Release 0.13.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.config/nextest.toml

@@ -10,6 +10,7 @@ not (
     (package(solidcraft-engine) & (
         test(=tests::hostile_params_never_panic)
         | test(/^tests::robustness::/)
+        | test(/^tests::robustness_goldens::/)
         | test(=pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen)
         | test(=pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs)
         | test(=cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall)
@@ -27,3 +28,11 @@ slow-timeout = { period = "60s" }
 
 [profile.ci.junit]
 path = "junit.xml"
+
+# The action matrix sample runs its designs in parallel worker processes, one per CPU. Run with
+# other tests beside it (the heavy ones on main), a pi-case hole that takes 8 s alone (#952 makes
+# it a real hole) went past the matrix's 90 s action limit. It runs on its own.
+[[profile.ci.overrides]]
+filter = "binary(action_matrix) & test(=action_matrix_sample)"
+threads-required = "num-cpus"
+

.github/ISSUE_TEMPLATE/bug_report.md

@@ -14,6 +14,8 @@ What did you expect, and what happened instead?
 
 Include steps, SolidCraft version/commit and relevant environment details. Prefer a small example without private design data.
 
+When the problem shows on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+
 ## Screenshots of the behavior (when observable)
 
 For observable CAD, UI or model behavior, include actual descriptive screenshots or a short recording from a small reproduction. This includes kernel, geometry, assembly and backend effects that can be shown in the app. Coding agents should run the app and capture the evidence themselves, rather than asking a human for evidence they can produce. Show the actual failure/result, preferably before and after, with brief steps, expected/actual behavior and annotations where helpful.

.github/release-notes.md

@@ -5,91 +5,9 @@ parameter to watch the timeline rebuild. [Documentation](https://bherbruck.githu
 [issues](https://github.com/bherbruck/solidcraft/issues). AI agents can model with it over MCP:
 `solidcraft-cli mcp` ([how](https://bherbruck.github.io/solidcraft/guide/mcp.html)).
 
-**Why 0.9:** this is a minor bump because the design file format moved to version 17, and
-because it adds many new features.
-
-**What's new**
-- **Face actions work on about 90% of flat faces.** Sketches, offset planes and press-pull now
-  attach to sheet metal rims and holes, plastic features (Boss, Lip, Rest, Snap Fit), lofts,
-  revolved faces, pieces Offset Face moved and walls a Join merged
-  ([#677](https://github.com/bherbruck/solidcraft/pull/677), fixing
-  [#681](https://github.com/bherbruck/solidcraft/issues/681)). Across the test models: sketch
-  75% → 90%, offset plane 75% → 90%, press-pull 64% → 85%.
-- **Joins:** a logo-style part with pieces extruded up and down from one sketch now joins
-  ([#679](https://github.com/bherbruck/solidcraft/issues/679)), faces that only partly overlap
-  fuse correctly ([#704](https://github.com/bherbruck/solidcraft/pull/704), fixing
-  [#674](https://github.com/bherbruck/solidcraft/issues/674)), and booleans build the same body
-  every time ([#748](https://github.com/bherbruck/solidcraft/pull/748)), so a design rebuilds
-  identically on every run.
-- **Sketch:** type a dimension right after picking (D, click, type;
-  [#695](https://github.com/bherbruck/solidcraft/pull/695)); redundant but consistent
-  constraints are accepted, such as a rectangle clover
-  ([#699](https://github.com/bherbruck/solidcraft/pull/699)); tool windows for Scale, Offset,
-  Mirror, Move/Copy, Fillet and Chamfer and the rectangular pattern (thanks @wdunn001), shown
-  next to the Sketch Palette, which now lists the running tool's options; a typed Rho for the
-  conic; a Construction Geometries row in the Sketch Palette that hides construction geometry
-  ([#804](https://github.com/bherbruck/solidcraft/pull/804)); sketch tool shortcuts open a sketch on the selected plane; Edit Sketch from the viewport
-  menu.
-- **Features:** feature history on the left side with folders (opt in under Preferences;
-  [#449](https://github.com/bherbruck/solidcraft/pull/449)); Convert to Sheet Metal from a solid
-  or shelled body by its bend edges ([#725](https://github.com/bherbruck/solidcraft/pull/725));
-  a tear corner relief ([#809](https://github.com/bherbruck/solidcraft/pull/809)); tapered and
-  variable fillet radii ([#675](https://github.com/bherbruck/solidcraft/pull/675),
-  [#749](https://github.com/bherbruck/solidcraft/pull/749)) with a radius spline you drag on the
-  edge ([#752](https://github.com/bherbruck/solidcraft/pull/752)); free-form cut-outs stay exact
-  in sheet-metal flat patterns ([#692](https://github.com/bherbruck/solidcraft/pull/692)) and edge
-  flanges run along what cut-outs leave of an edge
-  ([#702](https://github.com/bherbruck/solidcraft/pull/702)); and Surface Extrude, sheets from
-  open curves and profile walls ([#815](https://github.com/bherbruck/solidcraft/pull/815)).
-- **View:** Home and Fit frame only what is shown, and a middle double-click goes Home
-  ([#701](https://github.com/bherbruck/solidcraft/pull/701)); a cube navigator option
-  (thanks @Karl-VonRichter, [#664](https://github.com/bherbruck/solidcraft/pull/664)); the window
-  stays responsive and draggable while a design opens, with a Cancel button that stays put
-  ([#643](https://github.com/bherbruck/solidcraft/pull/643),
-  [#686](https://github.com/bherbruck/solidcraft/pull/686)).
-- **Quality:** cuts no longer split walls they don't touch
-  ([#670](https://github.com/bherbruck/solidcraft/pull/670)); booleans are faster and use less
-  memory ([#714](https://github.com/bherbruck/solidcraft/pull/714)); STL export welds shared
-  vertices ([#816](https://github.com/bherbruck/solidcraft/pull/816)); complete Japanese
-  translation ([#753](https://github.com/bherbruck/solidcraft/pull/753)).
-- **Fixes:** pasted features act on the pasted bodies (#613); a refused OK's error clears when
-  you change the inputs (#641); dialogs show the units of their sizes (#630); the wheel over a
-  dialog's list scrolls only the list (#678); a Single hole picked at a circle's centre lands on
-  the centre (#657); axis or tangent plane on a drill tip works (#567); sketch text edits from
-  letter interiors and moves as a whole; a projected edge stays the edge you picked; a size from
-  a bare diameter keeps its unit (#716); Convert Mesh says how big a mesh is and what converts;
-  the Save changes prompt takes arrow keys and Enter.
-- **MCP:** agent skills for modeling and editing over MCP
-  ([#728](https://github.com/bherbruck/solidcraft/pull/728)).
-- A new README demo and the SELENE rover showcase.
-
-**File format 17.** Designs are now format 17 (`solidcraft/17`). SolidCraft 0.8 and older can't
-open designs saved by 0.9, as a container or as JSON; they ask you to update instead. Keep a
-copy of a file you may still open in 0.8. Files from every earlier version still open in 0.9.
-
-**Upgrading from 0.8.** Nothing to do: open your designs and save (they're saved as format 17
-from then on). Feature-history folders on
-the left are off by default; turn them on in Preferences.
-
-**Known limitations**
-- Some through-all holes along a wall or beside curved faces still fail
-  ([#559](https://github.com/bherbruck/solidcraft/issues/559)), as does a hole crossing an
-  equal-radius hole ([#788](https://github.com/bherbruck/solidcraft/issues/788)).
-- Some fillets are still refused, such as along an outline of lines and arcs
-  ([#431](https://github.com/bherbruck/solidcraft/issues/431)).
-- Some faces still can't take an attached sketch: a revolve's flat faces before a later feature
-  ([#726](https://github.com/bherbruck/solidcraft/issues/726)) and faces after Split Body or
-  Combine Intersect ([#565](https://github.com/bherbruck/solidcraft/issues/565)).
-- Fillet and chamfer accept an edge pick far from any edge and change the nearest one
-  ([#783](https://github.com/bherbruck/solidcraft/issues/783)); Press Pull fails on faces beside
-  rounds ([#562](https://github.com/bherbruck/solidcraft/issues/562)).
-- `sheet.fold` refuses a fixed point exactly on the sheet face
-  ([#685](https://github.com/bherbruck/solidcraft/issues/685)), and some tabs on L-shaped or
-  collinear blanks can't be folded ([#638](https://github.com/bherbruck/solidcraft/issues/638),
-  [#639](https://github.com/bherbruck/solidcraft/issues/639)); an edge flange with different
-  per-edge angles leaves gaps at the corners
-  ([#501](https://github.com/bherbruck/solidcraft/issues/501)).
-- More in [ROADMAP.md](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations).
+**What's new** in SolidCraft {version} is listed below, and the
+[ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
+the known limitations. Designs from every earlier version open in this one.
 
 **Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
 `flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old

.github/workflows/ci.yml

@@ -21,8 +21,9 @@ permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.ref }}
-  # Every push to main gets its full run; a new PR push replaces the old run.
+  # A new PR push replaces the old run. Only one run per group may wait, so a busy main would
+  # cancel the waiting nightly (or a Run workflow) before it starts: they get groups of their own.
+  group: ci-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
@@ -47,6 +48,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       native: ${{ steps.paths.outputs.native }}
+      kernel: ${{ steps.paths.outputs.kernel }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -59,12 +61,14 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           native=false
+          kernel=false
           if [ "$EVENT_NAME" != pull_request ]; then
             native=true
           else
             # Compare both old and new paths of renames; unknown paths run native checks.
             git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
             while IFS= read -r -d '' path; do
+              case "$path" in crates/kernel/*|vendor/truck-*) kernel=true ;; esac
               case "$path" in
                 .github/workflows/ci.yml) native=true ;;
                 *.rs|Cargo.toml|Cargo.lock|*/Cargo.toml|.cargo/*|rust-toolchain*) native=true ;;
@@ -74,6 +78,7 @@ jobs:
             done < "$RUNNER_TEMP/ci-paths"
           fi
           echo "native=$native" >> "$GITHUB_OUTPUT"
+          echo "kernel=$kernel" >> "$GITHUB_OUTPUT"
 
   checks:
     name: Format and repository checks
@@ -95,6 +100,8 @@ jobs:
         run: cargo xtask licences --check
       - name: Dependency layers
         run: cargo xtask layers
+      - name: Web app offline use and updates (headless Chrome)
+        run: cargo xtask web-offline-test
 
   clippy:
     name: Native Linux Clippy
@@ -150,7 +157,7 @@ jobs:
 
   tests:
     name: Native Linux tests (${{ matrix.shard }}/4)
-    needs: build-tests
+    needs: [changes, build-tests]
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     strategy:
@@ -177,6 +184,16 @@ jobs:
           # the build job's path, which is the same checkout path here.
           cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
             --profile ci --partition "slice:$SHARD/4" "${all[@]}"
+      - name: Robustness goldens sample (pull requests that touch the kernel)
+        # Every 8th seed of tests/robustness/goldens.json, a quarter per shard; pushes to main and
+        # the nightly run every seed in the step above.
+        if: github.event_name == 'pull_request' && needs.changes.outputs.kernel == 'true'
+        env:
+          SHARD: ${{ matrix.shard }}
+        run: |
+          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
+            --profile ci --ignore-default-filter \
+            -E "package(solidcraft-engine) & test(=tests::robustness_goldens::sample_$((SHARD - 1)))"
       - name: Upload test timings
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -188,16 +205,17 @@ jobs:
   action-matrix:
     # Every ordinary action on every face, edge, vertex and body of the design corpus, against
     # tests/action_matrix/baseline.json (docs/action-matrix.md). Every test run checks a sample;
-    # the whole matrix runs nightly (or by hand), a quarter per job.
-    name: Action matrix (${{ matrix.part }}/4)
+    # the whole matrix runs nightly (or by hand) in shards of about equal cost, cut by
+    # tests/action_matrix/costs.json. Keep SHARDS in step with the matrix below.
+    name: Action matrix (${{ matrix.shard }}/16)
     needs: build-tests
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
-    timeout-minutes: 60
+    timeout-minutes: 55
     strategy:
       fail-fast: false
       matrix:
-        part: [1, 2, 3, 4]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
@@ -206,12 +224,48 @@ jobs:
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: nextest-archive
-      - name: Run a quarter of the matrix
+      - name: Run one shard of the matrix
+        # A step limit below the job's, so the outcomes so far are still uploaded.
+        timeout-minutes: 45
         env:
-          PART: ${{ matrix.part }}
+          SHARDS: 16
+          SHARD: ${{ matrix.shard }}
+          OUT: ${{ github.workspace }}/action-matrix
+        run: |
+          mkdir -p "$OUT"
+          export ACTION_MATRIX_SHARD="$SHARD/$SHARDS" ACTION_MATRIX_RESULTS="$OUT/results-$SHARD.json" \
+            ACTION_MATRIX_TIMINGS="$OUT/timings-$SHARD.jsonl" ACTION_MATRIX_WORKDIR="$OUT/raw-$SHARD"
+          cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
+            --profile ci --success-output final --run-ignored only -E "binary(action_matrix) & test(=action_matrix_shard)"
+      - name: Upload the outcomes and timings
+        # `cargo xtask action-matrix --from DIR --bless` (with every shard's files in DIR)
+        # records them in the baseline and costs.json.
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: action-matrix-${{ matrix.shard }}
+          path: action-matrix
+          retention-days: 14
+
+  action-matrix-determinism:
+    # A sample of the matrix run twice on one runner: every action must come out the same.
+    name: Action matrix determinism
+    needs: build-tests
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: nextest-archive
+      - name: Run a sample twice
         run: |
           cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --run-ignored only -E "binary(action_matrix) & test(=action_matrix_full_$PART)"
+            --profile ci --success-output final --run-ignored only -E "binary(action_matrix) & test(=action_matrix_determinism)"
 
   doc-tests:
     name: Doc tests
@@ -269,9 +323,61 @@ jobs:
           name: oracle-report
           path: docs/oracle.md
 
+  # D3D12's older shader compiler (FXC, used where dxcompiler.dll is absent) is stricter than
+  # DXC, Vulkan and Metal: a shader it cannot compile once crashed the app at startup. Build the
+  # GPU tessellation pipeline with FXC on the runner's WARP software adapter and compare its
+  # results with the CPU.
+  windows-fxc:
+    name: Windows D3D12 FXC shaders
+    needs: changes
+    if: needs.changes.outputs.native == 'true'
+    runs-on: windows-latest
+    timeout-minutes: 45
+    env:
+      WGPU_BACKEND: dx12
+      WGPU_DX12_COMPILER: fxc
+      SOLIDCRAFT_REQUIRE_GPU: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows-fxc
+      # One test at a time: WARP's shader JIT crashes now and then (a null read in
+      # d3d10warp.dll's JIT optimizer, about 1 run in 60) when several devices compile compute
+      # pipelines at once, which the parallel tests do. Minidumps showed it in WARP itself, not
+      # in SolidCraft or FXC; serial runs never hit it.
+      - run: cargo test -p solidcraft-gpu --profile ci --locked -- --test-threads=1
+
+  # The Windows app starts D3D12 first and only the backend it uses (a Vulkan driver crashed the
+  # app at startup on Intel). Start the real app on the runner (its D3D12 adapter is WARP) with
+  # several saved settings and safe mode, and check each draws a frame and quits cleanly.
+  windows-startup:
+    name: Windows app startup
+    needs: changes
+    if: needs.changes.outputs.native == 'true'
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: windows-startup
+      - name: Backend order and probing on Windows
+        run: cargo test -p solidcraft --profile ci --locked -- startup::tests native_crash::tests native_frame::tests
+      - name: Build the app
+        run: cargo build -p solidcraft --profile ci --locked
+      - name: Start the app under different settings
+        shell: pwsh
+        run: tools/windows-startup-smoke.ps1 -Exe target/ci/solidcraft.exe
+      - name: Resize border from the first frame
+        shell: pwsh
+        run: tools/windows-resize-smoke.ps1 -Exe target/ci/solidcraft.exe
+
   # Preserve the existing check name for branch protection, including docs-only PRs.
   ci:
-    needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle]
+    needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
     if: always()
     runs-on: ubuntu-24.04
     steps:
@@ -285,6 +391,8 @@ jobs:
           TESTS: ${{ needs.tests.result }}
           DOCS: ${{ needs.doc-tests.result }}
           ORACLE: ${{ needs.oracle.result }}
+          WINDOWS_FXC: ${{ needs.windows-fxc.result }}
+          WINDOWS_STARTUP: ${{ needs.windows-startup.result }}
         run: |
           test "$CHANGES" = success
           test "$CHECKS" = success
@@ -294,6 +402,8 @@ jobs:
             test "$TESTS" = success
             test "$DOCS" = success
             test "$ORACLE" = success
+            test "$WINDOWS_FXC" = success
+            test "$WINDOWS_STARTUP" = success
           fi
 
   wasm:

.github/workflows/packaging-lint.yml

@@ -6,9 +6,9 @@ name: Packaging lint
 on:
   push:
     branches: [main]
-    paths: [".github/workflows/**", "packaging/**"]
+    paths: [".github/workflows/**", "packaging/**", "assets/**"]
   pull_request:
-    paths: [".github/workflows/**", "packaging/**"]
+    paths: [".github/workflows/**", "packaging/**", "assets/**"]
   workflow_dispatch:
 
 permissions:
@@ -52,13 +52,13 @@ jobs:
           }
       - name: XML, desktop entry, AppStream, Flatpak manifest
         run: |
-          xmllint --noout packaging/windows/solidcraft.wxs packaging/windows/solidcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
-          desktop-file-validate packaging/linux/ai.storyteller.solidcraft.desktop
+          xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
+          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
           # The window's X11 class is its app id; the old id stays only as the rename shims.
-          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' packaging/linux/ai.storyteller.solidcraft.desktop
-          grep -q '<id>ai.storyteller.solvecraft</id>' packaging/linux/ai.storyteller.solidcraft.metainfo.xml.in
+          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
           grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
           appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
           python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
           python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"

.github/workflows/pages.yml

@@ -50,6 +50,8 @@ jobs:
       - name: Build the web app
         working-directory: apps/solidcraft-web
         run: trunk build --release --public-url /solidcraft/app/
+      - name: Test the web app offline and across an update (headless Chrome)
+        run: cargo xtask web-offline-test --site dist/web
       - name: Assemble the site
         run: |
           mkdir -p site

.github/workflows/release.yml

@@ -429,6 +429,32 @@ jobs:
         run: |
           (cd artifacts && sha256sum -- * | tee SHA256SUMS.txt)
           sed "s/{version}/$VERSION/g" .github/release-notes.md >notes.md
+      - name: Sign the checksum list for in-app updates
+        # Optional until the UPDATE_SIGNING_KEY secret exists (docs/releasing.md, "Update
+        # signing"). The trusted comment names the release, which the app checks.
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+        run: |
+          # The key the app checks against (crates/ui-egui/src/update/install.rs, PUBLIC_KEY).
+          public_key=$(sed -n 's/^pub const PUBLIC_KEY: Option<&str> = Some("\([^"]*\)");/\1/p' crates/ui-egui/src/update/install.rs)
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            if [ -n "$public_key" ]; then
+              echo "::error::the app expects signed updates (PUBLIC_KEY is set) but the UPDATE_SIGNING_KEY secret is missing"
+              exit 1
+            fi
+            echo "UPDATE_SIGNING_KEY isn't set: SHA256SUMS.txt stays unsigned"
+            exit 0
+          fi
+          sudo apt-get update -q
+          sudo apt-get install -y --no-install-recommends minisign
+          umask 077
+          printf '%s\n' "$UPDATE_SIGNING_KEY" >"$RUNNER_TEMP/update.key"
+          minisign -S -s "$RUNNER_TEMP/update.key" -m artifacts/SHA256SUMS.txt \
+            -x artifacts/SHA256SUMS.txt.minisig -t "SolidCraft v$VERSION" </dev/null
+          rm -f "$RUNNER_TEMP/update.key"
+          if [ -n "$public_key" ]; then
+            minisign -V -P "$public_key" -m artifacts/SHA256SUMS.txt -x artifacts/SHA256SUMS.txt.minisig
+          fi
       - name: Publish nightly pre-release
         if: github.event_name == 'schedule'
         working-directory: artifacts

.github/workflows/winget.yml

@@ -0,0 +1,77 @@
+# Publishing a GitHub release (not a prerelease) opens a pull request at microsoft/winget-pkgs
+# that adds the new version of bherbruck.SolidCraft, so `winget install bherbruck.SolidCraft`
+# and `winget upgrade` get it. Komac (https://github.com/russellbanks/Komac) downloads the three
+# versioned MSIs, reads their product codes and copies the rest from the previous manifest.
+# Skipped until the owner adds the WINGET_TOKEN secret, and while the package isn't in
+# winget-pkgs yet; see docs/releasing.md.
+name: WinGet
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published release tag to submit (e.g. v0.11.1)
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: winget
+  cancel-in-progress: false
+
+env:
+  PACKAGE_ID: bherbruck.SolidCraft
+  KOMAC_VERSION: 2.16.0
+  KOMAC_SHA256: 7d2707fa6210f2789a3702de49fbd150b736dbf426ee0b9bc8e098736f9fd82d
+
+jobs:
+  submit:
+    runs-on: ubuntu-latest
+    steps:
+      - id: check
+        name: Check for the token and the package
+        env:
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          if [ -z "$WINGET_TOKEN" ]; then
+            echo "No WINGET_TOKEN secret: nothing to submit."
+            exit 0
+          fi
+          case "$TAG" in
+            v[0-9]*.[0-9]*.[0-9]*-*|*nightly*) echo "$TAG is a prerelease: not submitted."; exit 0 ;;
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "::error::Unexpected tag '$TAG'"; exit 1 ;;
+          esac
+          if ! gh api "repos/microsoft/winget-pkgs/contents/manifests/b/bherbruck/SolidCraft" --silent; then
+            echo "$PACKAGE_ID isn't in winget-pkgs yet: nothing to update."
+            exit 0
+          fi
+          echo "version=${TAG#v}" >>"$GITHUB_OUTPUT"
+          echo "tag=$TAG" >>"$GITHUB_OUTPUT"
+      - name: Install Komac
+        if: steps.check.outputs.version != ''
+        run: |
+          archive="komac-${KOMAC_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+          curl -fsSLo "$RUNNER_TEMP/$archive" \
+            "https://github.com/russellbanks/Komac/releases/download/v${KOMAC_VERSION}/$archive"
+          echo "$KOMAC_SHA256  $RUNNER_TEMP/$archive" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" komac
+      - name: Open the winget-pkgs pull request
+        if: steps.check.outputs.version != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          VERSION: ${{ steps.check.outputs.version }}
+          TAG: ${{ steps.check.outputs.tag }}
+        run: |
+          base="https://github.com/${GITHUB_REPOSITORY}/releases/download/$TAG"
+          "$RUNNER_TEMP/komac" update "$PACKAGE_ID" --version "$VERSION" \
+            --urls "$base/solidcraft-$VERSION-windows-x64.msi" \
+                   "$base/solidcraft-$VERSION-windows-x86.msi" \
+                   "$base/solidcraft-$VERSION-windows-arm64.msi" \
+            --release-notes-url "https://github.com/${GITHUB_REPOSITORY}/releases/tag/$TAG" \
+            --submit

AGENTS.md

@@ -27,7 +27,13 @@ new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pa
 ## Never crash
 People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
   returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, design files, control-channel
@@ -59,8 +65,8 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
   operations are our own.
 - **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
-  artwork from commercial CAD products — ever.** Every icon is drawn in code
-  (`crates/ui-egui/src/icons.rs`). Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
+  artwork from commercial CAD products — ever.** Every UI icon is drawn in collected code
+  (`assets/icons/ui/source/`, compiled through `crates/ui-egui/src/icons.rs`). Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
   (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
   Breaking this rule is the most serious mistake you can make in this repo.
 - **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
@@ -75,7 +81,14 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
   `app.start(id)`. Colours come from `theme::Tokens`.
-- **Rust only.** Units are millimetres and radians internally; Z is up.
+- **One set of camera controls**: every page or canvas with a camera (viewport, Render
+  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
+  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
+  camera input (a test rejects it).
+- **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
+  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
+  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
+  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
 - **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
@@ -122,7 +135,10 @@ before the draft is verified.
 ## Running and looking at the app
 - `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
   Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
+- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
+  request on a connection carries the launch's token as `"token"`: read it from
+  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
+  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
   - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
   - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
   - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.

ATTRIBUTION.md

@@ -8,47 +8,47 @@ file is missing from this table.
 templates, materials or help text.** Every asset is original work by SolidCraft contributors or
 third-party material under an open licence. Screenshots of Autodesk software are never committed.
 
-Generated-in-code assets are original and have no file to list:
-- the UI icon set (`crates/ui-egui/src/icons.rs`);
-- the axis view, navigation bar and timeline glyphs (`crates/ui-egui/src/viewport.rs`,
-  `crates/ui-egui/src/timeline.rs`).
+Editable drawing code, native projects and shipped exports are collected under `assets/`.
 
 ## Files
 
 | File | Author | Source | Licence |
 |---|---|---|---|
-| assets/icon.svg | SolidCraft contributors | original macOS adaptation of the code-drawn SolidCraft mark, edited and exported with VectorCraft; Apple HIG and production templates consulted as layout references only | MIT OR Apache-2.0 |
-| assets/SolidCraft.icon/icon.json | SolidCraft contributors | approved Icon Composer composition and appearance settings for the original SolidCraft artwork | MIT OR Apache-2.0 |
-| assets/SolidCraft.icon/Assets/02-grid.svg | SolidCraft contributors | original perspective grid with elliptical radial alpha, exported from VectorCraft | MIT OR Apache-2.0 |
-| assets/SolidCraft.icon/Assets/02-grid-dark.svg | SolidCraft contributors | original blue perspective grid with elliptical radial alpha, exported from VectorCraft for the Dark appearance | MIT OR Apache-2.0 |
-| assets/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | SolidCraft contributors | original saturated blue CAD solid with transparent topology cutouts, edited and exported with VectorCraft | MIT OR Apache-2.0 |
-| assets/Assets.car | SolidCraft contributors | Apple actool compilation of assets/SolidCraft.icon for macOS; contains original artwork only | MIT OR Apache-2.0 |
-| assets/icon.vectorcraft | SolidCraft contributors | editable VectorCraft source for assets/icon.svg, with named face and background layers | MIT OR Apache-2.0 |
-| assets/icon.png | SolidCraft contributors | 1024 × 1024 transparent sRGB export of assets/icon.svg from VectorCraft | MIT OR Apache-2.0 |
-| assets/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/SolidCraft.icon composition | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_16x16.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_16x16@2x.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_32x32.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_32x32@2x.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_128x128.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_128x128@2x.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_256x256.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_256x256@2x.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_512x512.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
-| assets/icon.iconset/icon_512x512@2x.png | SolidCraft contributors | native sips export from assets/icon.png | MIT OR Apache-2.0 |
+| examples/render-studio.json | SolidCraft contributors | original procedural box/cylinder enclosure script for the integrated Render workspace | MIT OR Apache-2.0 |
+| examples/render-opaque-studio.json | SolidCraft contributors | original procedural sphere study varying opaque metal fraction and roughness independently; no external assets or engineering data | MIT OR Apache-2.0 |
+| crates/ui-egui/src/pbr_gpu.rs | SolidCraft contributors | original WGSL translation of SolidCraft's opaque surface and fixed studio reference, embedded as Rust source; no external shader code | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.svg | SolidCraft contributors | original macOS adaptation of the code-drawn SolidCraft mark, edited and exported with VectorCraft; Apple HIG and production templates consulted as layout references only | MIT OR Apache-2.0 |
+| assets/icons/app/macos/source/SolidCraft.icon/icon.json | SolidCraft contributors | approved Icon Composer composition and appearance settings for the original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/app/macos/source/SolidCraft.icon/Assets/02-grid.svg | SolidCraft contributors | original perspective grid with elliptical radial alpha, exported from VectorCraft | MIT OR Apache-2.0 |
+| assets/icons/app/macos/source/SolidCraft.icon/Assets/02-grid-dark.svg | SolidCraft contributors | original blue perspective grid with elliptical radial alpha, exported from VectorCraft for the Dark appearance | MIT OR Apache-2.0 |
+| assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | SolidCraft contributors | original saturated blue CAD solid with transparent topology cutouts, edited and exported with VectorCraft | MIT OR Apache-2.0 |
+| assets/icons/app/macos/exports/Assets.car | SolidCraft contributors | Apple actool compilation of assets/icons/app/macos/source/SolidCraft.icon for macOS; contains original artwork only | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/source/icon.vectorcraft | SolidCraft contributors | editable VectorCraft source for assets/archive/icons/macos-v1/exports/icon.svg, with named face and background layers | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.png | SolidCraft contributors | 1024 × 1024 transparent sRGB export of assets/archive/icons/macos-v1/exports/icon.svg from VectorCraft | MIT OR Apache-2.0 |
+| assets/icons/app/macos/exports/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/icons/app/macos/source/SolidCraft.icon composition | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_16x16.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_16x16@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_32x32.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_32x32@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_128x128.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_128x128@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_256x256.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_256x256@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_512x512.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
+| assets/archive/icons/macos-v1/exports/icon.iconset/icon_512x512@2x.png | SolidCraft contributors | native sips export from assets/archive/icons/macos-v1/exports/icon.png | MIT OR Apache-2.0 |
 | docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
 | docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
 | docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
 | docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (2× playback) | MIT OR Apache-2.0 |
 | docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
-| docs/book/src/og.png | SolidCraft contributors | original 1280 × 640 social preview card (the SolidCraft mark, name and tagline), served by the docs site for link previews | MIT OR Apache-2.0 |
+| assets/branding/web/source/og.png | SolidCraft contributors | original 1280 × 640 social preview card (the SolidCraft mark, name and tagline), served by the docs site for link previews | MIT OR Apache-2.0 |
 | docs/book/src/generated/sample-plate.png | SolidCraft contributors | copy of docs/screenshots/sample-plate.png made by `cargo xtask book` (gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/bracket.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot examples/bracket.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/enclosure.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/enclosure.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/revolve.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/revolve.json`; gitignored) | MIT OR Apache-2.0 |
 | docs/book/src/generated/sheet-metal.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/sheet-metal.json`; gitignored) | MIT OR Apache-2.0 |
-| crates/sketch/fonts/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in crates/sketch/fonts/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
-| apps/solidcraft-web/fonts/BIZUDPGothic-Regular.ttf | The BIZ UDGothic Project Authors | https://github.com/googlefonts/morisawa-biz-ud-gothic (Google Fonts), unmodified; licence text in apps/solidcraft-web/fonts/OFL.txt; used for web UI Japanese font | SIL OFL 1.1 |
+| assets/fonts/liberation-sans/LiberationSans-Regular.ttf | Red Hat, Inc. (Liberation Fonts 2.x; digitized data Google) | https://github.com/liberationfonts (Debian fonts-liberation), unmodified; licence text in assets/fonts/liberation-sans/OFL.txt; used for sketch Text outlines | SIL OFL 1.1 |
+| assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf | The BIZ UDGothic Project Authors | https://github.com/googlefonts/morisawa-biz-ud-gothic (Google Fonts), unmodified; licence text in assets/fonts/biz-udp-gothic/OFL.txt; used for web UI Japanese font | SIL OFL 1.1 |
 | tests/oracle/17-loft/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/17-loft/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/23-bracket-multifeature/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/23-bracket-multifeature/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/28-blind-pocket-fillets/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/28-blind-pocket-fillets/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
@@ -70,6 +70,48 @@ Generated-in-code assets are original and have no file to list:
 | tests/oracle/63-hinge-knuckle/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/63-hinge-knuckle/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 | tests/oracle/65-sketch-gear-tooth/reference.stl | SolidCraft contributors | triangulation of our own recipe (tests/oracle/65-sketch-gear-tooth/recipe.json) built with FreeCAD as an external tool by tools/freecad-oracle | MIT OR Apache-2.0 |
 
+| assets/appearances/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/fonts/biz-udp-gothic/OFL.txt | The BIZ UDGothic Project Authors | Unmodified accompanying font licence | SIL OFL 1.1 |
+| assets/fonts/liberation-sans/OFL.txt | Red Hat, Inc.; Liberation Fonts contributors | Unmodified accompanying font licence | SIL OFL 1.1 |
+| assets/icons/app/linux/exports/hicolor/128x128/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/16x16/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/24x24/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/48x48/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/64x64/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/app/shared/source/windows_ico.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/app/windows/exports/solidcraft-executable.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/windows/exports/solidcraft.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/ui/source/glyphs.rs | SolidCraft / VectorCraft contributors | Original glyphs; caption geometry adapted from VectorCraft titlebar.rs (https://github.com/storytold/vectorcraft) | MIT OR Apache-2.0 |
+| assets/icons/ui/source/icons.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/ui/source/markers.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/ui/source/navigation.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/icons/ui/source/pointer.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/de.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/en.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/fr.json | rlartot | French translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/uk.json | Igor Bronovskyi (BrunIF) | Ukrainian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
+| assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/ai.storyteller.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/macos/Info.plist.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/macos/README.txt | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/windows/solidcraft.en-us.wxl | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/windows/solidcraft.wxs | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/shaders/viewport.wgsl | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/styles/ui/palettes.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+| assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
+
+| docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |
+
 ## Code adapted from sibling projects
 
 | SolidCraft file | Adapted from | Licence |
@@ -83,9 +125,20 @@ Generated-in-code assets are original and have no file to list:
 | crates/mcp/src/tools.rs (tool schema helpers and argument checking) | CADCraft `crates/mcp/src/tools.rs`, GridCraft `crates/mcp/src/tools.rs` | MIT OR Apache-2.0 |
 | crates/io/src/threemf.rs (bounded zip part reading and writing) | GridCraft `crates/xlsx/src/package.rs` | MIT OR Apache-2.0 |
 | crates/ui-egui/src/titlebar.rs (title bar drag, caption buttons, resize zones, their tests) and the window setup in apps/solidcraft/src/main.rs | VectorCraft `crates/ui-egui/src/titlebar.rs`, `apps/vectorcraft/src/main.rs` | MIT OR Apache-2.0 |
+| apps/solidcraft/src/open_documents.rs (macOS: files opened from Finder and the Dock, its test) | VectorCraft `apps/vectorcraft/src/open_documents.rs` (https://github.com/storytold/vectorcraft) | MIT OR Apache-2.0 |
 | LICENSE-MIT, LICENSE-APACHE (licence text) | CADCraft | — |
 | .github/workflows/release.yml, .github/workflows/packaging-lint.yml and packaging/ (release pipeline: Linux AppImage/deb/rpm/Flatpak/tar.gz, FreeBSD, macOS dmg, Windows MSI/portable zip, web zip; AppRun, nfpm, Flatpak, WiX and Info.plist templates) | PhotoCraft (https://github.com/storytold/photocraft) `.github/workflows/{release,packaging-lint}.yml`, `packaging/` | Apache-2.0 |
 
+## Incremental HDR codec adapter
+
+`crates/render/src/lighting/hdr.rs` adapts the scanline/component/old-RLE decoding
+state machines from the Radiance decoder in `image` 0.25.10
+([source](https://docs.rs/crate/image/0.25.10/source/src/codecs/hdr/decoder.rs)),
+MIT OR Apache-2.0. Metadata parsing still uses that library. The adapter makes row
+work cooperative and adds checked run lengths, zero-run rejection, width validation,
+header/input/radiance bounds and cancellation. Original licence texts are retained
+in THIRD-PARTY-LICENSES.txt; no images or artwork from that project are copied.
+
 ## Recovered contributions
 
 | SolidCraft file | Original contribution | Licence |
@@ -96,9 +149,9 @@ Generated-in-code assets are original and have no file to list:
 
 | Directory | Source | Licence | Changes |
 |---|---|---|---|
-| vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: bounded parameter searches, subdivision and provisional fixed-grid previews (vendor/README.md) |
+| vendor/truck-meshalgo | truck-meshalgo 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | meshing: bounded parameter searches, collapsed-boundary projection, subdivision and provisional fixed-grid previews (vendor/README.md) |
 | vendor/truck-stepio | truck-stepio 0.3.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | STEP writer: intersection-curve surfaces written at unique ids (vendor/README.md) |
-| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro (vendor/README.md) |
+| vendor/truck-shapeops | truck-shapeops 0.4.0, https://github.com/ricosjp/truck (RICOS Co. Ltd.) | Apache-2.0 | robust meshing and nearest-parameter fallback in booleans; degenerate intersection-curve rejection; face and edge history of booleans; trace macro; corner choice at vertices several intersection curves end on (vendor/README.md) |
 | vendor/matext4cgmath | matext4cgmath 0.1.0, https://github.com/ricosjp/matext4cgmath (RICOS Co. Ltd.) | Apache-2.0 | root refinement stops after 100 Newton steps (vendor/README.md) |
 
 ## Vendored renderer compatibility fix

CLAUDE.md

@@ -27,7 +27,13 @@ new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pa
 ## Never crash
 People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The three exceptions, in the app crate
+  (which denies it instead), have no safe API: two functions in
+  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
+  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
+  records crashes inside native code such as graphics drivers) and the Windows-only
+  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
+  test of the window without OS decorations).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
   returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, design files, control-channel
@@ -75,7 +81,10 @@ People trust SolidCraft with their designs; a crash loses their work. **This out
   egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
   `app.start(id)`. Colours come from `theme::Tokens`.
-- **Rust only.** Units are millimetres and radians internally; Z is up.
+- **Rust only.** Units are millimetres and radians internally; Z is up. The one exception is
+  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
+  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
+  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
   assets, layers). Commit after every feature arc that builds.
 - **Publishing**: `origin` is github.com/bherbruck/solidcraft. Changes land through **pull requests**:
@@ -99,7 +108,10 @@ before the draft is verified.
 ## Running and looking at the app
 - `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
   Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
-- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`):
+- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
+  request on a connection carries the launch's token as `"token"`: read it from
+  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
+  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
   - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
   - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
   - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.

CONTRIBUTING.md

@@ -107,13 +107,21 @@ The [README](README.md#architecture) has the layer table. The short version:
    `cargo xtask assets` enforces this.
 4. **Never crash.** People trust a CAD app with their work.
    - Non-test code never uses `unwrap`, `expect`, `panic!` or indexing on input-derived data.
-     There's no `unsafe`, and clippy denies it.
+     There's no `unsafe` outside `apps/solidcraft/src/open_documents.rs` (macOS file-open events)
+     and `apps/solidcraft/src/native_crash.rs` (Windows native crash capture), and the compiler
+     denies it.
    - An unsupported case returns an error ("not supported yet: …"); it never panics.
    - Every call into truck goes through `solidcraft_kernel::guard`.
    - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
    `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
    face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
+   viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
+   `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
+   `NavCaps` saying whether it can orbit (off for flat 2D pages) and pick. New canvases must use
+   `navigation::handle`; never read drags, the wheel or pinch to move the camera yourself. The
+   `hand_rolled_camera_input_is_rejected` test fails if a page does.
 
 [AGENTS.md](AGENTS.md) has the long form of these rules. It's written for AI agents, but it's
 the most complete description of the house style.
@@ -161,7 +169,8 @@ Pull requests skip a few heavy tests (one to four minutes each), which run on ev
 `main` and nightly; check the `main` run after merging. They are listed in
 `.config/nextest.toml` and the [testing page](docs/book/src/dev/testing.md):
 
-- `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness`,
+- `solidcraft-engine`: `tests::hostile_params_never_panic`, everything in `tests::robustness` and
+  `tests::robustness_goldens` (pull requests that touch `crates/kernel` run its `sample_*` part),
   `pattern_suppress_tests::enclosure_arc_extinction_keeps_a_real_sharp_inner_lip_after_resize_and_reopen`,
   `pattern_suppress_tests::enclosure_datums_follow_wall_height_and_board_depth_with_material_proofs`,
   `cmd::plastic::tests::enclosure_snap_fit_follows_resized_front_wall`

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]
 
 [workspace.package]
-version = "0.9.0"
+version = "0.13.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -18,18 +18,26 @@ solidcraft-geom = { path = "crates/geom" }
 solidcraft-sketch = { path = "crates/sketch" }
 solidcraft-kernel = { path = "crates/kernel" }
 solidcraft-render = { path = "crates/render" }
+solidcraft-gpu = { path = "crates/gpu" }
 solidcraft-doc = { path = "crates/doc" }
 solidcraft-io = { path = "crates/io" }
 solidcraft-engine = { path = "crates/engine" }
 solidcraft-ui-egui = { path = "crates/ui-egui" }
 solidcraft-mcp = { path = "crates/mcp" }
+solidcraft-derive = { path = "crates/derive" }
 
 # foundation
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
+# derive macros (crates/derive); already in the tree through serde_derive
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 sha2 = "0.10"
+moxcms = { version = "0.8.1", default-features = false, features = ["extended_range"] }
+semver = "1"
 
 # geometry kernel (Apache-2.0; see plan/adr/0001-geometry-kernel.md). Only crates/kernel uses it.
 truck-modeling = "0.6"
@@ -50,7 +58,8 @@ quick-xml = "0.41"
 ttf-parser = { version = "0.25", default-features = false, features = ["std"] }
 
 # images
-image = { version = "0.25", default-features = false, features = ["png"] }
+image = { version = "0.25", default-features = false, features = ["png", "hdr"] }
+png = "0.18.1"
 
 # ui
 egui = "0.36"
@@ -58,6 +67,10 @@ eframe = { version = "0.36", default-features = false, features = ["persistence"
 # Instant/SystemTime that also work in the browser (std panics on wasm32-unknown-unknown).
 web-time = "1"
 egui-wgpu = "0.36"
+# the wgpu egui-wgpu uses, for compute (crates/gpu); backends come from the apps' features
+wgpu = { version = "30", default-features = false, features = ["std", "wgsl"] }
+naga = { version = "30", default-features = false }
+pollster = "0.4"
 rfd = "0.17"
 
 [workspace.lints.rust]

NOTICE

@@ -19,6 +19,11 @@ licensed MIT OR Apache-2.0; ATTRIBUTION.md lists the files.
 The release packaging (.github/workflows/release.yml, packaging/) is adapted from PhotoCraft
 (https://github.com/storytold/photocraft), licensed under the Apache License 2.0.
 
+The incremental Radiance RGBE row adapter in crates/render/src/lighting/hdr.rs adapts
+decoding state machines from image 0.25.10 (https://github.com/image-rs/image),
+MIT OR Apache-2.0. ATTRIBUTION.md describes the bounded/cancellable changes; the
+original licence texts are included in THIRD-PARTY-LICENSES.txt.
+
 Most bundled assets are drawn in code or contributed originally; third-party fonts (Liberation Sans
 for sketch text, BIZ UDPGothic for web Japanese display) are licensed under SIL OFL 1.1. The
 per-file list is in ATTRIBUTION.md.

README.md

@@ -21,6 +21,8 @@ model through the built-in MCP server.
 - **Windows:** download and run the [installer][windows-msi].
   Also for [ARM64][windows-arm64-msi] and [32-bit][windows-x86-msi] PCs, or as a
   [portable zip][windows-portable] that runs without installing.
+  With [WinGet](https://learn.microsoft.com/windows/package-manager/winget/):
+  `winget install bherbruck.SolidCraft`.
 - **macOS:** open the [disk image][macos-dmg] and drag SolidCraft into Applications
   (Apple silicon and Intel).
 - **Linux:** download the [AppImage][linux-appimage], allow it to run as a program and open it.
@@ -125,14 +127,29 @@ rebuild with no errors, replayed here at 2× speed.
   provisional picture from warm geometry caches while rebuilding before editing; caches never
   replace the parametric design. Export to STEP (AP242 with body names, colours and
   components as assemblies; revolved faces as native planes, cylinders, cones, spheres and tori),
-  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ;
+  IGES 5.3 (manifold solid B-reps with names and colours), 3MF, STL (binary/ASCII) and OBJ, and
+  assemblies with joints as URDF for robot simulators (docs/urdf.md);
   3MF, STL and OBJ import as mesh bodies (they render, measure, move and export; solid features
-  need B-rep bodies). Convert Mesh reconstructs supported closed constant-section parts
+  need B-rep bodies). The `mesh.convert` command reconstructs supported closed constant-section parts
   as parametric solids with planar and circular cylindrical faces;
   STEP import (AP203/AP214/AP242 solids, assemblies, units, names, colours) and IGES import
   (manifold solid B-reps, or trimmed and bounded surfaces sewn into solids) as a base feature
   that later features build on — open a `.step`/`.stp`/`.igs`/`.iges` file, insert one into a
   design, or drop it on the window ([docs/step-import.md](docs/step-import.md)).
+- **Render:** opaque surfaces can use metal fraction, roughness and dielectric IOR in the
+  integrated product viewport and CPU preview PNGs. Existing simple colors remain supported.
+  Fixed direct lighting is a preview; HDRI, refraction and texture maps are not implemented.
+  See [opaque surfaces](docs/render-opaque-pbr.md).
+- **Display meshes** from our own tessellation planner: each face becomes a plan of (u, v)
+  points and triangles that shares its edge nodes with its neighbours, so the mesh is watertight.
+  Facets follow the chord tolerance, the facet angle and a longest side, with cells at most 2:1
+  along straight directions. Box-bounded and four-cornered faces mesh as structured grids.
+  Trimmed faces are cut into four-sided patches: squares around holes, butterflies in round
+  faces, motorcycle traces from concave corners (after Lyon et al. 2019). Each patch then meshes
+  as a Coons grid. Intersection edges are evaluated by Newton on both surfaces. A compute shader
+  evaluates the plans for the whole scene in one dispatch, with a CPU fallback when the GPU
+  can't build it. Planning and evaluating the 78 reference bodies takes about 65 ms, 50–65×
+  faster than the previous mesher.
 - **Desktop app** (egui + wgpu): toolbar with workspace tabs, browser, timeline, 3D viewport with
   axis view and navigation bar, sketch tools, feature dialogs, command palette, and a JSON-lines
   control channel so agents and tests can drive it.
@@ -150,6 +167,7 @@ cargo run --release -p solidcraft -- --sample          # desktop app with a samp
 cargo run --release -p solidcraft-cli -- commands      # the command registry
 cargo run --release -p solidcraft-cli -- run examples/bracket.json --out bracket.step
 cargo run --release -p solidcraft-cli -- snapshot examples/bracket.json --out bracket.png
+cargo run --release -p solidcraft-cli -- render examples/render-studio.json --out product.png
 cargo run --release -p solidcraft -- part.step          # open a STEP file as a new design
 cargo run --release -p solidcraft-cli -- eval part.step # measure an imported STEP file
 cargo xtask ci                                          # fmt, clippy, tests, assets, layers, wasm
@@ -199,7 +217,9 @@ stdio. Headless it runs its own design session; with `--connect 127.0.0.1:PORT`
 started with `solidcraft --control PORT`, so you can watch the agent model. Tools:
 `list_commands`, `execute`, `batch`, `inspect_design`, `measure`, `body_topology`,
 `set_parameter`, `screenshot` (returns the image), `export`, `undo`, `redo`, `new_design`, `open`,
-`save`. Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Details, client
+`save`. Tool calls reach files only in the open design's folder (when it lies inside your home
+folder, never home itself or a hidden folder), SolidCraft's recovery folder and folders given with
+`--allow-path DIR`. Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Details, client
 configuration and an example session: [docs/mcp.md](docs/mcp.md).
 
 ## Architecture
@@ -212,7 +232,7 @@ configuration and an example session: [docs/mcp.md](docs/mcp.md).
 | L2 | `doc` | parameters, expressions, the feature timeline and its incremental evaluation |
 | L3 | `io` | design files, STL/OBJ/STEP/3MF export, STEP and 3MF/STL import features |
 | L4 | `engine` | the session and the command registry (everything is a command) |
-| L5 | `ui-egui`, `mcp` | the swappable desktop front end; the MCP server (headless or bridged to the app) |
+| L5 | `gpu`, `ui-egui`, `mcp` | compute-shader evaluation of display tessellation plans; the swappable desktop front end; the MCP server (headless or bridged to the app) |
 | apps | `solidcraft`, `solidcraft-cli` | desktop app, headless CLI |
 <!-- ANCHOR_END: architecture -->
 

ROADMAP.md

@@ -1,6 +1,6 @@
 # SolidCraft roadmap
 
-Status as of **2026-10-11**. SolidCraft supports parametric modelling (sketch →
+Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
 features → parametric timeline) as an open, pure-Rust, agent-drivable application.
 
 ## At a glance
@@ -9,7 +9,7 @@ features → parametric timeline) as an open, pure-Rust, agent-drivable applicat
 |---|---|
 | Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
 | Features | Every registered command by area — [docs/features.md](docs/features.md) (`cargo xtask features`); registry breadth does not establish workflow or geometric depth |
-| Reference tests | **76 / 76 parts match** — [docs/oracle.md](docs/oracle.md): public cases in `tests/oracle/` with analytic (55) or FreeCAD-computed (21) expected values, run by CI on every PR. |
+| Reference tests | **82 / 82 parts match** — [docs/oracle.md](docs/oracle.md): public cases in `tests/oracle/` with analytic (61) or FreeCAD-computed (21) expected values, run by CI on every PR. |
 | Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
 | Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
 | Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
@@ -21,6 +21,8 @@ offsets and plastic face placements, XZ (+Y normal) with a v6 migration preservi
 designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
 toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
 acceptance scenarios now include board resizes; STEP reopening is automated. See [WIP reconciliation](docs/wip-reconciliation.md).
+Face-based Extrude Join (including outward Press Pull) now defaults to the picked body,
+so edge-touching assembly neighbours stay separate regardless of body order (#226).
 
