engine: geometry.face.split, a face split along a datum plane (#508)

geometry.face.split {name, face, datum} records a face split; it is
applied after the merges whenever the design is opened or cut again,
follows its datum (which it holds), undoes, and is saved with the
model. geometry.face.split.delete removes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

.github/CODEOWNERS

@@ -1,2 +1,13 @@
 # Every change to FieldCraft needs the maintainer's review before it merges.
 * @jyviko
+
+# Release and supply-chain paths, named explicitly so they stay owner-reviewed if the rule above
+# is ever relaxed: workflows and secrets use, packaging and signing, the updater, dependencies,
+# licences.
+/.github/ @jyviko
+/packaging/ @jyviko
+/crates/update/ @jyviko
+/Cargo.toml @jyviko
+/Cargo.lock @jyviko
+/ATTRIBUTION.md @jyviko
+/deny.toml @jyviko

.github/ISSUE_TEMPLATE/bug.yml

@@ -41,6 +41,6 @@ body:
     id: version
     attributes:
       label: Version and platform
-      placeholder: "v0.5.8 (or commit), macOS 15 arm64"
+      placeholder: "v0.6.0 (or commit), macOS 15 arm64"
     validations:
       required: true

.github/release-notes.md

@@ -1,13 +1,14 @@
 FieldCraft is open-source CAE pre-processing in Rust: it turns geometry into analysis-ready
 finite element models, writes Abaqus, Nastran and LS-DYNA decks, and solves linear static and
 modal problems with its own solver. AI agents can drive it over MCP (`fieldcraft-cli mcp`).
-[README](https://github.com/jyviko/fieldcraft#readme) ·
-[roadmap](https://github.com/jyviko/fieldcraft/blob/main/ROADMAP.md) ·
-[issues](https://github.com/jyviko/fieldcraft/issues)
+[README](https://github.com/tangency-labs/fieldcraft#readme) ·
+[roadmap](https://github.com/tangency-labs/fieldcraft/blob/main/ROADMAP.md) ·
+[issues](https://github.com/tangency-labs/fieldcraft/issues)
 
 **Which file?**
 - **macOS 11+** (Apple silicon and Intel): open `fieldcraft-{version}-macos-universal.dmg` and
-  drag `FieldCraft.app` onto Applications. The command-line tool is in
+  drag `FieldCraft.app` onto Applications. The command-line tool is included at
+  `/Applications/FieldCraft.app/Contents/MacOS/fieldcraft-cli` and also available separately in
   `fieldcraft-cli-{version}-macos-universal.zip`.
 - **Linux** (x86_64, glibc 2.35+: Ubuntu 22.04, Debian 12, Fedora 36 or newer):
   `fieldcraft-{version}-linux-x86_64.AppImage` (`chmod +x`, then run it), or unpack
@@ -21,6 +22,8 @@ modal problems with its own solver. AI agents can drive it over MCP (`fieldcraft
 To start with a sample model, run the app with `--sample cantilever` (macOS:
 `/Applications/FieldCraft.app/Contents/MacOS/FieldCraft --sample cantilever`).
 
+**Updates.** {update_signing}
+
 **Signing.** {macos_signing} The Linux and Windows builds are not signed; on Windows, SmartScreen
 may say "Windows protected your PC": choose **More info**, then **Run anyway**.
 

.github/workflows/ci.yml

@@ -6,6 +6,13 @@ name: CI
 # Pull requests from forks (outside contributors) run the full gate, once the maintainer approves
 # the run, so the review sees it; so do Dependabot's (.github/dependabot.yml), which nobody tests
 # locally. The heavy job stays off pull requests.
+#
+# What runs when (docs/releasing.md, "What CI runs when"): the `plan` job picks a base, the last
+# `develop` commit whose CI run passed (a pull request: its merge base; nightly and manual runs:
+# none), and `cargo xtask affected` maps the change since it to crates. `cargo xtask ci --affected`
+# then lints and tests those crates and their dependents only; the heavy and oracle jobs run when
+# the change reaches the solvers, the oracle or everything (Cargo.toml/Cargo.lock/xtask/workflows).
+# Nightly and manual runs, and every release (release.yml), run all of it.
 on:
   pull_request:
     paths:
@@ -26,7 +33,7 @@ on:
       - 'docs/features.md'
       - 'docs/oracle.md'
   schedule:
-    # Nightly, on the default branch (develop): the heavy tests.
+    # Nightly, on the default branch (develop): the whole gate, the heavy tests and the oracle.
     - cron: '23 3 * * *'
     # Weekly: the oracle on macOS too, so results that differ by platform show up in CI (the
     # fixtures are often blessed on a Mac; #115).
@@ -37,7 +44,8 @@ permissions:
   contents: read
 
 # A newer merge cancels the run still going for the one before it, so a burst of merges is tested
-# once, at the tip. Nightly and manual runs are grouped apart and never cancelled by a merge.
+# once, at the tip; nothing is missed, since the tip's run tests everything since the last green
+# run. Nightly and manual runs are grouped apart and never cancelled by a merge.
 concurrency:
   group: ci-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
@@ -46,32 +54,101 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  plan:
+    name: Plan (affected crates)
+    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      # To find the last green run on develop.
+      actions: read
+    outputs:
+      base: ${{ steps.base.outputs.base }}
+      everything: ${{ steps.affected.outputs.everything }}
+      solver: ${{ steps.affected.outputs.solver }}
+      wasm: ${{ steps.affected.outputs.wasm }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: plan
+          save-if: ${{ github.ref == 'refs/heads/develop' }}
+      - name: Pick the base
+        id: base
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT: ${{ github.event_name }}
+          PR_BASE: ${{ github.base_ref }}
+        run: |
+          base=""
+          case "$EVENT" in
+            push)
+              # The newest develop commit whose push run passed and that this commit contains.
+              # Runs that were cancelled or failed are skipped, so their changes are tested here.
+              for sha in $(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=develop&event=push&status=success&per_page=100" --jq '.workflow_runs[].head_sha'); do
+                if [ "$sha" != "$GITHUB_SHA" ] && git merge-base --is-ancestor "$sha" HEAD; then
+                  base="$sha"
+                  break
+                fi
+              done
+              ;;
+            pull_request)
+              base="$(git merge-base "origin/$PR_BASE" HEAD || true)"
+              ;;
+          esac
+          # Nightly and manual runs, or no green run to start from: everything.
+          echo "base=$base" >>"$GITHUB_OUTPUT"
+          echo "### Base: \`${base:-none (everything)}\`" >>"$GITHUB_STEP_SUMMARY"
+      - name: cargo xtask affected
+        id: affected
+        env:
+          BASE: ${{ steps.base.outputs.base }}
+        run: |
+          if [ -n "$BASE" ]; then
+            cargo xtask affected --base "$BASE" --github-output | tee -a "$GITHUB_STEP_SUMMARY"
+          else
+            printf 'everything=true\nsolver=true\nwasm=true\n' >>"$GITHUB_OUTPUT"
+          fi
+
   ci:
     name: cargo xtask ci
-    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
+    needs: plan
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
+          # Shared keys: release.yml's verify jobs restore these caches (they save only on main).
+          shared-key: ci
           save-if: ${{ github.ref == 'refs/heads/develop' }}
-      # A dependency update changes THIRD-PARTY-LICENSES.txt, which Dependabot cannot regenerate:
-      # regenerate it here so the gate checks everything else, and dependabot-licences.yml commits
-      # it to the pull request.
-      - name: Regenerate THIRD-PARTY-LICENSES.txt (Dependabot)
-        if: github.event.pull_request.user.login == 'dependabot[bot]'
-        run: cargo xtask licences
-      - run: cargo xtask ci
+      - name: Software GPU (lavapipe), so headless snapshots run the GPU pipeline
+        run: sudo apt-get update -q && sudo apt-get install -y -q --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: cargo xtask ci (the affected crates, or everything)
+        env:
+          BASE: ${{ needs.plan.outputs.base }}
+          # The drawing tests run on lavapipe and fail, instead of skipping, without it.
+          FIELDCRAFT_GPU: software
+          FIELDCRAFT_REQUIRE_GPU: "1"
+        run: |
+          if [ -n "$BASE" ]; then cargo xtask ci --affected "$BASE"; else cargo xtask ci; fi
 
   heavy:
-    # The heavy verification and corpus tests (#[ignore]d) and the doc tests.
+    # The heavy verification and corpus tests (#[ignore]d) and the doc tests, when the change
+    # reaches them.
     name: cargo xtask test --heavy
-    if: github.event.schedule != '41 4 * * 0' && github.event_name != 'pull_request'
+    needs: plan
+    if: github.event_name != 'pull_request' && (needs.plan.outputs.solver == 'true' || needs.plan.outputs.everything == 'true')
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
@@ -79,15 +156,18 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
+          shared-key: heavy
           save-if: ${{ github.ref == 'refs/heads/develop' }}
       - run: cargo xtask test --heavy
 
   oracle:
     # Verification and validation (docs/verification.md): every case against its reference and
     # its fixture, and docs/oracle.md must be the table the cases produce. Cases marked `slow`
-    # run here too while the whole set stays within a few minutes; `--quick` skips them.
+    # run here too while the whole set stays within a few minutes; `--quick` skips them. It runs
+    # when the change reaches the solvers or the oracle's package.
     name: cargo xtask oracle
-    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
+    needs: plan
+    if: needs.plan.outputs.solver == 'true' || needs.plan.outputs.everything == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -95,7 +175,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: oracle
+          shared-key: oracle
           save-if: ${{ github.ref == 'refs/heads/develop' }}
       - run: cargo xtask oracle
       - name: docs/oracle.md is current
@@ -113,14 +193,31 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          key: oracle-macos
+          shared-key: oracle-macos
           save-if: ${{ github.ref == 'refs/heads/develop' }}
       - run: cargo xtask oracle
       - name: docs/oracle.md is current
         run: git diff --exit-code docs/oracle.md
 
+  windows:
+    # The desktop app's tests on Windows, nightly and on demand: the Windows-only code
+    # (apps/fieldcraft/src/native_crash.rs, the exception filter) builds and a child process that
+    # faults on purpose leaves its native crash report (#299). Releases build Windows too.
+    name: Windows app tests
+    if: github.event.schedule == '23 3 * * *' || github.event_name == 'workflow_dispatch'
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: windows
+          save-if: ${{ github.ref == 'refs/heads/develop' }}
+      - run: cargo test --locked --profile ci -p fieldcraft
+
   advisories:
-    name: Dependency advisories and sources
+    name: Dependency licences, advisories and sources
     if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
     runs-on: ubuntu-24.04
     timeout-minutes: 20
@@ -129,4 +226,4 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - name: Install cargo-deny
         run: cargo install cargo-deny --version 0.20.2 --locked
-      - run: cargo deny --locked check --warn unmaintained advisories bans sources
+      - run: cargo deny --locked check --warn unmaintained advisories bans licenses sources

.github/workflows/dependabot-licences.yml

@@ -1,40 +0,0 @@
-# Dependabot's Cargo updates change THIRD-PARTY-LICENSES.txt (`cargo xtask licences`), which
-# Dependabot cannot regenerate: this commits the regenerated file to its pull request. CI's own
-# run on the pull request regenerates it too, so its result covers everything else.
-name: Dependabot licences
-
-on:
-  pull_request:
-    branches: [develop]
-    paths: [Cargo.lock]
-
-permissions:
-  contents: write
-
-concurrency:
-  group: dependabot-licences-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  licences:
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.head_ref }}
-      - uses: dtolnay/rust-toolchain@stable
-      - run: cargo xtask licences
-      - name: Commit the regenerated file
-        run: |
-          if git diff --quiet -- THIRD-PARTY-LICENSES.txt; then
-            echo "THIRD-PARTY-LICENSES.txt is up to date"
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          # [skip ci]: the pull request's CI run already regenerated this file and tested the
-          # tree with it; a bot-authored commit would otherwise wait for a maintainer's approval.
-          git commit -m "deps: regenerate THIRD-PARTY-LICENSES.txt [skip ci]" -- THIRD-PARTY-LICENSES.txt
-          git push origin "HEAD:${GITHUB_HEAD_REF}"

.github/workflows/pages.yml

@@ -1,4 +1,4 @@
-# The web app (apps/fieldcraft-web, docs/web.md) on GitHub Pages: https://jyviko.github.io/fieldcraft/
+# The web app (apps/fieldcraft-web, docs/web.md) on GitHub Pages: https://tangency-labs.github.io/fieldcraft/
 # After SolidCraft's pages.yml (MIT OR Apache-2.0; see ATTRIBUTION.md).
 #
 # A push to `main` (a release; main holds released code only) builds the app with Trunk (release,
@@ -33,6 +33,10 @@ env:
 
 jobs:
   build:
+    # POSTHOG_KEY lives in the `release` environment (main only, docs/releasing.md). The deploy job
+    # already uses github-pages and a job has one environment, so the build job reads the key: on
+    # main it runs in `release`, elsewhere in no environment and with an empty key.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
@@ -53,6 +57,10 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Build the web app
         working-directory: apps/fieldcraft-web
+        env:
+          # Usage analytics only in the deployed build (main), and only with the user's consent
+          # (docs/privacy.md); develop builds get an empty key, which sends nothing.
+          FIELDCRAFT_POSTHOG_KEY: ${{ github.ref == 'refs/heads/main' && secrets.POSTHOG_KEY || '' }}
         run: trunk build --release --public-url /fieldcraft/
       - name: Bundle size
         run: |

.github/workflows/release.yml

@@ -3,10 +3,12 @@
 #
 # A push to `main` (fast-forwarded from a verified `develop` commit; main holds released code only)
 # builds every package and creates or updates the
-# DRAFT GitHub Release "FieldCraft v<version>", with SHA256SUMS.txt and generated notes. The
+# DRAFT GitHub Release "FieldCraft v<version>", with SHA256SUMS.txt (signed with the release key
+# into SHA256SUMS.txt.minisig when the FIELDCRAFT_SIGNING_KEY secret exists) and generated notes. The
 # version is [workspace.package] version in Cargo.toml; a suffix (0.2.0-rc.1) makes a
-# pre-release. A person verifies the draft and publishes it; this workflow never publishes,
-# and pushes to develop or tags never start it.
+# pre-release. Every package, and the release itself, carries THIRD-PARTY-LICENSES.txt, generated
+# here by `cargo xtask licences` (it is not committed). A person verifies the draft and publishes
+# it; this workflow never publishes, and pushes to develop or tags never start it.
 #
 #   macOS universal (arm64 + x86_64)   .dmg with FieldCraft.app, the CLI as a .zip   packaging/macos
 #   Linux x86_64 (glibc 2.35+)         .tar.gz, .AppImage, .deb and .rpm              packaging/linux
@@ -15,7 +17,14 @@
 # macOS: signed with a Developer ID and notarized when the APPLE_* secrets exist, ad-hoc
 # otherwise (the release notes say which). Linux and Windows builds are not signed.
 #
-# Dry run: `gh workflow run release.yml --ref <branch>` builds everything and uploads the
+# The verify jobs run everything CI can: the full `cargo xtask ci`, `cargo xtask test --heavy` and
+# `cargo xtask oracle` on Linux, and the oracle on macOS. Develop's CI tests only what each change
+# affects (ci.yml), so this is where a release proves all of it. The packaging jobs build in
+# parallel with them and only upload workflow artifacts; the `release` job, the only one that
+# signs SHA256SUMS.txt or touches a GitHub Release, needs every verify and packaging job, so a
+# failing verify means no draft and no signature.
+#
+# Dry run: `gh workflow run release.yml --ref <branch>` verifies and builds everything and uploads the
 # `release-assets` artifact without creating a release. `-f draft=true` on `main` retries
 # the draft.
 name: Release
@@ -39,8 +48,10 @@ concurrency:
   cancel-in-progress: false
 
 env:
+  # The same CARGO_* environment as ci.yml: rust-cache hashes it into the cache key, so a
+  # difference would stop the verify jobs restoring develop's caches. (rust-cache already sets
+  # CARGO_INCREMENTAL=0 for every job.)
   CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
 
 jobs:
   version:
@@ -69,9 +80,68 @@ jobs:
           { echo "version=$VERSION"; echo "prerelease=$pre"; echo "draft=$REQUEST_DRAFT"; } >>"$GITHUB_OUTPUT"
           echo "### FieldCraft v$VERSION (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
 
+  # The full gate, the heavy tests and the oracle on Linux and macOS: the `release` job needs them,
+  # so a release never drafts or signs a commit that fails any of them. Each restores the cache of
+  # its ci.yml counterpart on develop (same shared-key), so it starts warm.
+  verify-ci:
+    name: Verify (cargo xtask ci)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: ci
+          # Release runs are rare: only release-branch runs keep a cache, so dry runs don't evict CI's.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo xtask ci
+
+  verify-heavy:
+    name: Verify (cargo xtask test --heavy)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: heavy
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo xtask test --heavy
+
+  verify-oracle:
+    name: Verify (cargo xtask oracle, ${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            cache: oracle
+          - os: macos-14
+            cache: oracle-macos
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: ${{ matrix.cache }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo xtask oracle
+      - name: docs/oracle.md is current
+        run: git diff --exit-code docs/oracle.md
+
   macos:
     name: macOS universal
     needs: version
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: macos-14
     timeout-minutes: 120
     outputs:
@@ -88,6 +158,8 @@ jobs:
           key: release-macos-universal
           # Release runs are rare: only release-branch runs keep a cache, so dry runs don't evict CI's.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Generate THIRD-PARTY-LICENSES.txt (fails when a crate's licence can't be resolved)
+        run: cargo xtask licences
       - name: Import the signing certificate (skipped without APPLE_CERTIFICATE)
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -97,6 +169,8 @@ jobs:
       - name: Build, sign, notarize and package (the dmg is mounted and checked)
         id: package
         env:
+          # The analytics project key (docs/privacy.md), built in; never printed.
+          FIELDCRAFT_POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
@@ -115,6 +189,9 @@ jobs:
     name: Linux x86_64
     needs: version
     # The oldest GitHub-hosted image, so the binaries need only glibc >= 2.35.
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     env:
@@ -134,11 +211,16 @@ jobs:
           key: release-linux-x86_64
           # Release runs are rare: only release-branch runs keep a cache, so dry runs don't evict CI's.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Generate THIRD-PARTY-LICENSES.txt (fails when a crate's licence can't be resolved)
+        run: cargo xtask licences
       - name: Install cargo-deb and cargo-generate-rpm
         run: |
           cargo install --locked --version "$CARGO_DEB_VERSION" cargo-deb
           cargo install --locked --version "$CARGO_GENERATE_RPM_VERSION" cargo-generate-rpm
       - name: Build and package (tar.gz, AppImage, deb, rpm)
+        env:
+          # The analytics project key (docs/privacy.md), built in; never printed.
+          FIELDCRAFT_POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}
         run: packaging/linux/package.sh
       - name: Check the packages
         run: |
@@ -195,6 +277,9 @@ jobs:
   windows:
     name: Windows x64
     needs: version
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: windows-latest
     timeout-minutes: 90
     env:
@@ -209,8 +294,13 @@ jobs:
           key: release-windows-x64
           # Release runs are rare: only release-branch runs keep a cache, so dry runs don't evict CI's.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Generate THIRD-PARTY-LICENSES.txt (fails when a crate's licence can't be resolved)
+        run: cargo xtask licences
       - name: Build and package (zip)
         shell: pwsh
+        env:
+          # The analytics project key (docs/privacy.md), built in; never printed.
+          FIELDCRAFT_POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}
         run: ./packaging/windows/package.ps1
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
@@ -220,7 +310,11 @@ jobs:
 
   release:
     name: Draft release (or dry-run artifacts)
-    needs: [version, macos, linux, windows]
+    # The only job that publishes anything: it waits for every verify and packaging job.
+    needs: [version, verify-ci, verify-heavy, verify-oracle, macos, linux, windows]
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-24.04
     permissions:
       contents: write
@@ -237,22 +331,58 @@ jobs:
           pattern: release-*
           path: artifacts
           merge-multiple: true
-      - name: Check the set, checksums and notes
+      - uses: dtolnay/rust-toolchain@stable
+      # The same file every package carries, attached to the release on its own.
+      - name: Generate THIRD-PARTY-LICENSES.txt
+        run: cargo xtask licences && cp THIRD-PARTY-LICENSES.txt artifacts/
+      - name: Check the set and write the checksums
         run: |
           for f in "fieldcraft-$VERSION-macos-universal.dmg" "fieldcraft-cli-$VERSION-macos-universal.zip" \
             "fieldcraft-$VERSION-linux-x86_64.tar.gz" "fieldcraft-$VERSION-linux-x86_64.AppImage" \
             "fieldcraft_${VERSION}_amd64.deb" "fieldcraft-$VERSION.x86_64.rpm" \
-            "fieldcraft-$VERSION-windows-x64.zip"; do
+            "fieldcraft-$VERSION-windows-x64.zip" THIRD-PARTY-LICENSES.txt; do
             test -s "artifacts/$f" || { echo "::error::missing $f"; exit 1; }
           done
           (cd artifacts && sha256sum -- * | tee SHA256SUMS.txt)
+      - name: Sign SHA256SUMS.txt with the release key (skipped without FIELDCRAFT_SIGNING_KEY)
+        id: sign
+        env:
+          FIELDCRAFT_SIGNING_KEY: ${{ secrets.FIELDCRAFT_SIGNING_KEY }}
+          # rsign2 (MIT), a minisign-compatible signer, pinned.
+          RSIGN_VERSION: 0.6.7
+        run: |
+          if [ -z "$FIELDCRAFT_SIGNING_KEY" ]; then
+            echo "::warning::FIELDCRAFT_SIGNING_KEY is not set: SHA256SUMS.txt is not signed, so the app cannot install this release itself (docs/releasing.md)"
+            echo "signed=false" >>"$GITHUB_OUTPUT"
+            exit 0
+          fi
+          cargo install --locked --quiet --root "$RUNNER_TEMP/rsign" rsign2 --version "$RSIGN_VERSION"
+          rsign="$RUNNER_TEMP/rsign/bin/rsign"
+          key="$RUNNER_TEMP/release.key"
+          (umask 077 && printf '%s\n' "$FIELDCRAFT_SIGNING_KEY" >"$key")
+          "$rsign" sign -W -s "$key" -t "FieldCraft v$VERSION SHA256SUMS.txt" -x artifacts/SHA256SUMS.txt.minisig artifacts/SHA256SUMS.txt
+          rm -f "$key"
+          # The signature must verify with the public key the app is built with.
+          public="$(sed -n 's/^pub const PUBLIC_KEY: &str = "\(.*\)";$/\1/p' crates/update/src/lib.rs)"
+          "$rsign" verify -q -P "$public" -x artifacts/SHA256SUMS.txt.minisig artifacts/SHA256SUMS.txt
+          echo "signed=true" >>"$GITHUB_OUTPUT"
+      - name: Write the notes
+        env:
+          SIGNED: ${{ steps.sign.outputs.signed }}
+        run: |
           # The macOS paragraph says how the app was signed (packaging/macos/package.sh).
           case "$MACOS_SIGNING" in
             notarized) macos="The macOS app is signed with a Developer ID and notarized by Apple." ;;
             signed) macos="The macOS app is signed with a Developer ID but **not notarized**: the first time, right-click \`FieldCraft.app\` in Applications and choose **Open**." ;;
             *) macos="The macOS app is **ad-hoc signed and not notarized**: macOS blocks the first launch. Right-click \`FieldCraft.app\` in Applications and choose **Open** (then **Open** again), or run \`xattr -dr com.apple.quarantine /Applications/FieldCraft.app\`." ;;
           esac
-          awk -v v="$VERSION" -v m="$macos" '{ gsub(/\{version\}/, v); gsub(/\{macos_signing\}/, m); print }' \
+          # The updates paragraph says whether the app can install this release itself.
+          if [ "$SIGNED" = true ]; then
+            updates="\`SHA256SUMS.txt\` is signed with the FieldCraft release key (\`SHA256SUMS.txt.minisig\`), so FieldCraft's Help › Check for Updates can verify and install this release."
+          else
+            updates="This release's \`SHA256SUMS.txt\` is **not signed**: FieldCraft's in-app updates can't verify it and won't install it; download it from this page instead."
+          fi
+          awk -v v="$VERSION" -v m="$macos" -v u="$updates" '{ gsub(/\{version\}/, v); gsub(/\{macos_signing\}/, m); gsub(/\{update_signing\}/, u); print }' \
             .github/release-notes.md >notes.md
           cat notes.md >>"$GITHUB_STEP_SUMMARY"
       - name: Upload the dry-run artifacts

