PathBuf> =
+        std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "solidcraft")).collect();
+    v.sort();
+    assert!(v.len() >= 7, "corpus files in {}", dir.display());
+    v
+}
+
+/// Designs with components or joints, which scripts do not support yet.
+const ASSEMBLIES: [&str; 2] = ["components-arm", "joints-hinge"];
+
+fn bodies(s: &mut Session) -> Vec<(String, f64, f64, Value)> {
+    let m = s.execute("inspect.measure", &json!({})).unwrap();
+    let mut v: Vec<_> = m["bodies"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .map(|b| {
+            (
+                b["name"].as_str().unwrap_or_default().to_string(),
+                b["volume_mm3"].as_f64().unwrap(),
+                b["area_mm2"].as_f64().unwrap(),
+                b["faces"].clone(),
+            )
+        })
+        .collect();
+    v.sort_by(|a, b| a.0.cmp(&b.0));
+    v
+}
+
+fn errors(s: &Session) -> Vec<(u64, Option<String>)> {
+    s.model.results.iter().map(|r| (r.id, r.error.clone())).collect()
+}
+
+fn params(s: &Session) -> Vec<solidcraft_engine::doc::Param> {
+    let mut v = s.doc.params.clone();
+    v.sort_by(|a, b| a.name.cmp(&b.name));
+    v
+}
+
+#[test]
+fn corpus_designs_replay_from_their_scripts() {
+    let mut replayed = 0;
+    for p in corpus() {
+        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let mut s = Session::default();
+        s.execute("doc.open", &json!({"path": p.to_string_lossy()})).unwrap();
+        let r = match s.execute("timeline.export_script", &json!({})) {
+            Ok(r) => r,
+            Err(e) => {
+                assert!(ASSEMBLIES.contains(&name.as_str()), "{name}: {e}");
+                assert!(e.to_string().contains("not supported yet"), "{name}: {e}");
+                continue;
+            }
+        };
+        assert!(!ASSEMBLIES.contains(&name.as_str()), "{name} has components: the script should refuse it");
+        // Through text, as a script file would carry it.
+        let script: Value = serde_json::from_str(&r["script"].to_string()).unwrap();
+        let mut t = Session::default();
+        t.run_script(&script).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(t.doc.features, s.doc.features, "{name}: timeline");
+        assert_eq!(params(&t), params(&s), "{name}: parameters");
+        assert_eq!(t.doc.marker, s.doc.marker, "{name}: marker");
+        assert_eq!(t.doc.units, s.doc.units, "{name}: units");
+        assert_eq!(t.doc.sheet, s.doc.sheet, "{name}: sheet metal rules");
+        assert_eq!(t.doc.plastic, s.doc.plastic, "{name}: plastic rules");
+        assert_eq!(t.doc.materials, s.doc.materials, "{name}: materials");
+        assert_eq!(t.doc.user_materials, s.doc.user_materials, "{name}: user materials");
+        assert_eq!(t.doc.favorites, s.doc.favorites, "{name}: favourites");
+        assert_eq!(t.doc.param_comments, s.doc.param_comments, "{name}: comments");
+        assert_eq!(errors(&t), errors(&s), "{name}: feature results");
+        assert_eq!(bodies(&mut t), bodies(&mut s), "{name}: bodies");
+        replayed += 1;
+    }
+    assert!(replayed >= 7, "replayed {replayed} corpus designs");
+}
@@ -0,0 +1,412 @@
+//! `snapshot` frames its picture like the MCP `screenshot`: from a camera, a view saved in the
+//! design or one the script applies itself, and without the ground grid and the origin's axes
+//! when asked (the grid lies on Z 0 and cuts through a part that straddles it). Pictures are drawn
+//! on the GPU and compared with a tolerance; without a GPU adapter the tests that draw are skipped
+//! with the reason printed (`SOLIDCRAFT_REQUIRE_GPU=1` makes that a failure).
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+use solidcraft_mcp::{Headless, Server};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+/// Whether pictures can be drawn here; installs the renderer the CLI installs, so the MCP
+/// `screenshot` in this process draws as `solidcraft-cli mcp` does.
+fn gpu() -> bool {
+    match solidcraft_gpu::capture::shared() {
+        Ok(c) => {
+            solidcraft_engine::capture::install(std::sync::Arc::new(move |scene, cam, w, h| {
+                c.rgba(scene, cam, w, h).map(|rgba| solidcraft_engine::capture::Picture { rgba, renderer: c.renderer() }).map_err(|e| e.to_string())
+            }));
+            true
+        }
+        Err(e @ solidcraft_gpu::GpuError::NoAdapter(_)) if std::env::var_os("SOLIDCRAFT_REQUIRE_GPU").is_none() => {
+            eprintln!("skipping: {e}");
+            false
+        }
+        Err(e) => panic!("{e}"),
+    }
+}
+
+/// A PNG's size and RGBA pixels.
+fn decode(png: &[u8]) -> (u32, u32, Vec<u8>) {
+    let img = image::load_from_memory_with_format(png, image::ImageFormat::Png).unwrap().to_rgba8();
+    (img.width(), img.height(), img.into_raw())
+}
+
+/// Pixels of two same-sized pictures that differ by more than a little in some channel.
+fn differing(a: &[u8], b: &[u8]) -> usize {
+    let ((wa, ha, a), (wb, hb, b)) = (decode(a), decode(b));
+    assert_eq!((wa, ha), (wb, hb), "pictures of different sizes");
+    a.as_chunks::<4>().0.iter().zip(b.as_chunks::<4>().0).filter(|(p, q)| p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 16)).count()
+}
+
+/// The same picture: GPU output may differ by a few levels or a stray edge pixel between drivers.
+#[track_caller]
+fn assert_same(a: &[u8], b: &[u8], what: &str) {
+    let (n, total) = (differing(a, b), (SIZE.0 * SIZE.1) as usize);
+    assert!(n * 500 <= total, "{what}: {n} of {total} pixels differ");
+}
+
+/// Different pictures: more than stray pixels differ.
+#[track_caller]
+fn assert_differs(a: &[u8], b: &[u8], what: &str) {
+    let n = differing(a, b);
+    assert!(n >= 20, "{what}: only {n} pixels differ");
+}
+
+const SIZE: (u32, u32) = (160, 100);
+
+fn camera() -> Value {
+    json!({"target": [20, 0, 0], "yaw": 0.6, "pitch": 0.25, "distance": 100})
+}
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solidcraft-snapshot-camera-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A box that straddles Z 0 and keeps clear of the origin (its axes show beside it), with a view
+    /// saved in the design, plus `more` steps.
+    fn script(&self, name: &str, more: &[Value]) -> PathBuf {
+        let mut steps = vec![
+            json!({"command": "solid.box", "params": {"length": 60, "width": 40, "height": 30, "corner": [10, -20, -15]}}),
+            json!({"command": "view.save", "params": {"name": "Detail", "camera": camera()}}),
+        ];
+        steps.extend(more.iter().cloned());
+        let path = self.0.join(name);
+        std::fs::write(&path, json!({"commands": steps}).to_string()).unwrap();
+        path
+    }
+
+    fn run(&self, script: &Path, out: &str, extra: &[&str]) -> Output {
+        let (w, h) = (SIZE.0.to_string(), SIZE.1.to_string());
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .arg("snapshot")
+            .arg(script)
+            .arg("--out")
+            .arg(self.0.join(out))
+            .args(["--width", &w, "--height", &h])
+            .args(extra)
+            .output()
+            .unwrap()
+    }
+
+    /// The PNG `snapshot` writes.
+    fn snapshot(&self, script: &Path, out: &str, extra: &[&str]) -> Vec<u8> {
+        let output = self.run(script, out, extra);
+        assert!(output.status.success(), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+        let png = std::fs::read(self.0.join(out)).unwrap();
+        assert!(png.starts_with(b"\x89PNG"), "{extra:?}");
+        png
+    }
+
+    /// The PNG the MCP `screenshot` tool writes for the same design.
+    fn mcp(&self, script: &Path, out: &str, arguments: Value) -> Vec<u8> {
+        let mut session = Session::default();
+        session.run_script(&serde_json::from_slice(&std::fs::read(script).unwrap()).unwrap()).unwrap();
+        let mut server = Server::new(Box::new(Headless::new(session)));
+        let mut arguments = arguments;
+        arguments["path"] = json!(self.0.join(out).to_string_lossy());
+        arguments["width"] = json!(SIZE.0);
+        arguments["height"] = json!(SIZE.1);
+        let call = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "screenshot", "arguments": arguments}});
+        let reply: Value = serde_json::from_str(&server.handle_line(&call.to_string()).unwrap()).unwrap();
+        assert!(reply.get("error").is_none() && reply["result"]["isError"] != json!(true), "{reply}");
+        std::fs::read(self.0.join(out)).unwrap()
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// The picture of `--camera` is the picture of the MCP `screenshot` with the same camera, and
+/// not the home view the option used to be ignored for.
+#[test]
+fn a_camera_frames_the_picture_as_the_mcp_screenshot_does() {
+    if !gpu() {
+        return;
+    }
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let home = dir.snapshot(&script, "home.png", &[]);
+    let json = camera().to_string();
+    let shot = dir.snapshot(&script, "camera.png", &["--camera", &json]);
+    assert_differs(&shot, &home, "--camera was ignored");
+    assert_same(&shot, &dir.mcp(&script, "mcp-camera.png", json!({"camera": camera()})), "the MCP screenshot");
+    // A perspective camera too, and a different eye gives a different picture.
+    let mut near = camera();
+    near["fov"] = json!(0.6);
+    let perspective = dir.snapshot(&script, "perspective.png", &["--camera", &near.to_string()]);
+    assert_differs(&perspective, &shot, "perspective");
+    assert_same(&perspective, &dir.mcp(&script, "mcp-perspective.png", json!({"camera": near})), "the MCP perspective screenshot");
+}
+
+/// `--view` also takes a view saved in the design, which is the camera it was saved with; a
+/// standard view still looks as it did.
+#[test]
+fn a_saved_view_is_its_camera_and_a_standard_view_is_unchanged() {
+    if !gpu() {
+        return;
+    }
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let json = camera().to_string();
+    let by_camera = dir.snapshot(&script, "camera.png", &["--camera", &json]);
+    let saved = dir.snapshot(&script, "saved.png", &["--view", "Detail"]);
+    assert_same(&saved, &by_camera, "the saved view");
+    assert_same(&saved, &dir.mcp(&script, "mcp-saved.png", json!({"view": "Detail"})), "the MCP saved view");
+    // A standard view frames the model from its direction, as before: the home camera turned.
+    let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
+    let mut s = Session::default();
+    s.run_script(&serde_json::from_slice(&std::fs::read(&script).unwrap()).unwrap()).unwrap();
+    let mut cam = solidcraft_engine::view::home_camera(&s);
+    cam.set_view(solidcraft_engine::render::StandardView::Top);
+    let scene = solidcraft_engine::view::scene(&s, &cam);
+    assert_same(&top, &solidcraft_engine::capture::png(&scene, &cam, SIZE.0, SIZE.1).unwrap().bytes, "the home camera turned to the top");
+    assert_same(&top, &dir.mcp(&script, "mcp-top.png", json!({"view": "top"})), "the MCP top view");
+    assert_differs(&top, &saved, "top and the saved view");
+    let iso = dir.snapshot(&script, "iso.png", &["--view", "iso"]);
+    assert_same(&iso, &dir.snapshot(&script, "home.png", &[]), "iso is home");
+    assert_differs(&iso, &top, "iso and top");
+}
+
+/// A script that applies a view itself (as an MCP `execute` of `view.apply` does) sets the camera
+/// of its snapshot; `--view` and `--camera` still decide when given.
+#[test]
+fn a_script_can_carry_its_camera() {
+    if !gpu() {
+        return;
+    }
+    let dir = Scratch::new();
+    let script = dir.script("carried.json", &[json!({"command": "view.apply", "params": {"camera": camera()}})]);
+    let plain = dir.script("plain.json", &[]);
+    let carried = dir.snapshot(&script, "carried.png", &[]);
+    assert_same(&carried, &dir.snapshot(&plain, "by-camera.png", &["--camera", &camera().to_string()]), "the carried camera");
+    assert_differs(&carried, &dir.snapshot(&plain, "home.png", &[]), "the carried camera and home");
+    let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
+    assert_same(&top, &dir.snapshot(&plain, "plain-top.png", &["--view", "top"]), "--view decides");
+}
+
+/// The grid and the axes each go when asked, and a render without both from any side shows the
+/// model alone: an empty design is then the same blank picture from every camera.
+#[test]
+fn the_grid_and_the_axes_can_be_left_out() {
+    if !gpu() {
+        return;
+    }
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let json = camera().to_string();
+    for view in [&["--view", "front"][..], &["--camera", &json][..]] {
+        let with = |extra: &[&str], out: &str| dir.snapshot(&script, out, &[view, extra].concat());
+        let (all, no_grid, no_axes, bare) = (
+            with(&[], "all.png"),
+            with(&["--no-grid"], "no-grid.png"),
+            with(&["--no-axes"], "no-axes.png"),
+            with(&["--no-grid", "--no-axes"], "bare.png"),
+        );
+        let different = [&all, &no_grid, &no_axes, &bare];
+        for (i, a) in different.iter().enumerate() {
+            for b in &different[i + 1..] {
+                assert_differs(a, b, &format!("{view:?}: two of the pictures"));
+            }
+        }
+        // The same as the MCP's `grid` and `axes`.
+        let mcp = |extra: Value, out: &str| {
+            let mut a = match view[0] {
+                "--view" => json!({"view": "front"}),
+                _ => json!({"camera": camera()}),
+            };
+            a.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+            dir.mcp(&script, out, a)
+        };
+        assert_same(&no_grid, &mcp(json!({"grid": false}), "mcp-no-grid.png"), "the MCP's grid: false");
+        assert_same(&no_axes, &mcp(json!({"axes": false}), "mcp-no-axes.png"), "the MCP's axes: false");
+        assert_same(&bare, &mcp(json!({"grid": false, "axes": false}), "mcp-bare.png"), "the MCP's bare picture");
+    }
+    let empty = dir.0.join("empty.json");
+    std::fs::write(&empty, json!({"commands": []}).to_string()).unwrap();
+    let blank = |view: &str, out: &str| dir.snapshot(&empty, out, &["--view", view, "--no-grid", "--no-axes"]);
+    assert_same(&blank("top", "blank-top.png"), &blank("front", "blank-front.png"), "blank from every side");
+    assert_differs(&blank("top", "blank-top.png"), &dir.snapshot(&empty, "top.png", &["--view", "top"]), "blank and the grid");
+}
+
+/// A snapshot of a box shows its silhouette where the camera puts it: the pixels that differ
+/// from an empty design's picture (same camera, no grid or axes) span the box's corners projected
+/// to pixels, within the edge and silhouette lines' width.
+#[test]
+fn a_snapshot_shows_the_part_where_the_camera_puts_it() {
+    if !gpu() {
+        return;
+    }
+    let dir = Scratch::new();
+    let part = dir.0.join("box.json");
+    let empty = dir.0.join("empty.json");
+    let corner = [10.0, -20.0, -15.0];
+    let size = [60.0, 40.0, 30.0];
+    std::fs::write(
+        &part,
+        json!({"commands": [{"command": "solid.box", "params": {"length": size[0], "width": size[1], "height": size[2], "corner": corner}}]})
+            .to_string(),
+    )
+    .unwrap();
+    std::fs::write(&empty, json!({"commands": []}).to_string()).unwrap();
+    for cam in [
+        camera(),
+        json!({"target": [40, 0, 0], "yaw": 0.0, "pitch": 0.0, "distance": 160}),
+        json!({"target": [40, 0, 0], "yaw": -0.4, "pitch": 0.5, "distance": 150, "fov": 0.6}),
+    ] {
+        let args = ["--camera", &cam.to_string(), "--no-grid", "--no-axes"];
+        let (_, _, with) = decode(&dir.snapshot(&part, "part.png", &args));
+        let (_, _, without) = decode(&dir.snapshot(&empty, "empty.png", &args));
+        // The part's pixels: where the picture differs from the empty one.
+        let (mut lo, mut hi) = ([u32::MAX; 2], [0u32; 2]);
+        for (i, (p, q)) in with.as_chunks::<4>().0.iter().zip(without.as_chunks::<4>().0).enumerate() {
+            if p.iter().zip(q.iter()).any(|(x, y)| x.abs_diff(*y) > 24) {
+                let (x, y) = (i as u32 % SIZE.0, i as u32 / SIZE.0);
+                lo = [lo[0].min(x), lo[1].min(y)];
+                hi = [hi[0].max(x), hi[1].max(y)];
+            }
+        }
+        assert!(lo[0] <= hi[0], "{cam}: the part is not in the picture");
+        // Where the camera puts the corners.
+        let mut s = solidcraft_engine::Session::default();
+        s.execute("view.apply", &json!({"camera": cam})).unwrap();
+        let c = s.camera.unwrap();
+        let vp = c.view_proj(f64::from(SIZE.0) / f64::from(SIZE.1), 1000.0);
+        let (mut elo, mut ehi) = ([f64::MAX; 2], [f64::MIN; 2]);
+        for k in 0..8 {
+            let p = solidcraft_engine::geom::Vec3::new(
+                corner[0] + size[0] * f64::from(k & 1),
+                corner[1] + size[1] * f64::from((k >> 1) & 1),
+                corner[2] + size[2] * f64::from((k >> 2) & 1),
+            );
+            let q = vp.apply(p);
+            let (x, y) = ((q[0] / q[3] + 1.0) * 0.5 * f64::from(SIZE.0), (1.0 - q[1] / q[3]) * 0.5 * f64::from(SIZE.1));
+            elo = [elo[0].min(x), elo[1].min(y)];
+            ehi = [ehi[0].max(x), ehi[1].max(y)];
+        }
+        let near = |got: u32, want: f64| (f64::from(got) - want).abs() <= 2.5;
+        assert!(
+            near(lo[0], elo[0]) && near(lo[1], elo[1]) && near(hi[0] + 1, ehi[0]) && near(hi[1] + 1, ehi[1]),
+            "{cam}: the part spans pixels {lo:?}..={hi:?}, its corners project to {elo:?}..{ehi:?}"
+        );
+    }
+}
+
+/// `snapshot` under a `SOLIDCRAFT_GPU` policy: its reply and stderr.
+fn snapshot_under(dir: &Scratch, script: &Path, out: &str, policy: &str) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .env("SOLIDCRAFT_GPU", policy)
+        .arg("snapshot")
+        .arg(script)
+        .arg("--out")
+        .arg(dir.0.join(out))
+        .args(["--width", &SIZE.0.to_string(), "--height", &SIZE.1.to_string(), "--view", "top"])
+        .output()
+        .unwrap()
+}
+
+/// The last tier: `SOLIDCRAFT_GPU=cpu` draws with the CPU rasterizer whatever adapters there are,
+/// says so (`renderer: cpu` and a warning that overlays are not drawn), and the picture is the
+/// rasterizer's own.
+#[test]
+fn a_forced_cpu_snapshot_is_the_cpu_rasterizers_and_says_so() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let output = snapshot_under(&dir, &script, "cpu.png", "cpu");
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(output.status.success(), "{stderr}");
+    let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(reply["renderer"], "cpu", "{reply}");
+    assert!(reply["warning"].as_str().is_some_and(|w| w.contains("not drawn")), "{reply}");
+    assert!(stderr.contains("CPU rasterizer"), "{stderr}");
+    let mut s = Session::default();
+    s.run_script(&serde_json::from_slice(&std::fs::read(&script).unwrap()).unwrap()).unwrap();
+    let mut cam = solidcraft_engine::view::home_camera(&s);
+    cam.set_view(solidcraft_engine::render::StandardView::Top);
+    let scene = solidcraft_engine::view::scene(&s, &cam);
+    let cpu = solidcraft_engine::render::render_png(&scene, &cam, SIZE.0 as usize, SIZE.1 as usize).unwrap();
+    assert_eq!(std::fs::read(dir.0.join("cpu.png")).unwrap(), cpu);
+}
+
+/// `hardware` (and `software`) never fall to the CPU rasterizer: without such an adapter the
+/// snapshot fails, naming the policy, and writes nothing; with one it says it was drawn on the GPU.
+/// `auto` lands where `solidcraft-cli gpu` says it does.
+#[test]
+fn a_strict_policy_never_falls_to_the_cpu() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let survey = |policy: &str| {
+        let o = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["gpu", "--policy", policy]).output().unwrap();
+        (o.status.success(), serde_json::from_slice::<Value>(&o.stdout).unwrap_or(Value::Null))
+    };
+    for policy in ["hardware", "software"] {
+        let (found, report) = survey(policy);
+        let output = snapshot_under(&dir, &script, &format!("{policy}.png"), policy);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        if found {
+            assert!(output.status.success(), "{policy}: {stderr}");
+            let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
+            assert_eq!(reply["renderer"], report["renderer"], "{policy}: {reply}");
+            assert_ne!(reply["renderer"], "cpu");
+        } else {
+            assert_eq!(report["lands_on"], Value::Null, "{policy}: {report}");
+            assert_eq!(output.status.code(), Some(1), "{policy}: {stderr}");
+            assert!(stderr.contains(&format!("`{policy}` policy")) && stderr.contains("solidcraft-cli gpu"), "{policy}: {stderr}");
+            assert!(!dir.0.join(format!("{policy}.png")).exists());
+        }
+    }
+    let (found, report) = survey("auto");
+    assert!(found, "auto always lands somewhere: {report}");
+    let output = snapshot_under(&dir, &script, "auto.png", "auto");
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    let reply: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(reply["renderer"], report["renderer"], "{reply} vs {report}");
+    let (_, cpu) = survey("cpu");
+    assert_eq!((cpu["lands_on"].clone(), cpu["renderer"].clone()), (json!("cpu"), json!("cpu")), "{cpu}");
+}
+
+#[test]
+fn a_view_or_a_camera_that_cannot_be_used_is_an_error_and_writes_nothing() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let cases: [(&[&str], &str); 7] = [
+        (&["--view", "Nowhere"], "Nowhere"),
+        (&["--view", "iso", "--camera", "{}"], "not both"),
+        (&["--camera", "not json"], "--camera"),
+        (&["--camera", "{\"target\": [0, 0, 0]}"], "yaw"),
+        (&["--camera", "{\"target\": [0, 0, 0], \"yaw\": 0, \"pitch\": 0, \"distance\": 0}"], "distance"),
+        (&["--camera", "{\"target\": [0, 0, 0], \"yaw\": 0, \"pitch\": 0, \"distance\": 50, \"fov\": -1}"], "camera"),
+        (&["--camera", "[1, 2, 3]"], "camera"),
+    ];
+    for (extra, expect) in cases {
+        let output = dir.run(&script, "never.png", extra);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
+        assert!(stderr.contains(expect), "{extra:?}: {stderr}");
+        assert!(output.stdout.is_empty() && !dir.0.join("never.png").exists(), "{extra:?}");
+    }
+}
+
+/// The usage text says what the new options do.
+#[test]
+fn the_usage_names_the_camera_and_the_guides() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("snapshot").output().unwrap();
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    for word in ["--camera", "--view", "view.save", "--no-grid", "--no-axes"] {
+        assert!(stderr.contains(word), "usage lacks {word}: {stderr}");
+    }
+}
@@ -0,0 +1,88 @@
+//! Straight edges stay one edge after many cuts (#1049). The owner's design
+//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
+//! joins and cuts, over four sketches, three of them on faces of the body with the faces'
+//! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
+//! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
+//! as many pieces, and a sketch on such a face projected every piece.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use serde_json::json;
+use solidcraft_engine::Session;
+use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
+use solidcraft_engine::geom::Vec3;
+
+fn design() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
+}
+
+fn open(path: &Path) -> Session {
+    let mut s = Session::default();
+    s.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+    s
+}
+
+/// The design built from scratch: saved without cached geometry and opened again.
+fn rebuilt() -> Session {
+    let s = open(&design());
+    let dir = std::env::temp_dir().join(format!("solidcraft-straight-edges-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("crazy-geom-cuts.json");
+    let mut t = s.scratch();
+    t.execute("file.save", &json!({"path": path.to_string_lossy(), "format": "json"})).unwrap();
+    let out = open(&path);
+    let _ = std::fs::remove_dir_all(&dir);
+    out
+}
+
+fn errors(s: &Session) -> Vec<(u64, String)> {
+    s.model.results.iter().filter_map(|r| r.error.clone().map(|e| (r.id, e))).collect()
+}
+
+fn key(v: Vec3) -> [i64; 3] {
+    [v.x, v.y, v.z].map(|c| (c * 1e5).round() as i64)
+}
+
+#[test]
+fn straight_edges_are_one_edge_after_many_cuts() {
+    for (what, s) in [("as saved", open(&design())), ("built from scratch", rebuilt())] {
+        assert_eq!(errors(&s), vec![], "{what}: every feature evaluates");
+        let st = s.world_state();
+        let bodies: Vec<_> = st.bodies.iter().filter(|b| !b.body.is_mesh()).collect();
+        assert_eq!(bodies.len(), 1, "{what}: one body");
+        let body = &bodies[0].body;
+        let mesh = body.tessellate(0.01).unwrap();
+        // Every edge is drawn as one polyline; a straight one as one segment.
+        let mut at: HashMap<[i64; 3], Vec<usize>> = HashMap::new();
+        for (i, e) in mesh.edges.iter().enumerate() {
+            let (Some(a), Some(z)) = (e.first(), e.last()) else { panic!("{what}: edge {i} is empty") };
+            at.entry(key(*a)).or_default().push(i);
+            at.entry(key(*z)).or_default().push(i);
+        }
+        let straight = |i: usize| mesh.edges.get(i).filter(|e| e.len() == 2).and_then(|e| (e[1] - e[0]).normalized());
+        let split: Vec<_> = at
+            .iter()
+            .filter(|(_, es)| match es.as_slice() {
+                [a, b] => straight(*a).zip(straight(*b)).is_some_and(|(u, w)| u.dot(w).abs() > 1. - 1e-9),
+                _ => false,
+            })
+            .map(|(k, _)| k.map(|c| c as f64 / 1e5))
+            .collect();
+        assert_eq!(split, Vec::<[f64; 3]>::new(), "{what}: straight edges split where nothing else meets them");
+        // No two faces side by side in one plane.
+        let plane = |f: usize| match face_surface(body, f) {
+            Some(FaceSurface::Plane { normal, point }) => Some((normal, normal.dot(point))),
+            _ => None,
+        };
+        for (i, faces) in mesh.edge_faces.iter().enumerate() {
+            if let [a, b] = faces.as_slice()
+                && a != b
+                && let (Some((na, da)), Some((nb, db))) = (plane(*a as usize), plane(*b as usize))
+            {
+                assert!(na.dot(nb) < 1. - 1e-9 || (da - db).abs() > 1e-6, "{what}: faces {a} and {b} meet at edge {i} in one plane");
+            }
+        }
+        assert_eq!((body.face_count(), body.edge_count(), body.vertex_count()), (35, 107, 71), "{what}: faces, edges and vertices");
+    }
+}
@@ -29,5 +29,5 @@ web-sys = { version = "0.3", features = [
    "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
-    "BeforeUnloadEvent", "Event", "EventTarget", "Response",
+    "BeforeUnloadEvent", "Event", "EventTarget", "Response", "MediaQueryList", "Gamepad",
 ] }
@@ -23,6 +23,15 @@
  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf" data-target-path="fonts" />
  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/OFL.txt" data-target-path="fonts" />
  <link data-trunk rel="css" href="../../assets/styles/web/loading.css" />
+  <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
+  <meta name="theme-color" content="#343840">
+  <link rel="manifest" href="manifest.webmanifest">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
+  <link data-trunk rel="copy-file" href="manifest.webmanifest" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
  <canvas id="solidcraft_canvas"></canvas>
@@ -32,6 +41,10 @@
    if ("serviceWorker" in navigator) {
      addEventListener("load", () => navigator.serviceWorker.register("sw.js").catch(() => {}));
    }
+    // Install as an app: the browser's offer can come before the app runs, so it is kept here for
+    // the app's File ▸ Install app… item (src/install.rs). Installed, the browser makes no more offers.
+    addEventListener("beforeinstallprompt", (e) => { e.preventDefault(); window.solidcraftInstall = e; });
+    addEventListener("appinstalled", () => { window.solidcraftInstall = null; });
  </script>
 </body>
 </html>
@@ -0,0 +1,16 @@
+{
+  "name": "SolidCraft",
+  "short_name": "SolidCraft",
+  "description": "Open-source parametric CAD built in Rust.",
+  "start_url": "./",
+  "scope": "./",
+  "display": "standalone",
+  "background_color": "#e8ebf0",
+  "theme_color": "#343840",
+  "categories": ["productivity", "utilities"],
+  "icons": [
+    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+  ]
+}
@@ -458,7 +458,7 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
    let Some(doc) = web_sys::window().and_then(|w| w.document()) else { return };
    let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
    input.set_type("file");
-    input.set_accept(".solidcraft,.solvecraft,.json,.step,.stp,.3mf,.stl");
+    input.set_accept(".solidcraft,.solvecraft,.json,.step,.stp,.3mf,.stl,.obj,.glb,.gltf");
    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
    let _ = input.set_attribute("style", "display:none");
    if let Some(body) = doc.body() {
@@ -0,0 +1,67 @@
+//! Install as an app (`solidcraft_ui_egui::install`). The browser offers it with a
+//! `beforeinstallprompt` event, which can come before this code runs: index.html keeps the event
+//! as `window.solidcraftInstall` (and drops it once the app is installed). The offer is good for
+//! one prompt; a browser that is still willing makes a new one later. Safari makes no offer: it
+//! gets its steps, unless the app is already running installed.
+
+use solidcraft_ui_egui::install::{InstallApp, Offer, safari_steps};
+use wasm_bindgen::{JsCast as _, JsValue};
+
+/// Where index.html keeps the browser's offer.
+const OFFER: &str = "solidcraftInstall";
+
+/// The browser's offer, kept by index.html (None: none, or it was used).
+fn offer() -> Option<js_sys::Object> {
+    let window = web_sys::window()?;
+    js_sys::Reflect::get(&window, &OFFER.into()).ok()?.dyn_into().ok()
+}
+
+/// Show the browser's install prompt (from the File menu click, so the page may).
+fn prompt() {
+    let Some(offer) = offer() else { return };
+    if let Some(window) = web_sys::window() {
+        let _ = js_sys::Reflect::set(&window, &OFFER.into(), &JsValue::NULL);
+    }
+    let shown = js_sys::Reflect::get(&offer, &"prompt".into())
+        .and_then(|f| f.dyn_into::<js_sys::Function>().map_err(JsValue::from))
+        .and_then(|f| f.call0(&offer))
+        .and_then(|p| p.dyn_into::<js_sys::Promise>().map_err(JsValue::from));
+    match shown {
+        // Accepted or dismissed, the browser handles it; a refusal is only logged.
+        Ok(p) => wasm_bindgen_futures::spawn_local(async move {
+            if let Err(e) = wasm_bindgen_futures::JsFuture::from(p).await {
+                log::warn!("install prompt: {e:?}");
+            }
+        }),
+        Err(e) => log::warn!("install prompt: {e:?}"),
+    }
+}
+
+/// The page runs as the installed app (its own window, or from the Home Screen on iOS).
+fn running_installed(window: &web_sys::Window) -> bool {
+    let standalone = window.match_media("(display-mode: standalone)").ok().flatten().is_some_and(|m| m.matches());
+    let home_screen = js_sys::Reflect::get(&window.navigator(), &"standalone".into()).ok().and_then(|v| v.as_bool()).unwrap_or(false);
+    standalone || home_screen
+}
+
+/// The host service for File ▸ Install app…; the UI is drawn again whenever the browser
+/// makes or withdraws its offer (even with nothing else happening).
+pub fn service(ctx: &egui::Context) -> InstallApp {
+    // Safari's steps, decided once: the browser and the way the page runs don't change.
+    let steps = web_sys::window().filter(|w| !running_installed(w)).and_then(|w| {
+        let nav = w.navigator();
+        let vendor = js_sys::Reflect::get(&nav, &"vendor".into()).ok().and_then(|v| v.as_string()).unwrap_or_default();
+        safari_steps(&nav.user_agent().unwrap_or_default(), &vendor, nav.max_touch_points())
+    });
+    if let Some(window) = web_sys::window() {
+        for event in ["beforeinstallprompt", "appinstalled"] {
+            let ctx = ctx.clone();
+            let redraw = wasm_bindgen::closure::Closure::<dyn FnMut()>::new(move || ctx.request_repaint());
+            let _ = window.add_event_listener_with_callback(event, redraw.as_ref().unchecked_ref());
+            // The listener lives as long as the page.
+            redraw.forget();
+        }
+    }
+    let offered = move || if offer().is_some() { Some(Offer::Prompt) } else { steps.map(Offer::Steps) };
+    InstallApp { offer: Box::new(offered), prompt: Box::new(prompt) }
+}
@@ -2,12 +2,16 @@
 //!
 //! Runs the same [`solidcraft_ui_egui::SolveApp`] as the desktop app through eframe's web runner
 //! (wgpu: WebGPU where available, WebGL2 otherwise). Build with `trunk build --release` from this
-//! directory (output in `dist/web`). URL flags: `?webgl` forces WebGL2, `?sample` opens the
-//! sample part.
+//! directory (output in `dist/web`). URL flags: `?webgl` forces WebGL2 (remembered until
+//! `?webgpu`), `?sample` opens the sample part.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 #[cfg(target_arch = "wasm32")]
 mod files;
+#[cfg(target_arch = "wasm32")]
+mod install;
+#[cfg(any(target_arch = "wasm32", test))]
+mod space_mouse;

 #[cfg(target_arch = "wasm32")]
 mod web {
@@ -19,6 +23,7 @@ mod web {
    use wasm_bindgen::JsCast as _;

    use crate::files::{self, Files, Intent};
+    use crate::space_mouse::SpaceMouse;

    const CANVAS_ID: &str = "solidcraft_canvas";
    const LOADING_ID: &str = "solidcraft_loading";
@@ -65,6 +70,7 @@ mod web {
        /// On-demand CJK font: fetched only when a CJK language is selected.
        font: solidcraft_ui_egui::fonts::CjkFontLoader,
        font_result: FontLoadResult,
+        space_mouse: SpaceMouse,
    }

    impl Shell {
@@ -73,11 +79,26 @@ mod web {
            if self.files.ctx.borrow().is_none() {
                *self.files.ctx.borrow_mut() = Some(ctx.clone());
            }
+            // A ready picker answer is consumed in app.logic later in this frame. Keep
+            // incoming files queued until then so they cannot replace its target design.
+            if self.app.file_picker_busy() {
+                ctx.request_repaint();
+                return;
+            }
            files::flush(&self.files);
            for (text, error) in self.files.messages.borrow_mut().drain(..) {
                self.app.set_status(text, error);
            }
-            let incoming: Vec<_> = self.files.incoming.borrow_mut().drain(..).collect();
+            let mut incoming: Vec<_> = self.files.incoming.borrow_mut().drain(..).collect();
+            // A glTF file's buffers picked with it are kept next to it, not opened.
+            incoming.retain_mut(|(name, bytes, _)| {
+                let companion =
+                    std::path::Path::new(name.as_str()).extension().and_then(|e| e.to_str()).is_some_and(|e| e.eq_ignore_ascii_case("bin"));
+                if companion {
+                    vfs::insert(&format!("{}{name}", files::UPLOAD), std::mem::take(bytes));
+                }
+                !companion
+            });
            for (name, bytes, intent) in incoming {
                let design = solidcraft_engine::io::is_design_path(&name);
                let path = if design && intent == Intent::Open {
@@ -365,11 +386,14 @@ mod web {
        fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
            self.tick_font(ctx);
            self.app.logic(ctx);
+            self.space_mouse.logic(&mut self.app, ctx);
            self.files_tick(ctx);
            UNSAVED.with(|u| u.set(solidcraft_ui_egui::documents::any_dirty(&self.app)));
        }
-        fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
            files::take_drops(&self.files, raw);
+            // Before the app's own hook, which adds the control channel's events.
+            self.space_mouse.raw_input_hook(ctx, self.app.preferences.space_mouse_enabled, raw);
            self.app.raw_input_hook(raw);
        }
        fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -392,6 +416,29 @@ mod web {
        web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
    }

+    /// Where `?webgl` is remembered. The installed app starts from its manifest's start URL, which
+    /// has no query, so the choice has to outlive the page it was made on.
+    const WEBGL_KEY: &str = "solidcraft.webgl";
+
+    /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
+    fn webgl() -> bool {
+        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let q = query();
+        if q.contains("webgl") {
+            if let Some(s) = &storage {
+                let _ = s.set_item(WEBGL_KEY, "1");
+            }
+            return true;
+        }
+        if q.contains("webgpu") {
+            if let Some(s) = &storage {
+                let _ = s.remove_item(WEBGL_KEY);
+            }
+            return false;
+        }
+        storage.and_then(|s| s.get_item(WEBGL_KEY).ok().flatten()).is_some()
+    }
+
    /// Fetch font bytes asynchronously through the browser.
    async fn fetch_font_bytes(url: &str) -> Result<Vec<u8>, String> {
        let window = web_sys::window().ok_or("no window")?;
@@ -416,7 +463,7 @@ mod web {
                return;
            };
            let mut options = eframe::WebOptions { depth_buffer: DEPTH_BITS, ..Default::default() };
-            if query().contains("webgl")
+            if webgl()
                && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
            {
                create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
@@ -434,15 +481,18 @@ mod web {
                            // Open shows the browser's files (and the computer's, from there).
                            pick_open: Some(Box::new(move || {
                                panel.panel.set(true);
-                                None
+                                Box::pin(std::future::ready(None))
                            })),
                            // Designs are kept in the browser; everything else is downloaded.
                            pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
                                let design = exts.contains(&solidcraft_engine::io::DESIGN_EXT);
-                                Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))
+                                Box::pin(std::future::ready(Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))))
                            })),
+                            install_app: Some(crate::install::service(&cc.egui_ctx)),
                            ..Default::default()
                        };
+                        // Thumbnails of saves and start-page cards.
+                        solidcraft_ui_egui::gpu::install_cpu_picture_renderer();
                        let mut app = SolveApp::new(Session::default(), services);
                        if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
                            app.load_prefs(&p);
@@ -459,6 +509,9 @@ mod web {
                            app.session.mark_saved();
                        }
                        if !query().contains("sample") {
+                            // The empty design takes Units of new designs (#1205). The sample
+                            // part is built in millimetres and is left that way.
+                            solidcraft_ui_egui::prefs::apply_new_design(&mut app);
                            let rev = app.session.revision;
                            app.home.show(rev);
                        }
@@ -472,6 +525,7 @@ mod web {
                            recents_synced: false,
                            font: Default::default(),
                            font_result: Rc::new(std::cell::RefCell::new(None)),
+                            space_mouse: SpaceMouse::default(),
                        }))
                    }),
                )
@@ -0,0 +1,285 @@
+//! The 3D mouse in the browser (#1336), through the Gamepad API.
+//!
+//! Chromium browsers list a 3Dconnexion device itself, with its six axes scaled to -1..1 from the
+//! device's ±350. Firefox lists only joysticks and gamepads (a 3D mouse is a HID multi-axis
+//! controller), but 3DxWare's virtual joystick carries the same six axes once 3DxWare's profile
+//! for Firefox sends them there. Both come in the device's own order and signs, so the shared
+//! navigation takes them with 3DxWare's object-mode mapping, as the Linux app does without a
+//! profile.
+
+use solidcraft_ui_egui::space_mouse::{Axes, FULL_SCALE};
+
+/// Logitech's vendor id, which older 3Dconnexion devices carry, and those devices' product ids
+/// (usb.ids). Logitech's own gamepads and wheels carry the same vendor id.
+const LOGITECH: u16 = 0x046d;
+const LOGITECH_3D_MICE: [u16; 11] = [0xc603, 0xc605, 0xc606, 0xc621, 0xc623, 0xc625, 0xc626, 0xc627, 0xc628, 0xc629, 0xc62b];
+/// 3Dconnexion's own vendor id. The browser lists only its 3D mice as gamepads: its mice, and the
+/// mouse side of its receivers, are not gamepads.
+const THREEDCONNEXION: u16 = 0x256f;
+/// 3DxWare's virtual joystick.
+const VIRTUAL_JOYSTICK: (u16, u16) = (0xbeef, 0x046d);
+
+/// What a gamepad the browser lists is, when it is a 3D mouse. A device is read before the
+/// joystick: in a Chromium browser both are listed, and the joystick stays at rest.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Source {
+    Device,
+    VirtualJoystick,
+}
+
+/// The vendor and product ids in a gamepad's id: `Name (Vendor: 046d Product: c62b)` in Chromium
+/// browsers, `046d-c62b-Name` in Firefox.
+fn vendor_product(id: &str) -> Option<(u16, u16)> {
+    fn hex(digits: &str) -> Option<u16> {
+        if (1..=4).contains(&digits.len()) && digits.bytes().all(|b| b.is_ascii_hexdigit()) { u16::from_str_radix(digits, 16).ok() } else { None }
+    }
+    if let Some((_, ids)) = id.rsplit_once("Vendor: ") {
+        let (vendor, rest) = ids.split_once(" Product: ")?;
+        let product = rest.split(|c: char| !c.is_ascii_hexdigit()).next()?;
+        return Some((hex(vendor)?, hex(product)?));
+    }
+    let mut parts = id.splitn(3, '-');
+    let (vendor, product, _name) = (parts.next()?, parts.next()?, parts.next()?);
+    Some((hex(vendor)?, hex(product)?))
+}
+
+/// Whether a gamepad is a 3D mouse, from the id the browser gives it.
+pub fn source(id: &str) -> Option<Source> {
+    match vendor_product(id)? {
+        VIRTUAL_JOYSTICK => Some(Source::VirtualJoystick),
+        (THREEDCONNEXION, _) => Some(Source::Device),
+        (LOGITECH, product) if LOGITECH_3D_MICE.contains(&product) => Some(Source::Device),
+        _ => None,
+    }
+}
+
+/// The six axes in the device's raw units, from a gamepad's axes (-1..1). Fewer than six: not a
+/// 3D mouse. A value that isn't a number reads as rest.
+pub fn axes(values: &[f64]) -> Option<Axes> {
+    let raw = |i: usize| values.get(i).map(|&v| if v.is_finite() { (v.clamp(-1.0, 1.0) * f64::from(FULL_SCALE)).round() as i16 } else { 0 });
+    Some(Axes { translation: [raw(0)?, raw(1)?, raw(2)?], rotation: [raw(3)?, raw(4)?, raw(5)?] })
+}
+
+/// The 3D mouse to read among the ones listed: the first device, else the first joystick.
+pub fn choose(found: impl IntoIterator<Item = (Source, Axes)>) -> Option<Axes> {
+    found.into_iter().min_by_key(|(source, _)| *source).map(|(_, axes)| axes)
+}
+
+#[cfg(target_arch = "wasm32")]
+pub use browser::SpaceMouse;
+
+#[cfg(target_arch = "wasm32")]
+mod browser {
+    use std::cell::Cell;
+    use std::rc::Rc;
+
+    use solidcraft_ui_egui::SolveApp;
+    use solidcraft_ui_egui::space_mouse::{Axes, DriverMapping, navigate_frame};
+    use wasm_bindgen::JsCast as _;
+    use wasm_bindgen::closure::Closure;
+
+    use solidcraft_ui_egui::space_mouse::WheelGuard;
+
+    use super::{axes, choose, source};
+
+    /// How often the page looks for the cap starting to move while nothing else redraws.
+    const WAKE_MS: i32 = 50;
+
+    /// The 3D mouse the browser lists, if any.
+    fn read() -> Option<Axes> {
+        let pads = web_sys::window()?.navigator().get_gamepads().ok()?;
+        choose(pads.iter().filter_map(|pad| {
+            let pad = pad.dyn_into::<web_sys::Gamepad>().ok().filter(web_sys::Gamepad::connected)?;
+            let source = source(&pad.id())?;
+            let values: Vec<f64> = pad.axes().iter().map(|v| v.as_f64().unwrap_or(f64::NAN)).collect();
+            Some((source, axes(&values)?))
+        }))
+    }
+
+    /// Reads the 3D mouse once per frame and moves the view with it.
+    #[derive(Default)]
+    pub struct SpaceMouse {
+        axes: Axes,
+        /// The previous frame's time and the step since it (seconds).
+        last: Option<f64>,
+        seconds: f64,
+        wheel: WheelGuard,
+        /// Listening for gamepads (from the first frame with navigation on).
+        listening: bool,
+        /// The timer that wakes the app when the cap starts moving runs (from when a 3D mouse
+        /// is first listed).
+        waking: bool,
+        /// Navigation is on (the waker reads it).
+        enabled: Rc<Cell<bool>>,
+    }
+
+    impl SpaceMouse {
+        /// At the start of a frame: reads the cap and drops 3DxWare's emulated wheel from the
+        /// frame's input, before the app sees it.
+        pub fn raw_input_hook(&mut self, ctx: &egui::Context, enabled: bool, raw: &mut egui::RawInput) {
+            let now = raw.time.unwrap_or_else(|| js_sys::Date::now() / 1000.0);
+            self.seconds = self.last.map_or(0.0, |last| now - last);
+            self.last = Some(now);
+            self.enabled.set(enabled);
+            self.axes = Axes::default();
+            if !enabled {
+                return;
+            }
+            if !self.listening {
+                self.listening = true;
+                listen(ctx);
+            }
+            let reading = read();
+            if reading.is_some() && !self.waking {
+                self.waking = wake(ctx, &self.enabled);
+            }
+            // Inside the dead zone is rest: a cap resting just off zero doesn't keep redrawing.
+            self.axes = reading.filter(|axes| axes.moving()).unwrap_or_default();
+            self.wheel.filter(self.axes.moving(), now, &mut raw.events);
+        }
+
+        pub fn logic(&self, app: &mut SolveApp, ctx: &egui::Context) {
+            navigate_frame(app, ctx, DriverMapping::object_mode(), self.axes, self.seconds);
+        }
+    }
+
+    /// A 3D mouse is listed only once it has been moved on the page: redraw then, so the frame
+    /// finds it without waiting for the pointer.
+    fn listen(ctx: &egui::Context) {
+        let Some(window) = web_sys::window() else { return };
+        let ctx = ctx.clone();
+        let on_connect = Closure::<dyn FnMut()>::new(move || ctx.request_repaint());
+        let _ = window.add_event_listener_with_callback("gamepadconnected", on_connect.as_ref().unchecked_ref());
+        // The listener lives as long as the page.
+        on_connect.forget();
+    }
+
+    /// The browser sends no event when a gamepad moves, so a timer looks while the app is idle and
+    /// redraws when the cap starts moving; the frames that follow keep going on their own.
+    fn wake(ctx: &egui::Context, enabled: &Rc<Cell<bool>>) -> bool {
+        let Some(window) = web_sys::window() else { return false };
+        let (ctx, enabled) = (ctx.clone(), Rc::clone(enabled));
+        let tick = Closure::<dyn FnMut()>::new(move || {
+            if enabled.get() && read().is_some_and(Axes::moving) {
+                ctx.request_repaint();
+            }
+        });
+        let started = window.set_interval_with_callback_and_timeout_and_arguments_0(tick.as_ref().unchecked_ref(), WAKE_MS).is_ok();
+        // The timer lives as long as the page.
+        tick.forget();
+        started
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recognises_3d_mice_in_each_browsers_ids() {
+        // As Edge and Firefox list them (Windows 11, SpaceMouse Pro, 3DxWare 10).
+        assert_eq!(source("SpaceMouse Pro (Vendor: 046d Product: c62b)"), Some(Source::Device));
+        assert_eq!(source("Unknown Gamepad (Vendor: beef Product: 046d)"), Some(Source::VirtualJoystick));
+        assert_eq!(source("beef-046d-Unknown Gamepad"), Some(Source::VirtualJoystick));
+        // 3Dconnexion's own vendor id, any product; the older devices under Logitech's.
+        assert_eq!(source("SpaceMouse Compact (Vendor: 256f Product: c635)"), Some(Source::Device));
+        assert_eq!(source("256f-c652-3Dconnexion Universal Receiver"), Some(Source::Device));
+        assert_eq!(source("46d-c626-SpaceNavigator"), Some(Source::Device));
+        assert_eq!(source("SpaceNavigator (STANDARD GAMEPAD Vendor: 046d Product: c626)"), Some(Source::Device));
+        for product in LOGITECH_3D_MICE {
+            assert_eq!(source(&format!("x (Vendor: 046d Product: {product:04x})")), Some(Source::Device));
+            assert_eq!(source(&format!("046d-{product:04X}-x")), Some(Source::Device));
+        }
+    }
+
+    #[test]
+    fn gamepads_and_other_logitech_devices_are_not_3d_mice() {
+        for id in [
+            "Logitech Dual Action (STANDARD GAMEPAD Vendor: 046d Product: c216)",
+            "046d-c21d-Logitech Gamepad F310",
+            "G29 Driving Force Racing Wheel (Vendor: 046d Product: c24f)",
+            "046d-c215-Logitech Extreme 3D",
+            "NuLOOQ navigator (Vendor: 046d Product: c640)",
+            "Xbox 360 Controller (XInput STANDARD GAMEPAD)",
+            "45e-28e-Xbox 360 Wired Controller",
+            "beef-046e-Unknown Gamepad",
+            "beee-046d-Unknown Gamepad",
+            "",
+            "-",
+            "--",
+            "256f-",
+            "256f-c635",
+            "Vendor: 256f",
+            "Vendor: 256f Product: ",
+            "x (Vendor: 256fff Product: c635)",
+            "x (Vendor: zz6f Product: c635)",
+            "12345-c635-x",
+            "256f--x",
+            "SpaceMouse Pro",
+        ] {
+            assert_eq!(source(id), None, "{id:?}");
+        }
+    }
+
+    #[test]
+    fn ids_never_panic() {
+        // Hostile and odd ids: multi-byte text around the markers, markers repeated or cut short.
+        for id in [
+            "Vendor: é Product: ü",
+            "Vendor: Vendor: 256f Product: c635)",
+            "é-ü-ö",
+            "Ⅰ (Vendor: 256f Product: c6Ⅰ)",
+            "\u{0}-\u{0}-\u{0}",
+            "Vendor: 256f Product: c635 Vendor: ",
+        ] {
+            let _ = source(id);
+        }
+        let mut seed = 0x2545_f491_4f6c_dd1d_u64;
+        let alphabet: Vec<char> = "0123456789abcdefABCDEF- ():VendorProductéⅠ\u{0}".chars().collect();
+        for _ in 0..20_000 {
+            let len = (seed % 40) as usize;
+            let id: String = (0..len)
+                .map(|_| {
+                    seed ^= seed << 13;
+                    seed ^= seed >> 7;
+                    seed ^= seed << 17;
+                    alphabet[(seed % alphabet.len() as u64) as usize]
+                })
+                .collect();
+            if let Some(Source::Device) = source(&id) {
+                let (vendor, product) = vendor_product(&id).expect("recognised ids have both");
+                assert!(vendor == THREEDCONNEXION || (vendor == LOGITECH && LOGITECH_3D_MICE.contains(&product)), "{id:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn gamepad_axes_are_the_devices_raw_units() {
+        // Full deflection is the desktop's 350, and the browser's scale keeps the device's steps.
+        let axes = axes(&[1.0, -1.0, 0.5, -0.5, 2.0 / 700.0, 0.0]).expect("six axes");
+        assert_eq!(axes, Axes { translation: [350, -350, 175], rotation: [-175, 1, 0] });
+        for raw in -350_i16..=350 {
+            let value = f64::from(raw) / 350.0;
+            assert_eq!(super::axes(&[value; 6]).map(|a| a.translation[0]), Some(raw));
+        }
+        // Past full deflection is full deflection; anything that isn't a number is rest.
+        let hostile = super::axes(&[f64::NAN, f64::INFINITY, f64::NEG_INFINITY, 1e300, -1e300, f64::MIN_POSITIVE]).expect("six axes");
+        assert_eq!(hostile, Axes { translation: [0, 0, 0], rotation: [350, -350, 0] });
+        // A gamepad with fewer than six axes is not a 3D mouse; extra axes are ignored.
+        assert_eq!(super::axes(&[1.0; 5]), None);
+        assert_eq!(super::axes(&[]), None);
+        assert_eq!(super::axes(&[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 1.0]), Some(Axes::default()));
+    }
+
+    #[test]
+    fn a_device_is_read_before_the_virtual_joystick() {
+        let moving = Axes { translation: [100, 0, 0], rotation: [0; 3] };
+        let other = Axes { translation: [0, 200, 0], rotation: [0; 3] };
+        assert_eq!(choose([(Source::VirtualJoystick, other), (Source::Device, moving)]), Some(moving));
+        assert_eq!(choose([(Source::Device, moving), (Source::VirtualJoystick, other)]), Some(moving));
+        assert_eq!(choose([(Source::VirtualJoystick, other)]), Some(other));
+        // Two devices: the first listed.
+        assert_eq!(choose([(Source::Device, moving), (Source::Device, other)]), Some(moving));
+        assert_eq!(choose([]), None);
+    }
+}
@@ -7,8 +7,18 @@ license.workspace = true
 publish = false
 default-run = "solidcraft"

-[lints]
-workspace = true
+# The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
+# (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
+# (Windows resize border) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+dbg_macro = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+type_complexity = "allow"
+neg_cmp_op_on_partial_ord = "allow"

 [dependencies]
 solidcraft-engine = { workspace = true }
@@ -18,13 +28,47 @@ egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
+# Checks eframe's settings file (app.ron) before eframe reads it (src/startup.rs).
+ron = "0.12"
+# Waits for wgpu's adapter list when choosing the graphics backend before the window opens.
+pollster = { workspace = true }
 getrandom = "0.3"
+# The update check (docs/updates.md): HTTPS with rustls, certificates from the operating system.
+ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "platform-verifier"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
+# API keys of the agent chat's API agents (docs/agent-chat.md) live in the system keychain:
+# Keychain on macOS, Credential Manager on Windows, the Secret Service (pure-Rust D-Bus) elsewhere.
+keyring = { version = "3.6", default-features = false, features = ["apple-native", "windows-native", "async-secret-service", "async-io", "crypto-rust"] }

 [target.'cfg(any(target_os = "windows", target_os = "linux"))'.dependencies]
 quick-xml = { workspace = true }

 [target.'cfg(target_os = "windows")'.dependencies]
 hidapi = { version = "2.6.7", default-features = false, features = ["windows-native"] }
+# The main window's handle for src/native_frame.rs (already in the tree through eframe and winit).
+raw-window-handle = "0.6"
+# Native crash capture (src/native_crash.rs): the exception filter, the faulting module, a minidump.
+# The window's resize border and DPI size (src/native_frame.rs): the window procedure, hit test, DPI.
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_Security",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Diagnostics_Debug",
+    "Win32_System_IO",
+    "Win32_System_Kernel",
+    "Win32_System_LibraryLoader",
+    "Win32_System_Memory",
+    "Win32_System_Threading",
+    "Win32_UI_HiDpi",
+    "Win32_UI_WindowsAndMessaging",
+] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+# Files opened from Finder and the Dock (src/open_documents.rs); all already come with eframe and rfd.
+objc2 = "0.6"
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+block2 = "0.6"

 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }
@@ -4,7 +4,7 @@
 use std::io::{BufRead, BufReader, Write};
 use std::net::{TcpListener, TcpStream};
 use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::mpsc::{Receiver, Sender, channel};
+use std::sync::mpsc::{Receiver, Sender, TryRecvError, channel};
 use std::time::Duration;

 use serde_json::{Value, json};
@@ -18,8 +18,9 @@ const MAX_CONNECTIONS: usize = 16;
 const MAX_BAD_LINES: usize = 8;

 static OPEN: AtomicUsize = AtomicUsize::new(0);
-/// The token file this launch wrote, removed when the app ends.
-static TOKEN_FILE: std::sync::OnceLock<std::path::PathBuf> = std::sync::OnceLock::new();
+/// The token files this launch wrote (its `--control` port, the agent chat's endpoint), removed
+/// when the app ends.
+static TOKEN_FILES: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());

 /// A new random token: 32 bytes from the operating system, as hex.
 fn new_token() -> Option<String> {
@@ -30,30 +31,55 @@ fn new_token() -> Option<String> {

 /// Remove this launch's token file (at exit).
 pub fn remove_token_file() {
-    if let Some(p) = TOKEN_FILE.get() {
-        let _ = std::fs::remove_file(p);
+    if let Ok(files) = TOKEN_FILES.lock() {
+        for p in files.iter() {
+            let _ = std::fs::remove_file(p);
+        }
    }
 }

 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
    let (tx, rx) = channel::<ControlRequest>();
    // Every connection must show the token before anything runs (docs/control-protocol.md).
-    let Some(token) = control_auth::env_token().or_else(new_token) else {
-        eprintln!("solidcraft: control server not started: no random token available");
-        return rx;
+    match control_auth::env_token().or_else(new_token) {
+        Some(token) => {
+            listen(port, token, tx, ctx, false);
+        }
+        None => eprintln!("solidcraft: control server not started: no random token available"),
+    }
+    rx
+}
+
+/// The agent chat's own endpoint for its agent's MCP server (docs/agent-chat.md): a free loopback
+/// port with a fresh token of its own (never `SOLIDCRAFT_CONTROL_TOKEN`), written to the usual
+/// token file, where the MCP server finds it, so the token never passes through the agent. Its
+/// requests go to `tx`, where the chat's gate reads them; one may wait long for the user's Allow.
+pub fn listen_agent(tx: Sender<ControlRequest>, ctx: egui::Context) -> Option<u16> {
+    let Some(token) = new_token() else {
+        eprintln!("solidcraft: agent chat endpoint not started: no random token available");
+        return None;
    };
+    listen(0, token, tx, ctx, true)
+}
+
+/// Listen on `port` (0: a free port the system picks) with `token`; the port it listens on.
+/// `patient`: every request may wait as long as a batch (a person decides on it).
+fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
    let listener = match TcpListener::bind(("127.0.0.1", port)) {
        Ok(l) => l,
        Err(e) => {
            eprintln!("solidcraft: control server failed to bind 127.0.0.1:{port}: {e}");
-            return rx;
+            return None;
        }
    };
+    let port = listener.local_addr().map(|a| a.port()).unwrap_or(port);
    match control_auth::token_path(port) {
        Some(path) => match control_auth::write_token_file(&path, &token) {
            Ok(()) => {
                eprintln!("solidcraft: control server listening on 127.0.0.1:{port} (token in {})", path.display());
-                let _ = TOKEN_FILE.set(path);
+                if let Ok(mut files) = TOKEN_FILES.lock() {
+                    files.push(path);
+                }
            }
            Err(e) => eprintln!(
                "solidcraft: control server listening on 127.0.0.1:{port}, but its token file {} could not be written ({e}); \
@@ -78,12 +104,12 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
            let ctx = ctx.clone();
            let token = token.clone();
            std::thread::spawn(move || {
-                serve(stream, &token, tx, ctx);
+                serve(stream, &token, tx, ctx, patient);
                OPEN.fetch_sub(1, Ordering::Relaxed);
            });
        }
    });
-    rx
+    Some(port)
 }