 In scope, in priority order:
 1. SOLID and SKETCH (now).
@@ -47,25 +49,111 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 | M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
 | M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
 | M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
+| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
 | M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
 | M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; optional compact named left feature history with rollback bar, multi-selection and persistent folders above the parts browser), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator; taper handle open), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; preferences | in progress | 6 |
-| M7 | Sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Patch with G1/G2 and general loops (#759), Blend surface (#764), sweep rails, twist and scale (#771, loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure. Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
+| M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
+| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane or a face), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis. Proposed, in order: surface Extrude/Revolve/Sweep/Loft from open and closed curves (#757), Offset surface (#758), Unstitch and Reverse Normal (#766), Delete Face without healing (#768); Extend curved faces and edges (#760), mutual trim and trim by projected curves (#767), Untrim (#761), Thicken every surface kind (#765); Ruled (#762), Boundary surface and curve networks with G0/G1/G2 (#763), Patch with G1/G2 and general loops (#759), Blend surface (#764), sweep guide rails and two-rail sweeps (#771; orientation, twist and end scale done; loft rails #201), fillet between surface bodies (#769); continuity analysis, surface curvature combs and isocurves (#770) | deferred | — |
+| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), Exploded views (automatic or by hand, shown without changing placements); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
 | M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs in Fusion's layout with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
 | M11 | 2D drawings | deferred | — |
 | M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. Trusted distribution signing and broader performance work remain | in progress | 16 |
 | M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
 | M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
 
+M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
+pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
+retain their saved two-finger scroll preference; camera motion is available through
+`view.navigate` and modifier-aware `ui.move` automation.
+
+## Interactive modelling
+
+- New Body extrusion and face-offset previews show completed intermediate geometry while a
+  drag continues, then catch up to the exact final value. Changes to the selected geometry,
+  operation or feature still discard obsolete results. Distance arrows and their value boxes
+  follow the current frame's input.
+
+## Physical material data
+
+- Physical material card validation (#923/#922) provides typed SI mechanical and
+  thermal data, per-property sources/conditions and isotropic/orthotropic stability
+  checks through read-only `material.properties.validate`. It does not assign or
+  persist properties, provide a solver or enable rendering; see
+  [the contract and staged follow-ups](docs/physical-material-cards.md).
+
+- Directional elasticity (#994) queries the validated card in material-local axes
+  through read-only `material.properties.directional`, with source/condition review.
+  It does not assign body frames, predict structural behavior or enable a solver.
+
+## Library foundations (#785, #786, #787)
+
+- Local scalar libraries (#846) inspect/export bounded portable catalogs and copy exact
+  selected appearance/material revisions into existing design definitions in one undo step.
+  Appearance offers local loading/search/export; physical materials use existing commands.
+  This slice is independent of the render stack and does not change the document format.
+  See [the contract and limits](docs/book/src/dev/local-libraries.md).
+
+- Proposed phases cover offline bundled/project/user packs, physical materials and
+  appearances, editable wood mapping, and parameterized component/assembly families.
+  Stable identity/revision, copied design definitions, provenance and resource limits
+  apply from the first implementation. Existing material, appearance and standard-part
+  commands remain the application paths. See [the proposal](docs/book/src/dev/libraries.md)
+  for source/license review and acceptance gates. This is planning only: pack loading,
+  texture rendering and expanded component families are not implemented by this entry.
+
 ## Render foundation
 
+- Explicit texture normalization (#1218) produces completed float RGBA with
+  role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
+  opt-in EXIF orientation. It retains high-precision raw samples and records lossy
+  gamut clipping only when explicitly requested. It is not a renderer/resource
+  consumer; see [the supported policy and limits](docs/render-texture-normalization.md).
+
+- Opt-in opaque PBR (#1046) connects persisted surface parameters to the integrated
+  product viewport and CPU PNG, using a fixed direct-light studio. Geometry and mass
+  stay unchanged. HDRI, transmission and textures remain separate gates.
+  See [the consumer and limitations](docs/render-opaque-pbr.md).
+
+- Combined integration is tracked in #842, with independent scalar libraries in
+  #863 and richer PBR/material-card transport in #1086. See [phase boundaries and validation gates](docs/render-integration.md).
+  Render/library consumers use the merged asynchronous picker (#1127). Material-card
+  UI (#1094), texture mapping and HDRI lighting remain explicit follow-ups.
+
+- R4a adds bounded CPU product-image jobs, cancellation and atomic PNG export through
+  engine commands, the Render panel, CLI and persistent MCP. Immutable captures and
+  results stay outside persistence/undo; native workers and cooperative browser tasks
+  share the same work protocol. See [jobs, limits and export](docs/render-jobs.md).
+
+- R3 adds an overlay-free product scene and the integrated Render workspace, with
+  runtime GPU host capabilities, per-document drafts and named camera/background
+  controls. Design keeps its camera and drawing policy. Raster transparency remains
+  approximate; PBR and environments are later slices. See
+  [workspace and scene contracts](docs/render-workspace.md).
+
+- R2 adds bounded named render setups in document format 21 and the read/save
+  `render.settings.get/set` commands. Proven render-only changes preserve geometry
+  and prepared world data through undo/redo and checkpoint restore. This slice does
+  not add a Render workspace, PBR, environments or image jobs; see
+  [settings and refresh policy](docs/render-settings.md).
+- Bounded PNG/JPEG texture admission (#900) validates in-memory sources and returns
+  completed RGBA8 pixels with explicit color/data roles. It is an input utility only:
+  ICC/16-bit normalization, local wood mapping, resource persistence and the renderer
+  consumer remain separate work. See [limits and licensed-file probes](docs/render-texture-input.md).
+
+- The initial opaque surface numerical contract for #1004 provides bounded linear
+  color/metallic/roughness/IOR admission and an original tested direct-light BRDF.
+  The numerical module alone advertises no capabilities; the installed consumer above
+  provides rendering. See
+  [the model, evidence and remaining consumer gates](docs/render-surface.md).
+
+- A bounded cooperative Radiance RGBE input utility is available in L1 render;
+  it does not yet enable HDRI/PBR rendering or a document import command. See
+  [the input contract](docs/render-hdr-input.md) and #813 for integration work.
 - R1 adds renderer-independent backend/profile metadata, strict request resolution and
   bounded image/scratch admission checks, exposed by the read-only `render.backends`
   command. It describes the current CPU raster snapshot path without evaluating the model.
-  Existing snapshot and viewport routes remain unchanged. The Render workspace, HDRI/PBR,
-  render jobs and optional engines remain future work; see [the contract](docs/render-backends.md)
+  The legacy Design snapshot route remains unchanged. Later slices above provide the
+  workspace/jobs and opaque PBR; HDRI and optional engines remain future work. See [the contract](docs/render-backends.md)
   and [the phased proposal (#620)](https://github.com/bherbruck/solidcraft/issues/620).
 
 ## Dimensioning and error reporting
@@ -134,6 +222,20 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
   Crash Reports…) with a reviewed issue draft; agents read them through
   `diagnostics.crash_reports`, the MCP `crash_reports` tool or the CLI. Nothing is sent
   anywhere. See [crash reports](docs/crash-reports.md).
+- Agent chat (off by default, desktop): a side panel that drives a coding agent the user
+  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, …) over the
+  Agent Client Protocol, under the user's own login; SolidCraft stores no keys. The agent works
+  through SolidCraft's MCP tools on a gated endpoint of its own: file actions wait for Allow or
+  Deny, crash reports are off limits, 24 changes per message, one undo step per message, and
+  the agent's whole process group ends with the panel or the app. Docks left or right,
+  minimises to a strip. See [agent chat](docs/agent-chat.md).
+- Command scripts from designs (#886): `timeline.export_script` (CLI `solidcraft-cli script`)
+  writes a design's history as a script that `eval` and `run` replay into the same design —
+  user parameters, units, sheet metal and plastic rules and materials as their own commands,
+  then each feature through `timeline.add` with its ids, names and dimension parameters kept,
+  so every feature kind replays exactly and a failing feature fails the same way. Trimming the
+  script after a step gives the design at that step. Appearances, folders, views and
+  configurations are listed as left out; components and joints are not supported yet.
 
 ## 0.2.0 release batch
 
@@ -194,6 +296,9 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
 
 - Associative shell-face sketches require a unique certified planar source. Nested shell
   attachments and ambiguous coincident sources remain unsupported.
+- G2 fillets: exact quintic blends of straight edges between planar faces, with one perpendicular
+  planar end face at each end. The UI and `solid.fillet` expose `curvature` (alias `g2`); the size
+  is an equivalent circular setback. Curved faces/edges, sloped ends and corner junctions remain unsupported.
 - Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
   rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
   meet (a sphere for equal radii); straight edges (convex or concave) between planar faces with perpendicular
@@ -201,6 +306,8 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
   basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
   corners around pocket rims, with unequal wall slopes and extensions confined to the face;
   connected equal-distance chamfers also trim each other across unequal sloped rim walls;
+  curved chamfer chains with straight planar ends can terminate across two existing planar
+  bevel faces, splitting their shared seam; picks on the same tangent chain are applied once (#1303);
   whole smooth loops of a planar face, picked whole or by one edge (tangent
   chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
   plate outlines), loops with sharp corners between straight edges (the blends meet in mitres), runs of
@@ -211,7 +318,15 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
   edges between any two smooth sides (a branch pipe on a main pipe), by a rolling ball (the
   blend a rational B-spline through exact arcs), closed or ending at planar faces square to the
   edges, where straight or curved cap edges are trimmed to the contacts (the straight edge
-  between two overlapping extruded arcs).
+  between two overlapping extruded arcs); knife edges, where the two faces have opposite
+  normals (a wall that runs out tangent into a face: the ball that fits there); an edge that
+  runs out along an end face tangent to one side (the arc top edge of that wall), cut where the
+  blend meets it; rounds that end in an earlier round on curved faces, in any order (the rounds
+  of two edges at a vertex meet in a crease, as on a box), picked together or one after the
+  other, except a round after a round of the edge between the wall and a flat face that it
+  would run over; the three edges at a vertex of any smooth faces, of one radius, end in a
+  piece of sphere. A limiting blend that collapses a side wall into coincident boundary
+  curves is refused as too large rather than returning an unmeshable face (#1113).
 - Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
   sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
   annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
@@ -245,10 +360,17 @@ PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
   and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
   touch (no clean crossing) enter that profile as polylines.
   Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
+  A sweep with a twist, an end scale or a parallel or direction orientation (#771) follows its
+  path that way too, even along sketch lines and arcs: B-spline walls through stations, ruled
+  walls through denser stations where the path has corners or the profile has holes.
 - Extend intersects exact ellipses and rational/high-degree splines without moving the line or
   circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
-  certificate and refine within bounded node limits while retaining existing IDs. Singular,
-  self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
+  certificate and refine within bounded node limits while retaining existing IDs.
+  At the node limit, geometric certificate subdivisions accommodate unequal spline parameter
+  speeds without changing stored nodes or relaxing the distance tolerance (#971).
+  Associated offset fit nodes stay hidden from display, picking and snapping; dragging the
+  editable source updates the derived boundary live. Break Association restores point editing.
+  Singular, self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
   closed natural-spline seams remain limitations. New explicitly closed fit splines and closed
   offset outputs use periodic C2 interpolation, supporting repeated certified offsets; older
   natural splines are preserved. Clicking the starting fit point deliberately closes a new loop.
@@ -386,6 +508,15 @@ editing. Construction planes and points resolve drawn 3D wires without applying
 plane a second time. Curved paths use sampled segments; multi-curve chains, absolute distance
 and reference-object placement remain separate work, as do loft rails and centerlines.
 
+## Design properties (#1015)
+
+- Designs carry project, part number, revision, author, organization, description and licence
+  in an optional `metadata` object (File → Design Properties…, `document.metadata.*`,
+  `inspect_design`). STEP and IGES headers and 3MF model metadata take the fields their format
+  has a place for. Other tools keep their own data under a reverse-DNS key, kept as it is
+  through open, edit and save and never exported. See [design properties](docs/book/src/guide/files.md#design-properties).
+  Per-component properties (a part number per component) can follow with the same type.
+
 ## Document-opening performance
 
 - Desktop STEP import prepares consecutive independent solids in bounded batches with up
@@ -431,6 +562,14 @@ and reference-object placement remain separate work, as do loft rails and center
   events by strategy and reports any bounded-log truncation. Existing geometry
   acceptance checks remain in force.
 
+- Cylinders of one radius whose axes cross (a second bore across a bore of the same size, a pipe
+  tee of equal pipes) touch at two points, where the mesh intersection cannot trace the curves
+  and a boolean cannot tell the four arms of the crossing apart. When the ordinary boolean fails
+  on such a pair, both faces are split along the line of their cylinder through the touching
+  points (the solids are unchanged), the boolean is taken of those, and its history is composed
+  back over the operands as given (#788). The result keeps the split lines as edges of the bore
+  walls. A crossing the ordinary route fails on and the split faces do not help (a radius of 17.5
+  in a 45 mm block with a tool of 80 mm) is still refused.
 - Boolean intersection-curve construction refuses point-only, collapsed and non-finite
   polylines without panicking. Direct constructor regressions retain valid open endpoints
   and closed spherical intersections; the original interactive trigger remains unidentified.

apps/solidcraft-cli/src/bench_agent.rs

@@ -0,0 +1,239 @@
+//! `bench-agent`: a large design built the way an agent builds one over MCP, one small command
+//! at a time, timed as it grows and then opened again.
+//!
+//! The design is a bicycle of about 1,300 bodies: frame tubes joined at root and then moved into
+//! a component, two wheels whose spokes and nipples are placed one by one, a chainring with
+//! patterned teeth, a cassette, a chain of individual links, cockpit, seat and a few hundred
+//! fasteners. Nothing is read from a file; the script is generated here, so the benchmark needs
+//! no fixture.
+//!
+//! ```text
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! ```
+//! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
+//! build total, then the phases `bench-open` prints for the saved design.
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+struct Script {
+    commands: Vec<Value>,
+}
+
+impl Script {
+    fn c(&mut self, command: &str, params: Value) {
+        self.commands.push(json!({"command": command, "params": params}));
+    }
+
+    /// A round tube from `a` to `b` (an agent's frame tube, spoke or post).
+    fn tube(&mut self, a: [f64; 3], b: [f64; 3], radius: f64, body: &str) {
+        let d = [b[0] - a[0], b[1] - a[1], b[2] - a[2]];
+        let len = (d[0] * d[0] + d[1] * d[1] + d[2] * d[2]).sqrt();
+        let axis = [d[0] / len, d[1] / len, d[2] / len];
+        self.c(
+            "solid.cylinder",
+            json!({"radius": radius, "height": round3(len), "base": a.map(round3), "axis": axis.map(round6), "body_name": body}),
+        );
+    }
+
+    fn component(&mut self, name: &str) {
+        self.c("component.create", json!({"name": name}));
+    }
+
+    fn root(&mut self) {
+        self.c("component.activate", json!({"component": "root"}));
+    }
+
+    /// A wheel built at the origin in its own component, then placed where it goes (the
+    /// component's occurrence moved), as an agent builds one part and positions it.
+    fn wheel(&mut self, label: &str, at: f64, spokes: usize) {
+        let cx = 0.0;
+        self.component(&format!("{label} wheel"));
+        self.c("solid.torus", json!({"major": 311, "minor": 12, "center": [cx, 0, 340], "body_name": format!("{label} rim")}));
+        self.c("solid.torus", json!({"major": 330, "minor": 18, "center": [cx, 0, 340], "body_name": format!("{label} tyre")}));
+        self.c("solid.cylinder", json!({"radius": 18, "height": 110, "base": [cx, -55, 340], "axis": "Y", "body_name": format!("{label} hub")}));
+        for k in 0..spokes {
+            let a = std::f64::consts::TAU * k as f64 / spokes as f64;
+            let side = if k % 2 == 1 { 1.0 } else { -1.0 };
+            let hub = [cx + 30.0 * a.cos(), side * 40.0, 340.0 + 30.0 * a.sin()];
+            let (ca, sa) = ((a + 0.12).cos(), (a + 0.12).sin());
+            let rim = [cx + 300.0 * ca, side * 4.0, 340.0 + 300.0 * sa];
+            self.tube(hub, rim, 1.0, &format!("{label} spoke {k}"));
+            let nipple = json!({"radius": 2, "height": 12, "base": rim.map(round3), "axis": [round6(ca), 0, round6(sa)], "body_name": format!("{label} nipple {k}")});
+            self.c("solid.cylinder", nipple);
+        }
+        self.root();
+        self.c("occurrence.move", json!({"occurrence": format!("{label} wheel:1"), "translate": [at, 0, 0]}));
+    }
+}
+
+fn round3(v: f64) -> f64 {
+    (v * 1e3).round() / 1e3
+}
+
+fn round6(v: f64) -> f64 {
+    (v * 1e6).round() / 1e6
+}
+
+/// The bicycle's command script. `scale` multiplies the counts of repeated parts (spokes,
+/// chain links, fasteners); 1.0 gives about 1,300 bodies.
+pub fn bicycle(scale: f64) -> Value {
+    let n = |k: f64| ((k * scale).round() as usize).max(1);
+    let mut s = Script { commands: Vec::new() };
+    // Frame: tubes at root, the main triangle joined, then everything moved into its component.
+    let (bb, head_top, head_bot, seat_top) = ([0.0, 0.0, 300.0], [600.0, 0.0, 860.0], [580.0, 0.0, 740.0], [-150.0, 0.0, 820.0]);
+    s.tube(bb, head_bot, 19.0, "Down tube");
+    s.tube(seat_top, head_top, 16.0, "Top tube");
+    s.tube(bb, seat_top, 16.0, "Seat tube");
+    s.tube(head_bot, head_top, 22.0, "Head tube");
+    for (side, y) in [("L", 60.0), ("R", -60.0)] {
+        s.tube([0.0, y * 0.3, 300.0], [-420.0, y, 340.0], 10.0, &format!("Chainstay {side}"));
+        s.tube([-140.0, y * 0.3, 800.0], [-420.0, y, 340.0], 9.0, &format!("Seatstay {side}"));
+        s.c("solid.box", json!({"length": 20, "width": 6, "height": 40, "corner": [-430.0, y - 3.0, 320], "body_name": format!("Dropout {side}")}));
+    }
+    s.c("solid.cylinder", json!({"radius": 24, "height": 80, "base": [0, -40, 300], "axis": "Y", "body_name": "BB shell"}));
+    s.c("solid.combine", json!({"target": "Down tube", "tools": ["Top tube", "Seat tube", "Head tube", "BB shell"]}));
+    s.component("Frame");
+    s.root();
+    let frame = ["Down tube", "Chainstay L", "Seatstay L", "Dropout L", "Chainstay R", "Seatstay R", "Dropout R"];
+    s.c("component.move_bodies", json!({"bodies": frame, "component": "Frame"}));
+    // Wheels: every spoke and nipple a body of its own.
+    s.wheel("Front", 640.0, n(36.0));
+    s.wheel("Rear", -420.0, n(36.0));
+    // Drivetrain: patterned chainring teeth, a cassette and a chain of separate links.
+    s.component("Drivetrain");
+    s.c("solid.cylinder", json!({"radius": 95, "height": 4, "base": [0, 50, 300], "axis": "Y", "body_name": "Chainring"}));
+    s.c("solid.box", json!({"length": 6, "width": 4, "height": 8, "corner": [-3, 50, 395], "name": "Tooth", "body_name": "Tooth"}));
+    s.c("solid.pattern.circular", json!({"bodies": ["Tooth"], "axis": {"origin": [0, 50, 300], "dir": [0, 1, 0]}, "count": 44}));
+    for g in 0..11 {
+        let r = 22.0 + 3.5 * g as f64;
+        s.c(
+            "solid.cylinder",
+            json!({"radius": r, "height": 2, "base": [-420.0, round3(30.0 + 2.6 * g as f64), 340.0], "axis": "Y", "body_name": format!("Cog {g}")}),
+        );
+    }
+    let links = n(112.0);
+    for k in 0..links {
+        let a = std::f64::consts::TAU * k as f64 / links as f64;
+        let (x, z) = (round3(-210.0 + 230.0 * a.cos()), round3(320.0 + 80.0 * a.sin()));
+        for (side, y) in [("in", 46), ("out", 56)] {
+            s.c("solid.box", json!({"length": 12, "width": 1, "height": 8, "corner": [round3(x - 6.0), y, round3(z - 4.0)], "body_name": format!("Link {k} {side}")}));
+        }
+        s.c("solid.cylinder", json!({"radius": 3.5, "height": 10, "base": [x, 46, z], "axis": "Y", "body_name": format!("Roller {k}")}));
+    }
+    for (side, y) in [("L", -90.0), ("R", 90.0)] {
+        let x0 = if side == "L" { -15.0 } else { 0.0 };
+        s.c("solid.box", json!({"length": 170, "width": 12, "height": 30, "corner": [x0, y - 6.0, 285], "body_name": format!("Crank {side}")}));
+        let py = if y > 0.0 { y + 8.0 } else { y - 68.0 };
+        s.c("solid.box", json!({"length": 90, "width": 60, "height": 15, "corner": [150.0, py, 280], "body_name": format!("Pedal {side}")}));
+    }
+    s.root();
+    // Cockpit and seat.
+    s.component("Cockpit");
+    s.tube([600.0, 0.0, 860.0], [620.0, 0.0, 940.0], 14.0, "Steerer");
+    s.tube([620.0, 0.0, 940.0], [700.0, 0.0, 950.0], 16.0, "Stem");
+    s.tube([700.0, -380.0, 950.0], [700.0, 380.0, 950.0], 11.0, "Handlebar");
+    s.c("solid.cylinder", json!({"radius": 16, "height": 120, "base": [700, 260, 950], "axis": "Y", "body_name": "Grip R"}));
+    s.c("solid.mirror", json!({"bodies": ["Grip R"], "plane": "XZ"}));
+    s.root();
+    s.component("Seat");
+    s.tube([-150.0, 0.0, 820.0], [-170.0, 0.0, 960.0], 13.0, "Seatpost");
+    s.c("solid.box", json!({"length": 260, "width": 140, "height": 40, "center": [-180, 0, 980], "body_name": "Saddle"}));
+    s.root();
+    // Fasteners: head, shank and washer, each its own body.
+    s.component("Hardware");
+    let bolts = n(240.0);
+    for k in 0..bolts {
+        let a = std::f64::consts::TAU * k as f64 / bolts as f64;
+        let p = [round3(-300.0 + 2.5 * k as f64), round3(120.0 + 10.0 * a.sin()), round3(400.0 + 10.0 * a.cos())];
+        s.c("solid.cylinder", json!({"radius": 5, "height": 4, "base": p, "axis": "Z", "body_name": format!("Bolt {k} head")}));
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 2.5, "height": 16, "base": [p[0], p[1], round3(p[2] - 16.0)], "axis": "Z", "body_name": format!("Bolt {k} shank")}),
+        );
+        s.c(
+            "solid.cylinder",
+            json!({"radius": 4.5, "height": 1, "base": [p[0], p[1], round3(p[2] - 1.0)], "axis": "Z", "body_name": format!("Bolt {k} washer")}),
+        );
+    }
+    s.root();
+    json!({"commands": s.commands})
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let flag = |name: &str| args.iter().position(|a| a == name).and_then(|i| args.get(i + 1));
+    let scale = match flag("--scale") {
+        Some(v) => v.parse::<f64>().ok().filter(|v| v.is_finite() && *v > 0.0 && *v <= 20.0).ok_or("--scale takes a number from 0 to 20")?,
+        None => 1.0,
+    };
+    let script = bicycle(scale);
+    if let Some(path) = flag("--script-out") {
+        let text = serde_json::to_string_pretty(&script).map_err(|e| e.to_string())?;
+        return solidcraft_engine::io::vfs::write(path, text.as_bytes()).map_err(|e| format!("{path}: {e}"));
+    }
+    let commands = script["commands"].as_array().cloned().unwrap_or_default();
+    let mut s = Session::default();
+    let began = std::time::Instant::now();
+    // Per command: the command itself, then what a window needs to draw its result (the
+    // bodies placed in the world and their display meshes).
+    let (mut run, mut shown): (Vec<f64>, Vec<f64>) = (Vec::new(), Vec::new());
+    for (i, c) in commands.iter().enumerate() {
+        let id = c["command"].as_str().unwrap_or_default();
+        let t = std::time::Instant::now();
+        s.execute(id, &c["params"]).map_err(|e| format!("command {i} ({id}): {e}"))?;
+        run.push(t.elapsed().as_secs_f64() * 1000.0);
+        let t = std::time::Instant::now();
+        s.world_state().warm_meshes(|| true);
+        shown.push(t.elapsed().as_secs_f64() * 1000.0);
+        if run.len() == 100 || i + 1 == commands.len() {
+            let mean = |v: &[f64]| v.iter().sum::<f64>() / v.len().max(1) as f64;
+            let bodies = s.model.state().bodies.len();
+            println!(
+                "{}",
+                json!({"step": "build", "commands": i + 1, "bodies": bodies, "command_ms": mean(&run), "display_ms": mean(&shown),
+                       "max_ms": run.iter().zip(&shown).map(|(a, b)| a + b).fold(0.0, f64::max)})
+            );
+            run.clear();
+            shown.clear();
+        }
+    }
+    let world = s.world_state();
+    println!(
+        "{}",
+        json!({"step": "built", "ms": began.elapsed().as_secs_f64() * 1000.0, "commands": commands.len(), "features": s.doc.features.len(), "bodies": world.bodies.len()})
+    );
+    let path = match flag("--save") {
+        Some(p) => p.clone(),
+        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+    };
+    s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
+    let r = crate::cmd_bench_open(std::slice::from_ref(&path));
+    if flag("--save").is_none() {
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_file(format!("{path}.bak"));
+    }
+    r
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The generated commands stay valid as the command set changes: a small bicycle builds
+    /// without a failing command or feature.
+    #[test]
+    fn a_small_bicycle_builds() {
+        let script = bicycle(0.03);
+        let mut s = Session::default();
+        for c in script["commands"].as_array().into_iter().flatten() {
+            let id = c["command"].as_str().unwrap_or_default();
+            if let Err(e) = s.execute(id, &c["params"]) {
+                panic!("{id}: {e}");
+            }
+        }
+        assert!(s.model.results.iter().all(|r| r.error.is_none()));
+        let world = s.world_state();
+        assert!(world.bodies.len() > 40, "{} bodies", world.bodies.len());
+        assert!(world.bodies.iter().any(|b| b.name.contains("spoke")));
+    }
+}

apps/solidcraft-cli/src/main.rs

@@ -1,49 +1,66 @@
 //! SolidCraft headless command line.
 //!
 //! ```text
-//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--allow-errors]
-//! solidcraft-cli eval <script.json|design.solidcraft|part.step> (alias: inspect) measurements as JSON
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] loading timings as JSON lines
-//! solidcraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|top|…]
+//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--json-out FILE] [--allow-errors]
+//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]] loading timings as JSON lines
+//! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
+//! solidcraft-cli snapshot <script|design> [--in design|part.step] --out shot.png [--width W] [--height H] [--view iso|front|top|…|NAME | --camera JSON] [--no-grid] [--no-axes]
 //! solidcraft-cli exec <command> [json-params]                 run one command on an empty design
 //! solidcraft-cli commands                                     the command registry as JSON
 //! solidcraft-cli recipe <recipe.json>                         translate an oracle recipe to a script
 //! solidcraft-cli oracle <case-dir>...                         replay recipes and compare with expected.json
-//! solidcraft-cli mcp [--in design|script] [--connect HOST:PORT] MCP server on stdio (docs/mcp.md)
+//! solidcraft-cli mcp [--in design|script] [--connect HOST:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
+//!                                                             MCP server on stdio (docs/mcp.md)
 //! solidcraft-cli licences                                     SolidCraft's licence and the third-party licences
 //! solidcraft-cli icon --out F.png|F.ico [--size N]             the app icon (packaging; drawn, not a file)
 //! ```
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+mod bench_agent;
 mod crashes;
 mod fuzz;
 mod oracle;
 mod recipe;
+mod render;
 mod spatial;
 
 use std::process::ExitCode;
 
 use serde_json::{Value, json};
-#[path = "../../app_icon.rs"]
+#[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
 mod app_icon;
 
 use solidcraft_engine::Session;
-use solidcraft_engine::render::{StandardView, render_png};
+use solidcraft_engine::render::render_png;
+use solidcraft_engine::view::Guides;
 
 const USAGE: &str = "usage:
-  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--allow-errors]
+  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--json-out FILE] [--allow-errors]
   solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...
       (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)
-  solidcraft-cli eval <script.json|design.solidcraft|part.step>     (alias: inspect; or --in FILE)
-  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]
-  solidcraft-cli snapshot <script|design> --out shot.png [--width W] [--height H] [--view iso|front|back|top|bottom|left|right]
+  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)
+      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,
+       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)
+  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]
+      (the design's history as a command script that eval and run replay)
+  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--display LEVEL [--edit NAME EXPR]]
+  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]
+  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]
+  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...
+      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;
+       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;
+       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);
+       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture)
+  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]
   solidcraft-cli exec <command> [json-params]
   solidcraft-cli commands
   solidcraft-cli recipe <recipe.json>
   solidcraft-cli oracle <case-dir>... [--json]
   solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]
-  solidcraft-cli mcp [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT]
+  solidcraft-cli mcp [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]
   solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]
   solidcraft-cli licences
   solidcraft-cli icon --out icon.png [--size 256] | --out icon.ico
@@ -54,7 +71,9 @@ fn main() -> ExitCode {
     let r = match args.first().map(String::as_str) {
         Some("run") => cmd_run(&args[1..]),
         Some("eval" | "inspect") => cmd_eval(&args[1..]),
+        Some("script") => cmd_script(&args[1..]),
         Some("snapshot") => cmd_snapshot(&args[1..]),
+        Some("render") => render::run(&args[1..]),
         Some("exec") => cmd_exec(&args[1..]),
         Some("commands") => {
             use std::io::Write as _;
@@ -90,6 +109,8 @@ fn main() -> ExitCode {
         // Hidden: time recomputes after parameter edits (docs/perf.md).
         Some("bench-edit") => cmd_bench_edit(&args[1..]),
         Some("bench-open") => cmd_bench_open(&args[1..]),
+        // A ~1,300-body design built command by command, as an agent builds one over MCP.
+        Some("bench-agent") => bench_agent::run(&args[1..]),
         Some("--version" | "-V") => {
             println!("solidcraft-cli {}", env!("CARGO_PKG_VERSION"));
             Ok(())
@@ -155,7 +176,7 @@ fn positional(args: &[String]) -> Option<&String> {
     let mut i = 0;
     while let Some(a) = args.get(i) {
         if a.starts_with("--") {
-            i += if matches!(a.as_str(), "--quiet" | "--results" | "--allow-errors") { 1 } else { 2 };
+            i += if matches!(a.as_str(), "--quiet" | "--results" | "--allow-errors" | "--no-grid" | "--no-axes") { 1 } else { 2 };
             continue;
         }
         return Some(a);
@@ -163,32 +184,52 @@ fn positional(args: &[String]) -> Option<&String> {
     None
 }
 
+/// `--json-out FILE`: where the JSON a command prints goes instead of stdout.
+fn json_out(args: &[String]) -> Result<Option<&str>, String> {
+    if !args.iter().any(|a| a == "--json-out") {
+        return Ok(None);
+    }
+    match flag(args, "--json-out") {
+        Some(file) if !file.starts_with("--") => Ok(Some(file)),
+        _ => Err("--json-out needs a FILE".to_string()),
+    }
+}
+
+/// `v` as indented JSON with a final newline: on stdout, or in `file`. The file is plain UTF-8
+/// with no byte-order mark, whatever the platform's shell does to redirected output (Windows
+/// PowerShell's `>` writes UTF-16, or UTF-8 with a BOM), so strict JSON readers take it.
+fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
+    match file {
+        Some(file) => {
+            let mut text = pretty(v);
+            text.push('\n');
+            std::fs::write(file, text).map_err(|e| format!("{file}: {e}"))
+        }
+        None => {
+            println!("{}", pretty(v));
+            Ok(())
+        }
+    }
+}
+
 fn cmd_run(args: &[String]) -> Result<(), String> {
+    let json_out = json_out(args)?;
     let base = flag(args, "--in");
     let path = positional(args);
     if path.is_none() && base.is_none() {
         return Err(USAGE.to_string());
     }
-    // `--in` starts from a design or STEP file; the positional script then runs on top of it.
-    let mut s = match base {
-        Some(b) => load(b)?,
-        None => Session::default(),
-    };
-    let results = if args.iter().any(|a| a == "--results") {
+    let (mut s, results) = if args.iter().any(|a| a == "--results") {
         // Collect every command's result (scripts only), then process requested files too.
+        let mut s = match base {
+            Some(b) => load(b)?,
+            None => Session::default(),
+        };
         let v = read_json(path.ok_or("--results needs a script")?)?;
         let r = s.run_script(&v).map_err(|e| e.to_string())?;
-        Some(Value::Array(r))
+        (s, Some(Value::Array(r)))
     } else {
-        match (base, path) {
-            (Some(_), Some(p)) => {
-                let v = read_json(p)?;
-                s.run_script(&v).map_err(|e| e.to_string())?;
-            }
-            (None, Some(p)) => s = load(p)?,
-            _ => {}
-        }
-        None
+        (open(base, path)?, None)
     };
     // A feature that fails leaves the bodies as they were before it (a parameter change can
     // break a feature without failing the command that made it): writing them would hand out
@@ -203,10 +244,45 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
         s.execute("file.save_as", &json!({"path": p})).map_err(|e| e.to_string())?;
     }
     if let Some(results) = results {
-        println!("{}", pretty(&results));
-    } else if !args.iter().any(|a| a == "--quiet") {
+        print_json(&results, json_out)?;
+    } else if json_out.is_some() || !args.iter().any(|a| a == "--quiet") {
+        // `--quiet` silences stdout; a file that was asked for is still written.
         let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
-        println!("{}", pretty(&m));
+        print_json(&m, json_out)?;
+    }
+    Ok(())
+}
+
+/// The session `run` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// positional script run on top of it, or either one alone.
+fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
+    match (base, path) {
+        (Some(b), Some(p)) => {
+            let mut s = load(b)?;
+            s.run_script(&read_json(p)?).map_err(|e| e.to_string())?;
+            Ok(s)
+        }
+        (Some(b), None) => load(b),
+        (None, Some(p)) => load(p),
+        (None, None) => Err(USAGE.to_string()),
+    }
+}
+
+/// Refuses an option `cmd` doesn't take, and one missing its value: a typo, or another
+/// command's option, would otherwise be ignored without a word.
+fn known_flags(cmd: &str, args: &[String], valued: &[&str], switches: &[&str]) -> Result<(), String> {
+    let mut i = 0;
+    while let Some(a) = args.get(i) {
+        if valued.contains(&a.as_str()) {
+            match args.get(i + 1) {
+                Some(v) if !v.starts_with("--") => i += 2,
+                _ => return Err(format!("{cmd}: {a} needs a value")),
+            }
+        } else if a.starts_with("--") && !switches.contains(&a.as_str()) {
+            return Err(format!("{cmd} doesn't take {a} (it takes {})", [valued, switches].concat().join(", ")));
+        } else {
+            i += 1;
+        }
     }
     Ok(())
 }
@@ -225,6 +301,7 @@ fn timeline_ok(s: &Session) -> Result<(), String> {
 }
 
 fn cmd_eval(args: &[String]) -> Result<(), String> {
+    let json_out = json_out(args)?;
     let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(|| USAGE.to_string())?;
     let mut s = load(path)?;
     let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
@@ -237,21 +314,56 @@ fn cmd_eval(args: &[String]) -> Result<(), String> {
         "params": d["params"],
         "sketches": d["sketches"],
     });
-    println!("{}", pretty(&out));
+    print_json(&out, json_out)
+}
+
+/// A design's history as a command script (`timeline.export_script`): printed, or written to
+/// `--out`; what the script leaves out goes to stderr.
+fn cmd_script(args: &[String]) -> Result<(), String> {
+    let path = positional(args).ok_or_else(|| USAGE.to_string())?;
+    let s = &mut load(path)?;
+    let out = flag(args, "--out");
+    let r = s.execute("timeline.export_script", &json!({"path": out})).map_err(|e| e.to_string())?;
+    for what in r["omitted"].as_array().into_iter().flatten().filter_map(Value::as_str) {
+        eprintln!("note: the script leaves out {what}");
+    }
+    match out {
+        Some(out) => eprintln!("{out}: {} steps", r["steps"]),
+        None => println!("{}", pretty(&r["script"])),
+    }
     Ok(())
 }
 
 fn cmd_snapshot(args: &[String]) -> Result<(), String> {
-    let path = args.first().ok_or_else(|| USAGE.to_string())?;
-    let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
-    let w = flag(args, "--width").and_then(|x| x.parse().ok()).unwrap_or(1280usize);
-    let h = flag(args, "--height").and_then(|x| x.parse().ok()).unwrap_or(800usize);
-    let s = load(path)?;
-    let mut cam = solidcraft_engine::view::home_camera(&s);
-    if let Some(v) = flag(args, "--view") {
-        cam.set_view(StandardView::parse(v).ok_or_else(|| format!("unknown view `{v}`"))?);
+    known_flags("snapshot", args, &["--in", "--out", "--width", "--height", "--view", "--camera"], &["--no-grid", "--no-axes"])?;
+    if positional(args).is_none() && flag(args, "--in").is_none() {
+        return Err(USAGE.to_string());
     }
-    let scene = solidcraft_engine::view::scene(&s, &cam);
+    let out = flag(args, "--out").ok_or("snapshot needs --out FILE.png")?;
+    let size = |name: &str, default: usize| match flag(args, name) {
+        None => Ok(default),
+        Some(x) => x.parse().ok().filter(|n| (16..=8192).contains(n)).ok_or_else(|| format!("{name} must be 16 to 8192 pixels, not `{x}`")),
+    };
+    let (w, h) = (size("--width", 1280)?, size("--height", 800)?);
+    let mut s = open(flag(args, "--in"), positional(args))?;
+    // The camera choices of the MCP `screenshot`, through the same command (`view.apply`): a
+    // standard view, a view saved in the design, or an explicit camera. A script that applies a
+    // view itself sets the camera too; without any, the iso view framing the model.
+    match (flag(args, "--view"), flag(args, "--camera")) {
+        (Some(_), Some(_)) => return Err("snapshot: give --view or --camera, not both".into()),
+        (Some(v), None) => {
+            let hint = "standard views: iso, front, back, top, bottom, left, right";
+            s.execute("view.apply", &json!({"view": v})).map_err(|e| format!("--view {v}: {e} ({hint}; or a view saved with view.save)"))?;
+        }
+        (None, Some(c)) => {
+            let camera: Value = serde_json::from_str(c).map_err(|e| format!("--camera: not JSON: {e}"))?;
+            s.execute("view.apply", &json!({"camera": camera})).map_err(|e| format!("--camera: {e}"))?;
+        }
+        (None, None) => {}
+    }
+    let cam = s.camera.unwrap_or_else(|| solidcraft_engine::view::home_camera(&s));
+    let guides = Guides { grid: !args.iter().any(|a| a == "--no-grid"), axes: !args.iter().any(|a| a == "--no-axes") };
+    let scene = solidcraft_engine::view::scene_with_guides(&s, &cam, s.section, guides);
     let png = render_png(&scene, &cam, w, h).ok_or("render failed")?;
     std::fs::write(out, &png).map_err(|e| format!("{out}: {e}"))?;
     println!("{}", pretty(&json!({"path": out, "width": w, "height": h, "bytes": png.len()})));
@@ -312,23 +424,46 @@ fn cmd_exec(args: &[String]) -> Result<(), String> {
 }
 
 /// MCP server on stdio: headless (optionally starting from a design or script) or bridged to
-/// a running app's control port. stdout carries only protocol messages.
+/// a running app's control port. stdout carries only protocol messages. Files the agent's tool
+/// calls reach are confined to `solidcraft_mcp::agent_scope` unless `--allow-any-path` is given.
 fn cmd_mcp(args: &[String]) -> Result<(), String> {
+    let scope = (!args.iter().any(|a| a == "--allow-any-path"))
+        .then(|| solidcraft_mcp::agent_scope(flags(args, "--allow-path").into_iter().map(std::path::PathBuf::from)));
+    if let Some(s) = &scope {
+        let roots: Vec<String> = s.roots().iter().map(|r| r.display().to_string()).collect();
+        eprintln!(
+            "solidcraft mcp: files limited to {} and the open design's folder (--allow-path DIR adds one, --allow-any-path lifts the limit)",
+            roots.join(", ")
+        );
+        let design_dir = flag(args, "--in")
+            .and_then(|p| std::path::Path::new(p).parent())
+            .map(|d| if d.as_os_str().is_empty() { std::path::Path::new(".") } else { d });
+        if let Some(why) = design_dir.and_then(solidcraft_engine::io::vfs::design_folder_refusal) {
+            eprintln!("solidcraft mcp: the design's folder is left out because {why}; add it with --allow-path if you mean it");
+        }
+    }
     let backend: Box<dyn solidcraft_mcp::Backend> = match (flag(args, "--connect"), flag(args, "--in")) {
         (Some(_), Some(_)) => return Err("mcp: use either --connect or --in, not both".into()),
-        (Some(addr), None) => Box::new(solidcraft_mcp::Remote::connect(addr).map_err(|e| {
-            let port = addr.rsplit(':').next().filter(|p| p.parse::<u16>().is_ok()).unwrap_or("PORT");
-            format!(
-                "cannot connect to {addr}: {e}\nno SolidCraft app is listening there; start it with \
-                 `solidcraft --control {port}` (or SOLIDCRAFT_CONTROL_PORT={port}) and retry"
-            )
-        })?),
+        (Some(addr), None) => {
+            let Some(port) = addr.rsplit_once(':').and_then(|(_, p)| p.parse::<u16>().ok()).filter(|p| *p != 0) else {
+                return Err(format!("mcp: --connect wants HOST:PORT, such as 127.0.0.1:7878, not `{addr}`"));
+            };
+            // Serve without the app too: the tools connect once it runs, and say it isn't until then.
+            let mut remote = solidcraft_mcp::Remote::new(addr, flag(args, "--token"));
+            if let Err(e) = remote.try_connect() {
+                eprintln!(
+                    "solidcraft mcp: no SolidCraft app at {addr} yet ({e}); start it with `solidcraft --control {port}` \
+                     (or SOLIDCRAFT_CONTROL_PORT={port}), tool calls connect once it runs"
+                );
+            }
+            Box::new(remote)
+        }
         (None, Some(path)) => Box::new(solidcraft_mcp::Headless::new(load(path)?)),
         (None, None) => Box::new(solidcraft_mcp::Headless::default()),
     };
     let stdin = std::io::stdin();
     let stdout = std::io::stdout();
-    solidcraft_mcp::Server::new(backend).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
+    solidcraft_mcp::Server::new(backend).with_path_scope(scope).serve(stdin.lock(), stdout.lock()).map_err(|e| e.to_string())
 }
 
 /// `save-stress <path> <rounds>`: save a design of a few hundred kilobytes `rounds` times, its
@@ -384,7 +519,7 @@ fn cmd_bench_edit(args: &[String]) -> Result<(), String> {
 }
 
 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
-fn cmd_bench_open(args: &[String]) -> Result<(), String> {
+pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
     let t = std::time::Instant::now();
     let step = solidcraft_engine::io::is_step_path(path);
@@ -393,10 +528,13 @@ fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     let read_ms = t.elapsed().as_secs_f64() * 1000.0;
     println!("{}", json!({"step": "read", "ms": read_ms, "bytes": bytes.len()}));
     let t = std::time::Instant::now();
+    // The file as read, held until the timeline has evaluated it (as the import command does).
+    let mut read = None;
     let doc = if step {
         let imported = solidcraft_engine::io::step_import_feature(&bytes, path).map_err(|e| e.to_string())?;
         let mut doc = solidcraft_engine::doc::Document::new(&imported.name);
         doc.add_feature(imported.kind, Some(&imported.name)).map_err(|e| e.to_string())?;
+        read = Some(imported.import);
         doc
     } else {
         solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?
@@ -408,13 +546,48 @@ fn cmd_bench_open(args: &[String]) -> Result<(), String> {
     }
     let t = std::time::Instant::now();
     let s = Session::new(doc);
+    drop(read);
     println!("{}", json!({"step": "evaluate", "ms": t.elapsed().as_secs_f64() * 1000.0}));
     for r in &s.model.results {
         println!("{}", json!({"step": "feature", "id": r.id, "name": r.name, "ms": r.ms, "error": r.error}));
     }
     let t = std::time::Instant::now();
     let st = s.world_state();
+    // As the desktop app prepares a design it opened.
+    st.warm_meshes(|| true);
     let triangles: usize = st.bodies.iter().map(|b| b.mesh().triangles.len()).sum();
     println!("{}", json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "bodies": st.bodies.len(), "triangles": triangles}));
+    // `--display LEVEL`: the display plans the viewport draws at that display quality, made as
+    // the GPU viewport makes them; `--edit NAME EXPR` then changes a parameter and times the
+    // evaluation and the plans of the bodies it changed.
+    let flag = |name: &str| args.iter().position(|a| a == name);
+    let Some(level) = flag("--display").and_then(|i| args.get(i + 1)) else { return Ok(()) };
+    let q = solidcraft_engine::doc::display_quality::DisplayQuality::parse(level).ok_or("--display: coarse, normal, fine or ultra")?;
+    let plans = |st: &solidcraft_engine::doc::ModelState| {
+        let t = std::time::Instant::now();
+        solidcraft_engine::kernel::for_each_on_threads(&st.bodies, 16, |b| {
+            let _ = b.plan_mesh_at(q);
+        });
+        let triangles: usize = st.bodies.iter().filter_map(|b| b.plan_mesh_at(q)).map(|m| m.triangles.len()).sum();
+        (t.elapsed().as_secs_f64() * 1000.0, triangles)
+    };
+    let (ms, triangles) = plans(&st);
+    println!("{}", json!({"step": "display", "quality": q.id(), "ms": ms, "triangles": triangles}));
+    if let Some(i) = flag("--edit") {
+        let (Some(name), Some(expr)) = (args.get(i + 1), args.get(i + 2)) else { return Err("--edit NAME EXPR".into()) };
+        let mut s = s;
+        let t = std::time::Instant::now();
+        s.execute("parameters.change", &json!({"name": name, "expression": expr})).map_err(|e| e.to_string())?;
+        let eval_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let st = s.world_state();
+        let t = std::time::Instant::now();
+        st.warm_meshes(|| true);
+        let mesh_ms = t.elapsed().as_secs_f64() * 1000.0;
+        let (ms, triangles) = plans(&st);
+        println!(
+            "{}",
+            json!({"step": "edit", "quality": q.id(), "evaluate_ms": eval_ms, "mesh_ms": mesh_ms, "display_ms": ms, "triangles": triangles})
+        );
+    }
     Ok(())
 }

apps/solidcraft-cli/src/recipe.rs

@@ -92,7 +92,7 @@ fn extent(f: &Value, p: &mut Value) {
         "symmetric" => {
             let full = e.get("is_full_length").and_then(Value::as_bool).unwrap_or(false);
             p["direction"] = json!("symmetric");
-            p["distance"] = if full { json!(format!("({}) / 2", expr_text(&dist))) } else { dist };
+            p["distance"] = if full { dist } else { json!(format!("({}) * 2", expr_text(&dist))) };
         }
         "two_sides" => {
             p["distance"] = e.get("side1").cloned().unwrap_or(Value::Null);
@@ -296,6 +296,17 @@ pub fn to_script(recipe: &Value) -> Result<Value, String> {
             Some("sketch") => sketch_cmds(f, &mut out)?,
             Some("extrude") => {
                 let mut p = json!({"sketch": profile_sketch(f), "profiles": profiles_of(f), "operation": op(f), "name": name, "body_names": bodies});
+                // Thin: {sketch, curves, thickness, side?, thickness2?} instead of profiles.
+                if let (Some(thin), Some(params)) = (f.get("thin"), p.as_object_mut()) {
+                    params.remove("profiles");
+                    params.insert("thin".into(), json!(true));
+                    params.insert("sketch".into(), thin.get("sketch").cloned().unwrap_or(Value::Null));
+                    for key in ["curves", "thickness", "side", "thickness2"] {
+                        if let Some(v) = thin.get(key) {
+                            params.insert(key.into(), v.clone());
+                        }
+                    }
+                }
                 extent(f, &mut p);
                 out.push(json!({"command": "solid.extrude", "params": p}));
             }

apps/solidcraft-cli/src/render.rs

@@ -0,0 +1,79 @@
+//! Complete headless image-job workflow through the same engine commands as the UI/MCP.
+use serde_json::json;
+use solidcraft_engine::{
+    doc::render_settings::RenderSetup,
+    render::job::{CpuHost, JobId, Phase},
+};
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let input = args.first().filter(|p| !p.starts_with('-')).ok_or("render requires an input design or script")?;
+    let mut out = None;
+    let mut setup = None;
+    let mut width = None;
+    let mut height = None;
+    let mut transparent = false;
+    let mut overwrite = false;
+    let mut timeout = 120u64;
+    let mut i = 1;
+    while let Some(arg) = args.get(i) {
+        match arg.as_str() {
+            "--transparent" => transparent = true,
+            "--overwrite" => overwrite = true,
+            "--out" | "--setup" | "--width" | "--height" | "--timeout" => {
+                i += 1;
+                let value = args.get(i).ok_or_else(|| format!("missing value for {arg}"))?;
+                match arg.as_str() {
+                    "--out" => out = Some(value.clone()),
+                    "--setup" => setup = Some(value.clone()),
+                    "--width" => width = Some(value.parse::<u32>().map_err(|_| "invalid width")?),
+                    "--height" => height = Some(value.parse::<u32>().map_err(|_| "invalid height")?),
+                    _ => timeout = value.parse::<u64>().map_err(|_| "invalid timeout")?,
+                }
+            }
+            _ => return Err(format!("unknown render option: {arg}")),
+        }
+        i += 1;
+    }
+    if !(1..=3600).contains(&timeout) {
+        return Err("render timeout must be 1..3600 seconds".into());
+    }
+    let out = out.ok_or("render requires --out FILE.png")?;
+    let mut session = crate::load(input)?;
+    session.set_render_job_host(Some(CpuHost::for_platform().map_err(|e| e.to_string())?)).map_err(|e| e.to_string())?;
+    session.execute("render.scene", &json!({})).map_err(|e| e.to_string())?;
+    let mut settings = if let Some(name) = setup {
+        session.doc.render.setups.get(&name).cloned().ok_or("no saved render setup with that name")?
+    } else {
+        let mut settings = RenderSetup::default();
+        if let Some(camera) = session.camera {
+            settings.camera = camera;
+        } else {
+            settings.camera.fit(&solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?.bounds);
+        }
+        settings
+    };
+    if let Some(width) = width {
+        settings.width = width;
+    }
+    if let Some(height) = height {
+        settings.height = height;
+    }
+    let params = json!({"settings":settings,"transparent_background":transparent});
+    let preflight = session.execute("render.preflight", &params).map_err(|e| e.to_string())?;
+    let started = session.execute("render.start", &params).map_err(|e| e.to_string())?;
+    let id: JobId = serde_json::from_value(started["job"].clone()).map_err(|e| e.to_string())?;
+    let handle = session.render_job_handle(id).map_err(|e| e.to_string())?;
+    let status = match handle.wait_timeout(std::time::Duration::from_secs(timeout)) {
+        Ok(status) => status,
+        Err(e) => {
+            let _ = session.execute("render.cancel", &json!({"job":id}));
+            return Err(e.to_string());
+        }
+    };
+    if status.progress.phase != Phase::Completed {
+        return Err(status.error.map_or_else(|| "render cancelled".into(), |e| e.to_string()));
+    }
+    let exported = session.execute("render.export", &json!({"job":id,"path":out,"overwrite":overwrite})).map_err(|e| e.to_string())?;
+    println!("{}", crate::pretty(&json!({"preflight":preflight,"export":exported})));
+    Ok(())
+}

apps/solidcraft-cli/tests/action_matrix.rs

@@ -13,8 +13,10 @@
 //! fails the test (a regression). Newly passing actions are reported; record them with
 //! `cargo xtask action-matrix --bless` (or `ACTION_MATRIX_BLESS=1` on [`action_matrix_all`]).
 //! Every CI run checks a fixed sample ([`action_matrix_sample`], under a minute); the full matrix
-//! is four ignored tests (`action_matrix_full_N`) that the nightly "Action matrix" job runs side by
-//! side. See docs/action-matrix.md.
+//! is the ignored [`action_matrix_shard`], which the nightly "Action matrix" jobs run one shard
+//! each (`ACTION_MATRIX_SHARD=k/n`), cut by what each design costs (`tests/action_matrix/costs.json`).
+//! [`action_matrix_determinism`] runs a sample twice and lists any action whose outcome changed.
+//! See docs/action-matrix.md.
 //!
 //! Each design runs in a child process (this test binary, [`action_matrix_worker`]) so an action
 //! that hangs or aborts is recorded as such and the rest of the design still runs.
@@ -33,6 +35,10 @@ use solidcraft_engine::geom::Vec3;
 