.gitignore

@@ -7,3 +7,4 @@
 .DS_Store
 *.swp
 __pycache__/
+/THIRD-PARTY-LICENSES.txt

AGENTS.md

@@ -24,7 +24,9 @@ FieldCraft everywhere: crates `fieldcraft-*`, binaries `fieldcraft` and `fieldcr
 ## Never crash
 People trust FieldCraft with their models; a crash loses their work. **This outranks feature work.**
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The one exception, in the app crate
+  (which denies it instead), has no safe API: the Windows-only `apps/fieldcraft/src/native_crash.rs`
+  (the exception filter that records crashes inside native code such as graphics drivers).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
   returns an error ("not supported yet: …"); it never panics.
 - **Input-derived numbers are hostile** (command parameters, model files, solver decks,
@@ -119,20 +121,25 @@ People trust FieldCraft with their models; a crash loses their work. **This outr
      contributors' pull requests wait for the maintainer's review (CONTRIBUTING.md). Never squash.
      Then remove your worktree and delete your local branch.
   5. Never run the full gate locally: no `cargo xtask ci`, no `cargo clippy --workspace`, no
-     `cargo xtask wasm` or `oracle` unless step 2 calls for it. Never watch CI. GitHub CI runs
-     `cargo xtask ci` (fmt, assets, licences, layers, clippy -D warnings, tests, wasm), the
-     oracle, the heavy tests and the advisories once per merge on `develop`; the coordinator
+     `cargo xtask wasm` or `oracle` unless step 2 calls for it. Never watch CI. GitHub CI runs,
+     per merge on `develop`, `cargo xtask ci --affected <last green commit>` (fmt, assets,
+     layers on the whole tree; clippy and tests on the crates the change reaches; wasm when one
+     of them builds for it), the oracle and heavy tests when the change reaches the solvers or
+     the oracle, and the dependency licences and advisories; a change to Cargo.toml, Cargo.lock,
+     xtask or the workflows, the nightly run and every release run all of it (docs/releasing.md,
+     "What CI runs when"). `cargo xtask affected --base origin/develop` shows what your branch
+     reaches. The coordinator
      watches it and sends a failure back to the change that caused it, which is fixed forward
      at once.
 - **Keep the trunk gate fast** (under ~3 minutes on CI). A test that takes more than a few seconds
   (convergence studies, the whole corpus, cross-checks between solvers) is
   `#[ignore = "heavy: cargo xtask test --heavy (CI heavy job)"]`, with a fast representative
   test left in the trunk gate. The `heavy` CI job runs `cargo xtask test --heavy` (every ignored
-  test, benchmarks included, and the doc tests) on every merge to `develop`, nightly and on
-  demand (`gh workflow run CI --ref <branch>`). Hostile-input tests run commands on sessions with small
+  test, benchmarks included, and the doc tests) on merges to `develop` that reach a crate with
+  heavy tests, nightly, before every release and on demand (`gh workflow run CI --ref <branch>`). Hostile-input tests run commands on sessions with small
   work caps (`Session::limits`) so refusals are instant; never lower the production caps for a
   test.
-- **Publishing**: `origin` is github.com/jyviko/fieldcraft. Changes land through pull requests
+- **Publishing**: `origin` is github.com/tangency-labs/fieldcraft. Changes land through pull requests
   as the workflow above describes; the coordinator reads every merged diff and sends findings
   back as fix-forward work. Never force-push `develop` or `main`; `main` holds released code and moves only by
   fast-forward at a release (docs/releasing.md). Never commit `plan/`, `.agent-files/`,

ATTRIBUTION.md

@@ -24,12 +24,32 @@ is committed and listed here with its exports.
 | docs/media/examples/bracket-hex.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved bracket-hex sample (docs/examples.md) | MIT OR Apache-2.0 |
 | docs/media/examples/crank-arm.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved crank-arm sample (docs/examples.md) | MIT OR Apache-2.0 |
 | docs/media/examples/crank-mirror.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved crank-mirror sample (docs/examples.md) | MIT OR Apache-2.0 |
+| docs/meshing/skill/analytic-cylinder.png, docs/meshing/skill/analytic-pipe.png, docs/meshing/skill/analytic-plate-hole.png, docs/meshing/skill/analytic-sphere.png, docs/meshing/skill/analytic-torus.png, docs/meshing/skill/bent-tube.png, docs/meshing/skill/bolted-assembly.png, docs/meshing/skill/cantilever-i-beam.png, docs/meshing/skill/crank-arm.png, docs/meshing/skill/cup.png, docs/meshing/skill/filleted-bracket-blocks.png, docs/meshing/skill/filleted-bracket.png, docs/meshing/skill/i-beam.png, docs/meshing/skill/loft-transition.png, docs/meshing/skill/perforated-plate.png, docs/meshing/skill/pi5-base.png, docs/meshing/skill/pi5-lid.png, docs/meshing/skill/pinhole-block.png, docs/meshing/skill/plain-cup.png, docs/meshing/skill/rounded-box.png, docs/meshing/skill/shallow-groove.png, docs/meshing/skill/sharp-wedge.png, docs/meshing/skill/sphere-on-plate.png, docs/meshing/skill/spline-vase.png, docs/meshing/skill/stepped-block.png, docs/meshing/skill/thin-ribs.png, docs/meshing/skill/thin-wall-enclosure.png, docs/meshing/skill/upright-bracket.png | FieldCraft contributors | Original: section pictures of the corpus parts and samples meshed by the meshing skill, drawn by `fieldcraft-cli snapshot` (`cargo xtask skill-results`, docs/meshing/skill-results.md) | MIT OR Apache-2.0 |
+| docs/media/examples/flow-past.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the flow-past sample (its bracket; the viewport does not draw flow results yet) (docs/examples.md) | MIT OR Apache-2.0 |
+| docs/media/examples/cantilever.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved cantilever sample (docs/examples.md) | MIT OR Apache-2.0 |
+| docs/media/examples/impact.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved impact sample (docs/examples.md) | MIT OR Apache-2.0 |
+| docs/media/examples/ibeam.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the solved ibeam sample (docs/examples.md) | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/ibeam.png | FieldCraft contributors | Original: the solved ibeam sample rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the ibeam sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| docs/media/examples/parts.png | FieldCraft contributors | Original: the FieldCraft window captured (`ui.capture`) with the parts sample (meshes only, nothing to solve) (docs/examples.md) | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/flow-past.png | FieldCraft contributors | Original: the flow-past sample as docs/media/examples/flow-past.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the flow-past sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/cantilever.png | FieldCraft contributors | Original: the cantilever sample as docs/media/examples/cantilever.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the cantilever sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/impact.png | FieldCraft contributors | Original: the impact sample as docs/media/examples/impact.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the impact sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/parts.png | FieldCraft contributors | Original: the parts sample as docs/media/examples/parts.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the parts sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/bracket-hex.png | FieldCraft contributors | Original: the bracket-hex sample as docs/media/examples/bracket-hex.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the bracket-hex sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/crank-arm.png | FieldCraft contributors | Original: the crank-arm sample as docs/media/examples/crank-arm.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the crank-arm sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/crank-mirror.png | FieldCraft contributors | Original: the crank-mirror sample as docs/media/examples/crank-mirror.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the crank-mirror sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/drop-test.png | FieldCraft contributors | Original: the drop-test sample as docs/media/examples/drop-test.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the drop-test sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/heated-bracket.png | FieldCraft contributors | Original: the heated-bracket sample as docs/media/examples/heated-bracket.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the heated-bracket sample's thumbnail on the Start card | MIT OR Apache-2.0 |
+| crates/ui-egui/thumbnails/rubber-seal.png | FieldCraft contributors | Original: the rubber-seal sample as docs/media/examples/rubber-seal.png shows it, rendered by FieldCraft (`ui.render`, light theme), cropped to the model and scaled to 320 px wide (ImageMagick, 128-colour palette), the rubber-seal sample's thumbnail on the Start card | MIT OR Apache-2.0 |
 | crates/decks/tests/golden/nastran/*.bdf | FieldCraft contributors | Written by our Nastran writer from our own test models (crates/decks/tests/nastran.rs) | MIT OR Apache-2.0 |
+| crates/engine/tests/designs/pi5-enclosure.json | FieldCraft contributors | Original SolidCraft recipe (solid.* commands) of an enclosure for a single-board computer, for thermal analysis: base, lid, heat sink, board, chips, connectors and the air inside | MIT OR Apache-2.0 |
+| crates/geometry/tests/designs/hollow-box.solidcraft, crates/geometry/tests/designs/hollow-box-post.solidcraft, crates/geometry/tests/designs/open-tray-post.solidcraft | FieldCraft contributors | Built with `solidcraft-cli run` from the recipes beside them (crates/geometry/tests/designs/*.json) | MIT OR Apache-2.0 |
 | assets/icons/assembly.instance.svg, assets/icons/assembly.instance.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/assembly.instance.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/deck.read.svg, assets/icons/deck.read.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/deck.read.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/deck.write.abaqus.svg, assets/icons/deck.write.abaqus.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/deck.write.abaqus.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/deck.write.lsdyna.svg, assets/icons/deck.write.lsdyna.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/deck.write.lsdyna.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/deck.write.nastran.svg, assets/icons/deck.write.nastran.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/deck.write.nastran.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/diagnostics.bug_report.svg, assets/icons/diagnostics.bug_report.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/diagnostics.bug_report.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/edit.redo.svg, assets/icons/edit.redo.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/edit.redo.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/edit.undo.svg, assets/icons/edit.undo.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/edit.undo.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/file.open.svg, assets/icons/file.open.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/file.open.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
@@ -37,11 +57,18 @@ is committed and listed here with its exports.
 | assets/icons/file.save_as.svg, assets/icons/file.save_as.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/file.save_as.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/file.save.svg, assets/icons/file.save.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/file.save.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.bodies.svg, assets/icons/geometry.bodies.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.bodies.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.check.svg, assets/icons/geometry.check.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.check.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.datum.svg, assets/icons/geometry.datum.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.datum.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.datum.axis.svg, assets/icons/geometry.datum.axis.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.datum.axis.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.datum.point.svg, assets/icons/geometry.datum.point.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.datum.point.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.import.mesh.svg, assets/icons/geometry.import.mesh.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.import.mesh.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.midsurface.svg, assets/icons/geometry.midsurface.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.midsurface.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.open.svg, assets/icons/geometry.open.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.open.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.partition.svg, assets/icons/geometry.partition.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.partition.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.faces.merge.svg, assets/icons/geometry.faces.merge.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.faces.merge.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.face.absorb.svg, assets/icons/geometry.face.absorb.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.face.absorb.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.face.split.svg, assets/icons/geometry.face.split.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.face.split.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/geometry.stitch.svg, assets/icons/geometry.stitch.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.stitch.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/geometry.tessellate.svg, assets/icons/geometry.tessellate.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/geometry.tessellate.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/interaction.bolt.svg, assets/icons/interaction.bolt.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.bolt.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/interaction.connector.svg, assets/icons/interaction.connector.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.connector.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
@@ -49,6 +76,8 @@ is committed and listed here with its exports.
 | assets/icons/interaction.contact.general.svg, assets/icons/interaction.contact.general.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.contact.general.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/interaction.contact.pair.svg, assets/icons/interaction.contact.pair.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.contact.pair.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/interaction.fsi.svg, assets/icons/interaction.fsi.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.fsi.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.block.svg, assets/icons/mesh.block.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.block.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.mirror.svg, assets/icons/mesh.mirror.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.mirror.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/model.mass.create.svg, assets/icons/model.mass.create.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/model.mass.create.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/interaction.rigid_wall.svg, assets/icons/interaction.rigid_wall.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/interaction.rigid_wall.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/model.spring.create.svg, assets/icons/model.spring.create.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/model.spring.create.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
@@ -65,9 +94,13 @@ is committed and listed here with its exports.
 | assets/icons/mesh.layers.svg, assets/icons/mesh.layers.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.layers.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.node.add.svg, assets/icons/mesh.node.add.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.node.add.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.node.merge.svg, assets/icons/mesh.node.merge.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.node.merge.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.node.relax.svg, assets/icons/mesh.node.relax.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.node.relax.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.order.quadratic.svg, assets/icons/mesh.order.quadratic.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.order.quadratic.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.quad.faces.svg, assets/icons/mesh.quad.faces.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.quad.faces.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.quality.svg, assets/icons/mesh.quality.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.quality.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.quality.mark.svg, assets/icons/mesh.quality.mark.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.quality.mark.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/results.export.vtu.svg, assets/icons/results.export.vtu.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/results.export.vtu.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.export.stl.svg, assets/icons/mesh.export.stl.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.export.stl.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.region.remesh.svg, assets/icons/mesh.region.remesh.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.region.remesh.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.size.adapt.svg, assets/icons/mesh.size.adapt.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.size.adapt.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.size.global.svg, assets/icons/mesh.size.global.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.size.global.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
@@ -76,6 +109,8 @@ is committed and listed here with its exports.
 | assets/icons/mesh.surface.check.svg, assets/icons/mesh.surface.check.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.surface.check.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.tag.svg, assets/icons/mesh.tag.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.tag.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.tet.generate.svg, assets/icons/mesh.tet.generate.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.tet.generate.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.hex.extrude.svg, assets/icons/mesh.hex.extrude.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.hex.extrude.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/mesh.plan.svg, assets/icons/mesh.plan.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.plan.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.planar.svg, assets/icons/mesh.planar.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.planar.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.transition.svg, assets/icons/mesh.transition.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.transition.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/mesh.untangle.svg, assets/icons/mesh.untangle.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/mesh.untangle.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
@@ -141,6 +176,7 @@ is committed and listed here with its exports.
 | assets/icons/ui.sun.svg, assets/icons/ui.sun.vectorcraft | FieldCraft contributors | Original interface icon (navigation bar, title bar, browser) drawn with VectorCraft from `assets/icons/src/ui.sun.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/ui.views.svg, assets/icons/ui.views.vectorcraft | FieldCraft contributors | Original interface icon (navigation bar, title bar, browser) drawn with VectorCraft from `assets/icons/src/ui.views.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/icons/ui.zoom.svg, assets/icons/ui.zoom.vectorcraft | FieldCraft contributors | Original interface icon (navigation bar, title bar, browser) drawn with VectorCraft from `assets/icons/src/ui.zoom.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
+| assets/icons/view.show_all.svg, assets/icons/view.show_all.vectorcraft | FieldCraft contributors | Original toolbar icon drawn with VectorCraft from `assets/icons/src/view.show_all.json` (`cargo xtask icons`) | MIT OR Apache-2.0 |
 | assets/app-icon/icon.vectorcraft, assets/app-icon/icon.svg, assets/app-icon/icon.png | FieldCraft contributors | Original application icon (a hexahedral-meshed cube with a banded colour fringe on its faces on a rounded-square backdrop), drawn with VectorCraft by `cargo xtask app-icon` (xtask/src/app_icon.rs); editable source, SVG and 1024 × 1024 PNG export | MIT OR Apache-2.0 |
 | assets/app-icon/icon-small.vectorcraft, assets/app-icon/icon-small.svg, assets/app-icon/icon-small.png | FieldCraft contributors | Original simplified application icon for 16–32 px (the fringe cube alone; no mesh or floor grid), drawn with VectorCraft by `cargo xtask app-icon` (xtask/src/app_icon.rs) | MIT OR Apache-2.0 |
 | assets/app-icon/layers/01-floor.vectorcraft, assets/app-icon/FieldCraft.icon/Assets/01-floor.svg | FieldCraft contributors | Original isometric floor grid with a radial fade (Default appearance), drawn with VectorCraft by `cargo xtask app-icon` (xtask/src/app_icon.rs) | MIT OR Apache-2.0 |
@@ -172,11 +208,12 @@ is committed and listed here with its exports.
 | clippy.toml, rustfmt.toml | SolidCraft | MIT OR Apache-2.0 |
 | crates/geometry/src/tagged_mesh.rs (package and part reading, transforms, units, caps) | SolidCraft `crates/io/src/threemf.rs` | MIT OR Apache-2.0 |
 | crates/render/src/camera.rs, crates/render/src/raster.rs | SolidCraft `crates/render/src/camera.rs`, `raster.rs` | MIT OR Apache-2.0 |
-| crates/ui-egui/src/gpu.rs, crates/ui-egui/src/theme.rs (tokens and their values), crates/ui-egui/src/control.rs, crates/ui-egui/src/lib.rs (input injection, screenshots), crates/ui-egui/src/toolbar.rs (workspace switcher, tabs, panels with drop-downs, fitting), crates/ui-egui/src/appbar.rs (application bar; the mark is drawn from assets/app-icon/icon-small.svg's coordinates), crates/ui-egui/src/titlebar.rs (caption buttons, drag and resize zones; SolidCraft took it from VectorCraft), crates/ui-egui/src/frame.rs (windows, heading bands), crates/ui-egui/src/browser.rs (row drawing), crates/ui-egui/src/palette.rs (command line and search), crates/ui-egui/src/timeline.rs (timeline strip, transport), crates/ui-egui/src/viewport.rs (navigation bar, orientation gizmo), crates/ui-egui/src/files.rs (background opening, file pickers as host services) | SolidCraft `crates/ui-egui/src/` (titlebar.rs also VectorCraft `crates/ui-egui/src/titlebar.rs`) | MIT OR Apache-2.0 |
+| crates/gpu/src/view.rs (viewport pipelines and shaders), crates/ui-egui/src/gpu.rs, crates/ui-egui/src/theme.rs (tokens and their values), crates/ui-egui/src/control.rs, crates/ui-egui/src/lib.rs (input injection, screenshots), crates/ui-egui/src/toolbar.rs (workspace switcher, tabs, panels with drop-downs, fitting), crates/ui-egui/src/appbar.rs (application bar; the mark is drawn from assets/app-icon/icon-small.svg's coordinates), crates/ui-egui/src/titlebar.rs (caption buttons, drag and resize zones; SolidCraft took it from VectorCraft), crates/ui-egui/src/frame.rs (windows, heading bands), crates/ui-egui/src/browser.rs (row drawing), crates/ui-egui/src/palette.rs (command line and search), crates/ui-egui/src/timeline.rs (timeline strip, transport), crates/ui-egui/src/viewport.rs (navigation bar, orientation gizmo), crates/ui-egui/src/files.rs (background opening, file pickers as host services) | SolidCraft `crates/ui-egui/src/` (titlebar.rs also VectorCraft `crates/ui-egui/src/titlebar.rs`) | MIT OR Apache-2.0 |
 | crates/ui-egui/src/navigation.rs (navigation presets and bindings), crates/ui-egui/src/viewport.rs (orbit about the point under the cursor, or the drawn centre from empty space; Ctrl + left drag orbits) | SolidCraft `crates/ui-egui/src/prefs.rs` (`NavPreset`, `NavBinding`, `NAV_PRESETS`, `orbit`) | MIT OR Apache-2.0 |
 | crates/ui-egui/src/fields.rs (form rows: a label column of fixed width, then the field) | SolidCraft `crates/ui-egui/src/dialogs.rs` | MIT OR Apache-2.0 |
 | crates/io/src/fs.rs (atomic writes) | SolidCraft `crates/io/src/safe_write.rs` | MIT OR Apache-2.0 |
 | crates/io/src/recovery.rs (recovery folder, entries, locks) | SolidCraft `crates/engine/src/recovery.rs` | MIT OR Apache-2.0 |
+| crates/engine/src/crash.rs, crates/engine/src/crash_tests.rs (crash reports: panic hook, locked command journal, unclean-exit detection, startup steps, native crash reports, report folders and limits, replay), apps/fieldcraft/src/native_crash.rs (Windows exception filter and minidump), apps/fieldcraft-cli/src/crashes.rs, docs/crash-reports.md (structure) | SolidCraft `crates/engine/src/crash.rs`, `crash_tests.rs`, `apps/solidcraft/src/native_crash.rs`, `apps/solidcraft-cli/src/crashes.rs`, `docs/crash-reports.md` | MIT OR Apache-2.0 |
 | apps/fieldcraft/src/control_server.rs | SolidCraft `apps/solidcraft/src/control_server.rs` | MIT OR Apache-2.0 |
 | crates/mcp/src/ (JSON-RPC framing, MCP lifecycle, tool schema checks, the control-channel backend, base64) | SolidCraft `crates/mcp/src/` | MIT OR Apache-2.0 |
 | crates/io/src/roots.rs (the rules of read and write roots) | VectorCraft's automation roots (docs/mcp.md there) | MIT OR Apache-2.0 |