 /// One line without its newline, or `None` at the end of the stream. A client that sends
@@ -134,12 +160,35 @@ fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
    let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
 }

-fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context) {
+/// How long a request waits for the app's reply: most requests, and a batch (or every request,
+/// on a patient connection).
+#[derive(Clone, Copy)]
+struct Waits {
+    short: Duration,
+    long: Duration,
+}
+
+const WAITS: Waits = Waits { short: Duration::from_secs(60), long: Duration::from_secs(3600) };
+
+/// A request that timed out but is still running in the app (#1618): its id and method, and where
+/// its reply will land.
+struct Pending {
+    id: Value,
+    method: String,
+    reply: Receiver<Value>,
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
+    serve_with(stream, token, tx, ctx, patient, WAITS);
+}
+
+fn serve_with(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool, waits: Waits) {
    let Ok(read) = stream.try_clone() else { return };
    let mut out = stream;
    let mut reader = BufReader::new(read);
    let mut bad = 0usize;
    let mut authenticated = false;
+    let mut pending: Option<Pending> = None;
    loop {
        let line = match read_line(&mut reader, MAX_LINE) {
            Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
@@ -167,14 +216,46 @@ fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::
                let id = msg.get("id").cloned().unwrap_or(Value::Null);
                let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                let params = msg.get("params").cloned().unwrap_or(json!({}));
-                // A batch replaces many short requests: the whole of it may take long (#743).
-                let wait = Duration::from_secs(if method == "engine.batch" { 3600 } else { 60 });
-                let (req, rrx) = ControlRequest::new(method, params);
-                if tx.send(req).is_err() {
-                    break;
-                }
-                ctx.request_repaint();
-                let mut r = rrx.recv_timeout(wait).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"}));
+                // A request that timed out may have finished since (#1618).
+                let late = pending.as_ref().and_then(|p| match p.reply.try_recv() {
+                    Ok(reply) => Some(reply),
+                    Err(TryRecvError::Disconnected) => Some(json!({"ok": false, "error": "the app ended the request without a reply"})),
+                    Err(TryRecvError::Empty) => None,
+                });
+                let mut r = if method == "control.pending" {
+                    match (pending.take(), late) {
+                        (None, _) => json!({"ok": true, "result": {"pending": null}}),
+                        (Some(p), Some(reply)) => json!({"ok": true, "result": {"pending": p.id, "method": p.method, "done": true, "reply": reply}}),
+                        (Some(p), None) => {
+                            let r = json!({"ok": true, "result": {"pending": p.id, "method": p.method, "done": false}});
+                            pending = Some(p);
+                            r
+                        }
+                    }
+                } else if let Some(p) = pending.as_ref().filter(|_| late.is_none()) {
+                    // Nothing more is queued behind it, to run unseen when it ends.
+                    json!({"ok": false, "busy": true, "error": format!("busy: request {} (`{}`) is still running; ask `control.pending` for its result", p.id, p.method)})
+                } else {
+                    if late.is_some() {
+                        // Finished, and the client moved on without asking: it is dropped.
+                        pending = None;
+                    }
+                    // A batch replaces many short requests: the whole of it may take long (#743).
+                    let wait = if patient || method == "engine.batch" { waits.long } else { waits.short };
+                    let (req, rrx) = ControlRequest::new(method.clone(), params);
+                    if tx.send(req).is_err() {
+                        break;
+                    }
+                    ctx.request_repaint();
+                    match rrx.recv_timeout(wait) {
+                        Ok(r) => r,
+                        Err(_) => {
+                            let r = json!({"ok": false, "running": true, "error": format!("timeout: `{method}` is still running in the app and will still apply; ask `control.pending` for its result")});
+                            pending = Some(Pending { id: id.clone(), method, reply: rrx });
+                            r
+                        }
+                    }
+                };
                if let Some(o) = r.as_object_mut() {
                    o.insert("id".into(), id);
                }
@@ -202,6 +283,62 @@ fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::
 mod tests {
    use super::*;

+    /// #1618: a request that outlasts its wait says it is still running; the connection keeps its
+    /// reply for `control.pending`, and refuses other requests as `busy` until it lands, so none
+    /// is queued to run unseen behind it.
+    #[test]
+    fn a_timed_out_request_can_be_asked_for_later() {
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let ran = std::sync::Arc::new(std::sync::Mutex::new(Vec::<String>::new()));
+        let seen = ran.clone();
+        std::thread::spawn(move || {
+            for req in rx {
+                seen.lock().unwrap().push(req.method.clone());
+                if req.method == "slow" {
+                    std::thread::sleep(Duration::from_millis(400));
+                }
+                let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+            }
+        });
+        let waits = Waits { short: Duration::from_millis(100), long: Duration::from_millis(100) };
+        std::thread::spawn(move || {
+            if let Some(stream) = listener.incoming().flatten().next() {
+                serve_with(stream, token, tx, egui::Context::default(), false, waits);
+            }
+        });
+        let s = TcpStream::connect(addr).unwrap();
+        s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+        let mut out = s.try_clone().unwrap();
+        let mut lines = BufReader::new(s);
+        let mut ask = |v: Value| -> Value {
+            writeln!(out, "{v}").unwrap();
+            let mut l = String::new();
+            lines.read_line(&mut l).unwrap();
+            serde_json::from_str(&l).unwrap()
+        };
+        let r = ask(json!({"id": 1, "method": "slow", "token": token}));
+        assert!(r["ok"] == false && r["running"] == true && r["error"].as_str().is_some_and(|e| e.starts_with("timeout")), "{r}");
+        let r = ask(json!({"id": 2, "method": "ui.view"}));
+        assert!(r["busy"] == true && r["id"] == 2, "{r}");
+        let r = ask(json!({"id": 3, "method": "control.pending"}));
+        assert_eq!((&r["result"]["pending"], &r["result"]["done"]), (&json!(1), &json!(false)), "{r}");
+        std::thread::sleep(Duration::from_millis(600));
+        let r = ask(json!({"id": 4, "method": "control.pending"}));
+        assert_eq!(
+            (&r["result"]["pending"], &r["result"]["done"], &r["result"]["reply"]["result"]),
+            (&json!(1), &json!(true), &json!("slow")),
+            "{r}"
+        );
+        let r = ask(json!({"id": 5, "method": "control.pending"}));
+        assert_eq!(r["result"]["pending"], Value::Null, "{r}");
+        let r = ask(json!({"id": 6, "method": "ui.view"}));
+        assert_eq!((&r["ok"], &r["result"]), (&json!(true), &json!("ui.view")), "{r}");
+        assert_eq!(*ran.lock().unwrap(), ["slow", "ui.view"], "the busy request never reached the app");
+    }
+
    /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
    /// missing token, or garbage, is refused and the connection closed. Once shown, the token
    /// need not be repeated on that connection.
@@ -223,7 +360,7 @@ mod tests {
        std::thread::spawn(move || {
            for stream in listener.incoming().flatten() {
                let tx = tx.clone();
-                std::thread::spawn(move || serve(stream, token, tx, egui::Context::default()));
+                std::thread::spawn(move || serve(stream, token, tx, egui::Context::default(), false));
            }
        });
        let session = |lines: &[String]| {
@@ -1,35 +1,60 @@
 //! SolidCraft desktop app.
 //!
-//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [design.solidcraft | part.step]`
+//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]`
+//!
+//! `--safe-mode` (or `SOLIDCRAFT_SAFE_MODE=1`) starts with default settings, no recovery offer and
+//! the software renderer; see `startup` and docs/book/src/guide/troubleshooting.md.
 //!
 //! A `.step`/`.stp` file opens as a new design holding the file's bodies (an Import feature); a
-//! `.3mf`/`.stl` file as a new design holding mesh bodies.
+//! `.3mf`/`.stl`/`.obj`/`.glb`/`.gltf` file as a new design holding mesh bodies.
 //!
 //! `--control <port>` (or `SOLIDCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control
 //! server: `{"id":1,"method":"engine.execute","params":{"command":"solid.box","params":{…}}}`.
 //! See `solidcraft_ui_egui::control` and docs/control-protocol.md.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-#![forbid(unsafe_code)]
+#![deny(unsafe_code)]

 #[cfg(not(target_os = "macos"))]
 #[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
 mod app_icon;
 mod control_server;
+#[cfg(target_os = "windows")]
+mod native_crash;
+#[cfg(target_os = "windows")]
+mod native_frame;
+#[cfg(target_os = "macos")]
+mod open_documents;
 #[cfg(any(target_os = "windows", target_os = "linux"))]
 mod space_mouse;
+mod startup;

 use solidcraft_engine::{Session, io};
 use solidcraft_ui_egui::{Services, SolveApp};

 struct App {
    solve: SolveApp,
+    /// The settings folder whose start marker the first frame clears (`startup::started`).
+    starting: Option<std::path::PathBuf>,
+    /// Frames begun; the second one means the first was drawn (startup is over).
+    frames: u32,
    #[cfg(any(target_os = "windows", target_os = "linux"))]
    space_mouse: space_mouse::SpaceMouse,
 }

 impl eframe::App for App {
    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if self.frames < 2 {
+            self.frames += 1;
+            // A second frame right away, which means the first was presented: the app is up.
+            ctx.request_repaint();
+            if self.frames == 2 {
+                solidcraft_engine::crash::phase(solidcraft_engine::crash::RUNNING);
+                if let Some(dir) = self.starting.take() {
+                    startup::started(&dir);
+                }
+            }
+        }
        // The design on screen is the one whose commands a crash report replays.
        self.solve.session.crash_journal = solidcraft_engine::crash::enabled();
        // The OS closing the window (Alt+F4, Cmd+Q, the window manager): ask about unsaved
@@ -38,14 +63,23 @@ impl eframe::App for App {
            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
            solidcraft_ui_egui::documents::request_quit(&mut self.solve);
        }
+        #[cfg(target_os = "macos")]
+        for f in if self.solve.file_picker_busy() { Vec::new() } else { open_documents::take() } {
+            self.solve.open_path_async(&f);
+        }
        self.solve.logic(ctx);
        #[cfg(any(target_os = "windows", target_os = "linux"))]
-        self.space_mouse.tick(&mut self.solve, ctx);
+        if !self.solve.file_picker_busy() {
+            self.space_mouse.tick(&mut self.solve, ctx);
+        }
        if self.solve.quit_requested {
            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
        }
    }
    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // Before the app's own hook, which adds the control channel's events.
+        #[cfg(any(target_os = "windows", target_os = "linux"))]
+        self.space_mouse.raw_input_hook(self.solve.preferences.space_mouse_enabled, raw);
        self.solve.raw_input_hook(raw);
    }
    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -55,17 +89,29 @@ impl eframe::App for App {
        storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, self.solve.prefs());
    }
    fn on_exit(&mut self) {
+        // The agent chat's agent and everything it started end with the app.
+        solidcraft_ui_egui::agent_chat::shutdown(&mut self.solve);
        solidcraft_ui_egui::recovery_ui::close(&mut self.solve);
        solidcraft_engine::crash::end_session();
+        // An update asked to restart into the new version or to run its installer.
+        if let Some((program, args)) = solidcraft_ui_egui::update::take_launch(&mut self.solve)
+            && let Err(e) = std::process::Command::new(&program).args(&args).spawn()
+        {
+            log::error!("update: starting {}: {e}", program.display());
+        }
    }
 }

-fn services() -> Services {
+fn services(cc: &eframe::CreationContext<'_>) -> Services {
+    let parent = rfd::AsyncFileDialog::new().set_parent(cc);
+    let open_parent = parent.clone();
+    let program_parent = parent.clone();
    Services {
-        pick_open: Some(Box::new(|| {
-            rfd::FileDialog::new()
+        pick_open: Some(Box::new(move || {
+            let future = open_parent
+                .clone()
                .add_filter(
-                    "Designs, STEP, IGES and meshes",
+                    "Designs, CAD files and meshes",
                    &[
                        io::DESIGN_EXT,
                        io::LEGACY_DESIGN_EXT,
@@ -78,23 +124,40 @@ fn services() -> Services {
                        "iges",
                        "IGS",
                        "IGES",
+                        "FCStd",
+                        "fcstd",
+                        "3dm",
+                        "3DM",
                        "3mf",
                        "3MF",
                        "stl",
                        "STL",
+                        "obj",
+                        "OBJ",
+                        "glb",
+                        "GLB",
+                        "gltf",
+                        "GLTF",
                    ],
                )
                .add_filter("SolidCraft design (container or JSON)", &[io::DESIGN_EXT, io::LEGACY_DESIGN_EXT, "json"])
                .add_filter("STEP", &["step", "stp", "STEP", "STP"])
                .add_filter("IGES", &["igs", "iges", "IGS", "IGES"])
-                .add_filter("Mesh (3MF, STL)", &["3mf", "3MF", "stl", "STL"])
+                .add_filter("FreeCAD and Rhino", &["FCStd", "fcstd", "3dm", "3DM"])
+                .add_filter("Mesh (3MF, STL, OBJ, glTF)", &["3mf", "3MF", "stl", "STL", "obj", "OBJ", "glb", "GLB", "gltf", "GLTF"])
                .add_filter("Sketch drawings (DXF, SVG)", &["dxf", "DXF", "svg", "SVG"])
                .add_filter("All files", &["*"])
-                .pick_file()
-                .map(|p| p.to_string_lossy().to_string())
+                .pick_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
        })),
-        pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
-            let dialog = rfd::FileDialog::new().set_file_name(name);
+        pick_program: Some(Box::new(move || {
+            let dialog = program_parent.clone().set_title("Choose your slicer");
+            let dialog = if cfg!(target_os = "windows") { dialog.add_filter("Programs", &["exe"]) } else { dialog };
+            let future = dialog.pick_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+        })),
+        pick_save: Some(Box::new(move |name: &str, exts: &[&str]| {
+            let dialog = parent.clone().set_file_name(name);
            let dialog = if exts == [io::DESIGN_EXT, "json"] {
                if name.ends_with(".json") {
                    dialog.add_filter("Plain JSON design", &["json"]).add_filter("SolidCraft container", &[io::DESIGN_EXT])
@@ -104,9 +167,16 @@ fn services() -> Services {
            } else {
                dialog.add_filter("File", exts)
            };
-            dialog.save_file().map(|p| p.to_string_lossy().to_string())
+            let future = dialog.save_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
        })),
        graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
+        http_get: Some(std::sync::Arc::new(http_get)),
+        http_download: Some(std::sync::Arc::new(http_download)),
+        // Already an installed app: only the browser build offers to install.
+        install_app: None,
+        agent_http: Some(std::sync::Arc::new(agent_http)),
+        secrets: Some(std::sync::Arc::new(Keychain)),
        show_in_folder: Some(Box::new(|path| {
            let folder = std::path::Path::new(path).parent().unwrap_or_else(|| std::path::Path::new("."));
            let mut command = std::process::Command::new(if cfg!(target_os = "windows") {
@@ -127,6 +197,144 @@ fn services() -> Services {
    }
 }

+/// HTTPS GET for the update check (docs/updates.md): certificates from the operating system, a
+/// 15 s limit, at most 1 MB, and no headers beyond what GitHub requires (a User-Agent without
+/// the version or anything about this machine, and the API's media type).
+fn http_get(url: &str) -> Result<Vec<u8>, solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    let mut response = http_call(url, std::time::Duration::from_secs(15))?;
+    response.body_mut().with_config().limit(1 << 20).read_to_vec().map_err(|e| FetchError::Failed(e.to_string()))
+}
+
+/// HTTPS download of an update package to `to` (docs/updates.md), reporting progress; stops when
+/// `progress` returns false. The caller verifies the file.
+fn http_download(url: &str, to: &std::path::Path, progress: &dyn Fn(u64, Option<u64>) -> bool) -> Result<(), solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    use std::io::{Read, Write};
+    let fail = |e: String| FetchError::Failed(e);
+    let mut response = http_call(url, std::time::Duration::from_secs(30 * 60))?;
+    let total = response.headers().get("content-length").and_then(|v| v.to_str().ok()).and_then(|v| v.parse::<u64>().ok());
+    let mut body = response.body_mut().with_config().limit(solidcraft_ui_egui::update::install::MAX_PACKAGE).reader();
+    let mut file = std::fs::File::create(to).map_err(|e| fail(format!("{}: {e}", to.display())))?;
+    let mut buf = vec![0u8; 1 << 16];
+    let mut done = 0u64;
+    loop {
+        let n = body.read(&mut buf).map_err(|e| fail(e.to_string()))?;
+        if n == 0 {
+            break;
+        }
+        file.write_all(buf.get(..n).unwrap_or_default()).map_err(|e| fail(format!("{}: {e}", to.display())))?;
+        done += n as u64;
+        if !progress(done, total) {
+            return Err(fail("cancelled".into()));
+        }
+    }
+    file.sync_all().map_err(|e| fail(format!("{}: {e}", to.display())))?;
+    Ok(())
+}
+
+/// HTTP for the agent chat's API agents (OpenAI-compatible endpoints, docs/agent-chat.md): to the
+/// URL the user configured, which may be plain HTTP on this computer (Ollama, LM Studio). No
+/// redirects (a key must not follow one elsewhere), at most 16 MB back.
+fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Result<(u16, Vec<u8>), String> {
+    use std::time::Duration;
+    let tls = ureq::tls::TlsConfig::builder()
+        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+        .unversioned_rustls_crypto_provider(std::sync::Arc::new(rustls::crypto::ring::default_provider()))
+        .build();
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .tls_config(tls)
+        .http_status_as_error(false)
+        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 900))))
+        .timeout_connect(Some(Duration::from_secs(10)))
+        .user_agent("SolidCraft")
+        .max_redirects(0)
+        .build()
+        .into();
+    let mut response = if r.method == "POST" {
+        let mut req = agent.post(&r.url);
+        for (k, v) in &r.headers {
+            req = req.header(k, v);
+        }
+        req.send(r.body.as_deref().unwrap_or_default())
+    } else {
+        let mut req = agent.get(&r.url);
+        for (k, v) in &r.headers {
+            req = req.header(k, v);
+        }
+        req.call()
+    }
+    .map_err(|e| e.to_string())?;
+    let status = response.status().as_u16();
+    let body = response.body_mut().with_config().limit(16 << 20).read_to_vec().map_err(|e| e.to_string())?;
+    Ok((status, body))
+}
+
+/// API keys in the system keychain (service "SolidCraft agent chat", one entry per agent).
+struct Keychain;
+
+impl Keychain {
+    fn entry(id: &str) -> Result<keyring::Entry, String> {
+        keyring::Entry::new("SolidCraft agent chat", id).map_err(|e| e.to_string())
+    }
+}
+
+impl solidcraft_ui_egui::agent_chat::backend::Secrets for Keychain {
+    fn get(&self, id: &str) -> Result<Option<String>, String> {
+        match Self::entry(id)?.get_password() {
+            Ok(p) => Ok(Some(p)),
+            Err(keyring::Error::NoEntry) => Ok(None),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+    fn set(&self, id: &str, secret: &str) -> Result<(), String> {
+        Self::entry(id)?.set_password(secret).map_err(|e| e.to_string())
+    }
+    fn delete(&self, id: &str) -> Result<(), String> {
+        match Self::entry(id)?.delete_credential() {
+            Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+}
+
+/// One GET to GitHub: a 200 answer, or why not (rate limits included).
+fn http_call(url: &str, timeout: std::time::Duration) -> Result<ureq::http::Response<ureq::Body>, solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    use std::time::Duration;
+    let tls = ureq::tls::TlsConfig::builder()
+        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+        .unversioned_rustls_crypto_provider(std::sync::Arc::new(rustls::crypto::ring::default_provider()))
+        .build();
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .tls_config(tls)
+        .https_only(true)
+        .http_status_as_error(false)
+        .timeout_global(Some(timeout))
+        .timeout_connect(Some(Duration::from_secs(5)))
+        .user_agent("SolidCraft-update-check")
+        .max_redirects(3)
+        .build()
+        .into();
+    let response = agent
+        .get(url)
+        .header("Accept", "application/vnd.github+json")
+        .header("X-GitHub-Api-Version", "2022-11-28")
+        .call()
+        .map_err(|e| FetchError::Failed(e.to_string()))?;
+    let status = response.status().as_u16();
+    let header = |k: &str| response.headers().get(k).and_then(|v| v.to_str().ok()).and_then(|v| v.trim().parse::<u64>().ok());
+    if status == 429 || (status == 403 && (header("x-ratelimit-remaining") == Some(0) || header("retry-after").is_some())) {
+        let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        let retry_after_s = header("retry-after").or_else(|| header("x-ratelimit-reset").map(|reset| reset.saturating_sub(now))).unwrap_or(3600);
+        return Err(FetchError::RateLimited { retry_after_s });
+    }
+    if status != 200 {
+        return Err(FetchError::Failed(format!("GitHub answered HTTP {status}")));
+    }
+    Ok(response)
+}
+
 /// The per-user settings folder: eframe's storage (`app.ron`) and the anti-aliasing preference.
 fn settings_dir() -> Option<std::path::PathBuf> {
    eframe::storage_dir("SolidCraft")
@@ -174,11 +382,19 @@ fn adopt_settings(
    Ok(())
 }

+/// `graphics.json`, read before the window opens.
+fn graphics() -> Option<serde_json::Value> {
+    graphics_path().and_then(|p| std::fs::read_to_string(p).ok()).and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+}
+
+/// The graphics backend preference (`graphics.json`'s `backend`: `auto`, `dx12`, `vulkan`, `gl`).
+fn backend_preference() -> Option<String> {
+    graphics().and_then(|v| v.get("backend").and_then(serde_json::Value::as_str).map(str::to_string))
+}
+
 /// Anti-aliasing samples from Preferences (4 when unset).
 fn msaa() -> u16 {
-    graphics_path()
-        .and_then(|p| std::fs::read_to_string(p).ok())
-        .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+    graphics()
        .and_then(|v| v.get("msaa").and_then(serde_json::Value::as_u64))
        .and_then(|m| u16::try_from(m).ok())
        .filter(|m| [1, 2, 4, 8].contains(m))
@@ -219,7 +435,7 @@ const APP_ID: &str = solidcraft_engine::io::APP_ID;

 fn main() -> eframe::Result {
    adopt_legacy_settings();
-    let samples = msaa();
+    let mut safe_mode = startup::env_on(std::env::var(startup::SAFE_MODE_ENV).ok().as_deref());
    let mut control_port: Option<u16> = solidcraft_engine::geom::env::var("CONTROL_PORT").and_then(|p| p.parse().ok());
    let mut files = Vec::new();
    let mut sample = false;
@@ -228,6 +444,7 @@ fn main() -> eframe::Result {
        match a.as_str() {
            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
            "--sample" => sample = true,
+            "--safe-mode" => safe_mode = true,
            "--version" | "-V" => {
                println!("solidcraft {}", env!("CARGO_PKG_VERSION"));
                return Ok(());
@@ -246,12 +463,30 @@ fn main() -> eframe::Result {
                return Ok(());
            }
            "--help" | "-h" => {
-                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [design.solidcraft | part.step]");
+                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]");
                return Ok(());
            }
            _ => files.push(a),
        }
    }
+    // Settings that don't read are moved aside; launches that never got a window are counted,
+    // and after a few in a row this one starts in safe mode (docs/book/src/guide/troubleshooting.md).
+    let settings = settings_dir();
+    let mut notes: Vec<String> = Vec::new();
+    let mut failed_starts = 0;
+    if let Some(dir) = &settings {
+        notes.extend(startup::check_settings(dir, &[solidcraft_ui_egui::prefs::STORAGE_KEY, solidcraft_ui_egui::prefs::LEGACY_STORAGE_KEY]));
+        failed_starts = startup::begin(dir);
+    }
+    if failed_starts >= startup::FAILED_STARTS_FOR_SAFE_MODE && !safe_mode {
+        safe_mode = true;
+        notes.push(format!("The last {failed_starts} launches stopped before the window opened, so this one is in safe mode."));
+    }
+    let cpu_renderer = safe_mode || startup::cpu_renderer_env(std::env::var(startup::RENDERER_ENV).ok().as_deref());
+    if safe_mode {
+        notes.push("Safe mode: default settings (yours are kept for the next normal start), no recovery offer, software rendering.".into());
+    }
+    let samples = if safe_mode { MSAA } else { msaa() };
    // Crashes leave a report in the crash folder (solidcraft_engine::crash, docs/crash-reports.md).
    let crashed = solidcraft_engine::crash::default_dir()
        .map(|dir| {
@@ -263,13 +498,28 @@ fn main() -> eframe::Result {
            solidcraft_engine::crash::install(dir, build)
        })
        .unwrap_or_default();
+    // A crash in native code (a graphics driver) says where it happened: the exception and the
+    // module on Windows, and on every system the startup step the app was in.
+    #[cfg(target_os = "windows")]
+    native_crash::install();
+    eframe::egui_wgpu::set_startup_hook(startup_step);
+    solidcraft_engine::crash::phase("window");
    let options = eframe::NativeOptions {
        viewport: app_viewport()?,
        depth_buffer: DEPTH_BITS,
        stencil_buffer: STENCIL_BITS,
        multisampling: samples,
-        // Kept with the other settings, not in a folder named after the app id.
-        persistence_path: settings_dir().map(|d| d.join("app.ron")),
+        // Kept with the other settings, not in a folder named after the app id. Safe mode reads
+        // and writes a scratch copy, leaving the user's settings as they were.
+        persistence_path: if safe_mode {
+            let scratch = std::env::temp_dir().join(format!("solidcraft-safe-mode-{}.ron", std::process::id()));
+            let _ = std::fs::remove_file(&scratch);
+            Some(scratch)
+        } else {
+            settings.as_ref().map(|d| d.join("app.ron"))
+        },
+        persist_window: !safe_mode,
+        wgpu_options: wgpu_options(cpu_renderer, if safe_mode { None } else { backend_preference() }.as_deref()),
        ..Default::default()
    };
    #[cfg(all(unix, not(target_os = "macos")))]
@@ -286,20 +536,45 @@ fn main() -> eframe::Result {
            b.with_x11();
        }));
    }
+    // Files opened from Finder and the Dock arrive as events, not arguments.
+    #[cfg(target_os = "macos")]
+    open_documents::install();
+    let created = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let created_in_app = created.clone();
+    let starting = settings.clone();
    let result = eframe::run_native(
        "SolidCraft",
        options,
        Box::new(move |cc| {
+            created_in_app.store(true, std::sync::atomic::Ordering::SeqCst);
+            solidcraft_engine::crash::phase("app setup");
            solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
-            let mut app = SolveApp::new(Session::default(), services());
+            let mut app = SolveApp::new(Session::default(), services(cc));
+            app.apply_off_thread = Some(solidcraft_ui_egui::dialogs::APPLY_AT_ONCE);
            app.custom_titlebar = CUSTOM_TITLEBAR;
+            // Windows: the OS hit test offers the resize border, at the window's DPI, from the
+            // first message (#1381).
+            #[cfg(target_os = "windows")]
+            {
+                app.native_resize_border = CUSTOM_TITLEBAR && native_frame::install(cc);
+                if CUSTOM_TITLEBAR && !app.native_resize_border {
+                    eprintln!("SolidCraft window: no native resize border; egui edge zones instead");
+                }
+            }
            app.integrated_titlebar = cfg!(target_os = "macos");
-            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+            app.cpu_meshing = safe_mode;
+            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))).filter(|_| !safe_mode) {
                app.load_prefs(&p);
            }
            if let Some(rs) = &cc.wgpu_render_state {
                eprintln!("SolidCraft graphics: {:?}, MSAA {}x (requested {}x)", rs.adapter.get_info().backend, rs.msaa_samples, samples);
+                solidcraft_engine::crash::phase("viewport pipelines (shader compile)");
                app.set_wgpu(rs, DEPTH_BITS, STENCIL_BITS, rs.msaa_samples);
+                solidcraft_ui_egui::gpu::install_picture_renderer(rs);
+                // The graphics driver is loaded now; it may have put its own exception filter
+                // in front of ours.
+                #[cfg(target_os = "windows")]
+                native_crash::reinstall();
                // A saved anti-aliasing the device can't do: back to the default, with a notice.
                solidcraft_ui_egui::prefs::check_msaa(&mut app, u32::from(samples));
                let info = rs.adapter.get_info();
@@ -312,6 +587,10 @@ fn main() -> eframe::Result {
                let rx = control_server::start(port, cc.egui_ctx.clone());
                app = app.with_control(rx);
            }
+            // The agent chat's MCP bridge reaches the app through an endpoint of its own, started
+            // on a free port the first time the chat connects (docs/agent-chat.md).
+            let ctx = cc.egui_ctx.clone();
+            app.agent_chat.control_starter = Some(Box::new(move |tx| control_server::listen_agent(tx, ctx.clone())));
            if sample {
                if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                    app.set_status(format!("sample: {e}"), true);
@@ -320,9 +599,20 @@ fn main() -> eframe::Result {
                app.session.mark_saved();
                app.session.undo.clear();
            }
+            // A launch from Finder: its files arrived before the window.
+            #[cfg(target_os = "macos")]
+            let files = {
+                open_documents::set_ui(&cc.egui_ctx);
+                [files, open_documents::take()].concat()
+            };
            for f in &files {
                app.open_path_async(f);
            }
+            // No file and no sample: the empty design takes Units of new designs (#1205).
+            // An opened file and the sample part keep the units they were saved or built with.
+            if files.is_empty() && !sample {
+                solidcraft_ui_egui::prefs::apply_new_design(&mut app);
+            }
            // No design given: the start page (not when driven over the control channel, whose
            // clients expect the design view; `ui.home` shows it there).
            if files.is_empty() && !sample && control_port.is_none() {
@@ -333,20 +623,83 @@ fn main() -> eframe::Result {
            if let Some(dir) = solidcraft_engine::recovery::default_dir() {
                let every = if app.autosave_minutes > 0.0 { app.autosave_minutes * 60.0 } else { f64::MAX / 4.0 };
                solidcraft_ui_egui::recovery_ui::start(&mut app, &dir, std::time::Duration::from_secs_f64(every.min(1e9)));
+                // Safe mode keeps autosaving but offers nothing: the entries wait for a normal start.
+                if safe_mode {
+                    app.recoverable.clear();
+                }
            }
            // Tell the user about crashes since the last start (after the recovery offer is set up).
            solidcraft_ui_egui::crash_ui::announce(&mut app, &crashed);
+            if !notes.is_empty() {
+                app.set_status(notes.join(" "), true);
+            }
            #[cfg(any(target_os = "windows", target_os = "linux"))]
            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            solidcraft_engine::crash::phase("first frame");
            Ok(Box::new(App {
                solve: app,
+                starting,
+                frames: 0,
                #[cfg(any(target_os = "windows", target_os = "linux"))]
                space_mouse,
            }))
        }),
    );
    control_server::remove_token_file();
-    result
+    match result {
+        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, settings.as_deref()),
+        r => r,
+    }
+}
+
+/// egui-wgpu is about to start a step of getting the graphics device and the window's surface up:
+/// the crash journal keeps it, and the adapter once it is picked.
+fn startup_step(step: &'static str, detail: &str) {
+    if step == eframe::egui_wgpu::STEP_ADAPTER_CHOSEN {
+        solidcraft_engine::crash::set_environment(&format!("Renderer: {detail}"));
+    }
+    solidcraft_engine::crash::phase(step);
+}
+
+/// The renderer settings: with `cpu`, the software adapter (WARP, lavapipe, llvmpipe). The
+/// backends come from `startup::choose_backends` (on Windows D3D12 first, and only the backend
+/// in use is started); `preference` is `graphics.json`'s `backend`.
+fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuConfiguration {
+    let mut options = eframe::egui_wgpu::WgpuConfiguration::default();
+    if let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &mut options.wgpu_setup {
+        let env_set = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+        if let Some(backends) = startup::choose_backends(cfg!(target_os = "windows"), env_set, cpu, preference, startup::has_hardware_adapter) {
+            eprintln!("SolidCraft graphics: starting {backends:?}");
+            setup.instance_descriptor.backends = backends;
+        }
+        if cpu {
+            setup.native_adapter_selector = Some(std::sync::Arc::new(startup::pick_cpu_adapter));
+        }
+    }
+    options
+}
+
+/// The window never opened (no graphics adapter, a device that wouldn't start): once more on
+/// the software renderer, else a message box saying what failed instead of a silent exit.
+fn no_window(error: eframe::Error, tried_cpu: bool, settings: Option<&std::path::Path>) -> eframe::Result {
+    log::error!("the window could not open: {error}");
+    eprintln!("SolidCraft: the window could not open: {error}");
+    if !tried_cpu && let Ok(exe) = std::env::current_exe() {
+        eprintln!("SolidCraft: trying again with the software renderer ({}=cpu)", startup::RENDERER_ENV);
+        match std::process::Command::new(exe).args(std::env::args_os().skip(1)).env(startup::RENDERER_ENV, "cpu").status() {
+            Ok(status) if status.success() => return Ok(()),
+            // The second try showed its own message.
+            Ok(_) => return Err(error),
+            Err(e) => log::error!("could not start again with the software renderer: {e}"),
+        }
+    }
+    let _ = rfd::MessageDialog::new()
+        .set_level(rfd::MessageLevel::Error)
+        .set_title("SolidCraft could not start")
+        .set_description(startup::no_window_message(&error.to_string(), settings))
+        .set_buttons(rfd::MessageButtons::Ok)
+        .show();
+    Err(error)
 }

 /// Whether to run through XWayland rather than native Wayland. winit has no file drag-and-drop
@@ -0,0 +1,285 @@
+//! Windows: what a crash in native code leaves behind (docs/crash-reports.md).
+//!
+//! A crash inside a graphics driver or another DLL (an access violation, a stack overflow) is no
+//! Rust panic: the panic hook never runs and the next start only found "an unclean exit". An
+//! unhandled-exception filter now writes, before the process goes, a small JSON file with the
+//! exception code, the faulting module and the offset into it, and a minidump, next to the run's
+//! crash journal (`solidcraft_engine::crash::native_paths`). The next start puts both into the
+//! unclean exit's report, with the startup step the journal says the app was in.
+//!
+//! Installing an exception filter and asking the system which module holds an address have no
+//! safe API, hence the `unsafe_code` allowance on this module (the app crate denies it; see
+//! `open_documents.rs` for the other one). The filter runs on a thread that may have a broken
+//! heap or almost no stack left: it doesn't allocate, formats into a buffer on the stack, and
+//! skips the minidump after a stack overflow.
+#![allow(unsafe_code)]
+
+use std::fmt::Write as _;
+use std::os::windows::ffi::OsStrExt;
+use std::path::Path;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+use windows_sys::Win32::Foundation::{CloseHandle, GENERIC_WRITE, HANDLE, HMODULE, INVALID_HANDLE_VALUE};
+use windows_sys::Win32::Storage::FileSystem::{CREATE_ALWAYS, CreateFileW, FILE_ATTRIBUTE_NORMAL, WriteFile};
+use windows_sys::Win32::System::Diagnostics::Debug::{
+    EXCEPTION_CONTINUE_SEARCH, EXCEPTION_POINTERS, MINIDUMP_EXCEPTION_INFORMATION, MiniDumpNormal, MiniDumpWithThreadInfo,
+    MiniDumpWithUnloadedModules, MiniDumpWriteDump, SetUnhandledExceptionFilter,
+};
+use windows_sys::Win32::System::LibraryLoader::{
+    GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, GetModuleFileNameW, GetModuleHandleExW,
+};
+use windows_sys::Win32::System::Threading::{GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId};
+
+/// Where the filter writes (NUL-terminated UTF-16), set once by [`install`].
+struct Paths {
+    info: Vec<u16>,
+    dump: Vec<u16>,
+}
+
+static PATHS: OnceLock<Paths> = OnceLock::new();
+/// The filter that was installed before ours (called after ours), as an address.
+static PREVIOUS: AtomicUsize = AtomicUsize::new(0);
+/// The filter has started writing (a second exception while it does is left alone).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+const STATUS_ACCESS_VIOLATION: u32 = 0xC000_0005;
+const STATUS_IN_PAGE_ERROR: u32 = 0xC000_0006;
+const STATUS_STACK_OVERFLOW: u32 = 0xC000_00FD;
+
+/// Catch native crashes from now on (after `solidcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, dump)) = solidcraft_engine::crash::native_paths() else { return };
+    let wide = |p: &Path| p.as_os_str().encode_wide().chain([0]).collect::<Vec<u16>>();
+    if PATHS.set(Paths { info: wide(&info), dump: wide(&dump) }).is_ok() {
+        set_filter();
+    }
+}
+
+/// Put the filter back on top: a DLL loaded since (a graphics driver) may have set its own,
+/// which is then called after ours.
+pub fn reinstall() {
+    if PATHS.get().is_some() {
+        set_filter();
+    }
+}
+
+fn set_filter() {
+    // SAFETY: `filter` has the signature the system calls it with and stays valid for the
+    // process's life.
+    let previous = unsafe { SetUnhandledExceptionFilter(Some(filter)) };
+    if let Some(p) = previous
+        && p as usize != filter as *const () as usize
+    {
+        PREVIOUS.store(p as usize, Ordering::SeqCst);
+    }
+}
+
+/// The unhandled-exception filter: record, then let the previous filter (or the system) go on.
+unsafe extern "system" fn filter(pointers: *const EXCEPTION_POINTERS) -> i32 {
+    if !BUSY.swap(true, Ordering::SeqCst) {
+        // SAFETY: the system passes valid exception pointers for the duration of the call.
+        unsafe { record(pointers) };
+    }
+    let previous = PREVIOUS.load(Ordering::SeqCst);
+    if previous != 0 && previous != filter as *const () as usize {
+        // SAFETY: the address came from `SetUnhandledExceptionFilter` as a filter of this type.
+        let previous: unsafe extern "system" fn(*const EXCEPTION_POINTERS) -> i32 = unsafe { std::mem::transmute(previous) };
+        // SAFETY: as for this filter.
+        return unsafe { previous(pointers) };
+    }
+    EXCEPTION_CONTINUE_SEARCH
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 2048],
+    len: usize,
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let room = self.bytes.len().saturating_sub(self.len);
+        let n = s.len().min(room);
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The usual names of the exception codes a crash shows.
+fn code_name(code: u32) -> &'static str {
+    match code {
+        STATUS_ACCESS_VIOLATION => "EXCEPTION_ACCESS_VIOLATION",
+        STATUS_IN_PAGE_ERROR => "EXCEPTION_IN_PAGE_ERROR",
+        STATUS_STACK_OVERFLOW => "EXCEPTION_STACK_OVERFLOW",
+        0xC000_001D => "EXCEPTION_ILLEGAL_INSTRUCTION",
+        0xC000_0094 => "EXCEPTION_INT_DIVIDE_BY_ZERO",
+        0xC000_0096 => "EXCEPTION_PRIV_INSTRUCTION",
+        0xC000_008C => "EXCEPTION_ARRAY_BOUNDS_EXCEEDED",
+        0xC000_0374 => "STATUS_HEAP_CORRUPTION",
+        0xC000_0409 => "STATUS_STACK_BUFFER_OVERRUN",
+        0xC000_0602 => "STATUS_FAIL_FAST_EXCEPTION",
+        0x8000_0003 => "EXCEPTION_BREAKPOINT",
+        0xE06D_7363 => "C++ exception",
+        _ => "exception",
+    }
+}
+
+/// Write what `pointers` says into the info file, then the minidump.
+unsafe fn record(pointers: *const EXCEPTION_POINTERS) {
+    let Some(paths) = PATHS.get() else { return };
+    if pointers.is_null() {
+        return;
+    }
+    // SAFETY: checked non-null; the system keeps it valid during the filter.
+    let rec = unsafe { (*pointers).ExceptionRecord };
+    if rec.is_null() {
+        return;
+    }
+    // SAFETY: as above.
+    let rec = unsafe { &*rec };
+    let code = rec.ExceptionCode as u32;
+    let address = rec.ExceptionAddress as usize;
+    let mut module: HMODULE = std::ptr::null_mut();
+    let mut name = [0u16; 512];
+    // SAFETY: FROM_ADDRESS takes the address in place of a name; UNCHANGED_REFCOUNT means no
+    // handle to release; `name` is as long as we say.
+    let len = unsafe {
+        if GetModuleHandleExW(
+            GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+            address as *const u16,
+            &mut module,
+        ) != 0
+        {
+            GetModuleFileNameW(module, name.as_mut_ptr(), name.len() as u32) as usize
+        } else {
+            0
+        }
+    };
+    // SAFETY: no preconditions.
+    let thread = unsafe { GetCurrentThreadId() };
+    let mut b = Buf { bytes: [0; 2048], len: 0 };
+    let _ = write!(b, "{{\"code\":\"0x{code:08X}\",\"name\":\"{}\",\"address\":\"0x{address:016X}\",\"thread\":{thread}", code_name(code));
+    if len > 0 {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", address.wrapping_sub(module as usize));
+        for c in char::decode_utf16(name.iter().take(len).copied()) {
+            let _ = match c.unwrap_or(char::REPLACEMENT_CHARACTER) {
+                '"' => b.write_str("\\\""),
+                '\\' => b.write_str("\\\\"),
+                c if (c as u32) < 0x20 => b.write_str("?"),
+                c => b.write_char(c),
+            };
+        }
+        let _ = b.write_str("\"");
+    }
+    if matches!(code, STATUS_ACCESS_VIOLATION | STATUS_IN_PAGE_ERROR) && rec.NumberParameters >= 2 {
+        let what = match rec.ExceptionInformation[0] {
+            0 => "read of",
+            1 => "write to",
+            8 => "execution at",
+            _ => "access to",
+        };
+        let _ = write!(b, ",\"detail\":\"{what} 0x{:016X}\"", rec.ExceptionInformation[1]);
+    }
+    let _ = b.write_str("}");
+    let bytes = b.bytes.get(..b.len).unwrap_or_default();
+    // SAFETY: NUL-terminated path; the handle is closed below.
+    unsafe {
+        let file = create(&paths.info);
+        if !file.is_null() {
+            let mut written = 0u32;
+            WriteFile(file, bytes.as_ptr(), bytes.len() as u32, &mut written, std::ptr::null_mut());
+            CloseHandle(file);
+        }
+    }
+    // After a stack overflow there is no stack left for writing a minidump.
+    if code == STATUS_STACK_OVERFLOW {
+        return;
+    }
+    // SAFETY: as above; the exception information points at this thread's exception.
+    unsafe {
+        let file = create(&paths.dump);
+        if !file.is_null() {
+            let exception = MINIDUMP_EXCEPTION_INFORMATION { ThreadId: thread, ExceptionPointers: pointers as *mut _, ClientPointers: 0 };
+            MiniDumpWriteDump(
+                GetCurrentProcess(),
+                GetCurrentProcessId(),
+                file,
+                MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithUnloadedModules,
+                &exception,
+                std::ptr::null(),
+                std::ptr::null(),
+            );
+            CloseHandle(file);
+        }
+    }
+}
+
+/// A new file at `path` (NUL-terminated) for writing, or null.
+unsafe fn create(path: &[u16]) -> HANDLE {
+    // SAFETY: the caller passes a NUL-terminated path.
+    let h = unsafe { CreateFileW(path.as_ptr(), GENERIC_WRITE, 0, std::ptr::null(), CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, std::ptr::null_mut()) };
+    if h == INVALID_HANDLE_VALUE { std::ptr::null_mut() } else { h }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    /// The child half: install crash reporting and the filter, then fault in native code.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = solidcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234", built: "2026-10-14" };
+        let fresh = solidcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        if std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_FAULT").is_none() {
+            solidcraft_engine::crash::end_session();
+            return;
+        }
+        super::install();
+        solidcraft_engine::crash::phase("device creation");
+        // SAFETY: none; this is the crash under test (a read of address 16, as a null struct
+        // pointer's field would be).
+        let v = unsafe { std::ptr::read_volatile(16 as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &std::path::Path, fault: bool) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash::tests::child", "--test-threads=1", "--nocapture"]).env("SOLIDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if fault {
+            c.env("SOLIDCRAFT_NATIVE_CRASH_FAULT", "1");
+        }
+        c.output().unwrap()
+    }
+
+    #[test]
+    fn an_access_violation_is_reported_with_its_module_step_and_minidump() {
+        let dir = std::env::temp_dir().join(format!("solidcraft-native-crash-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, true);
+        assert_eq!(out.status.code().map(|c| c as u32), Some(super::STATUS_ACCESS_VIOLATION), "{out:?}");
+        let sessions: Vec<PathBuf> = std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).collect();
+        let info = sessions.iter().find(|p| p.to_string_lossy().ends_with(".native.json")).expect("the filter wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        assert_eq!(v["code"], "0xC0000005", "{v}");
+        assert_eq!(v["detail"], "read of 0x0000000000000010", "{v}");
+        assert!(v["module"].as_str().unwrap().to_lowercase().contains("solidcraft"), "the fault is in the test binary: {v}");
+        let dump = sessions.iter().find(|p| p.extension().is_some_and(|e| e == "dmp")).expect("a minidump");
+        assert_eq!(std::fs::read(dump).unwrap().get(..4), Some(&b"MDMP"[..]));
+        // The next start reports it.
+        let out = run(&dir, false);
+        assert!(out.status.success(), "{out:?}");
+        let reports = solidcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = solidcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        assert!(r["message"].as_str().unwrap().contains("EXCEPTION_ACCESS_VIOLATION (0xC0000005) in solidcraft"), "{r}");
+        assert!(r["message"].as_str().unwrap().contains("during startup (device creation"), "{r}");
+        assert!(r.get("minidump_path").is_some(), "{r}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
@@ -0,0 +1,177 @@
+//! Windows: the resize border of the window without OS decorations (#1381).
+//!
+//! The window keeps its native thick frame (`WS_THICKFRAME`, so Aero Snap, Win+arrows and the
+//! OS's own move and size loops work) but winit draws no frame: its `WM_NCCALCSIZE` makes the
+//! whole window client area, and every point then hit-tests as `HTCLIENT`. This module puts the
+//! resize border back by answering `WM_NCHITTEST` itself: within Windows' resize-border width
+//! for the window's current DPI from each edge (`solidcraft_ui_egui::titlebar::resize_hit`;
+//! 8 px at 100 %, corners win), it returns `HTLEFT`, `HTTOPRIGHT`, … So from the first message
+//! the OS shows its resize cursors and runs its own resize, whatever egui has laid out, whatever
+//! the scale; nothing waits for a first frame or a first size change.
+//!
+//! It also answers `WM_GETDPISCALEDSIZE` with the size the window will really have at the new
+//! DPI (the same logical size, as winit computes it), so the rect Windows suggests while the
+//! title bar is dragged onto a monitor with another scale is the rect winit then applies: the
+//! window rescales once at the crossing and stays under the pointer, instead of the OS's move
+//! loop and winit disagreeing about a frame the window doesn't have.
+//!
+//! Replacing a window procedure has no safe API, hence the `unsafe_code` allowance on this
+//! module (the app crate denies it; see `native_crash.rs` and `open_documents.rs` for the others).
+//! The procedure is installed once, on the thread that owns the window, for the main window only,
+//! and calls the previous one (winit's) for everything it doesn't answer.
+#![allow(unsafe_code)]
+
+use std::sync::atomic::{AtomicIsize, Ordering};
+
+use raw_window_handle::{HasWindowHandle, RawWindowHandle};
+use solidcraft_ui_egui::titlebar;
+use windows_sys::Win32::Foundation::{HWND, LPARAM, LRESULT, RECT, SIZE, WPARAM};
+use windows_sys::Win32::UI::HiDpi::{GetDpiForWindow, GetSystemMetricsForDpi};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    CallWindowProcW, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTLEFT,
+    HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IsIconic, IsZoomed, SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SetWindowLongPtrW, WM_GETDPISCALEDSIZE,
+    WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
+};
+
+/// The window procedure ours replaced (winit's), as an address; 0 before [`install`].
+static PREVIOUS: AtomicIsize = AtomicIsize::new(0);
+
+/// Answer the main window's hit test and DPI-size questions from now on. Call it once, on the
+/// thread that created the window (eframe's app creator). `false` if it isn't a Win32 window.
+pub fn install(window: &impl HasWindowHandle) -> bool {
+    let Ok(handle) = window.window_handle() else { return false };
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return false };
+    let hwnd = w.hwnd.get() as HWND;
+    if PREVIOUS.load(Ordering::SeqCst) != 0 {
+        return false;
+    }
+    // SAFETY: `hwnd` is the live window eframe just created on this thread; `frame_proc` has the
+    // WNDPROC signature and stays valid for the life of the process. SetWindowLongPtrW returns
+    // the previous procedure, which `frame_proc` calls for every other message.
+    let previous = unsafe { SetWindowLongPtrW(hwnd, GWLP_WNDPROC, frame_proc as *const () as isize as _) };
+    // `as _`: on 32-bit Windows SetWindowLongPtrW is SetWindowLongW, which takes and
+    // returns i32.
+    if previous == 0 {
+        return false;
+    }
+    PREVIOUS.store(previous as _, Ordering::SeqCst);
+    true
+}
+
+/// The procedure ours replaced.
+fn previous() -> WNDPROC {
+    let p = PREVIOUS.load(Ordering::SeqCst);
+    // SAFETY: a nonzero value is the WNDPROC that SetWindowLongPtrW returned in `install`.
+    (p != 0).then(|| unsafe { std::mem::transmute::<isize, unsafe extern "system" fn(HWND, u32, WPARAM, LPARAM) -> LRESULT>(p) })
+}
+
+unsafe extern "system" fn frame_proc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam: LPARAM) -> LRESULT {
+    let prev = previous();
+    // SAFETY: the arguments are the message as Windows delivered it to this window.
+    let call_previous = || unsafe { CallWindowProcW(prev, hwnd, msg, wparam, lparam) };
+    match msg {
+        WM_NCHITTEST => {
+            let default = call_previous();
+            // Screen coordinates, signed (monitors left of or above the primary one).
+            let (x, y) = (i32::from(lparam as u16 as i16), i32::from((lparam >> 16) as u16 as i16));
+            // The border, else what winit and the system say (`HTCLIENT` everywhere else).
+            border_hit(hwnd, x, y).map_or(default, |hit| hit as LRESULT)
+        }
+        WM_GETDPISCALEDSIZE => {
+            let new_dpi = wparam as u32;
+            // SAFETY: for this message lParam points to a SIZE the system reads back.
+            match (resizable(hwnd), client_size(hwnd), unsafe { (lparam as *mut SIZE).as_mut() }) {
+                (true, Some(size), Some(out)) => {
+                    // SAFETY: a window handle the system passed in.
+                    let old_dpi = unsafe { GetDpiForWindow(hwnd) };
+                    match titlebar::dpi_scaled_size(size, old_dpi, new_dpi) {
+                        Some((cx, cy)) => {
+                            *out = SIZE { cx, cy };
+                            1
+                        }
+                        None => call_previous(),
+                    }
+                }
+                _ => call_previous(),
+            }
+        }
+        WM_NCDESTROY => {
+            // Hand the window back to winit's procedure for its last message.
+            if prev.is_some() {
+                // SAFETY: restores the procedure this window had before `install`.
+                unsafe { SetWindowLongPtrW(hwnd, GWLP_WNDPROC, PREVIOUS.load(Ordering::SeqCst) as _) };
+            }
+            call_previous()
+        }
+        _ => call_previous(),
+    }
+}
+
+/// The window can be resized by its border now: it has the thick frame (not fullscreen, which
+/// drops it) and is neither maximized nor minimized.
+fn resizable(hwnd: HWND) -> bool {
+    // SAFETY: plain queries on a window handle the system passed in.
+    unsafe {
+        let style = GetWindowLongPtrW(hwnd, GWL_STYLE) as u32;
+        style & WS_THICKFRAME != 0 && IsZoomed(hwnd) == 0 && IsIconic(hwnd) == 0
+    }
+}
+
+/// The client area's size in pixels (the whole window: winit gives it no frame).
+fn client_size(hwnd: HWND) -> Option<(i32, i32)> {
+    let mut r = RECT { left: 0, top: 0, right: 0, bottom: 0 };
+    // SAFETY: `r` is a valid RECT to fill.
+    (unsafe { GetClientRect(hwnd, &mut r) } != 0).then_some((r.right - r.left, r.bottom - r.top))
+}
+
+/// Windows' resize border at the window's DPI: the sizing frame plus its padding, as Windows
+/// itself sizes it, or 8 px scaled when the system has no answer.
+fn border_px(hwnd: HWND) -> f32 {
+    // SAFETY: plain queries.
+    let (dpi, metric) = unsafe {
+        let dpi = GetDpiForWindow(hwnd);
+        (dpi, GetSystemMetricsForDpi(SM_CXSIZEFRAME, dpi) + GetSystemMetricsForDpi(SM_CXPADDEDBORDER, dpi))
+    };
+    let scale = if dpi > 0 { dpi as f32 / 96.0 } else { 1.0 };
+    if metric > 0 { metric as f32 } else { titlebar::resize_border_px(scale) }
+}
+
+/// The `HT*` resize code at screen point (`x`, `y`), if it is on the border.
+fn border_hit(hwnd: HWND, x: i32, y: i32) -> Option<u32> {
+    if !resizable(hwnd) {
+        return None;
+    }
+    let mut r = RECT { left: 0, top: 0, right: 0, bottom: 0 };
+    // SAFETY: `r` is a valid RECT to fill.
+    if unsafe { GetWindowRect(hwnd, &mut r) } == 0 {
+        return None;
+    }
+    let w = egui::Rect::from_min_max(egui::pos2(r.left as f32, r.top as f32), egui::pos2(r.right as f32, r.bottom as f32));
+    titlebar::resize_hit(w, egui::pos2(x as f32, y as f32), border_px(hwnd)).map(hit_code)
+}
+
+fn hit_code(d: egui::ResizeDirection) -> u32 {
+    use egui::ResizeDirection::*;
+    match d {
+        North => HTTOP,
+        South => HTBOTTOM,
+        West => HTLEFT,
+        East => HTRIGHT,
+        NorthWest => HTTOPLEFT,
+        NorthEast => HTTOPRIGHT,
+        SouthWest => HTBOTTOMLEFT,
+        SouthEast => HTBOTTOMRIGHT,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_direction_has_its_own_hit_code() {
+        use egui::ResizeDirection::*;
+        let codes: Vec<u32> = [North, South, West, East, NorthWest, NorthEast, SouthWest, SouthEast].into_iter().map(hit_code).collect();
+        assert_eq!(codes, vec![HTTOP, HTBOTTOM, HTLEFT, HTRIGHT, HTTOPLEFT, HTTOPRIGHT, HTBOTTOMLEFT, HTBOTTOMRIGHT]);
+    }
+}
@@ -0,0 +1,120 @@
+//! macOS: files opened from Finder (double-click, Open With, a drop on the Dock icon) or with
+//! `open -a SolidCraft file` (#997).
+//!
+//! macOS doesn't pass these on the command line: AppKit hands them to the application delegate's
+//! `application:openURLs:`, and when the delegate has no such method it asks `NSDocumentController`,
+//! which fails with "SolidCraft cannot open files in the … format" because SolidCraft isn't an
+//! `NSDocument` app. winit 0.30's delegate doesn't implement the method, so [`install`] adds it to
+//! the delegate's class when the app is about to finish launching: after winit set the delegate and
+//! before AppKit delivers the files the app was launched with. The handler queues the paths and
+//! wakes the UI, which opens them with [`take`] like files named on the command line.
+//!
+//! Adding a method to another crate's Objective-C class has no safe API, hence the `unsafe_code`
+//! allowance on [`install`] and [`add_open_urls_method`] (winit overrides `sendEvent:` on
+//! `NSApplication` similarly).
+
+use std::ptr::NonNull;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+use block2::RcBlock;
+use objc2::MainThreadMarker;
+use objc2::runtime::{AnyObject, Imp, Sel};
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSApplicationWillFinishLaunchingNotification};
+use objc2_foundation::{NSArray, NSNotification, NSNotificationCenter, NSURL};
+
+/// Paths that arrived and haven't been opened yet.
+static PENDING: Mutex<Vec<String>> = Mutex::new(Vec::new());
+/// The UI to wake when files arrive (unset until the window exists; the first frame opens them).
+static UI: OnceLock<egui::Context> = OnceLock::new();
+
+/// Handle open-document events from now on. Call before the event loop runs.
+#[allow(unsafe_code)]
+pub fn install() {
+    let block = RcBlock::new(|_: NonNull<NSNotification>| add_open_urls_method());
+    // SAFETY: the name is AppKit's notification constant; no object or queue filter, so the block
+    // runs on the posting thread (AppKit posts it on the main thread). The block captures nothing,
+    // so it is sendable. The notification center keeps the registration (and the block) for the
+    // life of the app.
+    unsafe {
+        NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(
+            Some(NSApplicationWillFinishLaunchingNotification),
+            None,
+            None,
+            &block,
+        );
+    }
+}
+
+/// Wake `ctx` when files arrive while the app runs.
+pub fn set_ui(ctx: &egui::Context) {
+    // Set once; a second call would hand over the same context.
+    let _ = UI.set(ctx.clone());
+}
+
+/// The paths that arrived since the last call.
+pub fn take() -> Vec<String> {
+    std::mem::take(&mut *PENDING.lock().unwrap_or_else(PoisonError::into_inner))
+}
+
+/// `application:openURLs:` on the application delegate's class.
+#[allow(unsafe_code)]
+fn add_open_urls_method() {
+    let Some(mtm) = MainThreadMarker::new() else { return };
+    let Some(delegate) = NSApplication::sharedApplication(mtm).delegate() else {
+        log::warn!("no application delegate; files opened from Finder won't open");
+        return;
+    };
+    let class = AsRef::<AnyObject>::as_ref(&*delegate).class();
+    let handler: extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>) = open_urls;
+    // SAFETY: `Imp` is the untyped form of a method implementation; the Objective-C runtime calls
+    // it with the arguments the type encoding declares, which match `open_urls`: no return value
+    // (`v`), the receiver (`@`), the selector (`:`), the application (`@`) and the URL array (`@`).
+    let added = unsafe {
+        let imp = std::mem::transmute::<extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>), Imp>(handler);
+        objc2::ffi::class_addMethod(std::ptr::from_ref(class).cast_mut(), sel!(application:openURLs:), imp, c"v@:@@".as_ptr())
+    };
+    if !added.as_bool() {
+        log::warn!("the application delegate already handles open-document events");
+    }
+}
+
+/// AppKit calls this; a panic stops here instead of unwinding through AppKit's frames.
+extern "C-unwind" fn open_urls(_delegate: &AnyObject, _cmd: Sel, _app: &AnyObject, urls: &NSArray<NSURL>) {
+    if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| queue(urls))).is_err() {
+        log::warn!("files opened from Finder were dropped after an internal error");
+    }
+}
+
+/// Queue the files among `urls` and wake the UI.
+fn queue(urls: &NSArray<NSURL>) {
+    // Only file URLs: macOS 27 turns an https URL's path into a file path too.
+    let paths = urls.iter().filter(|u| u.isFileURL()).filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
+    PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(paths);
+    if let Some(ctx) = UI.get() {
+        ctx.request_repaint();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2::runtime::NSObject;
+    use objc2_foundation::NSString;
+
+    use super::*;
+
+    /// Files queue until the UI takes them; URLs that aren't files are left out.
+    #[test]
+    fn opened_files_wait_for_the_ui() {
+        let web = NSURL::URLWithString(&NSString::from_str("https://example.com/a.solidcraft")).unwrap();
+        let urls = NSArray::from_retained_slice(&[
+            NSURL::from_file_path("/tmp/a b.solidcraft").unwrap(),
+            web,
+            NSURL::from_file_path("/tmp/c.step").unwrap(),
+        ]);
+        let any = NSObject::new();
+        open_urls(&any, sel!(application:openURLs:), &any, &urls);
+        assert_eq!(take(), ["/tmp/a b.solidcraft", "/tmp/c.step"]);
+        assert!(take().is_empty());
+    }
+}
@@ -15,64 +15,18 @@ use hid_descriptor::Layout;
 use hidapi::{DeviceInfo, HidApi};
 use quick_xml::Reader;
 use quick_xml::events::Event;
-use solidcraft_engine::render::Camera;
 use solidcraft_ui_egui::SolveApp;
+use solidcraft_ui_egui::space_mouse::{Axes, AxisRule, DriverMapping, WheelGuard, navigate_frame};

 const STALE_AFTER: Duration = Duration::from_millis(150);
 const RETRY_AFTER: Duration = Duration::from_secs(2);
 const MAX_PROFILE_BYTES: u64 = 1024 * 1024;