 /// One in this many actions runs on pull requests (by a stable hash of its key).
 const PR_SAMPLE: u64 = 40;
+/// One in this many actions runs twice in the nightly determinism check, on the designs whose
+/// whole matrix takes at most [`DETERMINISM_MAX_SECS`] on a runner (most of the corpus).
+const DETERMINISM_SAMPLE: u64 = 8;
+const DETERMINISM_MAX_SECS: f64 = 300.0;
 /// Designs that take seconds to build: the full matrix only.
 const SLOW: [&str; 7] = [
     "oracle/41-tube-radial-holes",
@@ -623,23 +629,41 @@ fn action_matrix_worker() {
         out.flush().unwrap();
     };
     let Some((_, path)) = designs().into_iter().find(|(n, _)| *n == design) else { panic!("no design {design}") };
+    // A slice of a heavy design (`j/n`): the actions whose name hashes to `j` modulo `n` (by
+    // index, slices would take whole kinds of action when n shares a factor with the number of
+    // actions per entity, and a slice of only fillets runs three times as long); the first
+    // slice records the load.
+    let slice: Option<(usize, usize)> = std::env::var("ACTION_MATRIX_SLICE").ok().and_then(|v| parse_part(&v));
+    let first = slice.is_none_or(|(j, _)| j == 0);
     let t0 = Instant::now();
     let s = match load(&path) {
         Ok(s) => s,
         Err(e) => {
-            emit(outcome(&design, "design", "load", &Err(("load".into(), e)), t0.elapsed().as_millis()));
+            if first {
+                emit(outcome(&design, "design", "load", &Err(("load".into(), e)), t0.elapsed().as_millis()));
+            }
             emit(json!({"done": true}));
             return;
         }
     };
     let before = errors(&s);
-    if from == 0 {
+    if from == 0 && first {
         let r = if before.is_empty() { Ok(()) } else { Err(("timeline_error".into(), before.values().cloned().collect::<Vec<_>>().join("; "))) };
         emit(outcome(&design, "design", "load", &r, t0.elapsed().as_millis()));
     }
     let list = actions(&s);
     let edit = driving_parameter(&s);
+    // Local runs only: `ACTION_MATRIX_ACTIONS=edge.fillet,edge.chamfer` tries just those actions
+    // (don't bless such a run), `ACTION_MATRIX_VALIDITY=1` adds each passing action's body check.
+    let only: Option<Vec<String>> = std::env::var("ACTION_MATRIX_ACTIONS").ok().map(|v| v.split(',').map(str::to_string).collect());
+    let validity = std::env::var_os("ACTION_MATRIX_VALIDITY").is_some();
     for (i, a) in list.iter().enumerate().skip(from) {
+        if only.as_ref().is_some_and(|o| !o.iter().any(|x| x == a.action)) {
+            continue;
+        }
+        if slice.is_some_and(|(j, n)| stable_hash(&format!("{} {}", a.entity, a.action)) % n as u64 != j as u64) {
+            continue;
+        }
         // Whole families of pieces are sampled together (see [`family`]).
         let k = key(&design, &family(&a.entity), a.action);
         if !stable_hash(&k).is_multiple_of(sample) {
@@ -650,17 +674,44 @@ fn action_matrix_worker() {
         let mut scratch = s.scratch();
         let r = perform(&mut scratch, &a.act, &before);
         let mut line = outcome(&design, &a.entity, a.action, &r, t.elapsed().as_millis());
+        if validity && r.is_ok() {
+            let st = scratch.model.state();
+            let bad: Vec<String> = st.bodies.iter().flat_map(|b| b.body.validity().into_iter().map(|v| format!("{}: {v}", b.name))).collect();
+            line["validity"] = json!(bad);
+        }
         // What was sent, for reproducing a failure (kept in the results, not the baseline).
         line["command"] = match &a.act {
             Act::Run(id, p) => json!({"command": id, "params": p}),
             Act::Project { plane, edge } => json!({"command": "sketch.project", "params": {"refs": [edge]}, "sketch_plane": plane}),
         };
         emit(line);
+        // With ACTION_MATRIX_UNFOLD, sheet metal must still unfold and fold back after the action.
+        if r.is_ok() && std::env::var_os("ACTION_MATRIX_UNFOLD").is_some() {
+            let t = Instant::now();
+            let sheets: Vec<String> = scratch.model.state().sheets.iter().map(|sh| sh.body.clone()).collect();
+            let mut r = Ok(());
+            for body in &sheets {
+                for id in ["sheet.unfold", "sheet.refold"] {
+                    if r.is_ok() {
+                        r = scratch
+                            .execute(id, &json!({"body": body}))
+                            .map(|_| ())
+                            .map_err(|e| (command_kind(&e).to_string(), format!("{body}: {e}")));
+                    }
+                }
+            }
+            if !sheets.is_empty() {
+                let unfold: &'static str = Box::leak(format!("{}+unfold", a.action).into_boxed_str());
+                emit(outcome(&design, &a.entity, unfold, &r, t.elapsed().as_millis()));
+            }
+        }
         // The edit round: a driving parameter changes; the new feature still resolves.
         if r.is_ok()
             && let Some((name, expr)) = &edit
             && stable_hash(&format!("{k} edit")).is_multiple_of(EDIT_SAMPLE)
         {
+            // Marked like an action, so a hang here is put down to the edit round (not to loading).
+            emit(json!({"start": i, "edit": true}));
             let t = Instant::now();
             let start = s.doc.features.len();
             let r = scratch
@@ -674,46 +725,155 @@ fn action_matrix_worker() {
     emit(json!({"done": true, "actions": list.len()}));
 }
 
-/// Run the actions (one in `sample`) of every design in part `part` of `parts`, in child
-/// processes, `jobs` at a time.
-fn run_matrix(sample: u64, part: usize, parts: usize) -> Vec<Value> {
+/// `"k/n"` (1-based `k`) as `(k - 1, n)`.
+fn parse_part(v: &str) -> Option<(usize, usize)> {
+    let (k, n) = v.split_once('/')?;
+    let (k, n): (usize, usize) = (k.trim().parse().ok()?, n.trim().parse().ok()?);
+    (k >= 1 && k <= n).then_some((k - 1, n))
+}
+
+/// What one design costs on a CI runner (`tests/action_matrix/costs.json`, measured by the
+/// nightly shards): the whole run and the load before its first action, in seconds.
+#[derive(Clone, Copy, Debug)]
+struct Cost {
+    secs: f64,
+    load: f64,
+}
+
+fn costs_path() -> PathBuf {
+    root().join("tests/action_matrix/costs.json")
+}
+
+fn read_costs() -> BTreeMap<String, Cost> {
+    let Some(v) = std::fs::read(costs_path()).ok().and_then(|b| serde_json::from_slice::<Value>(&b).ok()) else { return BTreeMap::new() };
+    v["designs"]
+        .as_object()
+        .into_iter()
+        .flatten()
+        .map(|(d, c)| (d.clone(), Cost { secs: c["secs"].as_f64().unwrap_or(0.0), load: c["load"].as_f64().unwrap_or(0.0) }))
+        .collect()
+}
+
+/// A design new to the corpus (not in costs.json yet) is planned as this.
+const UNKNOWN_COST: Cost = Cost { secs: 120.0, load: 5.0 };
+/// A design that takes longer than this on a runner is split into slices of about this much, or
+/// five loads if that is more (each slice loads the design again), so no shard waits on one design.
+const SLICE_SECS: f64 = 600.0;
+/// Designs that take longer than this to load on a runner stay out of the pull request sample.
+const SAMPLE_MAX_LOAD_SECS: f64 = 8.0;
+
+/// A piece of work: one design, or a slice `(j, n)` of a heavy one, and what it should cost.
+#[derive(Clone, Debug)]
+struct Unit {
+    design: String,
+    slice: Option<(usize, usize)>,
+    cost: f64,
+}
+
+impl Unit {
+    fn name(&self) -> String {
+        match self.slice {
+            Some((j, n)) => format!("{} [{}/{n}]", self.design, j + 1),
+            None => self.design.clone(),
+        }
+    }
+}
+
+/// The whole matrix split into `parts` shards of about equal cost: heavy designs in slices, then
+/// the largest pieces first, each to the shard with the least so far. The same corpus and
+/// costs.json always give the same shards.
+fn plan(designs: &[String], costs: &BTreeMap<String, Cost>, parts: usize) -> Vec<Vec<Unit>> {
+    let mut units = Vec::new();
+    for d in designs {
+        let c = costs.get(d).copied().unwrap_or(UNKNOWN_COST);
+        let n = ((c.secs / SLICE_SECS.max(5.0 * c.load)).ceil() as usize).max(1);
+        if n == 1 {
+            units.push(Unit { design: d.clone(), slice: None, cost: c.secs });
+        } else {
+            let each = c.load + (c.secs - c.load).max(0.0) / n as f64;
+            units.extend((0..n).map(|j| Unit { design: d.clone(), slice: Some((j, n)), cost: each }));
+        }
+    }
+    units.sort_by(|a, b| b.cost.total_cmp(&a.cost).then_with(|| a.name().cmp(&b.name())));
+    let mut shards: Vec<(f64, Vec<Unit>)> = vec![(0.0, Vec::new()); parts];
+    for u in units {
+        let i = (0..parts).min_by(|&a, &b| shards[a].0.total_cmp(&shards[b].0)).unwrap_or(0);
+        shards[i].0 += u.cost;
+        shards[i].1.push(u);
+    }
+    shards.into_iter().map(|(_, v)| v).collect()
+}
+
+/// Every design's name, with `ACTION_MATRIX_FILTER` applied.
+fn design_names() -> Vec<String> {
     let designs = designs();
     assert!(designs.len() > 80, "only {} designs", designs.len());
-    let dir = std::env::temp_dir().join(format!("action-matrix-{}-{part}", std::process::id()));
+    let filter = std::env::var("ACTION_MATRIX_FILTER").ok();
+    designs.into_iter().map(|(n, _)| n).filter(|n| filter.as_deref().is_none_or(|f| n.contains(f))).collect()
+}
+
+/// Run the actions (one in `sample`) of these units in child processes, `jobs` at a time.
+///
+/// `ACTION_MATRIX_WORKDIR` keeps each design's raw outcomes there (one JSON line each, written as
+/// they come, so a run cut short still shows what it did) and `ACTION_MATRIX_TIMINGS` appends
+/// each unit's time to that file (JSON lines).
+fn run_units(sample: u64, queue: &[Unit]) -> Vec<Value> {
+    let keep = std::env::var_os("ACTION_MATRIX_WORKDIR").map(PathBuf::from);
+    static RUN: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let run = RUN.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let dir = keep.clone().unwrap_or_else(|| std::env::temp_dir().join(format!("action-matrix-{}-{run}", std::process::id())));
     std::fs::create_dir_all(&dir).unwrap();
+    let timings = std::env::var_os("ACTION_MATRIX_TIMINGS").map(PathBuf::from);
     let jobs: usize = std::env::var("ACTION_MATRIX_JOBS")
         .ok()
         .and_then(|v| v.parse().ok())
         .unwrap_or_else(|| std::thread::available_parallelism().map_or(2, |n| n.get()))
         .max(1);
-    let filter = std::env::var("ACTION_MATRIX_FILTER").ok();
-    let queue: Vec<(String, PathBuf)> = designs
-        .into_iter()
-        .enumerate()
-        .filter(|(i, (n, _))| i % parts == part && filter.as_deref().is_none_or(|f| n.contains(f)) && (sample == 1 || !SLOW.contains(&n.as_str())))
-        .map(|(_, d)| d)
-        .collect();
     let next = std::sync::atomic::AtomicUsize::new(0);
     let results = std::sync::Mutex::new(Vec::new());
     std::thread::scope(|scope| {
         for _ in 0..jobs {
             scope.spawn(|| {
-                while let Some((name, _)) = queue.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
-                    let out = dir.join(format!("{}.jsonl", name.replace('/', "__")));
-                    let lines = run_design(name, &out, sample);
+                while let Some(u) = queue.get(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)) {
+                    let file = u.name().replace('/', "__").replace([' ', '[', ']'], "_");
+                    let out = dir.join(format!("{file}.r{run}.jsonl"));
+                    let t = Instant::now();
+                    let lines = run_design(&u.design, &out, sample, u.slice);
+                    let secs = t.elapsed().as_secs_f64();
+                    let load = lines.iter().find(|o| o["entity"] == "design" && o["action"] == "load").and_then(|o| o["ms"].as_f64()).unwrap_or(0.0) / 1000.0;
+                    if let Some(p) = &timings {
+                        let line = json!({"design": u.design, "slice": u.slice.map(|(j, n)| format!("{}/{n}", j + 1)), "secs": round3(secs), "load": round3(load), "actions": lines.len()});
+                        let mut f = std::fs::OpenOptions::new().create(true).append(true).open(p).unwrap();
+                        writeln!(f, "{line}").unwrap();
+                    }
+                    eprintln!("action matrix: {} took {secs:.1} s ({} outcomes, load {load:.1} s)", u.name(), lines.len());
                     results.lock().unwrap().extend(lines);
                 }
             });
         }
     });
-    let _ = std::fs::remove_dir_all(&dir);
+    if keep.is_none() {
+        let _ = std::fs::remove_dir_all(&dir);
+    }
     let mut v = results.into_inner().unwrap();
     v.sort_by_key(|o| key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or("")));
     v
 }
 
+/// Run the actions (one in `sample`) of every design (the pull request sample leaves out the
+/// slow-loading ones).
+fn run_matrix(sample: u64) -> Vec<Value> {
+    let costs = read_costs();
+    let queue: Vec<Unit> = design_names()
+        .into_iter()
+        .filter(|n| sample == 1 || !(SLOW.contains(&n.as_str()) || costs.get(n).is_some_and(|c| c.load > SAMPLE_MAX_LOAD_SECS)))
+        .map(|design| Unit { design, slice: None, cost: 0.0 })
+        .collect();
+    run_units(sample, &queue)
+}
+
 /// One design in child processes, restarting after an action that hangs or aborts.
-fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
+fn run_design(design: &str, out: &Path, sample: u64, slice: Option<(usize, usize)>) -> Vec<Value> {
     let _ = std::fs::remove_file(out);
     let mut from = 0usize;
     let mut results = Vec::new();
@@ -725,6 +885,7 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
             .env("ACTION_MATRIX_OUT", out)
             .env("ACTION_MATRIX_FROM", from.to_string())
             .env("ACTION_MATRIX_SAMPLE", sample.to_string())
+            .env("ACTION_MATRIX_SLICE", slice.map(|(j, n)| format!("{}/{n}", j + 1)).unwrap_or_default())
             .stdout(Stdio::null())
             .stderr(Stdio::null())
             .spawn()
@@ -753,13 +914,18 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
             .map(|f| std::io::BufReader::new(f).lines().map_while(Result::ok).filter_map(|l| serde_json::from_str(&l).ok()).collect())
             .unwrap_or_default();
         let done = lines.iter().any(|l| l.get("done").is_some());
-        let last_start = lines.iter().rev().take_while(|l| l.get("start").is_some() || l.get("design").is_none()).find_map(|l| l["start"].as_u64());
+        let last = lines.iter().rev().take_while(|l| l.get("start").is_some() || l.get("design").is_none()).find(|l| l.get("start").is_some());
+        let last_start = last.and_then(|l| l["start"].as_u64());
+        let in_edit = last.is_some_and(|l| l["edit"] == true);
         results = lines.iter().filter(|l| l.get("design").is_some()).cloned().collect();
         if done {
             break;
         }
         // It stopped inside action `last_start`: record it and go on after it.
         let Some(i) = last_start else {
+            if slice.is_some_and(|(j, _)| j > 0) {
+                break;
+            }
             extra.push(
                 json!({"design": design, "entity": "design", "action": "load", "ok": false, "kind": if timed_out { "timeout" } else { "crash" },
                               "message": format!("the design did not load ({status:?})")}),
@@ -768,7 +934,7 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
         };
         // Which action was it? The child enumerates them; ask it by running from there with a
         // marker: simplest is to record the index and let the next run name it.
-        extra.push(json!({"design": design, "index": i, "kind": if timed_out { "timeout" } else { "crash" },
+        extra.push(json!({"design": design, "index": i, "edit": in_edit, "kind": if timed_out { "timeout" } else { "crash" },
                           "message": if timed_out { format!("no result after {} s", ACTION_TIMEOUT.as_secs()) } else { format!("the process ended: {status:?}") }}));
         from = i as usize + 1;
     }
@@ -777,7 +943,10 @@ fn run_design(design: &str, out: &Path, sample: u64) -> Vec<Value> {
         let names = action_names(design);
         for e in &mut extra {
             if let Some(i) = e.get("index").and_then(Value::as_u64) {
-                let (entity, action) = names.get(i as usize).cloned().unwrap_or_else(|| (format!("action{i}"), "unknown".into()));
+                let (entity, mut action) = names.get(i as usize).cloned().unwrap_or_else(|| (format!("action{i}"), "unknown".into()));
+                if e["edit"] == true {
+                    action += "+edit";
+                }
                 *e = json!({"design": design, "entity": entity, "action": action, "ok": false, "kind": e["kind"], "message": e["message"]});
             }
         }
@@ -824,9 +993,12 @@ fn write_baseline(results: &[Value]) {
             m.entry(design).or_default().entry(entity).or_default().extend(actions.as_str().unwrap_or("").split_whitespace().map(str::to_string));
         }
     }
+    // A timeout of an action that passed keeps it passing (see [`ratchet`]).
+    let base = read_baseline();
     for o in results {
         let (design, entity, action) = (o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
-        let mark = if o["ok"].as_bool() == Some(true) { "" } else { "!" };
+        let kept = o["kind"] == "timeout" && base.get(&key(design, entity, action)) == Some(&true);
+        let mark = if o["ok"].as_bool() == Some(true) || kept { "" } else { "!" };
         m.entry(design).or_default().entry(entity).or_default().push(format!("{mark}{action}"));
     }
     // One entity per line, sorted: small diffs when a few actions change.
@@ -855,10 +1027,18 @@ fn ratchet(results: &[Value], full: bool) {
     // baseline, over the same names this run tried, and in this run.
     let mut fam: BTreeMap<String, (usize, usize, Vec<String>, Vec<String>)> = BTreeMap::new();
     let mut fresh = 0usize;
+    // An action that passed in the baseline and now runs past ACTION_TIMEOUT is listed but not
+    // judged: on a busy runner the slowest actions (40-80 s on oracle 41's tube) land either side
+    // of the limit from one night to the next. An error or a crash is judged as usual.
+    let mut slow = Vec::new();
     for o in results {
         let (design, entity, action) = (o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
         let k = key(design, entity, action);
         let ok = o["ok"].as_bool() == Some(true);
+        if o["kind"] == "timeout" && base.get(&k) == Some(&true) {
+            slow.push(k);
+            continue;
+        }
         let f = fam.entry(key(design, &family(entity), action)).or_default();
         match base.get(&k) {
             Some(was) => {
@@ -895,6 +1075,14 @@ fn ratchet(results: &[Value], full: bool) {
         eprintln!("baseline written: {}", baseline_path().display());
         return;
     }
+    if !slow.is_empty() {
+        eprintln!(
+            "{} actions that pass in the baseline ran past the {} s limit this time (not judged):\n{}",
+            slow.len(),
+            ACTION_TIMEOUT.as_secs(),
+            slow.join("\n")
+        );
+    }
     if !fixed.is_empty() || fresh > 0 {
         eprintln!(
             "{} actions pass now that failed in the baseline, and {fresh} are not in it: record them with `cargo xtask action-matrix --bless`:\n{}",
@@ -913,51 +1101,156 @@ fn ratchet(results: &[Value], full: bool) {
 /// Pull requests: a fixed sample of the matrix (one action in [`PR_SAMPLE`]) against the ratchet.
 #[test]
 fn action_matrix_sample() {
-    let results = run_matrix(PR_SAMPLE, 0, 1);
+    let results = run_matrix(PR_SAMPLE);
     assert!(results.len() > 300, "only {} actions ran", results.len());
     ratchet(&results, false);
 }
 
-/// The whole matrix against the ratchet, in four parts that the nightly CI job runs side by side
-/// (`--run-ignored only`).
-fn full_part(part: usize) {
-    let results = run_matrix(1, part, 4);
+/// One shard of the whole matrix against the ratchet: `ACTION_MATRIX_SHARD=k/n` (the nightly
+/// "Action matrix" CI jobs run the n shards side by side, `--run-ignored only`). Shards are cut by
+/// what each design costs (tests/action_matrix/costs.json), see [`plan`].
+/// `ACTION_MATRIX_SHARD_LIST=1` only prints the plan.
+#[test]
+#[ignore = "heavy: the nightly Action matrix CI jobs run it, one shard each"]
+fn action_matrix_shard() {
+    let Some((k, n)) = std::env::var("ACTION_MATRIX_SHARD").ok().and_then(|v| parse_part(&v)) else { panic!("set ACTION_MATRIX_SHARD=k/n") };
+    let shards = plan(&design_names(), &read_costs(), n);
+    for (i, sh) in shards.iter().enumerate() {
+        let total: f64 = sh.iter().map(|u| u.cost).sum();
+        eprintln!("shard {}/{n}: {} pieces, about {:.0} s of work{}", i + 1, sh.len(), total, if i == k { " (this one)" } else { "" });
+    }
+    eprintln!("this shard: {}", shards[k].iter().map(Unit::name).collect::<Vec<_>>().join(", "));
+    if std::env::var_os("ACTION_MATRIX_SHARD_LIST").is_some() {
+        return;
+    }
+    let results = run_units(1, &shards[k]);
     ratchet(&results, false);
 }
 
+/// Determinism: a sample of the matrix (one family in [`DETERMINISM_SAMPLE`], the heaviest
+/// designs left out) run twice must give the same outcome for every action. Lists each action
+/// whose outcome changed between the runs.
 #[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_1() {
-    full_part(0);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_2() {
-    full_part(1);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_3() {
-    full_part(2);
-}
-
-#[test]
-#[ignore = "heavy: the nightly Action matrix CI job runs it"]
-fn action_matrix_full_4() {
-    full_part(3);
+#[ignore = "heavy: the nightly Action matrix determinism CI job runs it"]
+fn action_matrix_determinism() {
+    let outcomes = |v: Vec<Value>| -> BTreeMap<String, String> {
+        v.into_iter()
+            .map(|o| {
+                let k = key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or(""));
+                let r = if o["ok"].as_bool() == Some(true) {
+                    "pass".to_string()
+                } else {
+                    format!("{}: {}", o["kind"].as_str().unwrap_or(""), o["message"].as_str().unwrap_or(""))
+                };
+                (k, r)
+            })
+            .collect()
+    };
+    let costs = read_costs();
+    let queue: Vec<Unit> = design_names()
+        .into_iter()
+        .filter(|n| costs.get(n).copied().unwrap_or(UNKNOWN_COST).secs <= DETERMINISM_MAX_SECS)
+        .map(|design| Unit { design, slice: None, cost: 0.0 })
+        .collect();
+    let a = outcomes(run_units(DETERMINISM_SAMPLE, &queue));
+    let b = outcomes(run_units(DETERMINISM_SAMPLE, &queue));
+    let keys: BTreeSet<&String> = a.keys().chain(b.keys()).collect();
+    let mut changed = Vec::new();
+    // Pieces that share a name can swap numbers between runs (#569): compare passes per family
+    // too, and report a family whose pass count differs.
+    let mut fam: BTreeMap<String, (usize, usize)> = BTreeMap::new();
+    for k in &keys {
+        let (x, y) = (a.get(*k).map_or("missing", String::as_str), b.get(*k).map_or("missing", String::as_str));
+        let mut parts = k.splitn(3, " :: ");
+        let (d, e, act) = (parts.next().unwrap_or(""), parts.next().unwrap_or(""), parts.next().unwrap_or(""));
+        let f = fam.entry(key(d, &family(e), act)).or_default();
+        f.0 += usize::from(x == "pass");
+        f.1 += usize::from(y == "pass");
+        if x != y {
+            changed.push(format!("{k}\n    first:  {x}\n    second: {y}"));
+        }
+    }
+    let families: Vec<String> = fam.into_iter().filter(|(_, (x, y))| x != y).map(|(k, (x, y))| format!("{k}: {x} then {y} pass")).collect();
+    eprintln!(
+        "action matrix determinism: {} actions, {} changed between two runs, {} families pass a different number of times",
+        keys.len(),
+        changed.len(),
+        families.len()
+    );
+    for c in &changed {
+        eprintln!("  {c}");
+    }
+    assert!(
+        families.is_empty(),
+        "{} families of actions pass a different number of times in two runs of the same build:\n{}",
+        families.len(),
+        families.join("\n")
+    );
 }
 
 /// The whole matrix at once (`cargo xtask action-matrix`): `ACTION_MATRIX_BLESS=1` rewrites the
 /// baseline; `ACTION_MATRIX_RESULTS=file.json` keeps every outcome with its message.
+/// `ACTION_MATRIX_MERGE=DIR` runs nothing and takes the outcomes from the `results-*.json` files
+/// in DIR instead (the nightly shards' artifacts), and the timings from its `timings-*.jsonl`
+/// files, which `ACTION_MATRIX_BLESS` then also writes to tests/action_matrix/costs.json.
 #[test]
-#[ignore = "cargo xtask action-matrix runs it (CI runs it as the four action_matrix_full parts)"]
+#[ignore = "cargo xtask action-matrix runs it (CI runs it as the action_matrix_shard jobs)"]
 fn action_matrix_all() {
-    let results = run_matrix(1, 0, 1);
+    let Some(dir) = std::env::var_os("ACTION_MATRIX_MERGE").map(PathBuf::from) else {
+        let results = run_matrix(1);
+        ratchet(&results, true);
+        return;
+    };
+    let mut results: Vec<Value> = Vec::new();
+    let mut timings: Vec<Value> = Vec::new();
+    let mut files: Vec<PathBuf> = std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).collect();
+    files.sort();
+    for f in files {
+        let name = f.file_name().unwrap_or_default().to_string_lossy().to_string();
+        let text = std::fs::read_to_string(&f).unwrap_or_default();
+        if name.starts_with("results-") && name.ends_with(".json") {
+            results.extend(serde_json::from_str::<Vec<Value>>(&text).unwrap_or_else(|e| panic!("{name}: {e}")));
+        } else if name.starts_with("timings-") {
+            timings.extend(text.lines().filter_map(|l| serde_json::from_str(l).ok()));
+        }
+    }
+    let ran: BTreeSet<&str> = results.iter().filter_map(|o| o["design"].as_str()).collect();
+    let missing: Vec<String> = design_names().into_iter().filter(|d| !ran.contains(d.as_str())).collect();
+    assert!(missing.is_empty(), "no results for {}", missing.join(", "));
+    results.sort_by_key(|o| key(o["design"].as_str().unwrap_or(""), o["entity"].as_str().unwrap_or(""), o["action"].as_str().unwrap_or("")));
+    if std::env::var_os("ACTION_MATRIX_BLESS").is_some() && !timings.is_empty() {
+        write_costs(&timings);
+    }
     ratchet(&results, true);
 }
 
+/// tests/action_matrix/costs.json from the shards' timings: per design, its whole time (a sliced
+/// design's slices added up, less the loads all but one of them repeat) and its load.
+fn write_costs(timings: &[Value]) {
+    let mut m: BTreeMap<String, (f64, f64, usize)> = BTreeMap::new();
+    for t in timings {
+        let e = m.entry(t["design"].as_str().unwrap_or("").to_string()).or_default();
+        e.0 += t["secs"].as_f64().unwrap_or(0.0);
+        e.1 = e.1.max(t["load"].as_f64().unwrap_or(0.0));
+        e.2 += 1;
+    }
+    // Designs these timings don't cover keep their old costs.
+    for (d, c) in read_costs() {
+        m.entry(d).or_insert((c.secs, c.load, 1));
+    }
+    let mut s = String::from(
+        "{\n \"about\": \"What each action matrix design costs on a CI runner, in seconds (secs: the whole design, load: before its first action), for cutting the nightly shards (apps/solidcraft-cli/tests/action_matrix.rs, plan). Written with the baseline by cargo xtask action-matrix --bless --from DIR.\",\n \"designs\": {\n",
+    );
+    let n = m.len();
+    for (i, (d, (secs, load, pieces))) in m.into_iter().enumerate() {
+        let secs = (secs - load * pieces.saturating_sub(1) as f64).max(load);
+        s += &format!("  {}: {{\"secs\": {:.1}, \"load\": {:.1}}}{}\n", json!(d), secs, load, if i + 1 < n { "," } else { "" });
+    }
+    s += " }\n}\n";
+    std::fs::write(costs_path(), s).unwrap();
+    eprintln!("costs written: {}", costs_path().display());
+}
+
 // ---------------------------------------------------------------------------------------------
 // The matrix's causes: one small reproduction per open issue, ignored until it is fixed (the
 // issue says how many matrix actions it accounts for). Each runs commands as the desktop sends
@@ -999,6 +1292,106 @@ fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
     }
 }
 
+// #1255: a round on a knuckle's cap circle (oracle/63's hinge), 0.73 wide on a ring of radius
+// 4. The run past each end of the circle followed the end tangent so far that its sections
+// wrapped round the ring and the blend was refused; it is shortened now while it still
+// crosses the end face. Before #1101 a 0.13 mm station on the leaf's top edge kept the
+// matrix's radius at 0.013, which never got that far.
+#[test]
+fn a_round_on_a_knuckle_cap_circle() {
+    for (cmd, size, removed) in [("solid.fillet", "radius", (2.4, 2.8)), ("solid.chamfer", "distance", (5.6, 6.3))] {
+        let mut s = load(&root().join("tests/oracle/63-hinge-knuckle/recipe.json")).unwrap();
+        let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate(0.001).unwrap().measure().volume).sum::<f64>();
+        let before = volume(&s);
+        s.execute(cmd, &json!({"edges": [[40.0, 29.837_722, 6.449_490]], size: 0.728})).unwrap_or_else(|e| panic!("{cmd}: {e}"));
+        check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{cmd}: {kind}: {e}"));
+        let st = s.model.state();
+        let body = &st.bodies.first().unwrap().body;
+        assert!(body.validity().is_empty(), "{cmd}: {:?}", body.validity());
+        let gone = before - volume(&s);
+        assert!(gone > removed.0 && gone < removed.1, "{cmd} took {gone} mm³");
+    }
+}
+
+// #1255: a hole 0.133 mm across on the 0.5 mm ledge a loft cut leaves in a pocket floor of a
+// 900 mm slab. The Boolean needed a retry, and its guard meshed the drill as coarsely as the
+// slab's size allows (0.4 mm, three times the drill's width): the mesh had no inside, the drill
+// measured −30272 mm³ and the right cut was refused. Volumes are measured finer than each
+// body's smallest radius now.
+#[test]
+fn a_hair_thin_hole_on_a_ledge_beside_a_loft_cut() {
+    let mut s = load(&root().join("examples/regressions/loft_cut_beside_round_hole.json")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.005, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 0.133, "position": [357.22, -150.993_333, 730.0]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    // The drill goes through the 4 mm ledge and on through the slab below: 690 to 730.
+    let gone = before - volume(&s);
+    let expected = std::f64::consts::PI * 0.0665 * 0.0665 * 40.0;
+    assert!((gone - expected).abs() < 0.2, "the hole took {gone} mm³, not {expected}");
+}
+
+// #1255: a 0.8 mm hole through the side wall of the plastic part's rest. Meshed at the
+// tolerance the 200 mm drill sets, the part with its rounds, bosses and draft measured 6.8 mm³
+// more after the cut than before; ten times finer it is 1.44 mm³ less, the drill's volume
+// through the 2.9 mm wall. A volume out of bounds is measured again finer before it refuses.
+#[test]
+fn a_small_hole_through_the_wall_of_a_plastic_rest() {
+    let mut s = load(&root().join("apps/solidcraft-cli/tests/corpus/modern-plastic.solidcraft")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 0.8, "position": [63.069_841_5, 28.333_333, 4.0]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    let gone = before - volume(&s);
+    assert!(gone > 1.2 && gone < 1.7, "the hole took {gone} mm³");
+}
+
+// #1255: a hole square to a flange bent at 45°. The drill's cap, evaluated at that angle, lay
+// 2.9e-11 mm off the plane it was made on against a bound of 2.2e-11, so the sheet didn't take
+// the hole as a cut-out of its flat pattern and the cut was refused. The sheet keeps the hole
+// and still unfolds and folds back.
+#[test]
+fn a_hole_square_to_a_45_degree_flange() {
+    let mut s = load(&root().join("tests/oracle/70-sm-flange-45/recipe.json")).unwrap();
+    let volume = |s: &Session| s.model.state().bodies.iter().map(|b| b.body.tessellate_with(0.002, true).unwrap().measure().volume).sum::<f64>();
+    let before = volume(&s);
+    s.execute("solid.hole", &json!({"diameter": 3.448, "position": [66.666_667, -4.511_845, 4.511_845]})).unwrap();
+    check(&s, 0, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    // Through the 2.5 mm flange.
+    let gone = before - volume(&s);
+    let expected = std::f64::consts::PI * 1.724 * 1.724 * 2.5;
+    assert!((gone - expected).abs() < 0.1, "the hole took {gone} mm³, not {expected}");
+    let sheets: Vec<String> = s.model.state().sheets.iter().map(|sh| sh.body.clone()).collect();
+    assert!(!sheets.is_empty());
+    for body in sheets {
+        for id in ["sheet.unfold", "sheet.refold"] {
+            s.execute(id, &json!({"body": body})).unwrap_or_else(|e| panic!("{id}: {e}"));
+        }
+    }
+}
+
+// #1255: an axis through a corner round of the sensor enclosure's lid, then a parameter that
+// widens the lid. The round is found again by name, but its point nearest the old pick is the
+// end of its arc, on the edge it shares with the flat side, and picking again by that point
+// took the side: "the face is not a cylinder". The named face is used as found now.
+#[test]
+fn an_axis_through_a_corner_round_that_a_parameter_moves() {
+    let mut s = load(&root().join("examples/acceptance/sensor_enclosure.json")).unwrap();
+    s.execute("construct.axis.through_cylinder", &json!({"face": {"face": [36.242_617, 29.977_740, 27.0]}})).unwrap();
+    let start = s.doc.features.len();
+    s.execute("parameters.change", &json!({"name": "board_w", "expression": "(60 mm) * 1.1"})).unwrap();
+    check(&s, start, &BTreeMap::new()).unwrap_or_else(|(kind, e)| panic!("{kind}: {e}"));
+    let st = s.model.state();
+    let axis = st.construct.iter().find_map(|c| match &c.geom {
+        solidcraft_engine::doc::construct::ConstructGeom::Axis { origin, dir } => Some((*origin, *dir)),
+        _ => None,
+    });
+    let (origin, dir) = axis.expect("the axis");
+    // The round's axis moved with the lid's corner, from x = 36 to 39.
+    let off = origin - Vec3::new(39.0, 26.0, 0.0);
+    assert!((off - dir * off.dot(dir)).len() < 1e-6, "the axis passes {origin:?} along {dir:?}");
+}
+
 #[test]
 fn a_sketch_on_a_patterned_boss_top() {
     let mut c: Vec<Value> = rectangle(json!("XY"), [0., 0.], [60., 20.]).into();
@@ -1051,6 +1444,18 @@ fn a_through_hole_into_a_shelled_box_rim() {
     );
 }
 
+/// #559: a 6 mm hole drilled at an angle through a 920 mm prism, its through-all tool nearly
+/// 1.9 m long beside a thin bar it misses. The bar's cut came out empty: the tool filled too
+/// little of its own box for the sampled shortcut, and the boolean's tolerances (from the
+/// tool's length) were wider than the hole.
+#[test]
+fn an_oblique_through_hole_beside_a_thin_bar() {
+    reproduces(
+        Some("examples/regressions/oblique_cut_of_cylinder.json"),
+        json!([{"command": "solid.hole", "params": {"diameter": 6.0, "position": [296.66666666666663, -458.66666666666663, 848.7633333333333]}}]),
+    );
+}
+
 #[test]
 fn a_hole_through_a_sheet_metal_base() {
     let mut c: Vec<Value> = rectangle(json!("XY"), [0., 0.], [60., 40.]).into();
@@ -1061,6 +1466,29 @@ fn a_hole_through_a_sheet_metal_base() {
     reproduces(None, Value::Array(c));
 }
 
+/// `face.hole` on a rim of the sheet metal corpus (#560): drilled along the panel, the hole is a
+/// bore of that panel, and the part still unfolds and folds back.
+#[test]
+fn a_hole_drilled_into_a_sheet_metal_rim() {
+    // What the matrix sends: the face's point, the hole square into it.
+    for (design, at, diameter) in [
+        // The base's end rim of the L bracket, through to the other end.
+        ("typical/sheet-metal-bracket", [60.0, 7.777777777777779, 0.8333333333333333], 0.667),
+        // The end rim of a tray's wall, beside the corner.
+        ("oracle/69-sm-tray", [99.58333333333333, 4.267766952966369, 15.0], 0.333),
+    ] {
+        let Some((_, path)) = designs().into_iter().find(|(n, _)| n == design) else { panic!("no design {design}") };
+        let mut s = load(&path).unwrap();
+        let before = errors(&s);
+        let start = s.doc.features.len();
+        s.execute("solid.hole", &json!({"position": at, "diameter": diameter})).unwrap_or_else(|e| panic!("{design}: {e}"));
+        check(&s, start, &before).unwrap_or_else(|(kind, e)| panic!("{design}: {kind}: {e}"));
+        for id in ["sheet.unfold", "sheet.refold"] {
+            s.execute(id, &json!({})).unwrap_or_else(|e| panic!("{design} {id}: {e}"));
+        }
+    }
+}
+
 #[test]
 fn sketches_on_loft_and_sweep_faces() {
     let mut loft: Vec<Value> = rectangle(json!("XY"), [-20., -20.], [20., 20.]).into();

apps/solidcraft-cli/tests/json_out.rs

@@ -0,0 +1,168 @@
+//! `--json-out FILE` writes the JSON `run` and `eval` would print to a file the CLI makes
+//! itself. A shell's `>` can re-encode stdout (Windows PowerShell writes UTF-16, or UTF-8 with a
+//! byte-order mark), which strict JSON readers refuse; the file is plain UTF-8.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solidcraft-json-out-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A box, and a parameter whose comment has a character outside ASCII.
+    fn script(&self) -> PathBuf {
+        let path = self.0.join("box.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "bore", "expression": "5 mm", "comment": "\u{d8} of the bore"}},
+            {"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+
+    /// A filleted box whose fillet a later parameter change makes impossible: every command
+    /// succeeds, the timeline ends with a failing feature.
+    fn broken_script(&self) -> PathBuf {
+        let path = self.0.join("broken.json");
+        let script = json!({"commands": [
+            {"command": "parameters.add", "params": {"name": "r", "expression": "2 mm"}},
+            {"command": "solid.box", "params": {"length": 20, "width": 20, "height": 10}},
+            {"command": "solid.fillet", "params": {"edges": [[10, 0, 10]], "radius": "r"}},
+            {"command": "parameters.change", "params": {"name": "r", "expression": "50 mm"}},
+        ]});
+        std::fs::write(&path, script.to_string()).unwrap();
+        path
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn cli() -> Command {
+    Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+}
+
+fn stdout_of(output: Output) -> Vec<u8> {
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    output.stdout
+}
+
+/// Timings differ from one run to the next.
+fn without_timings(v: &mut Value) {
+    match v {
+        Value::Object(map) => {
+            map.remove("ms");
+            map.values_mut().for_each(without_timings);
+        }
+        Value::Array(items) => items.iter_mut().for_each(without_timings),
+        _ => {}
+    }
+}
+
+/// The file holds what stdout carried in the same command without `--json-out`: the same JSON,
+/// laid out the same way, in UTF-8 with no byte-order mark (UTF-8's or UTF-16's), so a strict
+/// reader accepts it.
+fn assert_plain_utf8_json(file: &Path, stdout: &[u8]) -> Value {
+    let bytes = std::fs::read(file).unwrap();
+    assert!(matches!(bytes.first(), Some(b'{' | b'[')), "the file starts with the JSON itself, not a mark");
+    assert_eq!(bytes.last(), Some(&b'\n'), "like stdout, the file ends with a newline");
+    let lines = |b: &[u8]| b.iter().filter(|c| **c == b'\n').count();
+    assert_eq!(lines(&bytes), lines(stdout), "laid out like stdout");
+    let mut value: Value = serde_json::from_str(std::str::from_utf8(&bytes).unwrap()).unwrap();
+    let mut printed: Value = serde_json::from_slice(stdout).unwrap();
+    without_timings(&mut value);
+    without_timings(&mut printed);
+    assert_eq!(value, printed, "the file is what stdout would have carried");
+    value
+}
+
+#[test]
+fn run_results_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let file = dir.0.join("results.json");
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).arg("--results").output().unwrap());
+    let output = cli().arg("run").arg(&script).arg("--results").arg("--json-out").arg(&file).output().unwrap();
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    assert!(output.stdout.is_empty(), "the JSON goes to the file, not to stdout");
+    let results = assert_plain_utf8_json(&file, &on_stdout);
+    assert_eq!(results.as_array().map(Vec::len), Some(2));
+}
+
+#[test]
+fn run_json_out_without_results_holds_the_measurement_even_when_quiet() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("run").arg(&script).output().unwrap());
+    for (name, extra) in [("plain", &[][..]), ("quiet", &["--quiet"][..])] {
+        let file = dir.0.join(format!("measure-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measure = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measure["body_count"], 1, "{name}");
+    }
+}
+
+#[test]
+fn eval_json_out_holds_what_stdout_would() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let on_stdout = stdout_of(cli().arg("eval").arg(&script).output().unwrap());
+    // The option may come before the file to evaluate, and `inspect` is the same command.
+    for name in ["eval", "inspect"] {
+        let file = dir.0.join(format!("{name}.json"));
+        let output = cli().arg(name).arg("--json-out").arg(&file).arg(&script).output().unwrap();
+        assert!(output.status.success(), "{name}: {}", String::from_utf8_lossy(&output.stderr));
+        assert!(output.stdout.is_empty(), "{name}");
+        let measured = assert_plain_utf8_json(&file, &on_stdout);
+        assert_eq!(measured["body_count"], 1, "{name}");
+        // A character outside ASCII is written as it is, in UTF-8.
+        assert!(std::fs::read_to_string(&file).unwrap().contains("\u{d8} of the bore"), "{name}");
+    }
+}
+
+#[test]
+fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    for cmd in ["run", "eval"] {
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
+
+        let missing = dir.0.join("missing").join("out.json");
+        let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{cmd}");
+        assert!(!output.stderr.is_empty(), "{cmd}");
+        assert!(output.stdout.is_empty(), "{cmd}");
+        assert!(!missing.exists(), "{cmd}");
+    }
+}
+
+#[test]
+fn run_json_out_is_not_written_when_a_feature_fails() {
+    let dir = Scratch::new();
+    let script = dir.broken_script();
+    for (name, extra) in [("plain", &[][..]), ("results", &["--results"][..])] {
+        let file = dir.0.join(format!("failed-{name}.json"));
+        let output = cli().arg("run").arg(&script).args(extra).arg("--json-out").arg(&file).output().unwrap();
+        assert_eq!(output.status.code(), Some(1), "{name}");
+        assert!(String::from_utf8_lossy(&output.stderr).contains("nothing was written"), "{name}");
+        assert!(!file.exists(), "{name}");
+    }
+}

apps/solidcraft-cli/tests/mcp_connect.rs

@@ -1,18 +1,83 @@
-//! `mcp --connect` to a port where no app listens tells the user how to start one (#270).
+//! `mcp --connect` to a port where no app listens yet (#270): the server still starts, its tools
+//! say how to start the app, and once the app runs they reach it with that launch's token.
 