CONTRIBUTING.md

@@ -15,7 +15,7 @@ needed most, and how to claim work. The rules every change follows, by a person
 You need stable Rust 1.95 or newer.
 
 ```sh
-git clone https://github.com/jyviko/fieldcraft && cd fieldcraft
+git clone https://github.com/tangency-labs/fieldcraft && cd fieldcraft
 cargo run --release -p fieldcraft -- --sample cantilever   # the desktop app on a sample model
 cargo run -p fieldcraft-cli -- commands                    # every command and its parameters
 cargo test -p fieldcraft-solver                            # the tests of one crate
@@ -28,32 +28,32 @@ cargo xtask oracle --quick                                 # the verification ca
 
 ## Where help is wanted most
 
-See the [`help wanted`](https://github.com/jyviko/fieldcraft/labels/help%20wanted) and
-[`good first issue`](https://github.com/jyviko/fieldcraft/labels/good%20first%20issue) labels, and
+See the [`help wanted`](https://github.com/tangency-labs/fieldcraft/labels/help%20wanted) and
+[`good first issue`](https://github.com/tangency-labs/fieldcraft/labels/good%20first%20issue) labels, and
 the `area:` labels for your field. In order of how much they would help users:
 
-1. **Reproducible meshes** ([#115](https://github.com/jyviko/fieldcraft/issues/115)). The same part
+1. **Reproducible meshes** ([#115](https://github.com/tangency-labs/fieldcraft/issues/115)). The same part
    must give the same tet mesh on every platform and every run, as the solvers already do.
-2. **All-hex meshing of thin and curved parts** ([#85](https://github.com/jyviko/fieldcraft/issues/85)).
+2. **All-hex meshing of thin and curved parts** ([#85](https://github.com/tangency-labs/fieldcraft/issues/85)).
    The octree mesher over-refines thin walls; concave transition templates and an up-front depth
    are next. Hex meshing is the centre of gravity of the project.
-3. **Getting results in and out**: ParaView export ([#90](https://github.com/jyviko/fieldcraft/issues/90)),
-   Gmsh import ([#91](https://github.com/jyviko/fieldcraft/issues/91)), Abaqus deck reading
-   ([#98](https://github.com/jyviko/fieldcraft/issues/98)), CSV and STL
-   ([#92](https://github.com/jyviko/fieldcraft/issues/92), [#93](https://github.com/jyviko/fieldcraft/issues/93)).
-4. **Verification benchmarks** ([#97](https://github.com/jyviko/fieldcraft/issues/97),
-   [#106](https://github.com/jyviko/fieldcraft/issues/106)). An engineer with a published benchmark
+3. **Getting results in and out**: ParaView export ([#90](https://github.com/tangency-labs/fieldcraft/issues/90)),
+   Gmsh import ([#91](https://github.com/tangency-labs/fieldcraft/issues/91)), Abaqus deck reading
+   ([#98](https://github.com/tangency-labs/fieldcraft/issues/98)), CSV and STL
+   ([#92](https://github.com/tangency-labs/fieldcraft/issues/92), [#93](https://github.com/tangency-labs/fieldcraft/issues/93)).
+4. **Verification benchmarks** ([#97](https://github.com/tangency-labs/fieldcraft/issues/97),
+   [#106](https://github.com/tangency-labs/fieldcraft/issues/106)). An engineer with a published benchmark
    can add it as an oracle case without touching solver code.
 5. **Nonlinear elements and materials**: incompatible modes at finite strain
-   ([#82](https://github.com/jyviko/fieldcraft/issues/82)), kinematic hardening
-   ([#81](https://github.com/jyviko/fieldcraft/issues/81)), and the material library
-   ([#99](https://github.com/jyviko/fieldcraft/issues/99)).
-6. **The app**: typed command forms ([#112](https://github.com/jyviko/fieldcraft/issues/112)), XY and
-   path plots ([#94](https://github.com/jyviko/fieldcraft/issues/94), [#95](https://github.com/jyviko/fieldcraft/issues/95)).
+   ([#82](https://github.com/tangency-labs/fieldcraft/issues/82)), kinematic hardening
+   ([#81](https://github.com/tangency-labs/fieldcraft/issues/81)), and the material library
+   ([#99](https://github.com/tangency-labs/fieldcraft/issues/99)).
+6. **The app**: typed command forms ([#112](https://github.com/tangency-labs/fieldcraft/issues/112)), XY and
+   path plots ([#94](https://github.com/tangency-labs/fieldcraft/issues/94), [#95](https://github.com/tangency-labs/fieldcraft/issues/95)).
 
 Bigger areas on the [roadmap](ROADMAP.md) — contact, dynamics, composites, coupled fields, wave
 propagation, turbulence — are open to anyone who wants to own one: start a thread in
-[Discussions](https://github.com/jyviko/fieldcraft/discussions).
+[Discussions](https://github.com/tangency-labs/fieldcraft/discussions).
 
 ## Before you start: claim an issue
 

Cargo.toml

@@ -3,12 +3,12 @@ resolver = "3"
 members = ["crates/*", "apps/*", "xtask"]
 
 [workspace.package]
-version = "0.5.8"
+version = "0.6.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
 authors = ["FieldCraft contributors"]
-repository = "https://github.com/jyviko/fieldcraft"
+repository = "https://github.com/tangency-labs/fieldcraft"
 
 [workspace.dependencies]
 # internal
@@ -27,6 +27,8 @@ fieldcraft-testkit = { path = "crates/testkit" }
 fieldcraft-render = { path = "crates/render" }
 fieldcraft-ui-egui = { path = "crates/ui-egui" }
 fieldcraft-mcp = { path = "crates/mcp" }
+fieldcraft-update = { path = "crates/update" }
+fieldcraft-gpu = { path = "crates/gpu" }
 
 # foundation
 thiserror = "2"
@@ -34,9 +36,9 @@ serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
 
-# 3MF packages (docs/formats/tagged-mesh.md): the same versions SolidCraft uses.
-zip = { version = "3", default-features = false, features = ["deflate"] }
-quick-xml = "0.41"
+# 3MF packages (docs/formats/tagged-mesh.md). zip is ahead of SolidCraft (still on 3), so both are built.
+zip = { version = "9", default-features = false, features = ["deflate"] }
+quick-xml = "0.42"
 
 # content hashes and part checksums of .fieldcraft files (the version SolidCraft uses)
 sha2 = "0.11"
@@ -50,6 +52,9 @@ resvg = { version = "0.48", default-features = false }
 egui = "0.36"
 eframe = { version = "0.36", default-features = false }
 egui-wgpu = "0.36"
+# the wgpu egui-wgpu uses, for the offscreen viewport (crates/gpu); backends come per target there
+wgpu = { version = "30", default-features = false, features = ["std", "wgsl"] }
+pollster = "1.0"
 # Shared Craft-family egui components (icon buttons, tabs, widget palette); the same rev as
 # VectorCraft. MIT OR Apache-2.0.
 craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675" }
@@ -58,13 +63,13 @@ rfd = "0.17"
 
 # Geometry: SolidCraft's B-rep kernel (MIT OR Apache-2.0), pinned. Only crates/geometry uses it
 # (plan/adr/0001-libraries.md).
-solidcraft-geom = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-solidcraft-kernel = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-solidcraft-doc = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-solidcraft-io = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
+solidcraft-geom = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+solidcraft-kernel = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+solidcraft-doc = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+solidcraft-io = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
 # Runs SolidCraft command scripts (the test corpus recipes); only behind fieldcraft-geometry's
 # `scripts` feature.
-solidcraft-engine = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
+solidcraft-engine = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -128,10 +133,10 @@ debug = "line-tables-only"
 # reach a dependent workspace, so FieldCraft applies the same ones from the same pinned commit;
 # keep this list and the rev in step with SolidCraft's [patch.crates-io].
 [patch.crates-io]
-truck-shapeops = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-truck-stepio = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-truck-meshalgo = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
-matext4cgmath = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
+truck-shapeops = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+truck-stepio = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+truck-meshalgo = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
+matext4cgmath = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }
 # egui-wgpu with SolidCraft's fixes (vendor/egui-wgpu there): MSAA clamped to what the device
 # supports and 1x on OpenGL adapters, so the requested 4x never fails pipeline validation at start.
-egui-wgpu = { git = "https://github.com/bherbruck/solidcraft", rev = "a629236650c44ee73edf36fab0dcd2385103a610" }
+egui-wgpu = { git = "https://github.com/bherbruck/solidcraft", rev = "b1695873f5d0031f51a8d5e7ec036fced6f000e2" }

NOTICE

@@ -6,7 +6,7 @@ Licensed under the MIT License or the Apache License, Version 2.0, at your optio
 Third-party material
 
 Software dependencies are listed in Cargo.lock; their licences are in THIRD-PARTY-LICENSES.txt
-(`cargo xtask licences`). Geometry comes from SolidCraft (https://github.com/bherbruck/solidcraft,
+(generated by `cargo xtask licences`, in every release package). Geometry comes from SolidCraft (https://github.com/bherbruck/solidcraft,
 MIT OR Apache-2.0), which builds on the truck crates (https://github.com/ricosjp/truck, Apache-2.0,
 Copyright (c) RICOS Co. Ltd.), some with SolidCraft's modifications.
 

README.md

@@ -10,8 +10,8 @@ see the results — with a nonlinear implicit solver (large deformation, plastic
 in place. Hex meshing is the centre of gravity. Next: buckling and arc-length, contact, then
 the wider material and multiphysics library. See [ROADMAP.md](ROADMAP.md).
 **Want to help?** Pick an issue labelled
-[good first issue](https://github.com/jyviko/fieldcraft/labels/good%20first%20issue) or
-[help wanted](https://github.com/jyviko/fieldcraft/labels/help%20wanted) and read
+[good first issue](https://github.com/tangency-labs/fieldcraft/labels/good%20first%20issue) or
+[help wanted](https://github.com/tangency-labs/fieldcraft/labels/help%20wanted) and read
 [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ![Claude analyses an I-beam cantilever in FieldCraft over MCP: it opens the part, hex meshes it, sets steel, the clamp and a 1 kN tip load, solves, shows von Mises stress and the deformed shape, and checks the tip deflection against beam theory](docs/media/claude-mcp.gif)
@@ -28,15 +28,15 @@ theory with shear 0.177 mm).
 
 ## Download
 
-[![Download for macOS](https://img.shields.io/badge/macOS-Download-000000?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/jyviko/fieldcraft/releases/latest)
-[![Download for Windows](https://img.shields.io/badge/Windows-Download-0078D6?style=for-the-badge)](https://github.com/jyviko/fieldcraft/releases/latest)
-[![Download for Linux](https://img.shields.io/badge/Linux-Download-FCC624?style=for-the-badge&logo=linux&logoColor=black)](https://github.com/jyviko/fieldcraft/releases/latest)
-[![Try it in your browser](https://img.shields.io/badge/Browser-Try%20it-2ea44f?style=for-the-badge&logo=webassembly&logoColor=white)](https://jyviko.github.io/fieldcraft/)
+[![Download for macOS](https://img.shields.io/badge/macOS-Download-000000?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/tangency-labs/fieldcraft/releases/latest)
+[![Download for Windows](https://img.shields.io/badge/Windows-Download-0078D6?style=for-the-badge)](https://github.com/tangency-labs/fieldcraft/releases/latest)
+[![Download for Linux](https://img.shields.io/badge/Linux-Download-FCC624?style=for-the-badge&logo=linux&logoColor=black)](https://github.com/tangency-labs/fieldcraft/releases/latest)
+[![Try it in your browser](https://img.shields.io/badge/Browser-Try%20it-2ea44f?style=for-the-badge&logo=webassembly&logoColor=white)](https://tangency-labs.github.io/fieldcraft/)
 
 - **macOS:** open the `.dmg` and drag FieldCraft into Applications (Apple silicon and Intel).
 - **Windows:** unzip and run `fieldcraft.exe`.
 - **Linux:** the `.AppImage` (allow it to run as a program), or the `.tar.gz`.
-- **Browser:** [try it at jyviko.github.io/fieldcraft](https://jyviko.github.io/fieldcraft/), no install.
+- **Browser:** [try it at tangency-labs.github.io/fieldcraft](https://tangency-labs.github.io/fieldcraft/), no install.
 - **Command line:** `fieldcraft-cli` ships in every package; AI agents connect to it over MCP
   ([docs/mcp.md](docs/mcp.md)).
 
@@ -114,10 +114,11 @@ against a closed form or a reference solution ([docs/examples.md](docs/examples.
 ## Build
 