-#[derive(Clone, Copy, Debug, Default, PartialEq)]
-struct Axes {
-    translation: [i16; 3],
-    rotation: [i16; 3],
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct AxisRule {
-    output: usize,
-    enabled: bool,
-    reversed: bool,
-    scale: f64,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct DriverMapping {
-    axes: [AxisRule; 6],
-    overall_scale: f64,
-}
-
-impl Default for DriverMapping {
-    fn default() -> Self {
-        Self { axes: std::array::from_fn(|output| AxisRule { output, enabled: true, reversed: false, scale: 1.0 }), overall_scale: 1.0 }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq)]
-struct Motion {
-    translation: [f64; 3],
-    rotation: [f64; 3],
-}
-
-impl DriverMapping {
-    fn apply(self, axes: Axes) -> Motion {
-        let raw = [
-            normalized(axes.translation[0]),
-            normalized(axes.translation[1]),
-            normalized(axes.translation[2]),
-            normalized(axes.rotation[0]),
-            normalized(axes.rotation[1]),
-            normalized(axes.rotation[2]),
-        ];
-        let mut logical = [0.0; 6];
-        for (input, rule) in self.axes.iter().enumerate() {
-            if rule.enabled {
-                let sign = if rule.reversed { -1.0 } else { 1.0 };
-                logical[rule.output] = raw[input] * sign * rule.scale * self.overall_scale;
-            }
-        }
-        Motion { translation: [logical[0], logical[1], logical[2]], rotation: [logical[3], logical[4], logical[5]] }
-    }
+/// The mapping used when no 3DxWare profile is found: what the driver applies by default in
+/// object mode. On Linux there is no 3DxWare (#1172); on Windows 3DxWare has no profile for
+/// SolidCraft until one is made, and the raw axes swap roll and spin (#1380).
+fn without_profile() -> DriverMapping {
+    DriverMapping::object_mode()
 }

 #[derive(Clone, Copy, Debug, Default)]
@@ -366,6 +320,9 @@ pub struct SpaceMouse {
    last_frame: Instant,
    driver_mapping: DriverMapping,
    mapping_checked_at: Instant,
+    /// Drops 3DxWare's emulated wheel while the cap moves (#1380).
+    wheel: WheelGuard,
+    started: Instant,
 }

 impl SpaceMouse {
@@ -377,82 +334,56 @@ impl SpaceMouse {
        if let Err(error) = std::thread::Builder::new().name("solidcraft-3d-mouse".into()).spawn(move || reader(worker_ctx, worker_state)) {
            log::warn!("3D mouse: reader could not start: {error}");
        }
-        Self { shared, last_frame: now, driver_mapping: load_driver_mapping().unwrap_or_default(), mapping_checked_at: now }
+        Self {
+            shared,
+            last_frame: now,
+            driver_mapping: load_driver_mapping().unwrap_or_else(without_profile),
+            mapping_checked_at: now,
+            wheel: WheelGuard::default(),
+            started: now,
+        }
+    }
+
+    /// Before the app's own hook (which adds the control channel's events): with navigation on,
+    /// the wheel events 3DxWare makes from the cap's motion are dropped.
+    pub fn raw_input_hook(&mut self, enabled: bool, raw: &mut egui::RawInput) {
+        if !enabled {
+            return;
+        }
+        let now = Instant::now();
+        let moving = self.shared.lock().map(|reading| reading.current(now).moving()).unwrap_or(false);
+        self.wheel.filter(moving, now.duration_since(self.started).as_secs_f64(), &mut raw.events);
    }

    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
        let now = Instant::now();
-        let seconds = now.duration_since(self.last_frame).as_secs_f64().min(0.05);
+        let seconds = now.duration_since(self.last_frame).as_secs_f64();
        self.last_frame = now;
        if now.duration_since(self.mapping_checked_at) >= RETRY_AFTER {
-            let updated = load_driver_mapping().unwrap_or_default();
+            let updated = load_driver_mapping().unwrap_or_else(without_profile);
            if updated != self.driver_mapping {
                log::info!("3D mouse: applying updated 3DxWare axis profile");
                self.driver_mapping = updated;
            }
            self.mapping_checked_at = now;
        }
-        if !app.preferences.space_mouse_enabled || app.home.open {
-            return;
-        }
        let axes = match self.shared.lock() {
            Ok(reading) => reading.current(now),
            Err(_) => return,
        };
-        if axes == Axes::default() {
-            return;
-        }
-        let speed = f64::from(app.preferences.space_mouse_speed);
-        if !speed.is_finite() {
-            return;
-        }
-        app.begin_external_navigation();
-        let height = app.viewport.rect.map_or(600.0, |rect| f64::from(rect.height().max(1.0)));
-        navigate(
-            &mut app.cam,
-            self.driver_mapping.apply(axes),
-            seconds * speed.clamp(0.1, 5.0),
-            height,
-            app.session.active_sketch.is_some(),
-            app.preferences.zoom_reverse,
-        );
-        ctx.request_repaint_after(Duration::from_millis(16));
-    }
-}
-
-/// A small dead zone avoids drift at rest. A full cap deflection takes roughly one viewport
-/// per second to pan and about two radians per second to turn, independent of frame rate.
-fn normalized(value: i16) -> f64 {
-    let v = f64::from(value);
-    if v.abs() <= 20.0 { 0.0 } else { v.signum() * ((v.abs() - 20.0) / 330.0).min(1.0) }
-}
-
-fn navigate(cam: &mut Camera, motion: Motion, seconds: f64, height: f64, sketch: bool, reverse_zoom: bool) {
-    if !(seconds > 0.0) || !seconds.is_finite() {
-        return;
-    }
-    let [x, y, z] = motion.translation;
-    let [rx, ry, rz] = motion.rotation;
-    // Logical 3DxWare coordinates are X = left/right, Y = zoom and Z = up/down. The user's
-    // profile above can swap the physical forward/back and up/down axes before they reach here.
-    cam.pan(x * height * 0.6 * seconds, z * height * 0.6 * seconds, height);
-    let zoom_sign = if reverse_zoom { -1.0 } else { 1.0 };
-    cam.zoom_at((-y * zoom_sign * 1.5 * seconds).exp(), None);
-    if !sketch {
-        // These are logical 3DxWare coordinates after the profile mapping above: Rx is Tilt,
-        // Ry is Roll and Rz is Spin. The KMJ profile swaps physical Ry/Rz for the selected
-        // navigation mode, so swapping them again here would make Roll behave like Spin.
-        cam.orbit(ry * 250.0 * seconds, rx * 250.0 * seconds);
-        cam.roll_by(rz * 2.0 * seconds);
+        navigate_frame(app, ctx, self.driver_mapping, axes, seconds);
    }
 }

 #[cfg(test)]
 mod tests {
    use super::*;
+    use solidcraft_ui_egui::space_mouse::{DeviceMotion, Motion};

-    fn raw(axes: Axes) -> Motion {
-        DriverMapping::default().apply(axes)
+    /// The logical axes a reading reaches. Logical Rz rolls the view and logical Ry turns it about
+    /// its vertical (`navigation::device_camera` in solidcraft-ui-egui, tested there).
+    fn rotation(mapping: DriverMapping, rotation: [i16; 3]) -> [f64; 3] {
+        mapping.apply(Axes { translation: [0; 3], rotation }).rotation
    }

    #[test]
@@ -499,69 +430,6 @@ mod tests {
        assert_eq!(reading.current(now), Axes { translation: [1, 2, 3], rotation: [4, 5, 6] });
    }

-    #[test]
-    fn six_axes_move_the_camera_and_sketches_keep_their_orientation() {
-        let mut cam = Camera::default();
-        let before = cam;
-        navigate(&mut cam, raw(Axes { translation: [350, 350, 350], rotation: [350, 350, 350] }), 0.02, 600.0, false, false);
-        assert_ne!(cam.target, before.target);
-        assert!(cam.distance < before.distance);
-        assert_ne!(cam.yaw, before.yaw);
-        assert_ne!(cam.pitch, before.pitch);
-        assert_ne!(cam.roll, before.roll);
-        let orientation = (cam.yaw, cam.pitch, cam.roll);
-        navigate(&mut cam, raw(Axes { translation: [350, 0, 0], rotation: [350, 350, 350] }), 0.02, 600.0, true, false);
-        assert_eq!((cam.yaw, cam.pitch, cam.roll), orientation);
-        assert!(cam.is_valid());
-    }
-
-    #[test]
-    fn individual_axes_have_physical_spacemouse_meaning() {
-        let before = Camera::default();
-
-        let mut slide = before;
-        navigate(&mut slide, raw(Axes { translation: [350, 0, 0], rotation: [0; 3] }), 0.02, 600.0, false, false);
-        assert_ne!(slide.target, before.target);
-        assert_eq!(slide.distance, before.distance);
-
-        let mut push = before;
-        navigate(&mut push, raw(Axes { translation: [0, 350, 0], rotation: [0; 3] }), 0.02, 600.0, false, false);
-        assert_eq!(push.target, before.target);
-        assert!(push.distance < before.distance);
-
-        let mut lift = before;
-        navigate(&mut lift, raw(Axes { translation: [0, 0, 350], rotation: [0; 3] }), 0.02, 600.0, false, false);
-        assert_ne!(lift.target, before.target);
-        assert_eq!(lift.distance, before.distance);
-
-        let mut tilt = before;
-        navigate(&mut tilt, raw(Axes { translation: [0; 3], rotation: [350, 0, 0] }), 0.02, 600.0, false, false);
-        assert_eq!((tilt.yaw, tilt.roll), (before.yaw, before.roll));
-        assert_ne!(tilt.pitch, before.pitch);
-
-        let mut roll = before;
-        navigate(&mut roll, raw(Axes { translation: [0; 3], rotation: [0, 350, 0] }), 0.02, 600.0, false, false);
-        assert_eq!((roll.pitch, roll.roll), (before.pitch, before.roll));
-        assert_ne!(roll.yaw, before.yaw);
-
-        let mut twist = before;
-        navigate(&mut twist, raw(Axes { translation: [0; 3], rotation: [0, 0, 350] }), 0.02, 600.0, false, false);
-        assert_eq!((twist.yaw, twist.pitch), (before.yaw, before.pitch));
-        assert_ne!(twist.roll, before.roll);
-    }
-
-    #[test]
-    fn reverse_zoom_setting_applies_to_spacemouse() {
-        let before = Camera::default();
-        let motion = raw(Axes { translation: [0, 350, 0], rotation: [0; 3] });
-        let mut normal = before;
-        navigate(&mut normal, motion, 0.02, 600.0, false, false);
-        let mut reversed = before;
-        navigate(&mut reversed, motion, 0.02, 600.0, false, true);
-        assert!(normal.distance < before.distance);
-        assert!(reversed.distance > before.distance);
-    }
-
    #[test]
    fn applies_3dxware_axis_swaps_and_reversals() {
        let profile = br#"
@@ -581,7 +449,28 @@ mod tests {
    }

    #[test]
-    fn mapped_roll_and_spin_reach_distinct_camera_rotations() {
+    fn without_a_profile_the_drivers_object_mode_axes_are_used() {
+        // 3DxWare's object-mode mapping, as a profile (#1172: confirmed on a SpaceMouse Compact).
+        let object_mode = br#"
+            <AppCfg><Devices><Device><AxisBank>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_X</ActionID></Input><Output><ActionID>HIDMultiAxis_X</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Y</ActionID></Input><Output><ActionID>HIDMultiAxis_Y</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Z</ActionID></Input><Output><ActionID>HIDMultiAxis_Z</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Rx</ActionID></Input><Output><ActionID>HIDMultiAxis_Rx</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Ry</ActionID></Input><Output><ActionID>HIDMultiAxis_Rz</ActionID><Reversed>true</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Rz</ActionID></Input><Output><ActionID>HIDMultiAxis_Ry</ActionID><Reversed>true</Reversed></Output></Axis>
+            </AxisBank></Device></Devices></AppCfg>
+        "#;
+        let profile = parse_driver_mapping(object_mode).expect("valid 3DxWare profile");
+        // On every platform (#1172 on Linux, #1380 on Windows).
+        assert_eq!(without_profile(), profile);
+        // Tilting the cap rolls the view and twisting it spins it, as with the driver.
+        assert_eq!(rotation(without_profile(), [0, 350, 0]), [0.0, 0.0, -1.0]);
+        assert_eq!(rotation(without_profile(), [0, 0, 350]), [0.0, -1.0, 0.0]);
+    }
+
+    #[test]
+    fn mapped_roll_and_spin_reach_the_roll_and_turn_axes() {
        let profile = br#"
            <AppCfg><Devices><Device><AxisBank>
              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Ry</ActionID></Input><Output><ActionID>HIDMultiAxis_Rz</ActionID><Reversed>false</Reversed></Output></Axis>
@@ -589,16 +478,90 @@ mod tests {
            </AxisBank></Device></Devices></AppCfg>
        "#;
        let mapping = parse_driver_mapping(profile).expect("valid 3DxWare profile");
-        let before = Camera::default();
+        // The physical roll reaches the roll axis only, and the physical spin the turn only.
+        assert_eq!(rotation(mapping, [0, 350, 0]), [0.0, 0.0, 1.0]);
+        assert_eq!(rotation(mapping, [0, 0, 350]), [0.0, -1.0, 0.0]);
+    }

-        let mut physical_roll = before;
-        navigate(&mut physical_roll, mapping.apply(Axes { translation: [0; 3], rotation: [0, 350, 0] }), 0.02, 600.0, false, false);
-        assert_eq!((physical_roll.yaw, physical_roll.pitch), (before.yaw, before.pitch));
-        assert_ne!(physical_roll.roll, before.roll);
+    #[test]
+    fn each_frame_hands_the_view_its_motion_through_the_drivers_mapping() {
+        // The reader's latest tilt, and a profile that makes tilt roll: the frame's motion rolls.
+        let now = Instant::now();
+        let mut reading = Reading::new(now);
+        reading.axes.rotation = [0, 350, 0];
+        let mut mouse = SpaceMouse {
+            shared: Arc::new(Mutex::new(reading)),
+            last_frame: now - Duration::from_millis(20),
+            driver_mapping: DriverMapping::object_mode(),
+            mapping_checked_at: now,
+            wheel: WheelGuard::default(),
+            started: now,
+        };
+        let mut app = SolveApp::new(solidcraft_engine::Session::default(), solidcraft_ui_egui::Services::default());
+        app.home.open = false;
+        mouse.tick(&mut app, &Context::default());
+        let DeviceMotion { motion, seconds } = app.viewport.device_motion.expect("the frame hands the page its motion");
+        assert_eq!(motion, Motion { translation: [0.0; 3], rotation: [0.0, 0.0, -1.0] });
+        assert!(seconds > 0.0);
+    }

-        let mut physical_spin = before;
-        navigate(&mut physical_spin, mapping.apply(Axes { translation: [0; 3], rotation: [0, 0, 350] }), 0.02, 600.0, false, false);
-        assert_ne!(physical_spin.yaw, before.yaw);
-        assert_eq!((physical_spin.pitch, physical_spin.roll), (before.pitch, before.roll));
+    fn wheel() -> egui::Event {
+        egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Line,
+            delta: egui::vec2(0.0, -1.0),
+            modifiers: Default::default(),
+            phase: egui::TouchPhase::Move,
+        }
+    }
+
+    fn mouse(reading: Reading) -> SpaceMouse {
+        let now = Instant::now();
+        SpaceMouse {
+            shared: Arc::new(Mutex::new(reading)),
+            last_frame: now,
+            driver_mapping: DriverMapping::object_mode(),
+            mapping_checked_at: now,
+            wheel: WheelGuard::default(),
+            started: now,
+        }
+    }
+
+    #[test]
+    fn the_wheel_3dxware_makes_from_the_cap_is_dropped() {
+        // The cap tilted forward: 3DxWare also sends wheel turns (#1380). They are dropped.
+        let now = Instant::now();
+        let mut tilted = Reading::new(now);
+        tilted.axes.rotation = [-200, 0, 0];
+        let mut moving = mouse(tilted);
+        let mut raw = egui::RawInput { events: vec![wheel(), egui::Event::Zoom(1.1), egui::Event::Text("a".into())], ..Default::default() };
+        moving.raw_input_hook(true, &mut raw);
+        assert_eq!(raw.events, [egui::Event::Text("a".into())]);
+        // With navigation off, the wheel is the cap's only way to move the view: kept.
+        let mut raw = egui::RawInput { events: vec![wheel()], ..Default::default() };
+        moving.raw_input_hook(false, &mut raw);
+        assert_eq!(raw.events.len(), 1);
+        // The cap at rest: the wheel is the user's.
+        let mut resting = mouse(Reading::new(now));
+        let mut raw = egui::RawInput { events: vec![wheel()], ..Default::default() };
+        resting.raw_input_hook(true, &mut raw);
+        assert_eq!(raw.events.len(), 1);
+    }
+
+    #[test]
+    fn the_wheel_is_the_users_again_once_the_cap_has_been_still_a_moment() {
+        let mut tilted = Reading::new(Instant::now());
+        tilted.axes.rotation = [-200, 0, 0];
+        let mut cap = mouse(tilted);
+        let mut raw = egui::RawInput { events: vec![wheel()], ..Default::default() };
+        cap.raw_input_hook(true, &mut raw);
+        assert!(raw.events.is_empty(), "dropped while the cap moves");
+        // Let go, then wait out the quiet time.
+        if let Ok(mut reading) = cap.shared.lock() {
+            *reading = Reading::new(Instant::now());
+        }
+        std::thread::sleep(Duration::from_secs_f64(solidcraft_ui_egui::space_mouse::WHEEL_QUIET_S) + Duration::from_millis(60));
+        let mut raw = egui::RawInput { events: vec![wheel()], ..Default::default() };
+        cap.raw_input_hook(true, &mut raw);
+        assert_eq!(raw.events.len(), 1, "kept once the cap has been still");
    }
 }
@@ -0,0 +1,325 @@
+//! Getting the window open, whatever state the settings folder or the graphics device is in
+//! (docs/book/src/guide/troubleshooting.md).
+//!
+//! - **Settings that don't read** (`app.ron`, `graphics.json`): moved aside as
+//!   `<name>.bad-<time>` and the app starts with defaults, instead of a newer or damaged file
+//!   being dropped silently or stopping the start.
+//! - **Launches that die before the window is up**: a marker file counts them; after two in a
+//!   row the next launch starts in safe mode by itself.
+//! - **Safe mode** (`--safe-mode` or `SOLIDCRAFT_SAFE_MODE=1`): default settings (the saved ones
+//!   are left untouched), no recovery offer, the software renderer and CPU meshing.
+//! - **No usable graphics device**: one retry on the software renderer
+//!   (`SOLIDCRAFT_RENDERER=cpu`), then a message box saying what failed and what to try.
+
+use std::path::{Path, PathBuf};
+
+/// The environment variable that starts safe mode (any value but `0` or empty).
+pub const SAFE_MODE_ENV: &str = "SOLIDCRAFT_SAFE_MODE";
+/// `SOLIDCRAFT_RENDERER=cpu` picks the software renderer (WARP, lavapipe, llvmpipe).
+pub const RENDERER_ENV: &str = "SOLIDCRAFT_RENDERER";
+/// Consecutive launches that died before the window was up, after which safe mode starts.
+pub const FAILED_STARTS_FOR_SAFE_MODE: u32 = 2;
+const MARKER: &str = "starting";
+
+/// Whether an environment value switches something on.
+pub fn env_on(v: Option<&str>) -> bool {
+    v.map(str::trim).is_some_and(|v| !v.is_empty() && v != "0" && !v.eq_ignore_ascii_case("false"))
+}
+
+/// Whether `SOLIDCRAFT_RENDERER` asks for the software renderer.
+pub fn cpu_renderer_env(v: Option<&str>) -> bool {
+    v.map(str::trim).is_some_and(|v| v.eq_ignore_ascii_case("cpu") || v.eq_ignore_ascii_case("software"))
+}
+
+fn unix_now() -> u64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs())
+}
+
+/// Move `path` aside as `<name>.bad-<time>` (kept for a bug report); returns where it went.
+pub fn back_up(path: &Path) -> std::io::Result<PathBuf> {
+    let name = path.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "settings".into());
+    let mut to = path.with_file_name(format!("{name}.bad-{}", unix_now()));
+    let mut n = 1;
+    while to.exists() && n < 100 {
+        to = path.with_file_name(format!("{name}.bad-{}-{n}", unix_now()));
+        n += 1;
+    }
+    std::fs::rename(path, &to)?;
+    Ok(to)
+}
+
+/// Whether eframe's `app.ron` reads, with the preferences inside it.
+fn app_ron_reads(text: &str, prefs_keys: &[&str]) -> bool {
+    let Ok(kv) = ron::from_str::<std::collections::HashMap<String, String>>(text) else { return false };
+    prefs_keys.iter().filter_map(|k| kv.get(*k)).all(|p| serde_json::from_str::<serde_json::Value>(p).is_ok_and(|v| v.is_object()))
+}
+
+/// Check the settings files in `dir` before anything reads them: one that doesn't read is moved
+/// aside (the app then starts with defaults for it). Returns a line per file moved.
+pub fn check_settings(dir: &Path, prefs_keys: &[&str]) -> Vec<String> {
+    let mut notes = Vec::new();
+    let mut check = |name: &str, reads: &dyn Fn(&str) -> bool| {
+        let path = dir.join(name);
+        let Ok(bytes) = std::fs::read(&path) else { return };
+        let ok = std::str::from_utf8(&bytes).is_ok_and(|t| t.trim().is_empty() || reads(t));
+        if ok {
+            return;
+        }
+        match back_up(&path) {
+            Ok(to) => {
+                log::warn!("settings: {} did not read; moved to {}", path.display(), to.display());
+                notes.push(format!("{name} could not be read and was moved to {}; defaults are used.", to.display()));
+            }
+            Err(e) => log::warn!("settings: {} did not read and could not be moved: {e}", path.display()),
+        }
+    };
+    check("app.ron", &|t| app_ron_reads(t, prefs_keys));
+    check("graphics.json", &|t| serde_json::from_str::<serde_json::Value>(t).is_ok_and(|v| v.is_object()));
+    notes
+}
+
+/// A launch begins: count it in the marker in `dir`. Returns how many launches before this one
+/// died before their window was up.
+pub fn begin(dir: &Path) -> u32 {
+    let marker = dir.join(MARKER);
+    let before = std::fs::read_to_string(&marker).ok().and_then(|s| s.trim().parse::<u32>().ok()).unwrap_or(0).min(1000);
+    if std::fs::create_dir_all(dir).is_ok() {
+        let _ = std::fs::write(&marker, (before + 1).to_string());
+    }
+    before
+}
+
+/// The window is up: this launch did not fail to start.
+pub fn started(dir: &Path) {
+    let _ = std::fs::remove_file(dir.join(MARKER));
+}
+
+/// The software adapter among `adapters` (WARP on Windows, lavapipe or llvmpipe elsewhere), else
+/// the first one that can draw to `surface`.
+pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&eframe::wgpu::Surface<'_>>) -> Result<eframe::wgpu::Adapter, String> {
+    let fits = |a: &&eframe::wgpu::Adapter| surface.is_none_or(|s| a.is_surface_supported(s));
+    adapters
+        .iter()
+        .filter(fits)
+        .find(|a| a.get_info().device_type == eframe::wgpu::DeviceType::Cpu)
+        .or_else(|| adapters.iter().find(fits))
+        .cloned()
+        .ok_or_else(|| {
+            let names: Vec<String> = adapters.iter().map(|a| format!("{} ({:?})", a.get_info().name, a.get_info().backend)).collect();
+            format!("no graphics adapter can draw the window (found: {})", if names.is_empty() { "none".into() } else { names.join(", ") })
+        })
+}
+
+/// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
+pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";
+
+/// The graphics backends to start with, or `None` to leave it to wgpu (`WGPU_BACKEND`, or all
+/// the backends it was built with).
+///
+/// On Windows, D3D12 comes first, then Vulkan, then OpenGL, and only the first one with a
+/// hardware adapter is started at all. wgpu would otherwise start Vulkan, D3D12 and OpenGL
+/// together and prefer Vulkan, and starting Vulkan loads every installed Vulkan driver: Intel's
+/// (`igvk64.dll`) crashed SolidCraft at startup that way, inside the driver, before anything
+/// could be reported. D3D12 is Windows' own graphics API, the one its drivers are tested with.
+/// `has_hardware(backends)` says whether those backends have an adapter that isn't software
+/// (it is only asked about the backends being tried, one at a time).
+///
+/// - `WGPU_BACKEND` set (`env_set`): `None`, whatever it says wins.
+/// - The software renderer (`cpu`, safe mode): D3D12 alone on Windows (WARP); `None` elsewhere.
+/// - `preference` (`graphics.json`'s `backend`: `dx12`, `vulkan`, `gl` or a comma list; `auto`
+///   or empty for the order above): those backends, on any system.
+/// - Elsewhere than Windows: `None`.
+/// - No hardware adapter at all: D3D12 (WARP, Windows' software renderer).
+pub fn choose_backends(
+    windows: bool,
+    env_set: bool,
+    cpu: bool,
+    preference: Option<&str>,
+    mut has_hardware: impl FnMut(eframe::wgpu::Backends) -> bool,
+) -> Option<eframe::wgpu::Backends> {
+    use eframe::wgpu::Backends;
+    if env_set {
+        return None;
+    }
+    if cpu {
+        return windows.then_some(Backends::DX12);
+    }
+    if let Some(p) = preference.map(str::trim).filter(|p| !p.is_empty() && !p.eq_ignore_ascii_case("auto")) {
+        let chosen = Backends::from_comma_list(p);
+        if !chosen.is_empty() {
+            return Some(chosen);
+        }
+        log::warn!("graphics: unknown backend preference `{p}`; using the default order");
+    }
+    if !windows {
+        return None;
+    }
+    Some(WINDOWS_ORDER.into_iter().find(|b| has_hardware(*b)).unwrap_or(Backends::DX12))
+}
+
+/// The order backends are tried in on Windows.
+pub const WINDOWS_ORDER: [eframe::wgpu::Backends; 3] = [eframe::wgpu::Backends::DX12, eframe::wgpu::Backends::VULKAN, eframe::wgpu::Backends::GL];
+
+/// Whether `backends` (started on their own, nothing else) have a hardware adapter.
+pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
+    let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle();
+    desc.backends = backends;
+    desc.flags = eframe::wgpu::InstanceFlags::from_build_config().with_env();
+    let instance = eframe::wgpu::Instance::new(desc);
+    let adapters = pollster::block_on(instance.enumerate_adapters(backends));
+    let found: Vec<String> = adapters.iter().map(|a| format!("{} ({:?})", a.get_info().name, a.get_info().device_type)).collect();
+    log::info!("graphics: {backends:?} adapters: {found:?}");
+    adapters.iter().any(|a| a.get_info().device_type != eframe::wgpu::DeviceType::Cpu)
+}
+
+/// The message shown when no window could be opened at all.
+pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
+    let folder = settings.map(|d| d.display().to_string()).unwrap_or_else(|| "the SolidCraft settings folder".into());
+    format!(
+        "SolidCraft could not open its window.\n\n{error}\n\n\
+         The software renderer was tried too. Things to try:\n\
+         - Install or update the graphics driver (on Windows, from the GPU maker's site rather than Windows Update).\n\
+         - Over Remote Desktop or in a virtual machine, enable 3D acceleration or run it on the machine itself.\n\
+         - Start it once with `solidcraft --safe-mode`.\n\
+         - Rename the settings folder: {folder}\n\n\
+         More: https://bherbruck.github.io/solidcraft/guide/troubleshooting.html"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn scratch(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn switches_read_from_the_environment() {
+        assert!(env_on(Some("1")) && env_on(Some("yes")) && !env_on(Some("0")) && !env_on(Some(" ")) && !env_on(None) && !env_on(Some("false")));
+        assert!(cpu_renderer_env(Some("cpu")) && cpu_renderer_env(Some("Software")) && !cpu_renderer_env(Some("gpu")) && !cpu_renderer_env(None));
+    }
+
+    #[test]
+    fn settings_that_do_not_read_are_moved_aside_and_good_ones_stay() {
+        let keys = ["solidcraft.prefs", "solvecraft.prefs"];
+        let d = scratch("check");
+        // Good files (and an empty one) stay where they are.
+        std::fs::write(d.join("app.ron"), r#"{"solidcraft.prefs": "{\"grid\":true}", "egui": "(anything)"}"#).unwrap();
+        std::fs::write(d.join("graphics.json"), r#"{"msaa":4}"#).unwrap();
+        assert!(check_settings(&d, &keys).is_empty());
+        assert!(d.join("app.ron").is_file() && d.join("graphics.json").is_file());
+        // Damaged RON, preferences that aren't JSON, a truncated graphics.json, non-UTF-8 bytes.
+        for (name, text) in [
+            ("app.ron", b"{\"solidcraft.prefs\": \"{\\\"gr".as_slice()),
+            ("app.ron", br#"{"solvecraft.prefs": "not json"}"#.as_slice()),
+            ("graphics.json", br#"{"msaa":"#.as_slice()),
+            ("graphics.json", b"\xff\xfe\x00".as_slice()),
+        ] {
+            std::fs::write(d.join(name), text).unwrap();
+            let notes = check_settings(&d, &keys);
+            assert_eq!(notes.len(), 1, "{name}: {notes:?}");
+            assert!(!d.join(name).exists(), "{name} moved");
+            let kept: Vec<_> =
+                std::fs::read_dir(&d).unwrap().flatten().filter(|e| e.file_name().to_string_lossy().starts_with(&format!("{name}.bad-"))).collect();
+            assert!(kept.iter().any(|e| std::fs::read(e.path()).unwrap() == text), "{name}: the bad file is kept");
+        }
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn launches_that_never_got_a_window_are_counted_until_one_does() {
+        let d = scratch("marker");
+        assert_eq!(begin(&d), 0);
+        assert_eq!(begin(&d), 1);
+        assert_eq!(begin(&d), FAILED_STARTS_FOR_SAFE_MODE);
+        started(&d);
+        assert_eq!(begin(&d), 0);
+        // A damaged marker counts as none.
+        std::fs::write(d.join(MARKER), "zz").unwrap();
+        assert_eq!(begin(&d), 0);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn windows_starts_d3d12_first_and_vulkan_only_when_d3d12_has_no_gpu() {
+        use eframe::wgpu::Backends;
+        let probe = |with: &'static [Backends]| {
+            move |b: Backends| {
+                assert!(b == Backends::DX12 || b == Backends::VULKAN || b == Backends::GL, "one backend at a time: {b:?}");
+                with.contains(&b)
+            }
+        };
+        // D3D12 works: Vulkan and OpenGL are never even asked about (starting Vulkan loads
+        // its drivers, which is what crashed).
+        let mut asked = Vec::new();
+        let chosen = choose_backends(true, false, false, None, |b| {
+            asked.push(b);
+            b == Backends::DX12
+        });
+        assert_eq!(chosen, Some(Backends::DX12));
+        assert_eq!(asked, [Backends::DX12]);
+        // Everything works: still D3D12 alone.
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::DX12, Backends::VULKAN, Backends::GL])), Some(Backends::DX12));
+        // No D3D12 hardware adapter: Vulkan, else OpenGL, else D3D12's software adapter (WARP).
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::VULKAN, Backends::GL])), Some(Backends::VULKAN));
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::GL])), Some(Backends::GL));
+        assert_eq!(choose_backends(true, false, false, None, probe(&[])), Some(Backends::DX12));
+        // `auto` and blanks are the default order.
+        assert_eq!(choose_backends(true, false, false, Some(" auto "), probe(&[Backends::DX12])), Some(Backends::DX12));
+        assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
+    }
+
+    #[test]
+    fn wgpu_backend_the_preference_and_the_software_renderer_override_the_order() {
+        use eframe::wgpu::Backends;
+        let never = |b: Backends| -> bool { panic!("no probing expected, asked about {b:?}") };
+        // WGPU_BACKEND: wgpu reads it itself, nothing is probed.
+        assert_eq!(choose_backends(true, true, false, Some("gl"), never), None);
+        assert_eq!(choose_backends(true, true, true, None, never), None);
+        // The software renderer (safe mode, the retry): WARP through D3D12 alone, never Vulkan.
+        assert_eq!(choose_backends(true, false, true, Some("vulkan"), never), Some(Backends::DX12));
+        assert_eq!(choose_backends(false, false, true, None, never), None);
+        // The preference, on any system, without probing.
+        assert_eq!(choose_backends(true, false, false, Some("vulkan"), never), Some(Backends::VULKAN));
+        assert_eq!(choose_backends(true, false, false, Some("GL"), never), Some(Backends::GL));
+        assert_eq!(choose_backends(true, false, false, Some("dx12,vulkan"), never), Some(Backends::DX12 | Backends::VULKAN));
+        assert_eq!(choose_backends(false, false, false, Some("vulkan"), never), Some(Backends::VULKAN));
+        // An unknown preference is the default order.
+        assert_eq!(choose_backends(true, false, false, Some("glide"), |b| b == Backends::DX12), Some(Backends::DX12));
+        // Elsewhere: wgpu's own choice.
+        assert_eq!(choose_backends(false, false, false, None, never), None);
+        assert_eq!(choose_backends(false, false, false, Some("auto"), never), None);
+    }
+
+    #[test]
+    fn probing_a_backend_alone_never_panics() {
+        // Whatever this machine has (often nothing): an answer, not a crash.
+        for b in WINDOWS_ORDER {
+            let _ = has_hardware_adapter(b);
+        }
+    }
+
+    #[test]
+    fn the_message_names_the_settings_folder_and_safe_mode() {
+        let m = no_window_message("no adapter", Some(Path::new("/x/SolidCraft")));
+        assert!(m.contains("no adapter") && m.contains("/x/SolidCraft") && m.contains("--safe-mode"));
+    }
+
+    #[test]
+    fn the_software_adapter_is_preferred_and_its_absence_is_an_error_not_a_panic() {
+        assert!(pick_cpu_adapter(&[], None).unwrap_err().contains("none"));
+        let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
+        let adapters = pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all()));
+        if adapters.is_empty() {
+            return;
+        }
+        let picked = pick_cpu_adapter(&adapters, None).unwrap();
+        if adapters.iter().any(|a| a.get_info().device_type == eframe::wgpu::DeviceType::Cpu) {
+            assert_eq!(picked.get_info().device_type, eframe::wgpu::DeviceType::Cpu);
+        }
+    }
+}
@@ -75,7 +75,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 | Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `ai.storyteller.solidcraft` |
 | AppImage | Uses the Linux 256 px image and `.DirIcon` alias |
 | FreeBSD | Shares Linux hicolor images and freedesktop metadata |
-| Web | HTML/Trunk stays in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/` and uses the collected CSS; no favicon/PWA icon currently exists |
+| Web | HTML/Trunk and `manifest.webmanifest` stay in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/`, uses the collected CSS, and copies the Linux 32/256/512 px images to `icons/` for the favicon and installed app |
 | Docs and link previews | `xtask book` copies the shared card to the existing `/solidcraft/og.png` public path |

 ## Code and provenance
@@ -100,7 +100,7 @@ pub(crate) fn brand_mark(p: &egui::Painter, c: Pos2) {
    let face = |col: Color32, pts: &[(f32, f32)]| {
        p.add(egui::Shape::convex_polygon(m(pts), col, Stroke::NONE));
    };
-    let (light, mid, dark) = (Color32::from_rgb(96, 158, 236), Color32::from_rgb(58, 136, 238), Color32::from_rgb(55, 108, 197));
+    let [light, mid, dark, edge_col] = crate::theme::Tokens::get().logo;
    face(light, &[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)]);
    face(light, &[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)]);
    face(mid, &[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)]);
@@ -111,7 +111,7 @@ pub(crate) fn brand_mark(p: &egui::Painter, c: Pos2) {
    face(dark, &[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)]);
    face(dark, &[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)]);
    // White edge lines.
-    let edge = Stroke::new(10.0 * s, Color32::WHITE);
+    let edge = Stroke::new(10.0 * s, edge_col);
    let line = |pts: &[(f32, f32)]| {
        p.add(egui::Shape::line(m(pts), edge));
    };
@@ -3,13 +3,6 @@

 use egui::{Color32, Mesh, Painter, Pos2, Rect, Shape, Stroke, pos2, vec2};

-/// Surface sheets: a sheet, a second sheet beside it, a lighter sheet (an opening, a blend or
-/// round strip), and the iso lines and comb teeth drawn on sheets.
-const SHEET: Color32 = Color32::from_rgb(170, 200, 240);
-const SHEET_2: Color32 = Color32::from_rgb(150, 185, 235);
-const SHEET_LIGHT: Color32 = Color32::from_rgb(214, 229, 248);
-const SHEET_LINE: Color32 = Color32::from_rgb(127, 166, 218);
-
 /// `n + 1` points along the cubic Bézier curve with control points `c`.
 fn bezier(c: [(f32, f32); 4], n: usize) -> Vec<(f32, f32)> {
    (0..=n)
@@ -28,6 +21,19 @@ fn ellipse(x: f32, y: f32, rx: f32, ry: f32, a0: f32, a1: f32, n: usize) -> Vec<
    (0..=n).map(|i| a0 + (a1 - a0) * i as f32 / n as f32).map(|a| (x + rx * a.cos(), y + ry * a.sin())).collect()
 }

+/// A gear's toothed outline about (x, y): `n` teeth from the root radius `root` out to `tip`,
+/// turned by `phase` radians.
+fn teeth(x: f32, y: f32, root: f32, tip: f32, n: usize, phase: f32) -> Vec<(f32, f32)> {
+    let step = std::f32::consts::TAU / n as f32;
+    let at = |a: f32, r: f32| (x + r * a.cos(), y - r * a.sin());
+    (0..n)
+        .flat_map(|k| {
+            let a = phase + step * k as f32;
+            [at(a - 0.3 * step, root), at(a - 0.15 * step, tip), at(a + 0.15 * step, tip), at(a + 0.3 * step, root)]
+        })
+        .collect()
+}
+
 struct Pen<'a> {
    p: &'a Painter,
    r: Rect,
@@ -127,6 +133,12 @@ fn line_type_dot_radius(r: Rect) -> f32 {