+use std::io::{BufRead, BufReader, Write};
 use std::net::TcpListener;
 use std::process::{Command, Stdio};
 
+use serde_json::{Value, json};
+
 #[test]
-fn mcp_connect_without_a_listening_app_names_the_control_flag() {
+fn mcp_connect_serves_before_the_app_runs_and_reaches_it_once_it_does() {
     // A port that was free a moment ago: nothing listens on it.
     let port = TcpListener::bind("127.0.0.1:0").unwrap().local_addr().unwrap().port();
-    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
-        .args(["mcp", "--connect", &format!("127.0.0.1:{port}")])
-        .stdin(Stdio::null())
-        .output()
+    let addr = format!("127.0.0.1:{port}");
+    let control_dir = std::env::temp_dir().join(format!("solidcraft-mcp-connect-{}-{port}", std::process::id()));
+    std::fs::create_dir_all(&control_dir).unwrap();
+    let mut child = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+        .args(["mcp", "--connect", &addr, "--allow-any-path"])
+        .env("SOLIDCRAFT_CONTROL_DIR", &control_dir)
+        .env_remove("SOLIDCRAFT_CONTROL_TOKEN")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
         .unwrap();
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    assert!(!output.status.success(), "{stderr}");
-    assert!(stderr.contains("--control"), "say how to start the app with a control port: {stderr}");
+    let mut stdin = child.stdin.take().unwrap();
+    let mut stdout = BufReader::new(child.stdout.take().unwrap());
+    let mut ask = |id: u64, method: &str, params: Value| -> Value {
+        writeln!(stdin, "{}", json!({"jsonrpc": "2.0", "id": id, "method": method, "params": params})).unwrap();
+        let mut line = String::new();
+        stdout.read_line(&mut line).unwrap();
+        serde_json::from_str(&line).unwrap_or_else(|e| panic!("{e}: {line:?}"))
+    };
+    let measure = json!({"name": "measure", "arguments": {}});
+    let text = |r: &Value| r["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string();
+
+    // The server answers without the app, and its instructions say the app isn't running.
+    let init = ask(1, "initialize", json!({"protocolVersion": "2025-06-18"}));
+    let instructions = init["result"]["instructions"].as_str().unwrap_or_default();
+    assert!(instructions.contains("not running") && instructions.contains(&format!("--control {port}")), "{instructions}");
+    let tools = ask(2, "tools/list", json!({}));
+    assert!(tools["result"]["tools"].as_array().is_some_and(|t| !t.is_empty()), "{tools}");
+
+    // A tool call says the app is not running and how to start it.
+    let r = ask(3, "tools/call", measure.clone());
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("not running") && text(&r).contains(&format!("solidcraft --control {port}")), "{r}");
+
+    // The app starts: a token file for this launch, and its control port.
+    let token = "0123456789abcdef".repeat(4);
+    std::fs::write(control_dir.join(format!("{port}.token")), &token).unwrap();
+    let listener = TcpListener::bind(&addr).unwrap();
+    let app = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        let mut line = String::new();
+        BufReader::new(stream.try_clone().unwrap()).read_line(&mut line).unwrap();
+        let req: Value = serde_json::from_str(&line).unwrap();
+        let reply = if req["token"] == json!(token) {
+            json!({"id": req["id"], "ok": true, "result": {"bodies": [], "method": req["method"]}})
+        } else {
+            json!({"id": req["id"], "ok": false, "error": format!("unauthorized: token {}", req["token"])})
+        };
+        writeln!(&stream, "{reply}").unwrap();
+    });
+    let r = ask(4, "tools/call", measure);
+    assert_ne!(r["result"]["isError"], true, "{r}");
+    assert!(text(&r).contains("engine.execute"), "{r}");
+    app.join().unwrap();
+
+    drop(stdin);
+    assert!(child.wait().unwrap().success());
+    std::fs::remove_dir_all(&control_dir).ok();
+}
+
+#[test]
+fn mcp_connect_without_a_port_is_refused_at_start() {
+    for addr in ["localhost", "127.0.0.1:0"] {
+        let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).args(["mcp", "--connect", addr]).stdin(Stdio::null()).output().unwrap();
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert!(!output.status.success(), "{addr}: {stderr}");
+        assert!(stderr.contains("HOST:PORT"), "{addr}: {stderr}");
+    }
 }

apps/solidcraft-cli/tests/run_results.rs

@@ -132,3 +132,41 @@ fn legacy_extension_and_format_tag_still_open() {
     let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
     assert!(reopened.to_json().contains("\"solidcraft/"));
 }
+
+/// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
+/// option it doesn't take rather than ignoring it.
+#[test]
+fn snapshot_runs_its_script_on_the_in_design() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solidcraft");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let shifted = dir.0.join("shifted.json");
+    std::fs::write(
+        &shifted,
+        json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
+    )
+    .unwrap();
+    let shot = |name: &str, args: &[&std::ffi::OsStr]| {
+        let png = dir.0.join(name);
+        json_output(cli().arg("snapshot").args(args).arg("--out").arg(&png).args(["--width", "64", "--height", "48"]).output().unwrap());
+        std::fs::read(&png).unwrap()
+    };
+    let alone = shot("alone.png", &[shifted.as_os_str()]);
+    let on_base = shot("on_base.png", &[shifted.as_os_str(), "--in".as_ref(), base.as_os_str()]);
+    let base_only = shot("base.png", &["--in".as_ref(), base.as_os_str()]);
+    assert_ne!(alone, on_base, "the script ran on the --in design");
+    assert_ne!(base_only, on_base);
+    for (bad, says) in [(["--frobnicate", "1"], "doesn't take --frobnicate"), (["--width", "wide"], "--width must be 16 to 8192")] {
+        let output = cli().arg("snapshot").arg(&base).arg("--out").arg(dir.0.join("x.png")).args(bad).output().unwrap();
+        assert_eq!(output.status.code(), Some(1));
+        assert!(String::from_utf8_lossy(&output.stderr).contains(says), "{}", String::from_utf8_lossy(&output.stderr));
+    }
+}
+
+/// An unknown command's error suggests the id that was meant.
+#[test]
+fn unknown_command_suggests_the_closest_id() {
+    let output = cli().args(["exec", "file.open"]).output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&output.stderr).contains("did you mean `doc.open`?"), "{}", String::from_utf8_lossy(&output.stderr));
+}

apps/solidcraft-cli/tests/script_roundtrip.rs

@@ -0,0 +1,86 @@
+//! A design's command script (`timeline.export_script`, #886) replays into the same design:
+//! every corpus design that the script supports comes back with the same timeline, parameters,
+//! settings and bodies.
+
+use std::path::{Path, PathBuf};
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+
+fn corpus() -> Vec<PathBuf> {
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/corpus");
+    let mut v: Vec<PathBuf> =
+        std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "solidcraft")).collect();
+    v.sort();
+    assert!(v.len() >= 7, "corpus files in {}", dir.display());
+    v
+}
+
+/// Designs with components or joints, which scripts do not support yet.
+const ASSEMBLIES: [&str; 2] = ["components-arm", "joints-hinge"];
+
+fn bodies(s: &mut Session) -> Vec<(String, f64, f64, Value)> {
+    let m = s.execute("inspect.measure", &json!({})).unwrap();
+    let mut v: Vec<_> = m["bodies"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .map(|b| {
+            (
+                b["name"].as_str().unwrap_or_default().to_string(),
+                b["volume_mm3"].as_f64().unwrap(),
+                b["area_mm2"].as_f64().unwrap(),
+                b["faces"].clone(),
+            )
+        })
+        .collect();
+    v.sort_by(|a, b| a.0.cmp(&b.0));
+    v
+}
+
+fn errors(s: &Session) -> Vec<(u64, Option<String>)> {
+    s.model.results.iter().map(|r| (r.id, r.error.clone())).collect()
+}
+
+fn params(s: &Session) -> Vec<solidcraft_engine::doc::Param> {
+    let mut v = s.doc.params.clone();
+    v.sort_by(|a, b| a.name.cmp(&b.name));
+    v
+}
+
+#[test]
+fn corpus_designs_replay_from_their_scripts() {
+    let mut replayed = 0;
+    for p in corpus() {
+        let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
+        let mut s = Session::default();
+        s.execute("doc.open", &json!({"path": p.to_string_lossy()})).unwrap();
+        let r = match s.execute("timeline.export_script", &json!({})) {
+            Ok(r) => r,
+            Err(e) => {
+                assert!(ASSEMBLIES.contains(&name.as_str()), "{name}: {e}");
+                assert!(e.to_string().contains("not supported yet"), "{name}: {e}");
+                continue;
+            }
+        };
+        assert!(!ASSEMBLIES.contains(&name.as_str()), "{name} has components: the script should refuse it");
+        // Through text, as a script file would carry it.
+        let script: Value = serde_json::from_str(&r["script"].to_string()).unwrap();
+        let mut t = Session::default();
+        t.run_script(&script).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(t.doc.features, s.doc.features, "{name}: timeline");
+        assert_eq!(params(&t), params(&s), "{name}: parameters");
+        assert_eq!(t.doc.marker, s.doc.marker, "{name}: marker");
+        assert_eq!(t.doc.units, s.doc.units, "{name}: units");
+        assert_eq!(t.doc.sheet, s.doc.sheet, "{name}: sheet metal rules");
+        assert_eq!(t.doc.plastic, s.doc.plastic, "{name}: plastic rules");
+        assert_eq!(t.doc.materials, s.doc.materials, "{name}: materials");
+        assert_eq!(t.doc.user_materials, s.doc.user_materials, "{name}: user materials");
+        assert_eq!(t.doc.favorites, s.doc.favorites, "{name}: favourites");
+        assert_eq!(t.doc.param_comments, s.doc.param_comments, "{name}: comments");
+        assert_eq!(errors(&t), errors(&s), "{name}: feature results");
+        assert_eq!(bodies(&mut t), bodies(&mut s), "{name}: bodies");
+        replayed += 1;
+    }
+    assert!(replayed >= 7, "replayed {replayed} corpus designs");
+}

apps/solidcraft-cli/tests/snapshot_camera.rs

@@ -0,0 +1,217 @@
+//! `snapshot` frames its picture like the MCP `screenshot`: from a camera, a view saved in the
+//! design or one the script applies itself, and without the ground grid and the origin's axes
+//! when asked (the grid lies on Z 0 and cuts through a part that straddles it).
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use serde_json::{Value, json};
+use solidcraft_engine::Session;
+use solidcraft_mcp::{Headless, Server};
+
+static NEXT: AtomicUsize = AtomicUsize::new(0);
+
+const SIZE: (usize, usize) = (160, 100);
+
+fn camera() -> Value {
+    json!({"target": [20, 0, 0], "yaw": 0.6, "pitch": 0.25, "distance": 100})
+}
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!("solidcraft-snapshot-camera-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&dir).unwrap();
+        Self(dir)
+    }
+
+    /// A box that straddles Z 0 and keeps clear of the origin (its axes show beside it), with a view
+    /// saved in the design, plus `more` steps.
+    fn script(&self, name: &str, more: &[Value]) -> PathBuf {
+        let mut steps = vec![
+            json!({"command": "solid.box", "params": {"length": 60, "width": 40, "height": 30, "corner": [10, -20, -15]}}),
+            json!({"command": "view.save", "params": {"name": "Detail", "camera": camera()}}),
+        ];
+        steps.extend(more.iter().cloned());
+        let path = self.0.join(name);
+        std::fs::write(&path, json!({"commands": steps}).to_string()).unwrap();
+        path
+    }
+
+    fn run(&self, script: &Path, out: &str, extra: &[&str]) -> Output {
+        let (w, h) = (SIZE.0.to_string(), SIZE.1.to_string());
+        Command::new(env!("CARGO_BIN_EXE_solidcraft-cli"))
+            .arg("snapshot")
+            .arg(script)
+            .arg("--out")
+            .arg(self.0.join(out))
+            .args(["--width", &w, "--height", &h])
+            .args(extra)
+            .output()
+            .unwrap()
+    }
+
+    /// The PNG `snapshot` writes.
+    fn snapshot(&self, script: &Path, out: &str, extra: &[&str]) -> Vec<u8> {
+        let output = self.run(script, out, extra);
+        assert!(output.status.success(), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+        let png = std::fs::read(self.0.join(out)).unwrap();
+        assert!(png.starts_with(b"\x89PNG"), "{extra:?}");
+        png
+    }
+
+    /// The PNG the MCP `screenshot` tool writes for the same design.
+    fn mcp(&self, script: &Path, out: &str, arguments: Value) -> Vec<u8> {
+        let mut session = Session::default();
+        session.run_script(&serde_json::from_slice(&std::fs::read(script).unwrap()).unwrap()).unwrap();
+        let mut server = Server::new(Box::new(Headless::new(session)));
+        let mut arguments = arguments;
+        arguments["path"] = json!(self.0.join(out).to_string_lossy());
+        arguments["width"] = json!(SIZE.0);
+        arguments["height"] = json!(SIZE.1);
+        let call = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "screenshot", "arguments": arguments}});
+        let reply: Value = serde_json::from_str(&server.handle_line(&call.to_string()).unwrap()).unwrap();
+        assert!(reply.get("error").is_none() && reply["result"]["isError"] != json!(true), "{reply}");
+        std::fs::read(self.0.join(out)).unwrap()
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// The picture of `--camera` is the picture of the MCP `screenshot` with the same camera, and
+/// not the home view the option used to be ignored for.
+#[test]
+fn a_camera_frames_the_picture_as_the_mcp_screenshot_does() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let home = dir.snapshot(&script, "home.png", &[]);
+    let json = camera().to_string();
+    let shot = dir.snapshot(&script, "camera.png", &["--camera", &json]);
+    assert_ne!(shot, home, "--camera was ignored");
+    assert_eq!(shot, dir.mcp(&script, "mcp-camera.png", json!({"camera": camera()})));
+    // A perspective camera too, and a different eye gives a different picture.
+    let mut near = camera();
+    near["fov"] = json!(0.6);
+    let perspective = dir.snapshot(&script, "perspective.png", &["--camera", &near.to_string()]);
+    assert_ne!(perspective, shot);
+    assert_eq!(perspective, dir.mcp(&script, "mcp-perspective.png", json!({"camera": near})));
+}
+
+/// `--view` also takes a view saved in the design, which is the camera it was saved with; a
+/// standard view still looks as it did.
+#[test]
+fn a_saved_view_is_its_camera_and_a_standard_view_is_unchanged() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let json = camera().to_string();
+    let by_camera = dir.snapshot(&script, "camera.png", &["--camera", &json]);
+    let saved = dir.snapshot(&script, "saved.png", &["--view", "Detail"]);
+    assert_eq!(saved, by_camera);
+    assert_eq!(saved, dir.mcp(&script, "mcp-saved.png", json!({"view": "Detail"})));
+    // A standard view frames the model from its direction, as before: the home camera turned.
+    let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
+    let mut s = Session::default();
+    s.run_script(&serde_json::from_slice(&std::fs::read(&script).unwrap()).unwrap()).unwrap();
+    let mut cam = solidcraft_engine::view::home_camera(&s);
+    cam.set_view(solidcraft_engine::render::StandardView::Top);
+    let scene = solidcraft_engine::view::scene(&s, &cam);
+    assert_eq!(top, solidcraft_engine::render::render_png(&scene, &cam, SIZE.0, SIZE.1).unwrap());
+    assert_eq!(top, dir.mcp(&script, "mcp-top.png", json!({"view": "top"})));
+    assert_ne!(top, saved);
+    let iso = dir.snapshot(&script, "iso.png", &["--view", "iso"]);
+    assert_eq!(iso, dir.snapshot(&script, "home.png", &[]));
+    assert_ne!(iso, top);
+}
+
+/// A script that applies a view itself (as an MCP `execute` of `view.apply` does) sets the camera
+/// of its snapshot; `--view` and `--camera` still decide when given.
+#[test]
+fn a_script_can_carry_its_camera() {
+    let dir = Scratch::new();
+    let script = dir.script("carried.json", &[json!({"command": "view.apply", "params": {"camera": camera()}})]);
+    let plain = dir.script("plain.json", &[]);
+    let carried = dir.snapshot(&script, "carried.png", &[]);
+    assert_eq!(carried, dir.snapshot(&plain, "by-camera.png", &["--camera", &camera().to_string()]));
+    assert_ne!(carried, dir.snapshot(&plain, "home.png", &[]));
+    let top = dir.snapshot(&script, "top.png", &["--view", "top"]);
+    assert_eq!(top, dir.snapshot(&plain, "plain-top.png", &["--view", "top"]));
+}
+
+/// The grid and the axes each go when asked, and a render without both from any side shows the
+/// model alone: an empty design is then the same blank picture from every camera.
+#[test]
+fn the_grid_and_the_axes_can_be_left_out() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let json = camera().to_string();
+    for view in [&["--view", "front"][..], &["--camera", &json][..]] {
+        let with = |extra: &[&str], out: &str| dir.snapshot(&script, out, &[view, extra].concat());
+        let (all, no_grid, no_axes, bare) = (
+            with(&[], "all.png"),
+            with(&["--no-grid"], "no-grid.png"),
+            with(&["--no-axes"], "no-axes.png"),
+            with(&["--no-grid", "--no-axes"], "bare.png"),
+        );
+        let different = [&all, &no_grid, &no_axes, &bare];
+        for (i, a) in different.iter().enumerate() {
+            for b in &different[i + 1..] {
+                assert_ne!(a, b, "{view:?}: two pictures are the same");
+            }
+        }
+        // The same as the MCP's `grid` and `axes`.
+        let mcp = |extra: Value, out: &str| {
+            let mut a = match view[0] {
+                "--view" => json!({"view": "front"}),
+                _ => json!({"camera": camera()}),
+            };
+            a.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+            dir.mcp(&script, out, a)
+        };
+        assert_eq!(no_grid, mcp(json!({"grid": false}), "mcp-no-grid.png"));
+        assert_eq!(no_axes, mcp(json!({"axes": false}), "mcp-no-axes.png"));
+        assert_eq!(bare, mcp(json!({"grid": false, "axes": false}), "mcp-bare.png"));
+    }
+    let empty = dir.0.join("empty.json");
+    std::fs::write(&empty, json!({"commands": []}).to_string()).unwrap();
+    let blank = |view: &str, out: &str| dir.snapshot(&empty, out, &["--view", view, "--no-grid", "--no-axes"]);
+    assert_eq!(blank("top", "blank-top.png"), blank("front", "blank-front.png"));
+    assert_ne!(blank("top", "blank-top.png"), dir.snapshot(&empty, "top.png", &["--view", "top"]));
+}
+
+#[test]
+fn a_view_or_a_camera_that_cannot_be_used_is_an_error_and_writes_nothing() {
+    let dir = Scratch::new();
+    let script = dir.script("part.json", &[]);
+    let cases: [(&[&str], &str); 7] = [
+        (&["--view", "Nowhere"], "Nowhere"),
+        (&["--view", "iso", "--camera", "{}"], "not both"),
+        (&["--camera", "not json"], "--camera"),
+        (&["--camera", "{\"target\": [0, 0, 0]}"], "yaw"),
+        (&["--camera", "{\"target\": [0, 0, 0], \"yaw\": 0, \"pitch\": 0, \"distance\": 0}"], "distance"),
+        (&["--camera", "{\"target\": [0, 0, 0], \"yaw\": 0, \"pitch\": 0, \"distance\": 50, \"fov\": -1}"], "camera"),
+        (&["--camera", "[1, 2, 3]"], "camera"),
+    ];
+    for (extra, expect) in cases {
+        let output = dir.run(&script, "never.png", extra);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(output.status.code(), Some(1), "{extra:?}: {stderr}");
+        assert!(stderr.contains(expect), "{extra:?}: {stderr}");
+        assert!(output.stdout.is_empty() && !dir.0.join("never.png").exists(), "{extra:?}");
+    }
+}
+
+/// The usage text says what the new options do.
+#[test]
+fn the_usage_names_the_camera_and_the_guides() {
+    let output = Command::new(env!("CARGO_BIN_EXE_solidcraft-cli")).arg("snapshot").output().unwrap();
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    for word in ["--camera", "--view", "view.save", "--no-grid", "--no-axes"] {
+        assert!(stderr.contains(word), "usage lacks {word}: {stderr}");
+    }
+}

apps/solidcraft-cli/tests/straight_edges_after_cuts.rs

@@ -0,0 +1,88 @@
+//! Straight edges stay one edge after many cuts (#1049). The owner's design
+//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
+//! joins and cuts, over four sketches, three of them on faces of the body with the faces'
+//! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
+//! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
+//! as many pieces, and a sketch on such a face projected every piece.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use serde_json::json;
+use solidcraft_engine::Session;
+use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
+use solidcraft_engine::geom::Vec3;
+
+fn design() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
+}
+
+fn open(path: &Path) -> Session {
+    let mut s = Session::default();
+    s.execute("doc.open", &json!({"path": path.to_string_lossy()})).unwrap_or_else(|e| panic!("{}: {e}", path.display()));
+    s
+}
+
+/// The design built from scratch: saved without cached geometry and opened again.
+fn rebuilt() -> Session {
+    let s = open(&design());
+    let dir = std::env::temp_dir().join(format!("solidcraft-straight-edges-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("crazy-geom-cuts.json");
+    let mut t = s.scratch();
+    t.execute("file.save", &json!({"path": path.to_string_lossy(), "format": "json"})).unwrap();
+    let out = open(&path);
+    let _ = std::fs::remove_dir_all(&dir);
+    out
+}
+
+fn errors(s: &Session) -> Vec<(u64, String)> {
+    s.model.results.iter().filter_map(|r| r.error.clone().map(|e| (r.id, e))).collect()
+}
+
+fn key(v: Vec3) -> [i64; 3] {
+    [v.x, v.y, v.z].map(|c| (c * 1e5).round() as i64)
+}
+
+#[test]
+fn straight_edges_are_one_edge_after_many_cuts() {
+    for (what, s) in [("as saved", open(&design())), ("built from scratch", rebuilt())] {
+        assert_eq!(errors(&s), vec![], "{what}: every feature evaluates");
+        let st = s.world_state();
+        let bodies: Vec<_> = st.bodies.iter().filter(|b| !b.body.is_mesh()).collect();
+        assert_eq!(bodies.len(), 1, "{what}: one body");
+        let body = &bodies[0].body;
+        let mesh = body.tessellate(0.01).unwrap();
+        // Every edge is drawn as one polyline; a straight one as one segment.
+        let mut at: HashMap<[i64; 3], Vec<usize>> = HashMap::new();
+        for (i, e) in mesh.edges.iter().enumerate() {
+            let (Some(a), Some(z)) = (e.first(), e.last()) else { panic!("{what}: edge {i} is empty") };
+            at.entry(key(*a)).or_default().push(i);
+            at.entry(key(*z)).or_default().push(i);
+        }
+        let straight = |i: usize| mesh.edges.get(i).filter(|e| e.len() == 2).and_then(|e| (e[1] - e[0]).normalized());
+        let split: Vec<_> = at
+            .iter()
+            .filter(|(_, es)| match es.as_slice() {
+                [a, b] => straight(*a).zip(straight(*b)).is_some_and(|(u, w)| u.dot(w).abs() > 1. - 1e-9),
+                _ => false,
+            })
+            .map(|(k, _)| k.map(|c| c as f64 / 1e5))
+            .collect();
+        assert_eq!(split, Vec::<[f64; 3]>::new(), "{what}: straight edges split where nothing else meets them");
+        // No two faces side by side in one plane.
+        let plane = |f: usize| match face_surface(body, f) {
+            Some(FaceSurface::Plane { normal, point }) => Some((normal, normal.dot(point))),
+            _ => None,
+        };
+        for (i, faces) in mesh.edge_faces.iter().enumerate() {
+            if let [a, b] = faces.as_slice()
+                && a != b
+                && let (Some((na, da)), Some((nb, db))) = (plane(*a as usize), plane(*b as usize))
+            {
+                assert!(na.dot(nb) < 1. - 1e-9 || (da - db).abs() > 1e-6, "{what}: faces {a} and {b} meet at edge {i} in one plane");
+            }
+        }
+        assert_eq!((body.face_count(), body.edge_count(), body.vertex_count()), (35, 107, 71), "{what}: faces, edges and vertices");
+    }
+}

apps/solidcraft-web/Cargo.toml

@@ -29,5 +29,5 @@ web-sys = { version = "0.3", features = [
     "Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "Location", "Navigator", "StorageManager",
     "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
     "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
-    "BeforeUnloadEvent", "Event", "EventTarget", "Response",
+    "BeforeUnloadEvent", "Event", "EventTarget", "Response", "MediaQueryList",
 ] }

apps/solidcraft-web/Trunk.toml

@@ -8,3 +8,9 @@ filehash = true
 [serve]
 addresses = ["127.0.0.1"]
 port = 8781
+
+# Offline use and updates: release builds get sw.js listing this build's files (xtask/src/web_offline.rs).
+[[hooks]]
+stage = "post_build"
+command = "cargo"
+command_arguments = ["xtask", "web-offline"]

apps/solidcraft-web/index.html

@@ -20,17 +20,31 @@
   <meta name="twitter:image" content="https://bherbruck.github.io/solidcraft/og.png">
   <meta name="twitter:image:alt" content="SolidCraft: open-source parametric CAD built in Rust">
   <link data-trunk rel="rust" data-bin="solidcraft-web" data-wasm-opt="z" data-weak-refs />
-  <link data-trunk rel="copy-file" href="fonts/BIZUDPGothic-Regular.ttf" data-target-path="fonts" />
-  <link data-trunk rel="copy-file" href="fonts/OFL.txt" data-target-path="fonts" />
-  <style>
-    html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: #e8ebf0; }
-    #solidcraft_canvas { position: absolute; inset: 0; width: 100%; height: 100%; display: block; }
-    #solidcraft_loading { position: absolute; inset: 0; display: flex; flex-direction: column; align-items: center; justify-content: center;
-      color: #4a5060; font: 14px system-ui, sans-serif; pointer-events: none; }
-  </style>
+  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/BIZUDPGothic-Regular.ttf" data-target-path="fonts" />
+  <link data-trunk rel="copy-file" href="../../assets/fonts/biz-udp-gothic/OFL.txt" data-target-path="fonts" />
+  <link data-trunk rel="css" href="../../assets/styles/web/loading.css" />
+  <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
+  <meta name="theme-color" content="#343840">
+  <link rel="manifest" href="manifest.webmanifest">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
+  <link data-trunk rel="copy-file" href="manifest.webmanifest" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
   <canvas id="solidcraft_canvas"></canvas>
   <div id="solidcraft_loading">Loading SolidCraft&hellip;</div>
+  <script>
+    // Offline use and updates (sw.js; written into release builds by `cargo xtask web-offline`).
+    if ("serviceWorker" in navigator) {
+      addEventListener("load", () => navigator.serviceWorker.register("sw.js").catch(() => {}));
+    }
+    // Install as an app: the browser's offer can come before the app runs, so it is kept here for
+    // the app's File ▸ Install app… item (src/install.rs). Installed, the browser makes no more offers.
+    addEventListener("beforeinstallprompt", (e) => { e.preventDefault(); window.solidcraftInstall = e; });
+    addEventListener("appinstalled", () => { window.solidcraftInstall = null; });
+  </script>
 </body>
 </html>

apps/solidcraft-web/manifest.webmanifest

@@ -0,0 +1,16 @@
+{
+  "name": "SolidCraft",
+  "short_name": "SolidCraft",
+  "description": "Open-source parametric CAD built in Rust.",
+  "start_url": "./",
+  "scope": "./",
+  "display": "standalone",
+  "background_color": "#e8ebf0",
+  "theme_color": "#343840",
+  "categories": ["productivity", "utilities"],
+  "icons": [
+    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+  ]
+}

apps/solidcraft-web/src/install.rs

@@ -0,0 +1,67 @@
+//! Install as an app (`solidcraft_ui_egui::install`). The browser offers it with a
+//! `beforeinstallprompt` event, which can come before this code runs: index.html keeps the event
+//! as `window.solidcraftInstall` (and drops it once the app is installed). The offer is good for
+//! one prompt; a browser that is still willing makes a new one later. Safari makes no offer: it
+//! gets its steps, unless the app is already running installed.
+
+use solidcraft_ui_egui::install::{InstallApp, Offer, safari_steps};
+use wasm_bindgen::{JsCast as _, JsValue};
+
+/// Where index.html keeps the browser's offer.
+const OFFER: &str = "solidcraftInstall";
+
+/// The browser's offer, kept by index.html (None: none, or it was used).
+fn offer() -> Option<js_sys::Object> {
+    let window = web_sys::window()?;
+    js_sys::Reflect::get(&window, &OFFER.into()).ok()?.dyn_into().ok()
+}
+
+/// Show the browser's install prompt (from the File menu click, so the page may).
+fn prompt() {
+    let Some(offer) = offer() else { return };
+    if let Some(window) = web_sys::window() {
+        let _ = js_sys::Reflect::set(&window, &OFFER.into(), &JsValue::NULL);
+    }
+    let shown = js_sys::Reflect::get(&offer, &"prompt".into())
+        .and_then(|f| f.dyn_into::<js_sys::Function>().map_err(JsValue::from))
+        .and_then(|f| f.call0(&offer))
+        .and_then(|p| p.dyn_into::<js_sys::Promise>().map_err(JsValue::from));
+    match shown {
+        // Accepted or dismissed, the browser handles it; a refusal is only logged.
+        Ok(p) => wasm_bindgen_futures::spawn_local(async move {
+            if let Err(e) = wasm_bindgen_futures::JsFuture::from(p).await {
+                log::warn!("install prompt: {e:?}");
+            }
+        }),
+        Err(e) => log::warn!("install prompt: {e:?}"),
+    }
+}
+
+/// The page runs as the installed app (its own window, or from the Home Screen on iOS).
+fn running_installed(window: &web_sys::Window) -> bool {
+    let standalone = window.match_media("(display-mode: standalone)").ok().flatten().is_some_and(|m| m.matches());
+    let home_screen = js_sys::Reflect::get(&window.navigator(), &"standalone".into()).ok().and_then(|v| v.as_bool()).unwrap_or(false);
+    standalone || home_screen
+}
+
+/// The host service for File ▸ Install app…; the UI is drawn again whenever the browser
+/// makes or withdraws its offer (even with nothing else happening).
+pub fn service(ctx: &egui::Context) -> InstallApp {
+    // Safari's steps, decided once: the browser and the way the page runs don't change.
+    let steps = web_sys::window().filter(|w| !running_installed(w)).and_then(|w| {
+        let nav = w.navigator();
+        let vendor = js_sys::Reflect::get(&nav, &"vendor".into()).ok().and_then(|v| v.as_string()).unwrap_or_default();
+        safari_steps(&nav.user_agent().unwrap_or_default(), &vendor, nav.max_touch_points())
+    });
+    if let Some(window) = web_sys::window() {
+        for event in ["beforeinstallprompt", "appinstalled"] {
+            let ctx = ctx.clone();
+            let redraw = wasm_bindgen::closure::Closure::<dyn FnMut()>::new(move || ctx.request_repaint());
+            let _ = window.add_event_listener_with_callback(event, redraw.as_ref().unchecked_ref());
+            // The listener lives as long as the page.
+            redraw.forget();
+        }
+    }
+    let offered = move || if offer().is_some() { Some(Offer::Prompt) } else { steps.map(Offer::Steps) };
+    InstallApp { offer: Box::new(offered), prompt: Box::new(prompt) }
+}

apps/solidcraft-web/src/main.rs

@@ -2,12 +2,14 @@
 //!
 //! Runs the same [`solidcraft_ui_egui::SolveApp`] as the desktop app through eframe's web runner
 //! (wgpu: WebGPU where available, WebGL2 otherwise). Build with `trunk build --release` from this
-//! directory (output in `dist/web`). URL flags: `?webgl` forces WebGL2, `?sample` opens the
-//! sample part.
+//! directory (output in `dist/web`). URL flags: `?webgl` forces WebGL2 (remembered until
+//! `?webgpu`), `?sample` opens the sample part.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 #[cfg(target_arch = "wasm32")]
 mod files;
+#[cfg(target_arch = "wasm32")]
+mod install;
 
 #[cfg(target_arch = "wasm32")]
 mod web {
@@ -73,6 +75,12 @@ mod web {
             if self.files.ctx.borrow().is_none() {
                 *self.files.ctx.borrow_mut() = Some(ctx.clone());
             }
+            // A ready picker answer is consumed in app.logic later in this frame. Keep
+            // incoming files queued until then so they cannot replace its target design.
+            if self.app.file_picker_busy() {
+                ctx.request_repaint();
+                return;
+            }
             files::flush(&self.files);
             for (text, error) in self.files.messages.borrow_mut().drain(..) {
                 self.app.set_status(text, error);
@@ -331,22 +339,34 @@ mod web {
                 };
                 if installed {
                     log::info!("loaded web CJK font from {JAPANESE_FONT_PATH}");
-                } else {
+                } else if solidcraft_ui_egui::fonts::needs_cjk_font(&self.app.preferences.language) {
                     log::warn!("CJK font unavailable; showing English for this session");
                 }
                 self.font.finished(installed, &mut self.app.preferences.language);
                 ctx.request_repaint();
             }
             if self.font.tick(&mut self.app.preferences.language) {
-                let slot = self.font_result.clone();
-                let ctx = ctx.clone();
-                wasm_bindgen_futures::spawn_local(async move {
-                    let res = fetch_font_bytes(JAPANESE_FONT_PATH).await;
-                    *slot.borrow_mut() = Some(res);
-                    ctx.request_repaint();
-                });
+                self.fetch_font(ctx);
             }
         }
+
+        /// CJK text on screen with no CJK font yet (an English UI showing a Japanese name):
+        /// fetch the font, so the text does not stay tofu (#720).
+        fn watch_text_for_font(&mut self, ctx: &egui::Context) {
+            if self.font.watching_text() && solidcraft_ui_egui::fonts::painted_cjk(ctx) && self.font.text_needs_font() {
+                self.fetch_font(ctx);
+            }
+        }
+
+        fn fetch_font(&self, ctx: &egui::Context) {
+            let slot = self.font_result.clone();
+            let ctx = ctx.clone();
+            wasm_bindgen_futures::spawn_local(async move {
+                let res = fetch_font_bytes(JAPANESE_FONT_PATH).await;
+                *slot.borrow_mut() = Some(res);
+                ctx.request_repaint();
+            });
+        }
     }
 
     impl eframe::App for Shell {
@@ -365,6 +385,7 @@ mod web {
             let ctx = ui.ctx().clone();
             self.file_panel(&ctx);
             self.recovery_prompt(&ctx);
+            self.watch_text_for_font(&ctx);
         }
         fn save(&mut self, storage: &mut dyn eframe::Storage) {
             // Persist the user's own language, not a session-only English fallback.
@@ -379,6 +400,29 @@ mod web {
         web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
     }
 
+    /// Where `?webgl` is remembered. The installed app starts from its manifest's start URL, which
+    /// has no query, so the choice has to outlive the page it was made on.
+    const WEBGL_KEY: &str = "solidcraft.webgl";
+
+    /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
+    fn webgl() -> bool {
+        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let q = query();
+        if q.contains("webgl") {
+            if let Some(s) = &storage {
+                let _ = s.set_item(WEBGL_KEY, "1");
+            }
+            return true;
+        }
+        if q.contains("webgpu") {
+            if let Some(s) = &storage {
+                let _ = s.remove_item(WEBGL_KEY);
+            }
+            return false;
+        }
+        storage.and_then(|s| s.get_item(WEBGL_KEY).ok().flatten()).is_some()
+    }
+
     /// Fetch font bytes asynchronously through the browser.
     async fn fetch_font_bytes(url: &str) -> Result<Vec<u8>, String> {
         let window = web_sys::window().ok_or("no window")?;
@@ -403,7 +447,7 @@ mod web {
                 return;
             };
             let mut options = eframe::WebOptions { depth_buffer: DEPTH_BITS, ..Default::default() };
-            if query().contains("webgl")
+            if webgl()
                 && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
             {
                 create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
@@ -421,13 +465,14 @@ mod web {
                             // Open shows the browser's files (and the computer's, from there).
                             pick_open: Some(Box::new(move || {
                                 panel.panel.set(true);
-                                None
+                                Box::pin(std::future::ready(None))
                             })),
                             // Designs are kept in the browser; everything else is downloaded.
                             pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
                                 let design = exts.contains(&solidcraft_engine::io::DESIGN_EXT);
-                                Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))
+                                Box::pin(std::future::ready(Some(format!("{}{name}", if design { files::OPFS } else { files::DOWNLOADS }))))
                             })),
+                            install_app: Some(crate::install::service(&cc.egui_ctx)),
                             ..Default::default()
                         };
                         let mut app = SolveApp::new(Session::default(), services);
@@ -446,6 +491,9 @@ mod web {
                             app.session.mark_saved();
                         }
                         if !query().contains("sample") {
+                            // The empty design takes Units of new designs (#1205). The sample
+                            // part is built in millimetres and is left that way.
+                            solidcraft_ui_egui::prefs::apply_new_design(&mut app);
                             let rev = app.session.revision;
                             app.home.show(rev);
                         }

apps/solidcraft-web/sw.js

@@ -0,0 +1,227 @@
+// SolidCraft's service worker: the web app keeps working offline and updates itself.
+//
+// `cargo xtask web-offline` (Trunk's post_build hook) writes the build into the line below: the
+// version (workspace version + a hash of every built file) and the files to keep, each with its
+// SHA-256, and the same as `build.json` next to it. Files the app only fetches when it needs
+// them (the CJK font) aren't kept: they come from the network. Every download is checked
+// against its SHA-256: a deployment that lands mid-download (another build's `index.html`) fails
+// the download instead of mixing into the kept build. A new build changes this file, so the
+// browser installs the new worker, which keeps the whole new build before taking over.
+//
+// A launch only ever starts a build whose every file is kept, so a half-downloaded update can't
+// break it. It asks for `build.json` (waiting at most NAVIGATE_TIMEOUT_MS): offline, slow or
+// unchanged, the kept build starts; when a new build is deployed, it is downloaded first
+// (waiting at most UPDATE_TIMEOUT_MS; the download goes on in the background after that) and
+// started. When the site has no `build.json` (the app was removed), launches go to the network,
+// the kept build answering when that fails. Each page then gets its files from the build it
+// started (remembered in PAGES), never from another build with a file of the same name.
+//
+// A cache is only deleted when nothing uses it: a download holds its lock (Web Locks, shared,
+// in any tab or worker; the browser releases it when the download ends or its worker stops), and
+// an open page uses the build it started. Then unfinished downloads are dropped, and so are
+// builds replaced by a newer worker (RETIRED). The origin is shared with other apps (github.io)
+// and other copies of this one (the release zip works from any path): only caches named after
+// this worker's path (CACHE_PREFIX…, PAGES) are ever touched.
+//
+// Unbuilt (VERSION "dev", as debug builds get it), the worker retires: it drops what a release
+// build kept and unregisters, so `trunk serve` after `trunk serve --release --no-autoreload`
+// shows the development build. Deploying this file unbuilt switches the worker off for everyone.
+/* @build */ const VERSION = "dev", FILES = [];
+const RETIRE = VERSION === "dev";
+
+const PATH = new URL(self.registration.scope).pathname;
+const CACHE_PREFIX = `solidcraft-app ${PATH} `;
+const CACHE = CACHE_PREFIX + VERSION;
+/** Which build each open page started: page id → cache name (or NETWORK). */
+const PAGES = `solidcraft-app-pages ${PATH}`;
+/** A page that came from the network gets its files from there too. */
+const NETWORK = "network";
+const NAVIGATE_TIMEOUT_MS = 4000;
+const UPDATE_TIMEOUT_MS = 20000;
+/** The entry that marks a cache as holding its whole build. */
+const COMPLETE = "build-complete";
+/** The entry that marks a build replaced by a newer worker. */
+const RETIRED = "build-retired";
+/** A page remembered this recently may still be loading (not yet listed among the clients). */
+const PAGE_LOADING_MS = 30 * 1000;
+
+const url = (file) => new URL(file, self.registration.scope).href;
+const has = (name, entry) => caches.match(url(entry), { cacheName: name }).then(Boolean);
+
+/** Run `fn` while using the cache `name`: it isn't deleted meanwhile. */
+const using = (name, fn) => navigator.locks.request(name, { mode: "shared" }, fn);
+
+/** Delete the cache `name` if nothing is using it and `unwanted()` (asked once no one can start to) agrees. */
+const drop = (name, unwanted) =>
+  navigator.locks.request(name, { ifAvailable: true }, async (free) => free && (await unwanted()) && caches.delete(name));
+
+const hex = (buffer) => Array.from(new Uint8Array(buffer), (b) => b.toString(16).padStart(2, "0")).join("");
+
+/**
+ * Keep every file of a build (an earlier partial download is resumed); resolves to its cache's
+ * name. The first file that fails cancels the others.
+ */
+function keep(version, files) {
+  const name = CACHE_PREFIX + version;
+  return using(name, async () => {
+    const cache = await caches.open(name);
+    await cache.delete(url(RETIRED)); // Back in use (a rollback).
+    if (await has(name, COMPLETE)) return name;
+    const cancel = new AbortController();
+    const results = await Promise.allSettled(
+      files.map(async ({ file, sha256 }) => {
+        try {
+          if (await cache.match(url(file))) return;
+          // `no-cache`: revalidate with the server, so a stale HTTP-cached page never mixes builds.
+          const response = await fetch(new Request(url(file), { cache: "no-cache" }), { signal: cancel.signal });
+          if (!response.ok) throw new Error(`${file}: HTTP ${response.status}`);
+          const body = await response.arrayBuffer();
+          if (hex(await crypto.subtle.digest("SHA-256", body)) !== sha256) throw new Error(`${file}: not this build's`);
+          await cache.put(url(file), new Response(body, { headers: response.headers }));
+        } catch (error) {
+          cancel.abort();
+          throw error;
+        }
+      }),
+    );
+    const failed = results.find((r) => r.status === "rejected");
+    if (failed) throw failed.reason;
+    await cache.put(url(COMPLETE), new Response(version));
+    return name;
+  });
+}
+
+const pageEntry = (id) => url(`~page/${encodeURIComponent(id)}`);
+
+/** Remember which build a page started. */
+async function started(id, build) {
+  if (!id) return;
+  const record = JSON.stringify({ build, at: Date.now() });
+  await (await caches.open(PAGES)).put(pageEntry(id), new Response(record));
+}
+
+/** The build a page started; a page started before it was remembered gets this worker's. */
+async function startedBy(id) {
+  const response = id ? await caches.match(pageEntry(id), { cacheName: PAGES }) : null;
+  return response ? (await response.json()).build : CACHE;
+}
+
+/** The builds open pages use (pages closed since are forgotten). */
+async function inUse() {
+  const open = new Set((await self.clients.matchAll({ includeUncontrolled: true })).map((c) => c.id));
+  const pages = await caches.open(PAGES);
+  const builds = new Set();
+  for (const request of await pages.keys()) {
+    const id = decodeURIComponent(request.url.split("~page/")[1] ?? "");
+    const record = await pages.match(request).then((r) => r?.json()).catch(() => null);
+    if (record && (open.has(id) || Date.now() - record.at < PAGE_LOADING_MS)) builds.add(record.build);
+    else await pages.delete(request);
+  }
+  return builds;
+}
+
+/** Drop unfinished downloads nothing is using, and replaced builds no open page uses. */
+async function sweep() {
+  for (const name of await caches.keys()) {
+    if (!name.startsWith(CACHE_PREFIX) || name === CACHE) continue;
+    await drop(name, async () => !(await has(name, COMPLETE)) || ((await has(name, RETIRED)) && !(await inUse()).has(name)));
+  }
+}
+
+self.addEventListener("install", (event) => {
+  // Clean up first: a page open for days sees updates (and failed ones) without any launch.
+  const install = () => sweep().catch(() => {}).then(() => keep(VERSION, FILES));
+  event.waitUntil(RETIRE ? self.skipWaiting() : install().then(() => self.skipWaiting()));
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    (async () => {
+      if (RETIRE) {
+        for (const name of await caches.keys()) if (name.startsWith(CACHE_PREFIX) || name === PAGES) await caches.delete(name);
+        return self.registration.unregister();
+      }
+      for (const name of await caches.keys()) {
+        if (name.startsWith(CACHE_PREFIX) && name !== CACHE) await (await caches.open(name)).put(url(RETIRED), new Response(""));
+      }
+      await sweep();
+      await self.clients.claim();
+    })(),
+  );
+});
+
+/** The promise's value, or null when it fails or takes longer than `ms`. */
+function within(ms, promise) {
+  return Promise.race([promise.catch(() => null), new Promise((resolve) => setTimeout(resolve, ms, null))]);
+}
+
+/** No app is deployed here any more (the server says `build.json` doesn't exist). */
+const GONE = "gone";
+
+/** The deployed build's version and files, GONE, or null (unknown: offline, failing, invalid). */
+async function deployed() {
+  const response = await fetch(url("build.json"), { cache: "no-cache" });
+  if (response.status === 404 || response.status === 410) return GONE;
+  const build = response.ok ? await response.json() : null;
+  const valid = build && typeof build.version === "string" && Array.isArray(build.files);
+  return valid && build.files.every((f) => typeof f.file === "string" && typeof f.sha256 === "string") ? build : null;
+}
+
+/** Keep the worker alive for `promise` (allowed while the launch is being answered). */
+function extend(event, promise) {
+  try {
+    event.waitUntil(promise.catch(() => {}));
+  } catch {
+    // The event has ended; the work goes on while the worker runs.
+  }
+}
+
+/** A launch: the start page of a complete build (whatever query the URL has: `?sample`), and that build. */
+async function launch(event) {
+  const kept = await caches.match(url("index.html"), { cacheName: CACHE });
+  if (!kept) return [await fetch(event.request), NETWORK]; // Nothing kept yet (the first visit).
+  extend(event, sweep());
+  const build = await within(NAVIGATE_TIMEOUT_MS, deployed());
+  if (build === GONE) {
+    const page = await fetch(event.request).catch(() => null);
+    return page && page.ok ? [page, NETWORK] : [kept, CACHE];
+  }
+  if (!build || build.version === VERSION) return [kept, CACHE];
+  const download = keep(build.version, build.files);
+  extend(event, download);
+  const name = await within(UPDATE_TIMEOUT_MS, download);
+  const page = name && (await caches.match(url("index.html"), { cacheName: name }));
+  return page ? [page, name] : [kept, CACHE];
+}
+
+/**
+ * A launch that fails unexpectedly still starts the kept build (or asks the network). A newer
+ * worker only takes over once the launch has ended, by when its page is remembered (in use).
+ */
+async function launchOrKept(event) {
+  let page, build;
+  try {
+    [page, build] = await launch(event);
+  } catch {
+    page = await caches.match(url("index.html"), { cacheName: CACHE }).catch(() => null);
+    build = page ? CACHE : NETWORK;
+    page = page || (await fetch(event.request));
+  }
+  await started(event.resultingClientId, build).catch(() => {});
+  return page;
+}
+
+/** A page's files come from the build it started, else the network. */
+async function asset(event) {
+  const build = await startedBy(event.clientId).catch(() => CACHE);
+  const kept = build === NETWORK ? null : await caches.match(event.request, { cacheName: build, ignoreSearch: true });
+  return kept || fetch(event.request);
+}
+
+self.addEventListener("fetch", (event) => {
+  const request = event.request;
+  if (RETIRE || request.method !== "GET" || new URL(request.url).origin !== self.location.origin) return;
+  const path = request.url.split(/[?#]/)[0];
+  const start = request.mode === "navigate" && (path === url("") || path === url("index.html"));
+  event.respondWith(start ? launchOrKept(event) : asset(event));
+});

apps/solidcraft/Cargo.toml

@@ -7,8 +7,18 @@ license.workspace = true
 publish = false
 default-run = "solidcraft"
 
-[lints]
-workspace = true
+# The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
+# (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
+# (Windows resize border) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+dbg_macro = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+type_complexity = "allow"
+neg_cmp_op_on_partial_ord = "allow"
 
 [dependencies]
 solidcraft-engine = { workspace = true }
@@ -18,12 +28,47 @@ egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
+# Checks eframe's settings file (app.ron) before eframe reads it (src/startup.rs).
+ron = "0.12"
+# Waits for wgpu's adapter list when choosing the graphics backend before the window opens.
+pollster = { workspace = true }
+getrandom = "0.3"
+# The update check (docs/updates.md): HTTPS with rustls, certificates from the operating system.
+ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "platform-verifier"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
+# API keys of the agent chat's API agents (docs/agent-chat.md) live in the system keychain:
+# Keychain on macOS, Credential Manager on Windows, the Secret Service (pure-Rust D-Bus) elsewhere.
+keyring = { version = "3.6", default-features = false, features = ["apple-native", "windows-native", "async-secret-service", "async-io", "crypto-rust"] }
 
 [target.'cfg(any(target_os = "windows", target_os = "linux"))'.dependencies]
 quick-xml = { workspace = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 hidapi = { version = "2.6.7", default-features = false, features = ["windows-native"] }
+# The main window's handle for src/native_frame.rs (already in the tree through eframe and winit).
+raw-window-handle = "0.6"
+# Native crash capture (src/native_crash.rs): the exception filter, the faulting module, a minidump.
+# The window's resize border and DPI size (src/native_frame.rs): the window procedure, hit test, DPI.
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_Security",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Diagnostics_Debug",
+    "Win32_System_IO",
+    "Win32_System_Kernel",
+    "Win32_System_LibraryLoader",
+    "Win32_System_Memory",
+    "Win32_System_Threading",
+    "Win32_UI_HiDpi",
+    "Win32_UI_WindowsAndMessaging",
+] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+# Files opened from Finder and the Dock (src/open_documents.rs); all already come with eframe and rfd.
+objc2 = "0.6"
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder"] }
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+block2 = "0.6"
 
 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }

apps/solidcraft/build.rs

@@ -1,61 +1,17 @@
 #![forbid(unsafe_code)]
-#[path = "../app_icon.rs"]
-mod app_icon;
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    println!("cargo:rerun-if-changed=../app_icon.rs");
+    let icon = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../assets/icons/app/windows/exports/solidcraft-executable.ico");
+    println!("cargo:rerun-if-changed={}", icon.display());
     println!("cargo:rerun-if-changed=build.rs");
     if std::env::var("CARGO_CFG_TARGET_OS")? != "windows" {
         return Ok(());
     }
     let out = std::path::PathBuf::from(std::env::var_os("OUT_DIR").ok_or("missing OUT_DIR")?);
-    let sizes = [16usize, 24, 32, 48, 64, 128, 256];
-    let mut images = Vec::new();
-    for size in sizes {
-        let rgba = app_icon::rgba(size)?;
-        // ICO DIB: bottom-up BGRA plus a padded one-bit transparency mask.
-        let mask_stride = size.div_ceil(32) * 4;
-        let mut dib = Vec::new();
-        dib.extend_from_slice(&40u32.to_le_bytes());
-        dib.extend_from_slice(&(size as i32).to_le_bytes());
-        dib.extend_from_slice(&((size * 2) as i32).to_le_bytes());
-        dib.extend_from_slice(&1u16.to_le_bytes());
-        dib.extend_from_slice(&32u16.to_le_bytes());
-        dib.extend_from_slice(&[0; 24]);
-        for row in rgba.chunks_exact(size * 4).rev() {
-            for p in row.as_chunks::<4>().0.iter() {
-                dib.extend_from_slice(&[p[2], p[1], p[0], p[3]]);
-            }
-        }
-        for row in rgba.chunks_exact(size * 4).rev() {
-            let mut mask = vec![0u8; mask_stride];
-            for (x, p) in row.as_chunks::<4>().0.iter().enumerate() {
-                if p[3] == 0 {
-                    mask[x / 8] |= 0x80 >> (x % 8);
-                }
-            }
-            dib.extend_from_slice(&mask);
-        }
-        images.push((size, dib));
-    }
-    let mut ico = vec![0, 0, 1, 0];
-    ico.extend_from_slice(&(images.len() as u16).to_le_bytes());
-    let mut offset = 6 + 16 * images.len();
-    for (size, data) in &images {
-        let dim = if *size == 256 { 0 } else { *size as u8 };
-        ico.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
-        ico.extend_from_slice(&(data.len() as u32).to_le_bytes());
-        ico.extend_from_slice(&(offset as u32).to_le_bytes());
-        offset += data.len();
-    }
-    for (_, data) in images {
-        ico.extend_from_slice(&data);
-    }
-    let icon = out.join("solidcraft.ico");
-    std::fs::write(&icon, ico)?;
+    let copy = out.join("solidcraft.ico");
+    std::fs::copy(icon, &copy)?;
     let rc = out.join("solidcraft.rc");
-    std::fs::write(&rc, format!("1 ICON \"{}\"\n", icon.display().to_string().replace('\\', "/")))?;
-    // Missing resource tools are a build error, rather than silently shipping a generic icon.
+    std::fs::write(&rc, format!("1 ICON \"{}\"\n", copy.display().to_string().replace('\\', "/")))?;
     embed_resource::compile_for(&rc, ["solidcraft"], embed_resource::NONE).manifest_required()?;
     Ok(())
 }

apps/solidcraft/src/control_server.rs

@@ -9,26 +9,89 @@ use std::time::Duration;
 
 use serde_json::{Value, json};
 use solidcraft_engine::MAX_LINE;
+use solidcraft_engine::control_auth;
 use solidcraft_ui_egui::ControlRequest;
 
-/// Connections served at once. The channel has no authentication beyond being bound to
-/// loopback, so a flood must not be able to spawn threads without end.
+/// Connections served at once, so a flood must not be able to spawn threads without end.
 const MAX_CONNECTIONS: usize = 16;
 /// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
 const MAX_BAD_LINES: usize = 8;
 
 static OPEN: AtomicUsize = AtomicUsize::new(0);
+/// The token files this launch wrote (its `--control` port, the agent chat's endpoint), removed
+/// when the app ends.
+static TOKEN_FILES: std::sync::Mutex<Vec<std::path::PathBuf>> = std::sync::Mutex::new(Vec::new());
+
+/// A new random token: 32 bytes from the operating system, as hex.
+fn new_token() -> Option<String> {
+    let mut bytes = [0u8; 32];
+    getrandom::fill(&mut bytes).ok()?;
+    Some(bytes.iter().map(|b| format!("{b:02x}")).collect())
+}
+
+/// Remove this launch's token file (at exit).
+pub fn remove_token_file() {
+    if let Ok(files) = TOKEN_FILES.lock() {
+        for p in files.iter() {
+            let _ = std::fs::remove_file(p);
+        }
+    }
+}
 
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = channel::<ControlRequest>();
+    // Every connection must show the token before anything runs (docs/control-protocol.md).
+    match control_auth::env_token().or_else(new_token) {
+        Some(token) => {
+            listen(port, token, tx, ctx, false);
+        }
+        None => eprintln!("solidcraft: control server not started: no random token available"),
+    }
+    rx
+}
+
+/// The agent chat's own endpoint for its agent's MCP server (docs/agent-chat.md): a free loopback
+/// port with a fresh token of its own (never `SOLIDCRAFT_CONTROL_TOKEN`), written to the usual
+/// token file, where the MCP server finds it, so the token never passes through the agent. Its
+/// requests go to `tx`, where the chat's gate reads them; one may wait long for the user's Allow.
+pub fn listen_agent(tx: Sender<ControlRequest>, ctx: egui::Context) -> Option<u16> {
+    let Some(token) = new_token() else {
+        eprintln!("solidcraft: agent chat endpoint not started: no random token available");
+        return None;
+    };
+    listen(0, token, tx, ctx, true)
+}
+
+/// Listen on `port` (0: a free port the system picks) with `token`; the port it listens on.
+/// `patient`: every request may wait as long as a batch (a person decides on it).
+fn listen(port: u16, token: String, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) -> Option<u16> {
     let listener = match TcpListener::bind(("127.0.0.1", port)) {
         Ok(l) => l,
         Err(e) => {
             eprintln!("solidcraft: control server failed to bind 127.0.0.1:{port}: {e}");
-            return rx;
+            return None;
         }
     };
-    eprintln!("solidcraft: control server listening on 127.0.0.1:{port}");
+    let port = listener.local_addr().map(|a| a.port()).unwrap_or(port);
+    match control_auth::token_path(port) {
+        Some(path) => match control_auth::write_token_file(&path, &token) {
+            Ok(()) => {
+                eprintln!("solidcraft: control server listening on 127.0.0.1:{port} (token in {})", path.display());
+                if let Ok(mut files) = TOKEN_FILES.lock() {
+                    files.push(path);
+                }
+            }
+            Err(e) => eprintln!(
+                "solidcraft: control server listening on 127.0.0.1:{port}, but its token file {} could not be written ({e}); \
+                 clients need SOLIDCRAFT_CONTROL_TOKEN",
+                path.display()
+            ),
+        },
+        None => {
+            eprintln!("solidcraft: control server listening on 127.0.0.1:{port}; no data folder for its token, clients need SOLIDCRAFT_CONTROL_TOKEN")
+        }
+    }
+    let token = std::sync::Arc::new(token);
     std::thread::spawn(move || {
         for stream in listener.incoming().flatten() {
             if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
@@ -39,13 +102,14 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
             }
             let tx = tx.clone();
             let ctx = ctx.clone();
+            let token = token.clone();
             std::thread::spawn(move || {
-                serve(stream, tx, ctx);
+                serve(stream, &token, tx, ctx, patient);
                 OPEN.fetch_sub(1, Ordering::Relaxed);
             });
         }
     });
-    rx
+    Some(port)
 }
 
 /// One line without its newline, or `None` at the end of the stream. A client that sends
@@ -80,11 +144,28 @@ fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>
     }
 }
 
-fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
+/// The reply to a connection that didn't show the token; the connection is then closed.
+fn unauthorized() -> Value {
+    json!({"ok": false, "error": "unauthorized: send the control token as \"token\" (see docs/control-protocol.md)"})
+}
+
+/// Refuse the connection: the reply, then the end of what we send, then what the client had
+/// already sent read and dropped (a little, briefly). Closing a socket with unread input resets
+/// the connection, and a reset can reach the client before it has read the refusal.
+fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
+    use std::io::Read;
+    let _ = writeln!(out, "{}", unauthorized());
+    let _ = out.shutdown(std::net::Shutdown::Write);
+    let _ = reader.get_ref().set_read_timeout(Some(Duration::from_millis(500)));
+    let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
     let Ok(read) = stream.try_clone() else { return };
     let mut out = stream;
     let mut reader = BufReader::new(read);
     let mut bad = 0usize;
+    let mut authenticated = false;
     loop {
         let line = match read_line(&mut reader, MAX_LINE) {
             Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
@@ -99,20 +180,36 @@ fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
         }
         let reply = match serde_json::from_str::<Value>(&line) {
             Ok(msg) => {
+                // The first request must carry the token; later ones on the same connection may.
+                if !authenticated {
+                    match msg.get("token").and_then(Value::as_str) {
+                        Some(t) if control_auth::tokens_match(t, token) => authenticated = true,
+                        _ => {
+                            refuse(&mut out, &mut reader);
+                            break;
+                        }
+                    }
+                }
                 let id = msg.get("id").cloned().unwrap_or(Value::Null);
                 let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                 let params = msg.get("params").cloned().unwrap_or(json!({}));
+                // A batch replaces many short requests: the whole of it may take long (#743).
+                let wait = Duration::from_secs(if patient || method == "engine.batch" { 3600 } else { 60 });
                 let (req, rrx) = ControlRequest::new(method, params);
                 if tx.send(req).is_err() {
                     break;
                 }
                 ctx.request_repaint();
-                let mut r = rrx.recv_timeout(Duration::from_secs(60)).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"}));
+                let mut r = rrx.recv_timeout(wait).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"}));
                 if let Some(o) = r.as_object_mut() {
                     o.insert("id".into(), id);
                 }
                 r
             }
+            Err(_) if !authenticated => {
+                refuse(&mut out, &mut reader);
+                break;
+            }
             Err(e) => {
                 bad += 1;
                 json!({"ok": false, "error": format!("bad JSON: {e}")})
@@ -131,6 +228,62 @@ fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
 mod tests {
     use super::*;
 