 ```sh
-cargo xtask ci                                  # fmt, assets, licences, layers, clippy, tests, wasm
+cargo xtask ci                                  # fmt, assets, layers, clippy, tests, wasm
 cargo xtask test --heavy                        # the heavy (ignored) tests and the doc tests
 cargo run -p fieldcraft-cli -- commands         # every command and its parameters
 cargo run -p fieldcraft-cli -- run script.json  # run a command script
+cargo run -p fieldcraft-cli -- snapshot script.json --out shot.png  # draw it to a PNG, no window
 cargo run -p fieldcraft-cli -- mcp              # MCP server on stdio for AI agents (docs/mcp.md)
 ```
 
@@ -135,10 +136,21 @@ Rust 1.95 or later, with the `wasm32-unknown-unknown` target for `cargo xtask ci
 - [Releasing](docs/releasing.md): how a release is built, verified and published
 - [Contributing](CONTRIBUTING.md) and [agent instructions](AGENTS.md)
 
+## Privacy
+
+FieldCraft sends nothing until you agree. The first start asks once whether to share anonymous
+usage (which tools you use, nothing from your models); Help › Settings… changes it, and
+`FIELDCRAFT_TELEMETRY=0` turns it off. File names, paths, geometry, model contents, parameter
+values and messages are never sent: [docs/privacy.md](docs/privacy.md) lists every event and
+property. Crash reports and the log stay on your computer; Help › Report a Bug opens a GitHub issue
+you review and submit yourself, with your session or model attached only if you tick them
+([docs/crash-reports.md](docs/crash-reports.md)).
+
 ## License
 
 Dual-licensed under [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option. Notices
-are in [NOTICE](NOTICE); third-party licences in [THIRD-PARTY-LICENSES.txt](THIRD-PARTY-LICENSES.txt).
+are in [NOTICE](NOTICE); third-party licences in
+THIRD-PARTY-LICENSES.txt, which every release package carries (`cargo xtask licences` writes it).
 
 FieldCraft is an independent project, not affiliated with, sponsored or endorsed by Dassault
 Systèmes, MSC Software, Siemens or Ansys. Abaqus, Nastran, MSC Nastran, Simcenter Nastran and

ROADMAP.md

@@ -31,8 +31,8 @@ pressure) is a degree of freedom of the existing DOF framework, not a separate s
 | M2 Tet meshing and size field | Size field (global, curvature and proximity; edge seeds done: `mesh.seed.edge` on persistent design edge names (`<face>|<face>`) with a count or size, geometric bias and an exact, min or free constraint, shown as ticks and under Mesh › Seeds, honoured by the hex sweep, extrude, revolve, mapped, blocks and cells meshers through interval assignment (conflicting exact seeds named) and by the tet mesher, which divides the edge at the seed's nodes and grades its size field from them; per-face seeds to do; the `fieldcraft_mesh::size::SizeField` trait and edge-division helpers are in); Bowyer–Watson Delaunay (exact, symbolic perturbation, verified; `fieldcraft-mesh::delaunay`, done); robust CDT boundary recovery (Diazzi et al. 2023: implicit LNC Steiner points on segments, gift-wrapping facet recovery, inside/outside labelling, B-rep face tags on boundary tet faces, flip repair of rounding (§5.1) checked by the validity gate; `fieldcraft-mesh::cdt` and `mesh.tet.generate`, done: all 20 valid corpus parts); quality stage (done: `fieldcraft-mesh::tet` — curvature-graded size field, edge-collapse coarsening, constrained Delaunay refinement with boundary points on the B-rep faces and curves, ODT smoothing, Klingner–Shewchuk improvement, tet4 and tet10 with mid-side nodes on the B-rep, quality report; one validity criterion shared by the gate and both solvers; the filleted-bracket fillet stress converges, tests/oracle); mesh verify per set | in progress |
 | M3 First deck | Sets and surfaces bound to SolidCraft face, edge, vertex and body names, resolved after meshing; materials (isotropic and orthotropic elastic, density) with a unit-system label and consistency check; sections (solid, shell, beam profiles) assigned by set; element formulation per region mapped to each solver; BCs (fixed, displacement, symmetry); loads (force and moment on reference points, pressure, gravity); reference points with kinematic and distributing coupling; steps (linear static, frequency) with explicit per-step load and BC tables and output presets; `model.check` naming every missing or bad item; `model.*` and `mesh.tag` commands (model definition: done); writers for Abaqus input (done: `deck.write`), Nastran SOL 101/103 (done: `deck.write`) and LS-DYNA implicit (done); the `.fieldcraft` file (text definition, binary mesh, geometry references reopened on load, journal; atomic saves, autosave and recovery; undo/redo on the journal: done) | in progress |
 | M4 Own solver and first results | Element library per docs/elements.md (1D and 2D first); Linear static and modal solver (tet4/10, wedge6, hex8, hex20; sparse direct, Lanczos), verified against analytic solutions (solver: done — `fieldcraft-fem` kernels, `fieldcraft-solver` with nested dissection, sparse Cholesky and block Lanczos, `solve.static`/`solve.frequency`/`solve.probe`, patch, cantilever, Lamé, Kirsch and beam-frequency tests; reference points with kinematic and distributing couplings and moments by master–slave constraint elimination, verified by rigid motion, clamping, Saint-Venant tension, bending and tube torsion; 1D elements I: rod2/rod3 trusses, point masses, rotary inertia, springs and dashpots in both solvers and all three decks, verified by the method of joints, the three-bar truss, spring–mass, two-mass chain and torsional pendulum frequencies, and damped decay; 2D elements: plane stress, plane strain and axisymmetric tri3, tri6, quad4 (incompatible modes QM6), quad8 with two degrees of freedom per node, centrifugal loads, `mesh.planar` 2D meshes of polygons and planar faces, verified by patch tests, Kirsch, Lamé (plane strain and axisymmetric), rotating discs and cylinders, and a plane stress cantilever; deck mapping to Abaqus CPS/CPE/CAX, Nastran membranes, LS-DYNA ELFORM 12/13); shells and beams (done: quad4 MITC4 and tri3 MITC3 flat shells with a Hughes–Brezzi drilling rotation, two-node Timoshenko beams with profile properties and orientations, six degrees of freedom at shell and beam nodes shared with solids and trusses, section forces and surface stresses, verified by shell patch tests, Navier's plate, cantilever and portal-frame beams, and the Scordelis–Lo and pinched-cylinder benchmarks); results display (done: `results.*` commands, deformed shape to scale, banded contours of displacement, von Mises, principal and component stresses with a legend, mode shapes with their frequencies and animation, probing a node by clicking it, reaction force and moment sums per set, stale results marked after an edit; explicit steps: field frames by slider or animation with contours per frame, energy histories plotted) | started |
-| M5 Structured hex | 2D quad meshing of faces (`fieldcraft-mesh::quad`: transfinite mapped meshes, free all-quad meshes of polygons with holes on prescribed boundary nodes, exact planar quad validity, shared `SizeField` and even edge divisions; done for planar faces); mapped hex of six-sided regions (trivariate TFI, curved faces) and sweep meshing (multi-level extrusions with imprinted cross-sections, revolutions, one-to-one sweeps through linking faces; interval assignment, hex8/hex20 on the geometry, B-rep face tags, `mesh.hex.generate`/`sweep`/`mapped`: done, 16 of 21 corpus parts all-hex); conforming interfaces between cells (done: `mesh.hex.blocks` meshes a part split with SolidCraft's Split Body into mapped blocks as one conforming mesh — composite faces for seams and tangent faces, interval assignment over all cells, shared faces meshed once, grading off holes and fillets, free-internal-face check; the filleted bracket in 30 cells, hex20 within 0.1 % of a fine tet10 tip deflection); partitions inside FieldCraft (done: datum planes and axes, `geometry.partition` cuts the open design by a datum plane, kept in the model and replayed when the design opens, the two faces of each cut paired by name); cells meshed each with its own method into one mesh (done: `mesh.cells` — hex where a method fits, else tet; matching interfaces merged node for node, others, such as hex next to tet, tied by dual mortar, verified by a tied hex–tet bar in tension to 1e-6); meshing half a symmetric part and mirroring it (done: `mesh.mirror` reflects hex8/hex20/tet4/tet10/wedge6 across a datum plane, right-handed, nodes on the plane merged, tags carried to the image half; a mirrored half bar equals the whole bar's mesh and bending deflection to 1e-12; samples `crank-arm` and `crank-mirror`: the half cut into seven cells, each swept structured, seeded to merge, and mirrored, scaled Jacobian ≥ 0.37; or solving the half: `model.boundary_condition.symmetry` on a datum plane, a half bar with half the load bends as the whole to 1e-11); three-sided sweep regions mapped as triangle primitives (done: midpoint subdivision, dominance constraints in interval assignment); pyramid transitions; automatic decomposition into sweepable and mappable regions, proposed as SolidCraft splits | started |
-| M6 Automatic hex | Octree/grid all-hex for any part (first version: done — `fieldcraft-mesh::octree`, `mesh.hex.octree`: 3-refinement grid with conforming templates refined by curvature, thickness and narrow faces, a core cleared to a manifold boundary, feature map onto it, padding and a pillow per patch capturing every sharp curve, foldover-free fitting, certified validity, B-rep face tags; the corpus hex column and the filleted-bracket oracle case; next: transitions for concave refined regions so thin and curved parts stop over-refining); hex-dominant by tet recombination; polycube for blocky parts; layers through thin walls; mesh editing and orphan-mesh import | started |
+| M5 Structured hex | 2D quad meshing of faces (`fieldcraft-mesh::quad`: transfinite mapped meshes, free all-quad meshes of polygons with holes on prescribed boundary nodes, exact planar quad validity, shared `SizeField` and even edge divisions; done for planar faces); mapped hex of six-sided regions (trivariate TFI, curved faces) and sweep meshing (multi-level extrusions with imprinted cross-sections, revolutions, one-to-one sweeps through linking faces; interval assignment, hex8/hex20 on the geometry, B-rep face tags, `mesh.hex.generate`/`sweep`/`mapped`: done, 16 of 21 corpus parts all-hex); conforming interfaces between cells (done: `mesh.hex.blocks` meshes a part split with SolidCraft's Split Body into mapped blocks as one conforming mesh — composite faces for seams and tangent faces, interval assignment over all cells, shared faces meshed once, grading off holes and fillets, free-internal-face check; the filleted bracket in 30 cells, hex20 within 0.1 % of a fine tet10 tip deflection); partitions inside FieldCraft (done: datum planes and axes, `geometry.partition` cuts the open design by a datum plane, kept in the model and replayed when the design opens, the two faces of each cut paired by name); cells meshed each with its own method into one mesh (done: `mesh.cells` — hex where a method fits, else tet; matching interfaces merged node for node, others, such as hex next to tet, tied by dual mortar, verified by a tied hex–tet bar in tension to 1e-6); meshing half a symmetric part and mirroring it (done: `mesh.mirror` reflects hex8/hex20/tet4/tet10/wedge6 across a datum plane, right-handed, nodes on the plane merged, tags carried to the image half; a mirrored half bar equals the whole bar's mesh and bending deflection to 1e-12; samples `crank-arm` and `crank-mirror`: one datum, the half extruded in automatic blocks and mirrored, scaled Jacobian ≥ 0.37; or solving the half: `model.boundary_condition.symmetry` on a datum plane, a half bar with half the load bends as the whole to 1e-11); three-sided sweep regions mapped as triangle primitives (done: midpoint subdivision, dominance constraints in interval assignment); automatic blocks of extruded cross-sections (done: `hex::decompose` — holes separated, O-grids, cuts from concave corners and fillets chosen by block quality, kept only when no worse than the free mesh; nothing added to the model); pyramid transitions; automatic decomposition of 3D parts into sweepable and mappable regions | started |
+| M6 Automatic hex | Octree/grid all-hex for any part (first version: done — `fieldcraft-mesh::octree`, `mesh.hex.octree`: 3-refinement grid with conforming templates refined by curvature, thickness and narrow faces, a core cleared to a manifold boundary, feature map onto it, padding and a pillow per patch capturing every sharp curve, foldover-free fitting, certified validity, B-rep face tags; the corpus hex column and the filleted-bracket oracle case; next: transitions for concave refined regions so thin and curved parts stop over-refining); hex-dominant by tet recombination; polycube for blocky parts; layers through thin walls; mesh editing (node tools done: `mesh.node.merge` equivalences coincident nodes with sets and tags following the survivors and element collapses left out, previewed in its form; `mesh.check.duplicates` lists unmerged nodes, repeated elements, cracks and free edges and selects them; `mesh.renumber` compact, by body or in reverse Cuthill–McKee order, every reference following) and orphan-mesh import | started |
 | M7 Assemblies, contact and friction | Needs M15. Part instances from SolidCraft occurrences; tie between non-matching meshes (mortar: done — `interaction.tie`, dual mortar constraints in the implicit analyses, Abaqus `*TIE` and LS-DYNA tied contact, the tie patch test); implicit contact: surface-to-surface mortar and node-to-surface, penalty and augmented Lagrange, self-contact, automatic pair detection (mortar contact pairs with Coulomb friction in nonlinear static steps: done — segment-to-segment mortar with the consistent tangent by automatic differentiation of the segmentation, augmented Lagrangian with Uzawa updates to a gap tolerance, semismooth active set with a chattering cutback, small sliding without nonlinear geometry and finite sliding with it, overclosure adjusted or refused, Coulomb friction (stick/slip return map, static and kinetic coefficients, symmetrised tangent), pressure, gap, status, shear and slip output; verified by the contact patch test, Hertz cylinder and sphere, Newton's quadratic rate and sliding blocks; the linear analyses refuse contact by name); friction: Coulomb with stick–slip, static/kinetic, anisotropic, pressure-, rate- and temperature-dependent coefficients; contact output (pressure, slip, status); thermal contact conductance and frictional heating; wear (Archard); bolt pretension, connectors with behaviour (elastic, damped, stops, locks); amplitudes, multiple steps, restart; nonlinear steps in all three decks. Verified by Hertz (sphere and cylinder), the Cattaneo–Mindlin partial-slip problem, the sliding block, NAFEMS contact benchmarks | started |
 | M8 Materials, explicit, shells, composites | Plasticity, hyperelasticity, damage data per solver; explicit dynamics decks (Abaqus/Explicit, LS-DYNA); midsurface shells; composite layups and material orientations, continuum shells on swept hex; hybrid (mixed u–p) hex8/hex20/tet10 for nearly incompressible materials (done); heat transfer (solids done: steady and θ-method transient conduction with flux, convection and sources, thermal strain in static steps (solids and 2D) and explicit dynamics (with plasticity), coupled temperature–displacement, `solve.heat`; deck output, 2D/shell/beam conduction planned) | started |
 | M9 Post-processing and deck readers | Results readers for public formats (Nastran OP2, LS-DYNA d3plot, Abaqus `.fil`); XY and path plots, cuts, display groups, free-body forces; deck readers that keep unknown keywords; mesh convergence studies | planned |
@@ -52,7 +52,44 @@ pressure) is a degree of freedom of the existing DOF framework, not a separate s
 | M23 Wave propagation and ultrasound | Elastic, acoustic and coupled waves from the explicit solver's 1D bar today to guided and ultrasonic waves, by two methods. Finite differences first, for fast 2D (then 3D) ultrasound on regular grids: staggered-grid velocity–stress FDTD (Virieux) and the elastodynamic finite integration technique for solids, the rotated staggered grid for anisotropic media, a k-space pseudospectral scheme for weakly heterogeneous tissue and water, all on grids voxelised from the face-tagged geometry by the LBM's exact voxeliser, with heterogeneous, layered and fluid–solid media, CPML boundaries, threads and the GPU backend; staircased curved boundaries scatter spuriously, so the FD grid is checked against the finite elements on curved parts. Finite elements for curved geometry and coupling with structures: spectral elements (high-order Gauss–Lobatto–Legendre hexes with diagonal mass) on the hex meshes, and a mesh check in elements per wavelength with the dispersion error it implies; absorbing boundaries (convolutional PML, absorbing layers with increasing damping) and infinite media; tone-burst sources (Hann-windowed cycles), point, line and surface excitation, and piezoelectric transducers (M19); anisotropic media (composites, crystals) and viscoelastic, power-law-in-frequency attenuation; fluid–solid interfaces and fluid-loaded plates; ultrasound in water and tissue, nonlinear acoustics (Westervelt, KZK) for focused ultrasound. Guided waves: dispersion curves by semi-analytical finite elements (SAFE) for plates, pipes, rails and layered and anisotropic laminates — Lamb, Rayleigh, Love and SH modes — with phase and group velocities and mode shapes; mode-selective excitation. Output: A-scans and B-scans at sensors, wavefield snapshots, 2D FFT (frequency–wavenumber) for mode identification, and time–frequency diagrams of any signal — short-time Fourier spectrograms, continuous wavelet transforms (Morlet), reassigned spectrograms and smoothed pseudo Wigner–Ville — with the SAFE or Rayleigh–Lamb group-velocity curves overlaid as arrival times, and group velocities extracted from the ridges. GPU paths (M12's backend) for long runs. Verified by Lamb's problem (point load on a half-space), Rayleigh-wave speed, Rayleigh–Lamb dispersion, Love waves in a layer over a half-space, reflection and transmission at interfaces, and published guided-wave measurements | planned |
 | Continuous: verification and validation | Every capability checked against theory (closed forms), experiments (published measurements) and published benchmarks (NAFEMS, vendor benchmark and verification manuals such as Abaqus's), each case our own model in `tests/oracle/` with its cited reference and tolerance; `cargo xtask oracle` runs them and writes docs/oracle.md; once a case matches, our result is frozen as a fixture so fidelity cannot regress (docs/verification.md). Runner, fixtures and CI job: done; 26 theory cases (patch tests of every solid element, cantilevers, Lamé in 3D, plane strain and axisymmetric, Kirsch in 3D and plane stress, rotating disc and cylinder, beam frequencies, couplings, explicit waves, impact and J2 plasticity, CDT invariants), 9 published benchmarks (MacNeal–Harder solid tests, Scordelis–Lo with solids, NAFEMS LE1 in 3D and 2D, LE10, FV32) and 9 pending cases with citations (shells, thermal, static plasticity, Taylor bar, CFD); `mesh.block` mapped blocks and 2D patches build their meshes | started |
 | Continuous: performance | CPU first, deterministic: results never depend on the thread count (fixed partitions, sums in a fixed order; checked by hashing results on 1, 2 and 7 threads). Supernodal left-looking Cholesky (11–15× faster than the column solver on one thread), parallel element matrices, stresses and Lanczos products, explicit element updates and LBM cell blocks on rayon threads (done — `fieldcraft-parallel`, `threads` on the solve commands, `FIELDCRAFT_THREADS`); parallel forward/back substitution and explicit tet4 assembly; GPU paths later, within a stated tolerance of the CPU | started |
-| Continuous: desktop and agents | Desktop app (viewport, model tree, commands, control channel, the open design drawn, `ui.capture` of the whole window offscreen: done; toolbar of every capability from the catalogue, ready or coming soon with its milestone, icons drawn with VectorCraft, docs/features.md: done; the Craft-family shell — title bar, workspaces and ribbon drop-downs, browser, context panel, command search, journal timeline, light and dark themes — native file pickers with background opening, drag and drop and recent files, samples and one-click Solve, and an examples gallery of ready-to-solve samples, each checked by a test (docs/examples.md): done; MCP server over stdio, headless or bridged to the app, with read and write roots, docs/mcp.md: done; caps labels in Inter SemiBold; the README's analysis video recorded through MCP by `tools/demo-video`: done; support, load, reference-point and coupling symbols in the viewport and headless renders, with their browser toggles: done; symbols as wireframes, one mark per constrained degree of freedom, a constant size on screen with a size setting, highlighted with their selected definition, concentrated loads drawn over the part: done; selection by picking in the viewport — geometry faces, edges, vertices and bodies, mesh nodes, element faces and elements, box selection, hover, a Target row in command forms, `ui.select`/`ui.selection` and MCP `select`: done; a camera parameter for screenshots, a ribbon that follows the command being run: in progress; the browser build — the same app in a web page with browser file pickers, downloads, drops and autosave to browser storage, deployed to GitHub Pages from each release, docs/web.md: done), command schema as the public API | started |
+| Continuous: desktop and agents | Desktop app (viewport, model tree, commands, control channel, the open design drawn, `ui.capture` of the whole window offscreen: done; toolbar of every capability from the catalogue, ready or coming soon with its milestone, icons drawn with VectorCraft, docs/features.md: done; the Craft-family shell — title bar, workspaces and ribbon drop-downs, browser, context panel, command search, journal timeline, light and dark themes — native file pickers with background opening, drag and drop and recent files, samples and one-click Solve, and an examples gallery of ready-to-solve samples, each checked by a test (docs/examples.md): done; MCP server over stdio, headless or bridged to the app, with read and write roots, docs/mcp.md: done; caps labels in Inter SemiBold; the README's analysis video recorded through MCP by `tools/demo-video`: done; support, load, reference-point and coupling symbols in the viewport and headless renders, with their browser toggles: done; symbols as wireframes, one mark per constrained degree of freedom, a constant size on screen with a size setting, highlighted with their selected definition, concentrated loads drawn over the part: done; selection by picking in the viewport — geometry faces, edges, vertices and bodies, mesh nodes, element faces and elements, box selection, hover, a Target row in command forms, `ui.select`/`ui.selection` and MCP `select`: done; a camera parameter for screenshots, a ribbon that follows the command being run: in progress; the browser build — the same app in a web page with browser file pickers, downloads, drops and autosave to browser storage, deployed to GitHub Pages from each release, docs/web.md: done; in-app updates — a daily check of GitHub Releases, Help › Check for Updates and Reinstall, downloads verified against the release key's signature of SHA256SUMS.txt and swapped in after closing, `app.update.check`, `fieldcraft-cli update`, Reload to update in the browser, docs/updates.md: done), command schema as the public API | started |
+
+## 0.6.0: the UI/UX release
+
+What landed for 0.6.0 (milestone 0.6.0 on GitHub):
+
+- **Browser:** status checks in one aligned column, Interactions counting ties, a selected set
+  highlighted in the viewport, seeds selectable, editable and deletable, definitions shown with
+  units instead of raw JSON, one highlighted item per context menu, given names shown as typed,
+  and a setup checklist that does not ask for a load on a displacement-driven model or for a
+  support or load on a free body in explicit dynamics (#315, #335, #336, #352, #356, #361, #366).
+- **Results:** units on every legend, summary, probe and reaction sum; legend ranges that can be
+  clamped; max and min markers in the viewport; an energies plot with axes and the current frame;
+  the deformed shape kept when the field changes; a sensible auto scale for large strains; setup
+  symbols off over contours; heat flow through each convection and flux load; probe and reaction
+  results exported to CSV (#92, #191, #319, #321, #325–#332, #362).
+- **Forms, progress and jobs:** solves and meshers run as jobs with their step, stage, count and
+  elapsed time and a Cancel that interrupts every solver and mesher; the control channel and MCP
+  wait for a long solve; mesher forms report what they made; typed fields for label lists, point
+  lists, multi-choices and number-or-auto, JSON fields with hints, defaults shown as set; forms
+  without orphan sets on Cancel; unknown parameters refused (#169, #316, #322–#324, #337, #339,
+  #340, #353, #357, #367, #371).
+- **Picking and preparation:** vertices pickable, selected edges visible over the mesh, a