 /// Paint the icon `name` into `r`. `accent` highlights the "action" part.
 pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, accent: Color32) {
+    paint_with(p, r, name, ink, fill, accent, &crate::theme::Tokens::get().icons);
+}
+
+/// [`paint`] with the colours an icon draws of its own given (`theme::IconColors`).
+pub(crate) fn paint_with(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, accent: Color32, ic: &crate::theme::IconColors) {
+    let ic = *ic;
    let pen = Pen { p, r, ink, fill, accent, w: (r.width() / 24.0 * 1.4).max(1.0) };
    let a = pen.accent;
    match name {
@@ -164,7 +176,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        "sphere" => {
            pen.circle(12.0, 12.0, 8.5, pen.fill, ink);
            pen.arc(12.0, 12.0, 8.5, 3.3, 6.1, ink.gamma_multiply(0.5));
-            p.circle_filled(pen.at(9.0, 8.5), 2.0 * pen.s(), Color32::from_white_alpha(160));
+            p.circle_filled(pen.at(9.0, 8.5), 2.0 * pen.s(), ic.glint);
        }
        "torus" => {
            let pts: Vec<Pos2> =
@@ -172,7 +184,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            p.add(Shape::convex_polygon(pts, pen.fill, Stroke::new(pen.w, ink)));
            let pts: Vec<Pos2> =
                (0..40).map(|i| i as f32 / 40.0 * std::f32::consts::TAU).map(|t| pen.at(12.0 + 3.5 * t.cos(), 11.0 + 1.8 * t.sin())).collect();
-            p.add(Shape::convex_polygon(pts, Color32::WHITE, Stroke::new(pen.w, ink)));
+            p.add(Shape::convex_polygon(pts, ic.highlight, Stroke::new(pen.w, ink)));
        }
        "fillet" => {
            pen.poly(&[(4.0, 20.0), (4.0, 4.0), (10.0, 4.0), (10.0, 14.0), (20.0, 14.0), (20.0, 20.0)], pen.fill, Color32::TRANSPARENT);
@@ -214,7 +226,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.poly(&[(3.0, 8.0), (21.0, 8.0), (21.0, 20.0), (3.0, 20.0)], pen.fill, ink);
            let pts: Vec<Pos2> =
                (0..32).map(|i| i as f32 / 32.0 * std::f32::consts::TAU).map(|t| pen.at(12.0 + 5.0 * t.cos(), 8.0 + 2.0 * t.sin())).collect();
-            p.add(Shape::convex_polygon(pts, Color32::WHITE, Stroke::new(pen.w, a)));
+            p.add(Shape::convex_polygon(pts, ic.highlight, Stroke::new(pen.w, a)));
            pen.line(&[(7.0, 8.0), (7.0, 16.0)], a);
            pen.line(&[(17.0, 8.0), (17.0, 16.0)], a);
        }
@@ -231,7 +243,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        }
        "shell" => {
            pen.iso_box(3.0, 9.0, 10.0, 8.0, 9.0);
-            pen.poly(&[(6.0, 9.0), (13.0, 5.5), (18.0, 8.0), (11.0, 11.5)], Color32::WHITE, a);
+            pen.poly(&[(6.0, 9.0), (13.0, 5.5), (18.0, 8.0), (11.0, 11.5)], ic.highlight, a);
        }
        "draft" => {
            pen.poly(&[(4.0, 20.0), (20.0, 20.0), (17.0, 5.0), (7.0, 5.0)], pen.fill, ink);
@@ -266,6 +278,19 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
                pen.line(&[(17.0, y), (21.0, y)], ink);
            }
        }
+        // Update: an arrow down onto a tray (a newer release can be downloaded).
+        "update" => {
+            pen.line(&[(12.0, 3.5), (12.0, 14.5)], ink);
+            pen.line(&[(7.5, 10.0), (12.0, 14.5), (16.5, 10.0)], ink);
+            pen.line(&[(4.0, 15.0), (4.0, 20.0), (20.0, 20.0), (20.0, 15.0)], ink);
+        }
+        // Agent chat: a speech bubble with three dots.
+        "agent_chat" => {
+            pen.closed(&[(4.0, 5.0), (20.0, 5.0), (20.0, 16.0), (11.0, 16.0), (6.5, 20.0), (7.5, 16.0), (4.0, 16.0)], ink);
+            for x in [8.5, 12.0, 15.5] {
+                pen.dot(x, 10.5, ink);
+            }
+        }
        // Help: a question mark in a ring.
        "help" => {
            pen.circle(12.0, 12.0, 9.0, Color32::TRANSPARENT, ink);
@@ -465,6 +490,23 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            }
            p.circle_filled(at(0.5), dot_r, a);
        }
+        "infinite" => {
+            // An infinite line (#1359): Construction's broken line, with an open arrowhead at
+            // each end saying it runs on. Accent only, like Construction and Centerline.
+            let w = line_type_stroke(r);
+            let at = |t: f32| pen.at(3.0 + 16.0 * t, 19.0 - 16.0 * t);
+            for (t0, t1) in [(0.0, 0.38), (0.62, 1.0)] {
+                p.add(Shape::line(vec![at(t0), at(t1)], Stroke::new(w, a)));
+            }
+            // Each head: two short strokes back from the tip, either side of the line.
+            let tip_len = 0.3;
+            for (tip, back) in [(0.0f32, tip_len), (1.0, 1.0 - tip_len)] {
+                let (t, b) = (at(tip), at(back));
+                let along = b - t;
+                let side = egui::vec2(-along.y, along.x) * 0.55;
+                p.add(Shape::line(vec![b + side, t, b - side], Stroke::new(w, a)));
+            }
+        }
        "c_hv" => {
            pen.line(&[(4.0, 18.0), (20.0, 18.0)], a);
            pen.line(&[(6.0, 4.0), (6.0, 14.0)], a);
@@ -472,7 +514,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        "c_coincident" => {
            pen.line(&[(3.0, 18.0), (12.0, 12.0)], ink);
            pen.line(&[(12.0, 12.0), (21.0, 16.0)], ink);
-            pen.circle(12.0, 12.0, 2.6, Color32::WHITE, a);
+            pen.circle(12.0, 12.0, 2.6, ic.highlight, a);
        }
        "c_tangent" => {
            pen.circle(12.0, 14.0, 6.0, Color32::TRANSPARENT, ink);
@@ -519,7 +561,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.arrow((x1 + (x0 - x1) * 0.15, 9.0), (x1, 9.0), ink);
        }
        "new" => {
-            pen.poly(&[(6.0, 3.0), (15.0, 3.0), (19.0, 7.0), (19.0, 21.0), (6.0, 21.0)], Color32::WHITE, ink);
+            pen.poly(&[(6.0, 3.0), (15.0, 3.0), (19.0, 7.0), (19.0, 21.0), (6.0, 21.0)], ic.highlight, ink);
            pen.line(&[(15.0, 3.0), (15.0, 7.0), (19.0, 7.0)], ink);
        }
        "open" => {
@@ -527,7 +569,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        }
        "save" => {
            pen.poly(&[(4.0, 4.0), (17.0, 4.0), (20.0, 7.0), (20.0, 20.0), (4.0, 20.0)], pen.fill, ink);
-            pen.poly(&[(8.0, 4.0), (16.0, 4.0), (16.0, 9.0), (8.0, 9.0)], Color32::WHITE, ink);
+            pen.poly(&[(8.0, 4.0), (16.0, 4.0), (16.0, 9.0), (8.0, 9.0)], ic.highlight, ink);
        }
        "export" => {
            pen.poly(&[(4.0, 10.0), (4.0, 20.0), (16.0, 20.0), (16.0, 10.0)], pen.fill, ink);
@@ -566,7 +608,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            }
        }
        "zoom" => {
-            pen.circle(10.0, 10.0, 6.0, Color32::WHITE, ink);
+            pen.circle(10.0, 10.0, 6.0, ic.highlight, ink);
            pen.line(&[(14.5, 14.5), (20.0, 20.0)], ink);
        }
        "perspective" => {
@@ -584,13 +626,13 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.iso_box(2.0, 13.0, 9.0, 6.0, 6.0);
            pen.iso_box(9.0, 6.0, 5.0, 4.0, 4.0);
        }
-        "folder" => pen.poly(&[(3.0, 7.0), (9.0, 7.0), (11.0, 9.0), (21.0, 9.0), (21.0, 19.0), (3.0, 19.0)], Color32::from_rgb(236, 200, 110), ink),
+        "folder" => pen.poly(&[(3.0, 7.0), (9.0, 7.0), (11.0, 9.0), (21.0, 9.0), (21.0, 19.0), (3.0, 19.0)], ic.folder, ink),
        "origin" => {
-            pen.arrow((6.0, 18.0), (20.0, 18.0), Color32::from_rgb(210, 60, 60));
-            pen.arrow((6.0, 18.0), (6.0, 4.0), Color32::from_rgb(60, 100, 220));
-            pen.arrow((6.0, 18.0), (15.0, 9.0), Color32::from_rgb(60, 160, 60));
+            pen.arrow((6.0, 18.0), (20.0, 18.0), ic.axes[0]);
+            pen.arrow((6.0, 18.0), (6.0, 4.0), ic.axes[2]);
+            pen.arrow((6.0, 18.0), (15.0, 9.0), ic.axes[1]);
        }
-        "plane" => pen.poly(&[(3.0, 15.0), (12.0, 8.0), (21.0, 11.0), (12.0, 18.0)], Color32::from_rgb(244, 214, 150), ink),
+        "plane" => pen.poly(&[(3.0, 15.0), (12.0, 8.0), (21.0, 11.0), (12.0, 18.0)], ic.plane, ink),
        "axis" => {
            pen.line(&[(4.0, 20.0), (20.0, 4.0)], ink);
            pen.circle(4.0, 20.0, 2.0, ink, ink);
@@ -720,6 +762,20 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.closed(&[(21.0, 6.0), (15.0, 10.0), (15.0, 18.0), (21.0, 18.0)], a);
        }
        "sketch_circ_pattern" => paint(p, r, "pattern_circ", ink, Color32::TRANSPARENT, a),
+        "pattern_flip" => {
+            // Opposing arrows show reversal, with a short reference tick between them.
+            pen.arrow((4.0, 7.0), (20.0, 7.0), a);
+            pen.arrow((20.0, 17.0), (4.0, 17.0), ink);
+            pen.line(&[(12.0, 10.0), (12.0, 14.0)], ink);
+        }
+        "pattern_center" => {
+            // An original on a reference axis, with one equally spaced copy on either side.
+            pen.line(&[(12.0, 3.0), (12.0, 21.0)], a);
+            pen.line(&[(4.0, 12.0), (20.0, 12.0)], ink);
+            for x in [4.0, 12.0, 20.0] {
+                pen.circle(x, 12.0, 2.4, fill, if x == 12.0 { a } else { ink });
+            }
+        }
        "sketch_rect_pattern" => paint(p, r, "pattern_rect", ink, Color32::TRANSPARENT, a),
        "line_mid" => {
            pen.line(&[(3.0, 19.0), (21.0, 5.0)], a);
@@ -819,8 +875,8 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            }
        }
        "accessibility" => {
-            pen.poly(&[(2.0, 20.0), (22.0, 20.0), (22.0, 15.0), (2.0, 15.0)], Color32::from_rgb(70, 180, 90), ink);
-            pen.poly(&[(8.0, 15.0), (16.0, 15.0), (16.0, 17.5), (8.0, 17.5)], Color32::from_rgb(220, 70, 60), Color32::TRANSPARENT);
+            pen.poly(&[(2.0, 20.0), (22.0, 20.0), (22.0, 15.0), (2.0, 15.0)], ic.access[0], ink);
+            pen.poly(&[(8.0, 15.0), (16.0, 15.0), (16.0, 17.5), (8.0, 17.5)], ic.access[1], Color32::TRANSPARENT);
            pen.poly(&[(6.0, 10.0), (18.0, 10.0), (18.0, 12.5), (6.0, 12.5)], pen.fill, ink);
            pen.arrow((4.0, 2.0), (4.0, 13.0), a);
            pen.arrow((20.0, 2.0), (20.0, 13.0), a);
@@ -828,10 +884,10 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        "environment_map" => {
            let pts: Vec<Pos2> =
                (0..32).map(|i| i as f32 / 32.0 * std::f32::consts::TAU).map(|t| pen.at(12.0 + 9.0 * t.cos(), 12.0 + 9.0 * t.sin())).collect();
-            p.add(Shape::convex_polygon(pts, Color32::from_rgb(190, 205, 230), Stroke::new(pen.w, ink)));
-            pen.poly(&[(3.6, 13.0), (20.4, 13.0), (18.5, 17.5), (5.5, 17.5)], Color32::from_rgb(60, 62, 70), Color32::TRANSPARENT);
-            pen.line(&[(3.2, 12.6), (20.8, 12.6)], Color32::WHITE);
-            p.circle_filled(pen.at(9.0, 8.0), 2.2 * pen.s(), Color32::WHITE);
+            p.add(Shape::convex_polygon(pts, ic.sky, Stroke::new(pen.w, ink)));
+            pen.poly(&[(3.6, 13.0), (20.4, 13.0), (18.5, 17.5), (5.5, 17.5)], ic.floor, Color32::TRANSPARENT);
+            pen.line(&[(3.2, 12.6), (20.8, 12.6)], ic.highlight);
+            p.circle_filled(pen.at(9.0, 8.0), 2.2 * pen.s(), ic.highlight);
            pen.circle(12.0, 12.0, 9.0, Color32::TRANSPARENT, ink);
        }
        "zebra" | "draft_analysis" | "curvature_map" => {
@@ -839,27 +895,23 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
                (0..32).map(|i| i as f32 / 32.0 * std::f32::consts::TAU).map(|t| pen.at(12.0 + 9.0 * t.cos(), 12.0 + 9.0 * t.sin())).collect();
            match name {
                "zebra" => {
-                    p.add(Shape::convex_polygon(pts, Color32::WHITE, Stroke::new(pen.w, ink)));
+                    p.add(Shape::convex_polygon(pts, ic.highlight, Stroke::new(pen.w, ink)));
                    for k in 0..3 {
                        let y = 6.5 + k as f32 * 4.5;
                        let h = (81.0 - (y + 1.0 - 12.0) * (y + 1.0 - 12.0)).max(0.0).sqrt();
-                        pen.poly(
-                            &[(12.0 - h, y), (12.0 + h, y), (12.0 + h, y + 2.2), (12.0 - h, y + 2.2)],
-                            Color32::from_gray(30),
-                            Color32::TRANSPARENT,
-                        );
+                        pen.poly(&[(12.0 - h, y), (12.0 + h, y), (12.0 + h, y + 2.2), (12.0 - h, y + 2.2)], ic.stripe, Color32::TRANSPARENT);
                    }
                    pen.circle(12.0, 12.0, 9.0, Color32::TRANSPARENT, ink);
                }
                "draft_analysis" => {
-                    pen.poly(&[(4.0, 20.0), (20.0, 20.0), (17.0, 5.0), (7.0, 5.0)], Color32::from_rgb(70, 180, 90), ink);
-                    pen.poly(&[(7.0, 5.0), (17.0, 5.0), (16.0, 9.0), (8.0, 9.0)], Color32::from_rgb(235, 200, 50), Color32::TRANSPARENT);
+                    pen.poly(&[(4.0, 20.0), (20.0, 20.0), (17.0, 5.0), (7.0, 5.0)], ic.draft[0], ink);
+                    pen.poly(&[(7.0, 5.0), (17.0, 5.0), (16.0, 9.0), (8.0, 9.0)], ic.draft[1], Color32::TRANSPARENT);
                    pen.arrow((12.0, 16.0), (12.0, 1.5), a);
                }
                _ => {
-                    p.add(Shape::convex_polygon(pts, Color32::from_rgb(60, 110, 230), Stroke::new(pen.w, ink)));
-                    pen.circle(14.0, 10.0, 5.0, Color32::from_rgb(70, 190, 90), Color32::TRANSPARENT);
-                    pen.circle(15.5, 8.5, 2.2, Color32::from_rgb(225, 60, 45), Color32::TRANSPARENT);
+                    p.add(Shape::convex_polygon(pts, ic.curvature[0], Stroke::new(pen.w, ink)));
+                    pen.circle(14.0, 10.0, 5.0, ic.curvature[1], Color32::TRANSPARENT);
+                    pen.circle(15.5, 8.5, 2.2, ic.curvature[2], Color32::TRANSPARENT);
                }
            }
        }
@@ -977,13 +1029,13 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        }
        "patch" => {
            // A wire loop with a surface spanned across it.
-            pen.poly(&[(4.0, 16.0), (9.0, 6.0), (19.0, 5.0), (20.0, 15.0), (12.0, 20.0)], SHEET, ink);
+            pen.poly(&[(4.0, 16.0), (9.0, 6.0), (19.0, 5.0), (20.0, 15.0), (12.0, 20.0)], ic.sheet, ink);
            pen.line(&[(4.0, 16.0), (9.0, 6.0), (19.0, 5.0), (20.0, 15.0), (12.0, 20.0), (4.0, 16.0)], a);
        }
        "stitch" => {
            // Two surface patches sewn along their shared edge.
-            pen.poly(&[(3.0, 18.0), (11.0, 14.0), (11.0, 4.0), (3.0, 8.0)], SHEET, ink);
-            pen.poly(&[(13.0, 14.0), (21.0, 18.0), (21.0, 8.0), (13.0, 4.0)], SHEET_2, ink);
+            pen.poly(&[(3.0, 18.0), (11.0, 14.0), (11.0, 4.0), (3.0, 8.0)], ic.sheet, ink);
+            pen.poly(&[(13.0, 14.0), (21.0, 18.0), (21.0, 8.0), (13.0, 4.0)], ic.sheet_2, ink);
            for y in [6.0, 9.0, 12.0] {
                pen.line(&[(10.0, y), (14.0, y + 1.5)], a);
            }
@@ -993,7 +1045,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            let f = [(2.0, 12.5), (7.0, 9.5), (12.0, 15.5), (17.0, 12.5)];
            let b = [(6.4, 8.9), (11.4, 5.9), (16.4, 11.9), (21.4, 8.9)];
            let d = f.map(|(x, y)| (x, y + 6.0));
-            pen.band(&bezier(b, 16), &bezier(f, 16), SHEET);
+            pen.band(&bezier(b, 16), &bezier(f, 16), ic.sheet);
            pen.band(&bezier(f, 16), &bezier(d, 16), pen.fill.gamma_multiply(0.85));
            pen.poly(&[(17.0, 12.5), (21.4, 8.9), (21.4, 14.9), (17.0, 18.5)], pen.fill.gamma_multiply(0.7), ink);
            pen.line(&[(2.0, 12.5), (2.0, 18.5)], ink);
@@ -1036,7 +1088,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // An open profile (accent) pulled up into a sheet.
            let top = [(4.0, 11.0), (8.0, 8.0), (13.0, 14.0), (20.0, 10.0)];
            let bottom = [(4.0, 20.0), (8.0, 17.0), (13.0, 23.0), (20.0, 19.0)];
-            pen.band(&bezier(top, 16), &bezier(bottom, 16), SHEET);
+            pen.band(&bezier(top, 16), &bezier(bottom, 16), ic.sheet);
            pen.line(&[(4.0, 11.0), (4.0, 20.0)], ink);
            pen.line(&[(20.0, 10.0), (20.0, 19.0)], ink);
            pen.curve(top, ink);
@@ -1047,13 +1099,13 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // An open profile (accent) turned about the axis into a hollow band.
            let left = [(5.0, 6.0), (7.0, 10.0), (5.0, 14.0), (6.0, 18.0)];
            let right = [(19.0, 6.0), (17.0, 10.0), (19.0, 14.0), (18.0, 18.0)];
-            pen.band(&bezier(left, 16), &bezier(right, 16), SHEET);
+            pen.band(&bezier(left, 16), &bezier(right, 16), ic.sheet);
            let front = ellipse(12.0, 18.0, 6.0, 2.2, 0.0, std::f32::consts::PI, 16);
-            pen.poly(&front, SHEET, Color32::TRANSPARENT);
+            pen.poly(&front, ic.sheet, Color32::TRANSPARENT);
            // A closed fill takes each point once: a repeated end point spikes `poly`'s edge.
            let mut opening = ellipse(12.0, 6.0, 7.0, 2.2, 0.0, std::f32::consts::TAU, 32);
            opening.pop();
-            pen.poly(&opening, SHEET_LIGHT, ink);
+            pen.poly(&opening, ic.sheet_light, ink);
            pen.line(&front, ink);
            pen.curve(left, ink);
            pen.line(&[(12.0, 1.5), (12.0, 3.8)], ink);
@@ -1064,7 +1116,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // A straight profile (accent) carried along a curved path: a ribbon.
            let near = [(4.0, 13.0), (8.0, 5.0), (14.0, 5.0), (20.0, 9.0)];
            let far = [(4.0, 20.0), (8.0, 12.0), (14.0, 12.0), (20.0, 16.0)];
-            pen.band(&bezier(near, 16), &bezier(far, 16), SHEET);
+            pen.band(&bezier(near, 16), &bezier(far, 16), ic.sheet);
            pen.curve(near, ink);
            pen.curve(far, ink);
            pen.line(&[(4.0, 13.0), (4.0, 20.0)], a);
@@ -1074,7 +1126,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // Two open sections (accent) joined by a sheet.
            let top = [(5.0, 6.0), (9.0, 3.0), (14.0, 8.0), (19.0, 5.0)];
            let bottom = [(3.0, 19.0), (8.0, 15.0), (14.0, 22.0), (21.0, 18.0)];
-            pen.band(&bezier(top, 16), &bezier(bottom, 16), SHEET);
+            pen.band(&bezier(top, 16), &bezier(bottom, 16), ic.sheet);
            pen.line(&[(5.0, 6.0), (3.0, 19.0)], ink);
            pen.line(&[(19.0, 5.0), (21.0, 18.0)], ink);
            pen.curve(top, a);
@@ -1084,7 +1136,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // A wavy sheet and its offset copy (dashed), the distance shown by the arrow.
            let back = [(6.0, 14.0), (10.0, 11.0), (15.0, 17.0), (21.0, 14.0)];
            let front = [(3.0, 20.0), (7.0, 17.0), (12.0, 23.0), (18.0, 20.0)];
-            pen.band(&bezier(back, 16), &bezier(front, 16), SHEET);
+            pen.band(&bezier(back, 16), &bezier(front, 16), ic.sheet);
            pen.curve(back, ink);
            pen.curve(front, ink);
            pen.line(&[(6.0, 14.0), (3.0, 20.0)], ink);
@@ -1098,7 +1150,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        "ruled" => {
            // A strip hanging off a block's edge (accent), ruled by straight lines.
            pen.poly(&[(2.0, 12.0), (12.0, 12.0), (12.0, 22.0), (2.0, 22.0)], pen.fill, ink);
-            pen.poly(&[(12.0, 12.0), (21.0, 4.0), (21.0, 14.0), (12.0, 22.0)], SHEET, ink);
+            pen.poly(&[(12.0, 12.0), (21.0, 4.0), (21.0, 14.0), (12.0, 22.0)], ic.sheet, ink);
            pen.line(&[(15.0, 9.3), (15.0, 19.3)], a);
            pen.line(&[(18.0, 6.7), (18.0, 16.7)], a);
            pen.line(&[(12.0, 12.0), (12.0, 22.0)], a);
@@ -1134,13 +1186,13 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
                })
                .collect();
            for (lo, hi) in rows.iter().zip(rows.iter().skip(1)) {
-                pen.band(lo, hi, SHEET);
+                pen.band(lo, hi, ic.sheet);
            }
            for j in [n / 3, 2 * n / 3] {
                if let Some(r) = rows.get(j) {
-                    pen.line(r, SHEET_LINE);
+                    pen.line(r, ic.sheet_line);
                }
-                pen.line(&rows.iter().filter_map(|r| r.get(j).copied()).collect::<Vec<_>>(), SHEET_LINE);
+                pen.line(&rows.iter().filter_map(|r| r.get(j).copied()).collect::<Vec<_>>(), ic.sheet_line);
            }
            for c in [left, top, right, bottom] {
                pen.curve(c, a);
@@ -1154,29 +1206,29 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // leaves both edges tangent.
            let near = [(13.0, 20.0), (8.5, 20.0), (10.5, 11.0), (6.0, 11.0)];
            let far = near.map(|(x, y)| (x + 4.4, y - 3.6));
-            pen.poly(&[(2.0, 11.0), (6.0, 11.0), (10.4, 7.4), (6.4, 7.4)], SHEET, ink);
-            pen.band(&bezier(near, 16), &bezier(far, 16), SHEET_LIGHT);
+            pen.poly(&[(2.0, 11.0), (6.0, 11.0), (10.4, 7.4), (6.4, 7.4)], ic.sheet, ink);
+            pen.band(&bezier(near, 16), &bezier(far, 16), ic.sheet_light);
            pen.curve(far, a);
-            pen.poly(&[(13.0, 20.0), (17.0, 20.0), (21.4, 16.4), (17.4, 16.4)], SHEET, ink);
+            pen.poly(&[(13.0, 20.0), (17.0, 20.0), (21.4, 16.4), (17.4, 16.4)], ic.sheet, ink);
            pen.curve(near, a);
        }
        "untrim" => {
            // A trimmed sheet whose hole (dashed, accent) is filled back in.
-            pen.poly(&[(3.0, 17.0), (9.0, 5.0), (21.0, 7.0), (16.0, 20.0)], SHEET, ink);
+            pen.poly(&[(3.0, 17.0), (9.0, 5.0), (21.0, 7.0), (16.0, 20.0)], ic.sheet, ink);
            let hole = ellipse(12.2, 12.3, 4.2, 3.2, 0.0, std::f32::consts::TAU, 32);
-            pen.poly(hole.get(1..).unwrap_or_default(), SHEET_LIGHT, Color32::TRANSPARENT);
+            pen.poly(hole.get(1..).unwrap_or_default(), ic.sheet_light, Color32::TRANSPARENT);
            pen.dashed(&hole, a);
        }
        "unstitch" => {
            // Two sheets pulled apart from their shared edge.
-            pen.poly(&[(2.0, 18.0), (9.0, 14.0), (9.0, 4.0), (2.0, 8.0)], SHEET, ink);
-            pen.poly(&[(15.0, 14.0), (22.0, 18.0), (22.0, 8.0), (15.0, 4.0)], SHEET_2, ink);
+            pen.poly(&[(2.0, 18.0), (9.0, 14.0), (9.0, 4.0), (2.0, 8.0)], ic.sheet, ink);
+            pen.poly(&[(15.0, 14.0), (22.0, 18.0), (22.0, 8.0), (15.0, 4.0)], ic.sheet_2, ink);
            pen.arrow((10.8, 11.0), (7.0, 11.0), a);
            pen.arrow((13.2, 11.0), (17.0, 11.0), a);
        }
        "reverse_normal" => {
            // A sheet with its old normal (faded) and the flipped one (accent).
-            pen.poly(&[(2.0, 14.0), (14.0, 10.0), (22.0, 13.0), (10.0, 18.0)], SHEET, ink);
+            pen.poly(&[(2.0, 14.0), (14.0, 10.0), (22.0, 13.0), (10.0, 18.0)], ic.sheet, ink);
            pen.arrow((12.0, 14.0), (12.0, 3.5), ink.gamma_multiply(0.5));
            pen.arrow((12.0, 14.0), (12.0, 22.5), a);
        }
@@ -1184,10 +1236,10 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            // A wall sheet and a floor sheet joined by a round strip (accent edges).
            let near = [(3.0, 16.0), (3.0, 18.8), (5.2, 21.0), (8.0, 21.0)];
            let far = near.map(|(x, y)| (x + 4.4, y - 3.6));
-            pen.poly(&[(3.0, 16.0), (3.0, 8.0), (7.4, 4.4), (7.4, 12.4)], SHEET_2, ink);
-            pen.poly(&[(8.0, 21.0), (16.0, 21.0), (20.4, 17.4), (12.4, 17.4)], SHEET, ink);
-            pen.band(&bezier(near, 16), &bezier(far, 16), SHEET_LIGHT);
-            pen.line(&[(4.5, 19.5), (8.9, 15.9)], SHEET_LINE);
+            pen.poly(&[(3.0, 16.0), (3.0, 8.0), (7.4, 4.4), (7.4, 12.4)], ic.sheet_2, ink);
+            pen.poly(&[(8.0, 21.0), (16.0, 21.0), (20.4, 17.4), (12.4, 17.4)], ic.sheet, ink);
+            pen.band(&bezier(near, 16), &bezier(far, 16), ic.sheet_light);
+            pen.line(&[(4.5, 19.5), (8.9, 15.9)], ic.sheet_line);
            pen.curve(far, a);
            pen.curve(near, a);
        }
@@ -1203,11 +1255,11 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
                let h = 0.8 + 4.2 * i as f32 / 10.0;
                let tip = (x + (y1 - y) / len * h, y - (x1 - x) / len * h);
                if i % 2 == 0 {
-                    pen.line(&[(*x, *y), tip], SHEET_LINE);
+                    pen.line(&[(*x, *y), tip], ic.sheet_line);
                }
                tips.push(tip);
            }
-            pen.line(&tips, SHEET_LINE);
+            pen.line(&tips, ic.sheet_line);
            pen.curve(c, a);
            pen.dot(12.0, 13.0, a);
        }
@@ -1241,6 +1293,14 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.arc(12.0, 12.0, 8.5, 0.3, 4.6, a);
            pen.arrow((11.0, 20.4), (14.5, 20.3), a);
        }
+        // A crank on its pivot and the closed path its far end draws (accent).
+        "trace" => {
+            pen.curve([(15.0, 13.0), (22.0, 13.0), (23.0, 3.0), (15.0, 3.0)], a);
+            pen.curve([(15.0, 3.0), (8.0, 3.0), (9.0, 13.0), (15.0, 13.0)], a);
+            pen.line(&[(5.0, 20.0), (15.0, 13.0)], ink);
+            pen.circle(5.0, 20.0, 2.4, pen.fill, ink);
+            pen.dot(15.0, 13.0, a);
+        }
        "motion_link" => {
            pen.circle(7.0, 14.0, 4.5, pen.fill, ink);
            pen.circle(17.5, 9.0, 3.0, pen.fill, ink);
@@ -1248,9 +1308,39 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
            pen.dot(7.0, 14.0, a);
            pen.dot(17.5, 9.0, a);
        }
+        // Couplings: the driven part in the accent.
+        "gear" => {
+            pen.circle(9.0, 14.0, 5.2, pen.fill, Color32::TRANSPARENT);
+            pen.closed(&teeth(9.0, 14.0, 5.2, 6.8, 9, 0.0), ink);
+            pen.dot(9.0, 14.0, ink);
+            pen.circle(17.6, 7.4, 3.2, pen.fill, Color32::TRANSPARENT);
+            pen.closed(&teeth(17.6, 7.4, 3.2, 4.6, 6, 0.3), a);
+            pen.dot(17.6, 7.4, a);
+        }
+        "rack_pinion" => {
+            pen.circle(12.0, 7.4, 4.2, pen.fill, Color32::TRANSPARENT);
+            pen.closed(&teeth(12.0, 7.4, 4.2, 5.8, 8, 0.2), ink);
+            pen.dot(12.0, 7.4, ink);
+            let mut rack = vec![(2.0, 18.0)];
+            for k in 0..5 {
+                let x = 2.5 + 4.0 * k as f32;
+                rack.extend([(x, 14.3), (x + 1.0, 12.8), (x + 2.2, 12.8), (x + 3.2, 14.3)]);
+            }
+            rack.extend([(22.0, 14.3), (22.0, 18.0)]);
+            pen.closed(&rack, a);
+            pen.arrow((7.0, 21.5), (17.5, 21.5), a);
+        }
+        "screw" => {
+            pen.poly(&[(9.5, 2.0), (14.5, 2.0), (14.5, 22.0), (9.5, 22.0)], pen.fill, ink);
+            for y in [5.0, 8.0, 17.0, 20.0] {
+                pen.line(&[(9.5, y), (14.5, y - 2.0)], ink);
+            }
+            pen.poly(&[(6.0, 10.0), (18.0, 10.0), (18.0, 15.0), (6.0, 15.0)], pen.fill, a);
+            pen.arrow((21.0, 17.0), (21.0, 6.0), a);
+        }
        "interference" => {
            pen.closed(&[(3.0, 5.0), (14.0, 5.0), (14.0, 16.0), (3.0, 16.0)], ink);
-            pen.poly(&[(9.0, 10.0), (14.0, 10.0), (14.0, 16.0), (9.0, 16.0)], Color32::from_rgb(225, 70, 60), Color32::from_rgb(225, 70, 60));
+            pen.poly(&[(9.0, 10.0), (14.0, 10.0), (14.0, 16.0), (9.0, 16.0)], ic.interference, ic.interference);
            pen.closed(&[(9.0, 10.0), (21.0, 10.0), (21.0, 20.0), (9.0, 20.0)], ink);
        }
        // Sheet metal: thin plates (fill), the made or changed part in the accent.
@@ -1277,7 +1367,7 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        "fold" => {
            pen.line(&[(2.0, 18.0), (12.0, 18.0)], ink);
            pen.line(&[(12.0, 18.0), (19.0, 6.0)], a);
-            pen.line(&[(9.0, 21.0), (15.0, 15.0)], Color32::from_rgb(130, 140, 160));
+            pen.line(&[(9.0, 21.0), (15.0, 15.0)], ic.fold);
            pen.arc(12.0, 18.0, 6.0, 0.2, 1.0, a);
            pen.arrow((18.0, 16.0), (17.0, 12.5), a);
        }
@@ -1352,16 +1442,23 @@ pub fn paint(p: &Painter, r: Rect, name: &str, ink: Color32, fill: Color32, acce
        // Appearance: a shaded ball with three paint dabs.
        "appearance" => {
            pen.circle(10.0, 13.0, 7.5, pen.fill, ink);
-            pen.arc(10.0, 13.0, 4.5, 1.8, 3.2, Color32::WHITE);
-            pen.circle(18.0, 5.0, 2.6, Color32::from_rgb(220, 70, 60), ink);
-            pen.circle(20.5, 11.0, 2.6, Color32::from_rgb(70, 150, 230), ink);
-            pen.circle(19.0, 17.5, 2.6, Color32::from_rgb(240, 200, 60), ink);
+            pen.arc(10.0, 13.0, 4.5, 1.8, 3.2, ic.highlight);
+            pen.circle(18.0, 5.0, 2.6, ic.paint[0], ink);
+            pen.circle(20.5, 11.0, 2.6, ic.paint[1], ink);
+            pen.circle(19.0, 17.5, 2.6, ic.paint[2], ink);
        }
        "warning" => {
-            pen.poly(&[(12.0, 3.0), (21.0, 20.0), (3.0, 20.0)], Color32::from_rgb(250, 200, 60), ink);
+            pen.poly(&[(12.0, 3.0), (21.0, 20.0), (3.0, 20.0)], ic.warning, ink);
            pen.line(&[(12.0, 9.0), (12.0, 14.0)], ink);
            pen.dot(12.0, 17.0, ink);
        }
+        // A failed feature: a disc with a cross, a different shape from the warning's triangle, so
+        // it reads without colour (#972). Drawn in the caller's colours only.
+        "error" => {
+            pen.circle(12.0, 12.0, 10.0, pen.fill, ink);
+            pen.line(&[(8.0, 8.0), (16.0, 16.0)], ink);
+            pen.line(&[(16.0, 8.0), (8.0, 16.0)], ink);
+        }
        _ => {
            pen.poly(&[(5.0, 5.0), (19.0, 5.0), (19.0, 19.0), (5.0, 19.0)], pen.fill, ink);
        }
@@ -1424,7 +1521,7 @@ mod tests {
    /// theme's construction orange) and must not change with `ink`.
    #[test]
    fn construction_and_centerline_icons_follow_the_callers_accent_only() {
-        for name in ["construction", "centerline"] {
+        for name in ["construction", "centerline", "infinite"] {
            let base = drawn(name, Color32::BLACK, Color32::WHITE, Color32::from_rgb(1, 2, 3));
            let other_accent = drawn(name, Color32::BLACK, Color32::WHITE, Color32::from_rgb(4, 5, 6));
            assert_ne!(base, other_accent, "{name} icon must change with the caller's accent colour");
@@ -5,8 +5,9 @@ use egui::{Color32, Pos2, Stroke, vec2};

 pub(crate) fn snap(painter: &egui::Painter, c: Pos2, tip: Option<Pos2>, kind: SnapKind, col: Color32, tag: Option<&str>) {
    // A dark halo under every stroke keeps the glyph readable on light and dark faces alike.
-    let halo = Stroke::new(4.5, Color32::from_black_alpha(150));
-    let white = Stroke::new(1.5, Color32::WHITE);
+    let ic = Tokens::get().icons;
+    let halo = Stroke::new(4.5, ic.marker_halo);
+    let white = Stroke::new(1.5, ic.highlight);
    if let Some(tip) = tip {
        let d = (tip - c).normalized();
        let n = vec2(-d.y, d.x);
@@ -30,7 +31,7 @@ pub(crate) fn snap(painter: &egui::Painter, c: Pos2, tip: Option<Pos2>, kind: Sn
            }
        }
    };
-    painter.add(shape(Color32::from_black_alpha(150), Stroke::NONE, 4.0));
+    painter.add(shape(ic.marker_halo, Stroke::NONE, 4.0));
    painter.add(shape(col, Stroke::NONE, 0.0));
    match kind {
        SnapKind::FaceCenter => {
@@ -38,8 +39,8 @@ pub(crate) fn snap(painter: &egui::Painter, c: Pos2, tip: Option<Pos2>, kind: Sn
        }
        SnapKind::CircleCenter => {
            painter.circle_stroke(c, 7.0, white);
-            painter.line_segment([c - vec2(4.5, 0.0), c + vec2(4.5, 0.0)], Stroke::new(1.2, Color32::WHITE));
-            painter.line_segment([c - vec2(0.0, 4.5), c + vec2(0.0, 4.5)], Stroke::new(1.2, Color32::WHITE));
+            painter.line_segment([c - vec2(4.5, 0.0), c + vec2(4.5, 0.0)], Stroke::new(1.2, ic.highlight));
+            painter.line_segment([c - vec2(0.0, 4.5), c + vec2(0.0, 4.5)], Stroke::new(1.2, ic.highlight));
        }
        SnapKind::EdgeMid | SnapKind::Vertex => {
            painter.add(shape(Color32::TRANSPARENT, white, 0.0));
@@ -151,13 +151,12 @@ pub(crate) fn curved_arrow(painter: &egui::Painter, at: Pos2, clockwise: bool, h
 pub(crate) const AXIS_RADIUS: f32 = 11.0;
 pub(crate) fn axis_tip(painter: &egui::Painter, c: Pos2, name: &str, d: &Vec3, at: Pos2, depth: f64, hovered: bool, t: Tokens) {
    let col = if d.x != 0.0 {
-        solidcraft_engine::view::colors::AXIS_X
+        t.triad[0]
    } else if d.y != 0.0 {
-        solidcraft_engine::view::colors::AXIS_Y
+        t.triad[1]
    } else {
-        solidcraft_engine::view::colors::AXIS_Z
+        t.triad[2]
    };
-    let col = Color32::from_rgb(col.0, col.1, col.2);
    let positive = !name.starts_with('-');
    let ink = if depth < -0.01 { col.gamma_multiply(0.55) } else { col };
    painter.line_segment([c, at], Stroke::new(if positive { 2.0 } else { 1.0 }, ink));
@@ -1,14 +1,18 @@
 //! Original agent pointer and label. Animation stays with the UI controller.
 use egui::{Color32, FontId, Pos2, Shape, Stroke, vec2};
-pub(crate) const AGENT: Color32 = Color32::from_rgb(168, 85, 247);
+/// The agent pointer's colour (a theme token, so a colour vision mode can reach it).
+pub(crate) fn agent() -> Color32 {
+    crate::theme::Tokens::get().icons.agent
+}
 pub(crate) fn paint(painter: &egui::Painter, p: Pos2) {
+    let ic = crate::theme::Tokens::get().icons;
    // An arrow pointer, tip at `p`.
    let pts: Vec<Pos2> =
        [(0.0, 0.0), (0.0, 17.0), (4.5, 13.0), (7.5, 20.0), (10.5, 18.8), (7.5, 12.0), (13.0, 12.0)].iter().map(|(x, y)| p + vec2(*x, *y)).collect();
-    painter.add(Shape::convex_polygon(pts.clone(), AGENT, Stroke::NONE));
-    painter.add(Shape::closed_line(pts, Stroke::new(1.5, Color32::WHITE)));
-    let label = painter.layout_no_wrap("Agent".into(), FontId::proportional(11.0), Color32::WHITE);
+    painter.add(Shape::convex_polygon(pts.clone(), ic.agent, Stroke::NONE));
+    painter.add(Shape::closed_line(pts, Stroke::new(1.5, ic.highlight)));
+    let label = painter.layout_no_wrap("Agent".into(), FontId::proportional(11.0), ic.highlight);
    let r = egui::Rect::from_min_size(p + vec2(15.0, 18.0), label.size() + vec2(10.0, 4.0));
-    painter.rect_filled(r, 4.0, AGENT);
-    painter.galley(r.min + vec2(5.0, 2.0), label, Color32::WHITE);
+    painter.rect_filled(r, 4.0, ic.agent);
+    painter.galley(r.min + vec2(5.0, 2.0), label, ic.highlight);
 }
@@ -10,6 +10,10 @@ struct U {
    acc_u: vec4<f32>,  // accessibility map axes (xyz, offset)
    acc_v: vec4<f32>,
    eye: vec4<f32>,    // eye position, w = 1 for perspective (0: orthographic, looking along -back)
+    // analysis colours (`theme::AnalysisColors`): draft positive, between, negative; reachable,
+    // blocked; curvature flat, middle, tight
+    ana_c: array<vec4<f32>, 8>,
+    ana_f: vec4<f32>,  // x = 1: stripe the negative draft and blocked faces
 };

@group(1) @binding(2) var acc_t: texture_2d<f32>;
@@ -150,8 +154,8 @@ fn analysis(i: TOut, k: f32) -> vec4<f32> {
        // Slack of a pixel and a half, more on slopes (the map holds the pixel's highest point).
        let slack = u.ana.y * (1.0 + sqrt(max(1.0 - cn * cn, 0.0)) / max(cn, 0.05));
        let clear = dot(i.wp, d) >= top - slack;
-        var c = vec3<f32>(0.85, 0.22, 0.20);
-        if (facing && clear) { c = vec3<f32>(0.20, 0.75, 0.30); }
+        var c = u.ana_c[4].rgb;
+        if (facing && clear) { c = u.ana_c[3].rgb; } else { c = stripe(i, c); }
        return out_color(vec4<f32>(c * lit, 1.0));
    }
    if (u.ana.x > 3.5) {
@@ -171,24 +175,37 @@ fn analysis(i: TOut, k: f32) -> vec4<f32> {
    }
    if (u.ana.x < 2.5) {
        let a = degrees(asin(clamp(dot(normalize(i.n), normalize(u.pull.xyz)), -1.0, 1.0)));
-        var c = vec3<f32>(0.95, 0.80, 0.15);
-        if (a >= u.ana.y) { c = vec3<f32>(0.20, 0.75, 0.30); }
-        if (a <= -u.ana.y) { c = vec3<f32>(0.85, 0.22, 0.20); }
+        var c = u.ana_c[1].rgb;
+        if (a >= u.ana.y) { c = u.ana_c[0].rgb; }
+        if (a <= -u.ana.y) { c = stripe(i, u.ana_c[2].rgb); }
        return out_color(vec4<f32>(c * lit, 1.0));
    }
    // Curvature from how fast the normal turns across the pixel.
    let t = clamp(k * u.ana.y, 0.0, 1.0);
-    let c = select(mix(vec3<f32>(0.10, 0.80, 0.25), vec3<f32>(0.90, 0.15, 0.10), t * 2.0 - 1.0),
-                   mix(vec3<f32>(0.15, 0.35, 0.95), vec3<f32>(0.10, 0.80, 0.25), t * 2.0), t < 0.5);
+    let c = select(mix(u.ana_c[6].rgb, u.ana_c[7].rgb, t * 2.0 - 1.0), mix(u.ana_c[5].rgb, u.ana_c[6].rgb, t * 2.0), t < 0.5);
    return out_color(vec4<f32>(c * lit, 1.0));
 }

+/// A "bad" analysis face (negative draft, blocked): with the stripes on (colour vision modes), the
+/// section cap's 45 degree hatch over it, so colour is not the only cue.
+fn stripe(i: TOut, c: vec3<f32>) -> vec3<f32> {
+    if (u.ana_f.x < 0.5) { return c; }
+    let h = fract((i.pos.x + i.pos.y) / 9.0);
+    return select(c, c * 0.6, h < 0.22);
+}
+
@fragment
 fn fs_tri(i: TOut) -> @location(0) vec4<f32> {
    if (clipped(i.wp)) { discard; }
    return shade(i);
 }

+/// Reference planes: shaded like `fs_tri`, but never cut by the section plane.
+@fragment
+fn fs_tri_all(i: TOut) -> @location(0) vec4<f32> {
+    return shade(i);
+}
+
 fn shade(i: TOut) -> vec4<f32> {
    // A zero normal marks flat colour (selection fills, translucent planes).
    if (length(i.n) < 0.5) {
@@ -1,5 +1,5 @@
 //! Original light and dark palette values. Compiled by the UI theme boundary.
-use crate::theme::Tokens;
+use crate::theme::{AnalysisColors, IconColors, Tokens};
 use egui::Color32;
 impl Tokens {
    pub const fn light() -> Tokens {
@@ -75,12 +75,50 @@ impl Tokens {
            overlay: Color32::from_rgba_unmultiplied_const(255, 255, 255, 235),
            rubber_band: Color32::from_rgb(30, 120, 230),
            app_bar_text: Color32::from_rgb(230, 234, 242),
+            app_bar_hover: Color32::from_rgba_unmultiplied_const(255, 255, 255, 28),
            timeline_item: Color32::WHITE,
            timeline_item_error: Color32::from_rgb(250, 220, 220),
            timeline_marker: Color32::from_rgb(70, 76, 88),
            field: Color32::WHITE,
            box_window: Color32::from_rgb(38, 120, 218),
            box_crossing: Color32::from_rgb(40, 160, 80),
+            // Equal to `view::colors` (the engine's tags), so mapping a tag to its token
+            // changes nothing.
+            sketch_projected: Color32::from_rgb(150, 60, 190),
+            sketch_lost: Color32::from_rgb(200, 60, 90),
+            sketch_construction: Color32::from_rgb(230, 130, 40),
+            sketch_centerline: Color32::from_rgb(200, 110, 60),
+            triad: [Color32::from_rgb(220, 60, 60), Color32::from_rgb(60, 170, 60), Color32::from_rgb(60, 100, 230)],
+            gizmo: [Color32::from_rgb(225, 70, 60), Color32::from_rgb(80, 190, 80), Color32::from_rgb(70, 130, 240)],
+            bend_up: Color32::from_rgb(30, 140, 50),
+            bend_down: Color32::from_rgb(200, 90, 20),
+            interference: Color32::from_rgb(235, 45, 40),
+            analysis: AnalysisColors::DEFAULT,
+            icons: IconColors {
+                sheet: Color32::from_rgb(170, 200, 240),
+                sheet_2: Color32::from_rgb(150, 185, 235),
+                sheet_light: Color32::from_rgb(214, 229, 248),
+                sheet_line: Color32::from_rgb(127, 166, 218),
+                highlight: Color32::WHITE,
+                glint: Color32::from_rgba_premultiplied(160, 160, 160, 160),
+                folder: Color32::from_rgb(236, 200, 110),
+                plane: Color32::from_rgb(244, 214, 150),
+                fold: Color32::from_rgb(130, 140, 160),
+                stripe: Color32::from_gray(30),
+                sky: Color32::from_rgb(190, 205, 230),
+                floor: Color32::from_rgb(60, 62, 70),
+                paint: [Color32::from_rgb(220, 70, 60), Color32::from_rgb(70, 150, 230), Color32::from_rgb(240, 200, 60)],
+                axes: [Color32::from_rgb(210, 60, 60), Color32::from_rgb(60, 160, 60), Color32::from_rgb(60, 100, 220)],
+                access: [Color32::from_rgb(70, 180, 90), Color32::from_rgb(220, 70, 60)],
+                draft: [Color32::from_rgb(70, 180, 90), Color32::from_rgb(235, 200, 50)],
+                curvature: [Color32::from_rgb(60, 110, 230), Color32::from_rgb(70, 190, 90), Color32::from_rgb(225, 60, 45)],
+                interference: Color32::from_rgb(225, 70, 60),
+                warning: Color32::from_rgb(250, 200, 60),
+                agent: Color32::from_rgb(168, 85, 247),
+                marker_halo: Color32::from_black_alpha(150),
+            },
+            app_bar_icon: [Color32::from_rgb(225, 230, 238), Color32::from_rgb(120, 140, 170), Color32::from_rgb(120, 190, 255)],
+            logo: [Color32::from_rgb(96, 158, 236), Color32::from_rgb(58, 136, 238), Color32::from_rgb(55, 108, 197), Color32::WHITE],
        }
    }
    pub const fn dark() -> Tokens {
@@ -133,6 +171,60 @@ impl Tokens {
        t.field = Color32::from_rgb(30, 34, 41);
        t.box_window = Color32::from_rgb(70, 150, 255);
        t.box_crossing = Color32::from_rgb(80, 200, 120);
+        t.bend_up = Color32::from_rgb(110, 200, 120);
+        t.bend_down = Color32::from_rgb(240, 150, 80);
+        t
+    }
+
+    /// Colour vision, red-green (Protan and Deutan share it, #778): values of the theme's colours
+    /// that a weak red or green sense still tells apart. Each was measured against normal vision,
+    /// protan and deutan, with two simulations of each loss (`colour_vision_tests`).
+    pub(super) const fn red_green(self, dark: bool) -> Tokens {
+        let mut t = self;
+        let positive = [0.20, 0.45, 0.90];
+        let negative = [0.85, 0.40, 0.05];
+        t.triad[0] = Color32::from_rgb(200, 40, 40);
+        t.triad[1] = Color32::from_rgb(120, 210, 80);
+        t.gizmo[1] = Color32::from_rgb(140, 220, 90);
+        t.preview_sketch = Color32::from_rgb(80, 185, 145);
+        t.analysis.draft = [positive, [0.95, 0.90, 0.60], negative];
+        t.analysis.access = [positive, negative];
+        t.analysis.hatch = true;
+        // The icons that show the same meanings follow; on the dark toolbar the blue is a little
+        // stronger, to stay clear of the icon fill.
+        let good = if dark { Color32::from_rgb(35, 115, 245) } else { Color32::from_rgb(51, 115, 230) };
+        t.icons.axes[0] = t.triad[0];
+        t.icons.axes[1] = t.triad[1];
+        t.icons.access = [good, Color32::from_rgb(217, 102, 13)];
+        t.icons.draft = [good, Color32::from_rgb(242, 230, 153)];
+        if dark {
+            t.bend_up = Color32::from_rgb(110, 165, 255);
+            t.bend_down = Color32::from_rgb(240, 180, 70);
+            t.sketch_accent = Color32::from_rgb(150, 225, 195);
+        } else {
+            t.sketch_projected = Color32::from_rgb(205, 120, 215);
+            t.sketch_locked = Color32::from_rgb(60, 150, 120);
+            t.timeline_item_error = Color32::from_rgb(232, 196, 170);
+            t.bend_up = Color32::from_rgb(30, 100, 210);
+            t.bend_down = Color32::from_rgb(200, 120, 0);
+            t.sketch_accent = Color32::from_rgb(60, 150, 105);
+        }
+        t
+    }
+
+    /// Colour vision, blue-yellow (Tritan, #778), measured against normal vision and tritan.
+    pub(super) const fn blue_yellow(self, dark: bool) -> Tokens {
+        let mut t = self;
+        t.analysis.hatch = true;
+        t.preview_sketch = Color32::from_rgb(125, 180, 105);
+        if dark {
+            t.sketch_locked = Color32::from_rgb(140, 225, 110);
+            t.box_crossing = Color32::from_rgb(240, 110, 170);
+            t.glyph_text = Color32::from_rgb(240, 180, 165);
+        } else {
+            t.sketch_locked = Color32::from_rgb(20, 165, 70);
+            t.box_crossing = Color32::from_rgb(200, 60, 120);
+        }
        t
    }
 }
@@ -0,0 +1,17 @@
+[package]
+name = "solidcraft-derive"
+description = "SolidCraft derive macros: the walk over a feature's geometry, from role attributes on its fields"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lib]
+proc-macro = true
+
+[lints]
+workspace = true
+
+[dependencies]
+proc-macro2 = { workspace = true }
+quote = { workspace = true }
+syn = { workspace = true }
@@ -0,0 +1,280 @@
+//! `#[derive(Walk)]`: the walks over a feature (`crate::walk::Walk`), generated from the fields of
+//! a struct or an enum's variants. Each walk visits the fields in declaration order, and comes in
+//! `&` and `&mut`:
+//!
+//! - expressions (`walk_exprs`): each with its label, kind and role; the inputs' order names their
+//!   parameters (`dN`);
+//! - references (`walk_refs`): sketches by id, features and bodies by name;
+//! - geometry (`walk_geometry`): points with their roles, planes, construction references,
+//!   placement points and profile selections.
+//!
+//! What a field is, is written once, on the field, with `#[walk(...)]`:
+//!
+//! - no attribute: the field's own type walks itself (`impl Walk`): a reference (`SketchId`,
+//!   `BodyName`, `FeatureName`), a point with its role (`FacePick`, `Position`, `Dir`), a plane, a
+//!   nested struct, a list of them, or nothing for names, flags and numbers. An `Expr` or a bare
+//!   `Vec3` has no walk, so an expression or a point that does not say what it is does not
+//!   compile;
+//! - `length = label`, `angle = label`, `unitless = label`: an expression input (an `Expr`, an
+//!   optional one, a list or an array of them, or `(f64, Expr)` pairs). The label is any
+//!   expression: a `&'static str`, an array of them (one per element), or a closure
+//!   `|i: usize, n: usize| -> &'static str`; it may read the other fields;
+//! - `pinned`: a face pick that stays where it is when the feature moves;
+//!   `pick_if = cond`: a face pick when `cond` holds, else a position;
+//! - `placement`: a primitive's placement point (its X, Y and Z expressions are not inputs);
+//! - `profiles_of = sketch_field`, optionally with `when = cond`: a profile selection;
+//! - `after = field`: visit this field right after `field` instead of in declaration order (where
+//!   the parameter names already given need it);
+//! - `picks_faces`, on a nested value: its positions pick faces here (a `FaceAt` that names the
+//!   face it is on).
+//!
+//! Conditions and labels are worked out before the walk starts. The generated code names
+//! `crate::walk`, so the derive is for `solidcraft-doc`.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use proc_macro::TokenStream;
+use proc_macro2::{Span, TokenStream as Tokens};
+use quote::{format_ident, quote};
+use syn::{Data, DeriveInput, Expr, Fields, Ident, Member, parse_macro_input};
+
+#[proc_macro_derive(Walk, attributes(walk))]
+pub fn derive_walk(input: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(input as DeriveInput);
+    match expand(&input) {
+        Ok(t) => t.into(),
+        Err(e) => e.to_compile_error().into(),
+    }
+}
+
+/// A field's role in the geometry walk.
+enum Geo {
+    Points(&'static str),
+    PickIf(Expr),
+    Placement,
+    Profiles { sketch: Ident, when: Option<Expr> },
+}
+
+/// What a field is, from its `#[walk(...)]` attributes.
+#[derive(Default)]
+struct Roles {
+    geo: Option<Geo>,
+    /// The kind (`Length`, `Angle`, `Unitless`) and the label.
+    expr: Option<(&'static str, Expr)>,
+    after: Option<Ident>,
+    /// The positions inside this (nested) value pick faces here.
+    picks_faces: bool,
+}
+
+impl Roles {
+    /// No role given: the field's type walks itself.
+    fn nested(&self) -> bool {
+        self.geo.is_none() && self.expr.is_none()
+    }
+}
+
+fn roles(field: &syn::Field) -> syn::Result<Roles> {
+    let mut r = Roles::default();
+    for attr in field.attrs.iter().filter(|a| a.path().is_ident("walk")) {
+        let mut sketch = None;
+        let mut when = None;
+        attr.parse_nested_meta(|meta| {
+            let name = meta.path.get_ident().map(Ident::to_string).unwrap_or_default();
+            match name.as_str() {
+                "pinned" => r.geo = Some(Geo::Points("Pinned")),
+                "placement" => r.geo = Some(Geo::Placement),
+                "pick_if" => r.geo = Some(Geo::PickIf(meta.value()?.parse()?)),
+                "profiles_of" => sketch = Some(meta.value()?.parse::<Ident>()?),
+                "when" => when = Some(meta.value()?.parse::<Expr>()?),
+                "length" => r.expr = Some(("Length", meta.value()?.parse()?)),
+                "angle" => r.expr = Some(("Angle", meta.value()?.parse()?)),
+                "unitless" => r.expr = Some(("Unitless", meta.value()?.parse()?)),
+                "after" => r.after = Some(meta.value()?.parse()?),
+                "picks_faces" => r.picks_faces = true,
+                _ => return Err(meta.error("unknown walk role")),
+            }
+            Ok(())
+        })?;
+        if let Some(sketch) = sketch {
+            r.geo = Some(Geo::Profiles { sketch, when });
+        } else if when.is_some() {
+            return Err(syn::Error::new_spanned(attr, "`when` goes with `profiles_of`"));
+        }
+    }
+    Ok(r)
+}
+
+#[derive(Clone, Copy, PartialEq)]
+enum Which {
+    Exprs,
+    Refs,
+    Geometry,
+}
+
+/// A value worked out before the walk (a condition, a label, a sketch id) for field `b`.
+fn pre(b: &Ident, what: &str) -> Ident {
+    format_ident!("__{}_{}", what, b)
+}
+
+/// The statements that walk field `b` in walk `which`.
+fn walk_field(b: &Ident, r: &Roles, which: Which, mutable: bool) -> Tokens {
+    let w = quote!(crate::walk);
+    let each = if mutable { quote!(each_mut) } else { quote!(each) };
+    if r.nested() {
+        let m = match which {
+            Which::Exprs => "walk_exprs",
+            Which::Refs => "walk_refs",
+            Which::Geometry => "walk_geometry",
+        };
+        let m = if mutable { format_ident!("{}_mut", m) } else { format_ident!("{}", m) };
+        if r.picks_faces && which == Which::Geometry {
+            return quote! {
+                #w::Walk::#m(#b, &mut |g| f(match g { #w::Geo::Pos(p) => #w::Geo::Pick(p), g => g }));
+            };
+        }
+        return quote! { #w::Walk::#m(#b, f); };
+    }
+    match which {
+        Which::Exprs => {
+            let label = pre(b, "label");
+            match (&r.expr, &r.geo) {
+                (Some((kind, _)), _) => {
+                    let kind = Ident::new(kind, Span::call_site());
+                    quote! {
+                        #w::ExprField::#each(#b, &mut |i, n, e| f((#w::Label::at(&#label, i, n), e, #w::Kind::#kind, #w::ExprRole::Input)));
+                    }
+                }
+                (None, Some(Geo::Placement)) => quote! {
+                    #w::ExprField::#each(#b, &mut |i, n, e| f((#w::Label::at(&["X", "Y", "Z"], i, n), e, #w::Kind::Length, #w::ExprRole::Placement)));
+                },
+                _ => quote!(),
+            }
+        }
+        Which::Refs => quote!(),
+        Which::Geometry => match &r.geo {
+            Some(Geo::Points(v)) => {
+                let v = Ident::new(v, Span::call_site());
+                quote! { #w::Each::<#w::Vec3>::#each(#b, &mut |p| f(#w::Geo::#v(p))); }
+            }
+            Some(Geo::PickIf(_)) => {
+                let pick = pre(b, "pick");
+                quote! {
+                    #w::Each::<#w::Vec3>::#each(#b, &mut |p| f(if #pick { #w::Geo::Pick(p) } else { #w::Geo::Pos(p) }));
+                }
+            }
+            Some(Geo::Placement) => quote! { f(#w::Geo::Placement(#b)); },
+            Some(Geo::Profiles { .. }) => {
+                let (id, when) = (pre(b, "sketch"), pre(b, "when"));
+                quote! {
+                    if #when && let Some(id) = #id {
+                        #w::Each::<#w::ProfileSel>::#each(#b, &mut |sel| f(#w::Geo::Profiles(id, sel)));
+                    }
+                }
+            }
+            None => quote!(),
+        },
+    }
+}
+
+/// The values field `b`'s walk needs, worked out before the walk starts (the walk may hand out
+/// the fields they read).
+fn pre_values(b: &Ident, r: &Roles, which: Which) -> Tokens {
+    let w = quote!(crate::walk);
+    match (which, &r.expr, &r.geo) {
+        (Which::Exprs, Some((_, label)), _) => {
+            let l = pre(b, "label");
+            quote! { let #l = #label; }
+        }
+        (Which::Geometry, _, Some(Geo::PickIf(cond))) => {
+            let p = pre(b, "pick");
+            quote! { let #p: bool = #cond; }
+        }
+        (Which::Geometry, _, Some(Geo::Profiles { sketch, when })) => {
+            let (id, wh) = (pre(b, "sketch"), pre(b, "when"));
+            let when = when.as_ref().map_or(quote!(true), |c| quote!(#c));
+            quote! {
+                let #wh: bool = #when;
+                let mut #id: Option<u64> = None;
+                #w::Each::<crate::SketchId>::each(&*#sketch, &mut |s| #id = Some(s.0));
+            }
+        }
+        _ => quote!(),
+    }
+}
+
+/// A pattern that binds every field of `fields` by name (`_0`, `_1`… for tuple fields), and the
+/// body of walk `which` over them.
+fn arm(fields: &Fields, which: Which, mutable: bool) -> syn::Result<(Tokens, Tokens)> {
+    let mut members = Vec::new();
+    let mut walked: Vec<(Ident, Roles)> = Vec::new();
+    for (i, field) in fields.iter().enumerate() {
+        let b = field.ident.clone().unwrap_or_else(|| format_ident!("_{}", i));
+        members.push(field.ident.clone().map_or_else(|| Member::Unnamed(i.into()), Member::Named));
+        walked.push((b, roles(field)?));
+    }
+    let bindings: Vec<Ident> = walked.iter().map(|(b, _)| b.clone()).collect();
+    // `after = x` moves a field to just after `x`.
+    for b in &bindings {
+        let Some(pos) = walked.iter().position(|(x, _)| x == b) else { continue };
+        let Some(after) = walked.get(pos).and_then(|(_, r)| r.after.clone()) else { continue };
+        let moved = walked.remove(pos);
+        let Some(at) = walked.iter().position(|(x, _)| *x == after) else {
+            return Err(syn::Error::new_spanned(after, "no such field"));
+        };
+        walked.insert(at + 1, moved);
+    }
+    let mut body = Tokens::new();
+    for (b, r) in &walked {
+        body.extend(pre_values(b, r, which));
+    }
+    for (b, r) in &walked {
+        body.extend(walk_field(b, r, which, mutable));
+    }
+    let pattern = match fields {
+        Fields::Named(_) => quote!({ #(#bindings),* }),
+        Fields::Unnamed(_) => quote!({ #(#members: #bindings),* }),
+        Fields::Unit => quote!(),
+    };
+    Ok((pattern, body))
+}
+
+fn expand(input: &DeriveInput) -> syn::Result<Tokens> {
+    let name = &input.ident;
+    let (impl_generics, ty_generics, where_clause) = input.generics.split_for_impl();
+    let w = quote!(crate::walk);
+    let mut methods = Tokens::new();
+    for (which, method, item) in
+        [(Which::Exprs, "walk_exprs", "ExprItem"), (Which::Refs, "walk_refs", "RefItem"), (Which::Geometry, "walk_geometry", "GeoItem")]
+    {
+        for mutable in [false, true] {
+            let body = match &input.data {
+                Data::Struct(s) => {
+                    let (pattern, body) = arm(&s.fields, which, mutable)?;
+                    quote! { let Self #pattern = self; #body }
+                }
+                Data::Enum(e) => {
+                    let mut arms = Tokens::new();
+                    for v in &e.variants {
+                        let ident = &v.ident;
+                        let (pattern, body) = arm(&v.fields, which, mutable)?;
+                        arms.extend(quote! { Self::#ident #pattern => { #body } });
+                    }
+                    quote! { match self { #arms } }
+                }
+                Data::Union(u) => return Err(syn::Error::new_spanned(u.union_token, "unions are not walked")),
+            };
+            let (method, item, r) = if mutable {
+                (format_ident!("{}_mut", method), format_ident!("{}Mut", item), quote!(&'a mut))
+            } else {
+                (format_ident!("{}", method), format_ident!("{}", item), quote!(&'a))
+            };
+            methods.extend(quote! {
+                #[allow(unused_variables, unused_mut, clippy::needless_borrow)]
+                fn #method<'a>(#r self, f: &mut dyn FnMut(#w::#item<'a>)) { #body }
+            });
+        }
+    }
+    Ok(quote! {
+        impl #impl_generics #w::Walk for #name #ty_generics #where_clause { #methods }
+    })
+}
@@ -12,6 +12,8 @@ workspace = true
 solidcraft-geom = { workspace = true }
 solidcraft-sketch = { workspace = true }
 solidcraft-kernel = { workspace = true }
+solidcraft-render = { workspace = true }
+solidcraft-derive = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
@@ -0,0 +1,62 @@
+//! Lists the design-format changes in `src/format/`: one file per change, in `v<N>/` once a
+//! release fixed its number, else in `pending/` (see `src/format/pending/README.md`). The list is
+//! generated so that a change adds a file and never edits a line another change also edits.
+
+use std::fmt::Write as _;
+use std::path::{Path, PathBuf};
+
+/// The last format whose upgrade steps are written out in `format.rs` (`JSON_STEPS`).
+const HAND_WRITTEN: u32 = 22;
+
+fn main() {
+    let root = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap()).join("src/format");
+    println!("cargo:rerun-if-changed={}", root.display());
+    let mut folded: Vec<(u32, PathBuf)> = std::fs::read_dir(&root)
+        .unwrap_or_else(|e| panic!("{}: {e}", root.display()))
+        .filter_map(|entry| {
+            let path = entry.ok()?.path();
+            let version = path.file_name()?.to_str()?.strip_prefix('v')?.parse().ok()?;
+            path.is_dir().then_some((version, path))
+        })
+        .collect();
+    folded.sort();
+    for (i, (version, _)) in folded.iter().enumerate() {
+        let expected = HAND_WRITTEN + 1 + i as u32;
+        assert_eq!(*version, expected, "src/format/: expected v{expected}/ next, found v{version}/ (versions are contiguous)");
+    }
+    let mut out = String::new();
+    let mut mods = String::new();
+    out.push_str("/// The changes of each format after the hand-written ones, oldest first.\nconst FOLDED: &[(u32, &[Part])] = &[\n");
+    for (version, dir) in &folded {
+        let _ = writeln!(out, "    ({version}, &[");
+        parts(dir, &format!("v{version}"), &mut out, &mut mods);
+        out.push_str("    ]),\n");
+    }
+    out.push_str("];\n\n/// The changes no release has a number for yet (`src/format/pending/`).\nconst PENDING: &[Part] = &[\n");
+    parts(&root.join("pending"), "pending", &mut out, &mut mods);
+    out.push_str("];\n");
+    out.push_str(&mods);
+    let dest = PathBuf::from(std::env::var("OUT_DIR").unwrap()).join("format_parts.rs");
+    std::fs::write(dest, out).unwrap();
+}
+
+/// The `Part`s of the change files in `dir`, in file-name order, and a module for each.
+fn parts(dir: &Path, prefix: &str, out: &mut String, mods: &mut String) {
+    let Ok(entries) = std::fs::read_dir(dir) else { return };
+    let mut files: Vec<PathBuf> = entries.filter_map(|e| e.ok().map(|e| e.path())).filter(|p| p.extension().is_some_and(|x| x == "rs")).collect();
+    files.sort();
+    for path in files {
+        let name = path.file_stem().and_then(|s| s.to_str()).unwrap_or_default().to_string();
+        assert!(
+            !name.is_empty() && name.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-'),
+            "{}: name a format change file with lowercase letters, digits and dashes",
+            path.display()
+        );
+        let text = std::fs::read_to_string(&path).unwrap();
+        assert!(text.trim_start().starts_with("//!"), "{}: start a format change with a `//!` note", path.display());
+        let module = format!("{prefix}_{}", name.replace('-', "_"));
+        let step = if text.contains("fn step(") { format!("Some({module}::step)") } else { "None".into() };
+        let _ = writeln!(out, "        Part {{ name: {name:?}, step: {step} }},");
+        let _ = writeln!(mods, "#[path = {:?}]\nmod {module};", path.display().to_string());
+    }
+}
@@ -12,11 +12,34 @@ use crate::Document;

 /// A look: a name (a library entry's, or "Custom"), sRGB colour and opacity (1 = opaque).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(try_from = "LookWire")]
 pub struct Look {
    pub name: String,
    pub color: [u8; 3],
    #[serde(default = "opaque")]
    pub opacity: f64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pbr: Option<crate::pbr_appearance::PbrParameters>,
+}
+
+#[derive(Deserialize)]
+struct LookWire {
+    name: String,
+    color: [u8; 3],
+    #[serde(default = "opaque")]
+    opacity: f64,
+    #[serde(default)]
+    pbr: Option<crate::pbr_appearance::PbrParameters>,
+}
+
+impl TryFrom<LookWire> for Look {
+    type Error = String;
+    fn try_from(value: LookWire) -> std::result::Result<Self, Self::Error> {
+        if value.pbr.is_some() && value.opacity != 1.0 {
+            return Err("opaque PBR requires opacity 1; refraction/transmission is not supported".into());
+        }
+        Ok(Self { name: value.name, color: value.color, opacity: value.opacity, pbr: value.pbr })
+    }
 }

 fn opaque() -> f64 {
@@ -25,7 +48,13 @@ fn opaque() -> f64 {

 impl Look {
    pub fn custom(color: [u8; 3], opacity: f64) -> Look {
-        Look { name: "Custom".into(), color, opacity: opacity.clamp(0.0, 1.0) }
+        Look { name: "Custom".into(), color, opacity: opacity.clamp(0.0, 1.0), pbr: None }
+    }
+    pub fn opaque_surface(&self) -> crate::Result<Option<solidcraft_render::surface::OpaqueSurface>> {
+        if self.pbr.is_some() && self.opacity != 1.0 {
+            return Err(crate::DocError::Invalid("opaque PBR requires opacity 1".into()));
+        }
+        self.pbr.map(|p| p.surface(self.color).map_err(|e| crate::DocError::Invalid(e.to_string()))).transpose()
    }
    /// Colour as 0–1 fractions.
    pub fn rgb(&self) -> [f32; 3] {
@@ -109,14 +138,19 @@ pub use defaults::LIBRARY;

 /// A library appearance by name (case-insensitive).
 pub fn library(name: &str) -> Option<Look> {
-    LIBRARY.iter().find(|(n, _, _)| n.eq_ignore_ascii_case(name.trim())).map(|(n, c, o)| Look { name: n.to_string(), color: *c, opacity: *o })
+    LIBRARY.iter().find(|(n, _, _)| n.eq_ignore_ascii_case(name.trim())).map(|(n, c, o)| Look {
+        name: n.to_string(),
+        color: *c,
+        opacity: *o,
+        pbr: None,
+    })
 }

 /// The look a physical material gives a body that has no appearance of its own.
 pub fn material_look(material: &str) -> Option<Look> {
    let color = crate::material_color(material)?;
    let opacity = if material == "Glass" { 0.25 } else { 1.0 };
-    Some(Look { name: material.to_string(), color, opacity })
+    Some(Look { name: material.to_string(), color, opacity, pbr: None })
 }

 impl Document {
@@ -162,12 +196,12 @@ impl Document {
    pub fn face_colors(&self, b: &crate::ModelBody) -> Vec<(usize, Look)> {
        // Face colours the body was imported with, under the design's own.
        let to8 = |x: f32| (x.clamp(0.0, 1.0) * 255.0).round() as u8;
-        let names = crate::naming::face_names(b);
        let mut out: Vec<(usize, Look)> = match b.body.paint() {
            Some(p) => p.faces.iter().map(|f| (f.face, Look::custom(f.color.map(to8), f.opacity as f64))).collect(),
-            // Carried from an earlier version of the body: by face name.
+            // Carried from an earlier version of the body: by face name (worked out only here:
+            // the viewport asks every body for its face colours on every change).
            None => match &b.imported {
-                Some(imp) => names
+                Some(imp) => crate::naming::face_names(b)
                    .iter()
                    .enumerate()
                    .filter_map(|(i, n)| imp.faces.get(crate::naming::strip_piece(n)).map(|(c, o)| (i, Look::custom(c.map(to8), *o as f64))))
@@ -11,7 +11,7 @@
 use serde::{Deserialize, Serialize};
 use solidcraft_geom::{Plane, Vec3};

-use crate::{AxisRef, DocError, Document, FeatureKind, PatternKind, PlaneRef, Result};
+use crate::{DocError, Document, FeatureKind, PlaneRef, Result};