+    /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
+    /// missing token, or garbage, is refused and the connection closed. Once shown, the token
+    /// need not be repeated on that connection.
+    #[test]
+    fn requests_run_only_after_the_token() {
+        use std::io::Read;
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let ran = std::sync::Arc::new(std::sync::Mutex::new(Vec::<String>::new()));
+        let seen = ran.clone();
+        std::thread::spawn(move || {
+            for req in rx {
+                seen.lock().unwrap().push(req.method.clone());
+                let _ = req.reply.send(json!({"ok": true, "result": null}));
+            }
+        });
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve(stream, token, tx, egui::Context::default(), false));
+            }
+        });
+        let session = |lines: &[String]| {
+            let mut s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            for l in lines {
+                let _ = writeln!(s, "{l}");
+            }
+            let _ = s.shutdown(std::net::Shutdown::Write);
+            let mut text = String::new();
+            let _ = s.read_to_string(&mut text);
+            text.lines().map(|l| serde_json::from_str::<Value>(l).unwrap()).collect::<Vec<_>>()
+        };
+        for first in [
+            json!({"id": 1, "method": "app.quit", "params": {"force": true}}).to_string(),
+            json!({"id": 1, "method": "app.quit", "token": "0123456789abcdef0123456789abcdee"}).to_string(),
+            json!({"id": 1, "method": "app.quit", "token": "0123"}).to_string(),
+            json!({"id": 1, "method": "app.quit", "token": 7}).to_string(),
+            "not json".to_string(),
+        ] {
+            let replies = session(&[first.clone(), json!({"id": 2, "method": "app.quit", "token": token}).to_string()]);
+            assert_eq!(replies.len(), 1, "{first}: closed after refusing: {replies:?}");
+            assert!(replies[0]["error"].as_str().is_some_and(|e| e.starts_with("unauthorized")), "{first}: {replies:?}");
+        }
+        assert!(ran.lock().unwrap().is_empty(), "nothing ran without the token");
+        let replies = session(&[
+            json!({"id": 1, "method": "ui.inspect", "token": token}).to_string(),
+            json!({"id": 2, "method": "engine.commands"}).to_string(),
+        ]);
+        assert_eq!(replies.len(), 2, "{replies:?}");
+        assert!(replies.iter().all(|r| r["ok"] == true), "{replies:?}");
+        assert_eq!(*ran.lock().unwrap(), ["ui.inspect", "engine.commands"]);
+    }
+
     /// A request longer than the cap is refused instead of allocated.
     #[test]
     fn lines_past_the_cap_are_refused() {

apps/solidcraft/src/main.rs

@@ -1,6 +1,9 @@
 //! SolidCraft desktop app.
 //!
-//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [design.solidcraft | part.step]`
+//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]`
+//!
+//! `--safe-mode` (or `SOLIDCRAFT_SAFE_MODE=1`) starts with default settings, no recovery offer and
+//! the software renderer; see `startup` and docs/book/src/guide/troubleshooting.md.
 //!
 //! A `.step`/`.stp` file opens as a new design holding the file's bodies (an Import feature); a
 //! `.3mf`/`.stl` file as a new design holding mesh bodies.
@@ -10,26 +13,48 @@
 //! See `solidcraft_ui_egui::control` and docs/control-protocol.md.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-#![forbid(unsafe_code)]
+#![deny(unsafe_code)]
 
 #[cfg(not(target_os = "macos"))]
-#[path = "../../app_icon.rs"]
+#[path = "../../../assets/icons/app/shared/source/app_icon.rs"]
 mod app_icon;
 mod control_server;
+#[cfg(target_os = "windows")]
+mod native_crash;
+#[cfg(target_os = "windows")]
+mod native_frame;
+#[cfg(target_os = "macos")]
+mod open_documents;
 #[cfg(any(target_os = "windows", target_os = "linux"))]
 mod space_mouse;
+mod startup;
 
 use solidcraft_engine::{Session, io};
 use solidcraft_ui_egui::{Services, SolveApp};
 
 struct App {
     solve: SolveApp,
+    /// The settings folder whose start marker the first frame clears (`startup::started`).
+    starting: Option<std::path::PathBuf>,
+    /// Frames begun; the second one means the first was drawn (startup is over).
+    frames: u32,
     #[cfg(any(target_os = "windows", target_os = "linux"))]
     space_mouse: space_mouse::SpaceMouse,
 }
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if self.frames < 2 {
+            self.frames += 1;
+            // A second frame right away, which means the first was presented: the app is up.
+            ctx.request_repaint();
+            if self.frames == 2 {
+                solidcraft_engine::crash::phase(solidcraft_engine::crash::RUNNING);
+                if let Some(dir) = self.starting.take() {
+                    startup::started(&dir);
+                }
+            }
+        }
         // The design on screen is the one whose commands a crash report replays.
         self.solve.session.crash_journal = solidcraft_engine::crash::enabled();
         // The OS closing the window (Alt+F4, Cmd+Q, the window manager): ask about unsaved
@@ -38,9 +63,15 @@ impl eframe::App for App {
             ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
             solidcraft_ui_egui::documents::request_quit(&mut self.solve);
         }
+        #[cfg(target_os = "macos")]
+        for f in if self.solve.file_picker_busy() { Vec::new() } else { open_documents::take() } {
+            self.solve.open_path_async(&f);
+        }
         self.solve.logic(ctx);
         #[cfg(any(target_os = "windows", target_os = "linux"))]
-        self.space_mouse.tick(&mut self.solve, ctx);
+        if !self.solve.file_picker_busy() {
+            self.space_mouse.tick(&mut self.solve, ctx);
+        }
         if self.solve.quit_requested {
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
         }
@@ -55,15 +86,27 @@ impl eframe::App for App {
         storage.set_string(solidcraft_ui_egui::prefs::STORAGE_KEY, self.solve.prefs());
     }
     fn on_exit(&mut self) {
+        // The agent chat's agent and everything it started end with the app.
+        solidcraft_ui_egui::agent_chat::shutdown(&mut self.solve);
         solidcraft_ui_egui::recovery_ui::close(&mut self.solve);
         solidcraft_engine::crash::end_session();
+        // An update asked to restart into the new version or to run its installer.
+        if let Some((program, args)) = solidcraft_ui_egui::update::take_launch(&mut self.solve)
+            && let Err(e) = std::process::Command::new(&program).args(&args).spawn()
+        {
+            log::error!("update: starting {}: {e}", program.display());
+        }
     }
 }
 
-fn services() -> Services {
+fn services(cc: &eframe::CreationContext<'_>) -> Services {
+    let parent = rfd::AsyncFileDialog::new().set_parent(cc);
+    let open_parent = parent.clone();
+    let program_parent = parent.clone();
     Services {
-        pick_open: Some(Box::new(|| {
-            rfd::FileDialog::new()
+        pick_open: Some(Box::new(move || {
+            let future = open_parent
+                .clone()
                 .add_filter(
                     "Designs, STEP, IGES and meshes",
                     &[
@@ -90,11 +133,17 @@ fn services() -> Services {
                 .add_filter("Mesh (3MF, STL)", &["3mf", "3MF", "stl", "STL"])
                 .add_filter("Sketch drawings (DXF, SVG)", &["dxf", "DXF", "svg", "SVG"])
                 .add_filter("All files", &["*"])
-                .pick_file()
-                .map(|p| p.to_string_lossy().to_string())
+                .pick_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
         })),
-        pick_save: Some(Box::new(|name: &str, exts: &[&str]| {
-            let dialog = rfd::FileDialog::new().set_file_name(name);
+        pick_program: Some(Box::new(move || {
+            let dialog = program_parent.clone().set_title("Choose your slicer");
+            let dialog = if cfg!(target_os = "windows") { dialog.add_filter("Programs", &["exe"]) } else { dialog };
+            let future = dialog.pick_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+        })),
+        pick_save: Some(Box::new(move |name: &str, exts: &[&str]| {
+            let dialog = parent.clone().set_file_name(name);
             let dialog = if exts == [io::DESIGN_EXT, "json"] {
                 if name.ends_with(".json") {
                     dialog.add_filter("Plain JSON design", &["json"]).add_filter("SolidCraft container", &[io::DESIGN_EXT])
@@ -104,9 +153,16 @@ fn services() -> Services {
             } else {
                 dialog.add_filter("File", exts)
             };
-            dialog.save_file().map(|p| p.to_string_lossy().to_string())
+            let future = dialog.save_file();
+            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
         })),
         graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
+        http_get: Some(std::sync::Arc::new(http_get)),
+        http_download: Some(std::sync::Arc::new(http_download)),
+        // Already an installed app: only the browser build offers to install.
+        install_app: None,
+        agent_http: Some(std::sync::Arc::new(agent_http)),
+        secrets: Some(std::sync::Arc::new(Keychain)),
         show_in_folder: Some(Box::new(|path| {
             let folder = std::path::Path::new(path).parent().unwrap_or_else(|| std::path::Path::new("."));
             let mut command = std::process::Command::new(if cfg!(target_os = "windows") {
@@ -127,6 +183,144 @@ fn services() -> Services {
     }
 }
 
+/// HTTPS GET for the update check (docs/updates.md): certificates from the operating system, a
+/// 15 s limit, at most 1 MB, and no headers beyond what GitHub requires (a User-Agent without
+/// the version or anything about this machine, and the API's media type).
+fn http_get(url: &str) -> Result<Vec<u8>, solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    let mut response = http_call(url, std::time::Duration::from_secs(15))?;
+    response.body_mut().with_config().limit(1 << 20).read_to_vec().map_err(|e| FetchError::Failed(e.to_string()))
+}
+
+/// HTTPS download of an update package to `to` (docs/updates.md), reporting progress; stops when
+/// `progress` returns false. The caller verifies the file.
+fn http_download(url: &str, to: &std::path::Path, progress: &dyn Fn(u64, Option<u64>) -> bool) -> Result<(), solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    use std::io::{Read, Write};
+    let fail = |e: String| FetchError::Failed(e);
+    let mut response = http_call(url, std::time::Duration::from_secs(30 * 60))?;
+    let total = response.headers().get("content-length").and_then(|v| v.to_str().ok()).and_then(|v| v.parse::<u64>().ok());
+    let mut body = response.body_mut().with_config().limit(solidcraft_ui_egui::update::install::MAX_PACKAGE).reader();
+    let mut file = std::fs::File::create(to).map_err(|e| fail(format!("{}: {e}", to.display())))?;
+    let mut buf = vec![0u8; 1 << 16];
+    let mut done = 0u64;
+    loop {
+        let n = body.read(&mut buf).map_err(|e| fail(e.to_string()))?;
+        if n == 0 {
+            break;
+        }
+        file.write_all(buf.get(..n).unwrap_or_default()).map_err(|e| fail(format!("{}: {e}", to.display())))?;
+        done += n as u64;
+        if !progress(done, total) {
+            return Err(fail("cancelled".into()));
+        }
+    }
+    file.sync_all().map_err(|e| fail(format!("{}: {e}", to.display())))?;
+    Ok(())
+}
+
+/// HTTP for the agent chat's API agents (OpenAI-compatible endpoints, docs/agent-chat.md): to the
+/// URL the user configured, which may be plain HTTP on this computer (Ollama, LM Studio). No
+/// redirects (a key must not follow one elsewhere), at most 16 MB back.
+fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Result<(u16, Vec<u8>), String> {
+    use std::time::Duration;
+    let tls = ureq::tls::TlsConfig::builder()
+        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+        .unversioned_rustls_crypto_provider(std::sync::Arc::new(rustls::crypto::ring::default_provider()))
+        .build();
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .tls_config(tls)
+        .http_status_as_error(false)
+        .timeout_global(Some(Duration::from_secs(r.timeout_s.clamp(1, 900))))
+        .timeout_connect(Some(Duration::from_secs(10)))
+        .user_agent("SolidCraft")
+        .max_redirects(0)
+        .build()
+        .into();
+    let mut response = if r.method == "POST" {
+        let mut req = agent.post(&r.url);
+        for (k, v) in &r.headers {
+            req = req.header(k, v);
+        }
+        req.send(r.body.as_deref().unwrap_or_default())
+    } else {
+        let mut req = agent.get(&r.url);
+        for (k, v) in &r.headers {
+            req = req.header(k, v);
+        }
+        req.call()
+    }
+    .map_err(|e| e.to_string())?;
+    let status = response.status().as_u16();
+    let body = response.body_mut().with_config().limit(16 << 20).read_to_vec().map_err(|e| e.to_string())?;
+    Ok((status, body))
+}
+
+/// API keys in the system keychain (service "SolidCraft agent chat", one entry per agent).
+struct Keychain;
+
+impl Keychain {
+    fn entry(id: &str) -> Result<keyring::Entry, String> {
+        keyring::Entry::new("SolidCraft agent chat", id).map_err(|e| e.to_string())
+    }
+}
+
+impl solidcraft_ui_egui::agent_chat::backend::Secrets for Keychain {
+    fn get(&self, id: &str) -> Result<Option<String>, String> {
+        match Self::entry(id)?.get_password() {
+            Ok(p) => Ok(Some(p)),
+            Err(keyring::Error::NoEntry) => Ok(None),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+    fn set(&self, id: &str, secret: &str) -> Result<(), String> {
+        Self::entry(id)?.set_password(secret).map_err(|e| e.to_string())
+    }
+    fn delete(&self, id: &str) -> Result<(), String> {
+        match Self::entry(id)?.delete_credential() {
+            Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+}
+
+/// One GET to GitHub: a 200 answer, or why not (rate limits included).
+fn http_call(url: &str, timeout: std::time::Duration) -> Result<ureq::http::Response<ureq::Body>, solidcraft_ui_egui::update::FetchError> {
+    use solidcraft_ui_egui::update::FetchError;
+    use std::time::Duration;
+    let tls = ureq::tls::TlsConfig::builder()
+        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+        .unversioned_rustls_crypto_provider(std::sync::Arc::new(rustls::crypto::ring::default_provider()))
+        .build();
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .tls_config(tls)
+        .https_only(true)
+        .http_status_as_error(false)
+        .timeout_global(Some(timeout))
+        .timeout_connect(Some(Duration::from_secs(5)))
+        .user_agent("SolidCraft-update-check")
+        .max_redirects(3)
+        .build()
+        .into();
+    let response = agent
+        .get(url)
+        .header("Accept", "application/vnd.github+json")
+        .header("X-GitHub-Api-Version", "2022-11-28")
+        .call()
+        .map_err(|e| FetchError::Failed(e.to_string()))?;
+    let status = response.status().as_u16();
+    let header = |k: &str| response.headers().get(k).and_then(|v| v.to_str().ok()).and_then(|v| v.trim().parse::<u64>().ok());
+    if status == 429 || (status == 403 && (header("x-ratelimit-remaining") == Some(0) || header("retry-after").is_some())) {
+        let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+        let retry_after_s = header("retry-after").or_else(|| header("x-ratelimit-reset").map(|reset| reset.saturating_sub(now))).unwrap_or(3600);
+        return Err(FetchError::RateLimited { retry_after_s });
+    }
+    if status != 200 {
+        return Err(FetchError::Failed(format!("GitHub answered HTTP {status}")));
+    }
+    Ok(response)
+}
+
 /// The per-user settings folder: eframe's storage (`app.ron`) and the anti-aliasing preference.
 fn settings_dir() -> Option<std::path::PathBuf> {
     eframe::storage_dir("SolidCraft")
@@ -174,11 +368,19 @@ fn adopt_settings(
     Ok(())
 }
 
+/// `graphics.json`, read before the window opens.
+fn graphics() -> Option<serde_json::Value> {
+    graphics_path().and_then(|p| std::fs::read_to_string(p).ok()).and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+}
+
+/// The graphics backend preference (`graphics.json`'s `backend`: `auto`, `dx12`, `vulkan`, `gl`).
+fn backend_preference() -> Option<String> {
+    graphics().and_then(|v| v.get("backend").and_then(serde_json::Value::as_str).map(str::to_string))
+}
+
 /// Anti-aliasing samples from Preferences (4 when unset).
 fn msaa() -> u16 {
-    graphics_path()
-        .and_then(|p| std::fs::read_to_string(p).ok())
-        .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+    graphics()
         .and_then(|v| v.get("msaa").and_then(serde_json::Value::as_u64))
         .and_then(|m| u16::try_from(m).ok())
         .filter(|m| [1, 2, 4, 8].contains(m))
@@ -219,7 +421,7 @@ const APP_ID: &str = solidcraft_engine::io::APP_ID;
 
 fn main() -> eframe::Result {
     adopt_legacy_settings();
-    let samples = msaa();
+    let mut safe_mode = startup::env_on(std::env::var(startup::SAFE_MODE_ENV).ok().as_deref());
     let mut control_port: Option<u16> = solidcraft_engine::geom::env::var("CONTROL_PORT").and_then(|p| p.parse().ok());
     let mut files = Vec::new();
     let mut sample = false;
@@ -228,6 +430,7 @@ fn main() -> eframe::Result {
         match a.as_str() {
             "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
             "--sample" => sample = true,
+            "--safe-mode" => safe_mode = true,
             "--version" | "-V" => {
                 println!("solidcraft {}", env!("CARGO_PKG_VERSION"));
                 return Ok(());
@@ -246,12 +449,30 @@ fn main() -> eframe::Result {
                 return Ok(());
             }
             "--help" | "-h" => {
-                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [design.solidcraft | part.step]");
+                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]");
                 return Ok(());
             }
             _ => files.push(a),
         }
     }
+    // Settings that don't read are moved aside; launches that never got a window are counted,
+    // and after a few in a row this one starts in safe mode (docs/book/src/guide/troubleshooting.md).
+    let settings = settings_dir();
+    let mut notes: Vec<String> = Vec::new();
+    let mut failed_starts = 0;
+    if let Some(dir) = &settings {
+        notes.extend(startup::check_settings(dir, &[solidcraft_ui_egui::prefs::STORAGE_KEY, solidcraft_ui_egui::prefs::LEGACY_STORAGE_KEY]));
+        failed_starts = startup::begin(dir);
+    }
+    if failed_starts >= startup::FAILED_STARTS_FOR_SAFE_MODE && !safe_mode {
+        safe_mode = true;
+        notes.push(format!("The last {failed_starts} launches stopped before the window opened, so this one is in safe mode."));
+    }
+    let cpu_renderer = safe_mode || startup::cpu_renderer_env(std::env::var(startup::RENDERER_ENV).ok().as_deref());
+    if safe_mode {
+        notes.push("Safe mode: default settings (yours are kept for the next normal start), no recovery offer, software rendering.".into());
+    }
+    let samples = if safe_mode { MSAA } else { msaa() };
     // Crashes leave a report in the crash folder (solidcraft_engine::crash, docs/crash-reports.md).
     let crashed = solidcraft_engine::crash::default_dir()
         .map(|dir| {
@@ -263,13 +484,28 @@ fn main() -> eframe::Result {
             solidcraft_engine::crash::install(dir, build)
         })
         .unwrap_or_default();
+    // A crash in native code (a graphics driver) says where it happened: the exception and the
+    // module on Windows, and on every system the startup step the app was in.
+    #[cfg(target_os = "windows")]
+    native_crash::install();
+    eframe::egui_wgpu::set_startup_hook(startup_step);
+    solidcraft_engine::crash::phase("window");
     let options = eframe::NativeOptions {
         viewport: app_viewport()?,
         depth_buffer: DEPTH_BITS,
         stencil_buffer: STENCIL_BITS,
         multisampling: samples,
-        // Kept with the other settings, not in a folder named after the app id.
-        persistence_path: settings_dir().map(|d| d.join("app.ron")),
+        // Kept with the other settings, not in a folder named after the app id. Safe mode reads
+        // and writes a scratch copy, leaving the user's settings as they were.
+        persistence_path: if safe_mode {
+            let scratch = std::env::temp_dir().join(format!("solidcraft-safe-mode-{}.ron", std::process::id()));
+            let _ = std::fs::remove_file(&scratch);
+            Some(scratch)
+        } else {
+            settings.as_ref().map(|d| d.join("app.ron"))
+        },
+        persist_window: !safe_mode,
+        wgpu_options: wgpu_options(cpu_renderer, if safe_mode { None } else { backend_preference() }.as_deref()),
         ..Default::default()
     };
     #[cfg(all(unix, not(target_os = "macos")))]
@@ -286,20 +522,44 @@ fn main() -> eframe::Result {
             b.with_x11();
         }));
     }
-    eframe::run_native(
+    // Files opened from Finder and the Dock arrive as events, not arguments.
+    #[cfg(target_os = "macos")]
+    open_documents::install();
+    let created = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let created_in_app = created.clone();
+    let starting = settings.clone();
+    let result = eframe::run_native(
         "SolidCraft",
         options,
         Box::new(move |cc| {
+            created_in_app.store(true, std::sync::atomic::Ordering::SeqCst);
+            solidcraft_engine::crash::phase("app setup");
             solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
-            let mut app = SolveApp::new(Session::default(), services());
+            let mut app = SolveApp::new(Session::default(), services(cc));
+            app.apply_off_thread = Some(solidcraft_ui_egui::dialogs::APPLY_AT_ONCE);
             app.custom_titlebar = CUSTOM_TITLEBAR;
+            // Windows: the OS hit test offers the resize border, at the window's DPI, from the
+            // first message (#1381).
+            #[cfg(target_os = "windows")]
+            {
+                app.native_resize_border = CUSTOM_TITLEBAR && native_frame::install(cc);
+                if CUSTOM_TITLEBAR && !app.native_resize_border {
+                    eprintln!("SolidCraft window: no native resize border; egui edge zones instead");
+                }
+            }
             app.integrated_titlebar = cfg!(target_os = "macos");
-            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+            app.cpu_meshing = safe_mode;
+            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))).filter(|_| !safe_mode) {
                 app.load_prefs(&p);
             }
             if let Some(rs) = &cc.wgpu_render_state {
                 eprintln!("SolidCraft graphics: {:?}, MSAA {}x (requested {}x)", rs.adapter.get_info().backend, rs.msaa_samples, samples);
+                solidcraft_engine::crash::phase("viewport pipelines (shader compile)");
                 app.set_wgpu(rs, DEPTH_BITS, STENCIL_BITS, rs.msaa_samples);
+                // The graphics driver is loaded now; it may have put its own exception filter
+                // in front of ours.
+                #[cfg(target_os = "windows")]
+                native_crash::reinstall();
                 // A saved anti-aliasing the device can't do: back to the default, with a notice.
                 solidcraft_ui_egui::prefs::check_msaa(&mut app, u32::from(samples));
                 let info = rs.adapter.get_info();
@@ -312,6 +572,10 @@ fn main() -> eframe::Result {
                 let rx = control_server::start(port, cc.egui_ctx.clone());
                 app = app.with_control(rx);
             }
+            // The agent chat's MCP bridge reaches the app through an endpoint of its own, started
+            // on a free port the first time the chat connects (docs/agent-chat.md).
+            let ctx = cc.egui_ctx.clone();
+            app.agent_chat.control_starter = Some(Box::new(move |tx| control_server::listen_agent(tx, ctx.clone())));
             if sample {
                 if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                     app.set_status(format!("sample: {e}"), true);
@@ -320,9 +584,20 @@ fn main() -> eframe::Result {
                 app.session.mark_saved();
                 app.session.undo.clear();
             }
+            // A launch from Finder: its files arrived before the window.
+            #[cfg(target_os = "macos")]
+            let files = {
+                open_documents::set_ui(&cc.egui_ctx);
+                [files, open_documents::take()].concat()
+            };
             for f in &files {
                 app.open_path_async(f);
             }
+            // No file and no sample: the empty design takes Units of new designs (#1205).
+            // An opened file and the sample part keep the units they were saved or built with.
+            if files.is_empty() && !sample {
+                solidcraft_ui_egui::prefs::apply_new_design(&mut app);
+            }
             // No design given: the start page (not when driven over the control channel, whose
             // clients expect the design view; `ui.home` shows it there).
             if files.is_empty() && !sample && control_port.is_none() {
@@ -333,18 +608,83 @@ fn main() -> eframe::Result {
             if let Some(dir) = solidcraft_engine::recovery::default_dir() {
                 let every = if app.autosave_minutes > 0.0 { app.autosave_minutes * 60.0 } else { f64::MAX / 4.0 };
                 solidcraft_ui_egui::recovery_ui::start(&mut app, &dir, std::time::Duration::from_secs_f64(every.min(1e9)));
+                // Safe mode keeps autosaving but offers nothing: the entries wait for a normal start.
+                if safe_mode {
+                    app.recoverable.clear();
+                }
             }
             // Tell the user about crashes since the last start (after the recovery offer is set up).
             solidcraft_ui_egui::crash_ui::announce(&mut app, &crashed);
+            if !notes.is_empty() {
+                app.set_status(notes.join(" "), true);
+            }
             #[cfg(any(target_os = "windows", target_os = "linux"))]
             let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            solidcraft_engine::crash::phase("first frame");
             Ok(Box::new(App {
                 solve: app,
+                starting,
+                frames: 0,
                 #[cfg(any(target_os = "windows", target_os = "linux"))]
                 space_mouse,
             }))
         }),
-    )
+    );
+    control_server::remove_token_file();
+    match result {
+        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, settings.as_deref()),
+        r => r,
+    }
+}
+
+/// egui-wgpu is about to start a step of getting the graphics device and the window's surface up:
+/// the crash journal keeps it, and the adapter once it is picked.
+fn startup_step(step: &'static str, detail: &str) {
+    if step == eframe::egui_wgpu::STEP_ADAPTER_CHOSEN {
+        solidcraft_engine::crash::set_environment(&format!("Renderer: {detail}"));
+    }
+    solidcraft_engine::crash::phase(step);
+}
+
+/// The renderer settings: with `cpu`, the software adapter (WARP, lavapipe, llvmpipe). The
+/// backends come from `startup::choose_backends` (on Windows D3D12 first, and only the backend
+/// in use is started); `preference` is `graphics.json`'s `backend`.
+fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuConfiguration {
+    let mut options = eframe::egui_wgpu::WgpuConfiguration::default();
+    if let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &mut options.wgpu_setup {
+        let env_set = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+        if let Some(backends) = startup::choose_backends(cfg!(target_os = "windows"), env_set, cpu, preference, startup::has_hardware_adapter) {
+            eprintln!("SolidCraft graphics: starting {backends:?}");
+            setup.instance_descriptor.backends = backends;
+        }
+        if cpu {
+            setup.native_adapter_selector = Some(std::sync::Arc::new(startup::pick_cpu_adapter));
+        }
+    }
+    options
+}
+
+/// The window never opened (no graphics adapter, a device that wouldn't start): once more on
+/// the software renderer, else a message box saying what failed instead of a silent exit.
+fn no_window(error: eframe::Error, tried_cpu: bool, settings: Option<&std::path::Path>) -> eframe::Result {
+    log::error!("the window could not open: {error}");
+    eprintln!("SolidCraft: the window could not open: {error}");
+    if !tried_cpu && let Ok(exe) = std::env::current_exe() {
+        eprintln!("SolidCraft: trying again with the software renderer ({}=cpu)", startup::RENDERER_ENV);
+        match std::process::Command::new(exe).args(std::env::args_os().skip(1)).env(startup::RENDERER_ENV, "cpu").status() {
+            Ok(status) if status.success() => return Ok(()),
+            // The second try showed its own message.
+            Ok(_) => return Err(error),
+            Err(e) => log::error!("could not start again with the software renderer: {e}"),
+        }
+    }
+    let _ = rfd::MessageDialog::new()
+        .set_level(rfd::MessageLevel::Error)
+        .set_title("SolidCraft could not start")
+        .set_description(startup::no_window_message(&error.to_string(), settings))
+        .set_buttons(rfd::MessageButtons::Ok)
+        .show();
+    Err(error)
 }
 
 /// Whether to run through XWayland rather than native Wayland. winit has no file drag-and-drop

apps/solidcraft/src/native_crash.rs

@@ -0,0 +1,285 @@
+//! Windows: what a crash in native code leaves behind (docs/crash-reports.md).
+//!
+//! A crash inside a graphics driver or another DLL (an access violation, a stack overflow) is no
+//! Rust panic: the panic hook never runs and the next start only found "an unclean exit". An
+//! unhandled-exception filter now writes, before the process goes, a small JSON file with the
+//! exception code, the faulting module and the offset into it, and a minidump, next to the run's
+//! crash journal (`solidcraft_engine::crash::native_paths`). The next start puts both into the
+//! unclean exit's report, with the startup step the journal says the app was in.
+//!
+//! Installing an exception filter and asking the system which module holds an address have no
+//! safe API, hence the `unsafe_code` allowance on this module (the app crate denies it; see
+//! `open_documents.rs` for the other one). The filter runs on a thread that may have a broken
+//! heap or almost no stack left: it doesn't allocate, formats into a buffer on the stack, and
+//! skips the minidump after a stack overflow.
+#![allow(unsafe_code)]
+
+use std::fmt::Write as _;
+use std::os::windows::ffi::OsStrExt;
+use std::path::Path;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+use windows_sys::Win32::Foundation::{CloseHandle, GENERIC_WRITE, HANDLE, HMODULE, INVALID_HANDLE_VALUE};
+use windows_sys::Win32::Storage::FileSystem::{CREATE_ALWAYS, CreateFileW, FILE_ATTRIBUTE_NORMAL, WriteFile};
+use windows_sys::Win32::System::Diagnostics::Debug::{
+    EXCEPTION_CONTINUE_SEARCH, EXCEPTION_POINTERS, MINIDUMP_EXCEPTION_INFORMATION, MiniDumpNormal, MiniDumpWithThreadInfo,
+    MiniDumpWithUnloadedModules, MiniDumpWriteDump, SetUnhandledExceptionFilter,
+};
+use windows_sys::Win32::System::LibraryLoader::{
+    GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, GetModuleFileNameW, GetModuleHandleExW,
+};
+use windows_sys::Win32::System::Threading::{GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId};
+
+/// Where the filter writes (NUL-terminated UTF-16), set once by [`install`].
+struct Paths {
+    info: Vec<u16>,
+    dump: Vec<u16>,
+}
+
+static PATHS: OnceLock<Paths> = OnceLock::new();
+/// The filter that was installed before ours (called after ours), as an address.
+static PREVIOUS: AtomicUsize = AtomicUsize::new(0);
+/// The filter has started writing (a second exception while it does is left alone).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+const STATUS_ACCESS_VIOLATION: u32 = 0xC000_0005;
+const STATUS_IN_PAGE_ERROR: u32 = 0xC000_0006;
+const STATUS_STACK_OVERFLOW: u32 = 0xC000_00FD;
+
+/// Catch native crashes from now on (after `solidcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, dump)) = solidcraft_engine::crash::native_paths() else { return };
+    let wide = |p: &Path| p.as_os_str().encode_wide().chain([0]).collect::<Vec<u16>>();
+    if PATHS.set(Paths { info: wide(&info), dump: wide(&dump) }).is_ok() {
+        set_filter();
+    }
+}
+
+/// Put the filter back on top: a DLL loaded since (a graphics driver) may have set its own,
+/// which is then called after ours.
+pub fn reinstall() {
+    if PATHS.get().is_some() {
+        set_filter();
+    }
+}
+
+fn set_filter() {
+    // SAFETY: `filter` has the signature the system calls it with and stays valid for the
+    // process's life.
+    let previous = unsafe { SetUnhandledExceptionFilter(Some(filter)) };
+    if let Some(p) = previous
+        && p as usize != filter as *const () as usize
+    {
+        PREVIOUS.store(p as usize, Ordering::SeqCst);
+    }
+}
+
+/// The unhandled-exception filter: record, then let the previous filter (or the system) go on.
+unsafe extern "system" fn filter(pointers: *const EXCEPTION_POINTERS) -> i32 {
+    if !BUSY.swap(true, Ordering::SeqCst) {
+        // SAFETY: the system passes valid exception pointers for the duration of the call.
+        unsafe { record(pointers) };
+    }
+    let previous = PREVIOUS.load(Ordering::SeqCst);
+    if previous != 0 && previous != filter as *const () as usize {
+        // SAFETY: the address came from `SetUnhandledExceptionFilter` as a filter of this type.
+        let previous: unsafe extern "system" fn(*const EXCEPTION_POINTERS) -> i32 = unsafe { std::mem::transmute(previous) };
+        // SAFETY: as for this filter.
+        return unsafe { previous(pointers) };
+    }
+    EXCEPTION_CONTINUE_SEARCH
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 2048],
+    len: usize,
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let room = self.bytes.len().saturating_sub(self.len);
+        let n = s.len().min(room);
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The usual names of the exception codes a crash shows.
+fn code_name(code: u32) -> &'static str {
+    match code {
+        STATUS_ACCESS_VIOLATION => "EXCEPTION_ACCESS_VIOLATION",
+        STATUS_IN_PAGE_ERROR => "EXCEPTION_IN_PAGE_ERROR",
+        STATUS_STACK_OVERFLOW => "EXCEPTION_STACK_OVERFLOW",
+        0xC000_001D => "EXCEPTION_ILLEGAL_INSTRUCTION",
+        0xC000_0094 => "EXCEPTION_INT_DIVIDE_BY_ZERO",
+        0xC000_0096 => "EXCEPTION_PRIV_INSTRUCTION",
+        0xC000_008C => "EXCEPTION_ARRAY_BOUNDS_EXCEEDED",
+        0xC000_0374 => "STATUS_HEAP_CORRUPTION",
+        0xC000_0409 => "STATUS_STACK_BUFFER_OVERRUN",
+        0xC000_0602 => "STATUS_FAIL_FAST_EXCEPTION",
+        0x8000_0003 => "EXCEPTION_BREAKPOINT",
+        0xE06D_7363 => "C++ exception",
+        _ => "exception",
+    }
+}
+
+/// Write what `pointers` says into the info file, then the minidump.
+unsafe fn record(pointers: *const EXCEPTION_POINTERS) {
+    let Some(paths) = PATHS.get() else { return };
+    if pointers.is_null() {
+        return;
+    }
+    // SAFETY: checked non-null; the system keeps it valid during the filter.
+    let rec = unsafe { (*pointers).ExceptionRecord };
+    if rec.is_null() {
+        return;
+    }
+    // SAFETY: as above.
+    let rec = unsafe { &*rec };
+    let code = rec.ExceptionCode as u32;
+    let address = rec.ExceptionAddress as usize;
+    let mut module: HMODULE = std::ptr::null_mut();
+    let mut name = [0u16; 512];
+    // SAFETY: FROM_ADDRESS takes the address in place of a name; UNCHANGED_REFCOUNT means no
+    // handle to release; `name` is as long as we say.
+    let len = unsafe {
+        if GetModuleHandleExW(
+            GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+            address as *const u16,
+            &mut module,
+        ) != 0
+        {
+            GetModuleFileNameW(module, name.as_mut_ptr(), name.len() as u32) as usize
+        } else {
+            0
+        }
+    };
+    // SAFETY: no preconditions.
+    let thread = unsafe { GetCurrentThreadId() };
+    let mut b = Buf { bytes: [0; 2048], len: 0 };
+    let _ = write!(b, "{{\"code\":\"0x{code:08X}\",\"name\":\"{}\",\"address\":\"0x{address:016X}\",\"thread\":{thread}", code_name(code));
+    if len > 0 {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", address.wrapping_sub(module as usize));
+        for c in char::decode_utf16(name.iter().take(len).copied()) {
+            let _ = match c.unwrap_or(char::REPLACEMENT_CHARACTER) {
+                '"' => b.write_str("\\\""),
+                '\\' => b.write_str("\\\\"),
+                c if (c as u32) < 0x20 => b.write_str("?"),
+                c => b.write_char(c),
+            };
+        }
+        let _ = b.write_str("\"");
+    }
+    if matches!(code, STATUS_ACCESS_VIOLATION | STATUS_IN_PAGE_ERROR) && rec.NumberParameters >= 2 {
+        let what = match rec.ExceptionInformation[0] {
+            0 => "read of",
+            1 => "write to",
+            8 => "execution at",
+            _ => "access to",
+        };
+        let _ = write!(b, ",\"detail\":\"{what} 0x{:016X}\"", rec.ExceptionInformation[1]);
+    }
+    let _ = b.write_str("}");
+    let bytes = b.bytes.get(..b.len).unwrap_or_default();
+    // SAFETY: NUL-terminated path; the handle is closed below.
+    unsafe {
+        let file = create(&paths.info);
+        if !file.is_null() {
+            let mut written = 0u32;
+            WriteFile(file, bytes.as_ptr(), bytes.len() as u32, &mut written, std::ptr::null_mut());
+            CloseHandle(file);
+        }
+    }
+    // After a stack overflow there is no stack left for writing a minidump.
+    if code == STATUS_STACK_OVERFLOW {
+        return;
+    }
+    // SAFETY: as above; the exception information points at this thread's exception.
+    unsafe {
+        let file = create(&paths.dump);
+        if !file.is_null() {
+            let exception = MINIDUMP_EXCEPTION_INFORMATION { ThreadId: thread, ExceptionPointers: pointers as *mut _, ClientPointers: 0 };
+            MiniDumpWriteDump(
+                GetCurrentProcess(),
+                GetCurrentProcessId(),
+                file,
+                MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithUnloadedModules,
+                &exception,
+                std::ptr::null(),
+                std::ptr::null(),
+            );
+            CloseHandle(file);
+        }
+    }
+}
+
+/// A new file at `path` (NUL-terminated) for writing, or null.
+unsafe fn create(path: &[u16]) -> HANDLE {
+    // SAFETY: the caller passes a NUL-terminated path.
+    let h = unsafe { CreateFileW(path.as_ptr(), GENERIC_WRITE, 0, std::ptr::null(), CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, std::ptr::null_mut()) };
+    if h == INVALID_HANDLE_VALUE { std::ptr::null_mut() } else { h }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    /// The child half: install crash reporting and the filter, then fault in native code.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = solidcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234", built: "2026-10-14" };
+        let fresh = solidcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        if std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_FAULT").is_none() {
+            solidcraft_engine::crash::end_session();
+            return;
+        }
+        super::install();
+        solidcraft_engine::crash::phase("device creation");
+        // SAFETY: none; this is the crash under test (a read of address 16, as a null struct
+        // pointer's field would be).
+        let v = unsafe { std::ptr::read_volatile(16 as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &std::path::Path, fault: bool) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash::tests::child", "--test-threads=1", "--nocapture"]).env("SOLIDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if fault {
+            c.env("SOLIDCRAFT_NATIVE_CRASH_FAULT", "1");
+        }
+        c.output().unwrap()
+    }
+
+    #[test]
+    fn an_access_violation_is_reported_with_its_module_step_and_minidump() {
+        let dir = std::env::temp_dir().join(format!("solidcraft-native-crash-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, true);
+        assert_eq!(out.status.code().map(|c| c as u32), Some(super::STATUS_ACCESS_VIOLATION), "{out:?}");
+        let sessions: Vec<PathBuf> = std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).collect();
+        let info = sessions.iter().find(|p| p.to_string_lossy().ends_with(".native.json")).expect("the filter wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        assert_eq!(v["code"], "0xC0000005", "{v}");
+        assert_eq!(v["detail"], "read of 0x0000000000000010", "{v}");
+        assert!(v["module"].as_str().unwrap().to_lowercase().contains("solidcraft"), "the fault is in the test binary: {v}");
+        let dump = sessions.iter().find(|p| p.extension().is_some_and(|e| e == "dmp")).expect("a minidump");
+        assert_eq!(std::fs::read(dump).unwrap().get(..4), Some(&b"MDMP"[..]));
+        // The next start reports it.
+        let out = run(&dir, false);
+        assert!(out.status.success(), "{out:?}");
+        let reports = solidcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = solidcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        assert!(r["message"].as_str().unwrap().contains("EXCEPTION_ACCESS_VIOLATION (0xC0000005) in solidcraft"), "{r}");
+        assert!(r["message"].as_str().unwrap().contains("during startup (device creation"), "{r}");
+        assert!(r.get("minidump_path").is_some(), "{r}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

apps/solidcraft/src/native_frame.rs

@@ -0,0 +1,177 @@
+//! Windows: the resize border of the window without OS decorations (#1381).
+//!
+//! The window keeps its native thick frame (`WS_THICKFRAME`, so Aero Snap, Win+arrows and the
+//! OS's own move and size loops work) but winit draws no frame: its `WM_NCCALCSIZE` makes the
+//! whole window client area, and every point then hit-tests as `HTCLIENT`. This module puts the
+//! resize border back by answering `WM_NCHITTEST` itself: within Windows' resize-border width
+//! for the window's current DPI from each edge (`solidcraft_ui_egui::titlebar::resize_hit`;
+//! 8 px at 100 %, corners win), it returns `HTLEFT`, `HTTOPRIGHT`, … So from the first message
+//! the OS shows its resize cursors and runs its own resize, whatever egui has laid out, whatever
+//! the scale; nothing waits for a first frame or a first size change.
+//!
+//! It also answers `WM_GETDPISCALEDSIZE` with the size the window will really have at the new
+//! DPI (the same logical size, as winit computes it), so the rect Windows suggests while the
+//! title bar is dragged onto a monitor with another scale is the rect winit then applies: the
+//! window rescales once at the crossing and stays under the pointer, instead of the OS's move
+//! loop and winit disagreeing about a frame the window doesn't have.
+//!
+//! Replacing a window procedure has no safe API, hence the `unsafe_code` allowance on this
+//! module (the app crate denies it; see `native_crash.rs` and `open_documents.rs` for the others).
+//! The procedure is installed once, on the thread that owns the window, for the main window only,
+//! and calls the previous one (winit's) for everything it doesn't answer.
+#![allow(unsafe_code)]
+
+use std::sync::atomic::{AtomicIsize, Ordering};
+
+use raw_window_handle::{HasWindowHandle, RawWindowHandle};
+use solidcraft_ui_egui::titlebar;
+use windows_sys::Win32::Foundation::{HWND, LPARAM, LRESULT, RECT, SIZE, WPARAM};
+use windows_sys::Win32::UI::HiDpi::{GetDpiForWindow, GetSystemMetricsForDpi};
+use windows_sys::Win32::UI::WindowsAndMessaging::{
+    CallWindowProcW, GWL_STYLE, GWLP_WNDPROC, GetClientRect, GetWindowLongPtrW, GetWindowRect, HTBOTTOM, HTBOTTOMLEFT, HTBOTTOMRIGHT, HTLEFT,
+    HTRIGHT, HTTOP, HTTOPLEFT, HTTOPRIGHT, IsIconic, IsZoomed, SM_CXPADDEDBORDER, SM_CXSIZEFRAME, SetWindowLongPtrW, WM_GETDPISCALEDSIZE,
+    WM_NCDESTROY, WM_NCHITTEST, WNDPROC, WS_THICKFRAME,
+};
+
+/// The window procedure ours replaced (winit's), as an address; 0 before [`install`].
+static PREVIOUS: AtomicIsize = AtomicIsize::new(0);
+
+/// Answer the main window's hit test and DPI-size questions from now on. Call it once, on the
+/// thread that created the window (eframe's app creator). `false` if it isn't a Win32 window.
+pub fn install(window: &impl HasWindowHandle) -> bool {
+    let Ok(handle) = window.window_handle() else { return false };
+    let RawWindowHandle::Win32(w) = handle.as_raw() else { return false };
+    let hwnd = w.hwnd.get() as HWND;
+    if PREVIOUS.load(Ordering::SeqCst) != 0 {
+        return false;
+    }
+    // SAFETY: `hwnd` is the live window eframe just created on this thread; `frame_proc` has the
+    // WNDPROC signature and stays valid for the life of the process. SetWindowLongPtrW returns
+    // the previous procedure, which `frame_proc` calls for every other message.
+    let previous = unsafe { SetWindowLongPtrW(hwnd, GWLP_WNDPROC, frame_proc as *const () as isize as _) };
+    // `as _`: on 32-bit Windows SetWindowLongPtrW is SetWindowLongW, which takes and
+    // returns i32.
+    if previous == 0 {
+        return false;
+    }
+    PREVIOUS.store(previous as _, Ordering::SeqCst);
+    true
+}
+
+/// The procedure ours replaced.
+fn previous() -> WNDPROC {
+    let p = PREVIOUS.load(Ordering::SeqCst);
+    // SAFETY: a nonzero value is the WNDPROC that SetWindowLongPtrW returned in `install`.
+    (p != 0).then(|| unsafe { std::mem::transmute::<isize, unsafe extern "system" fn(HWND, u32, WPARAM, LPARAM) -> LRESULT>(p) })
+}
+
+unsafe extern "system" fn frame_proc(hwnd: HWND, msg: u32, wparam: WPARAM, lparam: LPARAM) -> LRESULT {
+    let prev = previous();
+    // SAFETY: the arguments are the message as Windows delivered it to this window.
+    let call_previous = || unsafe { CallWindowProcW(prev, hwnd, msg, wparam, lparam) };
+    match msg {
+        WM_NCHITTEST => {
+            let default = call_previous();
+            // Screen coordinates, signed (monitors left of or above the primary one).
+            let (x, y) = (i32::from(lparam as u16 as i16), i32::from((lparam >> 16) as u16 as i16));
+            // The border, else what winit and the system say (`HTCLIENT` everywhere else).
+            border_hit(hwnd, x, y).map_or(default, |hit| hit as LRESULT)
+        }
+        WM_GETDPISCALEDSIZE => {
+            let new_dpi = wparam as u32;
+            // SAFETY: for this message lParam points to a SIZE the system reads back.
+            match (resizable(hwnd), client_size(hwnd), unsafe { (lparam as *mut SIZE).as_mut() }) {
+                (true, Some(size), Some(out)) => {
+                    // SAFETY: a window handle the system passed in.
+                    let old_dpi = unsafe { GetDpiForWindow(hwnd) };
+                    match titlebar::dpi_scaled_size(size, old_dpi, new_dpi) {
+                        Some((cx, cy)) => {
+                            *out = SIZE { cx, cy };
+                            1
+                        }
+                        None => call_previous(),
+                    }
+                }
+                _ => call_previous(),
+            }
+        }
+        WM_NCDESTROY => {
+            // Hand the window back to winit's procedure for its last message.
+            if prev.is_some() {
+                // SAFETY: restores the procedure this window had before `install`.
+                unsafe { SetWindowLongPtrW(hwnd, GWLP_WNDPROC, PREVIOUS.load(Ordering::SeqCst) as _) };
+            }
+            call_previous()
+        }
+        _ => call_previous(),
+    }
+}
+
+/// The window can be resized by its border now: it has the thick frame (not fullscreen, which
+/// drops it) and is neither maximized nor minimized.
+fn resizable(hwnd: HWND) -> bool {
+    // SAFETY: plain queries on a window handle the system passed in.
+    unsafe {
+        let style = GetWindowLongPtrW(hwnd, GWL_STYLE) as u32;
+        style & WS_THICKFRAME != 0 && IsZoomed(hwnd) == 0 && IsIconic(hwnd) == 0
+    }
+}
+
+/// The client area's size in pixels (the whole window: winit gives it no frame).
+fn client_size(hwnd: HWND) -> Option<(i32, i32)> {
+    let mut r = RECT { left: 0, top: 0, right: 0, bottom: 0 };
+    // SAFETY: `r` is a valid RECT to fill.
+    (unsafe { GetClientRect(hwnd, &mut r) } != 0).then_some((r.right - r.left, r.bottom - r.top))
+}
+
+/// Windows' resize border at the window's DPI: the sizing frame plus its padding, as Windows
+/// itself sizes it, or 8 px scaled when the system has no answer.
+fn border_px(hwnd: HWND) -> f32 {
+    // SAFETY: plain queries.
+    let (dpi, metric) = unsafe {
+        let dpi = GetDpiForWindow(hwnd);
+        (dpi, GetSystemMetricsForDpi(SM_CXSIZEFRAME, dpi) + GetSystemMetricsForDpi(SM_CXPADDEDBORDER, dpi))
+    };
+    let scale = if dpi > 0 { dpi as f32 / 96.0 } else { 1.0 };
+    if metric > 0 { metric as f32 } else { titlebar::resize_border_px(scale) }
+}
+
+/// The `HT*` resize code at screen point (`x`, `y`), if it is on the border.
+fn border_hit(hwnd: HWND, x: i32, y: i32) -> Option<u32> {
+    if !resizable(hwnd) {
+        return None;
+    }
+    let mut r = RECT { left: 0, top: 0, right: 0, bottom: 0 };
+    // SAFETY: `r` is a valid RECT to fill.
+    if unsafe { GetWindowRect(hwnd, &mut r) } == 0 {
+        return None;
+    }
+    let w = egui::Rect::from_min_max(egui::pos2(r.left as f32, r.top as f32), egui::pos2(r.right as f32, r.bottom as f32));
+    titlebar::resize_hit(w, egui::pos2(x as f32, y as f32), border_px(hwnd)).map(hit_code)
+}
+
+fn hit_code(d: egui::ResizeDirection) -> u32 {
+    use egui::ResizeDirection::*;
+    match d {
+        North => HTTOP,
+        South => HTBOTTOM,
+        West => HTLEFT,
+        East => HTRIGHT,
+        NorthWest => HTTOPLEFT,
+        NorthEast => HTTOPRIGHT,
+        SouthWest => HTBOTTOMLEFT,
+        SouthEast => HTBOTTOMRIGHT,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_direction_has_its_own_hit_code() {
+        use egui::ResizeDirection::*;
+        let codes: Vec<u32> = [North, South, West, East, NorthWest, NorthEast, SouthWest, SouthEast].into_iter().map(hit_code).collect();
+        assert_eq!(codes, vec![HTTOP, HTBOTTOM, HTLEFT, HTRIGHT, HTTOPLEFT, HTTOPRIGHT, HTBOTTOMLEFT, HTBOTTOMRIGHT]);
+    }
+}

apps/solidcraft/src/open_documents.rs

@@ -0,0 +1,120 @@
+//! macOS: files opened from Finder (double-click, Open With, a drop on the Dock icon) or with
+//! `open -a SolidCraft file` (#997).
+//!
+//! macOS doesn't pass these on the command line: AppKit hands them to the application delegate's
+//! `application:openURLs:`, and when the delegate has no such method it asks `NSDocumentController`,
+//! which fails with "SolidCraft cannot open files in the … format" because SolidCraft isn't an
+//! `NSDocument` app. winit 0.30's delegate doesn't implement the method, so [`install`] adds it to
+//! the delegate's class when the app is about to finish launching: after winit set the delegate and
+//! before AppKit delivers the files the app was launched with. The handler queues the paths and
+//! wakes the UI, which opens them with [`take`] like files named on the command line.
+//!
+//! Adding a method to another crate's Objective-C class has no safe API, hence the `unsafe_code`
+//! allowance on [`install`] and [`add_open_urls_method`] (winit overrides `sendEvent:` on
+//! `NSApplication` similarly).
+
+use std::ptr::NonNull;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+use block2::RcBlock;
+use objc2::MainThreadMarker;
+use objc2::runtime::{AnyObject, Imp, Sel};
+use objc2::sel;
+use objc2_app_kit::{NSApplication, NSApplicationWillFinishLaunchingNotification};
+use objc2_foundation::{NSArray, NSNotification, NSNotificationCenter, NSURL};
+
+/// Paths that arrived and haven't been opened yet.
+static PENDING: Mutex<Vec<String>> = Mutex::new(Vec::new());
+/// The UI to wake when files arrive (unset until the window exists; the first frame opens them).
+static UI: OnceLock<egui::Context> = OnceLock::new();
+
+/// Handle open-document events from now on. Call before the event loop runs.
+#[allow(unsafe_code)]
+pub fn install() {
+    let block = RcBlock::new(|_: NonNull<NSNotification>| add_open_urls_method());
+    // SAFETY: the name is AppKit's notification constant; no object or queue filter, so the block
+    // runs on the posting thread (AppKit posts it on the main thread). The block captures nothing,
+    // so it is sendable. The notification center keeps the registration (and the block) for the
+    // life of the app.
+    unsafe {
+        NSNotificationCenter::defaultCenter().addObserverForName_object_queue_usingBlock(
+            Some(NSApplicationWillFinishLaunchingNotification),
+            None,
+            None,
+            &block,
+        );
+    }
+}
+
+/// Wake `ctx` when files arrive while the app runs.
+pub fn set_ui(ctx: &egui::Context) {
+    // Set once; a second call would hand over the same context.
+    let _ = UI.set(ctx.clone());
+}
+
+/// The paths that arrived since the last call.
+pub fn take() -> Vec<String> {
+    std::mem::take(&mut *PENDING.lock().unwrap_or_else(PoisonError::into_inner))
+}
+
+/// `application:openURLs:` on the application delegate's class.
+#[allow(unsafe_code)]
+fn add_open_urls_method() {
+    let Some(mtm) = MainThreadMarker::new() else { return };
+    let Some(delegate) = NSApplication::sharedApplication(mtm).delegate() else {
+        log::warn!("no application delegate; files opened from Finder won't open");
+        return;
+    };
+    let class = AsRef::<AnyObject>::as_ref(&*delegate).class();
+    let handler: extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>) = open_urls;
+    // SAFETY: `Imp` is the untyped form of a method implementation; the Objective-C runtime calls
+    // it with the arguments the type encoding declares, which match `open_urls`: no return value
+    // (`v`), the receiver (`@`), the selector (`:`), the application (`@`) and the URL array (`@`).
+    let added = unsafe {
+        let imp = std::mem::transmute::<extern "C-unwind" fn(&AnyObject, Sel, &AnyObject, &NSArray<NSURL>), Imp>(handler);
+        objc2::ffi::class_addMethod(std::ptr::from_ref(class).cast_mut(), sel!(application:openURLs:), imp, c"v@:@@".as_ptr())
+    };
+    if !added.as_bool() {
+        log::warn!("the application delegate already handles open-document events");
+    }
+}
+
+/// AppKit calls this; a panic stops here instead of unwinding through AppKit's frames.
+extern "C-unwind" fn open_urls(_delegate: &AnyObject, _cmd: Sel, _app: &AnyObject, urls: &NSArray<NSURL>) {
+    if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| queue(urls))).is_err() {
+        log::warn!("files opened from Finder were dropped after an internal error");
+    }
+}
+
+/// Queue the files among `urls` and wake the UI.
+fn queue(urls: &NSArray<NSURL>) {
+    // Only file URLs: macOS 27 turns an https URL's path into a file path too.
+    let paths = urls.iter().filter(|u| u.isFileURL()).filter_map(|u| u.to_file_path()).map(|p| p.to_string_lossy().into_owned());
+    PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(paths);
+    if let Some(ctx) = UI.get() {
+        ctx.request_repaint();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use objc2::runtime::NSObject;
+    use objc2_foundation::NSString;
+
+    use super::*;
+
+    /// Files queue until the UI takes them; URLs that aren't files are left out.
+    #[test]
+    fn opened_files_wait_for_the_ui() {
+        let web = NSURL::URLWithString(&NSString::from_str("https://example.com/a.solidcraft")).unwrap();
+        let urls = NSArray::from_retained_slice(&[
+            NSURL::from_file_path("/tmp/a b.solidcraft").unwrap(),
+            web,
+            NSURL::from_file_path("/tmp/c.step").unwrap(),
+        ]);
+        let any = NSObject::new();
+        open_urls(&any, sel!(application:openURLs:), &any, &urls);
+        assert_eq!(take(), ["/tmp/a b.solidcraft", "/tmp/c.step"]);
+        assert!(take().is_empty());
+    }
+}

apps/solidcraft/src/space_mouse.rs

@@ -48,6 +48,21 @@ impl Default for DriverMapping {
     }
 }
 
+impl DriverMapping {
+    /// The mapping used when no 3DxWare profile is found. On Linux there is no 3DxWare, so it is
+    /// what the driver applies by default in object mode (#1172): the physical Ry and Rz swapped
+    /// and reversed, so a tilt left/right rolls and a twist spins. Elsewhere the driver writes a
+    /// profile, and the raw axes are used until it does.
+    fn without_profile() -> Self {
+        let mut mapping = Self::default();
+        if cfg!(target_os = "linux") {
+            mapping.axes[4] = AxisRule { output: 5, enabled: true, reversed: true, scale: 1.0 };
+            mapping.axes[5] = AxisRule { output: 4, enabled: true, reversed: true, scale: 1.0 };
+        }
+        mapping
+    }
+}
+
 #[derive(Clone, Copy, Debug, Default, PartialEq)]
 struct Motion {
     translation: [f64; 3],
@@ -377,7 +392,12 @@ impl SpaceMouse {
         if let Err(error) = std::thread::Builder::new().name("solidcraft-3d-mouse".into()).spawn(move || reader(worker_ctx, worker_state)) {
             log::warn!("3D mouse: reader could not start: {error}");
         }
-        Self { shared, last_frame: now, driver_mapping: load_driver_mapping().unwrap_or_default(), mapping_checked_at: now }
+        Self {
+            shared,
+            last_frame: now,
+            driver_mapping: load_driver_mapping().unwrap_or_else(DriverMapping::without_profile),
+            mapping_checked_at: now,
+        }
     }
 
     pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
@@ -385,7 +405,7 @@ impl SpaceMouse {
         let seconds = now.duration_since(self.last_frame).as_secs_f64().min(0.05);
         self.last_frame = now;
         if now.duration_since(self.mapping_checked_at) >= RETRY_AFTER {
-            let updated = load_driver_mapping().unwrap_or_default();
+            let updated = load_driver_mapping().unwrap_or_else(DriverMapping::without_profile);
             if updated != self.driver_mapping {
                 log::info!("3D mouse: applying updated 3DxWare axis profile");
                 self.driver_mapping = updated;
@@ -580,6 +600,51 @@ mod tests {
         assert_eq!(motion.rotation, [1.0, -1.0, 0.0]);
     }
 