+  reference point placed by a pick or a hole's centre, Seed Edges switching the filter to edges,
+  live previews and default names for datums and partitions, readable partition cell names, the
+  Partitioned Mesh form with picks and per-cell methods, a mesh marked out of date when its seeds
+  or partitions change, remeshing from the current mesh's settings (#338, #341–#349, #351).
+- **UI conveniences:** File › New (`file.new`), Help › Crash Reports, the I-beam sample, every
+  sample with a Start-card thumbnail and a gallery capture, node tools (merge, duplicates, free
+  edges, renumber), the mesh quality panel's histograms and worst elements, Mirror Mesh and Mesh
+  Block on the ribbon, Rigid Wall in Interactions, readable journal entries and status messages,
+  a sample's name on its document tab, the web build naming an unknown sample (#113, #143, #144,
+  #200, #234, #300, #333, #334, #348, #350, #354, #355, #359, #360, #365).
+- **Mesh soundness:** tet improvement that no longer crowds one vertex, hex20 extrudes that pass
+  the validity gate where hex8 does, biased seeds carried to the opposite edge of a mapped face,
+  designs with a closed internal void and face names over 256 characters meshed (#197, #257,
+  #311, #364, #374).
+- **Heat:** heat transfer across ties for bonded multi-body thermal models (#358).
 
 ## Next
 

SECURITY.md

@@ -3,7 +3,7 @@
 FieldCraft is young; only `main` and the latest release get fixes.
 
 Please **don't open a public issue** for a security problem. Report it privately through the
-repository's [Security tab](https://github.com/jyviko/fieldcraft/security/advisories/new) with
+repository's [Security tab](https://github.com/tangency-labs/fieldcraft/security/advisories/new) with
 what you found, how to reproduce it (a model, deck or script), the version and platform, and the
 impact you expect.
 

apps/fieldcraft-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fieldcraft-cli"
-description = "FieldCraft from the command line: list commands, run scripts, serve MCP"
+description = "FieldCraft from the command line: list commands, run scripts, draw snapshots, serve MCP"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,6 +10,13 @@ workspace = true
 
 [dependencies]
 fieldcraft-engine = { workspace = true }
+fieldcraft-gpu = { workspace = true }
+fieldcraft-render = { workspace = true }
 fieldcraft-io = { workspace = true }
 fieldcraft-mcp = { workspace = true }
+fieldcraft-update = { workspace = true }
 serde_json = { workspace = true }
+
+[dev-dependencies]
+png = { workspace = true }
+fieldcraft-update = { workspace = true, features = ["mock"] }

apps/fieldcraft-cli/src/crashes.rs

@@ -0,0 +1,80 @@
+//! `fieldcraft-cli crashes`: the crash reports the desktop app wrote on this computer
+//! (docs/crash-reports.md): list them, show one, replay one, delete them.
+
+use std::path::Path;
+
+use fieldcraft_engine::crash;
+use serde_json::json;
+
+pub const USAGE: &str = "usage: fieldcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]";
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let dir = crash::default_dir().ok_or("no crash folder on this system (set FIELDCRAFT_CRASH_DIR)")?;
+    let id = || args.get(1).map(String::as_str).ok_or_else(|| USAGE.to_string());
+    match args.first().map(String::as_str) {
+        None | Some("list") => {
+            let reports = crash::list(&dir);
+            if args.iter().any(|a| a == "--json") {
+                return print_json(&json!({ "dir": dir.to_string_lossy(), "reports": reports }));
+            }
+            println!("crash reports in {}", dir.display());
+            if reports.is_empty() {
+                println!("  (none)");
+            }
+            for r in reports {
+                let times = if r.count > 1 { format!(" ×{}", r.count) } else { String::new() };
+                let cmd = r.command.map(|c| format!(" in {c}")).unwrap_or_default();
+                let replay = if r.replayable { "  [replayable]" } else { "" };
+                println!("  {}  {}{times}{cmd}  v{}{replay}\n      {}", r.id, r.kind, r.version, r.message);
+            }
+            Ok(())
+        }
+        Some("show") => print_json(&crash::read(&dir, id()?)?),
+        Some("replay") => replay(&dir, id()?),
+        Some("dir") => {
+            println!("{}", dir.display());
+            Ok(())
+        }
+        Some("clear") => {
+            println!("deleted {} report(s)", crash::clear(&dir, args.get(1).map(String::as_str)));
+            Ok(())
+        }
+        _ => Err(USAGE.to_string()),
+    }
+}
+
+fn print_json(v: &serde_json::Value) -> Result<(), String> {
+    println!("{}", serde_json::to_string_pretty(v).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+/// Run a report's commands on its model and say whether the crash happens again. Files the
+/// commands write go to a scratch folder, never over the user's files.
+fn replay(dir: &Path, id: &str) -> Result<(), String> {
+    let report = crash::read(dir, id)?;
+    let scratch = std::env::temp_dir().join(format!("fieldcraft-replay-{}", std::process::id()));
+    std::fs::create_dir_all(&scratch).map_err(|e| format!("{}: {e}", scratch.display()))?;
+    if report["kind"] == "unclean_exit" {
+        println!("this crash ended the app without a report: if this process ends abruptly, it reproduced");
+    }
+    println!("replaying on {}", report["model_path"].as_str().unwrap_or("a new model"));
+    let r = crash::replay(&report, &scratch);
+    let _ = std::fs::remove_dir_all(&scratch);
+    let r = r?;
+    for (i, (cmd, outcome)) in r.steps.iter().enumerate() {
+        match outcome {
+            Ok(()) => println!("  {:>3}. {cmd}: ok", i + 1),
+            Err(e) => println!("  {:>3}. {cmd}: {e}", i + 1),
+        }
+    }
+    let said = |k: &str| report[k].as_str().unwrap_or_default().to_string();
+    if r.reproduced {
+        println!("reproduced: the same internal error ({}) at {}", said("message"), said("location"));
+    } else if let Some((l, m)) = r.panics.first() {
+        println!("an internal error happened, but not the reported one: {m} at {l}");
+        println!("(the report says: {} at {})", said("message"), said("location"));
+    } else {
+        println!("did not reproduce: no internal error (fixed, or it depends on something the replay does not have)");
+    }
+    Ok(())
+}

apps/fieldcraft-cli/src/main.rs

@@ -1,11 +1,18 @@
 //! fieldcraft-cli commands
 //! fieldcraft-cli run <script.json>
+//! fieldcraft-cli snapshot <script.json> --out shot.png [--view V | --camera JSON] [--size WxH] [--section x|y|z[=V]] [--field F]
 //! fieldcraft-cli features
 //! fieldcraft-cli mcp [--connect ADDR | --headless] [--automation-read-root DIR] [--automation-write-root DIR]
+//! fieldcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]
+//! fieldcraft-cli update --check | --install
 //! fieldcraft-cli --version
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+mod crashes;
+mod snapshot;
+mod update;
+
 use std::path::Path;
 use std::process::ExitCode;
 
@@ -18,6 +25,19 @@ usage:
   fieldcraft-cli commands --json       the same as JSON, each command's parameters as JSON Schema
   fieldcraft-cli run <script.json>     run a script (a JSON array of {\"command\", \"params\"})
                                        and print the model summary
+  fieldcraft-cli snapshot <script.json> --out FILE.png [--view V | --camera JSON]
+                      [--size WxH] [--section x|y|z[=VALUE]] [--field FIELD]
+                                       run a script and draw the model to a PNG with no
+                                       window: the viewport's GPU pipeline on a hardware or
+                                       software GPU, else the CPU rasterizer (FIELDCRAFT_GPU=
+                                       auto|hardware|software|cpu); V: iso (default), x, y, z,
+                                       front, back, left, right, top, bottom; size 1280x800;
+                                       --section hides the elements beyond a plane (at the
+                                       mesh's middle, or VALUE); --field contours a nodal
+                                       field of the solved step (results.contour);
+                                       --camera '{\"yaw\":30,\"pitch\":20,\"target\":...,
+                                       \"fit\":true,\"fov\":35}' aims as MCP screenshot's camera
+                                       (default target: the model's centre of mass)
   fieldcraft-cli features              print docs/features.md (every capability, ready or
                                        coming soon) from the capability catalogue
   fieldcraft-cli mcp [options]         serve the Model Context Protocol on stdin/stdout
@@ -28,6 +48,14 @@ usage:
       --automation-read-root DIR       files may be read only inside DIR
       --automation-write-root DIR      files may be written only inside DIR (with either root,
                                        the access a root left out is not granted)
+  fieldcraft-cli crashes [list|show <id>|replay <id>|dir|clear [<id>]]
+                                       the crash reports the desktop app wrote on this
+                                       computer (docs/crash-reports.md): list them (--json),
+                                       show one, replay one (does the crash happen again?),
+                                       print their folder, delete them
+  fieldcraft-cli update --check        is a newer FieldCraft published? (app.update.check; JSON)
+  fieldcraft-cli update --install      download the latest release, verify its signature and
+                                       checksum, and install it over this copy (docs/updates.md)
   fieldcraft-cli --version             print the version
 ";
 
@@ -52,6 +80,9 @@ fn main() -> ExitCode {
             Ok(())
         }
         Some("mcp") => mcp(args.get(1..).unwrap_or(&[])),
+        Some("crashes") => crashes::run(args.get(1..).unwrap_or(&[])),
+        Some("update") => update::run(args.get(1..).unwrap_or(&[])),
+        Some("snapshot") => snapshot::run(args.get(1..).unwrap_or(&[])),
         Some("run") => args.get(1).ok_or_else(|| format!("run needs a script\n\n{USAGE}")).and_then(|p| run(p)),
         Some("-V" | "--version") => {
             println!("fieldcraft-cli {}", env!("CARGO_PKG_VERSION"));
@@ -120,7 +151,14 @@ fn mcp(args: &[String]) -> Result<(), String> {
     server.serve(std::io::stdin().lock(), std::io::stdout().lock()).map_err(|e| format!("mcp: {e}"))
 }
 
-fn run(path: &str) -> Result<(), String> {
+/// The JSON report of a picture: what drew it and what it shows (the MCP `screenshot` reply's
+/// fields).
+pub fn picture_report(r: &fieldcraft_gpu::Renderer, shown: &fieldcraft_engine::view::Shown) -> serde_json::Value {
+    fieldcraft_mcp::picture_report(r, shown)
+}
+
+/// The session after running the script at `path`.
+fn session_of(path: &str) -> Result<Session, String> {
     let size = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?.len();
     if size > MAX_SCRIPT_BYTES {
         return Err(format!("{path}: larger than {} MB", MAX_SCRIPT_BYTES / (1024 * 1024)));
@@ -129,6 +167,11 @@ fn run(path: &str) -> Result<(), String> {
     let script: serde_json::Value = serde_json::from_str(&text).map_err(|e| format!("{path}: {e}"))?;
     let mut session = Session::default();
     session.run_script(&script).map_err(|e| e.to_string())?;
+    Ok(session)
+}
+
+fn run(path: &str) -> Result<(), String> {
+    let mut session = session_of(path)?;
     let info = session.execute("model.info", &json!({})).map_err(|e| e.to_string())?;
     println!("{}", serde_json::to_string_pretty(&info).map_err(|e| e.to_string())?);
     Ok(())

apps/fieldcraft-cli/src/snapshot.rs

@@ -0,0 +1,261 @@
+//! `fieldcraft-cli snapshot`: a script in, a PNG out, with no window and no display. The picture
+//! is the viewport's: the engine's scene ([`fieldcraft_engine::view::frame`]) drawn with the
+//! window's GPU pipelines ([`fieldcraft_gpu::capture`]) on a hardware GPU or a software one
+//! (lavapipe, llvmpipe, WARP), and by the CPU rasterizer as the last tier (`FIELDCRAFT_GPU`,
+//! [`fieldcraft_gpu::select`]).
+
+use fieldcraft_engine::view::{self, Aim, Palette, Section, Target};
+use fieldcraft_gpu::Renderer;
+use fieldcraft_gpu::capture::{self, Capturer};
+use fieldcraft_gpu::select::Policy;
+use fieldcraft_render::{Orientation, StandardView};
+
+/// The picture size when `--size` is not given.
+const DEFAULT_SIZE: (u32, u32) = (1280, 800);
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Options {
+    pub script: String,
+    pub out: String,
+    pub view: StandardView,
+    /// A camera aimed as the MCP `screenshot`'s (`--camera JSON`; not with `--view`).
+    pub camera: Option<Aim>,
+    pub size: (u32, u32),
+    /// A section through the mesh (`--section x|y|z[=VALUE]`).
+    pub section: Option<Section>,
+    /// A nodal field contoured on the last solved step (`--field von_mises`).
+    pub field: Option<String>,
+}
+
+/// A view name: a standard view, or the axis looked along (`x`: from the right, `y`: from the
+/// front, `z`: from the top).
+fn view_of(s: &str) -> Option<StandardView> {
+    match s.to_ascii_lowercase().as_str() {
+        "x" => Some(StandardView::Right),
+        "y" => Some(StandardView::Front),
+        "z" => Some(StandardView::Top),
+        other => StandardView::parse(other),
+    }
+}
+
+/// `WxH`, each side 1..=the renderer's limit.
+fn size_of(s: &str) -> Option<(u32, u32)> {
+    let (w, h) = s.split_once(['x', 'X'])?;
+    let (w, h) = (w.trim().parse::<u32>().ok()?, h.trim().parse::<u32>().ok()?);
+    let max = fieldcraft_gpu::capture::MAX_SIDE;
+    ((1..=max).contains(&w) && (1..=max).contains(&h) && u64::from(w) * u64::from(h) <= fieldcraft_gpu::capture::MAX_PIXELS).then_some((w, h))
+}
+
+/// The options: the script, then each flag once, as `--flag value` or `--flag=value`.
+pub fn options(args: &[String]) -> Result<Options, String> {
+    let (mut script, mut out, mut view, mut size, mut section, mut field, mut camera) = (None, None, None, None, None, None, None);
+    let mut it = args.iter();
+    while let Some(arg) = it.next() {
+        if !arg.starts_with("--") {
+            if script.replace(arg.clone()).is_some() {
+                return Err(format!("snapshot takes one script, not `{arg}` too"));
+            }
+            continue;
+        }
+        let (flag, inline) = match arg.split_once('=') {
+            Some((f, v)) => (f, Some(v.to_string())),
+            None => (arg.as_str(), None),
+        };
+        let value = inline.or_else(|| it.next().cloned()).filter(|v| !v.is_empty()).ok_or_else(|| format!("{flag} needs a value"))?;
+        let twice = match flag {
+            "--out" => out.replace(value).is_some(),
+            "--view" => view
+                .replace(
+                    view_of(&value).ok_or_else(|| format!("--view: unknown view `{value}` (iso, x, y, z, front, back, left, right, top, bottom)"))?,
+                )
+                .is_some(),
+            "--size" => size
+                .replace(size_of(&value).ok_or_else(|| {
+                    format!(
+                        "--size: `{value}` is not WxH with each side 1..={} and at most {} pixels",
+                        fieldcraft_gpu::capture::MAX_SIDE,
+                        fieldcraft_gpu::capture::MAX_PIXELS
+                    )
+                })?)
+                .is_some(),
+            "--section" => section
+                .replace(Section::parse(&value).ok_or_else(|| format!("--section: `{value}` is not x, y, z or AXIS=VALUE (x=12.5)"))?)
+                .is_some(),
+            "--field" => field.replace(value).is_some(),
+            "--camera" => {
+                let v: serde_json::Value = serde_json::from_str(&value).map_err(|e| format!("--camera: not JSON: {e}"))?;
+                camera.replace(view::camera(&v).map_err(|e| format!("--camera: {e}"))?).is_some()
+            }
+            other => return Err(format!("snapshot: unknown option `{other}`")),
+        };
+        if twice {
+            return Err(format!("{flag} is given twice"));
+        }
+    }
+    if view.is_some() && camera.is_some() {
+        return Err("give --view or --camera, not both".into());
+    }
+    Ok(Options {
+        script: script.ok_or("snapshot needs a script")?,
+        out: out.ok_or("snapshot needs --out FILE.png")?,
+        view: view.unwrap_or(StandardView::Iso),
+        camera,
+        size: size.unwrap_or(DEFAULT_SIZE),
+        section,
+        field,
+    })
+}
+
+/// The PNG of the session `o` describes, drawn as `policy` says ([`capture::png`]).
+pub fn picture(o: &Options, policy: Policy) -> Result<(Vec<u8>, Renderer, view::Shown), String> {
+    let mut session = crate::session_of(&o.script)?;
+    if let Some(field) = &o.field {
+        session.execute("results.contour", &serde_json::json!({"field": field})).map_err(|e| format!("--field: {e}"))?;
+    }
+    let (w, h) = o.size;
+    let f = match &o.camera {
+        Some(aim) => view::frame_at(&session, aim, w as usize, h as usize, &Palette::LIGHT, o.section).map_err(|e| e.to_string())?,
+        None => view::frame(&session, &Orientation::of(o.view), w as usize, h as usize, &Palette::LIGHT, o.section),
+    };
+    let capturer = Capturer::open(policy);
+    let (png, renderer) = capture::png(&capturer, policy, &f.scene, &[&f.symbols], &f.cam, w, h).map_err(|e| e.to_string())?;
+    Ok((png, renderer, f.shown))
+}
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    let o = options(args)?;
+    let policy = Policy::from_env().map_err(|e| e.to_string())?;
+    let (png, renderer, shown) = picture(&o, policy)?;
+    std::fs::write(&o.out, &png).map_err(|e| format!("{}: {e}", o.out))?;
+    let mut report = crate::picture_report(&renderer, &shown);
+    if let Some(r) = report.as_object_mut() {
+        r.insert("out".into(), o.out.clone().into());
+        r.insert("width".into(), o.size.0.into());
+        r.insert("height".into(), o.size.1.into());
+        match &o.camera {
+            Some(aim) => r.insert("camera".into(), Aim { target: Some(aim.target.clone().unwrap_or(Target::MODEL)), ..aim.clone() }.json()),
+            None => r.insert("view".into(), o.view.label().into()),
+        };
+    }
+    println!("{report}");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn opts(args: &[&str]) -> Result<Options, String> {
+        options(&args.iter().map(|s| s.to_string()).collect::<Vec<_>>())
+    }
+
+    #[test]
+    fn options_are_checked() {
+        let o = opts(&["s.json", "--out", "a.png"]).unwrap();
+        assert_eq!(
+            o,
+            Options {
+                script: "s.json".into(),
+                out: "a.png".into(),
+                view: StandardView::Iso,
+                camera: None,
+                size: DEFAULT_SIZE,
+                section: None,
+                field: None
+            }
+        );
+        let o = opts(&["s", "--out", "o", "--section", "y=2.5", "--field", "displacement"]).unwrap();
+        assert_eq!((o.section, o.field.as_deref()), (Some(Section { axis: 1, at: Some(2.5) }), Some("displacement")));
+        assert_eq!(opts(&["s", "--out", "o", "--section=Z"]).unwrap().section, Some(Section { axis: 2, at: None }));
+        let o = opts(&["--view=z", "s.json", "--size", "640x480", "--out=b.png"]).unwrap();
+        assert_eq!((o.view, o.size), (StandardView::Top, (640, 480)));
+        assert_eq!(opts(&["s", "--out", "o", "--view", "X"]).unwrap().view, StandardView::Right);
+        assert_eq!(opts(&["s", "--out", "o", "--view", "front"]).unwrap().view, StandardView::Front);
+        let o = opts(&["s", "--out", "o", "--camera", r#"{"yaw": 30, "pitch": 10, "target": [1, 2, 3], "fit": true}"#]).unwrap();
+        assert_eq!(o.camera.and_then(|a| a.target), Some(Target::Point(fieldcraft_render::Vec3::new(1.0, 2.0, 3.0))));
+        for bad in [
+            vec![],
+            vec!["s.json"],
+            vec!["--out", "a.png"],
+            vec!["s", "t", "--out", "o"],
+            vec!["s", "--out"],
+            vec!["s", "--out", "o", "--out", "p"],
+            vec!["s", "--out", "o", "--view", "diagonal"],
+            vec!["s", "--out", "o", "--size", "0x10"],
+            vec!["s", "--out", "o", "--size", "10"],
+            vec!["s", "--out", "o", "--size", "99999x10"],
+            vec!["s", "--out", "o", "--size", "8192x8192"],
+            vec!["s", "--out", "o", "--size", "-5x10"],
+            vec!["s", "--out", "o", "--nope", "1"],
+            vec!["s", "--out", "o", "--section", "w"],
+            vec!["s", "--out", "o", "--section", "x=inf"],
+            vec!["s", "--out", "o", "--section", "x=", "--field", "f"],
+            vec!["s", "--out", "o", "--camera", "{yaw: 1}"],
+            vec!["s", "--out", "o", "--camera", r#"{"yaw": 0}"#],
+            vec!["s", "--out", "o", "--camera", r#"{"yaw": 0, "pitch": 0}"#, "--view", "x"],
+        ] {
+            assert!(opts(&bad).is_err(), "{bad:?}");
+        }
+    }
+
+    /// PNG width, height and pixels (RGBA).
+    fn decode(png: &[u8]) -> (u32, u32, Vec<u8>) {
+        let mut r = png::Decoder::new(std::io::Cursor::new(png)).read_info().unwrap();
+        let mut buf = vec![0; r.output_buffer_size().unwrap()];
+        let info = r.next_frame(&mut buf).unwrap();
+        buf.truncate(info.buffer_size());
+        (info.width, info.height, buf)
+    }
+
+    fn script(dir: &std::path::Path, name: &str, solve: bool) -> String {
+        let mut steps = fieldcraft_engine::sample::cantilever();
+        if solve && let Some(a) = steps.as_array_mut() {
+            a.push(serde_json::json!({"command": "solve.static", "params": {}}));
+        }
+        let path = dir.join(name);
+        std::fs::write(&path, steps.to_string()).unwrap();
+        path.to_string_lossy().into()
+    }
+
+    fn opts_for(script: String) -> Options {
+        Options { script, out: String::new(), view: StandardView::Iso, camera: None, size: (320, 200), section: None, field: None }
+    }
+
+    /// The cantilever drawn headless: a PNG of the size asked for, with the model in it (pixels
+    /// of the hex colour) and its element edges (dark pixels). `auto` draws on the GPU when the
+    /// machine has one and on the CPU otherwise (it must be the GPU under `FIELDCRAFT_REQUIRE_GPU=1`); `cpu` always
+    /// on the CPU, and both pictures show the same model. A section and a field change it.
+    #[test]
+    fn snapshots_the_model_and_its_mesh_headless() {
+        let dir = std::env::temp_dir().join(format!("fieldcraft-snapshot-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let o = opts_for(script(&dir, "cantilever.json", false));
+        for policy in [Policy::Auto, Policy::Cpu] {
+            let (png, drawn, _) = picture(&o, policy).unwrap();
+            let (w, h, px) = decode(&png);
+            assert_eq!((w, h), (320, 200), "{drawn:?}");
+            let hex = Palette::LIGHT.hex;
+            let near = |p: &[u8], c: fieldcraft_render::Rgb, d: u8| p[0].abs_diff(c.0) <= d && p[1].abs_diff(c.1) <= d && p[2].abs_diff(c.2) <= d;
+            // Shaded faces vary in brightness around the hex colour; the edges are near black.
+            let faces = px.chunks(4).filter(|p| near(p, hex, 60) && p[2] > p[0]).count();
+            let edges = px.chunks(4).filter(|p| p[0] < 90 && p[1] < 90 && p[2] < 90).count();
+            assert!(faces > 500, "{drawn:?}: {faces} face pixels");
+            assert!(edges > 100, "{drawn:?}: {edges} edge pixels");
+            if policy == Policy::Cpu {
+                assert_eq!(drawn, Renderer::Cpu { why: None });
+            } else if fieldcraft_gpu::select::gpu_required() {
+                assert!(matches!(drawn, Renderer::Gpu { .. }), "FIELDCRAFT_REQUIRE_GPU=1 but drawn by {drawn:?}");
+            }
+        }
+        // A section along the beam draws half of it.
+        let whole = picture(&o, Policy::Cpu).unwrap().0;
+        let cut = picture(&Options { section: Some(Section { axis: 0, at: None }), ..o.clone() }, Policy::Cpu).unwrap().0;
+        assert_ne!(whole, cut);
+        // A field needs a solved step; on a solved one it is the contour reported.
+        assert!(picture(&Options { field: Some("von_mises".into()), ..o.clone() }, Policy::Cpu).is_err());
+        let solved = Options { field: Some("displacement".into()), ..opts_for(script(&dir, "solved.json", true)) };
+        let (_, _, shown) = picture(&solved, Policy::Auto).unwrap();
+        assert_eq!(shown.contour.map(|c| c.0).as_deref(), Some("displacement"));
+        std::fs::remove_dir_all(&dir).ok();
+    }
+}

apps/fieldcraft-cli/src/update.rs

@@ -0,0 +1,56 @@
+//! `fieldcraft-cli update --check | --install` (docs/updates.md): the same check as the app's
+//! Help › Check for Updates (`app.update.check`), and installing the latest release over this
+//! copy of the CLI's install, verified against the release key first. `FIELDCRAFT_UPDATE_HOST`
+//! points both at a local test server.
+
+use fieldcraft_engine::Session;
+use fieldcraft_update::install::{self, Finish};
+use fieldcraft_update::net::Client;
+use fieldcraft_update::stage::{self, Options};
+use serde_json::json;
+
+pub const USAGE: &str = "usage: fieldcraft-cli update --check | --install";
+
+pub fn run(args: &[String]) -> Result<(), String> {
+    match args.iter().map(String::as_str).collect::<Vec<_>>().as_slice() {
+        ["--check"] => check(),