 /// Column-major 4×4 affine transform (`m[col][row]`).
 pub type Mat = [[f64; 4]; 4];
@@ -136,11 +136,16 @@ fn map_plane(m: &Mat, p: &Plane) -> Plane {
 fn map_plane_ref(m: &Mat, p: &mut PlaneRef) {
    match p {
        PlaneRef::Custom { plane } => *plane = map_plane(m, plane),
+        PlaneRef::Placed { origin, x_dir, y_dir } => {
+            map_point_expr(m, origin);
+            *x_dir = apply_vector(m, *x_dir);
+            *y_dir = apply_vector(m, *y_dir);
+        }
        PlaneRef::Face { plane, at, .. } => {
            *plane = map_plane(m, plane);
            *at = apply_point(m, *at);
        }
-        PlaneRef::Offset { base, .. } => map_plane_ref(m, base),
+        PlaneRef::Offset { base, .. } | PlaneRef::Flipped { base, .. } => map_plane_ref(m, base),
        PlaneRef::AtAngle { base, axis_origin, axis_dir, .. } => {
            map_plane_ref(m, base);
            *axis_origin = apply_point(m, *axis_origin);
@@ -171,7 +176,7 @@ fn map_geo_ref(m: &Mat, g: &mut crate::construct::GeoRef) {
 /// Map a point given as expressions by `m`: numbers stay numbers; a coordinate that is an
 /// expression stays one (`m · (x, y, z) + t`, written out), so it still follows its parameters.
 pub fn map_point_expr(m: &Mat, p: &mut crate::PointExpr) {
-    let num = |e: &String| e.trim().parse::<f64>().ok().filter(|v| v.is_finite());
+    let num = |e: &crate::Expr| e.trim().parse::<f64>().ok().filter(|v| v.is_finite());
    if let [Some(x), Some(y), Some(z)] = [num(&p[0]), num(&p[1]), num(&p[2])] {
        *p = crate::point_expr(apply_point(m, Vec3::new(x, y, z)));
        return;
@@ -197,164 +202,24 @@ pub fn map_point_expr(m: &Mat, p: &mut crate::PointExpr) {
        } else if constant.abs() >= 1e-12 {
            e = format!("{e} {} {} mm", if constant < 0.0 { '-' } else { '+' }, constant.abs());
        }
-        *out = e;
+        *out = e.into();
    }
 }

 impl FeatureKind {
    /// Map the feature's world geometry (points, directions, explicit planes) by `m`.
    pub fn transform_geometry(&mut self, m: &Mat) {
-        let pt = |p: &mut Vec3| *p = apply_point(m, *p);
-        let dir = |v: &mut Vec3| *v = apply_vector(m, *v);
-        match self {
-            FeatureKind::Sketch { plane, .. } | FeatureKind::ConstructionPlane { plane } | FeatureKind::Mirror { plane, .. } => {
-                map_plane_ref(m, plane)
-            }
-            FeatureKind::ConstructionAxis { def } => def.refs_mut().into_iter().for_each(|r| map_geo_ref(m, r)),
-            FeatureKind::ConstructionPoint { def } => def.refs_mut().into_iter().for_each(|r| map_geo_ref(m, r)),
-            FeatureKind::Split { plane, tool, .. } => {
-                map_plane_ref(m, plane);
-                if let Some(t) = tool {
-                    pt(&mut t.point);
-                }
-            }
-            FeatureKind::SplitFace { faces, plane, tool, .. } => {
-                faces.iter_mut().for_each(pt);
-                map_plane_ref(m, plane);
-                if let Some(t) = tool {
-                    pt(&mut t.point);
-                }
-            }
-            FeatureKind::Revolve { axis: AxisRef::Line { origin, dir: d }, .. }
-            | FeatureKind::SurfaceRevolve { axis: AxisRef::Line { origin, dir: d }, .. } => {
-                pt(origin);
-                dir(d);
-            }
-            FeatureKind::Fillet { edges, style, .. } => {
-                edges.iter_mut().for_each(pt);
-                if let crate::FilletStyle::Variable { start, .. } | crate::FilletStyle::Spline { start, .. } = style {
-                    pt(start);
-                }
-            }
-            FeatureKind::Chamfer { edges, .. } => edges.iter_mut().for_each(pt),
-            FeatureKind::Shell { faces, .. }
-            | FeatureKind::OffsetFace { faces, .. }
-            | FeatureKind::DeleteFace { faces, .. }
-            | FeatureKind::SurfaceOffset { faces, .. } => faces.iter_mut().for_each(pt),
-            FeatureKind::Draft { faces, neutral, pull, .. } => {
-                faces.iter_mut().for_each(pt);
-                map_plane_ref(m, neutral);
-                dir(pull);
-            }
-            FeatureKind::Box { corner, .. } => map_point_expr(m, corner),
-            FeatureKind::Cylinder { base, axis, .. } => {
-                map_point_expr(m, base);
-                dir(axis);
-            }
-            FeatureKind::Sphere { center, .. } | FeatureKind::Torus { center, .. } => map_point_expr(m, center),
-            FeatureKind::Pattern { pattern: PatternKind::Rectangular { dir1, dir2, .. }, .. } => {
-                dir(dir1);
-                if let Some(d) = dir2 {
-                    dir(d);
-                }
-            }
-            FeatureKind::Pattern { pattern: PatternKind::Circular { origin, axis, .. }, .. } => {
-                pt(origin);
-                dir(axis);
-            }
-            // Follows its sketch.
-            FeatureKind::Pattern { pattern: PatternKind::Path { .. }, .. } => {}
-            FeatureKind::Hole { position, direction, .. } => {
-                pt(position);
-                dir(direction);
-            }
-            FeatureKind::Thread { face, .. } => pt(face),
-            FeatureKind::SheetFlange { edges, .. } => edges.iter_mut().for_each(|e| pt(&mut e.point)),
-            FeatureKind::SheetHem { edges, .. } => edges.iter_mut().for_each(pt),
-            FeatureKind::SheetConvert { face, bends, .. } => {
-                pt(face);
-                bends.iter_mut().for_each(pt);
-            }
-            FeatureKind::SheetFold { a, b, fixed, .. } => {
-                pt(a);
-                pt(b);
-                if let Some(f) = fixed {
-                    pt(f);
-                }
-            }
-            FeatureKind::Boss { position, direction, .. } => {
-                pt(position);
-                dir(direction);
-            }
-            FeatureKind::Lip { face, .. } => pt(face),
-            FeatureKind::BoundaryFill { cells, .. } => cells.iter_mut().for_each(pt),
-            FeatureKind::Rest { position, direction, along, .. } => {
-                pt(position);
-                dir(direction);
-                if let Some(a) = along {
-                    dir(a);
-                }
-            }
-            FeatureKind::SnapFit { position, direction, hook, .. } => {
-                pt(position);
-                dir(direction);
-                dir(hook);
-            }
-            FeatureKind::SheetBase { .. } | FeatureKind::SheetContour { .. } | FeatureKind::SheetUnfold { .. } => {}
-            FeatureKind::Coil { base, axis, .. } => {
-                map_point_expr(m, base);
-                dir(axis);
-            }
-            FeatureKind::ReplaceFace { faces, target, .. } => {
-                faces.iter_mut().for_each(pt);
-                map_plane_ref(m, target);
-            }
-            FeatureKind::Align { from, to, from_normal, to_normal, .. } => {
-                pt(from);
-                pt(to);
-                if let Some(n) = from_normal {
-                    dir(n);
-                }
-                if let Some(n) = to_normal {
-                    dir(n);
-                }
-            }
-            FeatureKind::Scale { origin, .. } => pt(origin),
-            FeatureKind::Move { rotate_axis, .. } => {
-                if let Some(a) = rotate_axis {
-                    dir(a);
-                }
-            }
-            FeatureKind::Revolve { .. }
-            | FeatureKind::Extrude { .. }
-            | FeatureKind::SurfaceExtrude { .. }
-            | FeatureKind::SurfaceRevolve { .. }
-            | FeatureKind::SurfaceSweep { .. }
-            | FeatureKind::SurfaceLoft { .. }
-            | FeatureKind::Combine { .. }
-            | FeatureKind::Loft { .. }
-            | FeatureKind::Sweep { .. }
-            | FeatureKind::BoundingSolid { .. }
-            | FeatureKind::Pipe { .. }
-            | FeatureKind::Emboss { .. }
-            | FeatureKind::Rib { .. }
-            | FeatureKind::Remove { .. }
-            | FeatureKind::Stitch { .. }
-            | FeatureKind::Thicken { .. }
-            | FeatureKind::Import { .. }
-            | FeatureKind::MeshImport { .. }
-            | FeatureKind::MeshConvert { .. }
-            | FeatureKind::BodyTransfer { .. } => {}
-            FeatureKind::Patch { edges, .. } | FeatureKind::SurfaceExtend { edges, .. } => edges.iter_mut().for_each(pt),
-            FeatureKind::Unstitch { faces, .. } | FeatureKind::ReverseNormal { faces, .. } => faces.iter_mut().for_each(pt),
-            FeatureKind::SurfaceTrim { plane, tool, keep, .. } => {
-                map_plane_ref(m, plane);
-                if let Some(t) = tool {
-                    pt(&mut t.point);
-                }
-                pt(keep);
-            }
-        }
+        use crate::feature_geometry::Geo;
+        use crate::walk::Walk;
+        self.walk_geometry_mut(&mut |g| match g {
+            Geo::Pick(p) | Geo::Pos(p) => *p = apply_point(m, *p),
+            Geo::Dir(v) => *v = apply_vector(m, *v),
+            Geo::Plane(p) => map_plane_ref(m, p),
+            Geo::Construct(r) => map_geo_ref(m, r),
+            Geo::Placement(e) => map_point_expr(m, e),
+            // An Emboss cylinder is picked in its component's frame (`EmbossFace`).
+            Geo::Pinned(_) | Geo::Profiles(..) => {}
+        });
    }
 }

@@ -507,7 +372,7 @@ impl Document {
            return Err(DocError::Invalid("too many occurrences".into()));
        }
        let id = self.next_id.max(1);
-        self.next_id = id + 1;
+        self.next_id = id.checked_add(1).ok_or_else(|| DocError::Invalid("too many items in the design".into()))?;
        let cname = self.components.iter().find(|c| c.id == component).map(|c| c.name.clone()).unwrap_or_default();
        let k = self.occurrences.iter().filter(|o| o.component == component).count() + 1;
        self.occurrences.push(crate::Occurrence { id, component, parent, name: format!("{cname}:{k}"), transform, grounded: false });
@@ -78,7 +78,13 @@ mod tests {
            (vec!["bad\nname".into()], 0, crate::IDENTITY),
            (vec!["Block".into()], 0, scaled),
        ] {
-            assert!(doc.add_feature(crate::FeatureKind::BodyTransfer { bodies, from, to: 0, transform }, None).is_err());
+            assert!(
+                doc.add_feature(
+                    crate::FeatureKind::BodyTransfer { bodies: bodies.into_iter().map(crate::BodyName).collect(), from, to: 0, transform },
+                    None
+                )
+                .is_err()
+            );
            assert_eq!(doc.to_json(), before);
        }
    }
@@ -3,83 +3,7 @@

 use std::collections::BTreeMap;

-use crate::{FeatureKind, PatternKind, PlaneRef};
-
-fn plane_names(p: &mut PlaneRef, names: &BTreeMap<String, String>) {
-    let mut p = p;
-    for _ in 0..64 {
-        match p {
-            PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => p = base,
-            PlaneRef::Construction { name } => {
-                if let Some(n) = names.get(name) {
-                    *name = n.clone();
-                }
-                return;
-            }
-            _ => return,
-        }
-    }
-}
-
-impl FeatureKind {
-    /// Point references to sketches (by id) and features (by name) at their copies.
-    pub fn remap_refs(&mut self, sketches: &BTreeMap<u64, u64>, names: &BTreeMap<String, String>) {
-        let sk = |id: &mut u64| {
-            if let Some(n) = sketches.get(id) {
-                *id = *n;
-            }
-        };
-        let feats = |list: &mut Vec<String>| {
-            for x in list.iter_mut() {
-                if let Some(n) = names.get(x) {
-                    *x = n.clone();
-                }
-            }
-        };
-        match self {
-            FeatureKind::Sketch { plane, .. } | FeatureKind::ConstructionPlane { plane } | FeatureKind::Split { plane, .. } => {
-                plane_names(plane, names)
-            }
-            FeatureKind::SplitFace { plane, sketch, .. } => {
-                plane_names(plane, names);
-                if let Some(s) = sketch {
-                    sk(s);
-                }
-            }
-            FeatureKind::Extrude { sketch, .. }
-            | FeatureKind::SurfaceExtrude { sketch, .. }
-            | FeatureKind::SurfaceRevolve { sketch, .. }
-            | FeatureKind::Revolve { sketch, .. }
-            | FeatureKind::Emboss { sketch, .. }
-            | FeatureKind::SheetBase { sketch, .. }
-            | FeatureKind::SheetContour { sketch, .. }
-            | FeatureKind::Rib { sketch, .. } => sk(sketch),
-            FeatureKind::Patch { sketch: Some(s), .. } => sk(s),
-            FeatureKind::Sweep { sketch, path_sketch, .. } | FeatureKind::SurfaceSweep { sketch, path_sketch, .. } => {
-                sk(sketch);
-                sk(path_sketch);
-            }
-            FeatureKind::Pipe { path_sketch, .. } => sk(path_sketch),
-            FeatureKind::SheetFold { sketch: Some(s), .. } => sk(s),
-            FeatureKind::Loft { sections, .. } => sections.iter_mut().for_each(|s| sk(&mut s.sketch)),
-            FeatureKind::SurfaceLoft { sections } => sections.iter_mut().for_each(|s| sk(&mut s.sketch)),
-            FeatureKind::Hole { points: Some(p), .. } => sk(&mut p.sketch),
-            FeatureKind::Pattern { features, pattern, .. } => {
-                feats(features);
-                if let PatternKind::Path { path_sketch, .. } = pattern {
-                    sk(path_sketch);
-                }
-            }
-            FeatureKind::Mirror { features, plane, .. } => {
-                feats(features);
-                plane_names(plane, names);
-            }
-            FeatureKind::Draft { neutral, .. } => plane_names(neutral, names),
-            FeatureKind::ReplaceFace { target, .. } => plane_names(target, names),
-            _ => {}
-        }
-    }
-}
+use crate::{FeatureKind, PlaneRef};

 /// Remap persistent topology tokens without rewriting arbitrary user expressions or labels.
 pub fn remap_topology(name: &str, ids: &BTreeMap<u64, u64>, bodies: &BTreeMap<String, String>) -> String {
@@ -189,8 +113,10 @@ fn remap_plane(
        return Err(crate::DocError::Invalid("clone plane reference depth exceeded".into()));
    }
    match p {
-        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => remap_plane(base, ids, names, bodies, depth + 1)?,
-        PlaneRef::Construction { name } => mapped_name(name, names),
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => {
+            remap_plane(base, ids, names, bodies, depth + 1)?
+        }
+        PlaneRef::Construction { name } => mapped_name(&mut name.0, names),
        PlaneRef::Face { name, anchor, .. } => {
            if let Some(name) = name {
                *name = remap_topology(name, ids, bodies);
@@ -246,92 +172,6 @@ fn remap_link(
    }
 }

-impl FeatureKind {
-    /// Point the body names a feature acts on (targets, tools, the body it rounds…) at the
-    /// copies in `bodies`; names not in the map stay as they are.
-    pub fn remap_bodies(&mut self, bodies: &BTreeMap<String, String>) {
-        use FeatureKind as K;
-        match self {
-            K::Emboss { face: Some(face), .. } => mapped_name(&mut face.body, bodies),
-            K::Split { tool: Some(tool), .. } | K::SplitFace { tool: Some(tool), .. } | K::SurfaceTrim { tool: Some(tool), .. } => {
-                mapped_name(&mut tool.body, bodies)
-            }
-            _ => {}
-        }
-        match self {
-            K::Extrude { targets, .. }
-            | K::Revolve { targets, .. }
-            | K::Loft { targets, .. }
-            | K::Sweep { targets, .. }
-            | K::Pipe { targets, .. }
-            | K::Emboss { targets, .. } => {
-                for n in targets {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::Combine { target, tools, .. } => {
-                mapped_name(target, bodies);
-                for n in tools {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::Pattern { bodies: list, .. }
-            | K::Mirror { bodies: list, .. }
-            | K::Scale { bodies: list, .. }
-            | K::BoundingSolid { bodies: list, .. }
-            | K::Align { bodies: list, .. }
-            | K::Remove { bodies: list }
-            | K::Stitch { bodies: list, .. }
-            | K::Move { bodies: list, .. }
-            | K::BodyTransfer { bodies: list, .. } => {
-                for n in list {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::Thicken { bodies: list, targets, .. } => {
-                for n in list.iter_mut().chain(targets) {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::BoundaryFill { tools, .. } => {
-                for n in tools {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::Fillet { body, .. }
-            | K::Chamfer { body, .. }
-            | K::Shell { body, .. }
-            | K::Draft { body, .. }
-            | K::SplitFace { body, .. }
-            | K::OffsetFace { body, .. }
-            | K::DeleteFace { body, .. }
-            | K::SurfaceOffset { body, .. }
-            | K::ReplaceFace { body, .. }
-            | K::SheetFlange { body, .. }
-            | K::SheetHem { body, .. }
-            | K::SheetFold { body, .. }
-            | K::SheetUnfold { body, .. }
-            | K::Boss { body, .. }
-            | K::Lip { body, .. }
-            | K::SnapFit { body, .. }
-            | K::Rest { body, .. }
-            | K::Patch { body, .. } => {
-                if let Some(n) = body {
-                    mapped_name(n, bodies);
-                }
-            }
-            K::Split { body, .. }
-            | K::SheetConvert { body, .. }
-            | K::SurfaceExtend { body, .. }
-            | K::SurfaceTrim { body, .. }
-            | K::Unstitch { body, .. }
-            | K::ReverseNormal { body, .. }
-            | K::MeshConvert { body, .. } => mapped_name(body, bodies),
-            _ => {}
-        }
-    }
-}
-
 impl crate::Feature {
    /// Clone identities through typed reference fields. Sketch-local entity IDs stay local.
    pub fn remap_clone(
@@ -356,6 +196,7 @@ impl crate::Feature {
            | K::SurfaceTrim { plane, .. } => checked_plane(plane, 0)?,
            K::Draft { neutral, .. } => checked_plane(neutral, 0)?,
            K::ReplaceFace { target, .. } => checked_plane(target, 0)?,
+            K::SurfaceExtend { up_to: Some(crate::ExtendTo::Plane(plane)), .. } => checked_plane(plane, 0)?,
            K::ConstructionAxis { def } => {
                for r in def.refs() {
                    checked_geo(r, 0)?;
@@ -382,10 +223,10 @@ impl crate::Feature {
            *n = remap_topology(n, ids, bodies);
        }
        for (_, e, _) in self.kind.inputs_mut() {
-            *e = clone_expression(e, parameters);
+            *e = clone_expression(e, parameters).into();
        }
-        for e in self.kind.point_expr_mut().into_iter().flatten() {
-            *e = clone_expression(e, parameters);
+        for e in self.kind.placement_exprs_mut() {
+            *e = clone_expression(e, parameters).into();
        }
        self.kind.remap_bodies(bodies);
        match &mut self.kind {
@@ -396,6 +237,9 @@ impl crate::Feature {
                        mapped_name(n, parameters);
                    }
                }
+                for e in sketch.text_exprs_mut() {
+                    *e = clone_expression(e, parameters);
+                }
                for link in &mut sketch.links {
                    remap_link(&mut link.source, ids, names, bodies, 0);
                    for n in link.face_name.iter_mut().chain(&mut link.edge_name) {
@@ -410,6 +254,7 @@ impl crate::Feature {
            | K::SurfaceTrim { plane, .. } => remap_plane(plane, ids, names, bodies, 0)?,
            K::Draft { neutral, .. } => remap_plane(neutral, ids, names, bodies, 0)?,
            K::ReplaceFace { target, .. } => remap_plane(target, ids, names, bodies, 0)?,
+            K::SurfaceExtend { up_to: Some(crate::ExtendTo::Plane(plane)), .. } => remap_plane(plane, ids, names, bodies, 0)?,
            K::ConstructionAxis { def } => {
                for r in def.refs_mut() {
                    remap_geo(r, ids, names, bodies, 0)?;
@@ -440,7 +285,7 @@ fn checked_plane(p: &PlaneRef, depth: usize) -> crate::Result<()> {
        return Err(crate::DocError::Invalid("copy reference nesting exceeds 64".into()));
    }
    match p {
-        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => checked_plane(base, depth + 1)?,
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => checked_plane(base, depth + 1)?,
        PlaneRef::Midplane { a, b } | PlaneRef::TwoEdges { a, b } => {
            checked_geo(a, depth + 1)?;
            checked_geo(b, depth + 1)?;
@@ -148,6 +148,35 @@ pub(crate) fn extrude_cap_bindings(sketch: &SolvedSketch, bodies: &[solidcraft_k
    Some(bindings)
 }

+/// Cap signatures for a thin extrude (#1519). A thin wall's caps are bounded by offset curves
+/// the sketch doesn't have, so [`extrude_cap_bindings`] can never certify them. A wall built
+/// from one region is signed by the curves it follows instead: the cap of this extrude whose
+/// wall runs along them. That is the signature its solid caps had when the wall follows the
+/// whole profile (a rectangle's four lines), so a sketch attached to a solid cap keeps its face
+/// when the extrude is made thin, and the other way round. Several regions (walls apart, or one
+/// meeting itself) are left uncertified: they keep their history names.
+pub(crate) fn thin_extrude_cap_bindings(curves: &[String], regions: usize, bodies: &[solidcraft_kernel::Body]) -> CapBindings {
+    use solidcraft_kernel::FaceSource;
+    let mut outer = curves.to_vec();
+    outer.sort();
+    outer.dedup();
+    let signed = regions == 1 && bodies.len() == 1 && valid_signature(&outer, &[]);
+    bodies
+        .iter()
+        .map(|body| {
+            let sources: Vec<_> = body.face_sources().into_iter().flatten().collect();
+            let ends =
+                |high: bool| sources.iter().filter(|source| matches!(source, Some(FaceSource::ExtrudeCap { high: h, .. }) if *h == high)).count();
+            // One cap at each end, or none of them is certified.
+            let unique = ends(true) <= 1 && ends(false) <= 1;
+            sources
+                .iter()
+                .map(|source| (signed && unique && matches!(source, Some(FaceSource::ExtrudeCap { .. }))).then(|| (outer.clone(), Vec::new())))
+                .collect()
+        })
+        .collect()
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
 pub enum FaceCertificate {
@@ -17,7 +17,7 @@ fn shell_document() -> (Document, u64, u64) {
    let shell = doc
        .add_feature(
            FeatureKind::Shell {
-                faces: vec![Vec3::new(5., 6., 10.)],
+                faces: vec![crate::FacePick(Vec3::new(5., 6., 10.))],
                thickness: "wall".into(),
                body: Some("Case".into()),
                direction: "inside".into(),
@@ -118,7 +118,8 @@ fn shell_planar_anchor_rebuild_cold_geometry_and_missing_source_errors() {
    let boss = doc
        .add_feature(
            FeatureKind::Extrude {
-                sketch: sk,
+                thin: None,
+                sketch: crate::SketchId(sk),
                profiles: crate::ProfileSel::All,
                extent: serde_json::from_value(json!({"distance":"2"})).unwrap(),
                operation: crate::Operation::NewBody,
@@ -280,7 +281,8 @@ fn saved_former_strip_projection_reports_lost_without_expanding_healthy_material
    let boss = doc
        .add_feature(
            FeatureKind::Extrude {
-                sketch: sk,
+                thin: None,
+                sketch: crate::SketchId(sk),
                profiles: crate::ProfileSel::All,
                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
                operation: crate::Operation::NewBody,
@@ -342,7 +344,7 @@ fn saved_curved_strip_projection_is_lost_after_exact_wall_coalescence() {
    let shell = doc
        .add_feature(
            FeatureKind::Shell {
-                faces: vec![Vec3::new(0., 0., 30.)],
+                faces: vec![crate::FacePick(Vec3::new(0., 0., 30.))],
                thickness: "wall".into(),
                body: Some("Case".into()),
                direction: "inside".into(),
@@ -429,7 +431,8 @@ fn saved_curved_strip_projection_is_lost_after_exact_wall_coalescence() {
    let boss = doc
        .add_feature(
            FeatureKind::Extrude {
-                sketch: sk,
+                thin: None,
+                sketch: crate::SketchId(sk),
                profiles: crate::ProfileSel::All,
                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
                operation: crate::Operation::NewBody,
@@ -553,7 +556,8 @@ fn saved_stepped_tab_cut_piece_projection_is_lost_without_expanding_material() {
    let material = doc
        .add_feature(
            FeatureKind::Extrude {
-                sketch: sk,
+                thin: None,
+                sketch: crate::SketchId(sk),
                profiles: crate::ProfileSel::All,
                extent: serde_json::from_value(json!({"distance":"1"})).unwrap(),
                operation: crate::Operation::NewBody,
@@ -82,7 +82,7 @@ pub enum PointDef {
    /// Where an edge (line) crosses a plane.
    EdgeAndPlane { edge: GeoRef, plane: GeoRef },
    /// At a fraction `t` (0…1) of the way along an edge or sketch curve.
-    AlongPath { path: GeoRef, t: String },
+    AlongPath { path: GeoRef, t: crate::Expr },
 }

 /// Resolved construction geometry, kept in the model state by feature.
@@ -125,10 +125,15 @@ fn construct<'a>(st: &'a ModelState, name: &str) -> Result<&'a ConstructGeom> {

 /// The face picked: (body, face index, point on it).
 fn face_of<'a>(st: &'a ModelState, at: Vec3, name: &Option<String>) -> Result<(&'a ModelBody, usize, Vec3)> {
-    let at = match name.as_deref().and_then(|n| crate::naming::point_on_face(st, n, at)) {
-        Some((q, _)) => q,
-        None => at,
-    };
+    // The named face itself: its nearest point to the old pick can lie on an edge it shares
+    // (a corner round that a parameter moved away from the pick), where picking again by the
+    // point finds the flat face beside it (#1255).
+    if let Some(hit) = name.as_deref().and_then(|n| crate::name_lookup::locate_face(st, n, at))
+        && let Some(b) = st.bodies.get(hit.body).filter(|b| !b.body.is_mesh())
+        && hit.face < b.body.face_count()
+    {
+        return Ok((b, hit.face, hit.point));
+    }
    for b in bodies(st) {
        if let Some(fi) = crate::appearance::face_index_at(b, at) {
            return Ok((b, fi, at));
@@ -575,15 +580,6 @@ impl GeoRef {
    }
 }

-impl GeoRef {
-    fn plane_ref(&self) -> Option<&PlaneRef> {
-        match self {
-            GeoRef::Plane { plane } => Some(plane),
-            _ => None,
-        }
-    }
-}
-
 impl AxisDef {
    pub fn refs(&self) -> Vec<&GeoRef> {
        match self {
@@ -594,11 +590,6 @@ impl AxisDef {
        }
    }

-    /// Planes it refers to (whose expressions it depends on).
-    pub fn planes(&self) -> Vec<&PlaneRef> {
-        self.refs().into_iter().filter_map(GeoRef::plane_ref).collect()
-    }
-
    pub fn refs_mut(&mut self) -> Vec<&mut GeoRef> {
        match self {
            AxisDef::ThroughFace { face } => vec![face],
@@ -621,10 +612,6 @@ impl PointDef {
        }
    }

-    pub fn planes(&self) -> Vec<&PlaneRef> {
-        self.refs().into_iter().filter_map(GeoRef::plane_ref).collect()
-    }
-
    pub fn refs_mut(&mut self) -> Vec<&mut GeoRef> {
        match self {
            PointDef::At { point } => vec![point],
@@ -646,7 +633,7 @@ impl PlaneRef {
            PlaneRef::ThreePoints { a, b, c } => vec![a.as_mut(), b.as_mut(), c.as_mut()],
            PlaneRef::Tangent { face, .. } => vec![face.as_mut()],
            PlaneRef::AlongPath { path, .. } => vec![path.as_mut()],
-            PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => base.refs_mut(),
+            PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => base.refs_mut(),
            _ => Vec::new(),
        }
    }
@@ -0,0 +1,248 @@
+//! How finely the viewport tessellates curved faces and edges (Preferences ▸ Graphics ▸ Display
+//! quality). A viewing preference, not design data: it only picks the tolerances of the display
+//! plan ([`crate::ModelBody::display_plan`]) the viewport draws. The reference mesh the model
+//! reads (picks, holes, measuring) and exports keep their own tolerances.
+
+use std::sync::atomic::{AtomicU8, Ordering};
+
+/// A display quality level.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum DisplayQuality {
+    Coarse,
+    #[default]
+    Normal,
+    Fine,
+    Ultra,
+}
+
+impl DisplayQuality {
+    pub const ALL: [DisplayQuality; 4] = [DisplayQuality::Coarse, DisplayQuality::Normal, DisplayQuality::Fine, DisplayQuality::Ultra];
+
+    /// The id kept in the settings file.
+    pub fn id(self) -> &'static str {
+        match self {
+            DisplayQuality::Coarse => "coarse",
+            DisplayQuality::Normal => "normal",
+            DisplayQuality::Fine => "fine",
+            DisplayQuality::Ultra => "ultra",
+        }
+    }
+
+    pub fn parse(id: &str) -> Option<DisplayQuality> {
+        Self::ALL.into_iter().find(|q| q.id() == id)
+    }
+
+    /// Position in [`DisplayQuality::ALL`] (indexes the per-level display caches).
+    pub fn index(self) -> usize {
+        self as usize
+    }
+
+    /// Chord tolerance as a fraction of the body's size: the largest gap allowed between a
+    /// facet and its surface.
+    pub fn chord_fraction(self) -> f64 {
+        match self {
+            DisplayQuality::Coarse => 3e-3,
+            DisplayQuality::Normal => 1e-3,
+            DisplayQuality::Fine => 3e-4,
+            DisplayQuality::Ultra => 1e-4,
+        }
+    }
+
+    /// Smallest chord tolerance (mm), so a tiny body does not mesh down to nothing.
+    pub fn min_chord(self) -> f64 {
+        match self {
+            DisplayQuality::Coarse => 3e-3,
+            DisplayQuality::Normal => 1e-3,
+            DisplayQuality::Fine => 3e-4,
+            DisplayQuality::Ultra => 1e-4,
+        }
+    }
+
+    /// Most a facet of a curved face or edge may turn (radians), so a small radius on a large
+    /// body still looks round.
+    pub fn angle(self) -> f64 {
+        let deg: f64 = match self {
+            DisplayQuality::Coarse => 30.0,
+            DisplayQuality::Normal => 20.0,
+            DisplayQuality::Fine => 12.0,
+            DisplayQuality::Ultra => 7.0,
+        };
+        deg.to_radians()
+    }
+
+    /// The chord tolerance (mm) for a body of this size.
+    pub fn chord(self, size: f64) -> f64 {
+        let size = if size.is_finite() && size > 0.0 { size } else { 0.0 };
+        (size * self.chord_fraction()).max(self.min_chord())
+    }
+}
+
+/// Most refinement steps view-dependent display refinement takes past the chosen level (#1320):
+/// each halves the chord tolerance, so the finest is 1/16 of the chosen level's.
+pub const MAX_REFINE: u8 = 4;
+
+/// Screen-space error (physical pixels) above which a body is refined: a facet's sag shows.
+pub const REFINE_PX: f64 = 1.0;
+/// Error a refinement aims for (below [`REFINE_PX`], so a body just refined is not refined again
+/// at the next small zoom step).
+pub const TARGET_PX: f64 = 0.75;
+/// Error below which a refined body steps back toward the chosen level. A refinement lands
+/// between half [`TARGET_PX`] and [`TARGET_PX`], and a step back between this and twice this, so
+/// zooming out or in by up to 2× from either never flips the level back.
+pub const COARSEN_PX: f64 = 0.175;
+
+impl DisplayQuality {
+    /// Chord tolerance (mm) of a body of this size refined `k` steps past this level: halved
+    /// per step.
+    pub fn refined_chord(self, size: f64, k: u8) -> f64 {
+        self.chord(size) / f64::from(1u32 << k.min(MAX_REFINE))
+    }
+
+    /// Facet angle (radians) `k` steps past this level: an arc's sag goes with the square of its
+    /// angle, so the angle shrinks by √2 per step, keeping pace with the chord.
+    pub fn refined_angle(self, k: u8) -> f64 {
+        self.angle() / std::f64::consts::SQRT_2.powi(i32::from(k.min(MAX_REFINE)))
+    }
+}
+
+/// The refinement step a body should be drawn at (0: the chosen level), from `err_px`: the
+/// screen-space error of the chosen level, its chord tolerance in physical pixels where the body
+/// is nearest the eye (0 for a body off screen or too small to matter). `current` is the step
+/// drawn now; steps halve the error. A body is refined once its error passes [`REFINE_PX`], to the
+/// first step under [`TARGET_PX`], and steps back only once the error falls under [`COARSEN_PX`],
+/// to the coarsest step that stays under twice that: the band between keeps an orbit or a small
+/// zoom from flipping levels. Never past `max` (at most [`MAX_REFINE`]).
+pub fn refinement_for(err_px: f64, current: u8, max: u8) -> u8 {
+    let max = max.min(MAX_REFINE);
+    let current = current.min(max);
+    if !(err_px.is_finite() && err_px > 0.0) {
+        return 0;
+    }
+    let err = |k: u8| err_px / f64::from(1u32 << k);
+    if err(current) > REFINE_PX {
+        (current..=max).find(|&k| err(k) <= TARGET_PX).unwrap_or(max)
+    } else if err(current) < COARSEN_PX {
+        (0..=current).find(|&k| err(k) <= 2.0 * COARSEN_PX).unwrap_or(current)
+    } else {
+        current
+    }
+}
+
+static CURRENT: AtomicU8 = AtomicU8::new(1);
+
+/// The level the viewport draws at (process-wide; set from the preferences).
+pub fn current() -> DisplayQuality {
+    DisplayQuality::ALL.get(CURRENT.load(Ordering::Relaxed) as usize).copied().unwrap_or_default()
+}
+
+/// Set the level the viewport draws at. Bodies keep a display plan per level, so switching back
+/// is instant and nothing is re-evaluated.
+pub fn set_current(q: DisplayQuality) {
+    CURRENT.store(q.index() as u8, Ordering::Relaxed);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn normal_is_the_application_tolerance_and_levels_get_finer() {
+        let n = DisplayQuality::Normal;
+        assert_eq!(n.chord(200.0), 0.2);
+        assert_eq!(n.chord(0.5), 1e-3);
+        assert!((n.angle() - solidcraft_kernel::DISPLAY_ANGLE).abs() < 1e-12);
+        for w in DisplayQuality::ALL.windows(2) {
+            assert!(w[1].chord(100.0) < w[0].chord(100.0) && w[1].angle() < w[0].angle());
+        }
+        for q in DisplayQuality::ALL {
+            assert_eq!(DisplayQuality::parse(q.id()), Some(q));
+            assert_eq!(DisplayQuality::ALL[q.index()], q);
+        }
+    }
+
+    /// Each level keeps its own plan: finer levels draw a round body with more triangles and
+    /// closer to the surface, and the reference mesh the model reads never changes.
+    #[test]
+    fn each_level_has_its_own_plan_and_the_reference_mesh_stays() {
+        use solidcraft_geom::Vec3;
+        let body = solidcraft_kernel::cylinder(Vec3::ZERO, Vec3::Z, 20.0, 50.0).unwrap();
+        let mb = crate::ModelBody::new("Body1".into(), body, 1);
+        let reference = mb.mesh();
+        let mut last = 0;
+        for q in DisplayQuality::ALL {
+            let mesh = mb.plan_mesh_at(q).unwrap();
+            let r = |v: Vec3| (v.x * v.x + v.y * v.y).sqrt();
+            // The worst chord's sag on the side wall, from its triangle centres.
+            let sag = mesh
+                .triangles
+                .iter()
+                .map(|t| t.map(|i| mesh.positions[i as usize]))
+                .filter(|t| t.iter().all(|p| (r(*p) - 20.0).abs() < 1e-9))
+                .map(|[a, b, c]| 20.0 - r((a + b + c) * (1.0 / 3.0)))
+                .fold(0.0, f64::max);
+            assert!(sag <= q.chord(mb.body.size()) * 1.01, "{q:?}: sag {sag}");
+            assert!(mesh.triangles.len() > last, "{q:?}: {} triangles", mesh.triangles.len());
+            last = mesh.triangles.len();
+            assert!(std::sync::Arc::ptr_eq(&mesh, &mb.plan_mesh_at(q).unwrap()), "made once per level");
+        }
+        assert!(std::sync::Arc::ptr_eq(&reference, &mb.mesh()));
+        assert_eq!(mb.display_plan_at(DisplayQuality::Normal).unwrap().vertex_count(), {
+            let plan = mb.body.display_plan_angular((mb.body.size() * 1e-3).max(1e-3), solidcraft_kernel::DISPLAY_ANGLE).unwrap();
+            plan.vertex_count()
+        });
+    }
+
+    #[test]
+    fn refinement_follows_the_screen_space_error_with_hysteresis() {
+        // Off screen or tiny: the chosen level.
+        assert_eq!(refinement_for(0.0, 3, MAX_REFINE), 0);
+        assert_eq!(refinement_for(f64::NAN, 2, MAX_REFINE), 0);
+        // Fine already: stays.
+        assert_eq!(refinement_for(0.6, 0, MAX_REFINE), 0);
+        assert_eq!(refinement_for(1.0, 0, MAX_REFINE), 0);
+        // Past a pixel: the first step under the target (each halves the error).
+        assert_eq!(refinement_for(1.2, 0, MAX_REFINE), 1);
+        assert_eq!(refinement_for(5.0, 0, MAX_REFINE), 3);
+        assert_eq!(refinement_for(5.0, 1, MAX_REFINE), 3);
+        // Capped.
+        assert_eq!(refinement_for(1e6, 0, MAX_REFINE), MAX_REFINE);
+        assert_eq!(refinement_for(1e6, 0, 2), 2);
+        assert_eq!(refinement_for(1e6, 9, 99), MAX_REFINE);
+        // Zooming back out: kept until the error is well under a pixel, then the coarsest step
+        // that stays under half a pixel.
+        assert_eq!(refinement_for(5.0, 3, MAX_REFINE), 3);
+        assert_eq!(refinement_for(2.5, 3, MAX_REFINE), 3, "0.31 px at step 3: in the band");
+        assert_eq!(refinement_for(1.2, 3, MAX_REFINE), 2, "0.15 px at step 3: down to 0.3 px");
+        assert_eq!(refinement_for(0.05, 3, MAX_REFINE), 0);
+        // No flicker: any error, once settled, gives the same step again, and a zoom by up to
+        // 2x either way from where a level was chosen keeps it.
+        let mut e = 0.01;
+        while e < 1e4 {
+            for start in 0..=MAX_REFINE {
+                let k = refinement_for(e, start, MAX_REFINE);
+                assert_eq!(refinement_for(e, k, MAX_REFINE), k, "error {e}, from {start}");
+                // Settled by zooming in (from the chosen level) or out (from the finest).
+                if start == 0 || start == MAX_REFINE {
+                    for f in [0.5, 0.7, 1.0, 1.4, 2.0] {
+                        let back = refinement_for(e * f, k, MAX_REFINE);
+                        let zoomed_in = f >= 1.0;
+                        assert!(
+                            back == k || (zoomed_in && back > k && start == 0) || (!zoomed_in && back < k && start == MAX_REFINE),
+                            "error {e} x{f} from {start}: {k} -> {back}"
+                        );
+                    }
+                }
+            }
+            e *= 1.13;
+        }
+    }
+
+    #[test]
+    fn refined_steps_halve_the_chord() {
+        let q = DisplayQuality::Normal;
+        assert_eq!(q.refined_chord(200.0, 0), q.chord(200.0));
+        assert_eq!(q.refined_chord(200.0, 2), q.chord(200.0) / 4.0);
+        assert_eq!(q.refined_chord(200.0, 99), q.chord(200.0) / 16.0);
+        assert!((q.refined_angle(2) - q.angle() / 2.0).abs() < 1e-12);
+    }
+}
@@ -10,7 +10,7 @@ use solidcraft_geom::{Loop2, Seg2};
 pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState) -> Result<()> {
    match &f.kind {
        FeatureKind::Emboss { sketch, profiles, depth, deboss, targets, face } => {
-            let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
+            let ss = st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?;
            let regions = select_profiles(ss, profiles)?;
            let d = val(vals, depth, Kind::Length)?;
            if !(d > 0.0) {
@@ -35,7 +35,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
                    crate::apply_vector(&sketch_transform, ss.plane.y),
                )
                .ok_or_else(|| DocError::Invalid("invalid cylinder sketch frame".into()))?;
-                let mut at = crate::apply_point(&crate::mat_mul(&inverse, &author_frame), face.at);
+                let mut at = crate::apply_point(&crate::mat_mul(&inverse, &author_frame), face.at.0);
                let name = f
                    .face_names
                    .first()
@@ -67,10 +67,10 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            if st.bodies.is_empty() {
                return Err(DocError::Invalid("there is no body to emboss".into()));
            }
-            apply_op(st, f, tools, if *deboss { Operation::Cut } else { Operation::Join }, targets)
+            apply_op(st, f, tools, if *deboss { Operation::Cut } else { Operation::Join }, &crate::plain(targets))
        }
        FeatureKind::Rib { sketch, curves, thickness, depth, flip, web } => {
-            let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
+            let ss = st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
            let t = val(vals, thickness, Kind::Length)?;
            if !(t > 0.0) {
                return Err(DocError::Invalid("the rib thickness must be positive".into()));
@@ -95,17 +95,18 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
        FeatureKind::ReplaceFace { faces, target, body } => {
            let tp = doc.resolve_plane_in(vals, target, 0, Some(st))?;
            let tn = tp.normal();
-            let i = body_at(st, body, faces)?;
+            let i = body_at(st, body, &crate::plain(faces))?;
            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
            let mut b = mb.body.clone();
            for p in faces {
-                let n = planar_normal_at(&b, *p).ok_or_else(|| DocError::Invalid("not supported yet: replacing a face that is not planar".into()))?;
+                let n =
+                    planar_normal_at(&b, p.0).ok_or_else(|| DocError::Invalid("not supported yet: replacing a face that is not planar".into()))?;
                if n.dot(tn).abs() < 1.0 - 1e-9 {
                    return Err(DocError::Invalid("not supported yet: a target that is not parallel to the face".into()));
                }
-                let d = (tp.origin - *p).dot(n);
+                let d = (tp.origin - p.0).dot(n);
                if d.abs() > 1e-9 {
-                    b = kernel::offset_faces(&b, &[*p], d)?;
+                    b = kernel::offset_faces(&b, &[p.0], d)?;
                }
            }
            if let Some(slot) = st.bodies.get_mut(i) {
@@ -115,17 +116,17 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
        }
        FeatureKind::Align { bodies, from, to, from_normal, to_normal, flip } => {
            let mut m = translation(Vec3::ZERO);
-            if let (Some(a), Some(b)) = (from_normal.and_then(Vec3::normalized), to_normal.and_then(Vec3::normalized)) {
+            if let (Some(a), Some(b)) = (from_normal.and_then(|n| n.normalized()), to_normal.and_then(|n| n.normalized())) {
                // Turn `a` onto −b (faces meet) or b (flipped), about the `from` point.
                let want = if *flip { b } else { b * -1.0 };
                let axis = a.cross(want);
                let ang = axis.len().atan2(a.dot(want));
                let axis = axis.normalized().unwrap_or_else(|| a.any_perp());
                if ang.abs() > 1e-12 {
-                    m = rotation(*from, axis, ang);
+                    m = rotation(from.0, axis, ang);
                }
            }
-            let d = *to - *from;
+            let d = to.0 - from.0;
            m[3][0] += d.x;
            m[3][1] += d.y;
            m[3][2] += d.z;
@@ -150,23 +151,32 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
                    return Err(DocError::Unknown(format!("body `{n}`")));
                }
            }
-            st.bodies.retain(|b| !bodies.contains(&b.name));
+            st.bodies.retain(|b| !bodies.iter().any(|t| *t == b.name));
            Ok(())
        }
        _ => Err(DocError::Invalid(format!("{} is not evaluated here", f.name))),
    }
 }

-/// Unit outward normal of the planar face through `p`.
+/// Unit outward normal of the planar face through `p`: of the planar faces whose plane runs
+/// through it, the one nearest it. A face elsewhere in such a plane (the wall of a notch, the end
+/// of a rib, in line with a rim) is no pick of `p`, though its plane runs through it as exactly.
 fn planar_normal_at(b: &Body, p: Vec3) -> Option<Vec3> {
    let tol = (b.size() * 2e-3).max(1e-3);
    let faces = b.faces(tol).ok()?;
+    let mesh = b.tessellate(tol).ok()?;
+    let mut near = vec![f64::INFINITY; faces.len()];
+    for (t, f) in mesh.triangles.iter().zip(&mesh.tri_face) {
+        if let (Some([u, v, w]), Some(d)) = (mesh.tri(t), near.get_mut(*f as usize)) {
+            *d = d.min(crate::appearance::closest_on_triangle(p, u, v, w).dist(p));
+        }
+    }
    faces
        .iter()
-        .filter_map(|f| f.plane_normal.map(|n| (n, ((p - f.centroid).dot(n)).abs())))
-        .filter(|(_, d)| *d < tol * 5.0)
-        .min_by(|a, b| a.1.total_cmp(&b.1))
-        .map(|(n, _)| n)
+        .filter_map(|f| f.plane_normal.map(|n| (n, ((p - f.centroid).dot(n)).abs(), near.get(f.index).copied().unwrap_or(f64::INFINITY))))
+        .filter(|(_, d, _)| *d < tol * 5.0)
+        .min_by(|a, b| a.2.total_cmp(&b.2).then(a.1.total_cmp(&b.1)))
+        .map(|(n, _, _)| n)
 }

 /// The curves of a chain as one polyline in sketch coordinates, in order.
@@ -322,7 +332,7 @@ fn rebuild_sheet(st: &mut ModelState, idx: usize) -> Result<()> {
 }

 /// The sheet a feature works on: by body name, else the one with an edge nearest the pick.
-fn sheet_for(st: &ModelState, body: &Option<String>, pick: Option<Vec3>) -> Result<usize> {
+fn sheet_for(st: &ModelState, body: &Option<crate::BodyName>, pick: Option<Vec3>) -> Result<usize> {
    if let Some(n) = body {
        return st.sheets.iter().position(|s| &s.body == n).ok_or_else(|| DocError::Invalid(format!("`{n}` is not a sheet metal body")));
    }
@@ -382,7 +392,7 @@ pub(super) fn sheet_eval(
    use crate::sheet;
    match &f.kind {
        FeatureKind::SheetBase { sketch, profiles, rule, flip } => {
-            let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
+            let ss = st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
            let regions = solidcraft_sketch::merge_regions(&select_profiles(&ss, profiles)?);
            let r = doc.sheet_rule(rule.as_deref());
            let rv = doc.rule_values(vals, &r)?;
@@ -416,7 +426,7 @@ pub(super) fn sheet_eval(
            Ok(())
        }
        FeatureKind::SheetContour { sketch, curves, distance, rule, flip, reverse } => {
-            let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
+            let ss = st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch}")))?.clone();
            for id in curves {
                let ci = ss.sketch.curve_index(id).ok_or_else(|| DocError::Unknown(format!("curve `{id}`")))?;
                if !ss.sketch.segs(ci).iter().all(|s| matches!(s, Seg2::Line { .. })) {
@@ -440,8 +450,8 @@ pub(super) fn sheet_eval(
            st.sheets.push(sh);
            Ok(())
        }
-        FeatureKind::SheetFlange { edges, height, angle, radius, position, flip, body } => {
-            let i = sheet_for(st, body, edges.first().map(|e| e.point))?;
+        FeatureKind::SheetFlange { edges, height, angle, radius, position, flip, body, corner_relief_shape, corner_relief } => {
+            let i = sheet_for(st, body, edges.first().map(|e| e.point.0))?;
            let (h, a) = (val(vals, height, Kind::Length)?, val(vals, angle, Kind::Angle)?);
            // Each edge's own height and angle, else the feature's.
            let mut own = Vec::with_capacity(edges.len());
@@ -463,18 +473,32 @@ pub(super) fn sheet_eval(
                    doc.rule_values(vals, &doc.sheet_rule(Some(&rule)))?.bend_radius
                }
            };
+            // The corner relief these flanges ask for in place of the rule's.
+            let relief = sheet::ReliefOverride {
+                shape: match corner_relief_shape {
+                    Some(name) => Some(
+                        sheet::ReliefShape::parse(name)
+                            .ok_or_else(|| DocError::Invalid(format!("unknown corner relief shape `{name}` (notch, round, rectangular or tear)")))?,
+                    ),
+                    None => None,
+                },
+                size: match corner_relief {
+                    Some(e) => Some(val(vals, e, Kind::Length)?),
+                    None => None,
+                },
+            };
            let sh = st.sheets.get_mut(i).ok_or_else(|| DocError::Invalid("sheet".into()))?;
            if sh.flat {
                return Err(DocError::Invalid("refold the sheet before adding flanges".into()));
            }
-            let points: Vec<Vec3> = edges.iter().map(|e| e.point).collect();
+            let points: Vec<Vec3> = edges.iter().map(|e| e.point.0).collect();
            let each: Vec<sheet::EdgeFlange> = sheet_picks(sh, f, &points, warning)
                .into_iter()
                .zip(own)
                .map(|(pick, (height, angle))| sheet::EdgeFlange { pick, height, angle })
                .collect();
            let n0 = sh.flanges.len();
-            let (_, notes) = sh.add_flanges_each(&each, rr, position, *flip)?;
+            let (_, notes) = sh.add_flanges_each(&each, rr, position, *flip, relief)?;
            if !notes.is_empty() {
                let notes = notes.join("; ");
                *warning = Some(match warning.take() {
@@ -485,8 +509,34 @@ pub(super) fn sheet_eval(
            tag_flanges(sh, n0, f.id);
            rebuild_sheet(st, i)
        }
+        FeatureKind::SheetPerforate { diameter, pitch, margin, pattern, body } => {
+            // Without a body name the field goes on the newest sheet, as the command's own body lookup does.
+            let i = match body {
+                Some(_) => sheet_for(st, body, None)?,
+                None => st.sheets.len().checked_sub(1).ok_or_else(|| DocError::Invalid("there is no sheet metal body".into()))?,
+            };
+            let d = val(vals, diameter, Kind::Length)?;
+            let pitch = val(vals, pitch, Kind::Length)?;
+            let margin = match margin {
+                Some(e) => val(vals, e, Kind::Length)?,
+                None => d,
+            };
+            let square = match pattern.as_deref() {
+                None | Some("staggered") => false,
+                Some("square") => true,
+                Some(o) => return Err(DocError::Invalid(format!("perforation pattern {o:?}: use \"staggered\" or \"square\""))),
+            };
+            if !(d > 0.0 && pitch > d && margin >= 0.0) {
+                return Err(DocError::Invalid(format!(
+                    "perforation needs diameter > 0, pitch > diameter and margin >= 0 (diameter {d}, pitch {pitch}, margin {margin})"
+                )));
+            }
+            let sh = st.sheets.get_mut(i).ok_or_else(|| DocError::Invalid("sheet".into()))?;
+            sh.perforations.push(crate::sheet::SheetPerforation { feature: f.id, diameter: d, pitch, margin, square });
+            Ok(())
+        }
        FeatureKind::SheetHem { edges, length, gap, flip, body } => {
-            let i = sheet_for(st, body, edges.first().copied())?;
+            let i = sheet_for(st, body, edges.first().copied().map(Vec3::from))?;
            let l = val(vals, length, Kind::Length)?;
            let g = match gap {
                Some(e) => val(vals, e, Kind::Length)?,
@@ -496,7 +546,7 @@ pub(super) fn sheet_eval(
                }
            };
            let sh = st.sheets.get_mut(i).ok_or_else(|| DocError::Invalid("sheet".into()))?;
-            let picks = sheet_picks(sh, f, edges, warning);
+            let picks = sheet_picks(sh, f, &crate::plain(edges), warning);
            let n0 = sh.flanges.len();
            for e in &picks {
                sh.add_hem(*e, l, g, *flip)?;
@@ -508,14 +558,14 @@ pub(super) fn sheet_eval(
            // The sketch line, where it is now.
            let (a, b) = match (sketch, curve) {
                (Some(sk), Some(c)) => {
-                    let ss = st.sketch(*sk).ok_or_else(|| DocError::Unknown(format!("sketch {sk}")))?;
+                    let ss = st.sketch(sk.0).ok_or_else(|| DocError::Unknown(format!("sketch {sk}")))?;
                    let ci = ss.sketch.curve_index(c).ok_or_else(|| DocError::Unknown(format!("curve `{c}`")))?;
                    match ss.sketch.segs(ci).as_slice() {
                        [Seg2::Line { a, b }] => (ss.plane.to_world(*a), ss.plane.to_world(*b)),
                        _ => return Err(DocError::Invalid("the fold line must be a sketch line".into())),
                    }
                }
-                _ => (*a, *b),
+                _ => (a.0, b.0),
            };
            let i = sheet_for(st, body, Some((a + b) * 0.5))?;
            let ang = val(vals, angle, Kind::Angle)?;
@@ -529,7 +579,7 @@ pub(super) fn sheet_eval(
            // A fixed point that touches no material at all (e.g. far above the sheet) still picks
            // the side it lies on, so a stored fold keeps recomputing; it says so (#371).
            if let Some(p) = fixed
-                && !on_sheet_material(st, i, *p)
+                && !on_sheet_material(st, i, p.0)
            {
                *warning = Some(format!(
                    "{} at ({:.3}, {:.3}, {:.3}); the side of the fold line it lies on stays",
@@ -544,7 +594,7 @@ pub(super) fn sheet_eval(
                return Err(DocError::Invalid("refold the sheet before folding it".into()));
            }
            let n0 = sh.flanges.len();
-            sh.add_fold(a, b, ang, rr, position, *flip, *fixed, warning)?;
+            sh.add_fold(a, b, ang, rr, position, *flip, fixed.map(Vec3::from), warning)?;
            tag_flanges(sh, n0, f.id);
            rebuild_sheet(st, i)
        }
@@ -569,7 +619,7 @@ pub(super) fn sheet_eval(
            let mut picks = Vec::with_capacity(bends.len());
            for (i, p) in bends.iter().enumerate() {
                let name = f.edge_names.get(i).filter(|n| !n.is_empty());
-                picks.push(match name.map(|n| (n, crate::naming::locate_edge(&mb, n, *p))) {
+                picks.push(match name.map(|n| (n, crate::naming::locate_edge(&mb, n, p.0))) {
                    Some((n, Ok(hit))) => {
                        if let Some(note) = hit.note(n) {
                            append_warning(warning, note);
@@ -578,38 +628,54 @@ pub(super) fn sheet_eval(
                    }
                    Some((n, Err(_))) => {
                        append_warning(warning, format!("edge `{n}` no longer exists; using the edge at the picked point"));
-                        *p
+                        p.0
                    }
-                    None => *p,
+                    None => p.0,
                });
            }
-            let mut sh = sheet::convert_body(&mb, &r.name, &rv, *face, &picks)?;
+            let (mut sh, notes) = sheet::convert_body(&mb, &r.name, &rv, face.0, &picks)?;
+            for note in notes {
+                append_warning(warning, note);
+            }
            tag_flanges(&mut sh, 0, f.id);
            put_sheet(st, sh)
        }
        FeatureKind::SheetConvert { body, face, rule, .. } => {
            let mb = st.body(body).cloned().ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
-            let n = planar_normal_at(&mb.body, *face).ok_or_else(|| DocError::Invalid("pick a planar face of the plate".into()))?;
-            let tol = (mb.body.size() * 1e-3).max(1e-3);
-            let mesh = mb.body.tessellate(tol)?;
+            let n = planar_normal_at(&mb.body, face.0).ok_or_else(|| DocError::Invalid("pick a planar face of the plate".into()))?;
            // Thickness: the body's extent along the face normal.
-            let ds: Vec<f64> = mesh.positions.iter().map(|p| (*p - *face).dot(n)).collect();
-            let (lo, hi) = (ds.iter().cloned().fold(f64::MAX, f64::min), ds.iter().cloned().fold(f64::MIN, f64::max));
+            let extent = |mesh: &solidcraft_geom::Mesh| {
+                mesh.positions.iter().map(|p| (*p - face.0).dot(n)).fold((f64::MAX, f64::MIN), |(lo, hi), d| (lo.min(d), hi.max(d)))
+            };
+            // The tolerance (the mesh's chords, and how far off the face's plane a point of it may
+            // be) is at most a tenth of the thickness, not only a thousandth of the size. On a long
+            // thin plate that thousandth passes the thickness: the far side's triangles counted as
+            // this face's (no outline was left), and a hole of a smaller radius than that fell out.
+            let mut tol = (mb.body.size() * 1e-3).max(1e-3);
+            let mut mesh = mb.body.tessellate(tol)?;
+            let (mut lo, mut hi) = extent(&mesh);
+            if hi - lo > 0.0 && tol > (hi - lo) * 0.1 {
+                tol = ((hi - lo) * 0.1).max(1e-6);
+                mesh = mb.body.tessellate(tol)?;
+                (lo, hi) = extent(&mesh);
+            }
            let t = hi - lo;
            // The face outline: boundary edges of the triangles on that face's plane, where it runs
            // along a round wall an arc of the wall's circle (not chords: the plate check below
            // compares its area with the exact volume).
-            let plane = Plane::from_normal(*face + n * lo, n * -1.0).ok_or_else(|| DocError::Invalid("face".into()))?;
+            let plane = Plane::from_normal(face.0 + n * lo, n * -1.0).ok_or_else(|| DocError::Invalid("face".into()))?;
+            // Recesses in one face (an engraved label) become pockets; the outline is the other face's.
+            let recesses = plate_recesses(&mb.body, &mesh, &plane, face.0, n, (lo, hi), tol)?;
            let mut walls = std::collections::HashMap::new();
-            let mut wall = |f: u32| *walls.entry(f).or_insert_with(|| round_wall(&mb.body, &plane, n, f));
+            let mut wall = |f: u32| *walls.entry(f).or_insert_with(|| sheet::round_wall(&mb.body, &plane, n, f));
            let mut loops: Vec<Loop2> =
-                face_outline(&mesh, &plane, *face, n, lo, tol).iter().map(|l| outline_loop(l, &mut wall, tol * 1e-2)).collect();
+                face_outline(&mesh, &plane, face.0, n, recesses.level, tol).iter().map(|l| sheet::outline_loop(l, &mut wall, tol * 1e-2)).collect();
            loops.sort_by(|a, b| b.signed_area().abs().total_cmp(&a.signed_area().abs()));
            let mut it = loops.into_iter();
            let outer = it.next().ok_or_else(|| DocError::Invalid("no outline on that face".into()))?.ccw();
            let region = Region2 { outer, holes: it.map(|l| l.ccw().reversed()).collect() };
            let area = region.area().abs();
-            let vol = kernel::measure(&mb.body)?.volume;
+            let vol = kernel::measure(&mb.body)?.volume + recesses.volume;
            if (area * t - vol).abs() > 1e-3 * vol.max(1.0) {
                return Err(DocError::Invalid(
                    "not supported yet: converting bodies that are not a plate of even thickness without bend edges (`bends`)".into(),
@@ -620,6 +686,10 @@ pub(super) fn sheet_eval(
            rv.thickness = t;
            let mut sh = sheet::base_flange(body, &r.name, &rv, plane, Region2 { outer: region.outer.clone(), holes: Vec::new() });
            sh.holes = region.holes.iter().map(|h| Region2 { outer: h.ccw(), holes: Vec::new() }).collect();
+            let mut work = sheet::FlatWork::new();
+            for (pocket, z0, z1) in recesses.pockets {
+                sh.record_pocket(pocket, z0, z1, &mut work)?;
+            }
            put_sheet(st, sh)
        }
        _ => Err(DocError::Invalid(format!("{} is not a sheet metal feature", f.name))),
@@ -683,7 +753,11 @@ fn sheet_tool_span(body: &Body, source: &Plane) -> Option<(f64, f64, f64, Option
            }
            // Bound floating point projection separately from model geometry tolerance.
            let roundoff = 128.0 * f64::EPSILON * (plane.origin.len() + current.origin.len() + source.origin.len()).max(1.0);
-            if roundoff > 1e-7 || (current.origin - plane.origin).dot(n).abs() > roundoff {
+            // The cap's current point lies off the recorded plane by the noise of evaluating
+            // its edges, which its fitted tilt shows across the distance between the two points
+            // (8e-12 over 2.4 mm on a 45° flange's drill, #1255; none on axis-aligned caps).
+            let noise = current.normal().cross(n).len() * (current.origin - plane.origin).len();
+            if roundoff > 1e-7 || (current.origin - plane.origin).dot(n).abs() > roundoff + noise {
                return None;
            }
            projection_roundoff = projection_roundoff.max(roundoff);
@@ -705,14 +779,24 @@ pub(super) fn sheet_cut(
    tools: &[Body],
    targets: &[String],
    constructor: Option<&ExtrudeConstructor>,
+    warning: &mut Option<String>,
 ) -> Result<Vec<String>> {
    let FeatureKind::Extrude { sketch, profiles, operation, extent, .. } = &f.kind else { return Ok(Vec::new()) };
    if extent.taper.is_some() || !any_eligible_sheet(f, st, targets) {
        return Ok(Vec::new());
    }
-    let Some(ss) = st.sketch(*sketch).cloned() else { return Ok(Vec::new()) };
+    let Some(ss) = st.sketch(sketch.0).cloned() else { return Ok(Vec::new()) };
    let regions = solidcraft_sketch::merge_regions(&select_profiles(&ss, profiles)?);
-    sheet_prism_cut(f, st, &ss.plane, &regions, *operation, tools, targets, constructor, extent.to.is_some())
+    // The outlines of the sketch's text: the sheet remembers where its letters went.
+    let text: Vec<Seg2> = ss
+        .sketch
+        .links
+        .iter()
+        .filter(|l| matches!(l.source, solidcraft_sketch::LinkSource::Text { .. }))
+        .flat_map(|l| ss.sketch.link_curves(&l.id))
+        .flat_map(|ci| ss.sketch.exact_segs(ci).unwrap_or_else(|| ss.sketch.segs(ci)))
+        .collect();
+    sheet_prism_cut(f, st, &ss.plane, &regions, *operation, tools, targets, constructor, extent.to.is_some(), &text, warning)
 }