+    #[test]
+    fn without_a_profile_linux_uses_the_drivers_object_mode_axes() {
+        // 3DxWare's object-mode mapping, as a profile (#1172: confirmed on a SpaceMouse Compact).
+        let object_mode = br#"
+            <AppCfg><Devices><Device><AxisBank>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_X</ActionID></Input><Output><ActionID>HIDMultiAxis_X</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Y</ActionID></Input><Output><ActionID>HIDMultiAxis_Y</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Z</ActionID></Input><Output><ActionID>HIDMultiAxis_Z</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Rx</ActionID></Input><Output><ActionID>HIDMultiAxis_Rx</ActionID><Reversed>false</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Ry</ActionID></Input><Output><ActionID>HIDMultiAxis_Rz</ActionID><Reversed>true</Reversed></Output></Axis>
+              <Axis><Enabled>true</Enabled><Input><ActionID>HIDMultiAxis_Rz</ActionID></Input><Output><ActionID>HIDMultiAxis_Ry</ActionID><Reversed>true</Reversed></Output></Axis>
+            </AxisBank></Device></Devices></AppCfg>
+        "#;
+        let profile = parse_driver_mapping(object_mode).expect("valid 3DxWare profile");
+        if cfg!(target_os = "linux") {
+            assert_eq!(DriverMapping::without_profile(), profile);
+            // Tilting the cap rolls the view and twisting it spins it, as with the driver.
+            let before = Camera::default();
+            let mut tilt = before;
+            navigate(
+                &mut tilt,
+                DriverMapping::without_profile().apply(Axes { translation: [0; 3], rotation: [0, 350, 0] }),
+                0.02,
+                600.0,
+                false,
+                false,
+            );
+            assert_eq!((tilt.yaw, tilt.pitch), (before.yaw, before.pitch));
+            assert_ne!(tilt.roll, before.roll);
+            let mut twist = before;
+            navigate(
+                &mut twist,
+                DriverMapping::without_profile().apply(Axes { translation: [0; 3], rotation: [0, 0, 350] }),
+                0.02,
+                600.0,
+                false,
+                false,
+            );
+            assert_ne!(twist.yaw, before.yaw);
+            assert_eq!(twist.roll, before.roll);
+        } else {
+            assert_eq!(DriverMapping::without_profile(), DriverMapping::default());
+        }
+    }
+
     #[test]
     fn mapped_roll_and_spin_reach_distinct_camera_rotations() {
         let profile = br#"

apps/solidcraft/src/startup.rs

@@ -0,0 +1,325 @@
+//! Getting the window open, whatever state the settings folder or the graphics device is in
+//! (docs/book/src/guide/troubleshooting.md).
+//!
+//! - **Settings that don't read** (`app.ron`, `graphics.json`): moved aside as
+//!   `<name>.bad-<time>` and the app starts with defaults, instead of a newer or damaged file
+//!   being dropped silently or stopping the start.
+//! - **Launches that die before the window is up**: a marker file counts them; after two in a
+//!   row the next launch starts in safe mode by itself.
+//! - **Safe mode** (`--safe-mode` or `SOLIDCRAFT_SAFE_MODE=1`): default settings (the saved ones
+//!   are left untouched), no recovery offer, the software renderer and CPU meshing.
+//! - **No usable graphics device**: one retry on the software renderer
+//!   (`SOLIDCRAFT_RENDERER=cpu`), then a message box saying what failed and what to try.
+
+use std::path::{Path, PathBuf};
+
+/// The environment variable that starts safe mode (any value but `0` or empty).
+pub const SAFE_MODE_ENV: &str = "SOLIDCRAFT_SAFE_MODE";
+/// `SOLIDCRAFT_RENDERER=cpu` picks the software renderer (WARP, lavapipe, llvmpipe).
+pub const RENDERER_ENV: &str = "SOLIDCRAFT_RENDERER";
+/// Consecutive launches that died before the window was up, after which safe mode starts.
+pub const FAILED_STARTS_FOR_SAFE_MODE: u32 = 2;
+const MARKER: &str = "starting";
+
+/// Whether an environment value switches something on.
+pub fn env_on(v: Option<&str>) -> bool {
+    v.map(str::trim).is_some_and(|v| !v.is_empty() && v != "0" && !v.eq_ignore_ascii_case("false"))
+}
+
+/// Whether `SOLIDCRAFT_RENDERER` asks for the software renderer.
+pub fn cpu_renderer_env(v: Option<&str>) -> bool {
+    v.map(str::trim).is_some_and(|v| v.eq_ignore_ascii_case("cpu") || v.eq_ignore_ascii_case("software"))
+}
+
+fn unix_now() -> u64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs())
+}
+
+/// Move `path` aside as `<name>.bad-<time>` (kept for a bug report); returns where it went.
+pub fn back_up(path: &Path) -> std::io::Result<PathBuf> {
+    let name = path.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "settings".into());
+    let mut to = path.with_file_name(format!("{name}.bad-{}", unix_now()));
+    let mut n = 1;
+    while to.exists() && n < 100 {
+        to = path.with_file_name(format!("{name}.bad-{}-{n}", unix_now()));
+        n += 1;
+    }
+    std::fs::rename(path, &to)?;
+    Ok(to)
+}
+
+/// Whether eframe's `app.ron` reads, with the preferences inside it.
+fn app_ron_reads(text: &str, prefs_keys: &[&str]) -> bool {
+    let Ok(kv) = ron::from_str::<std::collections::HashMap<String, String>>(text) else { return false };
+    prefs_keys.iter().filter_map(|k| kv.get(*k)).all(|p| serde_json::from_str::<serde_json::Value>(p).is_ok_and(|v| v.is_object()))
+}
+
+/// Check the settings files in `dir` before anything reads them: one that doesn't read is moved
+/// aside (the app then starts with defaults for it). Returns a line per file moved.
+pub fn check_settings(dir: &Path, prefs_keys: &[&str]) -> Vec<String> {
+    let mut notes = Vec::new();
+    let mut check = |name: &str, reads: &dyn Fn(&str) -> bool| {
+        let path = dir.join(name);
+        let Ok(bytes) = std::fs::read(&path) else { return };
+        let ok = std::str::from_utf8(&bytes).is_ok_and(|t| t.trim().is_empty() || reads(t));
+        if ok {
+            return;
+        }
+        match back_up(&path) {
+            Ok(to) => {
+                log::warn!("settings: {} did not read; moved to {}", path.display(), to.display());
+                notes.push(format!("{name} could not be read and was moved to {}; defaults are used.", to.display()));
+            }
+            Err(e) => log::warn!("settings: {} did not read and could not be moved: {e}", path.display()),
+        }
+    };
+    check("app.ron", &|t| app_ron_reads(t, prefs_keys));
+    check("graphics.json", &|t| serde_json::from_str::<serde_json::Value>(t).is_ok_and(|v| v.is_object()));
+    notes
+}
+
+/// A launch begins: count it in the marker in `dir`. Returns how many launches before this one
+/// died before their window was up.
+pub fn begin(dir: &Path) -> u32 {
+    let marker = dir.join(MARKER);
+    let before = std::fs::read_to_string(&marker).ok().and_then(|s| s.trim().parse::<u32>().ok()).unwrap_or(0).min(1000);
+    if std::fs::create_dir_all(dir).is_ok() {
+        let _ = std::fs::write(&marker, (before + 1).to_string());
+    }
+    before
+}
+
+/// The window is up: this launch did not fail to start.
+pub fn started(dir: &Path) {
+    let _ = std::fs::remove_file(dir.join(MARKER));
+}
+
+/// The software adapter among `adapters` (WARP on Windows, lavapipe or llvmpipe elsewhere), else
+/// the first one that can draw to `surface`.
+pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&eframe::wgpu::Surface<'_>>) -> Result<eframe::wgpu::Adapter, String> {
+    let fits = |a: &&eframe::wgpu::Adapter| surface.is_none_or(|s| a.is_surface_supported(s));
+    adapters
+        .iter()
+        .filter(fits)
+        .find(|a| a.get_info().device_type == eframe::wgpu::DeviceType::Cpu)
+        .or_else(|| adapters.iter().find(fits))
+        .cloned()
+        .ok_or_else(|| {
+            let names: Vec<String> = adapters.iter().map(|a| format!("{} ({:?})", a.get_info().name, a.get_info().backend)).collect();
+            format!("no graphics adapter can draw the window (found: {})", if names.is_empty() { "none".into() } else { names.join(", ") })
+        })
+}
+
+/// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
+pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";
+
+/// The graphics backends to start with, or `None` to leave it to wgpu (`WGPU_BACKEND`, or all
+/// the backends it was built with).
+///
+/// On Windows, D3D12 comes first, then Vulkan, then OpenGL, and only the first one with a
+/// hardware adapter is started at all. wgpu would otherwise start Vulkan, D3D12 and OpenGL
+/// together and prefer Vulkan, and starting Vulkan loads every installed Vulkan driver: Intel's
+/// (`igvk64.dll`) crashed SolidCraft at startup that way, inside the driver, before anything
+/// could be reported. D3D12 is Windows' own graphics API, the one its drivers are tested with.
+/// `has_hardware(backends)` says whether those backends have an adapter that isn't software
+/// (it is only asked about the backends being tried, one at a time).
+///
+/// - `WGPU_BACKEND` set (`env_set`): `None`, whatever it says wins.
+/// - The software renderer (`cpu`, safe mode): D3D12 alone on Windows (WARP); `None` elsewhere.
+/// - `preference` (`graphics.json`'s `backend`: `dx12`, `vulkan`, `gl` or a comma list; `auto`
+///   or empty for the order above): those backends, on any system.
+/// - Elsewhere than Windows: `None`.
+/// - No hardware adapter at all: D3D12 (WARP, Windows' software renderer).
+pub fn choose_backends(
+    windows: bool,
+    env_set: bool,
+    cpu: bool,
+    preference: Option<&str>,
+    mut has_hardware: impl FnMut(eframe::wgpu::Backends) -> bool,
+) -> Option<eframe::wgpu::Backends> {
+    use eframe::wgpu::Backends;
+    if env_set {
+        return None;
+    }
+    if cpu {
+        return windows.then_some(Backends::DX12);
+    }
+    if let Some(p) = preference.map(str::trim).filter(|p| !p.is_empty() && !p.eq_ignore_ascii_case("auto")) {
+        let chosen = Backends::from_comma_list(p);
+        if !chosen.is_empty() {
+            return Some(chosen);
+        }
+        log::warn!("graphics: unknown backend preference `{p}`; using the default order");
+    }
+    if !windows {
+        return None;
+    }
+    Some(WINDOWS_ORDER.into_iter().find(|b| has_hardware(*b)).unwrap_or(Backends::DX12))
+}
+
+/// The order backends are tried in on Windows.
+pub const WINDOWS_ORDER: [eframe::wgpu::Backends; 3] = [eframe::wgpu::Backends::DX12, eframe::wgpu::Backends::VULKAN, eframe::wgpu::Backends::GL];
+
+/// Whether `backends` (started on their own, nothing else) have a hardware adapter.
+pub fn has_hardware_adapter(backends: eframe::wgpu::Backends) -> bool {
+    let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle();
+    desc.backends = backends;
+    desc.flags = eframe::wgpu::InstanceFlags::from_build_config().with_env();
+    let instance = eframe::wgpu::Instance::new(desc);
+    let adapters = pollster::block_on(instance.enumerate_adapters(backends));
+    let found: Vec<String> = adapters.iter().map(|a| format!("{} ({:?})", a.get_info().name, a.get_info().device_type)).collect();
+    log::info!("graphics: {backends:?} adapters: {found:?}");
+    adapters.iter().any(|a| a.get_info().device_type != eframe::wgpu::DeviceType::Cpu)
+}
+
+/// The message shown when no window could be opened at all.
+pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
+    let folder = settings.map(|d| d.display().to_string()).unwrap_or_else(|| "the SolidCraft settings folder".into());
+    format!(
+        "SolidCraft could not open its window.\n\n{error}\n\n\
+         The software renderer was tried too. Things to try:\n\
+         - Install or update the graphics driver (on Windows, from the GPU maker's site rather than Windows Update).\n\
+         - Over Remote Desktop or in a virtual machine, enable 3D acceleration or run it on the machine itself.\n\
+         - Start it once with `solidcraft --safe-mode`.\n\
+         - Rename the settings folder: {folder}\n\n\
+         More: https://bherbruck.github.io/solidcraft/guide/troubleshooting.html"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn scratch(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn switches_read_from_the_environment() {
+        assert!(env_on(Some("1")) && env_on(Some("yes")) && !env_on(Some("0")) && !env_on(Some(" ")) && !env_on(None) && !env_on(Some("false")));
+        assert!(cpu_renderer_env(Some("cpu")) && cpu_renderer_env(Some("Software")) && !cpu_renderer_env(Some("gpu")) && !cpu_renderer_env(None));
+    }
+
+    #[test]
+    fn settings_that_do_not_read_are_moved_aside_and_good_ones_stay() {
+        let keys = ["solidcraft.prefs", "solvecraft.prefs"];
+        let d = scratch("check");
+        // Good files (and an empty one) stay where they are.
+        std::fs::write(d.join("app.ron"), r#"{"solidcraft.prefs": "{\"grid\":true}", "egui": "(anything)"}"#).unwrap();
+        std::fs::write(d.join("graphics.json"), r#"{"msaa":4}"#).unwrap();
+        assert!(check_settings(&d, &keys).is_empty());
+        assert!(d.join("app.ron").is_file() && d.join("graphics.json").is_file());
+        // Damaged RON, preferences that aren't JSON, a truncated graphics.json, non-UTF-8 bytes.
+        for (name, text) in [
+            ("app.ron", b"{\"solidcraft.prefs\": \"{\\\"gr".as_slice()),
+            ("app.ron", br#"{"solvecraft.prefs": "not json"}"#.as_slice()),
+            ("graphics.json", br#"{"msaa":"#.as_slice()),
+            ("graphics.json", b"\xff\xfe\x00".as_slice()),
+        ] {
+            std::fs::write(d.join(name), text).unwrap();
+            let notes = check_settings(&d, &keys);
+            assert_eq!(notes.len(), 1, "{name}: {notes:?}");
+            assert!(!d.join(name).exists(), "{name} moved");
+            let kept: Vec<_> =
+                std::fs::read_dir(&d).unwrap().flatten().filter(|e| e.file_name().to_string_lossy().starts_with(&format!("{name}.bad-"))).collect();
+            assert!(kept.iter().any(|e| std::fs::read(e.path()).unwrap() == text), "{name}: the bad file is kept");
+        }
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn launches_that_never_got_a_window_are_counted_until_one_does() {
+        let d = scratch("marker");
+        assert_eq!(begin(&d), 0);
+        assert_eq!(begin(&d), 1);
+        assert_eq!(begin(&d), FAILED_STARTS_FOR_SAFE_MODE);
+        started(&d);
+        assert_eq!(begin(&d), 0);
+        // A damaged marker counts as none.
+        std::fs::write(d.join(MARKER), "zz").unwrap();
+        assert_eq!(begin(&d), 0);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn windows_starts_d3d12_first_and_vulkan_only_when_d3d12_has_no_gpu() {
+        use eframe::wgpu::Backends;
+        let probe = |with: &'static [Backends]| {
+            move |b: Backends| {
+                assert!(b == Backends::DX12 || b == Backends::VULKAN || b == Backends::GL, "one backend at a time: {b:?}");
+                with.contains(&b)
+            }
+        };
+        // D3D12 works: Vulkan and OpenGL are never even asked about (starting Vulkan loads
+        // its drivers, which is what crashed).
+        let mut asked = Vec::new();
+        let chosen = choose_backends(true, false, false, None, |b| {
+            asked.push(b);
+            b == Backends::DX12
+        });
+        assert_eq!(chosen, Some(Backends::DX12));
+        assert_eq!(asked, [Backends::DX12]);
+        // Everything works: still D3D12 alone.
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::DX12, Backends::VULKAN, Backends::GL])), Some(Backends::DX12));
+        // No D3D12 hardware adapter: Vulkan, else OpenGL, else D3D12's software adapter (WARP).
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::VULKAN, Backends::GL])), Some(Backends::VULKAN));
+        assert_eq!(choose_backends(true, false, false, None, probe(&[Backends::GL])), Some(Backends::GL));
+        assert_eq!(choose_backends(true, false, false, None, probe(&[])), Some(Backends::DX12));
+        // `auto` and blanks are the default order.
+        assert_eq!(choose_backends(true, false, false, Some(" auto "), probe(&[Backends::DX12])), Some(Backends::DX12));
+        assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
+    }
+
+    #[test]
+    fn wgpu_backend_the_preference_and_the_software_renderer_override_the_order() {
+        use eframe::wgpu::Backends;
+        let never = |b: Backends| -> bool { panic!("no probing expected, asked about {b:?}") };
+        // WGPU_BACKEND: wgpu reads it itself, nothing is probed.
+        assert_eq!(choose_backends(true, true, false, Some("gl"), never), None);
+        assert_eq!(choose_backends(true, true, true, None, never), None);
+        // The software renderer (safe mode, the retry): WARP through D3D12 alone, never Vulkan.
+        assert_eq!(choose_backends(true, false, true, Some("vulkan"), never), Some(Backends::DX12));
+        assert_eq!(choose_backends(false, false, true, None, never), None);
+        // The preference, on any system, without probing.
+        assert_eq!(choose_backends(true, false, false, Some("vulkan"), never), Some(Backends::VULKAN));
+        assert_eq!(choose_backends(true, false, false, Some("GL"), never), Some(Backends::GL));
+        assert_eq!(choose_backends(true, false, false, Some("dx12,vulkan"), never), Some(Backends::DX12 | Backends::VULKAN));
+        assert_eq!(choose_backends(false, false, false, Some("vulkan"), never), Some(Backends::VULKAN));
+        // An unknown preference is the default order.
+        assert_eq!(choose_backends(true, false, false, Some("glide"), |b| b == Backends::DX12), Some(Backends::DX12));
+        // Elsewhere: wgpu's own choice.
+        assert_eq!(choose_backends(false, false, false, None, never), None);
+        assert_eq!(choose_backends(false, false, false, Some("auto"), never), None);
+    }
+
+    #[test]
+    fn probing_a_backend_alone_never_panics() {
+        // Whatever this machine has (often nothing): an answer, not a crash.
+        for b in WINDOWS_ORDER {
+            let _ = has_hardware_adapter(b);
+        }
+    }
+
+    #[test]
+    fn the_message_names_the_settings_folder_and_safe_mode() {
+        let m = no_window_message("no adapter", Some(Path::new("/x/SolidCraft")));
+        assert!(m.contains("no adapter") && m.contains("/x/SolidCraft") && m.contains("--safe-mode"));
+    }
+
+    #[test]
+    fn the_software_adapter_is_preferred_and_its_absence_is_an_error_not_a_panic() {
+        assert!(pick_cpu_adapter(&[], None).unwrap_err().contains("none"));
+        let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
+        let adapters = pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all()));
+        if adapters.is_empty() {
+            return;
+        }
+        let picked = pick_cpu_adapter(&adapters, None).unwrap();
+        if adapters.iter().any(|a| a.get_info().device_type == eframe::wgpu::DeviceType::Cpu) {
+            assert_eq!(picked.get_info().device_type, eframe::wgpu::DeviceType::Cpu);
+        }
+    }
+}

assets/README.md

@@ -1,41 +1,98 @@
-# SolidCraft macOS icon
+# Application resources
 
-`SolidCraft.icon/` is the approved Icon Composer source, containing separate
-grid and solid SVG layers and the owner's appearance settings. The saturated
-blue solid has transparent geometry cutouts instead of painted edge lines.
-The solid and grid are both scaled to 90%, with separate Default and Dark grid artwork.
-Icon Composer supplies the system backdrop and Mono material effects.
-Artwork is original and attributed in `ATTRIBUTION.md`.
+`assets/` is the design resource home for SolidCraft.
+[ATTRIBUTION.md](../ATTRIBUTION.md) is the file inventory and provenance record.
+Keep one editable master per resource and place shipped derivatives in `exports/`.
 