+        ["--install"] => install(),
+        _ => Err(USAGE.into()),
+    }
+}
+
+fn check() -> Result<(), String> {
+    fieldcraft_engine::enable_update_checks(true);
+    let report = Session::default().execute("app.update.check", &json!({})).map_err(|e| e.to_string())?;
+    println!("{}", serde_json::to_string_pretty(&report).map_err(|e| e.to_string())?);
+    Ok(())
+}
+
+fn install() -> Result<(), String> {
+    let client = Client::from_env();
+    let check = client.check().map_err(|e| e.to_string())?;
+    if !check.newer() {
+        println!("FieldCraft {} is up to date (the latest release is {}).", check.current, check.latest.version);
+        return Ok(());
+    }
+    let here = install::here();
+    let downloads = fieldcraft_io::recovery::data_dir().map(|d| d.join("updates")).unwrap_or_else(|| std::env::temp_dir().join("fieldcraft-updates"));
+    eprintln!("Downloading FieldCraft {} for {}…", check.latest.version, here.describe());
+    let progress = |done: u64, total: u64| {
+        if total > 0 && done == total {
+            eprintln!("Downloaded {} MB; verifying…", total / (1024 * 1024));
+        }
+    };
+    let options = Options { key: fieldcraft_update::PUBLIC_KEY, downloads: &downloads, arch: std::env::consts::ARCH, progress: &progress };
+    let staged = stage::stage(&client, &check.latest, &here, &options).map_err(|e| e.to_string())?;
+    match install::plan(&staged, false).map_err(|e| e.to_string())? {
+        Finish::Swap(plan) => {
+            stage::apply(&plan).map_err(|e| e.to_string())?;
+            println!("Installed FieldCraft {} ({}). A running FieldCraft app uses it from its next start.", staged.version, here.describe());
+        }
+        Finish::Package { file, command } => {
+            println!("Downloaded and verified {}.\nInstall it with the system's package manager:\n  {command}", file.display());
+        }
+    }
+    Ok(())
+}

apps/fieldcraft-cli/tests/crashes.rs

@@ -0,0 +1,75 @@
+//! `fieldcraft-cli crashes` on a crash folder of its own (`FIELDCRAFT_CRASH_DIR`).
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use fieldcraft_engine::Session;
+use serde_json::{Value, json};
+
+const ID: &str = "20261014-101500-00000000deadbeef";
+
+/// A replayable report: a model with two nodes and a replay that adds a third.
+fn folder() -> PathBuf {
+    let d = std::env::temp_dir().join(format!("fieldcraft-cli-crashes-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    let r = d.join(ID);
+    std::fs::create_dir_all(&r).unwrap();
+    let mut s = Session::default();
+    for l in 1..=2 {
+        s.execute("mesh.node.add", &json!({"label": l, "xyz": [l, 0, 0]})).unwrap();
+    }
+    std::fs::write(r.join("model.fieldcraft"), s.file_bytes(None).unwrap()).unwrap();
+    let replay = json!({"commands": [
+        {"command": "mesh.node.add", "params": {"label": 3, "xyz": [3, 0, 0]}},
+        {"command": "file.save", "params": {"path": d.join("overwritten.fieldcraft")}},
+    ]});
+    std::fs::write(r.join("replay.json"), replay.to_string()).unwrap();
+    let report = json!({
+        "format": "fieldcraft-crash/1", "id": ID, "kind": "unclean_exit", "signature": "00000000deadbeef", "count": 2,
+        "first_seen": "2026-10-14T10:15:00Z", "message": "FieldCraft ended without a clean exit while running `mesh.node.add`",
+        "location": "unclean exit in mesh.node.add", "command": {"command": "mesh.node.add", "params": {}},
+        "app": {"version": "9.9.9"}, "backtrace": [],
+    });
+    std::fs::write(r.join("report.json"), report.to_string()).unwrap();
+    d
+}
+
+fn cli(dir: &Path, args: &[&str]) -> (String, bool) {
+    let out = Command::new(env!("CARGO_BIN_EXE_fieldcraft-cli")).args(args).env("FIELDCRAFT_CRASH_DIR", dir).output().unwrap();
+    (format!("{}{}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr)), out.status.success())
+}
+
+#[test]
+fn crashes_list_show_replay_and_clear() {
+    let d = folder();
+    let (out, ok) = cli(&d, &["crashes"]);
+    assert!(ok, "{out}");
+    assert!(out.contains(ID) && out.contains("unclean_exit ×2 in mesh.node.add") && out.contains("[replayable]"), "{out}");
+    let (out, ok) = cli(&d, &["crashes", "list", "--json"]);
+    assert!(ok);
+    let v: Value = serde_json::from_str(&out).unwrap();
+    assert_eq!(v["reports"][0]["id"], ID);
+    let (out, ok) = cli(&d, &["crashes", "show", ID]);
+    assert!(ok);
+    let v: Value = serde_json::from_str(&out).unwrap();
+    assert!(v["model_path"].as_str().unwrap().ends_with("model.fieldcraft"));
+    let (out, ok) = cli(&d, &["crashes", "replay", ID]);
+    assert!(ok, "{out}");
+    assert!(out.contains("1. mesh.node.add: ok"), "{out}");
+    // A command that writes a file is refused outside the scratch folder: the replay never
+    // writes over the user's files.
+    assert!(out.contains("2. file.save: ") && out.contains("outside the write root"), "{out}");
+    assert!(!d.join("overwritten.fieldcraft").exists());
+    assert!(out.contains("did not reproduce"), "{out}");
+    let (out, ok) = cli(&d, &["crashes", "show", "../etc"]);
+    assert!(!ok && out.contains("no crash report"), "{out}");
+    let (out, ok) = cli(&d, &["crashes", "dir"]);
+    assert!(ok && out.trim() == d.to_string_lossy(), "{out}");
+    let (out, ok) = cli(&d, &["crashes", "clear"]);
+    assert!(ok && out.contains("deleted 1 report(s)"), "{out}");
+    let (out, _) = cli(&d, &["crashes"]);
+    assert!(out.contains("(none)"), "{out}");
+    let (out, ok) = cli(&d, &["crashes", "nope"]);
+    assert!(!ok && out.contains("usage"), "{out}");
+    let _ = std::fs::remove_dir_all(&d);
+}

apps/fieldcraft-cli/tests/update.rs

@@ -0,0 +1,39 @@
+//! `fieldcraft-cli update --check` against a local release server (FIELDCRAFT_UPDATE_HOST).
+
+use std::process::Command;
+
+use fieldcraft_update::mock::Server;
+use serde_json::{Value, json};
+
+fn cli(host: &str, args: &[&str]) -> std::process::Output {
+    Command::new(env!("CARGO_BIN_EXE_fieldcraft-cli")).args(args).env("FIELDCRAFT_UPDATE_HOST", host).output().unwrap()
+}
+
+#[test]
+fn update_check_reports_the_latest_release() {
+    let server = Server::start().unwrap();
+    server.release(
+        "latest",
+        &json!({"tag_name": "v99.0.0", "html_url": "https://github.com/tangency-labs/fieldcraft/releases/tag/v99.0.0", "assets": []}),
+    );
+    let out = cli(&server.url(), &["update", "--check"]);
+    assert!(out.status.success(), "{out:?}");
+    let report: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(report["current"], env!("CARGO_PKG_VERSION"));
+    assert_eq!((report["latest"].as_str(), report["newer"].as_bool(), report["signed"].as_bool()), (Some("99.0.0"), Some(true), Some(false)));
+    // A test build is not a release package: it checks but would not install.
+    assert_eq!(report["asset"], Value::Null);
+    assert_eq!(server.requests(), 1);
+
+    // The same version: not newer, and --install has nothing to do.
+    server.release("latest", &json!({"tag_name": format!("v{}", env!("CARGO_PKG_VERSION")), "assets": []}));
+    let out = cli(&server.url(), &["update", "--check"]);
+    assert_eq!(serde_json::from_slice::<Value>(&out.stdout).unwrap()["newer"], false);
+    let out = cli(&server.url(), &["update", "--install"]);
+    assert!(out.status.success() && String::from_utf8_lossy(&out.stdout).contains("is up to date"), "{out:?}");
+
+    // Unreachable: an error, not a crash.
+    let out = cli("http://127.0.0.1:1", &["update", "--check"]);
+    assert!(!out.status.success() && String::from_utf8_lossy(&out.stderr).contains("could not reach"), "{out:?}");
+    assert!(!cli(&server.url(), &["update"]).status.success());
+}

apps/fieldcraft-web/Cargo.toml

@@ -29,6 +29,6 @@ rfd = { workspace = true, features = ["file-handle-inner"] }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "DomTokenList", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "DomTokenList", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "Storage", "Crypto", "Headers", "Request", "RequestInit", "RequestCache", "Response"] }
 # Autosaves kept in the browser's local storage, which holds text.
-base64 = "0.22"
+base64 = "0.23"

apps/fieldcraft-web/index.html

@@ -9,15 +9,15 @@
   <meta property="og:site_name" content="FieldCraft">
   <meta property="og:title" content="FieldCraft">
   <meta property="og:description" content="Open-source CAE built in Rust: structures, heat, fluids, and MCP for AI agents.">
-  <meta property="og:url" content="https://jyviko.github.io/fieldcraft/">
-  <meta property="og:image" content="https://jyviko.github.io/fieldcraft/og.png">
+  <meta property="og:url" content="https://tangency-labs.github.io/fieldcraft/">
+  <meta property="og:image" content="https://tangency-labs.github.io/fieldcraft/og.png">
   <meta property="og:image:width" content="1280">
   <meta property="og:image:height" content="640">
   <meta property="og:image:alt" content="FieldCraft: Open-source CAE built in Rust">
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:title" content="FieldCraft">
   <meta name="twitter:description" content="Open-source CAE built in Rust: structures, heat, fluids, and MCP for AI agents.">
-  <meta name="twitter:image" content="https://jyviko.github.io/fieldcraft/og.png">
+  <meta name="twitter:image" content="https://tangency-labs.github.io/fieldcraft/og.png">
   <link data-trunk rel="rust" data-bin="fieldcraft-web" data-wasm-opt="z" data-weak-refs />
   <link data-trunk rel="icon" type="image/svg+xml" href="../../assets/app-icon/icon-small.svg" />
   <link data-trunk rel="copy-file" href="../../assets/app-icon/icon.iconset/icon_128x128@2x.png" data-target-path="icons" />

apps/fieldcraft-web/src/deploy.rs

@@ -0,0 +1,75 @@
+//! A new deployment of the web app: every half hour the page's own address is fetched past the browser's cache, and when it loads another build
+//! of the app than the one running (Trunk names each build's files by their content hash), the
+//! status bar offers "Reload to update" (docs/updates.md). Reloading asks first when the model
+//! has unsaved changes, as closing the page does.
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+use wasm_bindgen::JsCast as _;
+
+/// How often the page looks for a new deployment (seconds).
+pub const INTERVAL: f64 = 30.0 * 60.0;
+
+/// Watches for a new deployment.
+pub struct Watch {
+    /// The build this page runs.
+    running: Option<String>,
+    /// A fetch found another build.
+    found: Rc<Cell<bool>>,
+    /// App time of the last look.
+    pub looked_at: f64,
+}
+
+impl Watch {
+    pub fn start() -> Watch {
+        let html = web_sys::window().and_then(|w| w.document()).and_then(|d| d.document_element()).map(|e| e.outer_html()).unwrap_or_default();
+        let running = crate::build_in_page(&html).map(str::to_string);
+        if running.is_none() {
+            log::info!("deploy: no hashed build in the page (a development server?); not watching");
+        }
+        Watch { running, found: Rc::default(), looked_at: 0.0 }
+    }
+
+    /// Whether a newer deployment was found.
+    pub fn found(&self) -> bool {
+        self.found.get()
+    }
+
+    /// Fetch the page again and compare its build with the running one.
+    pub fn look(&self) {
+        let (Some(running), Some(window)) = (self.running.clone(), web_sys::window()) else { return };
+        if self.found.get() {
+            return;
+        }
+        let url = window.location().pathname().unwrap_or_else(|_| "./".into());
+        let init = web_sys::RequestInit::new();
+        init.set_cache(web_sys::RequestCache::NoStore);
+        let promise = window.fetch_with_str_and_init(&url, &init);
+        let found = self.found.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            let text = async {
+                let response: web_sys::Response = wasm_bindgen_futures::JsFuture::from(promise).await.ok()?.dyn_into().ok()?;
+                if !response.ok() {
+                    return None;
+                }
+                wasm_bindgen_futures::JsFuture::from(response.text().ok()?).await.ok()?.as_string()
+            };
+            // Offline or refused: look again next time.
+            if let Some(html) = text.await
+                && let Some(deployed) = crate::build_in_page(&html)
+                && deployed != running
+            {
+                log::info!("deploy: {deployed} is deployed (running {running})");
+                found.set(true);
+            }
+        });
+    }
+}
+
+/// Reload the page (the new deployment loads).
+pub fn reload() {
+    if let Some(w) = web_sys::window() {
+        let _ = w.location().reload();
+    }
+}

apps/fieldcraft-web/src/main.rs

@@ -8,7 +8,8 @@
 //! - files live in the page ([`fieldcraft_io::fs`] keeps them in memory): File › Open and drops
 //!   read the computer's files into it; Save, Save As and Write Deck hand the written file out as
 //!   a download;
-//! - autosaves for recovery are kept in the browser's local storage ([`storage`]);
+//! - autosaves for recovery and the preferences are kept in the browser's local storage
+//!   ([`storage`], [`usage`]), and anonymous usage (when agreed) goes out with `fetch`;
 //! - no control channel (a page can't listen on a socket);
 //! - background jobs (meshing, solving) run on the page's one thread once the window has shown
 //!   that they run.
@@ -17,9 +18,13 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+#[cfg(target_arch = "wasm32")]
+mod deploy;
 #[cfg(target_arch = "wasm32")]
 mod storage;
 #[cfg(target_arch = "wasm32")]
+mod usage;
+#[cfg(target_arch = "wasm32")]
 mod web;
 
 #[cfg(target_arch = "wasm32")]
@@ -42,6 +47,25 @@ fn sample_in_query(query: &str) -> Option<String> {
     })
 }
 
+/// The build of the app a page loads: the content-hashed name Trunk gives its WebAssembly
+/// (`fieldcraft-web-<hash>_bg.wasm`). A new deployment loads another one.
+#[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+fn build_in_page(html: &str) -> Option<&str> {
+    const HEAD: &str = "fieldcraft-web-";
+    const TAIL: &str = "_bg.wasm";
+    let mut rest = html;
+    while let Some(at) = rest.find(HEAD) {
+        let candidate = rest.get(at..)?;
+        let hash = candidate.get(HEAD.len()..)?;
+        let len = hash.bytes().take_while(u8::is_ascii_alphanumeric).count();
+        if len > 0 && hash.get(len..)?.starts_with(TAIL) {
+            return candidate.get(..HEAD.len() + len + TAIL.len());
+        }
+        rest = candidate.get(HEAD.len()..)?;
+    }
+    None
+}
+
 /// The name a file from the computer is kept under in the page: its last path part, without
 /// characters a path would read as folders.
 #[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
@@ -64,6 +88,18 @@ mod tests {
         assert_eq!(sample_in_query("?samples=x"), None);
     }
 
+    #[test]
+    fn the_running_build_is_found_in_the_page() {
+        let page = r#"<link rel="modulepreload" href="/fieldcraft/fieldcraft-web-1a2b3c.js"><link rel="preload" href="/fieldcraft/fieldcraft-web-1a2b3c_bg.wasm" as="fetch">"#;
+        assert_eq!(build_in_page(page), Some("fieldcraft-web-1a2b3c_bg.wasm"));
+        let next = page.replace("1a2b3c", "9f8e7d");
+        assert_ne!(build_in_page(page), build_in_page(&next));
+        // A development page (no hash) and other text: nothing to compare.
+        assert_eq!(build_in_page(r#"<script src="fieldcraft-web.js"></script>"#), None);
+        assert_eq!(build_in_page("fieldcraft-web-"), None);
+        assert_eq!(build_in_page(""), None);
+    }
+
     #[test]
     fn file_names_stay_in_their_folder() {
         assert_eq!(safe_name("beam.fieldcraft"), "beam.fieldcraft");

apps/fieldcraft-web/src/usage.rs

@@ -0,0 +1,86 @@
+//! Anonymous usage in the browser (docs/privacy.md): the same events and the same consent as the
+//! desktop app, the choice kept in the browser's local storage with the other preferences. Queued
+//! events are posted with `fetch` every half minute and when the page is closed or left (`keepalive`, so
+//! a closing page still sends them); a failed post is dropped silently.
+//!
+//! The project key is a build setting, `FIELDCRAFT_POSTHOG_KEY`: a build without one asks nothing
+//! and sends nothing.
+
+use fieldcraft_engine::usage;
+use fieldcraft_ui_egui::files::PrefsStore;
+use fieldcraft_ui_egui::privacy::UsageHost;
+use wasm_bindgen::JsCast as _;
+
+const KEY: Option<&str> = option_env!("FIELDCRAFT_POSTHOG_KEY");
+/// Where the preferences are kept in local storage.
+const PREFS_KEY: &str = "fieldcraft-prefs";
+/// How often queued events are sent (seconds).
+pub const INTERVAL: f64 = 30.0;
+
+fn key() -> Option<&'static str> {
+    KEY.map(str::trim).filter(|k| !k.is_empty())
+}
+
+fn local_storage() -> Option<web_sys::Storage> {
+    web_sys::window()?.local_storage().ok().flatten()
+}
+
+/// The preferences in local storage (navigation, privacy).
+pub fn prefs_store() -> PrefsStore {
+    PrefsStore {
+        load: Box::new(|| local_storage()?.get_item(PREFS_KEY).ok().flatten().map(String::into_bytes)),
+        save: Box::new(|bytes| {
+            let text = std::str::from_utf8(bytes).map_err(|e| e.to_string())?;
+            local_storage().ok_or("browser storage is turned off")?.set_item(PREFS_KEY, text).map_err(crate::web::js_err)
+        }),
+    }
+}
+
+/// What the window needs to ask and record, when the build has a key.
+pub fn host() -> Option<UsageHost> {
+    // The browser's clock for command durations (the plain wasm target has none).
+    usage::set_clock(js_sys::Date::now);
+    key().is_some().then(|| UsageHost {
+        platform: "web",
+        os: "web",
+        arch: "wasm32",
+        new_id: Box::new(|| web_sys::window()?.crypto().ok().map(|c| c.random_uuid())),
+    })
+}
+
+/// Post what is queued.
+pub fn send() {
+    let (Some(key), Some(window)) = (key(), web_sys::window()) else { return };
+    let url = format!("{}/batch/", usage::DEFAULT_HOST);
+    while let Some(batch) = usage::take_batch() {
+        let init = web_sys::RequestInit::new();
+        init.set_method("POST");
+        init.set_body(&wasm_bindgen::JsValue::from_str(&batch.body(key)));
+        // The Fetch standard's `keepalive` (a closing page still sends it); web-sys has no setter.
+        let _ = js_sys::Reflect::set(&init, &"keepalive".into(), &true.into());
+        let headers = web_sys::Headers::new().ok();
+        if let Some(h) = &headers {
+            let _ = h.set("Content-Type", "application/json");
+            init.set_headers(h);
+        }
+        let promise = window.fetch_with_str_and_init(&url, &init);
+        wasm_bindgen_futures::spawn_local(async move {
+            // Offline or refused: the batch is dropped.
+            if let Err(e) = wasm_bindgen_futures::JsFuture::from(promise).await {
+                log::debug!("usage: not sent: {}", crate::web::js_err(e));
+            }
+        });
+    }
+}
+
+/// When the page is closed or left: the session's length, then send.
+pub fn send_when_hidden(window: &web_sys::Window) {
+    let on_hide = wasm_bindgen::closure::Closure::<dyn FnMut()>::new(|| {
+        usage::closing();
+        send();
+    });
+    if let Err(e) = window.add_event_listener_with_callback("pagehide", on_hide.as_ref().unchecked_ref()) {
+        log::warn!("usage: {}", crate::web::js_err(e));
+    }
+    on_hide.forget();
+}

apps/fieldcraft-web/src/web.rs

@@ -74,6 +74,7 @@ pub fn start() {
     fieldcraft_io::recovery::set_clock(|| js_sys::Date::now().max(0.0) as u64);
     let Some(window) = web_sys::window() else { return };
     ask_before_unload(&window);
+    crate::usage::send_when_hidden(&window);
     let Some(canvas) = element(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
         log::error!("missing <canvas id=\"{CANVAS_ID}\">");
         return;
@@ -86,6 +87,10 @@ pub fn start() {
                 Box::new(|cc| {
                     let inbox = Inbox::default();
                     let mut app = ModelApp::new(Session::default()).with_services(services(inbox.clone(), cc.egui_ctx.clone()));
+                    // Anonymous usage: asked once, recorded only when the user agreed (docs/privacy.md).
+                    if let Some(host) = crate::usage::host() {
+                        app = app.with_usage(host);
+                    }
                     if let Some(rs) = &cc.wgpu_render_state {
                         let info = rs.adapter.get_info();
                         log::info!("fieldcraft-web: graphics {:?} {}, MSAA {}x", info.backend, info.name, rs.msaa_samples);
@@ -102,7 +107,8 @@ pub fn start() {
                     if recoverable > 0 {
                         app.set_status(format!("{recoverable} autosaved model(s) can be recovered: File › Recover…"), false);
                     }
-                    Ok(Box::new(Shell { app, inbox, store, autosaver, autosaved_at: 0.0, storage_error: false }))
+                    let deploy = crate::deploy::Watch::start();
+                    Ok(Box::new(Shell { app, inbox, store, autosaver, autosaved_at: 0.0, storage_error: false, sent_at: 0.0, deploy }))
                 }),
             )
             .await;
@@ -188,8 +194,10 @@ fn services(inbox: Inbox, ctx: egui::Context) -> Services {
         pick_save: Some(Box::new(|name: &str, _: &[Filter]| Some(page_path(name)))),
         // The recent list holds the page's files, which go with the page.
         recent_path: None,
-        // Preferences last for the page's run.
-        prefs_path: None,
+        // Preferences are kept in the browser's local storage.
+        prefs: Some(crate::usage::prefs_store()),
+        // egui opens links itself in the browser.
+        open_url: None,
     }
 }
 
@@ -204,6 +212,10 @@ struct Shell {
     autosaved_at: f64,
     /// The last autosave did not fit in the browser's storage (said once until one fits).
     storage_error: bool,
+    /// App time usage events were last sent.
+    sent_at: f64,
+    /// Looks for a new deployment of the app.
+    deploy: crate::deploy::Watch,
 }
 
 impl Shell {
@@ -269,7 +281,19 @@ impl eframe::App for Shell {
         self.open_arrived();
         self.app.logic(ctx);
         self.autosave(ctx);
+        if self.app.now - self.sent_at >= crate::usage::INTERVAL {
+            self.sent_at = self.app.now;
+            crate::usage::send();
+        }
         UNSAVED.with(|u| u.set(self.app.session.is_dirty() && !self.app.session.journal.is_empty()));
+        if self.app.now - self.deploy.looked_at >= crate::deploy::INTERVAL || self.app.now < self.deploy.looked_at {
+            self.deploy.looked_at = self.app.now;
+            self.deploy.look();
+        }
+        if self.deploy.found() && !self.app.reload_offered() {
+            self.app.offer_reload(Box::new(crate::deploy::reload));
+        }
+        ctx.request_repaint_after(std::time::Duration::from_secs_f64(crate::deploy::INTERVAL));
     }
 
     /// Dropped files are read here (browsers read them asynchronously) and arrive through the

apps/fieldcraft/Cargo.toml

@@ -6,18 +6,54 @@ edition.workspace = true
 license.workspace = true
 publish = false
 
-[lints]
-workspace = true
+# The workspace lints, except unsafe_code: denied, not forbidden, so that src/native_crash.rs
+# (the Windows exception filter, which has no safe API) can allow it. Keep the rest in sync with
+# [workspace.lints].
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+dbg_macro = "warn"
+todo = "warn"
+too_many_arguments = "allow"
+type_complexity = "allow"
+neg_cmp_op_on_partial_ord = "allow"
 
 [dependencies]
 fieldcraft-engine = { workspace = true }
 fieldcraft-ui-egui = { workspace = true }
 fieldcraft-io = { workspace = true }
+fieldcraft-update = { workspace = true }
 rfd = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+# Usage analytics (docs/privacy.md): an HTTPS POST with rustls on ring, checked against the
+# operating system's certificates (no bundled root list), and a random install id.
+ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "platform-verifier"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+getrandom = "0.4"
+
+# A termination signal (SIGTERM, SIGINT) closes the window the normal way (terminate.rs).
+[target.'cfg(unix)'.dependencies]
+signal-hook = "0.4"
+
+# The exception filter and minidump of a native crash (src/native_crash.rs).
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_Security",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Diagnostics_Debug",
+    # WriteFile's OVERLAPPED.
+    "Win32_System_IO",
+    "Win32_System_Kernel",
+    "Win32_System_LibraryLoader",
+    # MiniDumpWriteDump.
+    "Win32_System_Memory",
+    "Win32_System_Threading",
+] }
 
 [build-dependencies]
 # The Windows executable's icon resource (build.rs).
@@ -65,7 +101,7 @@ assets = [
 [package.metadata.generate-rpm]
 name = "fieldcraft"
 license = "MIT OR Apache-2.0"
-url = "https://github.com/jyviko/fieldcraft"
+url = "https://github.com/tangency-labs/fieldcraft"
 assets = [
     { source = "target/release/fieldcraft", dest = "/usr/bin/fieldcraft", mode = "755" },
     { source = "target/release/fieldcraft-cli", dest = "/usr/bin/fieldcraft-cli", mode = "755" },

apps/fieldcraft/src/control_server.rs

@@ -115,6 +115,11 @@ fn serve(stream: TcpStream, tx: Sender<ControlRequest>, ctx: egui::Context) {
                 }
                 ctx.request_repaint();
                 let mut r = rrx.recv_timeout(REPLY_TIMEOUT).unwrap_or_else(|_| json!({"ok": false, "error": "timeout"}));