 /// Whether a cut of `f` with these targets (else its participants, else its component's
@@ -744,6 +828,7 @@ pub(super) fn sheet_primitive_cut(
    prism: PrimitivePrism,
    operation: Operation,
    drill: bool,
+    warning: &mut Option<String>,
 ) -> Result<Vec<String>> {
    if !matches!(operation, Operation::Cut | Operation::Intersect) || !any_eligible_sheet(f, st, &[]) {
        return Ok(Vec::new());
@@ -768,7 +853,7 @@ pub(super) fn sheet_primitive_cut(
    let Some(normal) = normal else { return Ok(Vec::new()) };
    let Some((plane, region, interval)) = prism.along(normal) else { return Ok(Vec::new()) };
    let tools = kernel::extrude(&plane, std::slice::from_ref(&region), interval.0, interval.1)?;
-    sheet_prism_cut(f, st, &plane, std::slice::from_ref(&region), operation, &tools, &[], None, false)
+    sheet_prism_cut(f, st, &plane, std::slice::from_ref(&region), operation, &tools, &[], None, false, &[], warning)
 }

 /// A hole's straight drill along a panel of a sheet (into its rim), kept as a bore of each
@@ -855,6 +940,12 @@ impl PrimitivePrism {
    }
 }

+/// The most outline segments of a sketch's text a cut tells letters by, and the most text regions
+/// a sheet keeps (see [`crate::sheet::SheetBody::labels`]).
+const MAX_TEXT_CURVES: usize = 20_000;
+const MAX_LABELS: usize = 1000;
+
+/// `text` is the outlines of the text in the cut's sketch (none for a primitive's cut).
 #[allow(clippy::too_many_arguments)]
 fn sheet_prism_cut(
    f: &Feature,
@@ -866,6 +957,8 @@ fn sheet_prism_cut(
    targets: &[String],
    constructor: Option<&ExtrudeConstructor>,
    footprints_bound: bool,
+    text: &[Seg2],
+    warning: &mut Option<String>,
 ) -> Result<Vec<String>> {
    let n = plane.normal();
    let mut work = sheet::FlatWork::new();
@@ -904,7 +997,14 @@ fn sheet_prism_cut(
            && current_footprints.iter().all(|(plane, r)| plane.x == placed_basis.x && plane.y == placed_basis.y && regions.contains(r)))
        .then_some(c.interval)
    });
+    // The regions of the cut that are letters, with their counters.
+    let letters: Vec<&Region2> = if operation == Operation::Cut && !text.is_empty() && text.len() <= MAX_TEXT_CURVES {
+        regions.iter().filter(|r| sheet::loop_lies_on(&r.outer, text)).collect()
+    } else {
+        Vec::new()
+    };
    let mut plans = Vec::new();
+    let mut notes = Vec::new();
    'sheets: for original in &st.sheets {
        if !sheet_eligible(f, st, targets, original) {
            continue;
@@ -937,6 +1037,7 @@ fn sheet_prism_cut(
            sh.material_panels(Some(plane), &mut work)?
        };
        let mut modeled = false;
+        let mut labels = Vec::new();
        for (pi, panel) in candidates {
            let w = if sh.flat { sh.world(None) } else { sh.world(pi) };
            let zorigin = (apply_point(&w, Vec3::ZERO) - plane.origin).dot(n);
@@ -976,6 +1077,7 @@ fn sheet_prism_cut(
            let (z0, z1) = (a.min(b).max(0.0), a.max(b).min(sh.t));
            // Sub-resolution layers must not be silently erased by endpoint snapping.
            let depth_resolved = ![z0, sh.t - z1, z1 - z0].into_iter().any(|d| d > 0.0 && d < 1e-6);
+            labels.extend(letters.iter().filter_map(|r| sh.region_to_flat(pi, plane, r).ok()));
            let mapped = if footprints_bound && current_footprints.len() == tools.len() {
                current_footprints.iter().map(|(plane, r)| sh.region_to_flat(pi, plane, r)).collect::<Result<Vec<_>>>()?
            } else {
@@ -1040,19 +1142,34 @@ fn sheet_prism_cut(
                }
            }
        }
+        if modeled {
+            for flat in labels {
+                if !sh.labels.contains(&flat) && sh.labels.len() < MAX_LABELS {
+                    sh.labels.push(flat);
+                }
+            }
+        }
        if !modeled {
            super::sheet_boolean_unchanged(&mb.body, tools, operation)?;
            plans.push((sh.body.clone(), Some((sh, mb.body.clone()))));
-        } else if sh.flat_material()?.is_empty() {
-            // Empty exact material removes geometry and metadata together. Budget or
-            // topology errors propagate; they are never mistaken for an empty blank.
-            plans.push((sh.body.clone(), None));
        } else {
-            let body = sh.solid()?;
-            plans.push((sh.body.clone(), Some((sh, body))));
+            let material = sh.flat_material()?;
+            if material.is_empty() {
+                // Empty exact material removes geometry and metadata together. Budget or
+                // topology errors propagate; they are never mistaken for an empty blank.
+                plans.push((sh.body.clone(), None));
+            } else {
+                // Every piece the cut leaves stays; the ones it parts from the base are named.
+                notes.extend(parted_note(&sh, &material, original));
+                let body = sh.solid()?;
+                plans.push((sh.body.clone(), Some((sh, body))));
+            }
        }
    }
    let handled = plans.iter().map(|(name, _)| name.clone()).collect();
+    if !notes.is_empty() {
+        append_warning(warning, notes.join("; "));
+    }
    for (name, result) in plans {
        match result {
            Some((sh, body)) => {
@@ -1073,6 +1190,35 @@ fn sheet_prism_cut(
    Ok(handled)
 }

+/// A cut's note on the pieces it parted from the base of `sh` (see
+/// [`sheet::SheetBody::parted_from_base`]; `material` is the sheet's flat material after the cut,
+/// `before` the sheet before it): how many, their area and where they lie in the flat pattern.
+/// The pieces stay, as every piece a cut leaves does. None when nothing is parted, and when the
+/// pieces can't be worked out: the note is no reason for a cut to fail.
+fn parted_note(sh: &sheet::SheetBody, material: &[Region2], before: &sheet::SheetBody) -> Option<String> {
+    let pieces = sh.parted_from_base(material, before).ok().filter(|p| !p.is_empty())?;
+    let area: f64 = pieces.iter().map(Region2::area).sum();
+    let at: Vec<String> = pieces
+        .iter()
+        .take(4)
+        .map(|r| {
+            let c = r.interior_point();
+            format!("({:.1}, {:.1})", c.x, c.y)
+        })
+        .collect();
+    let at = at.join(", ");
+    let body = &sh.body;
+    Some(match pieces.len() {
+        1 => format!("1 piece of `{body}` is no longer joined to its base ({area:.2} mm², near {at} in the flat pattern); it is kept"),
+        n => {
+            let more = if n > 4 { format!(" and {} more", n - 4) } else { String::new() };
+            format!(
+                "{n} pieces of `{body}` are no longer joined to its base ({area:.2} mm² in all, near {at}{more} in the flat pattern); they are kept"
+            )
+        }
+    })
+}
+
 /// Outline loops (in `plane` coordinates) of the mesh triangles lying in the plane at distance
 /// `level` from `at` along `n`: the edges used by one of them only, chained.
 fn face_loops(mesh: &solidcraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3, level: f64, tol: f64) -> Vec<Vec<Vec2>> {
@@ -1084,18 +1230,8 @@ fn face_loops(mesh: &solidcraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3, le
 fn face_outline(mesh: &solidcraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3, level: f64, tol: f64) -> Vec<Vec<(Vec2, Option<u32>)>> {
    let on_plane = |t: &[u32; 3]| t.iter().all(|k| mesh.positions.get(*k as usize).is_some_and(|p| ((*p - at).dot(n) - level).abs() < tol));
    let on: Vec<[u32; 3]> = mesh.triangles.iter().copied().filter(on_plane).collect();
-    // Boundary edges by position (meshes may repeat vertices per triangle).
    let pos = |k: u32| mesh.positions.get(k as usize).copied().unwrap_or_default();
    let q = |p: Vec3| ((p.x * 1e6).round() as i64, (p.y * 1e6).round() as i64, (p.z * 1e6).round() as i64);
-    let key = |a: Vec3, b: Vec3| {
-        let (ka, kb) = (q(a), q(b));
-        (ka.min(kb), ka.max(kb))
-    };
-    let mut count: std::collections::HashMap<((i64, i64, i64), (i64, i64, i64)), i32> = Default::default();
-    let edges: Vec<(Vec3, Vec3)> = on.iter().flat_map(|t| [(pos(t[0]), pos(t[1])), (pos(t[1]), pos(t[2])), (pos(t[2]), pos(t[0]))]).collect();
-    for (a, b) in &edges {
-        *count.entry(key(*a, *b)).or_insert(0) += 1;
-    }
    // The faces off the plane at each point on it, by position to a millionth of a millimetre
    // either way (a neighbouring face's mesh may round a shared point differently).
    let mut touch: std::collections::HashMap<(i64, i64, i64), Vec<u32>> = Default::default();
@@ -1119,6 +1255,34 @@ fn face_outline(mesh: &solidcraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3,
        let at_b = near(b);
        near(a).into_iter().find(|f| at_b.contains(f))
    };
+    chain_loops(mesh, plane, &on, across)
+}
+
+/// The loops (in `plane` coordinates) that bound the triangles `on` of the mesh.
+fn boundary_loops(mesh: &solidcraft_geom::Mesh, plane: &Plane, on: &[[u32; 3]]) -> Vec<Vec<Vec2>> {
+    chain_loops(mesh, plane, on, |_, _| None).into_iter().map(|l| l.into_iter().map(|(p, _)| p).collect()).collect()
+}
+
+/// The loops (in `plane` coordinates) that bound the triangles `on` of the mesh, each point with
+/// `across(it, next)`: the face the outline runs along from it to the next point.
+fn chain_loops(
+    mesh: &solidcraft_geom::Mesh,
+    plane: &Plane,
+    on: &[[u32; 3]],
+    across: impl Fn(Vec3, Vec3) -> Option<u32>,
+) -> Vec<Vec<(Vec2, Option<u32>)>> {
+    // Boundary edges by position (meshes may repeat vertices per triangle).
+    let pos = |k: u32| mesh.positions.get(k as usize).copied().unwrap_or_default();
+    let q = |p: Vec3| ((p.x * 1e6).round() as i64, (p.y * 1e6).round() as i64, (p.z * 1e6).round() as i64);
+    let key = |a: Vec3, b: Vec3| {
+        let (ka, kb) = (q(a), q(b));
+        (ka.min(kb), ka.max(kb))
+    };
+    let mut count: std::collections::HashMap<((i64, i64, i64), (i64, i64, i64)), i32> = Default::default();
+    let edges: Vec<(Vec3, Vec3)> = on.iter().flat_map(|t| [(pos(t[0]), pos(t[1])), (pos(t[1]), pos(t[2])), (pos(t[2]), pos(t[0]))]).collect();
+    for (a, b) in &edges {
+        *count.entry(key(*a, *b)).or_insert(0) += 1;
+    }
    let mut boundary: Vec<(Vec3, Vec3)> = edges.into_iter().filter(|(a, b)| count.get(&key(*a, *b)) == Some(&1)).collect();
    // Chain into loops (plane coordinates).
    let mut loops: Vec<Vec<(Vec2, Option<u32>)>> = Vec::new();
@@ -1157,64 +1321,166 @@ fn face_outline(mesh: &solidcraft_geom::Mesh, plane: &Plane, at: Vec3, n: Vec3,
    loops
 }

-/// The circle (centre in `plane` coordinates, radius) of face `f` when it is a round wall
-/// standing square on the plane: a cylinder about the plane's normal `n`.
-fn round_wall(body: &Body, plane: &Plane, n: Vec3, f: u32) -> Option<(Vec2, f64)> {
-    match kernel::face_surface(body, f as usize)? {
-        kernel::FaceSurface::Cylinder { origin, axis, radius } if axis.cross(n).len() < 1e-6 => Some((plane.to_local(origin), radius)),
-        _ => None,
-    }
+/// What the recesses of a plate (an engraved label, a counterbore) take out of it, for Convert
+/// to Sheet Metal: each becomes a pocket of the sheet, from its floor to the face it opens on.
+struct Recesses {
+    /// The level (along the picked face's normal) of the plate's face without recesses, whose
+    /// outline the sheet takes.
+    level: f64,
+    /// Pockets in flat coordinates, with their depth interval in the sheet (0 to its thickness).
+    pockets: Vec<(Region2, f64, f64)>,
+    /// The material they take out.
+    volume: f64,
 }

-/// A loop of [`face_outline`] as segments: each run along one round wall (`wall` gives a face's
-/// circle) is an arc of that circle, the rest stays straight. Coaxial cylinders of one radius are
-/// one wall, however many faces it comes in (many systems write a round hole's wall as two
-/// half-cylinders), so such a hole is one circle. `eps`: how far off its circle a point may be.
-fn outline_loop(pts: &[(Vec2, Option<u32>)], wall: &mut impl FnMut(u32) -> Option<(Vec2, f64)>, eps: f64) -> Loop2 {
-    use std::f64::consts::{PI, TAU};
-    let m = pts.len();
-    let point = |i: usize| pts.get(i % m).map(|x| x.0).unwrap_or_default();
-    // The circle each segment runs along: its wall's, when both its ends lie on it.
-    let circles: Vec<Option<(Vec2, f64)>> = (0..m)
-        .map(|i| {
-            let (c, r) = wall(pts.get(i)?.1?)?;
-            ((point(i).dist(c) - r).abs() <= eps && (point(i + 1).dist(c) - r).abs() <= eps).then_some((c, r))
-        })
-        .collect();
-    let circle = |i: usize| circles.get(i % m).copied().flatten();
-    let same = |i: usize, (c, r): (Vec2, f64)| circle(i).is_some_and(|(d, s)| d.dist(c) <= eps && (s - r).abs() <= eps);
-    // Start where no arc runs on across the start (anywhere when the whole loop is one circle).
-    let start = (0..m).find(|i| circle(*i + m - 1).is_none_or(|c| !same(*i, c))).unwrap_or(0);
-    let mut segs = Vec::new();
-    let mut i = 0;
-    while i < m {
-        let k = start + i;
-        let Some((c, r)) = circle(k) else {
-            segs.push(Seg2::Line { a: point(k), b: point(k + 1) });
-            i += 1;
+/// A planar face of the mesh parallel to the plate: its lowest and highest level, whether its
+/// outward normal is the picked face's (it faces up), its area, a point on it, and its
+/// triangles' centres and areas.
+struct LevelFace {
+    lo: f64,
+    hi: f64,
+    up: bool,
+    area: f64,
+    at: Vec3,
+    tris: Vec<(Vec3, f64)>,
+}
+
+/// The recesses of a plate lying between levels `lo` and `hi` along `n` (measured from `at`),
+/// whose sheet is built in `plane`. A recess's floor is a face parallel to the plate inside its
+/// thickness, lying in an opening of the face it is cut into, and its walls are square to the
+/// plate (walls that are not show as material the plate's volume doesn't account for). A body
+/// that is no plate once its recesses are filled has none, so the plate check refuses it as
+/// before: a bent part, whose legs' faces lie inside its extent. Recesses are taken in one face
+/// only, up to half the thickness deep, and no larger than the face they are cut into (a plate
+/// raised in places is no plate of the raised thickness).
+fn plate_recesses(body: &Body, mesh: &Mesh, plane: &Plane, at: Vec3, n: Vec3, (lo, hi): (f64, f64), tol: f64) -> Result<Recesses> {
+    let t = hi - lo;
+    let eps = t * 1e-3;
+    let level = |p: Vec3| (p - at).dot(n);
+    let mut faces: BTreeMap<u32, Option<LevelFace>> = BTreeMap::new();
+    for (tri, f) in mesh.triangles.iter().zip(&mesh.tri_face) {
+        let Some([a, b, c]) = mesh.tri(tri) else { continue };
+        let cr = (b - a).cross(c - a);
+        let len = cr.len();
+        if !(len > 1e-12) {
            continue;
-        };
-        let mut j = i + 1;
-        while j < m && same(start + j, (c, r)) {
-            j += 1;
        }
-        let sweep: f64 = (i..j)
-            .map(|s| {
-                let d = (point(start + s + 1) - c).angle() - (point(start + s) - c).angle();
-                (d + PI).rem_euclid(TAU) - PI
-            })
-            .sum();
-        // Arcs of up to half a turn each.
-        let pieces = ((sweep.abs() / PI - 1e-9).ceil() as usize).clamp(1, 4);
-        let (a0, step) = ((point(k) - c).angle(), sweep / pieces as f64);
-        segs.extend((0..pieces).map(|p| Seg2::Arc { center: c, radius: r, start: a0 + step * p as f64, sweep: step }));
-        i = j;
+        let up = cr.dot(n) > 0.0;
+        let entry = faces.entry(*f).or_insert(Some(LevelFace { lo: f64::MAX, hi: f64::MIN, up, area: 0.0, at: a, tris: Vec::new() }));
+        match entry {
+            Some(face) if face.up == up && cr.dot(n).abs() >= len * (1.0 - 1e-6) => {
+                for p in [a, b, c] {
+                    face.lo = face.lo.min(level(p));
+                    face.hi = face.hi.max(level(p));
+                }
+                face.area += len / 2.0;
+                face.tris.push(((a + b + c) / 3.0, len / 2.0));
+            }
+            _ => *entry = None,
+        }
    }
-    Loop2 { segs }
+    // The floors (face index, level, the face), and the areas of the plate's two faces (at `lo`
+    // and at `hi`).
+    let mut floors: Vec<(usize, f64, &LevelFace)> = Vec::new();
+    let (mut bottom, mut top) = (0.0, 0.0);
+    for (f, face) in faces.iter().filter_map(|(f, face)| Some((*f as usize, face.as_ref()?))) {
+        let d = (face.lo + face.hi) / 2.0;
+        if face.hi - face.lo > eps {
+            continue;
+        } else if (d - hi).abs() <= eps && face.up {
+            top += face.area;
+        } else if (d - lo).abs() <= eps && !face.up {
+            bottom += face.area;
+        } else if d > lo + eps && d < hi - eps {
+            floors.push((f, d, face));
+        }
+    }
+    let none = || Recesses { level: lo, pockets: Vec::new(), volume: 0.0 };
+    if floors.is_empty() {
+        return Ok(none());
+    }
+    // A floor is a recess's where (most of) it lies in an opening of the face it is cut into:
+    // inside that face's outline and in a hole of it, not on an island in the hole. (Its
+    // triangles are those at its level within `eps`: `tol` may exceed a recess's depth.)
+    let loops_at = |level: f64| -> Vec<Loop2> { face_loops(mesh, plane, at, n, level, eps).into_iter().map(|l| Loop2::polygon(&l)).collect() };
+    let (top_loops, bottom_loops) = (loops_at(hi), loops_at(lo));
+    floors.retain(|(_, _, face)| {
+        let loops = if face.up { &top_loops } else { &bottom_loops };
+        let open = |p: Vec2| {
+            let k = loops.iter().filter(|l| l.contains(p)).count();
+            k >= 2 && k.is_multiple_of(2)
+        };
+        face.tris.iter().filter(|(c, _)| open(plane.to_local(*c))).map(|(_, a)| a).sum::<f64>() > face.area / 2.0
+    });
+    let Some(&(_, _, first)) = floors.first() else { return Ok(none()) };
+    // Filled, the recesses leave a plate: its outline as large at `lo` as at `hi` once their
+    // openings count, and its volume with theirs the outline times the thickness. Else (a bent
+    // part) they are none.
+    let depth_in = |d: f64, up: bool| if up { hi - d } else { d - lo };
+    let opened = |up: bool| floors.iter().filter(|f| f.2.up == up).map(|f| f.2.area).sum::<f64>();
+    let outline = bottom + opened(false);
+    let removed: f64 = floors.iter().map(|f| f.2.area * depth_in(f.1, f.2.up)).sum();
+    let volume = kernel::measure(body)?.volume;
+    if (outline - top - opened(true)).abs() > 1e-3 * outline || (outline * t - volume - removed).abs() > 1e-3 * volume.max(1.0) {
+        return Ok(none());
+    }
+    let pt = |p: Vec3| format!("({:.3}, {:.3}, {:.3})", p.x, p.y, p.z);
+    let up = first.up;
+    if let Some(other) = floors.iter().find(|f| f.2.up != up) {
+        return Err(DocError::Invalid(format!(
+            "not supported yet: converting a plate with recesses in both faces (at {} and {}); recesses in one face become pockets",
+            pt(first.at),
+            pt(other.2.at)
+        )));
+    }
+    let depth_of = |d: f64| depth_in(d, up);
+    if let Some(deep) = floors.iter().find(|f| depth_of(f.1) > t / 2.0 + eps) {
+        return Err(DocError::Invalid(format!(
+            "not supported yet: the recess at {} is {:.3} mm deep, more than half the plate's {:.3} mm; shallower recesses (an engraving, a label) become pockets",
+            pt(deep.2.at),
+            depth_of(deep.1),
+            t
+        )));
+    }
+    let face_area = if up { top } else { bottom };
+    if floors.iter().map(|f| f.2.area).sum::<f64>() > face_area {
+        return Err(DocError::Invalid(format!(
+            "not supported yet: converting a plate whose recesses are larger than the face they are in (a plate thinner than {t:.3} mm, raised in places)"
+        )));
+    }
+    // The floors' outlines, from a mesh fine enough to mark them by.
+    let fine = body.tessellate((t * 1e-2).min(tol).max(1e-4))?;
+    floors.sort_by(|a, b| depth_of(a.1).total_cmp(&depth_of(b.1)));
+    // Floors at one depth are one pocket where they meet.
+    let mut groups: Vec<(f64, Vec<Region2>)> = Vec::new();
+    for (f, d, ..) in &floors {
+        let on: Vec<[u32; 3]> = fine.triangles.iter().zip(&fine.tri_face).filter(|(_, g)| **g as usize == *f).map(|(tri, _)| *tri).collect();
+        let mut loops = boundary_loops(&fine, plane, &on);
+        loops.sort_by(|a, b| poly_area(b).abs().total_cmp(&poly_area(a).abs()));
+        let mut it = loops.into_iter();
+        let Some(outline) = it.next() else { continue };
+        let region = Region2 { outer: Loop2::polygon(&outline).ccw(), holes: it.map(|l| Loop2::polygon(&l).ccw().reversed()).collect() };
+        match groups.last_mut() {
+            Some((depth, regions)) if depth_of(*d) - *depth <= eps => regions.push(region),
+            _ => groups.push((depth_of(*d), vec![region])),
+        }
+    }
+    // The sheet's z starts from the picked face when its plane faces away from that face.
+    let from_zero = up == (plane.normal().dot(n) < 0.0);
+    let mut work = sheet::FlatWork::new();
+    let (mut pockets, mut volume) = (Vec::new(), 0.0);
+    for (depth, regions) in groups {
+        let (z0, z1) = if from_zero { (0.0, depth) } else { (t - depth, t) };
+        for region in sheet::material_union(regions, &mut work)? {
+            volume += region.area().abs() * depth;
+            pockets.push((region, z0, z1));
+        }
+    }
+    Ok(Recesses { level: if up { lo } else { hi }, pockets, volume })
 }

 /// The body a placed plastic feature joins: by name, else the one under the point.
-fn body_under(st: &ModelState, body: &Option<String>, p: Vec3) -> Result<String> {
+fn body_under(st: &ModelState, body: &Option<crate::BodyName>, p: Vec3) -> Result<String> {
    let i = body_at(st, body, &[p])?;
    let b = st.bodies.get(i).ok_or_else(|| DocError::Invalid("there is no body".into()))?;
    let tolerance = (b.body.size() * 1e-5).max(1e-4);
@@ -1276,7 +1542,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            rib_offset,
            body,
        } => {
-            let target = body_under(st, body, *position)?;
+            let target = body_under(st, body, position.0)?;
            let (r0, h) = (len(diameter)? / 2.0, len(height)?);
            if !(r0 > 0.0 && h > 0.0) {
                return Err(DocError::Invalid("the boss diameter and height must be positive".into()));
@@ -1294,9 +1560,9 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                return Err(DocError::Invalid("the draft closes the boss before its top".into()));
            }
            let delta = (h * 0.05).clamp(1e-3, 0.5);
-            let (x, _, z) = local_frame(*direction, None)?;
+            let (x, _, z) = local_frame(direction.0, None)?;
            // The post: a (tapered) cylinder from a little inside the face.
-            let base = Plane::new(*position - z * delta, x, z.cross(x)).ok_or_else(|| DocError::Invalid("boss frame".into()))?;
+            let base = Plane::new(position.0 - z * delta, x, z.cross(x)).ok_or_else(|| DocError::Invalid("boss frame".into()))?;
            let r_in = r0 + delta * dr.tan();
            let disc = Region2 { outer: Loop2::circle(Vec2::ZERO, r_in), holes: Vec::new() };
            let post = if dr.abs() > 1e-12 {
@@ -1329,7 +1595,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                for k in 0..n as usize {
                    let a = std::f64::consts::TAU * k as f64 / n;
                    let (u, v) = (x * a.cos() + z.cross(x) * a.sin(), z.cross(x) * a.cos() - x * a.sin());
-                    let rp = Plane::new(*position, u, v).ok_or_else(|| DocError::Invalid("rib frame".into()))?;
+                    let rp = Plane::new(position.0, u, v).ok_or_else(|| DocError::Invalid("rib frame".into()))?;
                    let rect = Region2 {
                        outer: Loop2::polygon(&[
                            Vec2::new(r0 * 0.5, -t / 2.0),
@@ -1348,7 +1614,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                let i = st.bodies.iter().position(|b| b.name == target).ok_or_else(|| DocError::Invalid("boss body".into()))?;
                let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("boss body".into())) };
                let mut warn = None;
-                let edges = resolve_edges(&mb.body, &[*position + x * r0], &[], &mut warn)?;
+                let edges = resolve_edges(&mb.body, &[position.0 + x * r0], &[], &mut warn)?;
                let nb = mb.traced().then(kernel::fillet(&mb.body, &edges, rf)?);
                if let Some(slot) = st.bodies.get_mut(i) {
                    *slot = ModelBody::traced_new(mb.name, nb, mb.feature);
@@ -1363,7 +1629,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                if !(rh > 0.0 && rh < r_top && depth > 0.0) {
                    return Err(DocError::Invalid("the boss hole must fit inside the boss".into()));
                }
-                let hp = Plane::new(*position, x, z.cross(x)).ok_or_else(|| DocError::Invalid("hole frame".into()))?;
+                let hp = Plane::new(position.0, x, z.cross(x)).ok_or_else(|| DocError::Invalid("hole frame".into()))?;
                let tool = kernel::extrude(&hp, &[Region2 { outer: Loop2::circle(Vec2::ZERO, rh), holes: Vec::new() }], h - depth, h + delta)?;
                let tool = tool.into_iter().map(|b| crate::lineage::part_tool(b, "hole")).collect();
                apply_traced(st, f, tool, Operation::Cut, std::slice::from_ref(&target))?;
@@ -1371,9 +1637,9 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            Ok(())
        }
        FeatureKind::Lip { face, width, height, groove, gap, outside, body } => {
-            let target = body_under(st, body, *face)?;
+            let target = body_under(st, body, face.0)?;
            let mb = st.body(&target).cloned().ok_or_else(|| DocError::Invalid("body".into()))?;
-            let n = planar_normal_at(&mb.body, *face).ok_or_else(|| DocError::Invalid("pick the planar rim face".into()))?;
+            let n = planar_normal_at(&mb.body, face.0).ok_or_else(|| DocError::Invalid("pick the planar rim face".into()))?;
            let (w, h) = (len(width)?, len(height)?);
            let g = match gap {
                Some(e) => len(e)?,
@@ -1383,10 +1649,10 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            if !(w > 0.0 && h > 0.0 && g >= 0.0) {
                return Err(DocError::Invalid("the lip width and height must be positive".into()));
            }
-            let plane = Plane::from_normal(*face, n).ok_or_else(|| DocError::Invalid("rim plane".into()))?;
+            let plane = Plane::from_normal(face.0, n).ok_or_else(|| DocError::Invalid("rim plane".into()))?;
            let tol = (mb.body.size() * 1e-3).max(1e-3);
            let mesh = mb.body.tessellate(tol)?;
-            let mut loops = face_loops(&mesh, &plane, *face, n, 0.0, tol);
+            let mut loops = face_loops(&mesh, &plane, face.0, n, 0.0, tol);
            loops.sort_by(|a, b| poly_area(b).abs().total_cmp(&poly_area(a).abs()));
            let ccw = |l: &[Vec2]| if poly_area(l) < 0.0 { l.iter().rev().copied().collect::<Vec<_>>() } else { l.to_vec() };
            // The inner edge is an opening (the cavity under a rim): not the foot of a boss or a
@@ -1420,7 +1686,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            // A lip: the band raised from the rim's own faces (its walls continue the walls
            // below, which a join can't do: they would coincide).
            if !*groove
-                && let Ok(b) = kernel::raise_band(&mb.body, *face, w, h, *outside)
+                && let Ok(b) = kernel::raise_band(&mb.body, face.0, w, h, *outside)
                && let Some(slot) = st.bodies.iter_mut().find(|x| x.name == target)
            {
                *slot = ModelBody::traced_new(target.clone(), Traced::step(b, &[&mb.traced()]), slot.feature);
@@ -1450,17 +1716,17 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            }
        }
        FeatureKind::SnapFit { position, direction, hook, length, thickness, width, catch_depth, catch_length, body } => {
-            let target = body_under(st, body, *position)?;
+            let target = body_under(st, body, position.0)?;
            let (l, t, w, cd, cl) = (len(length)?, len(thickness)?, len(width)?, len(catch_depth)?, len(catch_length)?);
            if !(l > 0.0 && t > 0.0 && w > 0.0 && cd > 0.0 && cl > 0.0 && cl < l) {
                return Err(DocError::Invalid("the snap fit's sizes must be positive and the catch shorter than the arm".into()));
            }
-            let (x, y, z) = local_frame(*direction, Some(*hook))?;
+            let (x, y, z) = local_frame(direction.0, Some(hook.0))?;
            let delta = (l * 0.05).clamp(1e-3, 0.5);
            // Side profile (x = toward the catch, y = up the arm), extruded across the width.
            let pts =
                [Vec2::new(-t, -delta), Vec2::new(0.0, -delta), Vec2::new(0.0, l - cl), Vec2::new(cd, l - cl), Vec2::new(0.0, l), Vec2::new(-t, l)];
-            let o = *position - y * (w / 2.0);
+            let o = position.0 - y * (w / 2.0);
            let pl = Plane::new(o, x, z).ok_or_else(|| DocError::Invalid("snap fit frame".into()))?;
            let mut lp = Loop2::polygon(&pts);
            if lp.signed_area() < 0.0 {
@@ -1473,7 +1739,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
            apply_traced(st, f, tool, Operation::Join, std::slice::from_ref(&target))
        }
        FeatureKind::Rest { position, direction, along, width, length, height, draft, thickness, body } => {
-            let target = body_under(st, body, *position)?;
+            let target = body_under(st, body, position.0)?;
            let (w, h) = (len(width)?, len(height)?);
            let l = length.as_deref().map(len).transpose()?;
            let dr = match draft {
@@ -1496,7 +1762,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                return Err(DocError::Invalid("the draft closes the rest before its top".into()));
            }
            let delta = (h * 0.05).clamp(1e-3, 0.5);
-            let (x, y, z) = local_frame(*direction, *along)?;
+            let (x, y, z) = local_frame(direction.0, along.map(Vec3::from))?;
            // Sized at the face: the tool starts a little inside, grown by the draft over that.
            let e = delta * dr.tan();
            let shape = |grow: f64| match l {
@@ -1513,7 +1779,7 @@ pub(super) fn plastic_eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &F
                None => Vec::new(),
            };
            let region = Region2 { outer: shape(e), holes };
-            let base = Plane::new(*position - z * delta, x, y).ok_or_else(|| DocError::Invalid("rest frame".into()))?;
+            let base = Plane::new(position.0 - z * delta, x, y).ok_or_else(|| DocError::Invalid("rest frame".into()))?;
            let tool = if dr.abs() > 1e-12 {
                vec![kernel::extrude_tapered(&base, &region, h + delta, 1.0, -dr)?]
            } else {
@@ -1,25 +1,32 @@
 //! Evaluation of the surface features: Patch, Stitch, Thicken, Trim, Extend, Surface Extrude,
-//! Revolve, Sweep and Loft, Offset, Unstitch and Reverse Normal (kernel `surfaces`,
-//! `surface_offset`).
+//! Revolve, Sweep and Loft, Offset, Ruled, Untrim, Unstitch and Reverse Normal (kernel `surfaces`,
+//! `surface_offset`, `surface_ruled`, `surface_untrim`).

 use super::*;
+use crate::{RuledCorners, RuledMode};
 use solidcraft_geom::Seg2;

-pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState) -> Result<()> {
+pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature, st: &mut ModelState, warning: &mut Option<String>) -> Result<()> {
    match &f.kind {
-        FeatureKind::Patch { sketch, profiles, body, edges } => {
+        FeatureKind::Patch { sketch, profiles, body, edges, crown, continuity, points } => {
            let mut made = Vec::new();
            if let Some(sk) = sketch {
-                let ss = st.sketch(*sk).ok_or_else(|| DocError::Unknown(format!("sketch {sk} (it must come earlier in the timeline)")))?;
+                let ss = st.sketch(sk.0).ok_or_else(|| DocError::Unknown(format!("sketch {sk} (it must come earlier in the timeline)")))?;
                let regions = solidcraft_sketch::merge_regions(&select_profiles(ss, profiles)?);
                for r in &regions {
                    made.push(kernel::patch_region(&ss.plane, r)?);
                }
            }
            if !edges.is_empty() {
-                let i = body_at(st, body, edges)?;
+                let i = body_at(st, body, &crate::plain(edges))?;
                let b = st.bodies.get(i).ok_or_else(|| DocError::Invalid("body".into()))?;
-                made.push(kernel::patch_edges(&b.body, edges)?);
+                let spec = kernel::PatchSpec {
+                    continuity: continuity.all,
+                    edges: continuity.edges.iter().map(|e| (e.edge.0, e.g)).collect(),
+                    points: crate::plain(points),
+                    crown: *crown,
+                };
+                made.push(kernel::patch_edges_with(&b.body, &crate::plain(edges), &spec)?);
            }
            if made.is_empty() {
                return Err(DocError::Invalid("a patch needs a sketch region or a loop of edges".into()));
@@ -58,7 +65,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            if tools.is_empty() {
                return Err(DocError::Invalid("pick the surfaces to thicken".into()));
            }
-            apply_op(st, f, tools, *operation, targets)
+            apply_op(st, f, tools, *operation, &crate::plain(targets))
        }
        FeatureKind::SurfaceTrim { body, plane, tool, keep } => {
            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
@@ -66,31 +73,154 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            let trimmed = match tool {
                Some(t) => {
                    let tb = st.body(&t.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", t.body)))?;
-                    let face = crate::appearance::face_index_at(tb, t.point)
+                    let face = crate::appearance::face_index_at(tb, t.point.0)
                        .ok_or_else(|| DocError::Invalid(format!("no face of `{}` at the tool point", t.body)))?;
-                    kernel::trim(&mb.body, &kernel::SplitTool::Face { body: &tb.body, face }, *keep)?
+                    kernel::trim(&mb.body, &kernel::SplitTool::Face { body: &tb.body, face }, keep.0)?
                }
-                None => kernel::trim(&mb.body, &kernel::SplitTool::Plane(doc.resolve_plane_in(vals, plane, 0, Some(st))?), *keep)?,
+                None => kernel::trim(&mb.body, &kernel::SplitTool::Plane(doc.resolve_plane_in(vals, plane, 0, Some(st))?), keep.0)?,
            };
            if let Some(slot) = st.bodies.get_mut(i) {
                *slot = ModelBody::new(mb.name, trimmed, mb.feature);
            }
            Ok(())
        }
-        FeatureKind::SurfaceExtend { body, edges, distance } => {
-            let d = val(vals, distance, Kind::Length)?;
+        FeatureKind::SurfaceExtend { body, edges, distance, mode, up_to, neighbours } => {
            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
-            let out = kernel::extend(&mb.body, edges, d)?;
+            let mode = match mode {
+                crate::ExtendMode::Natural => kernel::ExtendMode::Natural,
+                crate::ExtendMode::Tangent => kernel::ExtendMode::Tangent,
+                crate::ExtendMode::Curvature => kernel::ExtendMode::Curvature,
+            };
+            let at = |limit| kernel::ExtendOptions { mode, limit, neighbours: *neighbours };
+            let out = match up_to {
+                None => {
+                    kernel::extend_surface(&mb.body, &crate::plain(edges), &at(kernel::ExtendLimit::Distance(val(vals, distance, Kind::Length)?)))?
+                }
+                Some(crate::ExtendTo::Bounds) => kernel::extend_surface(&mb.body, &crate::plain(edges), &at(kernel::ExtendLimit::Bounds))?,
+                Some(crate::ExtendTo::Plane(plane)) => {
+                    let tool = kernel::SplitTool::Plane(doc.resolve_plane_in(vals, plane, 0, Some(st))?);
+                    kernel::extend_surface(&mb.body, &crate::plain(edges), &at(kernel::ExtendLimit::UpTo(&tool)))?
+                }
+                Some(crate::ExtendTo::Face(t)) => {
+                    let tb = st.body(&t.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", t.body)))?;
+                    let face = crate::appearance::face_index_at(tb, t.point.0)
+                        .ok_or_else(|| DocError::Invalid(format!("no face of `{}` at the target point", t.body)))?;
+                    let tool = kernel::SplitTool::Face { body: &tb.body, face };
+                    kernel::extend_surface(&mb.body, &crate::plain(edges), &at(kernel::ExtendLimit::UpTo(&tool)))?
+                }
+            };
            if let Some(slot) = st.bodies.get_mut(i) {
                *slot = ModelBody::new(mb.name, out, mb.feature);
            }
            Ok(())
        }
+        FeatureKind::SurfaceBlend { from, to, continuity, bulge, align, stitch } => {
+            let a = st.body(&from.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", from.body)))?.body.clone();
+            let b = st.body(&to.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", to.body)))?.body.clone();
+            if from.edges.is_empty() || to.edges.is_empty() {
+                return Err(DocError::Invalid("a blend needs a chain of edges at each end".into()));
+            }
+            let (made, gap) = kernel::blend_between(
+                &a,
+                &crate::plain(&from.edges),
+                &b,
+                &crate::plain(&to.edges),
+                *continuity,
+                *bulge,
+                align.map(|[p, q]| [p.0, q.0]),
+                BLEND_STATIONS,
+                *stitch,
+            )?;
+            if gap > 1e-9 {
+                *warning = Some(format!("the blend's boundary lies up to {gap:.4} mm from the edges it was built on"));
+            }
+            let name = new_name(st, f, 0);
+            // A stitched blend takes the place of both bodies it joins; otherwise it is a new
+            // surface body of its own.
+            if *stitch {
+                let gone = [from.body.0.clone(), to.body.0.clone()];
+                st.bodies.retain(|x| !gone.contains(&x.name));
+            }
+            st.bodies.push(ModelBody::new(name, made, f.id));
+            Ok(())
+        }
+        FeatureKind::SurfaceBoundary { sketch, curves, orders, crown, samples } => {
+            let ss = sketch_in_feature_frame(
+                doc,
+                st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?,
+                f.component,
+            )?;
+            let boundaries = boundary_frames(&ss, curves, orders, *samples)?;
+            let body = kernel::boundary_patch(&boundaries, *crown, *samples)?;
+            let name = new_name(st, f, 0);
+            st.bodies.push(ModelBody::new(name, body, f.id));
+            Ok(())
+        }
+        FeatureKind::SurfaceMatch { body, faces, target, edges, order } => {
+            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
+            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
+            let tb = st.body(target).ok_or_else(|| DocError::Unknown(format!("body `{target}`")))?.body.clone();
+            if edges.is_empty() {
+                return Err(DocError::Invalid("a match needs a chain of the target's edges".into()));
+            }
+            // Picked by a point on the face; without picks, the body's first face.
+            let picked: Vec<solidcraft_geom::Vec3> = if faces.is_empty() {
+                let faces = mb.body.faces(mb.body.size() * 1e-2)?;
+                vec![faces.first().ok_or_else(|| DocError::Invalid(format!("`{body}` has no face to match")))?.centroid]
+            } else {
+                crate::plain(faces)
+            };
+            let made = kernel::match_surface(&mb.body, &picked, &tb, &crate::plain(edges), *order)?;
+            // A match rebuilds the face in place: the body keeps its name, and whatever meets it
+            // downstream still finds it.
+            if let Some(slot) = st.bodies.get_mut(i) {
+                *slot = ModelBody::new(mb.name, made, mb.feature);
+            }
+            Ok(())
+        }
+        FeatureKind::SurfaceFair { body, faces, strength, iterations, keep_edges, tolerance } => {
+            let tol = val(vals, tolerance, Kind::Length)?;
+            let opts = kernel::FairOptions::new(*strength, *iterations as usize, *keep_edges, tol)?;
+            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
+            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
+            // Picked by a point on the face; without picks, every face of the body.
+            let mut picked: Vec<usize> = Vec::new();
+            if faces.is_empty() {
+                picked.extend(0..mb.body.face_count());
+            } else {
+                for p in faces {
+                    let fi =
+                        crate::appearance::face_index_at(&mb, p.0).ok_or_else(|| DocError::Invalid(format!("Fair: no face of {body} at {p:?}")))?;
+                    if !picked.contains(&fi) {
+                        picked.push(fi);
+                    }
+                }
+            }
+            if picked.is_empty() {
+                return Err(DocError::Invalid("the body has no faces to fair".into()));
+            }
+            // The face keeps every edge it had: only the surface between them is faired. The
+            // energy before and after goes into the feature's warning, so the reply can say how
+            // much the face moved.
+            let (faired, report) = kernel::fair_faces(&mb.body, &picked, &opts)?;
+            *warning = Some(format!(
+                "faired {} face(s): energy {:.6} → {:.6} in {} step(s), control points moved up to {:.4} mm",
+                picked.len(),
+                report.energy_before,
+                report.energy_after,
+                report.steps,
+                report.movement
+            ));
+            if let Some(slot) = st.bodies.get_mut(i) {
+                *slot = ModelBody::new(mb.name, faired, mb.feature);
+            }
+            Ok(())
+        }
        FeatureKind::SurfaceExtrude { sketch, profiles, curves, extent } => {
            let ss = sketch_in_feature_frame(
                doc,
-                st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?,
+                st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?,
                f.component,
            )?;
            if extent.through_all || extent.taper.is_some() || extent.to.is_some() || extent.from.is_some() {
@@ -107,7 +237,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
        FeatureKind::SurfaceRevolve { sketch, profiles, curves, axis, angle, angle2, symmetric } => {
            let ss = sketch_in_feature_frame(
                doc,
-                st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?,
+                st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?,
                f.component,
            )?;
            let (o, d) = revolve_axis(&ss, axis)?;
@@ -128,7 +258,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
        FeatureKind::Unstitch { body, faces } => {
            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
-            let (pieces, rest) = kernel::unstitch(&mb.body, faces)?;
+            let (pieces, rest) = kernel::unstitch(&mb.body, &crate::plain(faces))?;
            let source = mb.traced();
            // The faces left keep the body's name; each face taken out is a new surface body.
            match rest {
@@ -150,16 +280,17 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
        FeatureKind::ReverseNormal { body, faces } => {
            let i = st.bodies.iter().position(|b| &b.name == body).ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
-            let turned = mb.traced().then(kernel::reverse_faces(&mb.body, faces)?);
+            let turned = mb.traced().then(kernel::reverse_faces(&mb.body, &crate::plain(faces))?);
            if let Some(slot) = st.bodies.get_mut(i) {
                *slot = ModelBody::traced_new(mb.name, turned, mb.feature);
            }
            Ok(())
        }
-        FeatureKind::SurfaceSweep { sketch, profiles, curves, path_sketch, path } => {
-            let ss = st.sketch(*sketch).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?;
+        FeatureKind::SurfaceSweep { sketch, profiles, curves, path_sketch, path, orientation, twist, scale } => {
+            let ctl = crate::eval::sweep_control(vals, orientation, twist, scale)?;
+            let ss = st.sketch(sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {sketch} (it must come earlier in the timeline)")))?;
            let ps =
-                st.sketch(*path_sketch).ok_or_else(|| DocError::Unknown(format!("sketch {path_sketch} (it must come earlier in the timeline)")))?;
+                st.sketch(path_sketch.0).ok_or_else(|| DocError::Unknown(format!("sketch {path_sketch} (it must come earlier in the timeline)")))?;
            // As Sweep: a 3D path sketch is followed in the feature's frame, the curves with it.
            let profile;
            let ss = if !ps.sketch.wires.is_empty() {
@@ -175,8 +306,8 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            let pts: Vec<Vec2> = chains.iter().flatten().flat_map(|s| s.polyline(1e-2)).collect();
            let start = ss.plane.to_world(pts.iter().fold(Vec2::default(), |a, p| a + *p) * (1.0 / pts.len().max(1) as f64));
            let body = match path_points(ps, path, start)? {
-                Some(pts) => kernel::sweep_sheet_points(&ss.plane, &chains, &pts)?,
-                None => kernel::sweep_sheet(&ss.plane, &chains, &path_segments(ps, path, start)?)?,
+                Some(pts) => kernel::sweep_sheet_points_with(&ss.plane, &chains, &pts, &ctl)?,
+                None => kernel::sweep_sheet_with(&ss.plane, &chains, &path_segments(ps, path, start)?, &ctl)?,
            };
            let traced = crate::lineage::ChainRoles { sketch: ss, chains: &chains }.tool(body);
            push_sheet(st, f, traced);
@@ -188,7 +319,7 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            for sec in sections {
                let ss = sketch_in_feature_frame(
                    doc,
-                    st.sketch(sec.sketch)
+                    st.sketch(sec.sketch.0)
                        .ok_or_else(|| DocError::Unknown(format!("sketch {} (it must come earlier in the timeline)", sec.sketch)))?,
                    f.component,
                )?;
@@ -218,9 +349,9 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
                Some(t) => val(vals, t, Kind::Length)?,
                None => 0.01,
            };
-            let i = body_at(st, body, faces)?;
+            let i = body_at(st, body, &crate::plain(faces))?;
            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
-            let picks = if *chain { smooth_chain(&mb, faces) } else { faces.clone() };
+            let picks = if *chain { smooth_chain(&mb, &crate::plain(faces)) } else { crate::plain(faces) };
            let mut picked: Vec<usize> = Vec::new();
            for p in &picks {
                let fi =
@@ -234,6 +365,52 @@ pub(super) fn eval(doc: &Document, vals: &BTreeMap<String, Value>, f: &Feature,
            st.bodies.push(ModelBody::traced_new(name, made, f.id));
            Ok(())
        }
+        FeatureKind::SurfaceRuled { body, edges, distance, mode, angle, direction, flip, corners, face } => {
+            let d = val(vals, distance, Kind::Length)?;
+            let mode = match mode {
+                RuledMode::Normal => kernel::RuledMode::Normal,
+                RuledMode::Tangent => kernel::RuledMode::Tangent,
+                RuledMode::Angle => {
+                    let a = angle.as_ref().ok_or_else(|| DocError::Invalid("a ruled surface at an angle needs `angle`".into()))?;
+                    kernel::RuledMode::Angle { angle: val(vals, a, Kind::Angle)?, reference: direction.map(Vec3::from) }
+                }
+                RuledMode::Direction => kernel::RuledMode::Direction(
+                    direction.map(Vec3::from).ok_or_else(|| DocError::Invalid("a ruled surface along a direction needs `direction`".into()))?,
+                ),
+            };
+            let corners = match corners {
+                RuledCorners::Mitre => kernel::RuledCorners::Mitre,
+                RuledCorners::Round => kernel::RuledCorners::Round,
+            };
+            let mb = st.body(body).cloned().ok_or_else(|| DocError::Unknown(format!("body `{body}`")))?;
+            let r = kernel::Ruled { distance: d, mode, flip: *flip, corners, face: face.map(Vec3::from) };
+            let made = Traced::step(kernel::ruled_surface(&mb.body, &crate::plain(edges), &r)?, &[&mb.traced()]);
+            let name = new_name(st, f, 0);
+            st.bodies.push(ModelBody::traced_new(name, made, f.id));
+            Ok(())
+        }
+        FeatureKind::SurfaceUntrim { face, holes, outer, in_place } => {
+            let i = st.bodies.iter().position(|b| b.name == face.body).ok_or_else(|| DocError::Unknown(format!("body `{}`", face.body)))?;
+            let Some(mb) = st.bodies.get(i).cloned() else { return Err(DocError::Invalid("body".into())) };
+            let fi = crate::appearance::face_index_at(&mb, face.point.0)
+                .ok_or_else(|| DocError::Invalid(format!("Untrim: no face of {} at {:?}", mb.name, face.point)))?;
+            let which = match holes {
+                None => kernel::UntrimHoles::All,
+                Some(points) => kernel::UntrimHoles::At(&crate::plain(points)),
+            };
+            // A surface body's face is untrimmed where it is when asked; a solid's is copied out.
+            let replace = *in_place && mb.body.is_surface();
+            let made = mb.traced().then(kernel::untrim(&mb.body, fi, which, *outer, replace)?);
+            if replace {
+                if let Some(slot) = st.bodies.get_mut(i) {
+                    *slot = ModelBody::traced_new(mb.name, made, mb.feature);
+                }
+            } else {
+                let name = new_name(st, f, 0);
+                st.bodies.push(ModelBody::traced_new(name, made, f.id));
+            }
+            Ok(())
+        }
        _ => Err(DocError::Invalid("not a surface feature".into())),
    }
 }
@@ -244,6 +421,70 @@ fn push_sheet(st: &mut ModelState, f: &Feature, traced: crate::lineage::Traced)
    st.bodies.push(ModelBody::traced_new(name, traced, f.id));
 }

+/// The boundaries `surface.boundary` builds its patch from: each picked curve's own stations in
+/// the sketch's frame, every one of them leaving the boundary square into the loop — the direction
+/// from the curve towards the middle of the loop, taken across its tangent — over the plane the
+/// curve lies in (so a chain of planar curves makes a flat patch, and a network that is not
+/// coplanar is followed as the plane through the curve's own tangent). `orders` sets how much of
+/// that plane each side repeats.
+fn boundary_frames(
+    ss: &SolvedSketch,
+    curves: &[String],
+    orders: &[solidcraft_kernel::Continuity],
+    samples: usize,
+) -> Result<Vec<solidcraft_kernel::Boundary>> {
+    use solidcraft_kernel::{Boundary, Frame};
+    // The stations along each curve, evenly in its own arclength, so every side carries the same
+    // number of frames and the patch's net is square.
+    let mut sides: Vec<Vec<solidcraft_geom::Vec3>> = Vec::with_capacity(curves.len());
+    for id in curves {
+        let ci = ss.sketch.curve_index(id).ok_or_else(|| DocError::Unknown(format!("sketch curve `{id}`")))?;
+        let pieces = ss.sketch.exact_pieces(ci);
+        if pieces.is_empty() {
+            return Err(DocError::Invalid(format!("curve `{id}` has no exact geometry to build on")));
+        }
+        let lengths: Vec<f64> = pieces.iter().map(Seg2::length).collect();
+        let total: f64 = lengths.iter().sum();
+        if !total.is_finite() || total <= 1e-9 {
+            return Err(DocError::Invalid(format!("curve `{id}` has no length")));
+        }
+        let mut pts = Vec::with_capacity(samples);
+        let (mut used, mut at) = (0.0, 0usize);
+        for k in 0..samples {
+            let want = total * k as f64 / (samples.saturating_sub(1)).max(1) as f64;
+            while at + 1 < pieces.len() && used + lengths[at] < want {
+                used += lengths[at];
+                at += 1;
+            }
+            let (Some(piece), Some(len)) = (pieces.get(at), lengths.get(at)) else { return Err(DocError::Invalid("boundary piece".into())) };
+            let t = ((want - used) / len.max(1e-12)).clamp(0.0, 1.0);
+            pts.push(ss.plane.to_world(piece.point_at(t)));
+        }
+        sides.push(pts);
+    }
+    // The middle of the loop, so every side leaves towards the inside of the patch.
+    let count = sides.iter().map(Vec::len).sum::<usize>().max(1) as f64;
+    let centre = sides.iter().flatten().fold(solidcraft_geom::Vec3::ZERO, |a, p| a + *p) * (1.0 / count);
+    let mut out = Vec::with_capacity(sides.len());
+    for (side, pts) in sides.iter().enumerate() {
+        let mut frames = Vec::with_capacity(pts.len());
+        for (i, p) in pts.iter().enumerate() {
+            // The tangent from the stations on either side, one-sided at the ends (where the side
+            // only has one neighbour).
+            let before = if i == 0 { *p } else { pts[i - 1] };
+            let after = if i + 1 == pts.len() { *p } else { pts[i + 1] };
+            let tangent = (after - before).normalized().ok_or_else(|| DocError::Invalid("a boundary curve has a stationary station".into()))?;
+            let across = centre - *p;
+            let leave = (across - tangent * across.dot(tangent))
+                .normalized()
+                .ok_or_else(|| DocError::Invalid("a boundary runs through the middle of the loop: no patch can leave it".into()))?;
+            frames.push(Frame { p: *p, leave, bend: Vec3::ZERO, bend_change: Vec3::ZERO });
+        }
+        out.push(Boundary { frames, order: orders.get(side).copied().unwrap_or(solidcraft_kernel::Continuity::G1) });
+    }
+    Ok(out)
+}
+
 /// What a surface builder sweeps: the boundary loops of the picked profiles, then the picked
 /// curves chained end to end.
 fn sheet_chains(ss: &SolvedSketch, profiles: Option<&ProfileSel>, curves: &[String]) -> Result<Vec<Vec<Seg2>>> {
@@ -262,6 +503,9 @@ fn sheet_chains(ss: &SolvedSketch, profiles: Option<&ProfileSel>, curves: &[Stri

 /// Most sketch curves one feature chains.
 const MAX_CHAIN_CURVES: usize = 1000;
+/// Stations a blend samples each of its two boundaries at: enough that the boundary it fits is
+/// within a small part of a thousandth of the chain's length of the edges it was built on.
+const BLEND_STATIONS: usize = 41;

 /// The sketch curves `ids` (free-form ones exactly where they can be) grouped into chains of segments that meet end to end, each oriented
 /// to run one way. Curves are joined greedily at their free ends: where three meet, one of them
@@ -15,6 +15,94 @@ const MAX_LEN: usize = 4096;
 const MAX_DEPTH: usize = 64;
 const MAX_ARGS: usize = 64;