-`Assets.car` is compiled by Apple's `actool` and supplies the layered icon on
-macOS 26 and later. It is checked in so the existing release workflow can still
-package on older Xcode runners. After editing and saving `SolidCraft.icon`,
-regenerate the catalog with Xcode 26 or later from the repository root:
-
-```sh
-mkdir -p target/macos-icon
-xcrun actool assets/SolidCraft.icon \
-  --compile target/macos-icon --platform macosx \
-  --minimum-deployment-target 11.0 --app-icon SolidCraft \
-  --output-partial-info-plist target/macos-icon/icon-info.plist \
-  --output-format human-readable-text
-cp target/macos-icon/Assets.car assets/Assets.car
-cp target/macos-icon/SolidCraft.icns assets/icon.icns
+```text
+assets/
+  icons/
+    app/
+      shared/source/                 # original Rust mark and executable ICO encoder
+      macos/source/SolidCraft.icon/   # approved Composer project and linked SVGs
+      macos/exports/                 # paired Assets.car and icon.icns
+      windows/exports/               # executable DIB ICO and installer PNG ICO
+      linux/exports/hicolor/         # Linux/FreeBSD package images, 16–512 px
+    ui/source/                       # original drawing library and other UI glyphs
+  branding/web/source/og.png          # shared social preview card
+  styles/ui/palettes.rs               # light/dark defaults
+  styles/web/loading.css             # web loading/canvas styles
+  appearances/library.rs             # built-in visual presets
+  materials/library.rs               # physical defaults and colours
+  shaders/viewport.wgsl               # original viewport shader
+  fonts/{liberation-sans,biz-udp-gothic}/ # unmodified fonts and OFL licences
+  locales/{en,de,ja,ko}.json          # shared offline catalogs
+  platforms/{macos,linux,windows}/    # bundle, freedesktop and WiX templates
+  archive/icons/macos-v1/
+    source/icon.vectorcraft          # earlier editable work, retained
+    exports/                         # all historical SVG, PNG and iconset exports
 ```
 
-`icon.icns` is the older-macOS fallback generated by the same Apple compiler
-from the approved composition, retaining its layer sizes and positions.
-Regenerate both compiled resources together with the commands above.
-`icon.vectorcraft`, `icon.svg`, `icon.png` and `icon.iconset/` retain the earlier
-VectorCraft artwork; packaging uses the Icon Composer compilation instead.
+## Editing and regeneration
 
-Only `packaging/macos/package.sh` consumes these resources. Its existing signed
-app/DMG workflow copies the catalog and ICNS into `Contents/Resources`, and
-`Info.plist` references `SolidCraft` through `CFBundleIconName` and
-`CFBundleIconFile`. The macOS viewport opts out of eframe's runtime bitmap so
-Finder, the Dock and the application switcher use the bundle icon. Other
-platforms retain the existing code-drawn icon and packaging.
+[UI artwork](icons/ui/README.md) identifies the drawing masters and their consumers.
+Edit geometry and IDs together in the original Rust source and review changes in
+both application themes. Palettes and model presets are also editable Rust data.
 
-Design references: [Apple app-icon HIG](https://developer.apple.com/design/human-interface-guidelines/app-icons)
-and [Icon Composer documentation](https://developer.apple.com/documentation/xcode/creating-your-app-icon-using-icon-composer).
-No Apple artwork is shipped.
+The current macOS master is `icons/app/macos/source/SolidCraft.icon/`, including
+its linked SVG layers and appearance settings. The earlier VectorCraft document
+is preserved in the archive. No other native design projects were available for
+the current UI set or preview card. Keep any future `.vectorcraft`, `.ai` or other
+native work and linked inputs under that resource's `source/work/`, with an
+attribution row; retain the editable document alongside its exports.
+
+Regenerate all exports of the shared Windows/Linux/FreeBSD mark together:
+
+```sh
+cargo xtask app-icons
+```
+
+For macOS, use Xcode with Icon Composer support:
+
+```sh
+mkdir -p target/resources/macos-icon
+xcrun actool assets/icons/app/macos/source/SolidCraft.icon \
+  --compile target/resources/macos-icon --platform macosx \
+  --minimum-deployment-target 11.0 --app-icon SolidCraft \
+  --output-partial-info-plist target/resources/macos-icon/icon-info.plist \
+  --output-format human-readable-text
+cp target/resources/macos-icon/Assets.car assets/icons/app/macos/exports/Assets.car
+cp target/resources/macos-icon/SolidCraft.icns assets/icons/app/macos/exports/icon.icns
+```
+
+Review and commit source changes and required exports together. Temporary renders,
+tool caches and package staging belong under ignored `target/` or `dist/`.
+Normal builds use the committed exports and require no design applications.
+The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
+
+## Platform bindings
+
+| Platform | Resources and output paths |
+| --- | --- |
+| macOS | Composer master and paired exports; bundle installs `Assets.car` and `SolidCraft.icns` |
+| Windows executable | `solidcraft-executable.ico`: original DIB/mask representations at 16/24/32/48/64/128/256 px |
+| Windows installer | `solidcraft.ico`: PNG representations at 16/20/24/32/40/48/64/128/256 px; `SOLIDCRAFT_ICONS` override retained |
+| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `ai.storyteller.solidcraft` |
+| AppImage | Uses the Linux 256 px image and `.DirIcon` alias |
+| FreeBSD | Shares Linux hicolor images and freedesktop metadata |
+| Web | HTML/Trunk and `manifest.webmanifest` stay in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/`, uses the collected CSS, and copies the Linux 32/256/512 px images to `icons/` for the favicon and installed app |
+| Docs and link previews | `xtask book` copies the shared card to the existing `/solidcraft/og.png` public path |
+
+## Code and provenance
+
+Resources remain compiled by their owning layer through existing APIs:
+`ui-egui::icons::paint` and `Tokens` at L5, model presets in L2 `doc`, and sketch
+fonts at L1. State, projection, interaction, commands and GPU bindings stay in
+their current modules. Embedded data uses `CARGO_MANIFEST_DIR`; application code
+needs no runtime resource registry or repository lookup.
+
+`cargo xtask assets` requires an exact attribution row for every collected file
+except Markdown documentation, and continues checking file assets elsewhere in
+the repository. This includes native work, Rust masters, catalogs, shaders and
+platform templates. Packaging selects explicit current files and fails when
+required inputs are absent. Archived artwork has no production consumers.
+
+Dependency-owned egui fonts and vendored renderer shaders stay with their
+libraries; their licences remain in `THIRD-PARTY-LICENSES.txt` and `ATTRIBUTION.md`.
+System fonts, optional packs, user fonts/canvases/decals/materials and native OS
+controls retain external ownership. Root licence/notice texts stay canonical.

assets/appearances/library.rs

@@ -0,0 +1,23 @@
+//! Built-in model appearances: names, sRGB colours and metalness.
+pub const LIBRARY: [(&str, [u8; 3], f64); 20] = [
+    ("Aluminum - Satin", [204, 208, 214], 1.0),
+    ("Aluminum - Anodized Black", [44, 46, 50], 1.0),
+    ("Aluminum - Anodized Blue", [52, 92, 160], 1.0),
+    ("Steel - Satin", [158, 164, 172], 1.0),
+    ("Stainless Steel - Brushed", [186, 191, 198], 1.0),
+    ("Cast Iron", [104, 104, 110], 1.0),
+    ("Brass - Polished", [208, 172, 88], 1.0),
+    ("Copper", [204, 122, 80], 1.0),
+    ("Titanium", [150, 148, 158], 1.0),
+    ("ABS - White", [236, 236, 230], 1.0),
+    ("ABS - Black", [36, 36, 38], 1.0),
+    ("ABS - Red", [196, 40, 40], 1.0),
+    ("ABS - Blue", [40, 90, 186], 1.0),
+    ("ABS - Yellow", [236, 196, 40], 1.0),
+    ("ABS - Green", [52, 150, 80], 1.0),
+    ("Rubber - Black", [28, 28, 28], 1.0),
+    ("Glass - Clear", [190, 220, 228], 0.25),
+    ("Glass - Smoked", [90, 96, 104], 0.45),
+    ("Wood - Oak", [190, 146, 92], 1.0),
+    ("Paint - Gloss White", [246, 246, 244], 1.0),
+];

assets/icons/app/shared/source/windows_ico.rs

@@ -0,0 +1,48 @@
+//! Original executable ICO encoder: DIB images and transparency masks.
+use super::app_icon;
+
+pub fn encode() -> Result<Vec<u8>, Box<dyn std::error::Error>> {
+    let sizes = [16usize, 24, 32, 48, 64, 128, 256];
+    let mut images = Vec::new();
+    for size in sizes {
+        let rgba = app_icon::rgba(size)?;
+        // ICO DIB: bottom-up BGRA plus a padded one-bit transparency mask.
+        let mask_stride = size.div_ceil(32) * 4;
+        let mut dib = Vec::new();
+        dib.extend_from_slice(&40u32.to_le_bytes());
+        dib.extend_from_slice(&(size as i32).to_le_bytes());
+        dib.extend_from_slice(&((size * 2) as i32).to_le_bytes());
+        dib.extend_from_slice(&1u16.to_le_bytes());
+        dib.extend_from_slice(&32u16.to_le_bytes());
+        dib.extend_from_slice(&[0; 24]);
+        for row in rgba.chunks_exact(size * 4).rev() {
+            for p in row.as_chunks::<4>().0.iter() {
+                dib.extend_from_slice(&[p[2], p[1], p[0], p[3]]);
+            }
+        }
+        for row in rgba.chunks_exact(size * 4).rev() {
+            let mut mask = vec![0u8; mask_stride];
+            for (x, p) in row.as_chunks::<4>().0.iter().enumerate() {
+                if p[3] == 0 {
+                    mask[x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+            dib.extend_from_slice(&mask);
+        }
+        images.push((size, dib));
+    }
+    let mut ico = vec![0, 0, 1, 0];
+    ico.extend_from_slice(&(images.len() as u16).to_le_bytes());
+    let mut offset = 6 + 16 * images.len();
+    for (size, data) in &images {
+        let dim = if *size == 256 { 0 } else { *size as u8 };
+        ico.extend_from_slice(&[dim, dim, 0, 0, 1, 0, 32, 0]);
+        ico.extend_from_slice(&(data.len() as u32).to_le_bytes());
+        ico.extend_from_slice(&(offset as u32).to_le_bytes());
+        offset += data.len();
+    }
+    for (_, data) in images {
+        ico.extend_from_slice(&data);
+    }
+    Ok(ico)
+}

assets/icons/ui/README.md

@@ -0,0 +1,22 @@
+# UI artwork
+
+Edit the Rust drawing masters in `source/`; the UI crate compiles them through
+`crates/ui-egui/src/icons.rs`. Use the 24 × 24 grid and semantic ink/fill/accent
+colours. Icon IDs and their geometry live together in `source/icons.rs`;
+unknown IDs retain the existing fallback. Add new artwork there without
+maintaining a separate ID registry.
+
+| Source | Artwork | Consumers |
+| --- | --- | --- |
+| `icons.rs` | Toolbar, browser, menu and constraint icons | `icons::paint` |
+| `glyphs.rs` | Brand mark, captions, transport, badges, pin, caret, disclosure, radial centre and removal cross | toolbar, titlebar, timeline, browser, menus |
+| `navigation.rs` | Signed axes, cube faces/labels and arrows | viewport/navigation cube |
+| `markers.rs` | Constraint mappings/letters, snap markers and dimension arrowheads | sketch, assembly and dimensions |
+| `pointer.rs` | Agent pointer and tag | agent cursor |
+
+Widget state, layout, projection, picking and commands stay with their widgets.
+Review drawing changes in the actual application in both light and dark themes.
+No separate native design projects were available for this set. Preserve any
+future native work and linked inputs under `source/work/`, with attribution.
+Original artwork is MIT OR Apache-2.0; caption geometry retains VectorCraft
+attribution in the root `ATTRIBUTION.md`.

assets/icons/ui/source/glyphs.rs

@@ -0,0 +1,158 @@
+//! Collected glyph artwork. Caption geometry adapted from VectorCraft (MIT OR Apache-2.0).
+use crate::titlebar::Caption;
+use egui::{Color32, Pos2, Rect, Stroke, Ui, pos2, vec2};
+
+pub(crate) fn transport_glyph(p: &egui::Painter, c: egui::Pos2, what: &str, col: Color32) {
+    let tri = |dir: f32, dx: f32| {
+        let pts = vec![pos2(c.x + dx - 4.0 * dir, c.y - 5.0), pos2(c.x + dx + 4.0 * dir, c.y), pos2(c.x + dx - 4.0 * dir, c.y + 5.0)];
+        p.add(egui::Shape::convex_polygon(pts, col, Stroke::NONE));
+    };
+    let bar = |dx: f32| p.line_segment([pos2(c.x + dx, c.y - 5.0), pos2(c.x + dx, c.y + 5.0)], Stroke::new(1.6, col));
+    match what {
+        "first" => {
+            bar(-5.0);
+            tri(-1.0, 1.0);
+        }
+        "back" => tri(-1.0, 0.0),
+        "forward" => tri(1.0, 0.0),
+        _ => {
+            tri(1.0, -1.0);
+            bar(5.0);
+        }
+    }
+}
+
+pub(crate) fn paint_glyph(ui: &Ui, c: Caption, maximized: bool, at: egui::Pos2, s: Stroke) {
+    let p = ui.painter();
+    let g = Rect::from_center_size(at, vec2(10.0, 10.0));
+    match c {
+        Caption::Minimize => {
+            p.line_segment([g.left_center(), g.right_center()], s);
+        }
+        // Restore: a front square with the corner of the one behind it.
+        Caption::Maximize if maximized => {
+            let front = Rect::from_min_max(g.min + vec2(0.0, 2.0), g.max - vec2(2.0, 0.0));
+            p.rect_stroke(front, 0.0, s, egui::StrokeKind::Middle);
+            p.line(vec![g.min + vec2(2.0, 2.0), g.min + vec2(2.0, 0.0), g.right_top(), g.max - vec2(0.0, 2.0), g.max - vec2(2.0, 2.0)], s);
+        }
+        Caption::Maximize => {
+            p.rect_stroke(g, 0.0, s, egui::StrokeKind::Middle);
+        }
+        Caption::Close => {
+            p.line_segment([g.left_top(), g.right_bottom()], s);
+            p.line_segment([g.right_top(), g.left_bottom()], s);
+        }
+    }
+}
+
+pub(crate) fn badge(p: &egui::Painter, r: Rect, name: &str, c: Color32) {
+    let s = Stroke::new(1.3, c);
+    match name {
+        "lock" => {
+            let body = Rect::from_min_max(pos2(r.left() + 1.5, r.center().y - 0.5), pos2(r.right() - 1.5, r.bottom() - 0.5));
+            p.rect_filled(body, 1.5, c);
+            let top = pos2(r.center().x, r.top() + 4.0);
+            p.add(egui::Shape::line(
+                (0..=8)
+                    .map(|k| {
+                        let a = std::f32::consts::PI * (k as f32 / 8.0);
+                        pos2(top.x - 3.2 * a.cos(), top.y - 3.2 * a.sin() + 1.0)
+                    })
+                    .chain([pos2(top.x + 3.2, body.top())])
+                    .collect(),
+                s,
+            ));
+            p.line_segment([pos2(top.x - 3.2, top.y + 1.0), pos2(top.x - 3.2, body.top())], s);
+        }
+        "pin" => {
+            let head = pos2(r.center().x + 2.0, r.top() + 4.0);
+            p.circle_filled(head, 3.2, c);
+            p.line_segment([head, pos2(r.left() + 1.5, r.bottom() - 1.0)], Stroke::new(1.6, c));
+        }
+        _ => {}
+    }
+}
+
+pub(crate) fn pin_icon(p: &egui::Painter, r: Rect, on: bool, col: Color32) {
+    let c = r.center();
+    let (sin, cos) = if on { (0.0, 1.0) } else { std::f32::consts::FRAC_PI_4.sin_cos() };
+    // Local coordinates: the pin points down, its head on top.
+    let at = |x: f32, y: f32| c + vec2(x * cos - y * sin, x * sin + y * cos);
+    let head = vec![at(-2.5, -7.0), at(2.5, -7.0), at(3.0, -2.0), at(-3.0, -2.0)];
+    let stroke = Stroke::new(1.4, col);
+    if on {
+        p.add(egui::Shape::convex_polygon(head, col, stroke));
+    } else {
+        p.add(egui::Shape::closed_line(head, stroke));
+    }
+    p.line_segment([at(-5.5, -2.0), at(5.5, -2.0)], stroke);
+    p.line_segment([at(0.0, -2.0), at(0.0, 7.0)], stroke);
+}
+
+pub(crate) fn caret(p: &egui::Painter, c: egui::Pos2, col: Color32) {
+    p.add(egui::Shape::convex_polygon(vec![pos2(c.x - 3.5, c.y - 2.0), pos2(c.x + 3.5, c.y - 2.0), pos2(c.x, c.y + 2.5)], col, Stroke::NONE));
+}
+
+pub(crate) fn brand_mark(p: &egui::Painter, c: Pos2) {
+    let s = 20.0 / 412.217;
+    let m = |pts: &[(f32, f32)]| -> Vec<egui::Pos2> { pts.iter().map(|&(x, y)| pos2(c.x + (x - 178.5) * s, c.y + (y - 206.1) * s)).collect() };
+    // egui only fills convex shapes, so each face is a few overlapping convex pieces.
+    let face = |col: Color32, pts: &[(f32, f32)]| {
+        p.add(egui::Shape::convex_polygon(m(pts), col, Stroke::NONE));
+    };
+    let [light, mid, dark, edge_col] = crate::theme::Tokens::get().logo;
+    face(light, &[(3.5, 105.9), (177.0, 5.8), (263.4, 55.6), (263.8, 156.0), (177.0, 406.4)]);
+    face(light, &[(177.0, 206.1), (263.8, 156.0), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)]);
+    face(mid, &[(3.5, 105.9), (177.0, 206.1), (177.0, 406.4)]);
+    face(mid, &[(3.5, 105.9), (3.5, 205.7), (90.3, 256.2), (177.0, 206.1)]);
+    face(mid, &[(177.0, 206.1), (90.3, 256.2), (90.0, 356.2), (177.0, 406.4)]);
+    face(dark, &[(264.1, 155.8), (177.0, 206.1), (177.0, 406.4), (263.8, 256.2)]);
+    face(dark, &[(263.8, 256.2), (350.5, 206.2), (350.5, 306.3), (177.0, 406.4)]);
+    face(dark, &[(177.0, 206.1), (177.0, 406.4), (350.5, 306.3)]);
+    face(dark, &[(263.8, 55.9), (263.8, 156.0), (177.1, 105.9)]);
+    // White edge lines.
+    let edge = Stroke::new(10.0 * s, edge_col);
+    let line = |pts: &[(f32, f32)]| {
+        p.add(egui::Shape::line(m(pts), edge));
+    };
+    line(&[(263.8, 55.9), (177.1, 105.9), (263.8, 156.0), (263.8, 256.2), (350.6, 206.1)]);
+    line(&[(5.0, 105.9), (178.5, 206.1), (178.5, 406.4)]);
+    line(&[(177.0, 206.1), (263.8, 156.0)]);
+    p.add(egui::Shape::closed_line(
+        m(&[
+            (178.5, 5.8),
+            (5.0, 105.9),
+            (5.0, 206.1),
+            (91.7, 256.2),
+            (91.7, 356.4),
+            (178.5, 406.4),
+            (352.0, 306.3),
+            (352.0, 206.1),
+            (265.2, 156.0),
+            (265.2, 55.9),
+        ]),
+        edge,
+    ));
+}
+
+pub(crate) fn cross(p: &egui::Painter, r: Rect, s: Stroke) {
+    p.line_segment([r.left_top(), r.right_bottom()], s);
+    p.line_segment([r.right_top(), r.left_bottom()], s);
+}
+pub(crate) fn radial_centre(p: &egui::Painter, c: Pos2, direction: Option<(egui::Vec2, bool)>, t: crate::theme::Tokens) {
+    p.circle(c, 15.0, t.panel.gamma_multiply(0.92), Stroke::new(1.0, t.border));
+    if let Some((d, enabled)) = direction {
+        p.line_segment([c + d * 6.0, c + d * 15.0], Stroke::new(3.0, if enabled { t.accent } else { t.border }));
+    } else {
+        p.circle_filled(c, 3.0, t.text_dim);
+    }
+}
+
+pub(crate) fn disclosure(p: &egui::Painter, ar: Rect, open: bool, ink: Color32) {
+    let pts = if open {
+        vec![pos2(ar.left() + 2.0, ar.top() + 4.0), pos2(ar.right() - 2.0, ar.top() + 4.0), pos2(ar.center().x, ar.bottom() - 3.0)]
+    } else {
+        vec![pos2(ar.left() + 4.0, ar.top() + 2.0), pos2(ar.right() - 3.0, ar.center().y), pos2(ar.left() + 4.0, ar.bottom() - 2.0)]
+    };
+    p.add(egui::Shape::convex_polygon(pts, ink, Stroke::NONE));
+}

assets/icons/ui/source/markers.rs

@@ -0,0 +1,87 @@
+//! Constraint, assembly snap and dimension marker artwork.
+use crate::dialogs_assembly::SnapKind;
+use crate::theme::Tokens;
+use egui::{Color32, Pos2, Stroke, vec2};
+
+pub(crate) fn snap(painter: &egui::Painter, c: Pos2, tip: Option<Pos2>, kind: SnapKind, col: Color32, tag: Option<&str>) {
+    // A dark halo under every stroke keeps the glyph readable on light and dark faces alike.
+    let ic = Tokens::get().icons;
+    let halo = Stroke::new(4.5, ic.marker_halo);
+    let white = Stroke::new(1.5, ic.highlight);
+    if let Some(tip) = tip {
+        let d = (tip - c).normalized();
+        let n = vec2(-d.y, d.x);
+        let head = vec![tip + d * 2.0, tip - d * 9.0 + n * 5.0, tip - d * 9.0 - n * 5.0];
+        painter.line_segment([c, tip], halo);
+        painter.add(egui::Shape::convex_polygon(head.clone(), Color32::TRANSPARENT, halo));
+        painter.line_segment([c, tip], Stroke::new(2.0, col));
+        painter.add(egui::Shape::convex_polygon(head, col, Stroke::NONE));
+    }
+    let shape = |fill: Color32, stroke: Stroke, grow: f32| -> egui::Shape {
+        match kind {
+            SnapKind::FaceCenter => egui::Shape::rect_filled(egui::Rect::from_center_size(c, vec2(12.0 + grow, 12.0 + grow)), 1.5, fill),
+            SnapKind::CircleCenter => egui::Shape::circle_filled(c, 7.0 + grow / 2.0, fill),
+            SnapKind::EdgeMid => {
+                let r = 8.0 + grow / 2.0;
+                egui::Shape::convex_polygon(vec![c + vec2(0.0, -r), c + vec2(r * 0.93, r * 0.7), c + vec2(-r * 0.93, r * 0.7)], fill, stroke)
+            }
+            SnapKind::Vertex => {
+                let r = 7.5 + grow / 2.0;
+                egui::Shape::convex_polygon(vec![c + vec2(0.0, -r), c + vec2(r, 0.0), c + vec2(0.0, r), c + vec2(-r, 0.0)], fill, stroke)
+            }
+        }
+    };
+    painter.add(shape(ic.marker_halo, Stroke::NONE, 4.0));
+    painter.add(shape(col, Stroke::NONE, 0.0));
+    match kind {
+        SnapKind::FaceCenter => {
+            painter.rect_stroke(egui::Rect::from_center_size(c, vec2(12.0, 12.0)), 1.5, white, egui::StrokeKind::Middle);
+        }
+        SnapKind::CircleCenter => {
+            painter.circle_stroke(c, 7.0, white);
+            painter.line_segment([c - vec2(4.5, 0.0), c + vec2(4.5, 0.0)], Stroke::new(1.2, ic.highlight));
+            painter.line_segment([c - vec2(0.0, 4.5), c + vec2(0.0, 4.5)], Stroke::new(1.2, ic.highlight));
+        }
+        SnapKind::EdgeMid | SnapKind::Vertex => {
+            painter.add(shape(Color32::TRANSPARENT, white, 0.0));
+        }
+    }
+    // What it snaps to (hovered), or which component it is (picked): a small label.
+    if let Some(tag) = tag {
+        let t = Tokens::get();
+        let font = egui::FontId::proportional(11.5);
+        let g = painter.layout_no_wrap(tag.to_string(), font, t.text);
+        let at = c + vec2(12.0, 10.0);
+        let r = egui::Rect::from_min_size(at, g.size()).expand2(vec2(5.0, 2.0));
+        painter.rect(r, 3.0, t.panel.gamma_multiply(0.92), Stroke::new(1.0, col), egui::StrokeKind::Inside);
+        painter.galley(at, g, t.text);
+    }
+}
+pub(crate) fn glyph_icon(name: &str) -> Option<&'static str> {
+    Some(match name {
+        "Coincident" => "c_coincident",
+        "Parallel" => "c_parallel",
+        "Perpendicular" => "c_perpendicular",
+        "Collinear" => "c_collinear",
+        "Tangent" => "c_tangent",
+        "Smooth" => "c_smooth",
+        "Equal" => "c_equal",
+        "Concentric" => "c_concentric",
+        "MidPoint" => "c_midpoint",
+        "Symmetry" => "c_symmetry",
+        "Fix" => "c_fix",
+        _ => return None,
+    })
+}
+pub(crate) fn glyph_letter(name: &str) -> &'static str {
+    match name {
+        "Horizontal" => "H",
+        "Vertical" => "V",
+        _ => "?",
+    }
+}
+pub(crate) fn dimension_arrow(painter: &egui::Painter, t: Pos2, back: Pos2, col: Color32) {
+    let d = (t - back).normalized();
+    let n = vec2(-d.y, d.x);
+    painter.add(egui::Shape::convex_polygon(vec![t, t - d * 9.0 + n * 3.0, t - d * 9.0 - n * 3.0], col, Stroke::NONE));
+}

assets/icons/ui/source/navigation.rs

@@ -0,0 +1,166 @@
+//! Navigation drawing definitions. Camera projection and picking remain in the UI widgets.
+use crate::theme::Tokens;
+use egui::{Align2, Color32, FontId, Pos2, Rect, Shape, Stroke, pos2, vec2};
+use solidcraft_engine::geom::Vec3;
+pub(crate) struct Facet {
+    pub(crate) direction: Vec3,
+    pub(crate) points: Vec<Pos2>,
+    pub(crate) outer_edges: Vec<bool>,
+    pub(crate) centre: Pos2,
+    pub(crate) label: String,
+    pub(crate) text_axes: Option<(egui::Vec2, egui::Vec2)>,
+    pub(crate) depth: f64,
+}
+// Private marker for label meshes with atlas-pixel UVs. The output hook replaces
+// it with the font texture before any renderer sees the frame.
+pub(crate) const LABEL_PIXELS: egui::TextureId = egui::TextureId::User(u64::from_le_bytes(*b"cubetext"));
+
+struct LabelAtlas;
+
+impl egui::plugin::Plugin for LabelAtlas {
+    fn debug_name(&self) -> &'static str {
+        "navigation cube label atlas"
+    }
+
+    fn output_hook(&mut self, ctx: &egui::Context, output: &mut egui::FullOutput) {
+        let size = ctx.fonts(|f| f.font_image_size());
+        let normalize = vec2(1.0 / size[0].max(1) as f32, 1.0 / size[1].max(1) as f32);
+        for shape in &mut output.shapes {
+            if let Shape::Mesh(mesh) = &mut shape.shape
+                && mesh.texture_id == LABEL_PIXELS
+            {
+                let mesh = std::sync::Arc::make_mut(mesh);
+                mesh.texture_id = egui::TextureId::default();
+                for v in &mut mesh.vertices {
+                    v.uv = (v.uv.to_vec2() * normalize).to_pos2();
+                }
+            }
+        }
+    }
+}
+
+/// Warp the font mesh into the projected face, so labels turn with the model.
+pub(crate) fn face_text(painter: &egui::Painter, face: &Facet, ink: Color32, font_size: f32) {
+    let Some((r, down)) = face.text_axes else { return };
+    let opacity = ((face.depth - 0.18) / 0.17).clamp(0.0, 1.0) as f32;
+    if opacity <= 0.0 {
+        return;
+    }
+    let ink = ink.gamma_multiply(opacity);
+    let galley = painter.layout_no_wrap(face.label.clone(), FontId::proportional(font_size), ink);
+    let centre = galley.rect.center();
+    // Keep atlas-pixel UVs until the frame is complete: another label or widget
+    // can grow the atlas after this mesh is created, invalidating early UVs.
+    painter.ctx().add_plugin(LabelAtlas);
+    let text = Shape::Text(egui::epaint::TextShape::new(Pos2::ZERO, galley, ink));
+    let atlas = painter.ctx().fonts(|f| f.font_image_size());
+    let primitives =
+        painter.ctx().tessellate(vec![egui::epaint::ClippedShape { clip_rect: Rect::EVERYTHING, shape: text }], painter.ctx().pixels_per_point());
+    for primitive in primitives {
+        if let egui::epaint::Primitive::Mesh(mut mesh) = primitive.primitive {
+            mesh.texture_id = LABEL_PIXELS;
+            for v in &mut mesh.vertices {
+                v.uv = pos2(v.uv.x * atlas[0] as f32, v.uv.y * atlas[1] as f32);
+                let local = v.pos - centre;
+                v.pos = face.centre + r * local.x + down * (local.y * 1.35);
+            }
+            painter.add(Shape::mesh(mesh));
+        }
+    }
+}
+
+pub(crate) fn paint_cube(painter: &egui::Painter, faces: &[Facet], hovered: Option<usize>, t: Tokens, labels: bool, scale: f32) {
+    // A shared, opaque triangle mesh has no antialiasing fringes between facets.
+    // Per-polygon fringes and miter joins overlap as a face becomes edge-on.
+    let mut fill_mesh = egui::epaint::Mesh::default();
+    let mut edges: Vec<(Pos2, Pos2, usize, bool)> = Vec::new();
+    let hovered_direction = hovered.and_then(|i| faces.get(i)).map(|f| f.direction);
+    for face in faces {
+        let base = t.cube_face;
+        let shade = (0.72 + 0.28 * face.depth.min(1.0)) as f32;
+        let highlighted = hovered_direction == Some(face.direction);
+        let fill = if highlighted {
+            t.cube_hover
+        } else {
+            Color32::from_rgb((f32::from(base.r()) * shade) as u8, (f32::from(base.g()) * shade) as u8, (f32::from(base.b()) * shade) as u8)
+        };
+        let centre = fill_mesh.vertices.len() as u32;
+        fill_mesh.colored_vertex(face.centre, fill);
+        for &p in &face.points {
+            fill_mesh.colored_vertex(p, fill);
+        }
+        for (j, (&a, &b)) in face.points.iter().zip(face.points.iter().cycle().skip(1)).take(face.points.len()).enumerate() {
+            fill_mesh.add_triangle(centre, centre + 1 + j as u32, centre + 1 + ((j + 1) % face.points.len()) as u32);
+            // Coplanar picking regions have no visible seams. Only actual cube
+            // edges and the hovered target's boundary receive an outline.
+            let outer = face.outer_edges.get(j).copied().unwrap_or(false);
+            if !highlighted && !outer {
+                continue;
+            }
+            if let Some(edge) = edges
+                .iter_mut()
+                .find(|(p, q, _, _)| (p.distance_sq(a) < 1e-6 && q.distance_sq(b) < 1e-6) || (p.distance_sq(b) < 1e-6 && q.distance_sq(a) < 1e-6))
+            {
+                edge.2 += usize::from(highlighted);
+                edge.3 |= outer;
+            } else {
+                edges.push((a, b, usize::from(highlighted), outer));
+            }
+        }
+    }
+    painter.add(Shape::mesh(fill_mesh));
+    for (a, b, highlights, outer) in edges {
+        // Two highlighted coplanar patches share an internal subdivision, not
+        // a target boundary. Actual cube edges remain visible across faces.
+        if !outer && highlights != 1 {
+            continue;
+        }
+        let highlighted = highlights > 0;
+        painter.line_segment([a, b], Stroke::new(1.0, if highlighted { t.accent } else { t.cube_border }));
+    }
+    if labels {
+        for face in faces {
+            face_text(painter, face, t.cube_text, 14.0 * scale);
+        }
+    }
+}
+pub(crate) fn arrow(painter: &egui::Painter, at: Pos2, direction: egui::Vec2, hover: bool, t: Tokens) {
+    let side = vec2(-direction.y, direction.x);
+    painter.add(Shape::convex_polygon(
+        vec![at + direction * 7.0, at - direction * 5.0 + side * 7.0, at - direction * 5.0 - side * 7.0],
+        if hover { t.accent_soft } else { t.cube_face },
+        Stroke::new(1.0, if hover { t.accent } else { t.cube_border }),
+    ));
+}
+pub(crate) fn curved_arrow(painter: &egui::Painter, at: Pos2, clockwise: bool, hover: bool, t: Tokens, scale: f32) {
+    let (start, end) =
+        if clockwise { (-std::f32::consts::FRAC_PI_4 + 0.12, 0.0) } else { (-std::f32::consts::FRAC_PI_4 - 0.12, -std::f32::consts::FRAC_PI_2) };
+    let points: Vec<_> = (0..=16)
+        .map(|i| {
+            let angle = egui::lerp(start..=end, f32::from(i as u8) / 16.0);
+            at + vec2(angle.cos(), angle.sin()) * (32.0 * scale)
+        })
+        .collect();
+    painter.add(Shape::line(points.clone(), Stroke::new(5.0 * scale, if hover { t.accent } else { t.cube_border })));
+    painter.add(Shape::line(points.clone(), Stroke::new(3.0 * scale, if hover { t.accent_soft } else { t.cube_face })));
+    if let Some(tip) = points.last() {
+        let sign = if clockwise { 1.0 } else { -1.0 };
+        arrow(painter, *tip, vec2(-end.sin(), end.cos()) * (sign * scale), hover, t);
+    }
+}
+pub(crate) const AXIS_RADIUS: f32 = 11.0;
+pub(crate) fn axis_tip(painter: &egui::Painter, c: Pos2, name: &str, d: &Vec3, at: Pos2, depth: f64, hovered: bool, t: Tokens) {
+    let col = if d.x != 0.0 {
+        t.triad[0]
+    } else if d.y != 0.0 {
+        t.triad[1]
+    } else {
+        t.triad[2]
+    };
+    let positive = !name.starts_with('-');
+    let ink = if depth < -0.01 { col.gamma_multiply(0.55) } else { col };
+    painter.line_segment([c, at], Stroke::new(if positive { 2.0 } else { 1.0 }, ink));
+    painter.circle_filled(at, AXIS_RADIUS, if hovered { t.accent_soft } else { t.overlay });
+    painter.circle_stroke(at, AXIS_RADIUS, Stroke::new(if hovered { 2.0 } else { 1.0 }, if hovered { t.accent } else { ink }));
+    painter.text(at, Align2::CENTER_CENTER, name.to_uppercase(), FontId::proportional(11.0), ink);
+}

assets/icons/ui/source/pointer.rs

@@ -0,0 +1,18 @@
+//! Original agent pointer and label. Animation stays with the UI controller.
+use egui::{Color32, FontId, Pos2, Shape, Stroke, vec2};
+/// The agent pointer's colour (a theme token, so a colour vision mode can reach it).
+pub(crate) fn agent() -> Color32 {
+    crate::theme::Tokens::get().icons.agent
+}
+pub(crate) fn paint(painter: &egui::Painter, p: Pos2) {
+    let ic = crate::theme::Tokens::get().icons;
+    // An arrow pointer, tip at `p`.
+    let pts: Vec<Pos2> =
+        [(0.0, 0.0), (0.0, 17.0), (4.5, 13.0), (7.5, 20.0), (10.5, 18.8), (7.5, 12.0), (13.0, 12.0)].iter().map(|(x, y)| p + vec2(*x, *y)).collect();
+    painter.add(Shape::convex_polygon(pts.clone(), ic.agent, Stroke::NONE));
+    painter.add(Shape::closed_line(pts, Stroke::new(1.5, ic.highlight)));
+    let label = painter.layout_no_wrap("Agent".into(), FontId::proportional(11.0), ic.highlight);
+    let r = egui::Rect::from_min_size(p + vec2(15.0, 18.0), label.size() + vec2(10.0, 4.0));
+    painter.rect_filled(r, 4.0, ic.agent);
+    painter.galley(r.min + vec2(5.0, 2.0), label, ic.highlight);
+}

assets/locales/en.json

@@ -1,4 +1,15 @@
 {
+  "Send your report on GitHub": "Send your report on GitHub",
+  "1. Open GitHub draft below, then paste the report copied to your clipboard.": "1. Open GitHub draft below, then paste the report copied to your clipboard.",
+  "1. Open GitHub draft below. Your title and report will be filled in.": "1. Open GitHub draft below. Your title and report will be filled in.",
+  "2. Attach your screenshot: copy and paste it, or save and upload the PNG.": "2. Attach your screenshot: copy and paste it, or save and upload the PNG.",
+  "3. Click Submit new issue on GitHub to send your report.": "3. Click Submit new issue on GitHub to send your report.",
+  "nav.touchpad.label": "Touchpad",
+  "nav.touchpad.help": "Hold Shift and move the pointer to pan; hold Alt/Option and move it to orbit. No mouse button is needed. Vertical scroll zooms.",
+  "nav.touchpad.orbit": "Orbit (hold Alt/Option and move; no mouse button)",
+  "nav.touchpad.pan": "Pan (hold Shift and move; no mouse button)",
+  "nav.touchpad.zoom": "Zoom (vertical scroll or pinch)",
+  "nav.touchpad.scroll": "Touchpad uses vertical scroll to zoom. Your two-finger pan setting is kept for other presets.",
   "browser.body_name": "Body{number}",
   "browser.component_name": "Component{number}",
   "browser.parameters": "Parameters ({count})",
@@ -25,6 +36,7 @@
   "cmd.component_capture_position": "Capture Position",
   "cmd.component_create": "New Component",
   "cmd.component_delete": "Delete Component",
+  "cmd.component_unlock": "Unlock Contents",
   "cmd.component_from_bodies": "Create Components from Bodies",
   "cmd.component_insert_design": "Insert Design",
   "cmd.component_links": "List Links",
@@ -77,6 +89,9 @@
   "cmd.doc_recovery_list": "Recoverable Designs",
   "cmd.document_inspect": "Inspect Design",
   "cmd.document_units": "Change Design Units",
+  "cmd.document_metadata": "Design Properties",
+  "cmd.document_metadata_set": "Change Design Properties",
+  "cmd.document_metadata_remove": "Remove Design Property",
   "cmd.edit_checkpoint": "Checkpoint",
   "cmd.edit_restore_checkpoint": "Restore Checkpoint",
   "cmd.engine_commands": "List Commands",
@@ -90,8 +105,10 @@
   "cmd.file_insert_mesh": "Insert Mesh",
   "cmd.file_insert_step": "Insert STEP",
   "cmd.file_save_mesh": "Save As Mesh",
+  "cmd.file_slicers": "Installed Slicers",
   "cmd.inspect_accessibility": "Accessibility Analysis",
   "cmd.inspect_center_of_mass": "Center of Mass",
+  "cmd.inspect_compare": "Compare Bodies",
   "cmd.inspect_curvature_comb": "Curvature Comb Analysis",
   "cmd.inspect_curvature_map": "Curvature Map Analysis",
   "cmd.inspect_draft": "Draft Analysis",
@@ -136,6 +153,7 @@
   "cmd.parameters_delete": "Delete Parameter",
   "cmd.parameters_export": "Export Parameters",
   "cmd.parameters_favorite": "Favourite Parameter",
+  "cmd.parameters_move": "Move Parameter",
   "cmd.parameters_graph": "Parameter Graph",
   "cmd.parameters_import": "Import Parameters",
   "cmd.parameters_list": "List Parameters",
@@ -161,6 +179,7 @@
   "cmd.sheet_fold": "Fold",
   "cmd.sheet_hem": "Hem",
   "cmd.sheet_manage_rules": "Sheet Metal Rules",
+  "cmd.sheet_perforate": "Perforate",
   "cmd.sheet_refold": "Refold",
   "cmd.sheet_rules": "List Sheet Metal Rules",
   "cmd.sheet_unfold": "Unfold",
@@ -184,6 +203,8 @@
   "cmd.sketch_constraint_fix": "Fix/UnFix",
   "cmd.sketch_constraint_midpoint": "MidPoint",
   "cmd.sketch_construction": "Normal/Construction",
+  "cmd.sketch_copy": "Copy Sketch Entities",
+  "cmd.sketch_cut": "Cut Sketch Entities",
   "cmd.sketch_delete": "Delete Sketch Entities",
   "cmd.sketch_dimension_text": "Move Dimension Text",
   "cmd.sketch_drag": "Drag Sketch Geometry",
@@ -208,12 +229,14 @@
   "cmd.sketch_move_point": "Drag Sketch Point",
   "cmd.sketch_offset_break": "Break Offset Association",
   "cmd.sketch_options": "Sketch Palette Options",
+  "cmd.sketch_paste": "Paste Sketch Entities",
   "cmd.sketch_point3d": "3D Point",
   "cmd.sketch_polygon_circumscribed": "Circumscribed Polygon",
   "cmd.sketch_polygon_edge": "Edge Polygon",
   "cmd.sketch_polygon_inscribed": "Inscribed Polygon",
   "cmd.sketch_project_to_surface": "Project To Surface",
   "cmd.sketch_rectangle_center": "Center Rectangle",
+  "cmd.sketch_rectangle_rounded": "Rounded Rectangle",
   "cmd.sketch_rectangle_three_point": "3-Point Rectangle",
   "cmd.sketch_rectangle_two_point": "2-Point Rectangle",
   "cmd.sketch_redefine": "Redefine Sketch Plane",
@@ -245,9 +268,24 @@
   "cmd.surface_patch": "Patch",
   "cmd.surface_stitch": "Stitch",
   "cmd.surface_thicken": "Thicken",
+  "cmd.surface_extrude": "Surface Extrude",
+  "cmd.surface_revolve": "Surface Revolve",
+  "cmd.surface_sweep": "Surface Sweep",
+  "cmd.surface_loft": "Surface Loft",
+  "cmd.surface_ruled": "Ruled Surface",
+  "cmd.surface_boundary": "Boundary Surface",
+  "cmd.surface_offset": "Offset Surface",
+  "cmd.surface_blend": "Blend Surface",
+  "cmd.surface_fillet": "Surface Fillet",
+  "cmd.surface_untrim": "Untrim",
+  "cmd.surface_unstitch": "Unstitch",
+  "cmd.surface_reverse_normal": "Reverse Normal",
+  "cmd.inspect_continuity": "Continuity Analysis",
+  "cmd.timeline_add": "Add Recorded Feature",
   "cmd.timeline_compute_all": "Compute All",
   "cmd.timeline_copy": "Copy Features",
   "cmd.timeline_dependents": "Feature Dependents",
+  "cmd.timeline_export_script": "Export Command Script",
   "cmd.timeline_inspect": "Inspect Feature",
   "cmd.timeline_paste": "Paste Features",
   "cmd.timeline_redefine": "Edit Feature",
@@ -261,12 +299,41 @@
   "cmd.view_list": "List Named Views",
   "cmd.view_rename": "Rename Named View",
   "cmd.view_save": "New Named View",
+  "dialog.computing": "Computing… {seconds} s",
   "dialog.custom_axis": "↖ Custom Axis",
   "dialog.edit_title": "EDIT {title}",
   "dialog.select": "↖ Select",
   "dialog.selected_count": "↖ {count} selected",
+  "dialog.step": "Step",
+  "dialog.selection_step": "{step} of {total}: Select {input}",
+  "dialog.selection_guidance": "Select an input to change it. Click selected objects to remove them; Ctrl/Cmd-click also toggles them. Review the preview, then press OK.",
   "document.save_changes": "Save changes to {name}?",
   "document.unsaved_changes": "{name} has unsaved changes. If you don't save, they are lost.",
+  "home.documentation": "Documentation",
+  "home.in_this_browser": "in this browser",
+  "home.missing": "missing",
+  "home.open": "Open…",
+  "home.opened_days_ago": "Opened {count} days ago",
+  "home.opened_hours_ago": "Opened {count} h ago",
+  "home.opened_just_now": "Opened just now",
+  "home.opened_minutes_ago": "Opened {count} min ago",
+  "home.opening": "opening…",
+  "home.recent": "Recent",
+  "home.report_issue": "Report an Issue",
+  "home.samples": "Samples",
+  "home.whats_new": "What's new",
+  "sample.bracket.about": "Base flange with edge flanges and a hem on a 2 mm rule",
+  "sample.bracket.name": "Sheet Metal Bracket",
+  "sample.enclosure.about": "Shelled box with a lip, screw bosses, a rest and a snap fit",
+  "sample.enclosure.name": "Plastic Enclosure",
+  "sample.flange.about": "Hub and flange with a circular pattern driven by a parameter",
+  "sample.flange.name": "Bolted Flange",
+  "sample.hinge.about": "Two components and a revolute joint, driven to 60°",
+  "sample.hinge.name": "Hinge Assembly",
+  "sample.plate.about": "Parametric plate with fillets, holes and a bored boss",
+  "sample.plate.name": "Sample Plate",
+  "sample.vents.about": "Slots in a rectangular pattern: rows, columns and pitch are parameters",
+  "sample.vents.name": "Vent Plate",
   "settings.msaa_applies_on_restart": "Anti-aliasing applies the next time SolidCraft starts",
   "settings.msaa_reset": "{setting}: {requested}× isn't supported by this graphics device; it is now {reset}× (supported: {supported}).",
   "settings.msaa_unsupported": "Not supported by this graphics device",
@@ -284,13 +351,165 @@
   "ui.active_component": "Active component",
   "ui.agent_cursor": "Agent cursor",
   "ui.agent_cursor_speed": "Agent cursor speed",
+  "ui.agent_chat": "Agent chat",
+  "ui.agent_chat_command": "Agent command",
+  "ui.agent_chat_desktop_only": "The agent chat needs the desktop app.",
+  "ui.agent_chat_side": "Agent chat side",
+  "ui.agent_chat_left": "Left",
+  "ui.agent_chat_right": "Right",
+  "ui.agent_chat_turn_limit": "Changes per message",
+  "ui.agent_chat_privacy_note": "SolidCraft sends nothing anywhere: the agent you run talks to its own service under your own account. SolidCraft never sees or stores a key or password.",
+  "ui.agent_chat_connect": "Connect",
+  "ui.agent_chat_stop": "Stop",
+  "ui.agent_chat_stop_tip": "Stop the agent and everything it started",
+  "ui.agent_chat_close": "Close",
+  "ui.agent_chat_minimize": "Minimise to a strip",
+  "ui.agent_chat_dock_left": "Dock on the left",
+  "ui.agent_chat_dock_right": "Dock on the right",
+  "ui.agent_chat_send": "Send",
+  "ui.agent_chat_cancel": "Cancel",
+  "ui.agent_chat_refresh": "Refresh",
+  "ui.agent_chat_pick": "Agent",
+  "ui.agent_chat_custom_hint": "Any program that speaks the Agent Client Protocol on stdin and stdout. No shell runs it.",
+  "ui.agent_chat_not_installed": "Not installed",
+  "ui.agent_chat_none_found": "No coding agent found. Install one of these, then press Refresh:",
+  "ui.agent_chat_detecting": "Looking for agents…",
+  "ui.agent_chat_signed_in": "signed in",
+  "ui.agent_chat_key_in_env": "key set",
+  "ui.agent_chat_not_signed_in": "not signed in",
+  "ui.agent_chat_state_off": "Not connected",
+  "ui.agent_chat_state_starting": "Starting…",
+  "ui.agent_chat_state_ready": "Ready",
+  "ui.agent_chat_state_busy": "Working…",
+  "ui.agent_chat_state_auth": "Sign-in needed",
+  "ui.agent_chat_state_exited": "Agent stopped",
+  "ui.agent_chat_changes_of": "{n}/{limit} changes",
+  "ui.agent_chat_auth_title": "Sign in to the agent",
+  "ui.agent_chat_auth_needed": "The agent asks you to sign in. You sign in with the agent itself; SolidCraft never sees your password or keys.",
+  "ui.agent_chat_auth_none": "The agent offers no sign-in method here: sign in the way its own documentation describes.",
+  "ui.agent_chat_auth_terminal": "Run this in a terminal, then press Connect again:",
+  "ui.agent_chat_auth_agent": "Sign in with {name}",
+  "ui.agent_chat_auth_env": "Set {vars} in your environment and restart SolidCraft.",
+  "ui.agent_chat_auth_retry": "I've signed in: connect again",
+  "ui.agent_chat_copy": "Copy",
+  "ui.agent_chat_permission": "The agent asks to run: {title}",
+  "ui.agent_chat_answered": "Answer: {option}",
+  "ui.agent_chat_approval": "Allow the agent to do this?",
+  "ui.agent_chat_allow": "Allow",
+  "ui.agent_chat_deny": "Deny",
+  "ui.agent_chat_allowed": "Allowed",
+  "ui.agent_chat_denied": "Denied",
+  "ui.agent_chat_changes": "Changes: {n}, one undo step",
+  "ui.agent_chat_undo_changes": "Undo these changes",
+  "ui.agent_chat_undone": "(undone)",
+  "ui.agent_chat_undo_label": "Agent chat: {message}",
+  "ui.agent_chat_limit": "The agent reached the limit of {limit} changes for one message. Send another message to let it go on.",
+  "ui.agent_chat_refused": "Not allowed for the agent: {reason}",
+  "ui.agent_chat_wait_turn": "The agent is still working on the last message: wait for it or press Cancel.",
+  "ui.agent_chat_placeholder": "Ask the agent to change the design…",
+  "ui.agent_chat_attach_view": "Attach view",
+  "ui.agent_chat_attach_view_tip": "Send a picture of the current view with the message",
+  "ui.agent_chat_no_images": "This agent doesn't take pictures",
+  "ui.agent_chat_view_attached": "View attached",
+  "ui.agent_chat_no_cli": "solidcraft-cli was not found next to the app, so the agent can't reach the design.",
+  "ui.agent_chat_no_control": "The agent chat's endpoint did not start, so the agent can't reach the design.",
+  "ui.agent_chat_exited": "The agent stopped.",
+  "ui.agent_chat_failed_start": "The agent could not start: {error}",
+  "ui.agent_chat_intro": "Chat with a coding agent you already use, or a model endpoint you choose. It works on the open design through SolidCraft's tools: its changes show as it makes them and undo as one step per message. What it may do without asking is set in Preferences > AI.",
+  "ui.agent_chat_privacy": "Nothing goes anywhere except to the agent you run, under your own account.",
+  "ui.agent_chat_none_found_short": "No agent found",
+  "ui.ai_add": "Add",
+  "ui.ai_add_agent": "Add agent…",
+  "ui.ai_add_agent_title": "Add agent",
+  "ui.ai_add_api": "OpenAI-compatible API",
+  "ui.ai_add_custom": "Custom command",
+  "ui.ai_added": "added",
+  "ui.ai_add_installed": "Installed agent",
+  "ui.ai_add_installed_note": "An entry of your own for an installed agent, for example with other arguments. Installed agents are listed by themselves.",
+  "ui.ai_agent_mode_tip": "The agent's own mode: its own tools (shell, file edits) follow it. SolidCraft's tools follow the permissions in Preferences > AI.",
+  "ui.ai_agents": "Agents",
+  "ui.ai_always_allow": "Always allow",
+  "ui.ai_always_allowed": "Always allowed",
+  "ui.ai_always_allowed_none": "Nothing is always allowed yet. \"Always allow\" answers you give in the chat are listed here.",
+  "ui.ai_always_allow_tip": "Allow {tool} for this agent from now on, without asking",
+  "ui.ai_auto_allowed": "Auto-allowed: {title} ({why})",
+  "ui.ai_auto_mode": "your permission setting",
+  "ui.ai_auto_ours": "SolidCraft checks its own tools itself",
+  "ui.ai_auto_remembered": "you chose Always allow",
+  "ui.ai_bad_url": "Enter a URL that starts with http:// or https://",
+  "ui.ai_base_url": "Base URL",
+  "ui.ai_button": "AI",
+  "ui.ai_copy_suffix": "copy",
+  "ui.ai_custom_url": "Custom URL",
+  "ui.ai_default": "Default",
+  "ui.ai_http_busy": "the endpoint is busy or over its limit; try again later",
+  "ui.ai_http_key": "the endpoint refused the key: check it in Preferences > AI",
+  "ui.ai_http_not_found": "no such endpoint or model: check the base URL and the model name",
+  "ui.ai_key": "API key",
+  "ui.ai_keychain_error": "The system keychain refused: {error}",
+  "ui.ai_key_hint": "optional; kept in the system keychain",
+  "ui.ai_key_needs_https": "A key is only sent over HTTPS, or to this computer.",
+  "ui.ai_key_note": "Stored in the system keychain, never in SolidCraft's settings. Leave it empty for a local server.",
+  "ui.ai_mode_all": "Allow everything",
+  "ui.ai_mode_all_note": "Nothing asks first. Crash reports stay off limits and the folder limits still apply.",
+  "ui.ai_mode_all_warning": "The agent can save, overwrite, export and replace your design without asking. Use this only with an agent you trust, on designs you have saved.",
+  "ui.ai_mode_ask": "Ask every time",
+  "ui.ai_mode_ask_note": "Every change to the design, and every file action, waits for your Allow.",
+  "ui.ai_mode_edits": "Auto-allow model edits",
+  "ui.ai_mode_edits_note": "Modelling commands run without asking; saving, opening, exporting and other file or destructive actions still ask.",
+  "ui.ai_mode_global": "As set above",
+  "ui.ai_model": "Model",
+  "ui.ai_modes_scope": "These settings cover SolidCraft's tools. An agent's own tools (its shell, its file edits) follow the agent's own mode, which you pick in the chat panel's header when the agent has modes.",
+  "ui.ai_name": "Name",
+  "ui.ai_need_command": "Enter the command that starts the agent",
+  "ui.ai_need_model": "Enter the model name",
+  "ui.ai_no_answer": "The agent did not answer in time",
+  "ui.ai_no_http": "This build can't reach API endpoints",
+  "ui.ai_no_keychain": "The system keychain isn't available, so a key can't be stored. A local server without a key still works.",
+  "ui.ai_panel": "Panel",
+  "ui.ai_permissions": "Permissions",
+  "ui.ai_preset": "Preset",
+  "ui.ai_remove": "Remove",
+  "ui.ai_request_limit": "stopped after 24 requests for one message; send another message to go on",
+  "ui.ai_reset": "Reset",
+  "ui.ai_settings": "AI settings…",
+  "ui.ai_show_features": "Show AI features",
+  "ui.ai_show_features_note": "The agent chat: a panel where a coding agent you already use, or a model endpoint you choose, works on the open design. Off: no AI button, shortcut, menu entry or panel, and nothing is looked for or started.",
+  "ui.ai_switch_tip": "Change the agent for this conversation",
+  "ui.ai_test": "Test",
+  "ui.ai_test_acp_ok": "Answers: {agent}",
+  "ui.ai_test_acp_tip": "Starts the agent briefly and asks it for a session; ends it again",
+  "ui.ai_test_api_tip": "Asks the endpoint for its models",
+  "ui.ai_testing": "Testing…",
+  "ui.ai_test_no_model": "Reached: {count} models, but not {model}",
+  "ui.ai_test_ok": "Reached: {count} models",
+  "ui.ai_toolbar_button": "Show button in toolbar",
+  "ui.ai_toolbar_button_note": "The AI button at the right end of the toolbar. Ctrl+Shift+A and the View menu still open the panel.",
+  "ui.ai_tool_done": "done",
+  "ui.ai_tool_failed": "failed",
+  "ui.ai_tool_running": "running",
+  "ui.ai_tool_unfold": "Click to show what it returned",
+  "ui.ai_tool_waiting": "waiting",
+  "ui.ai_undo_tip": "Undo everything the agent changed for this message, as one step",
+  "AI": "AI",
   "ui.all": "All",
+  "ui.analysis": "Analysis",
   "ui.angle": "Angle",
   "ui.angle_decimals": "Angle decimals",
   "ui.animate_view_changes": "Animate view changes",
   "ui.animation": "Animation",
   "ui.animation_speed": "Animation speed",
   "ui.anti_aliasing": "Anti-aliasing",
+  "ui.supersampling": "Supersampling (SSAA)",
+  "ui.supersampling_off": "Off (1×)",
+  "ui.supersampling_adaptive": "Only when the view is still",
+  "settings.supersampling_note": "Draws the view at a higher resolution and filters it down: smoother edges, lines and grid on screens below 4K. It costs GPU time: about 2.25× the pixels at 1.5× and 4× at 2×.",
+  "ui.display_quality": "Display quality",
+  "ui.display_quality_coarse": "Coarse",
+  "ui.display_quality_normal": "Normal",
+  "ui.display_quality_fine": "Fine",
+  "ui.display_quality_ultra": "Ultra",
+  "settings.display_quality_note": "Finer levels draw curved faces and edges smoother and take longer to mesh. Only the viewport changes, never the design or exports.",
   "ui.apply": "Apply",
   "ui.arc": "Arc",
   "ui.assemble": "Assemble",
@@ -310,6 +529,8 @@
   "ui.chamfer_type": "Chamfer Type",
   "ui.change_workspace": "Change workspace",
   "ui.chord_length": "Chord Length",
+  "ui.curvature_g2": "Curvature (G2)",
+  "ui.equivalent_radius": "Equivalent Radius",
   "ui.circle": "Circle",
   "ui.circular_pattern": "Circular Pattern",
   "ui.clear": "Clear",
@@ -318,13 +539,51 @@
   "ui.click_selects_whole_bodies": "Click selects whole bodies",
   "ui.click_then_press_key": "Click, then press the new key",
   "ui.close": "Close",