+                // A request waiting for a job (a solve, a mesher): its reply comes when the job
+                // ends, however long it runs; the job always answers, even when cancelled.
+                if r.get(fieldcraft_ui_egui::control::PENDING).is_some() {
+                    r = rrx.recv().unwrap_or_else(|_| json!({"ok": false, "error": "the job ended without a reply"}));
+                }
                 if let Some(o) = r.as_object_mut() {
                     o.insert("id".into(), id);
                 }

apps/fieldcraft/src/main.rs

@@ -9,12 +9,17 @@
 //! `fieldcraft_ui_egui::control` and docs/control-protocol.md.
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-#![forbid(unsafe_code)]
+// Unsafe code is denied (Cargo.toml): only the Windows exception filter allows it (native_crash.rs).
 
 mod control_server;
+#[cfg(windows)]
+mod native_crash;
+mod terminate;
+mod update;
+mod usage;
 
-use fieldcraft_engine::Session;
 use fieldcraft_engine::autosave::{self, Autosaver};
+use fieldcraft_engine::{Session, crash, logfile};
 use fieldcraft_ui_egui::{Filter, ModelApp, Services};
 
 const USAGE: &str =
@@ -47,6 +52,10 @@ struct App {
     autosaver: Option<Autosaver>,
     /// App time of the last autosave check.
     autosaved_at: f64,
+    /// Frames drawn so far, up to 2 (the second means the first was presented: the app is up).
+    frames: u8,
+    /// Sends the anonymous usage events, when this run may (docs/privacy.md).
+    usage: Option<usage::Sender>,
 }
 
 impl App {
@@ -61,6 +70,14 @@ impl App {
 
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        if self.frames < 2 {
+            self.frames += 1;
+            // A second frame right away, which means the first was presented: the app is up.
+            ctx.request_repaint();
+            if self.frames == 2 {
+                crash::phase(crash::RUNNING);
+            }
+        }
         self.app.logic(ctx);
         if self.app.now - self.autosaved_at >= AUTOSAVE_SECONDS {
             self.autosaved_at = self.app.now;
@@ -76,6 +93,16 @@ impl eframe::App for App {
         {
             log::warn!("autosave: {e}");
         }
+        self.app.usage_closing();
+        if let Some(u) = self.usage.take() {
+            u.finish();
+        }
+        // An update the user chose to install: swapped in now that the window has closed.
+        if let Some(staged) = self.app.take_staged_update() {
+            update::finish(&staged);
+        }
+        log::info!("FieldCraft closed");
+        crash::end_session();
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
         self.app.raw_input_hook(raw);
@@ -95,10 +122,65 @@ fn services() -> Services {
         })),
         // Beside the recovery folder in the per-user data folder.
         recent_path: fieldcraft_io::recovery::default_dir().and_then(|d| d.parent().map(|p| p.join("recent.json"))),
-        prefs_path: fieldcraft_io::recovery::default_dir().and_then(|d| d.parent().map(|p| p.join("prefs.json"))),
+        prefs: fieldcraft_io::recovery::default_dir()
+            .and_then(|d| d.parent().map(|p| fieldcraft_ui_egui::files::PrefsStore::file(p.join("prefs.json")))),
+        open_url: Some(Box::new(open_url)),
     }
 }
 
+/// Open a web link in the default browser, with the system's own opener: `open` (macOS),
+/// `xdg-open` (Linux and the BSDs), `explorer` (Windows). The link is one argument, never
+/// passed through a shell. Only https links are opened.
+fn open_url(url: &str) -> Result<(), String> {
+    if !url.starts_with("https://") {
+        return Err(format!("not a web link: {}", url.chars().take(80).collect::<String>()));
+    }
+    let opener = if cfg!(target_os = "macos") {
+        "open"
+    } else if cfg!(windows) {
+        "explorer"
+    } else {
+        "xdg-open"
+    };
+    let mut child = std::process::Command::new(opener).arg(url).spawn().map_err(|e| format!("{opener}: {e}"))?;
+    // Reaped off the window thread; its exit status says nothing (`explorer` exits with 1 even
+    // when it opened the link).
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+    Ok(())
+}
+
+/// Crash reports and the log file (docs/crash-reports.md): reports of earlier runs that crashed
+/// come back, for the window to offer. Both live in the app's data folder (a temporary one in
+/// runs driven by automation); `FIELDCRAFT_CRASH_DIR` moves the crash folder.
+fn start_reporting() -> Vec<crash::Summary> {
+    // First the crash reports: an unclean exit's report takes the dead run's lines from the log.
+    let crashed = crash::default_dir().map(|dir| crash::install(dir, crash::Build::current())).unwrap_or_default();
+    match fieldcraft_io::recovery::data_dir().map(|d| logfile::install(&d.join("logs"), log::LevelFilter::Info)) {
+        Some(Ok(path)) => eprintln!("fieldcraft: log {}", path.display()),
+        Some(Err(e)) => eprintln!("fieldcraft: no log file: {e}"),
+        None => {}
+    }
+    let b = crash::Build::current();
+    log::info!(
+        "FieldCraft {} started ({}), crash reports in {}",
+        b.version,
+        b.version_line(),
+        crash::default_dir().map(|d| d.display().to_string()).unwrap_or_default()
+    );
+    crashed
+}
+
+/// egui-wgpu is about to start a step of getting the graphics device and the window's surface
+/// up: the crash journal keeps it, and the adapter once it is picked (#299).
+fn startup_step(step: &'static str, detail: &str) {
+    if step == eframe::egui_wgpu::STEP_ADAPTER_CHOSEN {
+        crash::set_environment(&format!("Renderer: {detail}"));
+    }
+    crash::phase(step);
+}
+
 /// Command-line options.
 #[derive(Debug, Default, PartialEq)]
 struct Args {
@@ -152,9 +234,16 @@ fn main() -> eframe::Result {
     };
     if args.control.is_some() {
         // A run driven by automation keeps its autosaves (and recent files and preferences, which
-        // live beside them) in a temporary folder, never the user's.
+        // live beside them), its crash reports and its log in a temporary folder, never the user's.
         fieldcraft_io::recovery::use_automation_dir();
     }
+    let crashed = start_reporting();
+    // A crash in native code (a graphics driver) says where it happened: the exception and the
+    // module on Windows, and on every system the startup step the app was in.
+    #[cfg(windows)]
+    native_crash::install();
+    eframe::egui_wgpu::set_startup_hook(startup_step);
+    crash::phase("window");
     let options = eframe::NativeOptions {
         viewport: egui::ViewportBuilder::default()
             .with_title("FieldCraft")
@@ -177,13 +266,42 @@ fn main() -> eframe::Result {
         "FieldCraft",
         options,
         Box::new(move |cc| {
-            let mut app = ModelApp::new(Session::default()).with_services(services());
+            crash::phase("app setup");
+            let mut session = Session::default();
+            // The window's model: its commands go into the crash journal.
+            session.crash_journal = crash::enabled();
+            let mut app = ModelApp::new(session).with_services(services());
+            // Anonymous usage: asked once, recorded only when the user agreed (docs/privacy.md).
+            let usage = match usage::host(args.control.is_some()) {
+                Some(host) => {
+                    app = app.with_usage(host);
+                    usage::start()
+                }
+                None => None,
+            };
+            // Updates (docs/updates.md): checked at most daily when on, installed only on a click.
+            fieldcraft_engine::enable_update_checks(true);
+            app = app.with_updates(update::host(cc.egui_ctx.clone(), args.control.is_some()));
             app.custom_titlebar = CUSTOM_TITLEBAR;
             app.integrated_titlebar = cfg!(target_os = "macos");
             if let Some(rs) = &cc.wgpu_render_state {
                 let info = rs.adapter.get_info();
-                eprintln!("fieldcraft: graphics {:?} {}, MSAA {}x (requested {MSAA}x)", info.backend, info.name, rs.msaa_samples);
+                log::info!("graphics {:?} {} ({}), MSAA {}x (requested {MSAA}x)", info.backend, info.name, info.driver, rs.msaa_samples);
+                crash::set_environment(&format!("Renderer: {:?} {} ({}), MSAA {}x", info.backend, info.name, info.driver, rs.msaa_samples));
+                crash::phase("viewport pipelines (shader compile)");
                 app.set_wgpu(rs, DEPTH_BITS, rs.msaa_samples, &cc.egui_ctx);
+                // The graphics driver is loaded now; it may have put its own exception filter
+                // in front of ours.
+                #[cfg(windows)]
+                native_crash::reinstall();
+            }
+            // `kill` or Ctrl-C closes the window as Close does: autosaved, no crash (#248).
+            let ctx = cc.egui_ctx.clone();
+            if let Err(e) = terminate::watch(move || {
+                ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+                ctx.request_repaint();
+            }) {
+                log::warn!("termination signals: {e}");
             }
             if let Some(port) = args.control {
                 app = app.with_control(control_server::start(port, cc.egui_ctx.clone()));
@@ -202,7 +320,9 @@ fn main() -> eframe::Result {
                 }
                 Autosaver::new(&dir).map_err(|e| log::warn!("autosave unavailable: {e}")).ok()
             });
-            Ok(Box::new(App { app, autosaver, autosaved_at: 0.0 }))
+            app.announce_crashes(&crashed);
+            crash::phase("first frame");
+            Ok(Box::new(App { app, autosaver, autosaved_at: 0.0, frames: 0, usage }))
         }),
     )
 }

apps/fieldcraft/src/native_crash.rs

@@ -0,0 +1,290 @@
+//! Windows: what a crash in native code leaves behind (docs/crash-reports.md, #299).
+//!
+//! A crash inside a graphics driver or another DLL (an access violation, a stack overflow) is no
+//! Rust panic: the panic hook never runs and the next start only found "an unclean exit". An
+//! unhandled-exception filter now writes, before the process goes, a small JSON file with the
+//! exception code, the faulting module and the offset into it, and a minidump, next to the run's
+//! crash journal (`fieldcraft_engine::crash::native_paths`). The next start puts both into the
+//! unclean exit's report, with the startup step the journal says the app was in. Everything that
+//! can be tested without Windows (reading the file, the report, the startup steps) lives in
+//! `fieldcraft_engine::crash` and is tested there.
+//!
+//! Installing an exception filter and asking the system which module holds an address have no
+//! safe API, hence the `unsafe_code` allowance on this module, the only one in FieldCraft (the
+//! app crate denies unsafe code instead of forbidding it for this). The filter runs on a thread
+//! that may have a broken heap or almost no stack left: it doesn't allocate, formats into a buffer
+//! on the stack, and skips the minidump after a stack overflow.
+//!
+//! Adapted from SolidCraft's `apps/solidcraft/src/native_crash.rs` (MIT OR Apache-2.0), see
+//! ATTRIBUTION.md.
+#![allow(unsafe_code)]
+
+use std::fmt::Write as _;
+use std::os::windows::ffi::OsStrExt;
+use std::path::Path;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+use windows_sys::Win32::Foundation::{CloseHandle, GENERIC_WRITE, HANDLE, HMODULE, INVALID_HANDLE_VALUE};
+use windows_sys::Win32::Storage::FileSystem::{CREATE_ALWAYS, CreateFileW, FILE_ATTRIBUTE_NORMAL, WriteFile};
+use windows_sys::Win32::System::Diagnostics::Debug::{
+    EXCEPTION_CONTINUE_SEARCH, EXCEPTION_POINTERS, MINIDUMP_EXCEPTION_INFORMATION, MiniDumpNormal, MiniDumpWithThreadInfo,
+    MiniDumpWithUnloadedModules, MiniDumpWriteDump, SetUnhandledExceptionFilter,
+};
+use windows_sys::Win32::System::LibraryLoader::{
+    GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, GetModuleFileNameW, GetModuleHandleExW,
+};
+use windows_sys::Win32::System::Threading::{GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId};
+
+/// Where the filter writes (NUL-terminated UTF-16), set once by [`install`].
+struct Paths {
+    info: Vec<u16>,
+    dump: Vec<u16>,
+}
+
+static PATHS: OnceLock<Paths> = OnceLock::new();
+/// The filter that was installed before ours (called after ours), as an address.
+static PREVIOUS: AtomicUsize = AtomicUsize::new(0);
+/// The filter has started writing (a second exception while it does is left alone).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+const STATUS_ACCESS_VIOLATION: u32 = 0xC000_0005;
+const STATUS_IN_PAGE_ERROR: u32 = 0xC000_0006;
+const STATUS_STACK_OVERFLOW: u32 = 0xC000_00FD;
+
+/// Catch native crashes from now on (after `fieldcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, dump)) = fieldcraft_engine::crash::native_paths() else { return };
+    let wide = |p: &Path| p.as_os_str().encode_wide().chain([0]).collect::<Vec<u16>>();
+    if PATHS.set(Paths { info: wide(&info), dump: wide(&dump) }).is_ok() {
+        set_filter();
+    }
+}
+
+/// Put the filter back on top: a DLL loaded since (a graphics driver) may have set its own,
+/// which is then called after ours.
+pub fn reinstall() {
+    if PATHS.get().is_some() {
+        set_filter();
+    }
+}
+
+fn set_filter() {
+    // SAFETY: `filter` has the signature the system calls it with and stays valid for the
+    // process's life.
+    let previous = unsafe { SetUnhandledExceptionFilter(Some(filter)) };
+    if let Some(p) = previous
+        && p as usize != filter as *const () as usize
+    {
+        PREVIOUS.store(p as usize, Ordering::SeqCst);
+    }
+}
+
+/// The unhandled-exception filter: record, then let the previous filter (or the system) go on.
+unsafe extern "system" fn filter(pointers: *const EXCEPTION_POINTERS) -> i32 {
+    if !BUSY.swap(true, Ordering::SeqCst) {
+        // SAFETY: the system passes valid exception pointers for the duration of the call.
+        unsafe { record(pointers) };
+    }
+    let previous = PREVIOUS.load(Ordering::SeqCst);
+    if previous != 0 && previous != filter as *const () as usize {
+        // SAFETY: the address came from `SetUnhandledExceptionFilter` as a filter of this type.
+        let previous: unsafe extern "system" fn(*const EXCEPTION_POINTERS) -> i32 = unsafe { std::mem::transmute(previous) };
+        // SAFETY: as for this filter.
+        return unsafe { previous(pointers) };
+    }
+    EXCEPTION_CONTINUE_SEARCH
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 2048],
+    len: usize,
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let room = self.bytes.len().saturating_sub(self.len);
+        let n = s.len().min(room);
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The usual names of the exception codes a crash shows.
+fn code_name(code: u32) -> &'static str {
+    match code {
+        STATUS_ACCESS_VIOLATION => "EXCEPTION_ACCESS_VIOLATION",
+        STATUS_IN_PAGE_ERROR => "EXCEPTION_IN_PAGE_ERROR",
+        STATUS_STACK_OVERFLOW => "EXCEPTION_STACK_OVERFLOW",
+        0xC000_001D => "EXCEPTION_ILLEGAL_INSTRUCTION",
+        0xC000_0094 => "EXCEPTION_INT_DIVIDE_BY_ZERO",
+        0xC000_0096 => "EXCEPTION_PRIV_INSTRUCTION",
+        0xC000_008C => "EXCEPTION_ARRAY_BOUNDS_EXCEEDED",
+        0xC000_0374 => "STATUS_HEAP_CORRUPTION",
+        0xC000_0409 => "STATUS_STACK_BUFFER_OVERRUN",
+        0xC000_0602 => "STATUS_FAIL_FAST_EXCEPTION",
+        0x8000_0003 => "EXCEPTION_BREAKPOINT",
+        0xE06D_7363 => "C++ exception",
+        _ => "exception",
+    }
+}
+
+/// Write what `pointers` says into the info file, then the minidump.
+unsafe fn record(pointers: *const EXCEPTION_POINTERS) {
+    let Some(paths) = PATHS.get() else { return };
+    if pointers.is_null() {
+        return;
+    }
+    // SAFETY: checked non-null; the system keeps it valid during the filter.
+    let rec = unsafe { (*pointers).ExceptionRecord };
+    if rec.is_null() {
+        return;
+    }
+    // SAFETY: as above.
+    let rec = unsafe { &*rec };
+    let code = rec.ExceptionCode as u32;
+    let address = rec.ExceptionAddress as usize;
+    let mut module: HMODULE = std::ptr::null_mut();
+    let mut name = [0u16; 512];
+    // SAFETY: FROM_ADDRESS takes the address in place of a name; UNCHANGED_REFCOUNT means no
+    // handle to release; `name` is as long as we say.
+    let len = unsafe {
+        if GetModuleHandleExW(
+            GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+            address as *const u16,
+            &mut module,
+        ) != 0
+        {
+            GetModuleFileNameW(module, name.as_mut_ptr(), name.len() as u32) as usize
+        } else {
+            0
+        }
+    };
+    // SAFETY: no preconditions.
+    let thread = unsafe { GetCurrentThreadId() };
+    let mut b = Buf { bytes: [0; 2048], len: 0 };
+    let _ = write!(b, "{{\"code\":\"0x{code:08X}\",\"name\":\"{}\",\"address\":\"0x{address:016X}\",\"thread\":{thread}", code_name(code));
+    if len > 0 {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", address.wrapping_sub(module as usize));
+        for c in char::decode_utf16(name.iter().take(len).copied()) {
+            let _ = match c.unwrap_or(char::REPLACEMENT_CHARACTER) {
+                '"' => b.write_str("\\\""),
+                '\\' => b.write_str("\\\\"),
+                c if (c as u32) < 0x20 => b.write_str("?"),
+                c => b.write_char(c),
+            };
+        }
+        let _ = b.write_str("\"");
+    }
+    if matches!(code, STATUS_ACCESS_VIOLATION | STATUS_IN_PAGE_ERROR) && rec.NumberParameters >= 2 {
+        let what = match rec.ExceptionInformation[0] {
+            0 => "read of",
+            1 => "write to",
+            8 => "execution at",
+            _ => "access to",
+        };
+        let _ = write!(b, ",\"detail\":\"{what} 0x{:016X}\"", rec.ExceptionInformation[1]);
+    }
+    let _ = b.write_str("}");
+    let bytes = b.bytes.get(..b.len).unwrap_or_default();
+    // SAFETY: NUL-terminated path; the handle is closed below.
+    unsafe {
+        let file = create(&paths.info);
+        if !file.is_null() {
+            let mut written = 0u32;
+            WriteFile(file, bytes.as_ptr(), bytes.len() as u32, &mut written, std::ptr::null_mut());
+            CloseHandle(file);
+        }
+    }
+    // After a stack overflow there is no stack left for writing a minidump.
+    if code == STATUS_STACK_OVERFLOW {
+        return;
+    }
+    // SAFETY: as above; the exception information points at this thread's exception.
+    unsafe {
+        let file = create(&paths.dump);
+        if !file.is_null() {
+            let exception = MINIDUMP_EXCEPTION_INFORMATION { ThreadId: thread, ExceptionPointers: pointers as *mut _, ClientPointers: 0 };
+            MiniDumpWriteDump(
+                GetCurrentProcess(),
+                GetCurrentProcessId(),
+                file,
+                MiniDumpNormal | MiniDumpWithThreadInfo | MiniDumpWithUnloadedModules,
+                &exception,
+                std::ptr::null(),
+                std::ptr::null(),
+            );
+            CloseHandle(file);
+        }
+    }
+}
+
+/// A new file at `path` (NUL-terminated) for writing, or null.
+unsafe fn create(path: &[u16]) -> HANDLE {
+    // SAFETY: the caller passes a NUL-terminated path.
+    let h = unsafe { CreateFileW(path.as_ptr(), GENERIC_WRITE, 0, std::ptr::null(), CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, std::ptr::null_mut()) };
+    if h == INVALID_HANDLE_VALUE { std::ptr::null_mut() } else { h }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    /// The child half: install crash reporting and the filter, then fault in native code.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("FIELDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = fieldcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234" };
+        let fresh = fieldcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        if std::env::var_os("FIELDCRAFT_NATIVE_CRASH_FAULT").is_none() {
+            fieldcraft_engine::crash::end_session();
+            return;
+        }
+        super::install();
+        fieldcraft_engine::crash::phase("device creation");
+        // SAFETY: none; this is the crash under test (a read of address 16, as a null struct
+        // pointer's field would be).
+        let v = unsafe { std::ptr::read_volatile(16 as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &std::path::Path, fault: bool) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash::tests::child", "--test-threads=1", "--nocapture"]).env("FIELDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if fault {
+            c.env("FIELDCRAFT_NATIVE_CRASH_FAULT", "1");
+        }
+        c.output().unwrap()
+    }
+
+    #[test]
+    fn an_access_violation_is_reported_with_its_module_step_and_minidump() {
+        let dir = std::env::temp_dir().join(format!("fieldcraft-native-crash-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, true);
+        assert_eq!(out.status.code().map(|c| c as u32), Some(super::STATUS_ACCESS_VIOLATION), "{out:?}");
+        let sessions: Vec<PathBuf> = std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).collect();
+        let info = sessions.iter().find(|p| p.to_string_lossy().ends_with(".native.json")).expect("the filter wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        assert_eq!(v["code"], "0xC0000005", "{v}");
+        assert_eq!(v["detail"], "read of 0x0000000000000010", "{v}");
+        assert!(v["module"].as_str().unwrap().to_lowercase().contains("fieldcraft"), "the fault is in the test binary: {v}");
+        let dump = sessions.iter().find(|p| p.extension().is_some_and(|e| e == "dmp")).expect("a minidump");
+        assert_eq!(std::fs::read(dump).unwrap().get(..4), Some(&b"MDMP"[..]));
+        // The next start reports it.
+        let out = run(&dir, false);
+        assert!(out.status.success(), "{out:?}");
+        let reports = fieldcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = fieldcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        assert!(r["message"].as_str().unwrap().contains("EXCEPTION_ACCESS_VIOLATION (0xC0000005) in fieldcraft"), "{r}");
+        assert!(r["message"].as_str().unwrap().contains("during startup (device creation"), "{r}");
+        assert!(r.get("minidump_path").is_some(), "{r}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

apps/fieldcraft/src/terminate.rs

@@ -0,0 +1,143 @@
+//! A request to terminate (SIGTERM, SIGINT on Unix) closes the window the normal way.
+//!
+//! Without this, `kill PID`, Ctrl-C in the terminal, a system shutdown or a test harness's timeout
+//! ended the process on the spot: no `on_exit`, so no last autosave and no clean end of the crash
+//! journal, and the next start filed an `unclean_exit` crash report for what was no crash (#248:
+//! "ended without a clean exit between commands (last: control ui.capture)" was an automation run
+//! stopped with SIGTERM after its capture). Now the first signal asks the window to close, which
+//! autosaves, ends the journal and exits as a click on Close does; the journal notes the signal,
+//! so a run that still dies while closing says why. A second signal, for a window that does not
+//! close, ends the process at once with the signal's default action.
+//!
+//! SIGHUP is left alone: `nohup fieldcraft &` ignores it on purpose so the app outlives its
+//! terminal, and a handler would override that (a safe API cannot ask whether a signal was
+//! ignored at launch).
+//!
+//! Windows has no such signals: a window there is closed through its messages, which eframe
+//! already turns into a normal close.
+
+use std::io;
+
+/// The signals that ask the app to terminate.
+#[cfg(unix)]
+const SIGNALS: [i32; 2] = [signal_hook::consts::SIGTERM, signal_hook::consts::SIGINT];
+
+/// The signal's usual name, for the log and the crash journal.
+#[cfg(unix)]
+fn name(signal: i32) -> &'static str {
+    match signal {
+        signal_hook::consts::SIGTERM => "SIGTERM",
+        signal_hook::consts::SIGINT => "SIGINT",
+        _ => "signal",
+    }
+}
+
+/// Call `close` (on a thread of its own) on the first termination signal; a second one ends the
+/// process with the signal's default action.
+#[cfg(unix)]
+pub fn watch(close: impl Fn() + Send + 'static) -> io::Result<()> {
+    let mut signals = signal_hook::iterator::Signals::new(SIGNALS)?;
+    std::thread::Builder::new().name("terminate".into()).spawn(move || {
+        let mut asked = false;
+        for signal in signals.forever() {
+            if asked {
+                log::warn!("{}: the window did not close; ending now", name(signal));
+                if let Err(e) = signal_hook::low_level::emulate_default_handler(signal) {
+                    log::error!("{}: {e}", name(signal));
+                    std::process::exit(128 + signal);
+                }
+                continue;
+            }
+            asked = true;
+            log::info!("{}: closing", name(signal));
+            fieldcraft_engine::crash::activity(&format!("terminating ({})", name(signal)));
+            close();
+        }
+    })?;
+    Ok(())
+}
+
+/// Nothing to watch without Unix signals.
+#[cfg(not(unix))]
+pub fn watch(_close: impl Fn() + Send + 'static) -> io::Result<()> {
+    Ok(())
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::path::{Path, PathBuf};
+    use std::sync::mpsc;
+
+    use fieldcraft_engine::crash;
+
+    /// The child half: start crash reporting as the app does, then get SIGTERM. With the watcher