+/// An expression a feature holds, as the user wrote it (`2 * width + 5 mm`): kept as text and
+/// evaluated with the design's parameters. It is saved as a plain string, and reads as one
+/// (`&expr` is a `&str`); it changes only as a whole (`*expr = new.into()`).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Hash, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+#[serde(transparent)]
+pub struct Expr(String);
+
+impl Expr {
+    pub fn new(s: impl Into<String>) -> Self {
+        Expr(s.into())
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_string(self) -> String {
+        self.0
+    }
+}
+
+impl std::ops::Deref for Expr {
+    type Target = str;
+    fn deref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl AsRef<str> for Expr {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl From<String> for Expr {
+    fn from(s: String) -> Self {
+        Expr(s)
+    }
+}
+
+impl From<&str> for Expr {
+    fn from(s: &str) -> Self {
+        Expr(s.to_string())
+    }
+}
+
+impl From<&String> for Expr {
+    fn from(s: &String) -> Self {
+        Expr(s.clone())
+    }
+}
+
+impl From<Expr> for String {
+    fn from(e: Expr) -> Self {
+        e.0
+    }
+}
+
+impl std::fmt::Display for Expr {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl PartialEq<str> for Expr {
+    fn eq(&self, other: &str) -> bool {
+        self.0 == other
+    }
+}
+
+impl PartialEq<&str> for Expr {
+    fn eq(&self, other: &&str) -> bool {
+        self.0 == *other
+    }
+}
+
+impl PartialEq<Expr> for String {
+    fn eq(&self, other: &Expr) -> bool {
+        *self == other.0
+    }
+}
+
+impl PartialEq<String> for Expr {
+    fn eq(&self, other: &String) -> bool {
+        &self.0 == other
+    }
+}
+
 /// What an expression must evaluate to.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -237,6 +325,8 @@ fn lex_spans(s: &str) -> Result<Vec<(Tok, usize, usize)>, DocError> {
    let at = |i: usize| cs.get(i).map(|x| x.0).unwrap_or(s.len());
    let mut i = 0;
    let mut out = Vec::new();
+    // Parentheses open at this point: a comma outside them can only be a decimal comma.
+    let mut depth = 0usize;
    while let Some(&(_, c)) = cs.get(i) {
        if c.is_whitespace() {
            i += 1;
@@ -245,6 +335,17 @@ fn lex_spans(s: &str) -> Result<Vec<(Tok, usize, usize)>, DocError> {
            while cs.get(i).is_some_and(|(_, c)| c.is_ascii_digit() || *c == '.') {
                i += 1;
            }
+            // A decimal comma (`2,5 mm`, as typed with a numeric keypad in many locales, #1347):
+            // a comma between digits, in a number with no point, outside any parentheses (inside
+            // them a comma separates a function's arguments: `max(1,2)`).
+            let digit = |k: usize| cs.get(k).is_some_and(|(_, c)| c.is_ascii_digit());
+            let has_point = cs.get(st..i).is_some_and(|ds| ds.iter().any(|(_, c)| *c == '.'));
+            if depth == 0 && !has_point && digit(i.wrapping_sub(1)) && cs.get(i).is_some_and(|(_, c)| *c == ',') && digit(i + 1) {
+                i += 1;
+                while digit(i) {
+                    i += 1;
+                }
+            }
            // Exponent: 1e-3 (but not `2em`).
            if cs.get(i).is_some_and(|(_, c)| *c == 'e' || *c == 'E') {
                let sign = cs.get(i + 1).is_some_and(|(_, c)| *c == '-' || *c == '+');
@@ -257,7 +358,7 @@ fn lex_spans(s: &str) -> Result<Vec<(Tok, usize, usize)>, DocError> {
                }
            }
            let t = s.get(at(st)..at(i)).unwrap_or_default();
-            let v: f64 = t.parse().map_err(|_| DocError::Expr(format!("bad number `{t}`")))?;
+            let v: f64 = t.replace(',', ".").parse().map_err(|_| DocError::Expr(format!("bad number `{t}`")))?;
            out.push((Tok::Num(v), at(st), at(i)));
        } else if c.is_alphabetic() || c == '_' || c == 'µ' {
            let st = i;
@@ -268,6 +369,13 @@ fn lex_spans(s: &str) -> Result<Vec<(Tok, usize, usize)>, DocError> {
        } else if c == '°' {
            out.push((Tok::Id("deg".into()), at(i), at(i + 1)));
            i += 1;
+        } else if c == '"' || c == '″' {
+            // Inch and foot marks (`1"`, `2'`, #1502), straight or as primes.
+            out.push((Tok::Id("in".into()), at(i), at(i + 1)));
+            i += 1;
+        } else if c == '\'' || c == '′' {
+            out.push((Tok::Id("ft".into()), at(i), at(i + 1)));
+            i += 1;
        } else if c == '×' || c == '·' {
            out.push((Tok::Op('*'), at(i), at(i + 1)));
            i += 1;
@@ -282,6 +390,11 @@ fn lex_spans(s: &str) -> Result<Vec<(Tok, usize, usize)>, DocError> {
            out.push((Tok::Op(','), at(i), at(i + 1)));
            i += 1;
        } else if "+-*/^(),%".contains(c) {
+            match c {
+                '(' => depth += 1,
+                ')' => depth = depth.saturating_sub(1),
+                _ => {}
+            }
            out.push((Tok::Op(c), at(i), at(i + 1)));
            i += 1;
        } else {
@@ -819,6 +932,39 @@ mod tests {
        ParamDef { name: n.into(), expr: e.into(), unit: u.into() }
    }

+    #[test]
+    fn a_decimal_comma_outside_parentheses() {
+        // #1347: a comma between digits is a decimal comma where it cannot separate arguments.
+        assert_eq!(ev("2,5", Kind::Unitless).unwrap(), 2.5);
+        assert_eq!(ev("2,5 mm", Kind::Length).unwrap(), 2.5);
+        assert_eq!(ev("12,75mm + 0,25", Kind::Length).unwrap(), 13.0);
+        assert_eq!(ev("width / 2,5", Kind::Length).unwrap(), 16.0);
+        assert!((ev("1,5e3 mm", Kind::Length).unwrap() - 1500.0).abs() < 1e-9);
+        assert!((ev("22,5 deg", Kind::Angle).unwrap() - 22.5f64.to_radians()).abs() < 1e-12);
+        // Inside parentheses a comma still separates a function's arguments.
+        assert_eq!(ev("max(1,2)", Kind::Unitless).unwrap(), 2.0);
+        assert_eq!(ev("max(1 mm, 3, 2)", Kind::Length).unwrap(), 3.0);
+        assert_eq!(ev("(2,5)", Kind::Unitless).ok(), None, "a comma inside parentheses is not a decimal comma");
+        // Not between two digits, or a second comma: still an error.
+        for bad in ["2,", ",5", "2 ,5", "2, 5", "1,5,3", "1.5,3"] {
+            assert!(ev(bad, Kind::Unitless).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn inch_and_foot_marks() {
+        // #1502: `1"` in a millimetre design is an inch, `2'` two feet, straight or as primes.
+        assert_eq!(ev("1\"", Kind::Length).unwrap(), 25.4);
+        assert_eq!(ev("1″", Kind::Length).unwrap(), 25.4);
+        assert_eq!(ev("2'", Kind::Length).unwrap(), 609.6);
+        assert_eq!(ev("2′", Kind::Length).unwrap(), 609.6);
+        assert_eq!(ev("1/2\"", Kind::Length).unwrap(), 12.7);
+        assert_eq!(ev("width + 1\"", Kind::Length).unwrap(), 65.4);
+        assert_eq!(ev("2' + 3\"", Kind::Length).unwrap(), 685.8);
+        // A mark alone is its unit alone, as `in` is.
+        assert_eq!(ev("\"", Kind::Length).ok(), ev("in", Kind::Length).ok());
+    }
+
    #[test]
    fn arithmetic_and_units() {
        assert_eq!(ev("10", Kind::Length).unwrap(), 10.0);
@@ -69,8 +69,12 @@ impl FaceAnchor {
        }
        let inverse = crate::mat_inverse(&self.author_frame(doc, author)?)
            .ok_or_else(|| DocError::Invalid("attached sketch author frame is invalid".into()))?;
-        let source =
-            EmbossFace { body: self.target.body.clone(), at: self.target.point, path: self.path.clone(), author_path: self.author_path.clone() };
+        let source = EmbossFace {
+            body: self.target.body.clone().into(),
+            at: crate::FacePick(self.target.point),
+            path: self.path.clone(),
+            author_path: self.author_path.clone(),
+        };
        Ok(crate::mat_mul(&inverse, &source.body_frame(doc, body)?))
    }
 }
@@ -78,7 +82,7 @@ impl FaceAnchor {
 pub fn plane_face_anchor(plane: &PlaneRef) -> Option<&FaceAnchor> {
    match plane {
        PlaneRef::Face { anchor, .. } => anchor.as_deref(),
-        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => plane_face_anchor(base),
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => plane_face_anchor(base),
        _ => None,
    }
 }
@@ -86,7 +90,7 @@ pub fn plane_face_anchor(plane: &PlaneRef) -> Option<&FaceAnchor> {
 fn has_face_reference(plane: &PlaneRef) -> bool {
    match plane {
        PlaneRef::Face { .. } => true,
-        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => has_face_reference(base),
+        PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => has_face_reference(base),
        _ => false,
    }
 }
@@ -106,7 +110,9 @@ impl Document {
            }
            match plane {
                PlaneRef::Face { anchor: Some(anchor), .. } => *plane = PlaneRef::Custom { plane: doc.resolve_face_anchor(anchor, author, state)? },
-                PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } => replace(doc, base, author, state, depth + 1)?,
+                PlaneRef::Offset { base, .. } | PlaneRef::AtAngle { base, .. } | PlaneRef::Flipped { base, .. } => {
+                    replace(doc, base, author, state, depth + 1)?
+                }
                _ => {}
            }
            Ok(())
@@ -446,7 +452,8 @@ mod tests {
        let producer = doc
            .add_feature(
                FeatureKind::Extrude {
-                    sketch: source,
+                    thin: None,
+                    sketch: crate::SketchId(source),
                    profiles: crate::ProfileSel::Indices { indices: vec![0, 1] },
                    extent,
                    operation: crate::Operation::NewBody,
@@ -555,7 +562,14 @@ mod tests {
        let extent = serde_json::from_value(serde_json::json!({"distance":"2"})).unwrap();
        let boss = doc
            .add_feature(
-                FeatureKind::Extrude { sketch: sk, profiles: crate::ProfileSel::All, extent, operation: crate::Operation::NewBody, targets: vec![] },
+                FeatureKind::Extrude {
+                    thin: None,
+                    sketch: crate::SketchId(sk),
+                    profiles: crate::ProfileSel::All,
+                    extent,
+                    operation: crate::Operation::NewBody,
+                    targets: vec![],
+                },
                Some("Boss"),
            )
            .unwrap();
@@ -0,0 +1,101 @@
+//! The geometry a feature holds, each piece with its role: the points that pick faces (moved
+//! with the feature, and the source of its persistent face names), other positions, directions,
+//! planes, construction references, a primitive's placement point and its profile selections.
+//! The walk (`crate::walk`) is behind `transform_geometry`, `face_points`, `profile_sels` and
+//! `point_expr`.
+
+use solidcraft_geom::Vec3;
+
+use crate::walk::Walk;
+use crate::{FeatureKind, PointExpr, ProfileSel};
+
+/// A piece of a feature's geometry: `V` is `&Vec3` or `&mut Vec3`, and so on for the others.
+pub(crate) enum Geo<V, P, G, E, S> {
+    /// A point that picks a face: it moves with the feature and names the face it picks.
+    Pick(V),
+    /// A point that picks a face but stays where it is when the feature is moved (an Emboss
+    /// cylinder, chosen in its component's frame).
+    Pinned(V),
+    /// Any other position (an edge pick, an axis origin, a fold line): it moves with the feature.
+    Pos(V),
+    /// A direction: it turns with the feature.
+    Dir(V),
+    Plane(P),
+    /// A construction axis's or point's reference to the model.
+    Construct(G),
+    /// A primitive's placement point (length expressions).
+    Placement(E),
+    /// A profile selection, with its sketch.
+    Profiles(u64, S),
+}
+
+impl FeatureKind {
+    /// The points that pick faces (shell, draft, offset and replace faces, a hole's placement and
+    /// `to`, an extrude's `to` and `from`…), in the order of the feature's persistent face names.
+    pub fn face_points_mut(&mut self) -> Vec<&mut Vec3> {
+        let mut v = Vec::new();
+        self.walk_geometry_mut(&mut |g| {
+            if let Geo::Pick(p) | Geo::Pinned(p) = g {
+                v.push(p);
+            }
+        });
+        v
+    }
+
+    /// Read-only view of [`FeatureKind::face_points_mut`].
+    pub fn face_points(&self) -> Vec<Vec3> {
+        let mut v = Vec::new();
+        self.walk_geometry(&mut |g| {
+            if let Geo::Pick(p) | Geo::Pinned(p) = g {
+                v.push(*p);
+            }
+        });
+        v
+    }
+
+    /// The feature's profile selections, each with its sketch.
+    pub fn profile_sels_mut(&mut self) -> Vec<(u64, &mut ProfileSel)> {
+        let mut v = Vec::new();
+        self.walk_geometry_mut(&mut |g| {
+            if let Geo::Profiles(sketch, sel) = g {
+                v.push((sketch, sel));
+            }
+        });
+        v
+    }
+
+    /// Read-only view of [`FeatureKind::profile_sels_mut`].
+    pub fn profile_sels(&self) -> Vec<(u64, &ProfileSel)> {
+        let mut v = Vec::new();
+        self.walk_geometry(&mut |g| {
+            if let Geo::Profiles(sketch, sel) = g {
+                v.push((sketch, sel));
+            }
+        });
+        v
+    }
+
+    /// A primitive's placement point (length expressions). Its coordinates are not inputs:
+    /// they get no parameter names and keep bare numbers in mm whatever the design's units, as
+    /// every other position does; renames and users still find them.
+    pub fn point_expr_mut(&mut self) -> Option<&mut PointExpr> {
+        let mut found = None;
+        self.walk_geometry_mut(&mut |g| {
+            if let Geo::Placement(p) = g {
+                found = Some(p);
+            }
+        });
+        found
+    }
+
+    /// Read-only view of [`FeatureKind::point_expr_mut`].
+    pub fn point_expr(&self) -> Option<&PointExpr> {
+        let mut found = None;
+        self.walk_geometry(&mut |g| {
+            if let Geo::Placement(p) = g {
+                found = Some(p);
+            }
+        });
+        found
+    }
+}
@@ -0,0 +1,59 @@
+//! References from a feature to the rest of the design: the sketches it is built from (by id),
+//! the features it names (patterned and mirrored features, the construction plane a plane is
+//! built on) and the bodies it works on (by name). The walk (`crate::walk`) is behind
+//! `input_sketches`, `remap_refs` and `remap_bodies`.
+
+use std::collections::BTreeMap;
+
+use crate::walk::Walk;
+use crate::{BodyName, FeatureKind, FeatureName, SketchId};
+
+/// A reference a feature holds: `S` is `&SketchId` or `&mut SketchId`, and so on.
+pub(crate) enum Ref<S, F, B> {
+    Sketch(S),
+    Feature(F),
+    Body(B),
+}
+
+impl FeatureKind {
+    /// Sketches the feature is built from (profiles, paths, points): deleting one of them
+    /// deletes the feature.
+    pub fn input_sketches(&self) -> Vec<u64> {
+        let mut v = Vec::new();
+        self.walk_refs(&mut |r| {
+            if let Ref::Sketch(id) = r {
+                v.push(id.0);
+            }
+        });
+        v
+    }
+
+    /// Point references to sketches (by id) and features (by name) at their copies, or at a
+    /// feature's new name (`timeline.rename`).
+    pub fn remap_refs(&mut self, sketches: &BTreeMap<u64, u64>, names: &BTreeMap<String, String>) {
+        self.walk_refs_mut(&mut |r| match r {
+            Ref::Sketch(id) => {
+                if let Some(n) = sketches.get(&id.0) {
+                    *id = SketchId(*n);
+                }
+            }
+            Ref::Feature(name) => {
+                if let Some(n) = names.get(name.as_ref()) {
+                    *name = FeatureName(n.clone());
+                }
+            }
+            Ref::Body(_) => {}
+        });
+    }
+
+    /// Point references to bodies (by name) at their copies.
+    pub fn remap_bodies(&mut self, bodies: &BTreeMap<String, String>) {
+        self.walk_refs_mut(&mut |r| {
+            if let Ref::Body(name) = r
+                && let Some(n) = bodies.get(name.as_ref())
+            {
+                *name = BodyName(n.clone());
+            }
+        });
+    }
+}
@@ -0,0 +1,197 @@
+//! Golden records of what the walks over a feature report, for every variant (and every fillet
+//! style, pattern, hole and construction definition):
+//! - expressions: `inputs` (label, expression, kind, in order: the order names the `dN`
+//!   parameters) and `expressions` (every expression, placement points included). Each
+//!   expression field holds its own name, so a moved, missing or relabelled input shows;
+//! - references: the sketches a feature is built from, and the fields `remap_refs` and
+//!   `remap_bodies` rewrite when everything is copied under new ids and names;
+//! - geometry: the fields `transform_geometry` moves, the face points, the profile selections and
+//!   the placement point.
+//!
+//! The records live in `feature_walk_tests/*.txt`; to record an intended change, run the tests
+//! with `FEATURE_WALK_BLESS=1`.
+
+mod fixtures;
+
+use std::collections::BTreeMap;
+
+use fixtures::{changed, fixtures, with_points, with_refs};
+
+use crate::FeatureKind;
+
+/// Per fixture: its inputs, one per line (`label = expression (kind)`), then every expression.
+fn record() -> String {
+    let mut out = String::new();
+    for (name, v) in fixtures() {
+        let kind: FeatureKind = serde_json::from_value(v).unwrap_or_else(|e| panic!("{name}: {e}"));
+        out += &format!("{name}\n");
+        let inputs = kind.inputs();
+        if !inputs.is_empty() {
+            out += "  inputs:\n";
+            for (label, e, k) in inputs {
+                out += &format!("    {label} = {e} ({k:?})\n");
+            }
+        }
+        let expressions = kind.expressions();
+        if !expressions.is_empty() {
+            out += &format!("  expressions: {}\n", expressions.join(", "));
+        }
+    }
+    out
+}
+
+/// Per fixture: the sketches it is built from, and the fields that copying with every sketch,
+/// feature and body renamed rewrites (`remap_refs`: sketches and features; `remap_bodies`).
+fn ref_record() -> String {
+    let sketches: BTreeMap<u64, u64> = (1..=8).map(|i| (i, i + 100)).collect();
+    let names = BTreeMap::from([("F".to_string(), "F2".to_string()), ("CP".to_string(), "CP2".to_string())]);
+    let bodies = BTreeMap::from([("B".to_string(), "B2".to_string())]);
+    let mut out = String::new();
+    for (name, v) in fixtures() {
+        let kind: FeatureKind = serde_json::from_value(with_refs(name, v)).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let before = serde_json::to_value(&kind).unwrap();
+        let mut refs = kind.clone();
+        refs.remap_refs(&sketches, &names);
+        let mut by_refs = Vec::new();
+        changed(&before, &serde_json::to_value(&refs).unwrap(), "", &mut by_refs);
+        let mut body = kind.clone();
+        body.remap_bodies(&bodies);
+        let mut by_bodies = Vec::new();
+        changed(&before, &serde_json::to_value(&body).unwrap(), "", &mut by_bodies);
+        out += &format!("{name}\n");
+        let sketches = kind.input_sketches();
+        if !sketches.is_empty() {
+            out += &format!("  sketches: {sketches:?}\n");
+        }
+        if !by_refs.is_empty() {
+            out += &format!("  remap_refs: {}\n", by_refs.join(", "));
+        }
+        if !by_bodies.is_empty() {
+            out += &format!("  remap_bodies: {}\n", by_bodies.join(", "));
+        }
+    }
+    out
+}
+
+/// A variant with a field that refers to a sketch (a `SketchId`, sketch points or loft
+/// sections) must report it from `input_sketches`, or deleting the sketch leaves the feature
+/// broken. New variants are caught by the walk's exhaustive match; this catches a
+/// sketch field added to an existing variant (its fixture has to set it).
+/// Per fixture (with every reference and position set): the fields `transform_geometry` changes
+/// under a turn and a shift (every point, direction and plane it maps), the face points that name
+/// faces, the profile selections with their sketches, and a primitive's placement point.
+fn geometry_record() -> String {
+    // x → y → z → x, then (1, 2, 3): every point and every direction of the fixtures changes.
+    let m = [[0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0], [1.0, 0.0, 0.0, 0.0], [1.0, 2.0, 3.0, 1.0]];
+    let mut out = String::new();
+    for (name, v) in fixtures() {
+        let kind: FeatureKind = serde_json::from_value(with_points(name, with_refs(name, v))).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let mut moved = kind.clone();
+        moved.transform_geometry(&m);
+        let mut paths = Vec::new();
+        changed(&serde_json::to_value(&kind).unwrap(), &serde_json::to_value(&moved).unwrap(), "", &mut paths);
+        out += &format!("{name}\n");
+        if !paths.is_empty() {
+            out += &format!("  moves: {}\n", paths.join(", "));
+        }
+        let faces: Vec<String> = kind.face_points().iter().map(|p| format!("[{}, {}, {}]", p.x, p.y, p.z)).collect();
+        if !faces.is_empty() {
+            out += &format!("  face points: {}\n", faces.join(", "));
+        }
+        let profiles: Vec<String> = kind
+            .profile_sels()
+            .iter()
+            .map(|(sketch, sel)| format!("{sketch} {}", serde_json::to_value(sel).unwrap()["type"].as_str().unwrap_or("?")))
+            .collect();
+        if !profiles.is_empty() {
+            out += &format!("  profiles: {}\n", profiles.join(", "));
+        }
+        if let Some(p) = kind.point_expr() {
+            out += &format!("  placement: {}\n", p.iter().map(|e| e.as_str()).collect::<Vec<_>>().join(", "));
+        }
+    }
+    out
+}
+
+/// Compares `got` with the golden file `name` in `feature_walk_tests/`, line by line. With
+/// `FEATURE_WALK_BLESS` set it rewrites the file instead, for an intended change (say why in the
+/// pull request).
+fn check_golden(name: &str, want: &str, got: &str) {
+    if std::env::var_os("FEATURE_WALK_BLESS").is_some() {
+        let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/feature_walk_tests").join(name);
+        std::fs::write(&path, got).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+        return;
+    }
+    for (line, (want, got)) in want.lines().zip(got.lines()).enumerate() {
+        assert_eq!(want, got, "{name} line {}; rerun with FEATURE_WALK_BLESS=1 if the change is intended", line + 1);
+    }
+    assert_eq!(want.lines().count(), got.lines().count(), "{name}: the record has a different number of lines");
+}
+
+/// Recorded from the hand-written `inputs_mut` and `expressions` the walk replaced.
+const GOLDEN_EXPRS: &str = include_str!("feature_walk_tests/golden_exprs.txt");
+
+/// Recorded from the hand-written `transform_geometry`, `face_points`, `profile_sels` and
+/// `point_expr` the walk replaced.
+const GOLDEN_GEOMETRY: &str = include_str!("feature_walk_tests/golden_geometry.txt");
+
+/// Recorded from the hand-written `input_sketches`, `remap_refs` and `remap_bodies` the walk
+/// replaced, with two fixes: a coil's `targets` and a surface trim's plane are remapped too.
+const GOLDEN_REFS: &str = include_str!("feature_walk_tests/golden_refs.txt");
+
+#[test]
+fn input_sketches_lists_every_variant_with_a_sketch_field() {
+    let src = include_str!("document.rs").replace("\r\n", "\n");
+    let body = src.split("pub enum FeatureKind {").nth(1).and_then(|s| s.split("\n}\n").next()).unwrap();
+    let mut with_sketch = Vec::new();
+    let mut variant = String::new();
+    for line in body.lines() {
+        let t = line.trim();
+        if line.starts_with("    ") && !line.starts_with("     ") && t.chars().next().is_some_and(|c| c.is_ascii_uppercase()) {
+            variant = t.split(|c: char| !c.is_alphanumeric()).next().unwrap_or("").to_lowercase();
+            continue;
+        }
+        let Some((_, ty)) = t.strip_prefix("pub ").unwrap_or(t).split_once(':') else { continue };
+        let refers = ty.contains("SketchId") || ty.contains("SketchPoints") || ty.contains("LoftSection");
+        if refers && !t.starts_with("//") && !with_sketch.contains(&variant) {
+            with_sketch.push(variant.clone());
+        }
+    }
+    assert!(with_sketch.len() >= 10, "the FeatureKind parse found too few sketch users: {with_sketch:?}");
+    for v in with_sketch {
+        let uses = fixtures().into_iter().filter(|(_, f)| f["type"].as_str().unwrap().replace('_', "") == v).any(|(name, f)| {
+            let kind: FeatureKind = serde_json::from_value(with_refs(name, f)).unwrap();
+            !kind.input_sketches().is_empty()
+        });
+        assert!(uses, "FeatureKind::{v} has a sketch field but input_sketches reports no sketch for its fixtures");
+    }
+}
+
+#[test]
+fn geometry_matches_the_golden_record() {
+    check_golden("golden_geometry.txt", GOLDEN_GEOMETRY, &geometry_record());
+}
+
+#[test]
+fn references_match_the_golden_record() {
+    check_golden("golden_refs.txt", GOLDEN_REFS, &ref_record());
+}
+
+#[test]
+fn inputs_and_expressions_match_the_golden_record() {
+    check_golden("golden_exprs.txt", GOLDEN_EXPRS, &record());
+}
+
+#[test]
+fn the_record_covers_every_variant() {
+    let src = include_str!("document.rs").replace("\r\n", "\n");
+    let body = src.split("pub enum FeatureKind {").nth(1).and_then(|s| s.split("\n}\n").next()).unwrap();
+    let names: Vec<String> = fixtures().into_iter().map(|(_, v)| v["type"].as_str().unwrap().replace('_', "")).collect();
+    for line in body.lines().filter(|l| l.starts_with("    ") && !l.starts_with("     ")) {
+        let t = line.trim();
+        if t.chars().next().is_some_and(|c| c.is_ascii_uppercase()) {
+            let variant = t.split(|c: char| !c.is_alphanumeric()).next().unwrap_or("").to_lowercase();
+            assert!(names.contains(&variant), "FeatureKind::{t} has no fixture in feature_walk_tests");
+        }
+    }
+}
@@ -0,0 +1,277 @@
+//! Fixtures for the golden records in `feature_walk_tests`: one feature per variant (and per
+//! fillet style, pattern, hole kind and construction definition), each expression field holding
+//! its own name, plus the reference fields `with_refs` sets.
+
+use serde_json::{Value, json};
+
+fn plane(chain: &str) -> Value {
+    json!({"type": "at_angle", "angle": format!("{chain}.angle"), "axis_origin": [0, 0, 0], "axis_dir": [1, 0, 0],
+        "base": {"type": "offset", "distance": format!("{chain}.offset"), "base": {"type": "construction", "name": "CP"}}})
+}
+
+fn geo_plane(chain: &str) -> Value {
+    json!({"type": "plane", "plane": plane(chain)})
+}
+
+fn along(chain: &str) -> Value {
+    json!({"type": "along_path", "path": {"type": "edge", "at": [0, 0, 0]}, "t": format!("{chain}.t")})
+}
+
+pub(super) fn fixtures() -> Vec<(&'static str, Value)> {
+    let o = [0, 0, 0];
+    let sk = serde_json::to_value(solidcraft_sketch::Sketch::new()).unwrap();
+    let extent = |n: &str| {
+        json!({"distance": format!("{n}.distance"), "distance2": format!("{n}.distance2"), "start_offset": format!("{n}.start_offset"),
+            "taper": format!("{n}.taper"), "to_offset": format!("{n}.to_offset")})
+    };
+    let fillet = |style: Value| json!({"type": "fillet", "edges": [o], "radius": "fillet.radius", "style": style});
+    let pattern = |p: Value| json!({"type": "pattern", "features": ["F"], "pattern": p});
+    let hole =
+        |h: Value| json!({"type": "hole", "position": o, "direction": [0, 0, 1], "diameter": "hole.diameter", "depth": "hole.depth", "hole": h});
+    vec![
+        (
+            "body_transfer",
+            json!({"type": "body_transfer", "bodies": ["B"], "from": 0, "to": 1, "transform": [[1,0,0,0],[0,1,0,0],[0,0,1,0],[0,0,0,1]]}),
+        ),
+        ("sketch", json!({"type": "sketch", "plane": plane("sketch"), "sketch": sk.clone()})),
+        ("sketch_along_path", json!({"type": "sketch", "plane": along("sketch"), "sketch": sk})),
+        ("extrude", json!({"type": "extrude", "sketch": 1, "profiles": {"type": "all"}, "extent": extent("extrude")})),
+        (
+            "extrude_thin",
+            json!({"type": "extrude", "sketch": 1, "profiles": {"type": "all"}, "extent": extent("thin"),
+                "thin": {"curves": ["c1"], "thickness": "thin.thickness", "side": "two_sides", "thickness2": "thin.thickness2"}}),
+        ),
+        (
+            "revolve",
+            json!({"type": "revolve", "sketch": 1, "profiles": {"type": "all"}, "axis": {"type": "world", "axis": "X"}, "angle": "revolve.angle", "angle2": "revolve.angle2"}),
+        ),
+        ("fillet_constant", fillet(json!({"type": "constant"}))),
+        ("fillet_chord", fillet(json!({"type": "chord"}))),
+        ("fillet_curvature", fillet(json!({"type": "curvature"}))),
+        ("fillet_variable", fillet(json!({"type": "variable", "radius2": "fillet.radius2", "start": o, "mid": [[0.5, "fillet.mid"]]}))),
+        ("fillet_spline", fillet(json!({"type": "spline", "start": o, "knots": [0.0, 1.0], "radii": ["fillet.r1", "fillet.r2", "fillet.r3"]}))),
+        (
+            "chamfer",
+            json!({"type": "chamfer", "edges": [o], "distance": "chamfer.distance", "distance2": "chamfer.distance2", "angle": "chamfer.angle"}),
+        ),
+        ("box", json!({"type": "box", "corner": ["box.x", "box.y", "box.z"], "length": "box.length", "width": "box.width", "height": "box.height"})),
+        ("cylinder", json!({"type": "cylinder", "base": ["cyl.x", "cyl.y", "cyl.z"], "radius": "cyl.radius", "height": "cyl.height"})),
+        ("sphere", json!({"type": "sphere", "center": ["sph.x", "sph.y", "sph.z"], "radius": "sph.radius"})),
+        ("torus", json!({"type": "torus", "center": ["tor.x", "tor.y", "tor.z"], "major": "tor.major", "minor": "tor.minor"})),
+        ("combine", json!({"type": "combine", "target": "A", "tools": ["B"], "operation": "join"})),
+        (
+            "pattern_rectangular",
+            pattern(
+                json!({"type": "rectangular", "dir1": [1, 0, 0], "count1": "rect.count1", "spacing1": "rect.spacing1", "dir2": [0, 1, 0], "count2": "rect.count2", "spacing2": "rect.spacing2"}),
+            ),
+        ),
+        ("pattern_circular", pattern(json!({"type": "circular", "origin": o, "axis": [0, 0, 1], "count": "circ.count", "angle": "circ.angle"}))),
+        ("pattern_path", pattern(json!({"type": "path", "path_sketch": 1, "path": ["l1"], "count": "path.count", "spacing": "path.spacing"}))),
+        ("mirror", json!({"type": "mirror", "features": ["F"], "plane": plane("mirror")})),
+        ("hole_simple", hole(json!({"type": "simple"}))),
+        ("hole_drilled", hole(json!({"type": "drilled", "tip_angle": "hole.tip_angle"}))),
+        ("hole_counterbore", hole(json!({"type": "counterbore", "cb_diameter": "hole.cb_diameter", "cb_depth": "hole.cb_depth"}))),
+        ("hole_countersink", hole(json!({"type": "countersink", "cs_diameter": "hole.cs_diameter", "cs_angle": "hole.cs_angle"}))),
+        ("thread", json!({"type": "thread", "face": o, "length": "thread.length"})),
+        ("loft", json!({"type": "loft", "sections": []})),
+        ("sweep", json!({"type": "sweep", "sketch": 1, "profiles": {"type": "all"}, "path_sketch": 2, "path": ["l1"]})),
+        (
+            "sweep_options",
+            json!({"type": "sweep", "sketch": 1, "profiles": {"type": "all"}, "path_sketch": 2, "path": ["l1"],
+                "orientation": {"direction": [0, 1, 0]}, "twist": "sweep.twist", "scale": "sweep.scale"}),
+        ),
+        ("shell", json!({"type": "shell", "faces": [o], "thickness": "shell.thickness"})),
+        ("draft", json!({"type": "draft", "faces": [o], "angle": "draft.angle", "neutral": plane("draft_neutral"), "pull": [0, 0, 1]})),
+        ("construction_plane", json!({"type": "construction_plane", "plane": plane("cplane")})),
+        ("split", json!({"type": "split", "body": "B", "plane": plane("split")})),
+        ("split_line", json!({"type": "split", "body": "B", "plane": plane("split_line")})),
+        (
+            "construction_axis",
+            json!({"type": "construction_axis", "def": {"type": "two_planes", "a": geo_plane("axis_a"), "b": geo_plane("axis_b")}}),
+        ),
+        (
+            "construction_point_planes",
+            json!({"type": "construction_point", "def": {"type": "three_planes", "a": geo_plane("pt_a"), "b": geo_plane("pt_b"), "c": geo_plane("pt_c")}}),
+        ),
+        (
+            "construction_point_along",
+            json!({"type": "construction_point", "def": {"type": "along_path", "path": {"type": "edge", "at": o}, "t": "pt.t"}}),
+        ),
+        ("split_face", json!({"type": "split_face", "faces": [o], "plane": plane("split_face")})),
+        ("scale", json!({"type": "scale", "bodies": ["B"], "factor": "scale.factor", "factors": ["scale.x", "scale.y", "scale.z"]})),
+        ("offset_face", json!({"type": "offset_face", "faces": [o], "distance": "offset_face.distance"})),
+        ("delete_face", json!({"type": "delete_face", "faces": [o]})),
+        ("bounding_solid", json!({"type": "bounding_solid", "bodies": ["B"], "margin": "bounding.margin"})),
+        ("pipe", json!({"type": "pipe", "path_sketch": 1, "path": ["l1"], "diameter": "pipe.diameter", "wall": "pipe.wall"})),
+        ("emboss", json!({"type": "emboss", "sketch": 1, "profiles": {"type": "all"}, "depth": "emboss.depth"})),
+        ("rib", json!({"type": "rib", "sketch": 1, "curves": ["l1"], "thickness": "rib.thickness", "depth": "rib.depth"})),
+        ("replace_face", json!({"type": "replace_face", "faces": [o], "target": plane("replace_face")})),
+        ("align", json!({"type": "align", "bodies": ["B"], "from": o, "to": o})),
+        (
+            "coil",
+            json!({"type": "coil", "base": ["coil.x", "coil.y", "coil.z"], "diameter": "coil.diameter", "pitch": "coil.pitch", "turns": "coil.turns", "section_size": "coil.section_size", "start_angle": "coil.start_angle"}),
+        ),
+        ("sheet_base", json!({"type": "sheet_base", "sketch": 1, "profiles": {"type": "all"}})),
+        ("sheet_contour", json!({"type": "sheet_contour", "sketch": 1, "curves": ["l1"], "distance": "contour.distance"})),
+        (
+            "sheet_flange",
+            json!({"type": "sheet_flange", "edges": [{"point": o, "angle": "flange.e1_angle", "height": "flange.e1_height"}, {"point": o, "angle": null, "height": "flange.e2_height"}], "height": "flange.height", "angle": "flange.angle", "radius": "flange.radius", "corner_relief_shape": "round", "corner_relief": "flange.relief"}),
+        ),
+        ("sheet_hem", json!({"type": "sheet_hem", "edges": [o], "length": "hem.length", "gap": "hem.gap"})),
+        (
+            "sheet_perforate",
+            json!({"type": "sheet_perforate", "diameter": "perforate.diameter", "pitch": "perforate.pitch", "margin": "perforate.margin"}),
+        ),
+        (
+            "sheet_fold",
+            json!({"type": "sheet_fold", "a": o, "b": [1, 0, 0], "angle": "fold.angle", "radius": "fold.radius", "position": "centerline"}),
+        ),
+        ("sheet_unfold", json!({"type": "sheet_unfold"})),
+        ("sheet_convert", json!({"type": "sheet_convert", "body": "B", "face": o})),
+        (
+            "boss",
+            json!({"type": "boss", "position": o, "diameter": "boss.diameter", "height": "boss.height", "hole_diameter": "boss.hole_diameter", "hole_depth": "boss.hole_depth",
+            "draft": "boss.draft", "fillet": "boss.fillet", "ribs": "boss.ribs", "rib_thickness": "boss.rib_thickness", "rib_length": "boss.rib_length", "rib_offset": "boss.rib_offset"}),
+        ),
+        ("lip", json!({"type": "lip", "face": o, "width": "lip.width", "height": "lip.height", "gap": "lip.gap"})),
+        (
+            "snap_fit",
+            json!({"type": "snap_fit", "position": o, "hook": [1, 0, 0], "length": "snap.length", "thickness": "snap.thickness", "width": "snap.width", "catch_depth": "snap.catch_depth", "catch_length": "snap.catch_length"}),
+        ),
+        (
+            "rest",
+            json!({"type": "rest", "position": o, "width": "rest.width", "length": "rest.length", "height": "rest.height", "draft": "rest.draft", "thickness": "rest.thickness"}),
+        ),
+        ("boundary_fill", json!({"type": "boundary_fill", "tools": ["B"], "cells": [o]})),
+        ("remove", json!({"type": "remove", "bodies": ["B"]})),
+        ("patch", json!({"type": "patch"})),
+        ("stitch", json!({"type": "stitch", "bodies": ["B"], "tolerance": "stitch.tolerance"})),
+        ("thicken", json!({"type": "thicken", "bodies": ["B"], "thickness": "thicken.thickness", "operation": "new_body"})),
+        ("surface_extrude", json!({"type": "surface_extrude", "sketch": 1, "extent": extent("surface_extrude")})),
+        (
+            "surface_revolve",
+            json!({"type": "surface_revolve", "sketch": 1, "axis": {"type": "world", "axis": "X"}, "angle": "srev.angle", "angle2": "srev.angle2"}),
+        ),
+        ("surface_sweep", json!({"type": "surface_sweep", "sketch": 1, "path_sketch": 2, "path": ["l1"]})),
+        (
+            "surface_sweep_options",
+            json!({"type": "surface_sweep", "sketch": 1, "path_sketch": 2, "path": ["l1"],
+                "orientation": "parallel", "twist": "surface_sweep.twist", "scale": "surface_sweep.scale"}),
+        ),
+        ("surface_loft", json!({"type": "surface_loft", "sections": []})),
+        ("surface_blend", json!({"type": "surface_blend", "from": {"body": "B", "edges": [o]}, "to": {"body": "C", "edges": [o]}, "align": [o, o]})),
+        ("surface_offset", json!({"type": "surface_offset", "faces": [o], "distance": "soff.distance", "tolerance": "soff.tolerance"})),
+        // The Class-A surface family (surface.blend/boundary/match/fair).
+        ("surface_blend", json!({"type": "surface_blend", "from": {"body": "B", "edges": [o]}, "to": {"body": "C", "edges": [o]}, "align": [o, o]})),
+        ("surface_boundary", json!({"type": "surface_boundary", "sketch": 1, "curves": ["l1", "l2"]})),
+        ("surface_match", json!({"type": "surface_match", "body": "B", "faces": [o], "target": "C", "edges": [o]})),
+        ("surface_fair", json!({"type": "surface_fair", "body": "B", "faces": [o], "tolerance": "sfair.tolerance"})),
+        ("unstitch", json!({"type": "unstitch", "body": "B"})),
+        ("reverse_normal", json!({"type": "reverse_normal", "body": "B"})),
+        ("surface_untrim", json!({"type": "surface_untrim", "face": {"body": "B", "point": o}, "holes": [o], "outer": true})),
+        ("surface_extend", json!({"type": "surface_extend", "body": "B", "edges": [o], "distance": "extend.distance"})),
+        (
+            "surface_extend_to_plane",
+            json!({"type": "surface_extend", "body": "B", "edges": [o], "distance": "extend.distance", "mode": "curvature", "up_to": {"plane": plane("extend")}}),
+        ),
+        (
+            "surface_extend_to_face",
+            json!({"type": "surface_extend", "body": "B", "edges": [o], "distance": "extend.distance", "up_to": {"face": {"body": "B", "point": o}}, "neighbours": false}),
+        ),
+        (
+            "surface_ruled",
+            json!({"type": "surface_ruled", "body": "B", "edges": [o], "distance": "ruled.distance", "mode": "angle", "angle": "ruled.angle",
+                "direction": [0, 0, 1], "face": [1, 0, 0]}),
+        ),
+        ("surface_trim", json!({"type": "surface_trim", "body": "B", "plane": plane("trim"), "keep": o})),
+        ("move", json!({"type": "move", "bodies": ["B"], "translate": ["move.x", "move.y", "move.z"], "angle": "move.angle"})),
+        ("import", json!({"type": "import", "file": "a.step", "step": ""})),
+        ("mesh_convert", json!({"type": "mesh_convert", "body": "B", "tolerance": "mesh_convert.tolerance"})),
+        ("mesh_import", json!({"type": "mesh_import", "file": "a.stl", "meshes": []})),
+    ]
+}
+
+/// The reference fields a fixture leaves out (they don't change its expressions), set here so
+/// every sketch, feature and body reference is exercised: sketches 1–8, feature `F`,
+/// construction plane `CP`, body `B`.
+pub(super) fn with_refs(name: &str, mut v: Value) -> Value {
+    let o = [0, 0, 0];
+    let tool = json!({"body": "B", "point": o});
+    let extra = match name {
+        "extrude" | "extrude_thin" | "revolve" | "sweep" | "sweep_options" | "pipe" | "coil" | "thicken" => json!({"targets": ["B"]}),
+        "fillet_constant" | "fillet_chord" | "fillet_curvature" | "fillet_variable" | "fillet_spline" | "chamfer" | "shell" | "draft"
+        | "offset_face" | "delete_face" | "replace_face" | "sheet_flange" | "sheet_hem" | "sheet_perforate" | "sheet_unfold" | "boss" | "lip"
+        | "snap_fit" | "rest" | "surface_offset" => {
+            json!({"body": "B"})
+        }
+        "combine" => json!({"target": "B", "tools": ["B"]}),
+        "pattern_rectangular" | "pattern_circular" | "pattern_path" | "mirror" => json!({"bodies": ["B"]}),
+        "hole_simple" | "hole_drilled" | "hole_counterbore" | "hole_countersink" => json!({"points": {"sketch": 3, "ids": ["p"]}}),
+        "loft" => json!({"sections": [{"sketch": 4, "profiles": {"type": "all"}}, {"sketch": 5, "profiles": {"type": "all"}}], "targets": ["B"]}),
+        "split" | "surface_trim" => json!({"tool": tool}),
+        "split_line" => json!({"sketch": 6, "line": "l1"}),
+        "surface_loft" => json!({"sections": [{"sketch": 4}, {"sketch": 5}]}),
+        "split_face" => json!({"body": "B", "tool": tool, "sketch": 6}),
+        "emboss" => json!({"face": {"body": "B", "at": o}, "targets": ["B"]}),
+        "sheet_fold" => json!({"sketch": 7, "body": "B"}),
+        "patch" => json!({"sketch": 8, "body": "B"}),
+        _ => json!({}),
+    };
+    if let (Some(o), Some(e)) = (v.as_object_mut(), extra.as_object()) {
+        o.extend(e.clone());
+    }
+    v
+}
+
+/// The positions and directions a fixture leaves out (they don't change its expressions or
+/// references), set here so every point, direction and axis the geometry walks read is present:
+/// `to` / `from` picks, line axes, normals and origins. `hole_simple` places its hole at
+/// `position` (no sketch points), the other holes at sketch points.
+pub(super) fn with_points(name: &str, mut v: Value) -> Value {
+    let p = |i: f64| json!([i, i + 0.5, i + 0.25]);
+    let line = json!({"type": "line", "origin": p(9.0), "dir": [0.0, 0.6, 0.8]});
+    let extra = match name {
+        "extrude" | "surface_extrude" => {
+            if let Some(e) = v.get_mut("extent").and_then(Value::as_object_mut) {
+                e.insert("to".into(), p(1.0));
+                e.insert("from".into(), p(2.0));
+            }
+            json!({})
+        }
+        "revolve" => json!({"to": p(3.0), "axis": line}),
+        "surface_revolve" => json!({"axis": line}),
+        "hole_simple" => json!({"points": null, "to": p(4.0)}),
+        "hole_drilled" | "hole_counterbore" | "hole_countersink" => json!({"to": p(4.0)}),
+        "emboss" => json!({"face": {"body": "B", "at": p(5.0)}}),
+        "sheet_convert" => json!({"bends": [p(6.0)]}),
+        "sheet_fold" => json!({"fixed": p(7.0)}),
+        "rest" => json!({"along": [0.6, 0.8, 0.0]}),
+        "align" => json!({"from_normal": [0.0, 0.0, 1.0], "to_normal": [1.0, 0.0, 0.0]}),
+        "scale" => json!({"origin": p(8.0)}),
+        "move" => json!({"rotate_axis": [0.0, 1.0, 0.0]}),
+        "unstitch" | "reverse_normal" => json!({"faces": [p(10.0)]}),
+        _ => json!({}),
+    };
+    if let (Some(o), Some(e)) = (v.as_object_mut(), extra.as_object()) {
+        o.extend(e.clone());
+    }
+    v
+}
+
+/// The paths of the leaves that differ between two JSON values.
+pub(super) fn changed(a: &Value, b: &Value, path: &str, out: &mut Vec<String>) {
+    match (a, b) {
+        (Value::Object(x), Value::Object(y)) => {
+            for (k, v) in x {
+                changed(v, y.get(k).unwrap_or(&Value::Null), &format!("{path}.{k}"), out);
+            }
+        }
+        (Value::Array(x), Value::Array(y)) => {
+            for (i, v) in x.iter().enumerate() {
+                changed(v, y.get(i).unwrap_or(&Value::Null), &format!("{path}[{i}]"), out);
+            }
+        }
+        _ if a != b => out.push(path.trim_start_matches('.').to_string()),
+        _ => {}
+    }
+}
@@ -0,0 +1,389 @@
+body_transfer
+sketch
+  inputs:
+    Angle = sketch.angle (Angle)
+    Offset = sketch.offset (Length)
+  expressions: sketch.angle, sketch.offset
+sketch_along_path
+  inputs:
+    Distance (0 to 1) = sketch.t (Unitless)
+  expressions: sketch.t
+extrude
+  inputs:
+    Distance = extrude.distance (Length)
+    Distance 2 = extrude.distance2 (Length)
+    Start offset = extrude.start_offset (Length)
+    Taper angle = extrude.taper (Angle)
+    To offset = extrude.to_offset (Length)
+  expressions: extrude.distance, extrude.distance2, extrude.start_offset, extrude.taper, extrude.to_offset
+extrude_thin
+  inputs:
+    Distance = thin.distance (Length)
+    Distance 2 = thin.distance2 (Length)
+    Start offset = thin.start_offset (Length)
+    Taper angle = thin.taper (Angle)
+    To offset = thin.to_offset (Length)
+    Thickness = thin.thickness (Length)
+    Thickness 2 = thin.thickness2 (Length)
+  expressions: thin.distance, thin.distance2, thin.start_offset, thin.taper, thin.to_offset, thin.thickness, thin.thickness2
+revolve
+  inputs:
+    Angle = revolve.angle (Angle)
+    Angle 2 = revolve.angle2 (Angle)
+  expressions: revolve.angle, revolve.angle2
+fillet_constant
+  inputs:
+    Radius = fillet.radius (Length)
+  expressions: fillet.radius
+fillet_chord
+  inputs:
+    Chord length = fillet.radius (Length)
+  expressions: fillet.radius
+fillet_curvature
+  inputs:
+    Equivalent radius = fillet.radius (Length)
+  expressions: fillet.radius
+fillet_variable
+  inputs:
+    Start radius = fillet.radius (Length)
+    End radius = fillet.radius2 (Length)
+    Mid radius = fillet.mid (Length)
+  expressions: fillet.radius, fillet.radius2, fillet.mid
+fillet_spline
+  inputs:
+    Start radius = fillet.radius (Length)
+    Control radius = fillet.r1 (Length)
+    Control radius = fillet.r2 (Length)
+    End radius = fillet.r3 (Length)
+  expressions: fillet.radius, fillet.r1, fillet.r2, fillet.r3
+chamfer
+  inputs:
+    Distance = chamfer.distance (Length)
+    Distance 2 = chamfer.distance2 (Length)
+    Angle = chamfer.angle (Angle)
+  expressions: chamfer.distance, chamfer.distance2, chamfer.angle
+box
+  inputs:
+    Length = box.length (Length)
+    Width = box.width (Length)
+    Height = box.height (Length)
+  expressions: box.length, box.width, box.height, box.x, box.y, box.z
+cylinder
+  inputs:
+    Radius = cyl.radius (Length)
+    Height = cyl.height (Length)
+  expressions: cyl.radius, cyl.height, cyl.x, cyl.y, cyl.z
+sphere
+  inputs:
+    Radius = sph.radius (Length)
+  expressions: sph.radius, sph.x, sph.y, sph.z
+torus
+  inputs:
+    Major radius = tor.major (Length)
+    Minor radius = tor.minor (Length)
+  expressions: tor.major, tor.minor, tor.x, tor.y, tor.z
+combine
+pattern_rectangular
+  inputs:
+    Quantity = rect.count1 (Unitless)
+    Spacing = rect.spacing1 (Length)
+    Quantity 2 = rect.count2 (Unitless)
+    Spacing 2 = rect.spacing2 (Length)
+  expressions: rect.count1, rect.spacing1, rect.count2, rect.spacing2
+pattern_circular
+  inputs:
+    Quantity = circ.count (Unitless)
+    Total angle = circ.angle (Angle)
+  expressions: circ.count, circ.angle
+pattern_path
+  inputs:
+    Quantity = path.count (Unitless)
+    Distance = path.spacing (Length)
+  expressions: path.count, path.spacing
+mirror
+  inputs:
+    Angle = mirror.angle (Angle)
+    Offset = mirror.offset (Length)
+  expressions: mirror.angle, mirror.offset
+hole_simple
+  inputs:
+    Diameter = hole.diameter (Length)
+    Depth = hole.depth (Length)
+  expressions: hole.diameter, hole.depth
+hole_drilled
+  inputs:
+    Diameter = hole.diameter (Length)
+    Depth = hole.depth (Length)
+    Tip angle = hole.tip_angle (Angle)
+  expressions: hole.diameter, hole.depth, hole.tip_angle
+hole_counterbore
+  inputs:
+    Diameter = hole.diameter (Length)
+    Depth = hole.depth (Length)
+    Counterbore diameter = hole.cb_diameter (Length)
+    Counterbore depth = hole.cb_depth (Length)
+  expressions: hole.diameter, hole.depth, hole.cb_diameter, hole.cb_depth
+hole_countersink
+  inputs:
+    Diameter = hole.diameter (Length)
+    Depth = hole.depth (Length)
+    Countersink diameter = hole.cs_diameter (Length)
+    Countersink angle = hole.cs_angle (Angle)
+  expressions: hole.diameter, hole.depth, hole.cs_diameter, hole.cs_angle
+thread
+  inputs:
+    Length = thread.length (Length)
+  expressions: thread.length
+loft
+sweep
+sweep_options
+  inputs:
+    Twist = sweep.twist (Angle)
+    Scale = sweep.scale (Unitless)
+  expressions: sweep.twist, sweep.scale
+shell
+  inputs:
+    Thickness = shell.thickness (Length)
+  expressions: shell.thickness
+draft
+  inputs:
+    Angle = draft.angle (Angle)
+    Angle = draft_neutral.angle (Angle)
+    Offset = draft_neutral.offset (Length)
+  expressions: draft.angle, draft_neutral.angle, draft_neutral.offset
+construction_plane
+  inputs:
+    Angle = cplane.angle (Angle)
+    Offset = cplane.offset (Length)
+  expressions: cplane.angle, cplane.offset
+split
+  inputs:
+    Angle = split.angle (Angle)
+    Offset = split.offset (Length)
+  expressions: split.angle, split.offset
+split_line
+  inputs:
+    Angle = split_line.angle (Angle)
+    Offset = split_line.offset (Length)
+  expressions: split_line.angle, split_line.offset
+construction_axis
+  inputs:
+    Angle = axis_a.angle (Angle)
+    Offset = axis_a.offset (Length)
+    Angle = axis_b.angle (Angle)
+    Offset = axis_b.offset (Length)
+  expressions: axis_a.angle, axis_a.offset, axis_b.angle, axis_b.offset
+construction_point_planes
+  inputs:
+    Angle = pt_a.angle (Angle)
+    Offset = pt_a.offset (Length)
+    Angle = pt_b.angle (Angle)
+    Offset = pt_b.offset (Length)
+    Angle = pt_c.angle (Angle)
+    Offset = pt_c.offset (Length)
+  expressions: pt_a.angle, pt_a.offset, pt_b.angle, pt_b.offset, pt_c.angle, pt_c.offset
+construction_point_along
+  inputs:
+    Distance (0 to 1) = pt.t (Unitless)
+  expressions: pt.t
+split_face
+  inputs:
+    Angle = split_face.angle (Angle)
+    Offset = split_face.offset (Length)
+  expressions: split_face.angle, split_face.offset
+scale
+  inputs:
+    Scale factor = scale.factor (Unitless)
+    X scale = scale.x (Unitless)
+    Y scale = scale.y (Unitless)
+    Z scale = scale.z (Unitless)
+  expressions: scale.factor, scale.x, scale.y, scale.z
+offset_face
+  inputs:
+    Distance = offset_face.distance (Length)
+  expressions: offset_face.distance
+delete_face
+bounding_solid
+  inputs:
+    Margin = bounding.margin (Length)
+  expressions: bounding.margin
+pipe
+  inputs:
+    Diameter = pipe.diameter (Length)
+    Wall = pipe.wall (Length)
+  expressions: pipe.diameter, pipe.wall
+emboss
+  inputs:
+    Depth = emboss.depth (Length)
+  expressions: emboss.depth
+rib
+  inputs:
+    Thickness = rib.thickness (Length)
+    Depth = rib.depth (Length)
+  expressions: rib.thickness, rib.depth
+replace_face
+  inputs:
+    Angle = replace_face.angle (Angle)
+    Offset = replace_face.offset (Length)
+  expressions: replace_face.angle, replace_face.offset
+align
+coil
+  inputs:
+    Diameter = coil.diameter (Length)
+    Pitch = coil.pitch (Length)
+    Revolutions = coil.turns (Unitless)
+    Section size = coil.section_size (Length)
+    Start angle = coil.start_angle (Angle)
+  expressions: coil.diameter, coil.pitch, coil.turns, coil.section_size, coil.start_angle, coil.x, coil.y, coil.z
+sheet_base
+sheet_contour
+  inputs:
+    Distance = contour.distance (Length)
+  expressions: contour.distance
+sheet_flange
+  inputs:
+    Height = flange.height (Length)
+    Angle = flange.angle (Angle)
+    Bend radius = flange.radius (Length)
+    Edge angle = flange.e1_angle (Angle)
+    Edge height = flange.e1_height (Length)
+    Edge height = flange.e2_height (Length)
+    Corner relief = flange.relief (Length)
+  expressions: flange.height, flange.angle, flange.radius, flange.e1_angle, flange.e1_height, flange.e2_height, flange.relief
+sheet_hem
+  inputs:
+    Length = hem.length (Length)
+    Gap = hem.gap (Length)
+  expressions: hem.length, hem.gap
+sheet_perforate
+  inputs:
+    Diameter = perforate.diameter (Length)
+    Pitch = perforate.pitch (Length)
+    Margin = perforate.margin (Length)
+  expressions: perforate.diameter, perforate.pitch, perforate.margin
+sheet_fold
+  inputs:
+    Angle = fold.angle (Angle)
+    Bend radius = fold.radius (Length)
+  expressions: fold.angle, fold.radius
+sheet_unfold
+sheet_convert
+boss
+  inputs:
+    Diameter = boss.diameter (Length)
+    Height = boss.height (Length)
+    Hole diameter = boss.hole_diameter (Length)
+    Hole depth = boss.hole_depth (Length)
+    Draft angle = boss.draft (Angle)
+    Root fillet = boss.fillet (Length)
+    Ribs = boss.ribs (Unitless)
+    Rib thickness = boss.rib_thickness (Length)
+    Rib length = boss.rib_length (Length)
+    Rib offset = boss.rib_offset (Length)
+  expressions: boss.diameter, boss.height, boss.hole_diameter, boss.hole_depth, boss.draft, boss.fillet, boss.ribs, boss.rib_thickness, boss.rib_length, boss.rib_offset
+lip
+  inputs:
+    Width = lip.width (Length)
+    Height = lip.height (Length)
+    Gap = lip.gap (Length)
+  expressions: lip.width, lip.height, lip.gap
+snap_fit
+  inputs:
+    Length = snap.length (Length)
+    Thickness = snap.thickness (Length)
+    Width = snap.width (Length)
+    Catch depth = snap.catch_depth (Length)
+    Catch length = snap.catch_length (Length)
+  expressions: snap.length, snap.thickness, snap.width, snap.catch_depth, snap.catch_length
+rest
+  inputs:
+    Width = rest.width (Length)
+    Height = rest.height (Length)
+    Length = rest.length (Length)
+    Draft angle = rest.draft (Angle)
+    Wall thickness = rest.thickness (Length)
+  expressions: rest.width, rest.height, rest.length, rest.draft, rest.thickness
+boundary_fill
+remove
+patch
+stitch
+  inputs:
+    Tolerance = stitch.tolerance (Length)
+  expressions: stitch.tolerance
+thicken
+  inputs:
+    Thickness = thicken.thickness (Length)
+  expressions: thicken.thickness
+surface_extrude
+  inputs:
+    Distance = surface_extrude.distance (Length)
+    Distance 2 = surface_extrude.distance2 (Length)
+    Start offset = surface_extrude.start_offset (Length)
+    Taper angle = surface_extrude.taper (Angle)
+    To offset = surface_extrude.to_offset (Length)
+  expressions: surface_extrude.distance, surface_extrude.distance2, surface_extrude.start_offset, surface_extrude.taper, surface_extrude.to_offset
+surface_revolve
+  inputs:
+    Angle = srev.angle (Angle)
+    Angle 2 = srev.angle2 (Angle)
+  expressions: srev.angle, srev.angle2
+surface_sweep
+surface_sweep_options
+  inputs:
+    Twist = surface_sweep.twist (Angle)
+    Scale = surface_sweep.scale (Unitless)
+  expressions: surface_sweep.twist, surface_sweep.scale
+surface_loft
+surface_blend
+surface_offset
+  inputs:
+    Distance = soff.distance (Length)
+    Tolerance = soff.tolerance (Length)
+  expressions: soff.distance, soff.tolerance
+surface_blend
+surface_boundary
+surface_match
+surface_fair
+  inputs:
+    Tolerance = sfair.tolerance (Length)
+  expressions: sfair.tolerance
+unstitch
+reverse_normal
+surface_untrim
+surface_extend
+  inputs:
+    Distance = extend.distance (Length)
+  expressions: extend.distance
+surface_extend_to_plane
+  inputs:
+    Distance = extend.distance (Length)
+    Angle = extend.angle (Angle)
+    Offset = extend.offset (Length)
+  expressions: extend.distance, extend.angle, extend.offset
+surface_extend_to_face
+  inputs:
+    Distance = extend.distance (Length)
+  expressions: extend.distance
+surface_ruled
+  inputs:
+    Distance = ruled.distance (Length)
+    Angle = ruled.angle (Angle)
+  expressions: ruled.distance, ruled.angle
+surface_trim
+  inputs:
+    Angle = trim.angle (Angle)
+    Offset = trim.offset (Length)
+  expressions: trim.angle, trim.offset
+move
+  inputs:
+    X distance = move.x (Length)
+    Y distance = move.y (Length)
+    Z distance = move.z (Length)
+    Angle = move.angle (Angle)
+  expressions: move.x, move.y, move.z, move.angle
+import
+mesh_convert
+  inputs:
+    Tolerance = mesh_convert.tolerance (Length)
+  expressions: mesh_convert.tolerance
+mesh_import
@@ -0,0 +1,188 @@
+body_transfer
+sketch
+  moves: plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2]
+sketch_along_path
+  moves: plane.path.at[0], plane.path.at[1], plane.path.at[2]
+extrude
+  moves: extent.from[0], extent.from[1], extent.from[2], extent.to[0], extent.to[1], extent.to[2]
+  face points: [1, 1.5, 1.25], [2, 2.5, 2.25]
+  profiles: 1 all
+extrude_thin
+revolve
+  moves: axis.dir[0], axis.dir[1], axis.dir[2], axis.origin[0], axis.origin[1], axis.origin[2], to[0], to[1], to[2]
+  face points: [3, 3.5, 3.25]
+  profiles: 1 all
+fillet_constant
+  moves: edges[0][0], edges[0][1], edges[0][2]
+fillet_chord
+  moves: edges[0][0], edges[0][1], edges[0][2]
+fillet_curvature
+  moves: edges[0][0], edges[0][1], edges[0][2]
+fillet_variable
+  moves: edges[0][0], edges[0][1], edges[0][2], style.start[0], style.start[1], style.start[2]
+fillet_spline
+  moves: edges[0][0], edges[0][1], edges[0][2], style.start[0], style.start[1], style.start[2]
+chamfer
+  moves: edges[0][0], edges[0][1], edges[0][2]
+box
+  moves: corner[0], corner[1], corner[2]
+  placement: box.x, box.y, box.z
+cylinder
+  moves: axis[0], axis[2], base[0], base[1], base[2]
+  placement: cyl.x, cyl.y, cyl.z
+sphere
+  moves: center[0], center[1], center[2]
+  placement: sph.x, sph.y, sph.z
+torus
+  moves: center[0], center[1], center[2]
+  placement: tor.x, tor.y, tor.z
+combine
+pattern_rectangular
+  moves: pattern.dir1[0], pattern.dir1[1], pattern.dir2[1], pattern.dir2[2]
+pattern_circular
+  moves: pattern.axis[0], pattern.axis[2], pattern.origin[0], pattern.origin[1], pattern.origin[2]
+pattern_path
+mirror
+  moves: plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2]
+hole_simple
+  moves: direction[0], direction[2], position[0], position[1], position[2], to[0], to[1], to[2]
+  face points: [0, 0, 0], [4, 4.5, 4.25]
+hole_drilled
+  moves: direction[0], direction[2], position[0], position[1], position[2], to[0], to[1], to[2]
+  face points: [4, 4.5, 4.25]
+hole_counterbore
+  moves: direction[0], direction[2], position[0], position[1], position[2], to[0], to[1], to[2]
+  face points: [4, 4.5, 4.25]
+hole_countersink
+  moves: direction[0], direction[2], position[0], position[1], position[2], to[0], to[1], to[2]
+  face points: [4, 4.5, 4.25]
+thread
+  moves: face[0], face[1], face[2]
+  face points: [0, 0, 0]
+loft
+  profiles: 4 all, 5 all
+sweep
+  profiles: 1 all
+sweep_options
+  moves: orientation.direction[1], orientation.direction[2]
+  profiles: 1 all
+shell
+  moves: faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+draft
+  moves: faces[0][0], faces[0][1], faces[0][2], neutral.axis_dir[0], neutral.axis_dir[1], neutral.axis_origin[0], neutral.axis_origin[1], neutral.axis_origin[2], pull[0], pull[2]
+  face points: [0, 0, 0]
+construction_plane
+  moves: plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2]
+split
+  moves: plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2], tool.point[0], tool.point[1], tool.point[2]
+split_line
+  moves: plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2]
+construction_axis
+  moves: def.a.plane.axis_dir[0], def.a.plane.axis_dir[1], def.a.plane.axis_origin[0], def.a.plane.axis_origin[1], def.a.plane.axis_origin[2], def.b.plane.axis_dir[0], def.b.plane.axis_dir[1], def.b.plane.axis_origin[0], def.b.plane.axis_origin[1], def.b.plane.axis_origin[2]
+construction_point_planes
+  moves: def.a.plane.axis_dir[0], def.a.plane.axis_dir[1], def.a.plane.axis_origin[0], def.a.plane.axis_origin[1], def.a.plane.axis_origin[2], def.b.plane.axis_dir[0], def.b.plane.axis_dir[1], def.b.plane.axis_origin[0], def.b.plane.axis_origin[1], def.b.plane.axis_origin[2], def.c.plane.axis_dir[0], def.c.plane.axis_dir[1], def.c.plane.axis_origin[0], def.c.plane.axis_origin[1], def.c.plane.axis_origin[2]
+construction_point_along
+  moves: def.path.at[0], def.path.at[1], def.path.at[2]
+split_face
+  moves: faces[0][0], faces[0][1], faces[0][2], plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2], tool.point[0], tool.point[1], tool.point[2]
+  face points: [0, 0, 0]
+scale
+  moves: origin[0], origin[1], origin[2]
+offset_face
+  moves: faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+delete_face
+  moves: faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+bounding_solid
+pipe
+emboss
+  face points: [5, 5.5, 5.25]
+  profiles: 1 all
+rib
+replace_face
+  moves: faces[0][0], faces[0][1], faces[0][2], target.axis_dir[0], target.axis_dir[1], target.axis_origin[0], target.axis_origin[1], target.axis_origin[2]
+  face points: [0, 0, 0]
+align
+  moves: from[0], from[1], from[2], from_normal[0], from_normal[2], to[0], to[1], to[2], to_normal[0], to_normal[1]
+coil
+  moves: axis[0], axis[2], base[0], base[1], base[2]
+  placement: coil.x, coil.y, coil.z
+sheet_base
+  profiles: 1 all
+sheet_contour
+sheet_flange
+  moves: edges[0].point[0], edges[0].point[1], edges[0].point[2], edges[1].point[0], edges[1].point[1], edges[1].point[2]
+sheet_hem
+  moves: edges[0][0], edges[0][1], edges[0][2]
+sheet_perforate
+sheet_fold
+  moves: a[0], a[1], a[2], b[1], b[2], fixed[0], fixed[1], fixed[2]
+sheet_unfold
+sheet_convert
+  moves: bends[0][0], bends[0][1], bends[0][2], face[0], face[1], face[2]
+  face points: [0, 0, 0]
+boss
+  moves: direction[0], direction[2], position[0], position[1], position[2]
+  face points: [0, 0, 0]
+lip
+  moves: face[0], face[1], face[2]
+snap_fit
+  moves: direction[0], direction[2], hook[0], hook[1], position[0], position[1], position[2]
+  face points: [0, 0, 0]
+rest
+  moves: along[0], along[1], along[2], direction[0], direction[2], position[0], position[1], position[2]
+  face points: [0, 0, 0]
+boundary_fill
+  moves: cells[0][0], cells[0][1], cells[0][2]
+remove
+patch
+  profiles: 8 all
+stitch
+thicken
+surface_extrude
+  moves: extent.from[0], extent.from[1], extent.from[2], extent.to[0], extent.to[1], extent.to[2]
+  face points: [1, 1.5, 1.25], [2, 2.5, 2.25]
+surface_revolve
+  moves: axis.dir[0], axis.dir[1], axis.dir[2], axis.origin[0], axis.origin[1], axis.origin[2]
+surface_sweep
+surface_sweep_options
+surface_loft
+surface_blend
+  moves: align[0][0], align[0][1], align[0][2], align[1][0], align[1][1], align[1][2], from.edges[0][0], from.edges[0][1], from.edges[0][2], to.edges[0][0], to.edges[0][1], to.edges[0][2]
+surface_offset
+  moves: faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+surface_blend
+  moves: align[0][0], align[0][1], align[0][2], align[1][0], align[1][1], align[1][2], from.edges[0][0], from.edges[0][1], from.edges[0][2], to.edges[0][0], to.edges[0][1], to.edges[0][2]
+surface_boundary
+surface_match
+  moves: edges[0][0], edges[0][1], edges[0][2], faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+surface_fair
+  moves: faces[0][0], faces[0][1], faces[0][2]
+  face points: [0, 0, 0]
+unstitch
+  moves: faces[0][0], faces[0][1], faces[0][2]
+reverse_normal
+  moves: faces[0][0], faces[0][1], faces[0][2]
+surface_untrim
+  moves: face.point[0], face.point[1], face.point[2], holes[0][0], holes[0][1], holes[0][2]
+  face points: [0, 0, 0]
+surface_extend
+  moves: edges[0][0], edges[0][1], edges[0][2]
+surface_extend_to_plane
+  moves: edges[0][0], edges[0][1], edges[0][2], up_to.plane.axis_dir[0], up_to.plane.axis_dir[1], up_to.plane.axis_origin[0], up_to.plane.axis_origin[1], up_to.plane.axis_origin[2]
+surface_extend_to_face
+  moves: edges[0][0], edges[0][1], edges[0][2], up_to.face.point[0], up_to.face.point[1], up_to.face.point[2]
+surface_ruled
+  moves: direction[0], direction[2], edges[0][0], edges[0][1], edges[0][2], face[1], face[2]
+  face points: [1, 0, 0]
+surface_trim
+  moves: keep[0], keep[1], keep[2], plane.axis_dir[0], plane.axis_dir[1], plane.axis_origin[0], plane.axis_origin[1], plane.axis_origin[2], tool.point[0], tool.point[1], tool.point[2]
+move
+  moves: rotate_axis[1], rotate_axis[2]
+import
+mesh_convert
+mesh_import
@@ -0,0 +1,212 @@
+body_transfer
+  remap_bodies: bodies[0]
+sketch
+  remap_refs: plane.base.base.name
+sketch_along_path
+extrude
+  sketches: [1]
+  remap_refs: sketch
+  remap_bodies: targets[0]
+extrude_thin
+  sketches: [1]
+  remap_refs: sketch
+  remap_bodies: targets[0]
+revolve
+  sketches: [1]
+  remap_refs: sketch
+  remap_bodies: targets[0]
+fillet_constant
+  remap_bodies: body
+fillet_chord
+  remap_bodies: body
+fillet_curvature
+  remap_bodies: body
+fillet_variable
+  remap_bodies: body
+fillet_spline
+  remap_bodies: body
+chamfer
+  remap_bodies: body
+box
+cylinder
+sphere
+torus
+combine
+  remap_bodies: target, tools[0]
+pattern_rectangular
+  remap_refs: features[0]
+  remap_bodies: bodies[0]
+pattern_circular
+  remap_refs: features[0]
+  remap_bodies: bodies[0]
+pattern_path
+  sketches: [1]
+  remap_refs: features[0], pattern.path_sketch
+  remap_bodies: bodies[0]
+mirror
+  remap_refs: features[0], plane.base.base.name
+  remap_bodies: bodies[0]
+hole_simple
+  sketches: [3]
+  remap_refs: points.sketch
+hole_drilled
+  sketches: [3]
+  remap_refs: points.sketch
+hole_counterbore
+  sketches: [3]
+  remap_refs: points.sketch
+hole_countersink
+  sketches: [3]
+  remap_refs: points.sketch
+thread
+loft
+  sketches: [4, 5]
+  remap_refs: sections[0].sketch, sections[1].sketch
+  remap_bodies: targets[0]
+sweep
+  sketches: [1, 2]
+  remap_refs: path_sketch, sketch
+  remap_bodies: targets[0]
+sweep_options
+  sketches: [1, 2]
+  remap_refs: path_sketch, sketch
+  remap_bodies: targets[0]
+shell
+  remap_bodies: body
+draft
+  remap_refs: neutral.base.base.name
+  remap_bodies: body
+construction_plane
+  remap_refs: plane.base.base.name
+split
+  remap_refs: plane.base.base.name
+  remap_bodies: body, tool.body
+split_line
+  sketches: [6]
+  remap_refs: plane.base.base.name, sketch
+  remap_bodies: body
+construction_axis
+construction_point_planes
+construction_point_along
+split_face
+  sketches: [6]
+  remap_refs: plane.base.base.name, sketch
+  remap_bodies: body, tool.body
+scale
+  remap_bodies: bodies[0]
+offset_face
+  remap_bodies: body
+delete_face
+  remap_bodies: body
+bounding_solid
+  remap_bodies: bodies[0]
+pipe
+  sketches: [1]
+  remap_refs: path_sketch
+  remap_bodies: targets[0]
+emboss
+  sketches: [1]
+  remap_refs: sketch
+  remap_bodies: face.body, targets[0]
+rib
+  sketches: [1]
+  remap_refs: sketch
+replace_face
+  remap_refs: target.base.base.name
+  remap_bodies: body
+align
+  remap_bodies: bodies[0]
+coil
+  remap_bodies: targets[0]
+sheet_base
+  sketches: [1]
+  remap_refs: sketch
+sheet_contour
+  sketches: [1]
+  remap_refs: sketch
+sheet_flange
+  remap_bodies: body
+sheet_hem
+  remap_bodies: body
+sheet_perforate
+  remap_bodies: body
+sheet_fold
+  sketches: [7]
+  remap_refs: sketch
+  remap_bodies: body
+sheet_unfold
+  remap_bodies: body
+sheet_convert
+  remap_bodies: body
+boss
+  remap_bodies: body
+lip
+  remap_bodies: body
+snap_fit
+  remap_bodies: body
+rest
+  remap_bodies: body
+boundary_fill
+  remap_bodies: tools[0]
+remove
+  remap_bodies: bodies[0]
+patch
+  sketches: [8]
+  remap_refs: sketch
+  remap_bodies: body
+stitch
+  remap_bodies: bodies[0]
+thicken
+  remap_bodies: bodies[0], targets[0]
+surface_extrude
+  sketches: [1]
+  remap_refs: sketch
+surface_revolve
+  sketches: [1]
+  remap_refs: sketch
+surface_sweep
+  sketches: [1, 2]
+  remap_refs: path_sketch, sketch
+surface_sweep_options
+  sketches: [1, 2]
+  remap_refs: path_sketch, sketch
+surface_loft
+  sketches: [4, 5]
+  remap_refs: sections[0].sketch, sections[1].sketch
+surface_blend
+  remap_bodies: from.body
+surface_offset
+  remap_bodies: body
+surface_blend
+  remap_bodies: from.body
+surface_boundary
+  sketches: [1]
+  remap_refs: sketch
+surface_match
+  remap_bodies: body
+surface_fair
+  remap_bodies: body
+unstitch
+  remap_bodies: body
+reverse_normal
+  remap_bodies: body
+surface_untrim
+  remap_bodies: face.body
+surface_extend
+  remap_bodies: body
+surface_extend_to_plane
+  remap_refs: up_to.plane.base.base.name
+  remap_bodies: body
+surface_extend_to_face
+  remap_bodies: body, up_to.face.body
+surface_ruled
+  remap_bodies: body
+surface_trim
+  remap_refs: plane.base.base.name
+  remap_bodies: body, tool.body
+move
+  remap_bodies: bodies[0]
+import
+mesh_convert
+  remap_bodies: body
+mesh_import
@@ -138,13 +138,195 @@
 //!   Under the same version, a fillet's style can be `curvature` (a G2 quintic blend; `radius`
 //!   is the equivalent circular setback). Fillets of the other styles save as before; 0.9.0
 //!   would refuse the unknown style.
+//! - 20: an Extrude can be thin (`thin`: `curves`, `thickness`, optional `side` and
+//!   `thickness2`): a wall along sketch curves instead of its profiles. Version 19 designs need
+//!   no transformation, and an extrude without `thin` saves as before; the version stamp makes
+//!   0.10.0 (which reads up to 19) ask for an update instead of ignoring the wall and filling
+//!   the sketch's profiles.
+//!   A `sheet_perforate` feature (Perforate: `diameter`, `pitch`, optional `margin`,
+//!   `pattern` and `body`): a perforation field stored on a sheet, for the flat pattern, the DXF
+//!   and the measure. It is also first saved in 20; 0.10.0 asks for an update instead of
+//!   meeting a feature it can't read.
+//!   Associative, editable sketch patterns (`patterns` in a sketch) and their point/radius
+//!   relations are also first saved in 20. Old sketch copies stay independent: migration cannot
+//!   infer which curves formed a pattern.
+//!   The saved visibility can also list hidden assembly joints (`visibility.hidden_joints`,
+//!   joint ids): their glyphs aren't drawn, but they still constrain and drive the parts. A
+//!   design without it shows every joint, as it always did; 0.10.0 would show them all.
+//! - 21: named render setups (`render: {setups: {name: setup}}`): renderer-independent render
+//!   intent (camera, resolution, exposure, environment). Version 20 designs need no
+//!   transformation (an absent field means no setups, and empty render state is not saved); the
+//!   version stamp makes 0.11.0 (which reads up to 20) ask for an update instead of silently
+//!   dropping saved setups.
+//!   Also first saved in 21, a design can carry `metadata` (#1015): design properties
+//!   (`project`, `part_number`, `revision`, `author`, `organization`, `description`, `license`,
+//!   each text) and other tools' data, each tool's under its own reverse-DNS key
+//!   (`com.example.tool`). Every key is kept as it is, and nothing in it is checked when the
+//!   design opens. A design without it saves as before. 0.11.x refuses format 21, so no
+//!   released build drops the properties when it saves.
+//!   Under the same version, looks can explicitly select opaque PBR parameters (`pbr`: metal
+//!   fraction, roughness, dielectric IOR). Absent fields keep the scalar shading a look always
+//!   had; 0.11.0 asks for an update instead of silently dropping the response.
+//!   A `SurfaceUntrim` feature (Untrim: a `face` as `body` and `point`, optional `holes`
+//!   points, `outer` and `in_place`) is also first saved in 21; 0.11.0 asks for an update
+//!   instead of meeting a feature it can't read.
+//!   A `SurfaceRuled` feature (Ruled Surface: `body`, `edges` points, `distance`, optional
+//!   `mode`, `angle`, `direction`, `flip`, `corners` and `face`) is also first saved in 21;
+//!   0.11.0 asks for an update instead of meeting a feature it can't read.
+//!   Under the same version, a `SurfaceExtend` can say how it continues the surface (`mode`:
+//!   `tangent` or `curvature`; `natural` when absent), extend up to something instead of its
+//!   `distance` (`up_to`: a `plane`, a `face` as `body` and `point`, or `bounds`) and keep the
+//!   neighbouring edges as they are (`neighbours: false`). An Extend without them builds the
+//!   planar extension it always did and saves as before; 0.11.0 asks for an update instead of
+//!   dropping them and extending a plane by the distance.
+//!   Under the same version, an extrude's extent records how a symmetric `distance` is read
+//!   (`convention`: `total_distance`, split evenly around the start plane, which new solid
+//!   extrudes save; or `legacy_per_side`). An extent without it keeps the per-side reading
+//!   designs always had, so their thickness and parameters don't change; 0.11.0 asks for an
+//!   update instead of doubling a total-distance extrude.
+//!   Under the same version, a Convert to Sheet Metal bend point can lie in the middle of a
+//!   chamfer (a flat strip between two faces), which then is one bend at the two faces' virtual
+//!   sharp; 0.11.0 bent the chamfer's nearest edge instead or found no edge there. Bend points
+//!   on edges convert as before.
+//!   A bend point can also lie on a bend modelled with its radius (a cylinder between two flat
+//!   faces tangent to it), which then is one bend at the two faces' virtual sharp with the
+//!   rule's radius; 0.11.0 found no edge there or refused the curved face.
+//!   Also under 21, a Sweep and a Surface Sweep can carry `orientation` (`parallel`, or
+//!   `{direction: [x, y, z]}`; absent: perpendicular), `twist` (an angle expression) and `scale`
+//!   (the end scale, an expression). A sweep without them saves as before; 0.11.x refuses
+//!   format 21, so no released build sweeps a twisted or scaled profile straight.
+//!   Nothing new is saved for converted sheets' corners and bend ends, but a design converts as
+//!   the rule says when it is evaluated: corners between the walls take the rule's corner relief
+//!   and a bend ending beside more of the fixed face its bend relief (0.11.0 left every corner a
+//!   notch and cut no bend relief), and a wall on part of an edge bends only where it stands
+//!   (0.11.0 refused it).
+//! - 22: an Import (STEP) feature can list `skip`: indices of the file's bodies it does not
+//!   build, because they are later instances of a part the file places more than once and the
+//!   other occurrences of that part's component show them (#1386: an imported file becomes a
+//!   component, an assembly in it nested components). Version 21 designs need no
+//!   transformation: an Import without it builds every body, as it always did, and designs
+//!   whose imports sit loose in a component are left as they are. The version stamp makes
+//!   0.12.0 (which reads up to 21) ask for an update instead of building those instances again
+//!   on top of their occurrences.
+//!   Also under 22, a number in an expression can be written with a decimal comma outside
+//!   parentheses (`2,5 mm` is `2.5 mm`, #1347; inside a function's parentheses the comma still
+//!   separates its arguments). Nothing new is saved, but an expression typed that way is saved as
+//!   typed; 0.12.0 asks for an update instead of failing to evaluate it.
+//!   Also under 22, a design can hold a `SurfaceBlend` (Blend Surface: `from`/`to` edge chains of
+//!   two bodies, optional `continuity`, `bulge`, `align`, `stitch`), and a `Patch` can carry a
+//!   `crown` (0 by default, and then not saved: a bump that vanishes on the loop, so the face
+//!   still meets the picked edges). Version 21 designs need no transformation; 0.12.0 asks for an
+//!   update instead of meeting a feature it can't read or dropping a patch's crown.
+//!   Also under 22, a sketch text's link source can say that its place, height or angle are
+//!   expressions (`exprs`: `x`, `y`, `height`, `angle`, each an expression over the design's
+//!   parameters); the source's `at`, `height` and `angle` then hold the numbers they last came
+//!   to. A text without `exprs` is set as it always was; 0.12.0 asks for an update instead of
+//!   dropping the expressions and keeping the text at its last numbers.
+//!
+//! Later formats are one file per change, so changes made side by side never edit the same line
+//! (`src/format/pending/README.md`):
+//! - `src/format/v<N>/`: the changes format N added, one file each, its `//!` note saying what is
+//!   saved and what older designs get, and a `step` when older designs are rewritten as they open
+//!   (23: motion link couplings, FreeCAD and Rhino imports; 24: an Edge Flange's own corner relief).
+//! - `src/format/pending/`: changes no release has fixed a number for yet. While there are any,
+//!   this build writes the next number (which no release reads), with the names of these changes
+//!   in `format_pending`, so a later build applies just the steps a file is missing. At release
+//!   time `scripts/fold-format-pending.sh` moves them into the next `v<N>/`.