+  "ui.material_review.title": "Review Physical Material Data",
+  "ui.material_review.scope": "Candidate only: not assigned or saved. Numerical validation is not engineering certification.",
+  "ui.material_review.input": "Paste a schema-1 material card (JSON)",
+  "ui.material_review.review": "Review card",
+  "ui.material_review.limit": "The card exceeds the 256 KiB input limit.",
+  "ui.material_review.unknown": "Unknown",
+  "ui.material_review.properties": "Properties",
+  "ui.material_review.conditions": "Stated conditions",
+  "ui.material_review.source": "Source",
+  "ui.material_review.axes": "Material-local axes; no body orientation is assigned.",
+  "ui.material_review.derived": "Derived isotropic moduli",
+  "ui.material_review.claims": "Sources and licences are unverified claims. Missing values remain unknown.",
+  "ui.material_review.density": "Density",
+  "ui.material_review.elasticity": "Elasticity",
+  "ui.material_review.tensile_strength": "Tensile strength",
+  "ui.material_review.compressive_strength": "Compressive strength",
+  "ui.material_review.yield_strength": "Yield strength",
+  "ui.material_review.shear_strength": "Shear strength",
+  "ui.material_review.thermal_conductivity": "Thermal conductivity",
+  "ui.material_review.thermal_expansion": "Thermal expansion",
+  "ui.material_review.specific_heat": "Specific heat",
+  "ui.material_review.moisture_unit": "kg water / kg dry material",
   "ui.coil": "Coil",
   "ui.coincident": "Coincident",
   "ui.collapse": "Collapse",
   "ui.collinear": "Collinear",
+  "ui.colour_vision": "Colour vision",
+  "ui.colour_vision_deutan": "Deutan",
+  "ui.colour_vision_deutan_tip": "For a weak or missing green sense",
+  "ui.colour_vision_failed": "Failed",
+  "ui.colour_vision_fixed": "Fixed",
+  "ui.colour_vision_mode": "Mode",
+  "ui.colour_vision_note": "Changes the colours that carry a meaning: sketch states, axes, bends, analyses and icons. If you use Windows colour filters, keep this Off.",
+  "ui.colour_vision_off": "Off",
+  "ui.colour_vision_off_tip": "The theme's own colours",
+  "ui.colour_vision_projected": "Projected",
+  "ui.colour_vision_protan": "Protan",
+  "ui.colour_vision_protan_tip": "For a weak or missing red sense",
+  "ui.colour_vision_sample": "Sample",
+  "ui.colour_vision_tritan": "Tritan",
+  "ui.colour_vision_tritan_tip": "For a weak or missing blue sense",
   "ui.combine": "Combine",
   "ui.coming_later": "coming later",
   "ui.concentric": "Concentric",
+  "ui.configurations": "Configurations",
   "ui.conic_curve": "Conic Curve",
   "ui.constant": "Constant",
   "ui.constraints_conflict": "Constraints conflict",
@@ -362,6 +621,7 @@
   "ui.drawing": "Drawing",
   "ui.drill_point": "Drill Point",
   "ui.edit": "Edit",
+  "ui.edit_section_analysis": "Edit Section Analysis",
   "ui.ellipse": "Ellipse",
   "ui.end_radius": "End Radius",
   "ui.entities": "Entities",
@@ -374,6 +634,7 @@
   "ui.extent_type": "Extent Type",
   "ui.extrude": "Extrude",
   "ui.factor": "Factor",
+  "ui.feature_history": "Feature history",
   "ui.feature_options": "Feature Options",
   "ui.features": "Features",
   "ui.file": "File",
@@ -530,6 +791,10 @@
   "ui.quit": "Quit",
   "ui.radial_context_menu": "Radial context menu",
   "ui.radius": "Radius",
+  "ui.pull_direction": "Pull direction",
+  "ui.tool_direction": "Tool direction",
+  "ui.reachable": "Reachable",
+  "ui.blocked": "Blocked",
   "ui.radius_type": "Radius Type",
   "ui.rectangle": "Rectangle",
   "ui.rectangular_pattern": "Rectangular Pattern",
@@ -544,9 +809,33 @@
   "ui.revolve": "Revolve",
   "ui.right": "Right",
   "ui.save": "Save",
+  "ui.heading_save_mesh": "SAVE AS MESH",
+  "ui.format": "Format",
+  "ui.mesh_format_stl": "STL",
+  "ui.mesh_format_3mf": "3MF",
+  "ui.mesh_format_3mf_tagged": "3MF with face tags",
+  "ui.send_to_slicer": "Send to slicer",
+  "ui.slicer": "Slicer",
+  "ui.custom_program": "Custom…",
+  "ui.no_slicer_found": "No slicer found",
+  "ui.send": "Send",
+  "ui.custom_program_tip": "Choose a slicer program to add to the list",
+  "ui.slicer_delete_tip": "{program}\nPress Delete to remove it from the list",
+  "ui.save_mesh_pick_bodies": "Select the bodies to save",
+  "ui.save_mesh_no_slicer": "No slicer found: choose Custom… and pick your slicer program, or turn off Send to slicer",
+  "ui.not_a_program": "{path} is not a program that can be started",
+  "ui.sent_to_slicer": "Sent to {slicer}",
+  "ui.saved_to": "Saved {path}",
+  "ui.save_mesh_temp_failed": "Couldn't make {folder}: {error}",
   "ui.save_as": "Save As",
   "ui.save_as_ellipsis": "Save As...",
   "ui.scale": "Scale",
+  "ui.orientation": "Orientation",
+  "ui.twist": "Twist",
+  "ui.end_scale": "End Scale",
+  "ui.sweep_turn_with_path": "Turn with Path",
+  "ui.sweep_keep_as_drawn": "Keep as Drawn",
+  "ui.sweep_follow_direction": "Follow Direction",
   "ui.section_analysis": "Section Analysis",
   "ui.select": "Select",
   "ui.select_other_hint": "Select Other: hold the left button still on the model (or right-click › Select Other…) to list everything under the cursor; click again on the same spot to select the next thing there.",
@@ -554,7 +843,6 @@
   "ui.shell": "Shell",
   "ui.show": "Show",
   "ui.show_constraints": "Constraints",
-  "ui.show_construction_geometries": "Construction Geometries",
   "ui.show_dimensions": "Dimensions",
   "ui.show_points": "Show Points",
   "ui.show_profile": "Show Profile",
@@ -595,6 +883,9 @@
   "ui.theme": "Theme",
   "ui.thickness": "Thickness",
   "ui.thread": "Thread",
+  "ui.timeline_bottom": "Bottom timeline",
+  "ui.timeline_left_note": "The left layout shows the rollback bar above the parts and scene browser.",
+  "ui.timeline_left_sidebar": "Left sidebar",
   "ui.tip_angle": "Tip Angle",
   "ui.to_object": "To Object",
   "ui.top": "Top",
@@ -696,6 +987,8 @@
   "Files from many CAD programs have Y up, so they open lying on their back here (Z up).": "Files from many CAD programs have Y up, so they open lying on their back here (Z up).",
   "Filter": "Filter",
   "Find in Browser": "Find in Browser",
+  "Copy Error Message": "Copy Error Message",
+  "Copy Warning Message": "Copy Warning Message",
   "Flat size": "Flat size",
   "Follow camera (Look At sketches)": "Follow camera (Look At sketches)",
   "Font": "Font",
@@ -858,5 +1151,231 @@
   "Double-clicking the middle button in the view: Home (the home view, framing what is shown), Fit (frame what is shown, keeping the orientation) or nothing": "Double-clicking the middle button in the view: Home (the home view, framing what is shown), Fit (frame what is shown, keeping the orientation) or nothing",
   "Select Other: hold the left button still on the model (or right-click › Select Other…) to list everything under the cursor; click again on the same spot to select the next thing there. Double-click the middle button to go Home (Preferences › Navigation).": "Select Other: hold the left button still on the model (or right-click › Select Other…) to list everything under the cursor; click again on the same spot to select the next thing there. Double-click the middle button to go Home (Preferences › Navigation).",
   "cmd.render_backends": "Render Backends",
-  "cmd.view_navigate": "Navigate View"
-}
+  "cmd.view_navigate": "Navigate View",
+  "ui.animateJoint": "Animate Joint",
+  "ui.calibrate": "Calibrate",
+  "ui.customizeToolbar": "Customize Toolbar…",
+  "ui.editJointLimits": "Edit Joint Limits",
+  "ui.exportDxf": "Export DXF…",
+  "ui.findInTimeline": "Find in Timeline",
+  "ui.findInWindow": "Find in Window",
+  "ui.fit": "Fit",
+  "ui.groupSelected": "Group Selected",
+  "ui.hideAxes": "Hide Axes",
+  "ui.hideDimension": "Hide Dimension",
+  "ui.hideOrigin": "Hide Origin",
+  "ui.hidePlanes": "Hide Planes",
+  "ui.hideProfile": "Hide Profile",
+  "ui.homeView": "Home View",
+  "ui.isolate": "Isolate",
+  "ui.lock": "Lock",
+  "ui.newSketchGroup": "New Sketch Group",
+  "ui.normalConstruction": "Normal / Construction",
+  "ui.orbit": "Orbit",
+  "ui.heading_position": "POSITION",
+  "ui.pan": "Pan",
+  "ui.pinToShortcuts": "Pin to Shortcuts",
+  "ui.pinToToolbar": "Pin to Toolbar",
+  "ui.properties": "Properties",
+  "ui.design_properties.project": "Project",
+  "ui.design_properties.part_number": "Part number",
+  "ui.design_properties.revision": "Revision",
+  "ui.design_properties.author": "Author",
+  "ui.design_properties.organization": "Organization",
+  "ui.design_properties.description": "Description",
+  "ui.design_properties.license": "License",
+  "ui.design_properties.not_text": "Saved as something other than text; typing here replaces it.",
+  "ui.design_properties.exports": "STEP, IGES and 3MF exports carry these where the format has a place for them.",
+  "ui.design_properties.others": "Other tools' data",
+  "ui.design_properties.others_note": "Kept in the design as it is and never exported.",
+  "ui.removeSection": "Remove Section",
+  "ui.removeFromToolbar": "Remove from Toolbar",
+  "ui.repeat": "Repeat",
+  "ui.report_a_bug": "Report a bug",
+  "ui.restore": "Restore",
+  "ui.heading_setup": "SETUP",
+  "ui.selectOther": "Select Other…",
+  "ui.selectTangentChain": "Select Tangent Chain",
+  "ui.showAll": "Show All",
+  "ui.showAllBodies": "Show All Bodies",
+  "ui.showAxes": "Show Axes",
+  "ui.showDimension": "Show Dimension",
+  "ui.showOrigin": "Show Origin",
+  "ui.showPlanes": "Show Planes",
+  "ui.suppress": "Suppress",
+  "ui.command_palette_hint": "Type a command, e.g. {example}  — or press S to search",
+  "ui.unground": "Unground",
+  "ui.unisolate": "Unisolate",
+  "ui.unlock": "Unlock",
+  "ui.unsuppress": "Unsuppress",
+  "ui.updateToCurrentView": "Update to Current View",
+  "ui.zoom": "Zoom",
+  "ui.command_done": "{command} done",
+  "drive.stopped_by_loop": "Stopped at {value}: the loop through {joint} can't close any further",
+  "drive.stopped_by_contact": "Stopped at {value}: {a} would pass through {b}",
+  "drive.unconnected": "Moves nothing: {part} is not connected to anything grounded",
+  "timeline.group": "New Feature Folder",
+  "timeline.ungroup": "Remove Feature Folders",
+  "timeline.rename_group": "Rename Feature Folder",
+  "timeline.move_to_group": "Move Features to Folder",
+  "timeline.move_many": "Move Timeline Items",
+  "timeline.reorder_many": "Reorder Features",
+  "ui.show_construction_geometries": "Construction Geometries",
+  "ui.total_angle": "Total angle",
+  "sketch_text.builtin_font": "{family} (built-in)",
+  "sketch_text.font_search": "Search fonts",
+  "sketch_text.loading_fonts": "Looking for installed fonts…",
+  "sketch_text.use_font_file": "Use the font file {path}",
+  "sketch_text.bold": "Bold",
+  "sketch_text.italic": "Italic",
+  "sketch_text.align_left": "Left",
+  "sketch_text.align_center": "Center",
+  "sketch_text.align_right": "Right",
+  "sketch_text.path_hint": "A curve of the sketch the text follows: click here, then the curve",
+  "sketch_text.path_clear": "Take the text off its curve",
+  "Style": "Style",
+  "Alignment": "Alignment",
+  "Letter Spacing": "Letter Spacing",
+  "Line Spacing": "Line Spacing",
+  "Path": "Path",
+  "sketch_text.on_path": "The text follows its path: the curve places it",
+  "cmd.library_inspect": "Inspect Local Library",
+  "cmd.library_export": "Export Design Library",
+  "cmd.library_apply": "Apply Local Library Entry",
+  "Thin": "Thin",
+  "Thin Extrude": "Thin Extrude",
+  "Wall Location": "Wall Location",
+  "Wall Thickness": "Wall Thickness",
+  "Thickness Outside": "Thickness Outside",
+  "Inside": "Inside",
+  "Outside": "Outside",
+  "Profiles/Curves": "Profiles/Curves",
+  "cmd.material_properties_validate": "Validate Physical Material Data",
+  "cmd.material_properties_directional": "Directional Elastic Modulus",
+  "update.button": "Update",
+  "update.button_tip": "SolidCraft {version} is available",
+  "install.menu": "Install app…",
+  "install.button_tip": "Install SolidCraft as an app: it opens in its own window and works offline",
+  "install.title": "Install SolidCraft",
+  "install.steps_intro": "Safari installs web apps from its own menus:",
+  "install.home_screen_1": "Tap Share (in the … menu if it isn't on the toolbar).",
+  "install.home_screen_2": "Choose Add to Home Screen.",
+  "install.home_screen_3": "Tap Add.",
+  "install.home_screen_after": "SolidCraft then opens from its icon on the Home Screen, without Safari's toolbars, and works offline.",
+  "install.dock_1": "Choose File › Add to Dock.",
+  "install.dock_2": "Click Add.",
+  "install.dock_after": "SolidCraft then opens in its own window from the Dock, and works offline.",
+  "install.done": "Done",
+  "update.title": "Update available",
+  "update.available": "SolidCraft {version} is available",
+  "update.you_have": "You have {version}.",
+  "update.no_notes": "This release has no notes.",
+  "update.system_hint": "This copy is a {kind}. Update it with:",
+  "update.package_hint": "This copy came from a {kind}. Download the new package, then install it with:",
+  "update.copy": "Copy",
+  "update.file": "Download gets {file}.",
+  "update.download": "Download",
+  "update.release_page": "Open release page",
+  "update.skip": "Skip this version",
+  "update.later": "Remind me later",
+  "update.prefs_label": "Updates",
+  "update.check_automatically": "Check for updates automatically",
+  "update.check_now": "Check now",
+  "update.checking": "Checking…",
+  "update.failed": "Couldn't check: {error}",
+  "update.up_to_date": "SolidCraft is up to date.",
+  "update.prefs_note": "This is SolidCraft {version} ({kind}). A check asks GitHub for the latest release and sends nothing else.",
+  "update.prefs_dev": "This is a development build ({version}): it doesn't check for updates.",
+  "update.show": "Show the update to {version}",
+  "update.prefs_flatpak": "Flatpak updates this copy ({version}): run {command} or use your software center. SolidCraft doesn't check.",
+  "update.update_now": "Update now",
+  "update.install_msi": "Install (closes SolidCraft)",
+  "update.download_open": "Download and open",
+  "update.downloading": "Downloading and verifying… {done} of {total} MB",
+  "update.installed": "SolidCraft {version} is installed. Restart to use it.",
+  "update.restart": "Restart now",
+  "update.restart_later": "Later",
+  "update.installer_started": "The installer starts when SolidCraft closes.",
+  "update.dmg_opened": "The disk image is open and verified: drag SolidCraft to Applications, replacing the old copy, then restart SolidCraft.",
+  "update.install_failed": "The update didn't install: {error}. Nothing was changed; Download gets the package instead.",
+  "cmd.render_settings_get": "Render Settings",
+  "cmd.render_settings_set": "Save Render Settings",
+  "cmd.render_scene": "Inspect Render Scene",
+  "cmd.render_settings_apply": "Apply Render Camera",
+  "toolbar.render": "RENDER",
+  "toolbar.render_scene": "SCENE",
+  "render.preview": "Integrated preview",
+  "render.preview_help": "Raster shading and blended transparency. Refraction, HDRI and final rendering are not available yet.",
+  "render.setup_name": "Setup name",
+  "render.background": "Scene background",
+  "render.perspective": "Perspective camera",
+  "render.fit": "Fit Product",
+  "render.restore_camera": "Restore Saved Camera",
+  "render.save_setup": "Save Setup",
+  "render.unsaved": "Unsaved preview changes",
+  "render.reload_settings": "Reload Saved Settings",
+  "render.unavailable_preview": "This setup requests an unavailable preview profile.",
+  "render.use_preview": "Use Integrated Preview",
+  "render.navigation_help": "The camera moves as in Design (Preferences › Navigation). Save Setup records the current camera.",
+  "render.return_design": "Return to Design",
+  "render.image_title": "Render Image",
+  "render.image_help": "CPU preview image · PNG · approximate transparency",
+  "render.image_width": "Width",
+  "render.image_height": "Height",
+  "render.image_transparent": "Transparent background",
+  "render.image_check": "Check Render Request",
+  "render.image_supported": "Render request is supported; the queue and memory pool are checked again at start.",
+  "render.image_queued": "Waiting to render",
+  "render.image_preparing": "Preparing image",
+  "render.image_running": "Rendering image",
+  "render.image_encoding": "Encoding PNG",
+  "render.image_cancelling": "Cancelling",
+  "render.image_cancelled": "Render cancelled",
+  "render.image_completed": "Image ready to export",
+  "render.image_failed": "Render failed",
+  "render.image_unknown": "Render status unavailable",
+  "render.image_reduce": "Try a smaller image or simpler scene.",
+  "render.image_too_large": "Over the image limit: 4096 pixels per side and 4,194,304 pixels in all.",
+  "render.image_use_largest": "Use the largest size at this aspect:",
+  "render.image_cancel": "Cancel Render",
+  "render.image_stale": "This image uses the scene captured before subsequent changes.",
+  "render.image_start": "Start Render",
+  "render.image_overwrite": "Replace existing file",
+  "render.image_export": "Export PNG",
+  "cmd.render_preflight": "Check Render Request",
+  "cmd.render_start": "Render Image",
+  "cmd.render_status": "Render Progress",
+  "cmd.render_cancel": "Cancel Render",
+  "cmd.render_export": "Export Render Image",
+  "toolbar.image": "IMAGE",
+  "appearance.surface_response": "Surface response",
+  "appearance.pbr_opaque": "Opaque PBR",
+  "appearance.metallic": "Metallic",
+  "appearance.roughness": "Roughness",
+  "appearance.dielectric_ior": "Dielectric IOR",
+  "appearance.pbr_help": "View this surface in Render or a product PNG. No refraction or transmission.",
+  "render.opaque_preview_help": "Opaque PBR and simple colors; blended transparency. Refraction, HDRI and final rendering are not available yet.",
+  "render.opaque_image_summary": "Preview PNG · opaque PBR · blended transparency",
+  "UNTRIM": "UNTRIM",
+  "Face": "Face",
+  "Holes": "Holes",
+  "Holes (edges on them)": "Holes (edges on them)",
+  "In place (surfaces)": "In place (surfaces)",
+  "None": "None",
+  "Picked": "Picked",
+  "Restore outer boundary": "Restore outer boundary",
+  "RULED SURFACE": "RULED SURFACE",
+  "Mitre": "Mitre",
+  "Reference face": "Reference face",
+  "Round": "Round",
+  "joint.one_component": "These parts are bodies of one component: {bodies}. A joint moves one component against another, so each part needs a component of its own.",
+  "joint.one_body": "Both picks are on {body}. Pick the second one on another part.",
+  "joint.from_bodies_hint": "Each picked body moves into a new component of its own and stays where it is.",
+  "Circumference": "Circumference",
+  "Arc length": "Arc length",
+  "Slot width": "Slot width",
+  "Centre to centre": "Centre to centre",
+  "Overall length": "Overall length",
+  "Min": "Min",
+  "Max": "Max"
+}

assets/locales/ja.json

@@ -1,4 +1,15 @@
 {
+  "Send your report on GitHub": "GitHubでレポートを送信",
+  "1. Open GitHub draft below, then paste the report copied to your clipboard.": "1. 下のボタンでGitHubの下書きを開き、クリップボードにコピーされたレポートを貼り付けます。",
+  "1. Open GitHub draft below. Your title and report will be filled in.": "1. 下のボタンでGitHubの下書きを開きます。タイトルとレポートは入力済みです。",
+  "2. Attach your screenshot: copy and paste it, or save and upload the PNG.": "2. スクリーンショットを添付します。コピーして貼り付けるか、PNGを保存してアップロードします。",
+  "3. Click Submit new issue on GitHub to send your report.": "3. GitHubでSubmit new issueをクリックしてレポートを送信します。",
+  "nav.touchpad.label": "タッチパッド",
+  "nav.touchpad.help": "Shift を押しながらポインターを動かすとパン、Alt/Option を押しながら動かすと回転します。マウスボタンは不要です。縦スクロールでズームします。",
+  "nav.touchpad.orbit": "回転（Alt/Option を押しながら移動、マウスボタン不要）",
+  "nav.touchpad.pan": "パン（Shift を押しながら移動、マウスボタン不要）",
+  "nav.touchpad.zoom": "ズーム（縦スクロールまたはピンチ）",
+  "nav.touchpad.scroll": "タッチパッドでは縦スクロールでズームします。2 本指パンの設定は他のプリセット用に保持されます。",
   "browser.body_name": "ボディ{number}",
   "browser.component_name": "コンポーネント{number}",
   "browser.parameters": "パラメータ ({count})",
@@ -25,6 +36,7 @@
   "cmd.component_capture_position": "位置をキャプチャ",
   "cmd.component_create": "新規コンポーネント",
   "cmd.component_delete": "コンポーネントを削除",
+  "cmd.component_unlock": "内容のロックを解除",
   "cmd.component_from_bodies": "ボディからコンポーネントを作成",
   "cmd.component_insert_design": "デザインを挿入",
   "cmd.component_links": "リンクを一覧表示",
@@ -77,6 +89,9 @@
   "cmd.doc_recovery_list": "復元可能なデザイン",
   "cmd.document_inspect": "デザインを検査",
   "cmd.document_units": "デザインの単位を変更",
+  "cmd.document_metadata": "デザインのプロパティ",
+  "cmd.document_metadata_set": "デザインのプロパティを変更",
+  "cmd.document_metadata_remove": "デザインのプロパティを削除",
   "cmd.edit_checkpoint": "チェックポイント",
   "cmd.edit_restore_checkpoint": "チェックポイントを復元",
   "cmd.engine_commands": "コマンドを一覧表示",
@@ -90,8 +105,10 @@
   "cmd.file_insert_mesh": "メッシュを挿入",
   "cmd.file_insert_step": "STEP を挿入",
   "cmd.file_save_mesh": "メッシュとして保存",
+  "cmd.file_slicers": "インストール済みのスライサー",
   "cmd.inspect_accessibility": "アクセシビリティ解析",
   "cmd.inspect_center_of_mass": "重心",
+  "cmd.inspect_compare": "ボディを比較",
   "cmd.inspect_curvature_comb": "曲率コーム解析",
   "cmd.inspect_curvature_map": "曲率マップ解析",
   "cmd.inspect_draft": "勾配解析",
@@ -136,6 +153,7 @@
   "cmd.parameters_delete": "パラメータを削除",
   "cmd.parameters_export": "パラメータをエクスポート",
   "cmd.parameters_favorite": "お気に入りパラメータ",
+  "cmd.parameters_move": "パラメータを移動",
   "cmd.parameters_graph": "パラメータ グラフ",
   "cmd.parameters_import": "パラメータをインポート",
   "cmd.parameters_list": "パラメータを一覧表示",
@@ -161,6 +179,7 @@
   "cmd.sheet_fold": "折り曲げ",
   "cmd.sheet_hem": "ヘミング",
   "cmd.sheet_manage_rules": "板金ルール",
+  "cmd.sheet_perforate": "パンチング",
   "cmd.sheet_refold": "折り戻し",
   "cmd.sheet_rules": "板金ルールを一覧表示",
   "cmd.sheet_unfold": "展開",
@@ -184,6 +203,8 @@
   "cmd.sketch_constraint_fix": "固定/固定解除",
   "cmd.sketch_constraint_midpoint": "中点",
   "cmd.sketch_construction": "標準/コンストラクション",
+  "cmd.sketch_copy": "スケッチ要素をコピー",
+  "cmd.sketch_cut": "スケッチ要素を切り取り",
   "cmd.sketch_delete": "スケッチ要素を削除",
   "cmd.sketch_dimension_text": "寸法テキストを移動",
   "cmd.sketch_drag": "スケッチ ジオメトリをドラッグ",
@@ -208,12 +229,14 @@
   "cmd.sketch_move_point": "スケッチ点をドラッグ",
   "cmd.sketch_offset_break": "オフセット関連付けを解除",
   "cmd.sketch_options": "スケッチ パレット オプション",
+  "cmd.sketch_paste": "スケッチ要素を貼り付け",
   "cmd.sketch_point3d": "3D 点",
   "cmd.sketch_polygon_circumscribed": "外接ポリゴン",
   "cmd.sketch_polygon_edge": "エッジ ポリゴン",
   "cmd.sketch_polygon_inscribed": "内接ポリゴン",
   "cmd.sketch_project_to_surface": "サーフェスに投影",
   "cmd.sketch_rectangle_center": "中心指定の長方形",
+  "cmd.sketch_rectangle_rounded": "角丸長方形",
   "cmd.sketch_rectangle_three_point": "3点指定長方形",
   "cmd.sketch_rectangle_two_point": "2点指定長方形",
   "cmd.sketch_redefine": "スケッチ平面を再定義",
@@ -245,9 +268,24 @@
   "cmd.surface_patch": "パッチ",
   "cmd.surface_stitch": "ステッチ",
   "cmd.surface_thicken": "厚み付け",
+  "cmd.surface_extrude": "サーフェス押し出し",
+  "cmd.surface_revolve": "サーフェス回転",
+  "cmd.surface_sweep": "サーフェススイープ",
+  "cmd.surface_loft": "サーフェスロフト",
+  "cmd.surface_ruled": "ルールドサーフェス",
+  "cmd.surface_boundary": "境界サーフェス",
+  "cmd.surface_offset": "オフセットサーフェス",
+  "cmd.surface_blend": "ブレンドサーフェス",
+  "cmd.surface_fillet": "サーフェスフィレット",
+  "cmd.surface_untrim": "トリム解除",
+  "cmd.surface_unstitch": "縫い合わせ解除",
+  "cmd.surface_reverse_normal": "法線を反転",
+  "cmd.inspect_continuity": "連続性解析",
+  "cmd.timeline_add": "記録したフィーチャーを追加",
   "cmd.timeline_compute_all": "すべて再計算",
   "cmd.timeline_copy": "フィーチャーをコピー",
   "cmd.timeline_dependents": "従属フィーチャー",
+  "cmd.timeline_export_script": "コマンド スクリプトをエクスポート",
   "cmd.timeline_inspect": "フィーチャーを検査",
   "cmd.timeline_paste": "フィーチャーを貼り付け",
   "cmd.timeline_redefine": "フィーチャーを編集",
@@ -261,12 +299,41 @@
   "cmd.view_list": "名前付きビューを一覧表示",
   "cmd.view_rename": "名前付きビューの名前を変更",
   "cmd.view_save": "新規名前付きビュー",
+  "dialog.computing": "計算中… {seconds} 秒",
   "dialog.custom_axis": "↖ カスタム軸",
   "dialog.edit_title": "{title}を編集",
   "dialog.select": "↖ 選択",
   "dialog.selected_count": "↖ {count} 個選択中",
+  "dialog.step": "ステップ",
+  "dialog.selection_step": "{total} ステップ中 {step}: {input} を選択",
+  "dialog.selection_guidance": "入力欄を選んで変更します。選択済みのオブジェクトをクリックすると解除できます。Ctrl/Cmd を押しながらクリックしても切り替えられます。プレビューを確認してから OK を押してください。",
   "document.save_changes": "{name} への変更を保存しますか？",
   "document.unsaved_changes": "{name} には保存されていない変更があります。保存しない場合、変更内容は失われます。",
+  "home.documentation": "ドキュメント",
+  "home.in_this_browser": "このブラウザ内",
+  "home.missing": "見つかりません",
+  "home.open": "開く…",
+  "home.opened_days_ago": "{count} 日前に開きました",
+  "home.opened_hours_ago": "{count} 時間前に開きました",
+  "home.opened_just_now": "たった今開きました",
+  "home.opened_minutes_ago": "{count} 分前に開きました",
+  "home.opening": "開いています…",
+  "home.recent": "最近使用した項目",
+  "home.report_issue": "問題を報告",
+  "home.samples": "サンプル",
+  "home.whats_new": "新機能",
+  "sample.bracket.about": "2 mm の板金ルールによるベース フランジ、エッジ フランジ、ヘミング",
+  "sample.bracket.name": "板金ブラケット",
+  "sample.enclosure.about": "リップ、ねじボス、レスト、スナップ フィットを備えたシェル化した直方体",
+  "sample.enclosure.name": "プラスチック筐体",
+  "sample.flange.about": "パラメータで制御する円形パターンを持つハブとフランジ",
+  "sample.flange.name": "ボルト締めフランジ",
+  "sample.hinge.about": "2 つのコンポーネントと回転ジョイント、60° まで駆動",
+  "sample.hinge.name": "ヒンジ アセンブリ",
+  "sample.plate.about": "フィレット、穴、穴あきボスを備えたパラメトリック プレート",
+  "sample.plate.name": "サンプル プレート",
+  "sample.vents.about": "矩形パターンに並んだスロット: 行数、列数、ピッチはパラメータ",
+  "sample.vents.name": "通気プレート",
   "settings.msaa_applies_on_restart": "アンチエイリアスは次回 SolidCraft を起動したときに適用されます",
   "settings.msaa_reset": "{setting}: {requested}× はこのグラフィックスデバイスではサポートされていないため、{reset}× に変更しました（サポート: {supported}）。",
   "settings.msaa_unsupported": "このグラフィックスデバイスではサポートされていません",
@@ -284,13 +351,165 @@
   "ui.active_component": "アクティブなコンポーネント",
   "ui.agent_cursor": "エージェントカーソル",
   "ui.agent_cursor_speed": "エージェントカーソル速度",
+  "ui.agent_chat": "エージェントチャット",
+  "ui.agent_chat_command": "エージェントのコマンド",
+  "ui.agent_chat_desktop_only": "エージェントチャットにはデスクトップアプリが必要です。",
+  "ui.agent_chat_side": "エージェントチャットの位置",
+  "ui.agent_chat_left": "左",
+  "ui.agent_chat_right": "右",
+  "ui.agent_chat_turn_limit": "1メッセージあたりの変更数",
+  "ui.agent_chat_privacy_note": "SolidCraft はどこにも何も送信しません。あなたが実行するエージェントが、あなた自身のアカウントでそのサービスと通信します。SolidCraft がキーやパスワードを見たり保存したりすることはありません。",
+  "ui.agent_chat_connect": "接続",
+  "ui.agent_chat_stop": "停止",
+  "ui.agent_chat_stop_tip": "エージェントと、それが起動したものをすべて停止します",
+  "ui.agent_chat_close": "閉じる",
+  "ui.agent_chat_minimize": "細いバーに最小化",
+  "ui.agent_chat_dock_left": "左にドッキング",
+  "ui.agent_chat_dock_right": "右にドッキング",
+  "ui.agent_chat_send": "送信",
+  "ui.agent_chat_cancel": "キャンセル",
+  "ui.agent_chat_refresh": "再検索",
+  "ui.agent_chat_pick": "エージェント",
+  "ui.agent_chat_custom_hint": "標準入出力で Agent Client Protocol を話す任意のプログラム。シェルは使いません。",
+  "ui.agent_chat_not_installed": "未インストール",
+  "ui.agent_chat_none_found": "コーディングエージェントが見つかりません。次のいずれかをインストールしてから「再検索」を押してください:",
+  "ui.agent_chat_detecting": "エージェントを検索中…",
+  "ui.agent_chat_signed_in": "サインイン済み",
+  "ui.agent_chat_key_in_env": "キー設定済み",
+  "ui.agent_chat_not_signed_in": "未サインイン",
+  "ui.agent_chat_state_off": "未接続",
+  "ui.agent_chat_state_starting": "起動中…",
+  "ui.agent_chat_state_ready": "準備完了",
+  "ui.agent_chat_state_busy": "作業中…",
+  "ui.agent_chat_state_auth": "サインインが必要",
+  "ui.agent_chat_state_exited": "エージェント停止",
+  "ui.agent_chat_changes_of": "変更 {n}/{limit}",
+  "ui.agent_chat_auth_title": "エージェントにサインイン",
+  "ui.agent_chat_auth_needed": "エージェントがサインインを求めています。サインインはエージェント自身で行います。SolidCraft がパスワードやキーを見ることはありません。",
+  "ui.agent_chat_auth_none": "このエージェントはここでのサインイン方法を提示していません。エージェントのドキュメントに従ってサインインしてください。",
+  "ui.agent_chat_auth_terminal": "ターミナルでこれを実行してから、もう一度「接続」を押してください:",
+  "ui.agent_chat_auth_agent": "{name} でサインイン",
+  "ui.agent_chat_auth_env": "環境変数 {vars} を設定して SolidCraft を再起動してください。",
+  "ui.agent_chat_auth_retry": "サインインしました: 再接続",
+  "ui.agent_chat_copy": "コピー",
+  "ui.agent_chat_permission": "エージェントが実行の許可を求めています: {title}",
+  "ui.agent_chat_answered": "回答: {option}",
+  "ui.agent_chat_approval": "エージェントにこの操作を許可しますか？",
+  "ui.agent_chat_allow": "許可",
+  "ui.agent_chat_deny": "拒否",
+  "ui.agent_chat_allowed": "許可しました",
+  "ui.agent_chat_denied": "拒否しました",
+  "ui.agent_chat_changes": "{n} 件の変更（元に戻すは1回）",
+  "ui.agent_chat_undo_changes": "これらの変更を元に戻す",
+  "ui.agent_chat_undone": "（元に戻しました）",
+  "ui.agent_chat_undo_label": "エージェントチャット: {message}",
+  "ui.agent_chat_limit": "エージェントが1メッセージあたりの変更上限 {limit} に達しました。続けさせるには、もう一度メッセージを送ってください。",
+  "ui.agent_chat_refused": "エージェントには許可されていません: {reason}",
+  "ui.agent_chat_wait_turn": "エージェントはまだ前のメッセージを処理中です。待つか「キャンセル」を押してください。",
+  "ui.agent_chat_placeholder": "デザインの変更をエージェントに依頼…",
+  "ui.agent_chat_attach_view": "ビューを添付",
+  "ui.agent_chat_attach_view_tip": "現在のビューの画像をメッセージと一緒に送ります",
+  "ui.agent_chat_no_images": "このエージェントは画像を受け付けません",
+  "ui.agent_chat_view_attached": "ビューを添付済み",
+  "ui.agent_chat_no_cli": "アプリの隣に solidcraft-cli が見つからないため、エージェントはデザインにアクセスできません。",
+  "ui.agent_chat_no_control": "エージェントチャットのエンドポイントが起動しなかったため、エージェントはデザインにアクセスできません。",
+  "ui.agent_chat_exited": "エージェントが停止しました。",
+  "ui.agent_chat_failed_start": "エージェントを起動できませんでした: {error}",
+  "ui.agent_chat_intro": "普段使っているコーディングエージェント、または選んだモデルのエンドポイントとチャットできます。SolidCraft のツールで開いているデザインを操作し、変更はその場で表示され、メッセージごとに1回で元に戻せます。確認なしで許可する範囲は「環境設定 > AI」で設定します。",
+  "ui.agent_chat_privacy": "あなたのアカウントで実行するエージェント以外には、何も送信されません。",
+  "ui.agent_chat_none_found_short": "エージェントが見つかりません",
+  "ui.ai_add": "追加",
+  "ui.ai_add_agent": "エージェントを追加…",
+  "ui.ai_add_agent_title": "エージェントを追加",
+  "ui.ai_add_api": "OpenAI 互換 API",
+  "ui.ai_add_custom": "カスタムコマンド",
+  "ui.ai_added": "追加済み",
+  "ui.ai_add_installed": "インストール済みエージェント",
+  "ui.ai_add_installed_note": "インストール済みエージェントの独自エントリ（例: 別の引数で起動）。インストール済みのエージェントは自動で一覧に表示されます。",
+  "ui.ai_agent_mode_tip": "エージェント自身のモード: エージェント自身のツール（シェル、ファイル編集）はこれに従います。SolidCraft のツールは「環境設定 > AI」の権限に従います。",
+  "ui.ai_agents": "エージェント",
+  "ui.ai_always_allow": "常に許可",
+  "ui.ai_always_allowed": "常に許可されたもの",
+  "ui.ai_always_allowed_none": "まだ常に許可されたものはありません。チャットで「常に許可」と答えたものがここに表示されます。",
+  "ui.ai_always_allow_tip": "今後このエージェントに {tool} を確認なしで許可します",
+  "ui.ai_auto_allowed": "自動許可: {title}（{why}）",
+  "ui.ai_auto_mode": "権限の設定",
+  "ui.ai_auto_ours": "SolidCraft のツールは SolidCraft 自身が確認します",
+  "ui.ai_auto_remembered": "「常に許可」を選択済み",
+  "ui.ai_bad_url": "http:// または https:// で始まる URL を入力してください",
+  "ui.ai_base_url": "ベース URL",
+  "ui.ai_button": "AI",
+  "ui.ai_copy_suffix": "コピー",
+  "ui.ai_custom_url": "カスタム URL",
+  "ui.ai_default": "既定",
+  "ui.ai_http_busy": "エンドポイントが混雑しているか上限に達しています。後で再試行してください",
+  "ui.ai_http_key": "エンドポイントがキーを拒否しました。「環境設定 > AI」で確認してください",
+  "ui.ai_http_not_found": "エンドポイントまたはモデルが見つかりません。ベース URL とモデル名を確認してください",
+  "ui.ai_key": "API キー",
+  "ui.ai_keychain_error": "システムのキーチェーンが拒否しました: {error}",
+  "ui.ai_key_hint": "任意。システムのキーチェーンに保存",
+  "ui.ai_key_needs_https": "キーは HTTPS 経由、またはこのコンピューター宛てにのみ送信されます。",
+  "ui.ai_key_note": "システムのキーチェーンに保存され、SolidCraft の設定には保存されません。ローカルサーバーの場合は空欄のままにします。",
+  "ui.ai_mode_all": "すべて許可",
+  "ui.ai_mode_all_note": "確認なしで実行します。クラッシュレポートは引き続き対象外で、フォルダー制限も有効です。",
+  "ui.ai_mode_all_warning": "エージェントは確認なしでデザインの保存・上書き・エクスポート・置き換えができます。信頼できるエージェントで、保存済みのデザインに対してのみ使ってください。",
+  "ui.ai_mode_ask": "毎回確認",
+  "ui.ai_mode_ask_note": "デザインへのすべての変更とファイル操作が、あなたの許可を待ちます。",
+  "ui.ai_mode_edits": "モデル編集を自動許可",
+  "ui.ai_mode_edits_note": "モデリングコマンドは確認なしで実行されます。保存・開く・エクスポートなどのファイル操作や破壊的な操作は引き続き確認します。",
+  "ui.ai_mode_global": "上の設定に従う",
+  "ui.ai_model": "モデル",
+  "ui.ai_modes_scope": "これらの設定は SolidCraft のツールに適用されます。エージェント自身のツール（シェル、ファイル編集）は、エージェントにモードがある場合にチャットパネルのヘッダーで選ぶエージェント自身のモードに従います。",
+  "ui.ai_name": "名前",
+  "ui.ai_need_command": "エージェントを起動するコマンドを入力してください",
+  "ui.ai_need_model": "モデル名を入力してください",
+  "ui.ai_no_answer": "エージェントが時間内に応答しませんでした",
+  "ui.ai_no_http": "このビルドは API エンドポイントに接続できません",
+  "ui.ai_no_keychain": "システムのキーチェーンが使えないため、キーを保存できません。キー不要のローカルサーバーは利用できます。",
+  "ui.ai_panel": "パネル",
+  "ui.ai_permissions": "権限",
+  "ui.ai_preset": "プリセット",
+  "ui.ai_remove": "削除",
+  "ui.ai_request_limit": "1メッセージあたり24リクエストで停止しました。続けるには、もう一度メッセージを送ってください",
+  "ui.ai_reset": "リセット",
+  "ui.ai_settings": "AI 設定…",
+  "ui.ai_show_features": "AI 機能を表示",
+  "ui.ai_show_features_note": "エージェントチャット: 普段使っているコーディングエージェント、または選んだモデルのエンドポイントが、開いているデザインを操作するパネルです。オフ: AI ボタン、ショートカット、メニュー項目、パネルは表示されず、検索も起動も行いません。",
+  "ui.ai_switch_tip": "この会話のエージェントを切り替え",
+  "ui.ai_test": "テスト",
+  "ui.ai_test_acp_ok": "応答あり: {agent}",
+  "ui.ai_test_acp_tip": "エージェントを短時間起動してセッションを要求し、終了します",
+  "ui.ai_test_api_tip": "エンドポイントにモデル一覧を問い合わせます",
+  "ui.ai_testing": "テスト中…",
+  "ui.ai_test_no_model": "接続成功: {count} 個のモデル（{model} はありません）",
+  "ui.ai_test_ok": "接続成功: {count} 個のモデル",
+  "ui.ai_toolbar_button": "ツールバーにボタンを表示",
+  "ui.ai_toolbar_button_note": "ツールバー右端の AI ボタン。Ctrl+Shift+A と表示メニューからも引き続きパネルを開けます。",
+  "ui.ai_tool_done": "完了",
+  "ui.ai_tool_failed": "失敗",
+  "ui.ai_tool_running": "実行中",
+  "ui.ai_tool_unfold": "クリックして結果を表示",
+  "ui.ai_tool_waiting": "待機中",
+  "ui.ai_undo_tip": "このメッセージでエージェントが行った変更を、1回でまとめて元に戻します",
+  "AI": "AI",
   "ui.all": "すべて",
+  "ui.analysis": "解析",
   "ui.angle": "角度",
   "ui.angle_decimals": "角度の小数点以下の桁数",
   "ui.animate_view_changes": "視点変更をアニメーション表示",
   "ui.animation": "アニメーション",
   "ui.animation_speed": "アニメーション速度",
   "ui.anti_aliasing": "アンチエイリアス",
+  "ui.supersampling": "スーパーサンプリング (SSAA)",
+  "ui.supersampling_off": "オフ (1×)",
+  "ui.supersampling_adaptive": "ビューが静止しているときのみ",
+  "settings.supersampling_note": "ビューを高い解像度で描画してから縮小します。4K 未満の画面でエッジ、線、グリッドが滑らかになります。GPU の負荷が増えます（1.5× で約 2.25 倍、2× で 4 倍のピクセル）。",
+  "ui.display_quality": "表示品質",
+  "ui.display_quality_coarse": "粗い",
+  "ui.display_quality_normal": "標準",
+  "ui.display_quality_fine": "細かい",
+  "ui.display_quality_ultra": "最高",
+  "settings.display_quality_note": "細かいほど曲面とエッジが滑らかに表示されますが、メッシュの生成に時間がかかります。変わるのはビューポートだけで、設計やエクスポートは変わりません。",
   "ui.apply": "適用",
   "ui.arc": "円弧",
   "ui.assemble": "アセンブリ",
@@ -310,6 +529,8 @@
   "ui.chamfer_type": "面取りタイプ",
   "ui.change_workspace": "ワークスペースの変更",
   "ui.chord_length": "弦長",
+  "ui.curvature_g2": "曲率連続 (G2)",
+  "ui.equivalent_radius": "等価半径",
   "ui.circle": "円",
   "ui.circular_pattern": "円形パターン",
   "ui.clear": "クリア",
@@ -318,13 +539,51 @@
   "ui.click_selects_whole_bodies": "クリックでボディ全体を選択",
   "ui.click_then_press_key": "クリックした後、割り当てるキーを押してください",
   "ui.close": "閉じる",
+  "ui.material_review.title": "物理材料データを確認",
+  "ui.material_review.scope": "候補のみ：割り当てや保存は行いません。数値検証は工学的認証ではありません。",
+  "ui.material_review.input": "スキーマ1の材料カードを貼り付け（JSON）",
+  "ui.material_review.review": "カードを確認",
+  "ui.material_review.limit": "カードが256 KiBの入力上限を超えています。",
+  "ui.material_review.unknown": "不明",
+  "ui.material_review.properties": "特性",
+  "ui.material_review.conditions": "記載された条件",
+  "ui.material_review.source": "出典",
+  "ui.material_review.axes": "材料ローカル軸。ボディの方向は割り当てません。",
+  "ui.material_review.derived": "導出された等方性弾性率",
+  "ui.material_review.claims": "出典とライセンスの申告は未確認です。欠落値は不明のままです。",
+  "ui.material_review.density": "密度",
+  "ui.material_review.elasticity": "弾性",
+  "ui.material_review.tensile_strength": "引張強度",
+  "ui.material_review.compressive_strength": "圧縮強度",
+  "ui.material_review.yield_strength": "降伏強度",
+  "ui.material_review.shear_strength": "せん断強度",
+  "ui.material_review.thermal_conductivity": "熱伝導率",
+  "ui.material_review.thermal_expansion": "熱膨張",
+  "ui.material_review.specific_heat": "比熱",
+  "ui.material_review.moisture_unit": "kg 水 / kg 乾燥材料",
   "ui.coil": "コイル",
   "ui.coincident": "一致",
   "ui.collapse": "折りたたむ",
   "ui.collinear": "同一直線上",
+  "ui.colour_vision": "色覚",
+  "ui.colour_vision_deutan": "2型色覚（D型）",
+  "ui.colour_vision_deutan_tip": "緑を感じにくい、または感じない場合に",
+  "ui.colour_vision_failed": "エラー",
+  "ui.colour_vision_fixed": "固定",
+  "ui.colour_vision_mode": "モード",
+  "ui.colour_vision_note": "意味を持つ色を変更します（スケッチの状態、軸、曲げ、解析、アイコン）。Windows のカラー フィルターを使う場合は「オフ」のままにしてください。",
+  "ui.colour_vision_off": "オフ",
+  "ui.colour_vision_off_tip": "テーマ本来の色",
+  "ui.colour_vision_projected": "投影",
+  "ui.colour_vision_protan": "1型色覚（P型）",
+  "ui.colour_vision_protan_tip": "赤を感じにくい、または感じない場合に",
+  "ui.colour_vision_sample": "サンプル",
+  "ui.colour_vision_tritan": "3型色覚（T型）",
+  "ui.colour_vision_tritan_tip": "青を感じにくい、または感じない場合に",
   "ui.combine": "結合",
   "ui.coming_later": "準備中",
   "ui.concentric": "同心",
+  "ui.configurations": "構成",
   "ui.conic_curve": "円錐曲線",
   "ui.constant": "一定",
   "ui.constraints_conflict": "拘束が競合しています",
@@ -362,6 +621,7 @@
   "ui.drawing": "図面",
   "ui.drill_point": "ドリル先端",
   "ui.edit": "編集",
+  "ui.edit_section_analysis": "断面解析を編集",
   "ui.ellipse": "楕円",
   "ui.end_radius": "終了半径",
   "ui.entities": "エンティティ",
@@ -374,6 +634,7 @@
   "ui.extent_type": "範囲タイプ",
   "ui.extrude": "押し出し",
   "ui.factor": "倍率",
+  "ui.feature_history": "フィーチャー履歴",
   "ui.feature_options": "フィーチャーオプション",
   "ui.features": "フィーチャー",
   "ui.file": "ファイル",
@@ -530,6 +791,10 @@
   "ui.quit": "終了",
   "ui.radial_context_menu": "パイ メニュー",
   "ui.radius": "半径",
+  "ui.pull_direction": "抜き方向",
+  "ui.tool_direction": "工具方向",
+  "ui.reachable": "到達可能",
+  "ui.blocked": "到達不可",
   "ui.radius_type": "半径タイプ",
   "ui.rectangle": "長方形",
   "ui.rectangular_pattern": "矩形パターン",
@@ -544,9 +809,33 @@
   "ui.revolve": "回転",
   "ui.right": "右側面",
   "ui.save": "保存",
+  "ui.heading_save_mesh": "メッシュとして保存",
+  "ui.format": "形式",
+  "ui.mesh_format_stl": "STL",
+  "ui.mesh_format_3mf": "3MF",
+  "ui.mesh_format_3mf_tagged": "面タグ付き 3MF",
+  "ui.send_to_slicer": "スライサーに送る",
+  "ui.slicer": "スライサー",
+  "ui.custom_program": "カスタム…",
+  "ui.no_slicer_found": "スライサーが見つかりません",
+  "ui.send": "送信",
+  "ui.custom_program_tip": "リストに追加するスライサーのプログラムを選択",
+  "ui.slicer_delete_tip": "{program}\nDelete キーでリストから削除",
+  "ui.save_mesh_pick_bodies": "保存するボディを選択してください",
+  "ui.save_mesh_no_slicer": "スライサーが見つかりません。「カスタム…」でスライサーのプログラムを選ぶか、「スライサーに送る」をオフにしてください",
+  "ui.not_a_program": "{path} は起動できるプログラムではありません",
+  "ui.sent_to_slicer": "{slicer} に送信しました",
+  "ui.saved_to": "保存しました: {path}",
+  "ui.save_mesh_temp_failed": "{folder} を作成できません: {error}",
   "ui.save_as": "名前を付けて保存",
   "ui.save_as_ellipsis": "名前を付けて保存…",
   "ui.scale": "尺度",
+  "ui.orientation": "向き",
+  "ui.twist": "ねじれ",
+  "ui.end_scale": "終端スケール",
+  "ui.sweep_turn_with_path": "パスに沿って回転",
+  "ui.sweep_keep_as_drawn": "描いた向きを保持",
+  "ui.sweep_follow_direction": "方向に従う",
   "ui.section_analysis": "断面解析",
   "ui.select": "選択",
   "ui.select_other_hint": "その他を選択: モデル上で左ボタンを長押し（または右クリック › その他を選択…）するとカーソル下の要素が一覧表示されます。同じ場所を再度クリックすると次の要素が選択されます。",
@@ -554,7 +843,6 @@
   "ui.shell": "シェル",
   "ui.show": "表示",
   "ui.show_constraints": "拘束",
-  "ui.show_construction_geometries": "構築ジオメトリ",
   "ui.show_dimensions": "寸法",
   "ui.show_points": "点を表示",
   "ui.show_profile": "プロファイルを表示",
@@ -595,6 +883,9 @@
   "ui.theme": "テーマ",
   "ui.thickness": "厚さ",
   "ui.thread": "ねじ",
+  "ui.timeline_bottom": "下部タイムライン",
+  "ui.timeline_left_note": "左レイアウトでは、ロールバックバーがパーツとシーンブラウザーの上に表示されます。",
+  "ui.timeline_left_sidebar": "左サイドバー",
   "ui.tip_angle": "先端角度",
   "ui.to_object": "オブジェクトまで",
   "ui.top": "上面",
@@ -696,6 +987,8 @@
   "Files from many CAD programs have Y up, so they open lying on their back here (Z up).": "多くのCADではY軸を上向きとしているため、Z軸を上向きとするSolidCraftでは、読み込んだモデルが横倒しの向きで表示されることがあります。",
   "Filter": "フィルター",
   "Find in Browser": "ブラウザで検索",
+  "Copy Error Message": "エラーメッセージをコピー",
+  "Copy Warning Message": "警告メッセージをコピー",
   "Flat size": "展開サイズ",
   "Follow camera (Look At sketches)": "カメラ追従（スケッチを正面視）",
   "Font": "フォント",
@@ -858,5 +1151,231 @@
   "Double-clicking the middle button in the view: Home (the home view, framing what is shown), Fit (frame what is shown, keeping the orientation) or nothing": "ビュー上で中ボタンをダブルクリックした時の動作: ホーム（全体を収めたホームビュー）、全体表示（向きを維持して全体を収める）、または無効",
   "Select Other: hold the left button still on the model (or right-click › Select Other…) to list everything under the cursor; click again on the same spot to select the next thing there. Double-click the middle button to go Home (Preferences › Navigation).": "その他を選択: モデル上で左ボタンを長押し（または右クリック › その他を選択…）するとカーソル下の要素が一覧表示されます。同じ場所を再度クリックすると次の要素が選択されます。中ボタンをダブルクリックするとホームビューに戻ります（環境設定 › ナビゲーション）。",
   "cmd.render_backends": "レンダリング バックエンド",
-  "cmd.view_navigate": "ビューナビゲーション"
-}
+  "cmd.view_navigate": "ビューナビゲーション",
+  "ui.animateJoint": "ジョイントをアニメート",
+  "ui.calibrate": "校正",
+  "ui.customizeToolbar": "ツールバーをカスタマイズ…",
+  "ui.editJointLimits": "ジョイント制限を編集",
+  "ui.exportDxf": "DXF をエクスポート…",
+  "ui.findInTimeline": "タイムラインで検索",
+  "ui.findInWindow": "ウィンドウで検索",
+  "ui.fit": "フィット",
+  "ui.groupSelected": "選択をグループ化",
+  "ui.hideAxes": "軸を非表示",
+  "ui.hideDimension": "寸法を非表示",
+  "ui.hideOrigin": "原点を非表示",
+  "ui.hidePlanes": "平面を非表示",
+  "ui.hideProfile": "プロファイルを非表示",
+  "ui.homeView": "ホームビュー",
+  "ui.isolate": "分離表示",
+  "ui.lock": "ロック",
+  "ui.newSketchGroup": "新しいスケッチグループ",
+  "ui.normalConstruction": "通常 / コンストラクション",
+  "ui.orbit": "回転",
+  "ui.heading_position": "配置",
+  "ui.pan": "パン",
+  "ui.pinToShortcuts": "ショートカットに固定",
+  "ui.pinToToolbar": "ツールバーに固定",
+  "ui.properties": "プロパティ",
+  "ui.design_properties.project": "プロジェクト",
+  "ui.design_properties.part_number": "部品番号",
+  "ui.design_properties.revision": "リビジョン",
+  "ui.design_properties.author": "作成者",
+  "ui.design_properties.organization": "組織",
+  "ui.design_properties.description": "説明",
+  "ui.design_properties.license": "ライセンス",
+  "ui.design_properties.not_text": "テキスト以外の値で保存されています。ここに入力すると置き換わります。",
+  "ui.design_properties.exports": "STEP、IGES、3MF のエクスポートでは、形式に対応する項目があればこれらが書き込まれます。",
+  "ui.design_properties.others": "他のツールのデータ",
+  "ui.design_properties.others_note": "デザイン内にそのまま保持され、エクスポートされることはありません。",
+  "ui.removeSection": "セクションを解除",
+  "ui.removeFromToolbar": "ツールバーから削除",
+  "ui.repeat": "繰り返し",
+  "ui.report_a_bug": "不具合を報告",
+  "ui.restore": "復元",
+  "ui.heading_setup": "セットアップ",
+  "ui.selectOther": "その他を選択…",
+  "ui.selectTangentChain": "接線チェーンを選択",
+  "ui.showAll": "すべて表示",
+  "ui.showAllBodies": "すべてのボディを表示",
+  "ui.showAxes": "軸を表示",
+  "ui.showDimension": "寸法を表示",
+  "ui.showOrigin": "原点を表示",
+  "ui.showPlanes": "平面を表示",
+  "ui.suppress": "抑制",
+  "ui.command_palette_hint": "コマンドを入力（例: {example}）— または S キーで検索",
+  "ui.unground": "固定を解除",
+  "ui.unisolate": "分離表示を解除",
+  "ui.unlock": "ロック解除",
+  "ui.unsuppress": "抑制を解除",
+  "ui.updateToCurrentView": "現在のビューに更新",
+  "ui.zoom": "ズーム",
+  "ui.command_done": "{command} 完了",
+  "drive.stopped_by_loop": "{value} で停止: {joint} を通るループはこれ以上閉じられません",
+  "drive.stopped_by_contact": "{value} で停止: {a} が {b} を通り抜けてしまいます",
+  "drive.unconnected": "何も動きません: {part} は空間固定されたものに接続されていません",
+  "timeline.group": "フィーチャーフォルダを新規作成",
+  "timeline.ungroup": "フィーチャーフォルダを削除",
+  "timeline.rename_group": "フィーチャーフォルダの名前を変更",
+  "timeline.move_to_group": "フィーチャーをフォルダへ移動",
+  "timeline.move_many": "タイムライン項目を移動",
+  "timeline.reorder_many": "フィーチャーの順序を変更",
+  "ui.show_construction_geometries": "構築ジオメトリ",
+  "ui.total_angle": "合計角度",
+  "sketch_text.builtin_font": "{family}（内蔵）",
+  "sketch_text.font_search": "フォントを検索",
+  "sketch_text.loading_fonts": "インストール済みフォントを検索中…",
+  "sketch_text.use_font_file": "フォント ファイル {path} を使用",
+  "sketch_text.bold": "太字",
+  "sketch_text.italic": "斜体",
+  "sketch_text.align_left": "左",
+  "sketch_text.align_center": "中央",
+  "sketch_text.align_right": "右",
+  "sketch_text.path_hint": "文字が沿うスケッチの曲線: ここをクリックしてから曲線をクリック",
+  "sketch_text.path_clear": "文字を曲線から外す",
+  "Style": "スタイル",
+  "Alignment": "配置",
+  "Letter Spacing": "文字間隔",
+  "Line Spacing": "行間",
+  "Path": "パス",
+  "sketch_text.on_path": "文字はパスに沿います: 位置は曲線で決まります",
+  "cmd.library_inspect": "ローカルライブラリを確認",
+  "cmd.library_export": "デザインライブラリを書き出す",
+  "cmd.library_apply": "ローカルライブラリ項目を適用",
+  "Thin": "薄肉",
+  "Thin Extrude": "薄肉押し出し",
+  "Wall Location": "壁の位置",
+  "Wall Thickness": "壁の厚さ",
+  "Thickness Outside": "外側の厚さ",
+  "Inside": "内側",
+  "Outside": "外側",
+  "Profiles/Curves": "プロファイル/曲線",
+  "cmd.material_properties_validate": "物理材料データを検証",
+  "cmd.material_properties_directional": "方向別弾性率",
+  "update.button": "アップデート",
+  "update.button_tip": "SolidCraft {version} が利用できます",
+  "install.menu": "アプリをインストール…",
+  "install.button_tip": "SolidCraft をアプリとしてインストールします。専用のウィンドウで開き、オフラインでも使えます",
+  "install.title": "SolidCraft をインストール",
+  "install.steps_intro": "Safari では、Web アプリを Safari 自身のメニューからインストールします:",
+  "install.home_screen_1": "「共有」をタップします（ツールバーにない場合は … メニューの中にあります）。",
+  "install.home_screen_2": "「ホーム画面に追加」を選びます。",
+  "install.home_screen_3": "「追加」をタップします。",
+  "install.home_screen_after": "SolidCraft はホーム画面のアイコンから Safari のツールバーなしで開き、オフラインでも使えます。",
+  "install.dock_1": "「ファイル」›「Dockに追加」を選びます。",
+  "install.dock_2": "「追加」をクリックします。",
+  "install.dock_after": "SolidCraft は Dock から専用のウィンドウで開き、オフラインでも使えます。",
+  "install.done": "完了",
+  "update.title": "アップデートがあります",
+  "update.available": "SolidCraft {version} が利用できます",
+  "update.you_have": "現在のバージョンは {version} です。",
+  "update.no_notes": "このリリースにはリリースノートがありません。",
+  "update.system_hint": "このコピーは {kind} です。次のコマンドで更新します:",
+  "update.package_hint": "このコピーは {kind} からインストールされました。新しいパッケージをダウンロードし、次のコマンドでインストールします:",
+  "update.copy": "コピー",
+  "update.file": "ダウンロードするファイル: {file}",
+  "update.download": "ダウンロード",
+  "update.release_page": "リリースページを開く",
+  "update.skip": "このバージョンをスキップ",
+  "update.later": "後で通知",
+  "update.prefs_label": "アップデート",
+  "update.check_automatically": "アップデートを自動的に確認",
+  "update.check_now": "今すぐ確認",
+  "update.checking": "確認中…",
+  "update.failed": "確認できませんでした: {error}",
+  "update.up_to_date": "SolidCraft は最新です。",
+  "update.prefs_note": "これは SolidCraft {version} ({kind}) です。確認では GitHub に最新リリースを問い合わせるだけで、ほかには何も送信しません。",
+  "update.prefs_dev": "これは開発ビルド ({version}) のため、アップデートを確認しません。",
+  "update.show": "{version} へのアップデートを表示",
+  "update.prefs_flatpak": "このコピー ({version}) は Flatpak が更新します: {command} を実行するか、ソフトウェアセンターを使ってください。SolidCraft 自身は確認しません。",
+  "update.update_now": "今すぐ更新",
+  "update.install_msi": "インストール (SolidCraft を終了)",
+  "update.download_open": "ダウンロードして開く",
+  "update.downloading": "ダウンロードと検証中… {done} / {total} MB",
+  "update.installed": "SolidCraft {version} をインストールしました。再起動すると使えます。",
+  "update.restart": "今すぐ再起動",
+  "update.restart_later": "後で",
+  "update.installer_started": "SolidCraft の終了後にインストーラーが起動します。",
+  "update.dmg_opened": "ディスクイメージを検証して開きました: SolidCraft をアプリケーションフォルダにドラッグして古いものを置き換え、SolidCraft を再起動してください。",
+  "update.install_failed": "アップデートをインストールできませんでした: {error}。何も変更されていません。「ダウンロード」でパッケージを入手できます。",
+  "cmd.render_settings_get": "レンダリング設定",
+  "cmd.render_settings_set": "レンダリング設定を保存",
+  "cmd.render_scene": "レンダリングシーンを確認",
+  "cmd.render_settings_apply": "レンダリングカメラを適用",
+  "toolbar.render": "レンダリング",
+  "toolbar.render_scene": "シーン",
+  "render.preview": "統合プレビュー",
+  "render.preview_help": "ラスタシェーディングとブレンド透明度を使用します。屈折、HDRI、最終レンダリングはまだ利用できません。",
+  "render.setup_name": "セットアップ名",
+  "render.background": "シーンの背景",
+  "render.perspective": "透視投影カメラ",
+  "render.fit": "製品を画面に合わせる",
+  "render.restore_camera": "保存したカメラを復元",
+  "render.save_setup": "セットアップを保存",
+  "render.unsaved": "未保存のプレビュー変更",
+  "render.reload_settings": "保存した設定を再読み込み",
+  "render.unavailable_preview": "このセットアップは利用できないプレビュープロファイルを要求しています。",
+  "render.use_preview": "統合プレビューを使用",
+  "render.navigation_help": "カメラはデザインと同じように動きます（環境設定 › ナビゲーション）。「セットアップを保存」で現在のカメラを記録します。",
+  "render.return_design": "設計に戻る",
+  "render.image_title": "画像をレンダリング",
+  "render.image_help": "CPUプレビュー画像 · PNG · 近似透過",
+  "render.image_width": "幅",
+  "render.image_height": "高さ",
+  "render.image_transparent": "透明な背景",
+  "render.image_check": "レンダリング要求を確認",
+  "render.image_supported": "レンダリング要求に対応しています。開始時にキューとメモリを再確認します。",
+  "render.image_queued": "レンダリング待機中",
+  "render.image_preparing": "画像を準備中",
+  "render.image_running": "画像をレンダリング中",
+  "render.image_encoding": "PNGをエンコード中",
+  "render.image_cancelling": "キャンセル中",
+  "render.image_cancelled": "レンダリングをキャンセルしました",
+  "render.image_completed": "画像をエクスポートできます",
+  "render.image_failed": "レンダリングに失敗しました",
+  "render.image_unknown": "レンダリング状態を取得できません",
+  "render.image_reduce": "画像を小さくするかシーンを簡略化してください。",
+  "render.image_too_large": "画像の上限を超えています：一辺 4096 ピクセル、合計 4,194,304 ピクセル。",
+  "render.image_use_largest": "この縦横比での最大サイズを使用：",
+  "render.image_cancel": "レンダリングをキャンセル",
+  "render.image_stale": "この画像は後続の変更前に取得したシーンを使用しています。",
+  "render.image_start": "レンダリングを開始",
+  "render.image_overwrite": "既存のファイルを置換",
+  "render.image_export": "PNGをエクスポート",
+  "cmd.render_preflight": "レンダリング要求を確認",
+  "cmd.render_start": "画像をレンダリング",
+  "cmd.render_status": "レンダリングの進行状況",
+  "cmd.render_cancel": "レンダリングをキャンセル",
+  "cmd.render_export": "PNGをエクスポート",
+  "toolbar.image": "画像",
+  "appearance.surface_response": "表面の応答",
+  "appearance.pbr_opaque": "不透明PBR",
+  "appearance.metallic": "金属度",
+  "appearance.roughness": "粗さ",
+  "appearance.dielectric_ior": "誘電体の屈折率",
+  "appearance.pbr_help": "この表面はレンダリング作業空間または製品PNGで確認できます。屈折や透過には対応していません。",
+  "render.opaque_preview_help": "不透明PBRと単色表示、アルファ合成による透明表示に対応します。屈折、HDRI、最終レンダリングにはまだ対応していません。",
+  "render.opaque_image_summary": "プレビューPNG · 不透明PBR · アルファ合成の透明表示",
+  "UNTRIM": "トリム解除",
+  "Face": "面",
+  "Holes": "穴",
+  "Holes (edges on them)": "穴（そのエッジ）",
+  "In place (surfaces)": "その場で（サーフェス）",
+  "None": "なし",
+  "Picked": "選択したもの",
+  "Restore outer boundary": "外側の境界を復元",
+  "RULED SURFACE": "ルールドサーフェス",
+  "Mitre": "留め継ぎ",
+  "Reference face": "参照面",
+  "Round": "丸め",
+  "joint.one_component": "これらの部品は 1 つのコンポーネントのボディです: {bodies}。ジョイントはコンポーネント同士を動かすため、部品ごとに専用のコンポーネントが必要です。",
+  "joint.one_body": "両方の選択が {body} 上にあります。2 つ目は別の部品で選択してください。",
+  "joint.from_bodies_hint": "選択した各ボディを、位置はそのままで専用の新しいコンポーネントに移動します。",
+  "Circumference": "円周",
+  "Arc length": "円弧の長さ",
+  "Slot width": "長穴の幅",
+  "Centre to centre": "中心間",
+  "Overall length": "全長",
+  "Min": "最小",
+  "Max": "最大"
+}

assets/materials/library.rs

@@ -0,0 +1,40 @@
+//! Built-in physical materials: densities in g/cm³ and sRGB colours.
+pub const DEFAULT_DENSITY: f64 = 1.29;
+
+/// Physical materials: name and density (g/cm³).
+pub const MATERIALS: [(&str, f64); 14] = [
+    ("Default", DEFAULT_DENSITY),
+    ("Steel", 7.85),
+    ("Stainless Steel", 8.0),
+    ("Aluminum", 2.70),
+    ("Brass", 8.50),
+    ("Copper", 8.96),
+    ("Titanium", 4.43),
+    ("Cast Iron", 7.20),
+    ("ABS Plastic", 1.06),
+    ("PLA", 1.24),
+    ("Nylon", 1.14),
+    ("Polycarbonate", 1.20),
+    ("Oak", 0.75),
+    ("Glass", 2.50),
+];
+
+/// How a physical material looks (sRGB); the default material has no colour of its own.
+pub fn material_color(name: &str) -> Option<[u8; 3]> {
+    Some(match name {
+        "Steel" => [158, 164, 172],
+        "Stainless Steel" => [186, 191, 198],
+        "Aluminum" => [204, 208, 214],
+        "Brass" => [208, 172, 88],
+        "Copper" => [204, 122, 80],
+        "Titanium" => [150, 148, 158],
+        "Cast Iron" => [104, 104, 110],
+        "ABS Plastic" => [222, 222, 216],
+        "PLA" => [110, 160, 222],
+        "Nylon" => [236, 230, 214],
+        "Polycarbonate" => [196, 216, 232],
+        "Oak" => [190, 146, 92],
+        "Glass" => [170, 208, 218],
+        _ => return None,
+    })
+}