 use serde_json::Value;

 use crate::{DocError, Document, Result};

-/// The format this build writes.
-pub const FORMAT: u32 = 19;
+/// The format this build writes: the last folded one, or the next while changes are pending.
+pub const FORMAT: u32 = FORMATS.current();
+
+/// The last format whose upgrade step is written out in [`JSON_STEPS`]; later formats are made
+/// of [`Part`]s (`src/format/`, listed by `build.rs`).
+const HAND_WRITTEN: u32 = 22;
+
+/// One change to the file format: a file in `src/format/v<N>/` or `src/format/pending/`.
+pub(crate) struct Part {
+    /// The file's name, which a file written while the change was pending lists.
+    pub name: &'static str,
+    /// How a design from before the change is rewritten as it opens, if it is.
+    pub step: Option<JsonStep>,
+}
+
+include!(concat!(env!("OUT_DIR"), "/format_parts.rs"));
+
+/// Every format this build knows and how to upgrade a design through them.
+const FORMATS: Formats<'static> = Formats { hand: &JSON_STEPS, folded: FOLDED, pending: PENDING };
+
+/// The names of the pending changes this build writes into a design (`format_pending`).
+pub fn pending_names() -> Vec<String> {
+    FORMATS.pending.iter().map(|p| p.name.to_string()).collect()
+}
+
+/// The upgrade path: the hand-written steps up to [`HAND_WRITTEN`], the folded formats after it
+/// (each a list of changes) and the pending changes, which make the next format.
+struct Formats<'a> {
+    hand: &'a [JsonStep],
+    folded: &'a [(u32, &'a [Part])],
+    pending: &'a [Part],
+}
+
+impl Formats<'_> {
+    const fn current(&self) -> u32 {
+        self.hand.len() as u32 + 1 + self.folded.len() as u32 + if self.pending.is_empty() { 0 } else { 1 }
+    }
+
+    /// The changes format `version` is made of, if it is made of changes.
+    fn parts(&self, version: u32) -> Option<&[Part]> {
+        let after = version.checked_sub(self.hand.len() as u32 + 2)? as usize;
+        match self.folded.get(after) {
+            Some((_, parts)) => Some(parts),
+            None if after == self.folded.len() && !self.pending.is_empty() => Some(self.pending),
+            None => None,
+        }
+    }
+
+    /// Bring a design of format `version` up to [`Formats::current`]. `applied` is the file's
+    /// `format_pending`: the changes of its format it already has, when it was written while they
+    /// were pending; the others' steps run first. A pending change this build doesn't have is a
+    /// newer build's, and the design is refused.
+    fn upgrade(&self, v: &mut Value, version: u32, applied: Option<&[String]>) -> Result<()> {
+        if version == 0 || version > self.current() {
+            return Err(DocError::Invalid(format!("not a SolidCraft design (format {version})")));
+        }
+        // A list beside a format that isn't made of changes means nothing (a tool or a test set
+        // an older number on a newer file): it is ignored, like any field an upgrade drops.
+        if let (Some(applied), Some(parts)) = (applied, self.parts(version)) {
+            let pending = version == self.current() && !self.pending.is_empty();
+            if let Some(unknown) = applied.iter().find(|name| pending && !parts.iter().any(|p| p.name == name.as_str())) {
+                return Err(DocError::Invalid(format!(
+                    "this design was saved by a newer SolidCraft (file format {version} with `{unknown}`, which this version doesn't know): update SolidCraft to open it"
+                )));
+            }
+            for part in parts.iter().filter(|p| !applied.iter().any(|name| name == p.name)) {
+                part.step.map_or(Ok(()), |step| step(v))?;
+            }
+        }
+        for from in version..self.current() {
+            match self.hand.get(from as usize - 1) {
+                Some(step) => step(v)?,
+                None => {
+                    for part in self.parts(from + 1).unwrap_or_default() {
+                        part.step.map_or(Ok(()), |step| step(v))?;
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Take a file's `format_pending` (the pending changes it has) out of its JSON.
+fn take_pending(v: &mut Value) -> Result<Option<Vec<String>>> {
+    let Some(list) = v.as_object_mut().and_then(|o| o.remove("format_pending")) else { return Ok(None) };
+    let invalid = || DocError::Invalid("damaged design: `format_pending` is not a short list of names".into());
+    let list = list.as_array().filter(|l| l.len() <= 1000).ok_or_else(invalid)?;
+    list.iter().map(|n| n.as_str().filter(|n| n.len() <= 128).map(str::to_string).ok_or_else(invalid)).collect::<Result<_>>().map(Some)
+}

 pub fn format_string(n: u32) -> String {
    format!("solidcraft/{n}")
@@ -159,9 +341,10 @@ pub fn version_of(s: &str) -> Option<u32> {
    s.strip_prefix("solidcraft/").or_else(|| s.strip_prefix(LEGACY_FORMAT_PREFIX))?.parse().ok()
 }

-/// JSON-level upgrades: entry `i` turns format `i + 1` into `i + 2`.
+/// JSON-level upgrades up to [`HAND_WRITTEN`]: entry `i` turns format `i + 1` into `i + 2`.
+/// Never add to it: a new format is a file in `src/format/pending/`.
 type JsonStep = fn(&mut Value) -> Result<()>;
-const JSON_STEPS: [JsonStep; 18] = [
+const JSON_STEPS: [JsonStep; HAND_WRITTEN as usize - 1] = [
    |_| Ok(()),
    v2_to_v3,
    v3_to_v4,
@@ -180,6 +363,9 @@ const JSON_STEPS: [JsonStep; 18] = [
    |_| Ok(()),
    |_| Ok(()),
    |_| Ok(()),
+    |_| Ok(()),
+    |_| Ok(()),
+    |_| Ok(()),
 ];

 /// Stored face and edge names were worked out from geometry before format 14; they get the
@@ -370,6 +556,7 @@ pub fn read(s: &str) -> Result<Document> {
        Some(Value::String(f)) => version_of(f).ok_or_else(|| DocError::Invalid(format!("not a SolidCraft design (format `{f}`)")))?,
        Some(_) => return Err(DocError::Invalid("not a SolidCraft design (format is not a string)".into())),
    };
+    let applied = take_pending(&mut v)?;
    if version == 0 {
        return Err(DocError::Invalid("not a SolidCraft design (format 0)".into()));
    }
@@ -378,7 +565,7 @@ pub fn read(s: &str) -> Result<Document> {
            "this design was saved by a newer SolidCraft (file format {version}; this version reads formats up to {FORMAT}): update SolidCraft to open it"
        )));
    }
-    check_numbers(&v, 0)?;
+    check_design_numbers(&v)?;
    crate::config::validate_rules_json(&v)?;
    crate::config::validate_styles_json(&v)?;
    crate::face_anchor::validate_face_anchors_json(&v)?;
@@ -389,9 +576,7 @@ pub fn read(s: &str) -> Result<Document> {
    crate::format_offsets::validate_raw(&v)?;
    let legacy_wires = validate_wires(&v, version)?;
    validate_body_transfers(&v)?;
-    for step in JSON_STEPS.iter().skip(version as usize - 1).take((FORMAT - version) as usize) {
-        step(&mut v)?;
-    }
+    FORMATS.upgrade(&mut v, version, applied.as_deref())?;
    let mut d: Document = serde_json::from_value(v).map_err(|e| DocError::Invalid(format!("design file: {e}")))?;
    let mut legacy_by_feature = std::collections::BTreeMap::<usize, Vec<usize>>::new();
    for (feature, wire) in legacy_wires {
@@ -455,11 +640,18 @@ pub fn read(s: &str) -> Result<Document> {
            return Err(DocError::Invalid(format!("damaged design: occurrence `{}` has an invalid placement", o.name)));
        }
    }
+    if !all_unique(d.features.iter().map(|f| f.id))
+        || !all_unique(d.components.iter().map(|c| c.id))
+        || !all_unique(d.occurrences.iter().map(|o| o.id))
+    {
+        return Err(DocError::Invalid("damaged design: duplicate feature, component or occurrence id".into()));
+    }
    let component_ids: std::collections::BTreeSet<_> = d.components.iter().map(|component| component.id).chain(std::iter::once(0)).collect();
    for feature in &d.features {
        if let crate::FeatureKind::Sketch { sketch, .. } = &feature.kind {
            sketch.validate_freeform_offsets().map_err(|e| DocError::Invalid(format!("damaged design: {e}")))?;
            sketch.validate_wires().map_err(|e| DocError::Invalid(format!("damaged design: {e}")))?;
+            sketch.validate_patterns().map_err(|e| DocError::Invalid(format!("damaged design: {e}")))?;
            sketch.validate_periodic_splines().map_err(|e| DocError::Invalid(format!("damaged design: {e}")))?;
        }
        if let crate::FeatureKind::BodyTransfer { from, to, .. } = &feature.kind
@@ -476,10 +668,22 @@ pub fn read(s: &str) -> Result<Document> {
    // Fill in what older designs (and hand-edited files) may lack; a no-op otherwise.
    crate::format_offsets::validate_typed(&d)?;
    normalise(&mut d)?;
+    // `next_id` is trusted by nothing: a hand-edited or generated file may omit it or leave it stale,
+    // and the next feature, component or occurrence would then reuse an id that is already taken.
+    let largest =
+        d.features.iter().map(|f| f.id).chain(d.components.iter().map(|c| c.id)).chain(d.occurrences.iter().map(|o| o.id)).max().unwrap_or(0);
+    let floor = largest.checked_add(1).ok_or_else(|| DocError::Invalid("damaged design: the id space is exhausted".into()))?;
+    d.next_id = d.next_id.max(floor).max(1);
    d.format = format_string(FORMAT);
+    d.format_pending = pending_names();
    Ok(d)
 }

+fn all_unique(ids: impl Iterator<Item = u64>) -> bool {
+    let mut seen = std::collections::BTreeSet::new();
+    ids.into_iter().all(|id| seen.insert(id))
+}
+
 /// The caps interactive editing enforces, applied to the raw JSON so an oversized sketch is
 /// never deserialised. Every sketch in the timeline is solved when the design opens, and the
 /// solver sizes its dense matrices by the sketch, so a file with hundreds of thousands of
@@ -496,9 +700,34 @@ fn validate_sketch_sizes(value: &Value) -> Result<()> {
        if len("points") > solidcraft_sketch::MAX_POINTS
            || len("curves") > solidcraft_sketch::MAX_CURVES
            || len("constraints") > solidcraft_sketch::MAX_CONSTRAINTS
+            || len("patterns") > solidcraft_sketch::MAX_CONSTRAINTS
        {
            return Err(invalid());
        }
+        if let Some(patterns) = sketch.get("patterns").and_then(Value::as_array) {
+            let mut points = 0usize;
+            let mut curves = 0usize;
+            let mut constraints = 0usize;
+            for pattern in patterns {
+                let Some(entities) = pattern.get("entities").and_then(Value::as_array) else { return Err(invalid()) };
+                let Some(instances) = pattern.get("instances").and_then(Value::as_array) else { return Err(invalid()) };
+                if entities.len() > solidcraft_sketch::MAX_CURVES + solidcraft_sketch::MAX_POINTS || instances.len() >= 500 {
+                    return Err(invalid());
+                }
+                for instance in instances {
+                    let size = |key| instance.get(key).and_then(Value::as_array).map_or(0, Vec::len);
+                    points = points.saturating_add(size("points"));
+                    curves = curves.saturating_add(size("curves"));
+                    constraints = constraints.saturating_add(size("constraints"));
+                    if points > solidcraft_sketch::MAX_POINTS
+                        || curves > solidcraft_sketch::MAX_CURVES
+                        || constraints > solidcraft_sketch::MAX_CONSTRAINTS
+                    {
+                        return Err(invalid());
+                    }
+                }
+            }
+        }
    }
    Ok(())
 }
@@ -804,6 +1033,16 @@ fn validate_freeform_offsets(value: &Value) -> Result<()> {
 /// outside what the kernel's tolerances serve.
 const MAX_REAL: f64 = 1e9;

+/// Every number the design itself holds is in range ([`check_numbers`]). `metadata` is left
+/// alone: it is other tools' data, kept as it is and never read as a number (#1015); parsing
+/// already bounds its nesting.
+fn check_design_numbers(v: &Value) -> Result<()> {
+    match v {
+        Value::Object(m) => m.iter().filter(|(k, _)| k.as_str() != "metadata").try_for_each(|(_, x)| check_numbers(x, 1)),
+        v => check_numbers(v, 0),
+    }
+}
+
 /// Every non-integer number in the file is finite and within ±`MAX_REAL` (a damaged or hostile
 /// file is refused instead of overflowing the geometry later).
 fn check_numbers(v: &Value, depth: usize) -> Result<()> {
@@ -859,6 +1098,170 @@ fn normalise(d: &mut Document) -> Result<()> {
 mod tests {
    use super::*;

+    /// A pending change that records that its step ran, in `trace`.
+    fn traced(name: &'static str) -> Part {
+        fn step_a(v: &mut Value) -> Result<()> {
+            trace(v, "a")
+        }
+        fn step_b(v: &mut Value) -> Result<()> {
+            trace(v, "b")
+        }
+        fn trace(v: &mut Value, s: &str) -> Result<()> {
+            let o = v.as_object_mut().ok_or_else(|| DocError::Invalid("no object".into()))?;
+            o.entry("trace").or_insert_with(|| Value::Array(Vec::new())).as_array_mut().into_iter().for_each(|t| t.push(Value::from(s)));
+            Ok(())
+        }
+        Part { name, step: Some(if name.starts_with('a') { step_a } else { step_b }) }
+    }
+
+    fn trace_of(v: &Value) -> Vec<&str> {
+        v["trace"].as_array().into_iter().flatten().filter_map(Value::as_str).collect()
+    }
+
+    /// Formats after the hand-written ones follow on from them, one folder each, and the build
+    /// writes the next number exactly while changes are pending, so the last release (which
+    /// reads up to 22) refuses what a development build saves.
+    #[test]
+    fn formats_follow_on_and_pending_changes_take_the_next_number() {
+        assert_eq!(JSON_STEPS.len() as u32, HAND_WRITTEN - 1);
+        for (i, (version, parts)) in FOLDED.iter().enumerate() {
+            assert_eq!(*version, HAND_WRITTEN + 1 + i as u32);
+            assert!(!parts.is_empty(), "format {version} has no changes");
+        }
+        let last_folded = HAND_WRITTEN + FOLDED.len() as u32;
+        assert_eq!(FORMAT, last_folded + u32::from(!PENDING.is_empty()));
+        const { assert!(FORMAT >= 24, "designs saved as 23 and 24 by nightlies still open") };
+        assert_eq!(pending_names(), PENDING.iter().map(|p| p.name).collect::<Vec<_>>());
+        assert_eq!(Document::new("A").format_pending, pending_names());
+    }
+
+    /// The build lists every change file there is, in file-name order: a change is a file, so
+    /// two branches that each add one merge cleanly and the merged build has both.
+    #[test]
+    fn every_change_file_is_listed_in_name_order() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/format");
+        let names = |dir: &str| -> Vec<String> {
+            let mut names: Vec<String> = std::fs::read_dir(root.join(dir))
+                .map(|d| d.filter_map(|e| e.ok()?.file_name().to_str()?.strip_suffix(".rs").map(str::to_string)).collect())
+                .unwrap_or_default();
+            names.sort();
+            names
+        };
+        assert_eq!(names("pending"), pending_names());
+        for (version, parts) in FOLDED {
+            assert_eq!(names(&format!("v{version}")), parts.iter().map(|p| p.name).collect::<Vec<_>>());
+        }
+    }
+
+    /// Two changes pending side by side both run, in name order, after every older format's
+    /// steps: an old design upgrades through all of them, and one from the last folded format
+    /// gets just the pending ones.
+    #[test]
+    fn pending_changes_apply_in_order_after_older_formats() {
+        let pending = [traced("a-first"), traced("b-second")];
+        let formats = Formats { hand: &JSON_STEPS, folded: FOLDED, pending: &pending };
+        let next = HAND_WRITTEN + FOLDED.len() as u32 + 1;
+        assert_eq!(formats.current(), next);
+        for version in [1, HAND_WRITTEN, next - 1] {
+            let mut v = serde_json::json!({"features": [], "assembly": {"joints": [{"flip": false}]}});
+            formats.upgrade(&mut v, version, None).unwrap();
+            assert_eq!(trace_of(&v), ["a", "b"], "from format {version}");
+            // The hand-written steps ran too: format 3's joints were flipped on the way up.
+            assert_eq!(v["assembly"]["joints"][0]["flip"], Value::Bool(version < 4), "from format {version}");
+        }
+        // A design of the pending number written before `b-second` existed gets just that step.
+        let mut v = serde_json::json!({});
+        formats.upgrade(&mut v, next, Some(&["a-first".to_string()])).unwrap();
+        assert_eq!(trace_of(&v), ["b"]);
+        // One that has both, or that this build wrote, needs nothing.
+        let mut v = serde_json::json!({});
+        formats.upgrade(&mut v, next, Some(&["a-first".into(), "b-second".into()])).unwrap();
+        assert_eq!(trace_of(&v), Vec::<&str>::new());
+        // A change this build doesn't know is a newer build's: refused, not guessed at.
+        let err = formats.upgrade(&mut serde_json::json!({}), next, Some(&["c-later".into()])).unwrap_err();
+        assert!(err.to_string().contains("newer SolidCraft"), "{err}");
+        // A list on a format that isn't made of changes means nothing.
+        let mut v = serde_json::json!({});
+        formats.upgrade(&mut v, HAND_WRITTEN, Some(&["a-first".into()])).unwrap();
+        assert_eq!(trace_of(&v), ["a", "b"]);
+    }
+
+    /// Folding the pending changes into a number (the release script) keeps every design
+    /// opening the same: a file saved while they were pending gets the steps it missed.
+    #[test]
+    fn folded_changes_upgrade_like_pending_ones() {
+        let parts = [traced("a-first"), traced("b-second")];
+        let mut folded: Vec<(u32, &[Part])> = FOLDED.to_vec();
+        let next = HAND_WRITTEN + folded.len() as u32 + 1;
+        folded.push((next, &parts));
+        let formats = Formats { hand: &JSON_STEPS, folded: &folded, pending: &[] };
+        assert_eq!(formats.current(), next);
+        let mut old = serde_json::json!({});
+        formats.upgrade(&mut old, HAND_WRITTEN, None).unwrap();
+        assert_eq!(trace_of(&old), ["a", "b"]);
+        let mut nightly = serde_json::json!({});
+        formats.upgrade(&mut nightly, next, Some(&["a-first".into()])).unwrap();
+        assert_eq!(trace_of(&nightly), ["b"]);
+        let mut released = serde_json::json!({});
+        formats.upgrade(&mut released, next, None).unwrap();
+        assert_eq!(trace_of(&released), Vec::<&str>::new());
+    }
+
+    /// `format_pending` is read and checked: a damaged list is refused, a list of changes this
+    /// build doesn't have is a newer build's, and saving writes this build's own list.
+    #[test]
+    fn format_pending_in_a_file_is_checked() {
+        let mut file: Value = serde_json::from_str(&Document::new("A").to_json()).unwrap();
+        assert_eq!(file.get("format_pending").is_some(), !PENDING.is_empty());
+        for damaged in [serde_json::json!("x"), serde_json::json!([1]), serde_json::json!(["x".repeat(200)])] {
+            file["format_pending"] = damaged;
+            assert!(read(&file.to_string()).is_err());
+        }
+        file["format_pending"] = serde_json::json!(["not-a-change-anyone-made"]);
+        assert_eq!(read(&file.to_string()).is_err(), !PENDING.is_empty(), "only a pending format's list names changes");
+        file["format_pending"] = Value::from(pending_names());
+        let opened = read(&file.to_string()).unwrap();
+        assert_eq!(opened.format_pending, pending_names());
+    }
+
+    /// 24 added the corner relief of an edge flange: a no-op step carries a 23 design up, a flange
+    /// without a relief of its own saves as before, and one with it is saved under 24 and kept.
+    #[test]
+    fn version_twenty_three_designs_open_and_an_edge_flange_relief_is_saved_in_twenty_four() {
+        let flange = |shape: Option<&str>, size: Option<&str>| crate::FeatureKind::SheetFlange {
+            edges: vec![crate::FlangeEdge::at(solidcraft_geom::Vec3::ZERO)],
+            height: "10 mm".into(),
+            angle: "90 deg".into(),
+            radius: None,
+            position: "inside".into(),
+            flip: false,
+            body: None,
+            corner_relief_shape: shape.map(Into::into),
+            corner_relief: size.map(Into::into),
+        };
+        let saved = |document: &Document| -> Value { serde_json::from_str(&document.to_json()).unwrap() };
+        // A flange that follows the rule saves neither key, and a design of format 23 opens as it was.
+        let mut plain = Document::new("A");
+        plain.add_feature(flange(None, None), None).unwrap();
+        let mut file = saved(&plain);
+        let feature = file["features"].as_array().and_then(|f| f.last()).cloned().unwrap();
+        assert_eq!(feature["type"], "sheet_flange");
+        assert!(feature.get("corner_relief_shape").is_none() && feature.get("corner_relief").is_none(), "{feature}");
+        file["format"] = Value::from("solidcraft/23");
+        let opened = read(&file.to_string()).unwrap();
+        assert_eq!(opened.format, format_string(FORMAT));
+        assert_eq!(opened.features, plain.features);
+        // One that chooses its relief says so in the file, which is stamped 24 and keeps it.
+        let mut own = Document::new("A");
+        own.add_feature(flange(Some("round"), Some("6 mm")), None).unwrap();
+        let file = saved(&own);
+        let feature = file["features"].as_array().and_then(|f| f.last()).cloned().unwrap();
+        assert_eq!((&feature["corner_relief_shape"], &feature["corner_relief"]), (&Value::from("round"), &Value::from("6 mm")));
+        // A build that reads up to 23 asks for an update on that stamp instead of dropping the relief.
+        assert_eq!(version_of(file["format"].as_str().unwrap_or_default()), Some(FORMAT));
+        assert_eq!(read(&file.to_string()).unwrap(), own);
+    }
+
    #[test]
    fn version_thirteen_names_keep_their_meaning_under_the_legacy_mark() {
        let file = serde_json::json!({
@@ -1031,18 +1434,20 @@ mod tests {
        document
            .add_feature(
                FeatureKind::Extrude {
-                    sketch,
+                    thin: None,
+                    sketch: crate::SketchId(sketch),
                    profiles: ProfileSel::All,
                    extent: Extent {
+                        convention: crate::ExtrudeConvention::LegacyPerSide,
                        distance: "10".into(),
                        direction: Direction::Negative,
                        distance2: None,
                        start_offset: None,
                        through_all: false,
                        taper: Some("0 deg".into()),
-                        to: Some(solidcraft_geom::Vec3::new(0.0, 0.0, 10.0)),
+                        to: Some(crate::FacePick(solidcraft_geom::Vec3::new(0.0, 0.0, 10.0))),
                        to_offset: Some("offset + 1 mm".into()),
-                        from: Some(solidcraft_geom::Vec3::new(0.0, 0.0, 5.0)),
+                        from: Some(crate::FacePick(solidcraft_geom::Vec3::new(0.0, 0.0, 5.0))),
                    },
                    operation: Operation::NewBody,
                    targets: vec![],
@@ -1594,4 +1999,87 @@ mod tests {
            assert!(error.contains("sketch too large"), "{key}: {error}");
        }
    }
+
+    fn two_components_one_occurrence() -> Document {
+        let mut d = Document::new("ids");
+        let a = d.add_component(None, 0).unwrap();
+        d.add_component(None, 0).unwrap();
+        d.add_occurrence(a, 0, crate::IDENTITY).unwrap();
+        d
+    }
+
+    fn edited(d: &Document, f: impl FnOnce(&mut Value)) -> String {
+        let mut v: Value = serde_json::from_str(&d.to_json()).unwrap();
+        f(&mut v);
+        v.to_string()
+    }
+
+    #[test]
+    fn missing_or_stale_next_id_does_not_reuse_existing_ids() {
+        let d = two_components_one_occurrence();
+        let largest = d.components.iter().map(|c| c.id).chain(d.occurrences.iter().map(|o| o.id)).max().unwrap();
+        for stale in [None, Some(0), Some(1)] {
+            let json = edited(&d, |v| {
+                let o = v.as_object_mut().unwrap();
+                match stale {
+                    Some(n) => o.insert("next_id".into(), n.into()),
+                    None => o.remove("next_id"),
+                };
+            });
+            let mut back = read(&json).unwrap();
+            assert!(back.next_id > largest, "next_id {} after load with {stale:?}", back.next_id);
+            let fresh = back.add_component(None, 0).unwrap();
+            assert!(fresh > largest, "new component reused id {fresh}");
+        }
+    }
+
+    #[test]
+    fn duplicate_component_or_occurrence_ids_are_a_damaged_design() {
+        let d = two_components_one_occurrence();
+        let dup_component = edited(&d, |v| v["components"][1]["id"] = v["components"][0]["id"].clone());
+        let dup_occurrence = edited(&d, |v| {
+            let first = v["occurrences"][0].clone();
+            v["occurrences"].as_array_mut().unwrap().push(first);
+        });
+        for json in [dup_component, dup_occurrence] {
+            let error = read(&json).unwrap_err().to_string();
+            assert!(error.contains("damaged design"), "{error}");
+        }
+    }
+
+    #[test]
+    fn exhausted_id_space_is_an_error_not_a_panic() {
+        let d = two_components_one_occurrence();
+        let json = edited(&d, |v| v["next_id"] = u64::MAX.into());
+        let mut back = read(&json).unwrap();
+        let before = back.components.len();
+        assert!(back.add_component(None, 0).is_err());
+        assert_eq!(back.components.len(), before);
+        let json = edited(&d, |v| v["components"][1]["id"] = u64::MAX.into());
+        assert!(read(&json).unwrap_err().to_string().contains("damaged design"));
+    }
+
+    /// A sweep saved before its options existed loads as a plain sweep and saves as it was; the
+    /// options round-trip.
+    #[test]
+    fn sweep_options_are_optional_and_round_trip() {
+        use crate::{FeatureKind, SweepOrientation};
+        let old =
+            serde_json::json!({"type": "sweep", "sketch": 1, "profiles": {"type": "all"}, "path_sketch": 2, "path": ["l1"], "operation": "new_body"});
+        let k: FeatureKind = serde_json::from_value(old.clone()).unwrap();
+        let FeatureKind::Sweep { orientation, twist, scale, .. } = &k else { panic!("{k:?}") };
+        assert!(orientation.is_perpendicular() && twist.is_none() && scale.is_none());
+        assert_eq!(serde_json::to_value(&k).unwrap(), old);
+        let old = serde_json::json!({"type": "surface_sweep", "sketch": 1, "path_sketch": 2, "path": ["l1"]});
+        let k: FeatureKind = serde_json::from_value(old.clone()).unwrap();
+        assert_eq!(serde_json::to_value(&k).unwrap(), old);
+        let new = serde_json::json!({"type": "surface_sweep", "sketch": 1, "path_sketch": 2, "path": ["l1"],
+            "orientation": {"direction": [0.0, 1.0, 0.0]}, "twist": "90 deg", "scale": "0.5"});
+        let k: FeatureKind = serde_json::from_value(new.clone()).unwrap();
+        let FeatureKind::SurfaceSweep { orientation, .. } = &k else { panic!("{k:?}") };
+        assert_eq!(*orientation, SweepOrientation::Direction(crate::Dir(solidcraft_geom::Vec3::Y)));
+        assert_eq!(serde_json::to_value(&k).unwrap(), new);
+        let parallel: SweepOrientation = serde_json::from_value(serde_json::json!("parallel")).unwrap();
+        assert_eq!(parallel, SweepOrientation::Parallel);
+    }
 }
@@ -0,0 +1,27 @@
+# Pending design-format changes
+
+One file per change to what a design file saves that no release has shipped yet. Adding a file
+here is the whole format bump: never edit `FORMAT`, `JSON_STEPS` or another change's file.
+
+- Name it after the change, lowercase with dashes: `placed-plane-origins.rs`.
+- Start it with a `//!` note: what is saved, what an older design gets without it, and what
+  the last release does with a design that has it (it refuses the newer format number).
+- If older designs must be rewritten as they open, add the step to the same file:
+
+  ```rust
+  //! …the note…
+  use serde_json::Value;
+
+  pub fn step(v: &mut Value) -> crate::Result<()> {
+      // rewrite the design's JSON here
+      Ok(())
+  }
+  ```
+
+  Steps run in file-name order, after the steps of every older format.
+
+While this folder has a change in it, the build writes the next format number (the last
+folded one + 1, which no release reads), and lists the changes a file has in its
+`format_pending` field, so a later build applies only the steps that file is missing. At release
+time `scripts/fold-format-pending.sh` moves these files into `../v<N>/`, which fixes that number
+for good. See `crates/doc/src/format.rs` and CONTRIBUTING.md.
@@ -0,0 +1,4 @@
+//! An Import's `file` can name a FreeCAD `.FCStd` or Rhino `.3dm` file (#1435, read through
+//! cadmpeg); its `step` is still the STEP text the file was restated as, so the feature's fields
+//! are unchanged and version 22 designs need no transformation; 0.13.x asks for an update before
+//! it meets these imports.
@@ -0,0 +1,7 @@
+//! A motion link can carry a `coupling`: a gear pair (`ra`, `rb`, `internal`), a rack and pinion
+//! (`radius`) or a screw (`pitch`), each size a number in mm, an expression or a picked round
+//! face, and `reverse`. The link's `ratio` is worked out from it whenever the design changes and
+//! saved as well, so a link reads the same without it. Version 22 designs need no
+//! transformation: a link without `coupling` is a plain motion link, as it always was; 0.13.0
+//! (which reads up to 22) asks for an update instead of keeping a gear's ratio when its radius
+//! changes.
@@ -0,0 +1,5 @@
+//! An Edge Flange feature can choose its own corner relief (`corner_relief_shape`: notch, round,
+//! rectangular or tear, and `corner_relief`, the size across), for the corners its flanges make.
+//! Version 23 designs need no transformation: a feature without them follows the sheet metal
+//! rule, as it always did, and saves as before; 0.13.0 (which reads up to 22) asks for an update
+//! instead of silently building the rule's relief where a design asks for another.
@@ -0,0 +1,5 @@
+//! The Class-A surface pass adds `SurfaceBoundary` (Boundary Surface: `sketch`, `curves`,
+//! optional `orders`, `crown`, `samples`), `SurfaceMatch` (Match Surface: `body`, optional
+//! `faces`, `target`, `edges`, optional `order`) and `SurfaceFair` (Fair Surface: `body`, optional
+//! `faces`, `strength`, `iterations`, `keep_edges`, `tolerance`). Older designs need no
+//! transformation; 0.13.x asks for an update instead of meeting a feature it can't read.
@@ -0,0 +1,4 @@
+//! Rectangular and circular feature patterns store alignment and reversal, independently for
+//! each rectangular direction. Defaults preserve older positive-direction placements.
+//! Center retains the source and alternates copies on either side, as sketch patterns do.
+//! The last release refuses this pending format and asks for an update instead of losing it.
@@ -0,0 +1,5 @@
+//! A sketch can sit on a plane seen from its other side: `{"type": "flipped", "base": <plane>}`
+//! (with `"about_y": true` when it turns about the plane's y axis rather than its x axis). New
+//! sketches started from behind an origin or construction plane save this, so they face the
+//! viewer. Older designs have no flipped planes and open unchanged; the last release refuses a
+//! design that has one (it asks for an update) instead of putting the sketch on the wrong side.
@@ -0,0 +1,5 @@
+//! A sketch line can be `infinite` (#1359): construction geometry through its two points, drawn
+//! across the whole view, a boundary for trim and extend along its whole line. Saved only when
+//! set: older designs need no transformation, and a line without it is the line it always was;
+//! 0.13.x (which reads up to 24) asks for an update instead of drawing such a line between its
+//! two points.
@@ -0,0 +1,6 @@
+//! A `Patch` on edges can carry `continuity` (`all`: `g0`, `g1` or `g2`, and `edges`:
+//! `[{edge: [x, y, z], g}]` for edges met otherwise; G0 everywhere when absent, and then not
+//! saved) and `points` it passes through (none when absent). Older designs need no
+//! transformation: a patch without them fills as it always did; a loop that is not a height field
+//! over its plane, which 0.13.0 refused, now fills with one face. 0.13.x asks for an update
+//! instead of dropping them.
@@ -0,0 +1,4 @@
+//! An explicit plane (a mirror's, or any plane reference) can be `placed`: an `origin` of three
+//! length expressions with `x_dir` and `y_dir`, so it follows the design's parameters (#1492). A
+//! plane whose origin is plain numbers is still saved as `custom`. Older designs need no
+//! transformation; 0.13.x asks for an update instead of failing to read the plane.
@@ -0,0 +1,5 @@
+//! Sketch linear patterns save two independent live direction-line references and each
+//! direction's alignment and reversal. Even centered totals keep the original fixed and use
+//! reversal to choose which side receives the extra copy. Older patterns retain their fixed
+//! vectors and positive-direction placement through defaulted fields, so no rewrite is needed.
+//! The last release refuses this pending format instead of silently losing the references.