+    /// the "window" (here the main thread) closes the normal way; without it the process dies.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("FIELDCRAFT_TERMINATE_CHILD") else { return };
+        let build = crash::Build { version: "9.9.9", commit: "abc1234" };
+        let fresh = crash::install(PathBuf::from(dir), build);
+        if std::env::var_os("FIELDCRAFT_TERMINATE_NEXT").is_some() {
+            // The next start: what it reports of the run before.
+            println!("FRESH {}", fresh.iter().map(|s| s.message.as_str()).collect::<Vec<_>>().join(" | "));
+            crash::end_session();
+            return;
+        }
+        crash::activity("control ui.capture");
+        if std::env::var_os("FIELDCRAFT_TERMINATE_WATCH").is_some() {
+            let (tx, rx) = mpsc::channel();
+            super::watch(move || {
+                let _ = tx.send(());
+            })
+            .unwrap();
+            signal_hook::low_level::raise(signal_hook::consts::SIGTERM).unwrap();
+            // What `on_exit` does once the window has closed.
+            rx.recv().unwrap();
+            crash::end_session();
+            println!("CLOSED");
+            return;
+        }
+        signal_hook::low_level::raise(signal_hook::consts::SIGTERM).unwrap();
+        // Not reached: SIGTERM's default action ends the process.
+        std::thread::sleep(std::time::Duration::from_secs(10));
+    }
+
+    #[test]
+    fn sigterm_closes_cleanly_and_leaves_no_crash_report() {
+        let root = std::env::temp_dir().join(format!("fieldcraft-terminate-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        let run = |dir: &Path, mode: &str| {
+            let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+            c.args(["--exact", "terminate::tests::child", "--test-threads=1", "--nocapture"]).env("FIELDCRAFT_TERMINATE_CHILD", dir);
+            match mode {
+                "watch" => c.env("FIELDCRAFT_TERMINATE_WATCH", "1"),
+                "next" => c.env("FIELDCRAFT_TERMINATE_NEXT", "1"),
+                _ => &mut c,
+            };
+            c.output().unwrap()
+        };
+        // What the next start in `dir` reports of the run before.
+        let reported_at_next_start = |dir: &Path| {
+            let out = run(dir, "next");
+            assert!(out.status.success(), "{out:?}");
+            let stdout = String::from_utf8_lossy(&out.stdout).to_string();
+            stdout.lines().find_map(|l| l.split_once("FRESH ").map(|(_, r)| r.trim().to_string())).unwrap_or_else(|| panic!("{stdout}"))
+        };
+
+        // Without the watcher (the bug): killed, and the journal it leaves reads as a crash.
+        let unwatched = root.join("unwatched");
+        let out = run(&unwatched, "kill");
+        use std::os::unix::process::ExitStatusExt;
+        assert_eq!(out.status.signal(), Some(signal_hook::consts::SIGTERM), "{out:?}");
+        let reported = reported_at_next_start(&unwatched);
+        assert!(reported.contains("ended without a clean exit") && reported.contains("control ui.capture"), "{reported}");
+
+        // With it: the close runs, the journal ends, and nothing is reported as a crash.
+        let watched = root.join("watched");
+        let out = run(&watched, "watch");
+        assert!(out.status.success(), "{out:?}");
+        assert!(String::from_utf8_lossy(&out.stdout).contains("CLOSED"), "{out:?}");
+        assert_eq!(reported_at_next_start(&watched), "");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+}

apps/fieldcraft/src/update.rs

@@ -0,0 +1,105 @@
+//! The desktop app's side of updates (docs/updates.md): it runs the window's update jobs
+//! ([`fieldcraft_ui_egui::updates`]) on background threads with [`fieldcraft_update`], and swaps
+//! a staged release in after the window has closed ([`finish`]).
+//!
+//! Automatic checks are off in runs driven by automation (`--control`) and under CI, so test
+//! and agent runs never reach GitHub on their own; `FIELDCRAFT_UPDATE_HOST` (a local test
+//! server) turns them back on. Help › Check for Updates works in every run.
+
+use std::cell::Cell;
+use std::path::Path;
+use std::sync::mpsc;
+
+use fieldcraft_ui_egui::updates::{Event, Job, UpdateHost};
+use fieldcraft_update::install::{self, Finish, Install};
+use fieldcraft_update::net::{Client, Which};
+use fieldcraft_update::stage::{self, Options};
+use fieldcraft_update::{Release, Staged};
+
+/// What the window needs for updates.
+pub fn host(ctx: egui::Context, automation: bool) -> UpdateHost {
+    let here = install::here();
+    log::info!("updates: {}", here.describe());
+    stage::clean_stale(&here);
+    let env = |k: &str| std::env::var_os(k).is_some_and(|v| !v.is_empty());
+    let automatic = env(fieldcraft_update::HOST_ENV) || !(automation || env("CI"));
+    let (tx, events) = mpsc::channel::<Event>();
+    let unsupported = here.unsupported();
+    let start = move |job: Job| {
+        let (tx, ctx, here) = (tx.clone(), ctx.clone(), here.clone());
+        let spawned = std::thread::Builder::new().name("fieldcraft update".into()).spawn(move || {
+            let send = |e: Event| {
+                let _ = tx.send(e);
+                ctx.request_repaint();
+            };
+            let client = Client::from_env();
+            match job {
+                Job::Check { manual } => send(Event::Checked { manual, result: client.check().map_err(|e| e.to_string()) }),
+                Job::Stage(release) => send(Event::Staged(stage_release(&client, &release, &here, &send))),
+                Job::Reinstall => {
+                    let staged = client
+                        .release(&Which::Version(fieldcraft_update::current()))
+                        .map_err(|e| e.to_string())
+                        .and_then(|r| stage_release(&client, &r, &here, &send));
+                    send(Event::Staged(staged));
+                }
+            }
+        });
+        if let Err(e) = spawned {
+            log::warn!("updates: no thread: {e}");
+        }
+    };
+    UpdateHost { unsupported, automatic, start: Box::new(start), events, now: Box::new(now), open_file: Box::new(open_file) }
+}
+
+/// Download, verify and stage `release`, reporting each whole percent.
+fn stage_release(client: &Client, release: &Release, here: &Install, send: &dyn Fn(Event)) -> Result<Staged, String> {
+    let downloads = fieldcraft_io::recovery::data_dir().map(|d| d.join("updates")).unwrap_or_else(|| std::env::temp_dir().join("fieldcraft-updates"));
+    let last = Cell::new(u64::MAX);
+    let progress = |done: u64, total: u64| {
+        let step = done.saturating_mul(100).checked_div(total).unwrap_or(done / (1024 * 1024));
+        if last.replace(step) != step {
+            send(Event::Progress(done, total));
+        }
+    };
+    let options = Options { key: fieldcraft_update::PUBLIC_KEY, downloads: &downloads, arch: std::env::consts::ARCH, progress: &progress };
+    let staged = stage::stage(client, release, here, &options).map_err(|e| e.to_string());
+    match &staged {
+        Ok(s) => log::info!("updates: FieldCraft {} verified and staged at {}", s.version, s.payload.display()),
+        Err(e) => log::warn!("updates: FieldCraft {} not staged: {e}", release.version),
+    }
+    staged
+}
+
+/// Swap `staged` in and start it: the window has closed, its autosave is closed.
+pub fn finish(staged: &Staged) {
+    match install::plan(staged, true) {
+        Ok(Finish::Swap(plan)) => match stage::apply(&plan) {
+            Ok(()) => log::info!("updates: FieldCraft {} installed ({})", staged.version, staged.install.describe()),
+            Err(e) => log::error!("updates: FieldCraft {} not installed, the previous version is kept: {e}", staged.version),
+        },
+        Ok(Finish::Package { .. }) => {}
+        Err(e) => log::error!("updates: {e}"),
+    }
+}
+
+/// Seconds since the Unix epoch.
+fn now() -> u64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
+}
+
+/// Open a downloaded package with the system's handler for it (Linux: the software installer).
+fn open_file(path: &Path) -> Result<(), String> {
+    let opener = if cfg!(target_os = "macos") {
+        "open"
+    } else if cfg!(windows) {
+        "explorer"
+    } else {
+        "xdg-open"
+    };
+    let mut child = std::process::Command::new(opener).arg(path).spawn().map_err(|e| format!("{opener}: {e}"))?;
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+    Ok(())
+}

apps/fieldcraft/src/usage.rs

@@ -0,0 +1,116 @@
+//! Sending the anonymous usage events (docs/privacy.md) to PostHog Cloud EU: a background
+//! thread posts the queued events ([`fieldcraft_engine::usage`]) in batches every half minute and
+//! when the window closes. A failed post (offline, a slow network) drops its batch silently;
+//! nothing waits on it but the thread.
+//!
+//! The project key is a build setting, `FIELDCRAFT_POSTHOG_KEY`, which only the release workflow
+//! sets: local, development and fork builds have none and send nothing.
+
+use std::sync::mpsc;
+use std::time::Duration;
+
+use fieldcraft_engine::usage;
+use fieldcraft_ui_egui::privacy::UsageHost;
+
+/// The PostHog project key the release build was made with.
+const KEY: Option<&str> = option_env!("FIELDCRAFT_POSTHOG_KEY");
+/// How often queued events are sent.
+const INTERVAL: Duration = Duration::from_secs(30);
+/// The longest one post may take.
+const TIMEOUT: Duration = Duration::from_secs(10);
+/// How long closing the window waits for the last batch.
+const LAST_WAIT: Duration = Duration::from_secs(2);
+
+fn key() -> Option<&'static str> {
+    KEY.map(str::trim).filter(|k| !k.is_empty())
+}
+
+/// What the window needs to ask and record, when this run may share usage: the build has a key,
+/// `FIELDCRAFT_TELEMETRY` is not `0`, and neither CI nor `--control` automation runs it (unless
+/// `FIELDCRAFT_TELEMETRY=1`).
+pub fn host(automation: bool) -> Option<UsageHost> {
+    let telemetry = std::env::var("FIELDCRAFT_TELEMETRY").ok();
+    let ci = std::env::var_os("CI").is_some_and(|v| !v.is_empty());
+    usage::allowed(key().is_some(), telemetry.as_deref(), automation, ci).then(|| UsageHost {
+        platform: "desktop",
+        os: std::env::consts::OS,
+        arch: std::env::consts::ARCH,
+        new_id: Box::new(new_id),
+    })
+}
+
+/// A random (version 4) UUID from the operating system's random source.
+fn new_id() -> Option<String> {
+    let mut b = [0u8; 16];
+    getrandom::fill(&mut b).ok()?;
+    b[6] = (b[6] & 0x0f) | 0x40;
+    b[8] = (b[8] & 0x3f) | 0x80;
+    let hex: String = b.iter().map(|x| format!("{x:02x}")).collect();
+    Some(format!("{}-{}-{}-{}-{}", &hex[..8], &hex[8..12], &hex[12..16], &hex[16..20], &hex[20..]))
+}
+
+/// The sending thread; [`Sender::finish`] sends what is left and stops it.
+pub struct Sender {
+    stop: mpsc::Sender<()>,
+    finished: mpsc::Receiver<()>,
+}
+
+/// Start the sending thread (only when the build has a key). `FIELDCRAFT_TELEMETRY_HOST`
+/// replaces PostHog's host, for checking the payload against a local listener.
+pub fn start() -> Option<Sender> {
+    let key = key()?;
+    let host = std::env::var("FIELDCRAFT_TELEMETRY_HOST").ok().filter(|h| !h.trim().is_empty()).unwrap_or_else(|| usage::DEFAULT_HOST.into());
+    let url = format!("{}/batch/", host.trim_end_matches('/'));
+    // rustls's process-wide crypto (ring); another part of the app may have installed it first.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .timeout_global(Some(TIMEOUT))
+        .tls_config(ureq::tls::TlsConfig::builder().root_certs(ureq::tls::RootCerts::PlatformVerifier).build())
+        .build()
+        .into();
+    let (stop, stopped) = mpsc::channel::<()>();
+    let (done, finished) = mpsc::channel::<()>();
+    let spawned = std::thread::Builder::new().name("fieldcraft usage".into()).spawn(move || {
+        loop {
+            let last = !matches!(stopped.recv_timeout(INTERVAL), Err(mpsc::RecvTimeoutError::Timeout));
+            while let Some(batch) = usage::take_batch() {
+                if let Err(e) = agent.post(&url).header("Content-Type", "application/json").send(batch.body(key)) {
+                    // Offline or refused: this batch is dropped, the rest waits for the next try.
+                    log::debug!("usage: {} event(s) not sent: {e}", batch.events.len());
+                    break;
+                }
+            }
+            if last {
+                let _ = done.send(());
+                return;
+            }
+        }
+    });
+    match spawned {
+        Ok(_) => Some(Sender { stop, finished }),
+        Err(e) => {
+            log::warn!("usage: no sending thread: {e}");
+            None
+        }
+    }
+}
+
+impl Sender {
+    /// Send what is queued (waiting briefly) and stop.
+    pub fn finish(self) {
+        let _ = self.stop.send(());
+        let _ = self.finished.recv_timeout(LAST_WAIT);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn install_ids_are_random_version_4_uuids() {
+        let (a, b) = (super::new_id().unwrap(), super::new_id().unwrap());
+        assert_ne!(a, b);
+        assert_eq!(a.len(), 36);
+        assert_eq!(a.as_bytes()[14], b'4');
+        assert!(matches!(a.as_bytes()[19], b'8' | b'9' | b'a' | b'b'), "{a}");
+    }
+}

assets/icons/diagnostics.bug_report.svg

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>diagnostics.bug_report</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M12 8.5 L12 8.5 C14.209 8.5 16 10.291 16 12.5 L16 15.5 C16 17.709 14.209 19.5 12 19.5 L12 19.5 C9.791 19.5 8 17.709 8 15.5 L8 12.5 C8 10.291 9.791 8.5 12 8.5 Z" fill="none" stroke="#dde2ea" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9.9 5.8 C9.9 4.64 10.84 3.7 12 3.7 C13.16 3.7 14.1 4.64 14.1 5.8 C14.1 6.96 13.16 7.9 12 7.9 C10.84 7.9 9.9 6.96 9.9 5.8 Z" fill="none" stroke="#dde2ea" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 10.5 L12 18" fill="none" stroke="#4f9ce8" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8 11.5 L4.8 9.8" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8 14.5 L4.4 14.5" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8.3 17.4 L5 19.4" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M16 11.5 L19.2 9.8" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M16 14.5 L19.6 14.5" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M15.7 17.4 L19 19.4" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/geometry.check.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.check</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M9 3 L16 6.5 L16 13 L9 16.5 L2 13 L2 6.5 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M2 6.5 L9 10 L16 6.5 M9 10 L9 16.5" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M2 6.5 L2 9.5" fill="none" stroke="#f0b44a" stroke-width="2.25" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M13.5 17 C13.5 15.067 15.067 13.5 17 13.5 C18.933 13.5 20.5 15.067 20.5 17 C20.5 18.933 18.933 20.5 17 20.5 C15.067 20.5 13.5 18.933 13.5 17 Z" fill="none" stroke="#4f9ce8" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M19.5 19.5 L22 22" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/geometry.datum.axis.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.datum.axis</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M7 17 L19 5" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M20 4 L15 5.2 M20 4 L18.8 9" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M5.5 18.5 L2.5 21.5" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="1.5 2"/>
+    <path d="M8.8 12 C8.8 10.233 10.233 8.8 12 8.8 C13.767 8.8 15.2 10.233 15.2 12 C15.2 13.767 13.767 15.2 12 15.2 C10.233 15.2 8.8 13.767 8.8 12 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M10.6 12 C10.6 11.227 11.227 10.6 12 10.6 C12.773 10.6 13.4 11.227 13.4 12 C13.4 12.773 12.773 13.4 12 13.4 C11.227 13.4 10.6 12.773 10.6 12 Z" fill="#f0b44a"/>
+  </g>
+</svg>

assets/icons/geometry.datum.point.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.datum.point</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 16 L9 10 L21 10 L15 16 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 3 L12 11 M8 7 L16 7" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M10.2 7 C10.2 6.006 11.006 5.2 12 5.2 C12.994 5.2 13.8 6.006 13.8 7 C13.8 7.994 12.994 8.8 12 8.8 C11.006 8.8 10.2 7.994 10.2 7 Z" fill="#f0b44a"/>
+    <path d="M12 12.5 L12 20" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="1.5 2"/>
+  </g>
+</svg>

assets/icons/geometry.face.absorb.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.face.absorb</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 8 L12 4 L21 8 L12 12 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M14.5 5.1 L17 6.2 L8 10.3 L5.5 9.2 Z" fill="#f0b44a" stroke="#f0b44a" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 8 L12 4 L21 8 L12 12 Z" fill="none" stroke="#4f9ce8" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/geometry.face.split.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.face.split</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 8 L12 4 L21 8 L12 12 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M7.5 10 L16.5 6" fill="none" stroke="#f0b44a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M5 4.5 L9 2.5 M15 9.5 L19 7.5" fill="none" stroke="#4f9ce8" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="1.5 1.5"/>
+  </g>
+</svg>

assets/icons/geometry.faces.merge.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.faces.merge</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 8 L12 4 L21 8 L12 12 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M7.5 6 L16.5 10" fill="none" stroke="#f0b44a" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="1.5 2"/>
+    <path d="M3 8 L12 4 L21 8 L12 12 Z" fill="none" stroke="#4f9ce8" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/geometry.stitch.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>geometry.stitch</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 6 L10.5 6 L10.5 18 L3 18 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M13.5 6 L21 6 L21 18 L13.5 18 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9 8.5 L15 8.5" fill="none" stroke="#f0b44a" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9 12 L15 12" fill="none" stroke="#f0b44a" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9 15.5 L15 15.5" fill="none" stroke="#f0b44a" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.block.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.block</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M4 6 L16 3 L20 15 L8 19 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8 5 L12.33 16.33 M12 4 L16.67 17.67 M5.33 10.33 L17.33 7 M6.67 14.67 L18.67 11" fill="none" stroke="#4f9ce8" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.export.stl.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.export.stl</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 9 L9 5 L15 9 L9 13 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 9 L3 17 L9 21 L9 13 M9 21 L15 17 L15 9" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 9 L9 21 M9 13 L15 17" fill="none" stroke="#dde2ea" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M15 15 L21 15 M18.19 16.53 L21 15 L18.19 13.47" fill="none" stroke="#4f9ce8" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.hex.extrude.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.hex.extrude</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M6 20 L18 20 L18 11.6 C14 9.467 10 9.467 6 11.6 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M6 17.2 L18 17.2 M6 14.4 C10 12.8 14 12.8 18 14.4 M10 20 L10 9.9 M14 20 L14 9.9" fill="none" stroke="#4f9ce8" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 9.2 C9 5.333 15 5.333 21 9.2" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 6 L12 3 M10.5 4.5 L12 3 L13.5 4.5" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.mirror.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.mirror</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M12 2 L12 22" fill="none" stroke="#4f9ce8" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="2 1.5"/>
+    <path d="M10 5 L3 7 L3 17 L10 19 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 12 L10 12 M6.5 6 L6.5 18" fill="none" stroke="#dde2ea" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M14 5 L21 7 L21 17 L14 19 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M14 12 L21 12 M17.5 6 L17.5 18" fill="none" stroke="#dde2ea" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.node.relax.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.node.relax</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 12 C3 7.029 7.029 3 12 3 C16.971 3 21 7.029 21 12 C21 16.971 16.971 21 12 21 C7.029 21 3 16.971 3 12 Z" fill="none" stroke="#dde2ea" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="2 2"/>
+    <path d="M5 12 L19 12 M12 5 L12 19" fill="none" stroke="#dde2ea" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M7.5 8 L16.5 8 M7.5 16 L16.5 16 M8 7.5 L8 16.5 M16 7.5 L16 16.5" fill="none" stroke="#dde2ea" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9.6 12 C9.6 10.675 10.675 9.6 12 9.6 C13.325 9.6 14.4 10.675 14.4 12 C14.4 13.325 13.325 14.4 12 14.4 C10.675 14.4 9.6 13.325 9.6 12 Z" fill="#4f9ce8" stroke="#4f9ce8" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.plan.svg

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.plan</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M12 3 L20 7 L20 16 L12 20 L4 16 L4 7 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M4 7 L12 11 L20 7 M12 11 L12 20" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M4 11.5 L12 15.5 L20 11.5 M8 9 L8 18 M16 9 L16 18" fill="none" stroke="#4f9ce8" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 3 L12 5.4 M20 7 L15.2 7 M12 11 L12 8.6 M4 7 L8.8 7" fill="none" stroke="#4f9ce8" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8.8 7 C8.8 7.884 10.233 8.6 12 8.6 C13.767 8.6 15.2 7.884 15.2 7 C15.2 6.116 13.767 5.4 12 5.4 C10.233 5.4 8.8 6.116 8.8 7 Z" fill="none" stroke="#f0b44a" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/mesh.quality.mark.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>mesh.quality.mark</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M3 3 L11 3 L11 11 L3 11 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M13 3 L21 3 L21 11 L13 11 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 13 L11 13 L11 21 L3 21 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M13 14 L21 13 L20 21 L14 19 Z" fill="#f0b44a" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/results.export.vtu.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>results.export.vtu</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M4 3 L12 3 L16 7 L16 21 L4 21 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 3 L12 7 L16 7" fill="none" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M7 17 L7 14 M10 17 L10 11 M13 17 L13 13" fill="none" stroke="#4f9ce8" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M15 15 L21 15 M18.19 16.53 L21 15 L18.19 13.47" fill="none" stroke="#4f9ce8" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

assets/icons/src/diagnostics.bug_report.json

@@ -0,0 +1 @@
+{"shapes": [{"rect": [8, 8.5, 8, 11], "radius": 4, "stroke": "line", "width": 1.6}, {"circle": [12, 5.8, 2.1], "stroke": "line", "width": 1.6}, {"line": [12, 10.5, 12, 18], "stroke": "accent", "width": 1.5}, {"line": [8, 11.5, 4.8, 9.8], "stroke": "line"}, {"line": [8, 14.5, 4.4, 14.5], "stroke": "line"}, {"line": [8.3, 17.4, 5, 19.4], "stroke": "line"}, {"line": [16, 11.5, 19.2, 9.8], "stroke": "line"}, {"line": [16, 14.5, 19.6, 14.5], "stroke": "line"}, {"line": [15.7, 17.4, 19, 19.4], "stroke": "line"}]}

assets/icons/src/geometry.check.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M9 3 L16 6.5 L16 13 L9 16.5 L2 13 L2 6.5 Z", "fill": "soft", "stroke": "line"}, {"d": "M2 6.5 L9 10 L16 6.5 M9 10 L9 16.5", "stroke": "line"}, {"line": [2, 6.5, 2, 9.5], "stroke": "warm", "width": 2.25}, {"circle": [17, 17, 3.5], "stroke": "accent", "width": 1.75}, {"line": [19.5, 19.5, 22, 22], "stroke": "accent", "width": 2}]}

assets/icons/src/geometry.datum.axis.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M7 17 L19 5", "stroke": "accent", "width": 2}, {"d": "M20 4 L15 5.2 M20 4 L18.8 9", "stroke": "accent", "width": 2}, {"d": "M5.5 18.5 L2.5 21.5", "stroke": "line", "dash": [1.5, 2]}, {"circle": [12, 12, 3.2], "fill": "soft", "stroke": "line", "width": 1.25}, {"circle": [12, 12, 1.4], "fill": "warm", "stroke": null}]}

assets/icons/src/geometry.datum.point.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 16 L9 10 L21 10 L15 16 Z", "fill": "soft", "stroke": "line", "width": 1.25}, {"d": "M12 3 L12 11 M8 7 L16 7", "stroke": "accent", "width": 2}, {"circle": [12, 7, 1.8], "fill": "warm", "stroke": null}, {"d": "M12 12.5 L12 20", "stroke": "line", "dash": [1.5, 2]}]}

assets/icons/src/geometry.face.absorb.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 8 L12 4 L21 8 L12 12 Z", "fill": "soft", "stroke": "line"}, {"d": "M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8", "stroke": "line"}, {"d": "M14.5 5.1 L17 6.2 L8 10.3 L5.5 9.2 Z", "fill": "warm", "stroke": "warm", "width": 1}, {"d": "M3 8 L12 4 L21 8 L12 12 Z", "stroke": "accent", "width": 1.75}]}

assets/icons/src/geometry.face.split.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 8 L12 4 L21 8 L12 12 Z", "fill": "soft", "stroke": "line"}, {"d": "M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8", "stroke": "line"}, {"line": [7.5, 10, 16.5, 6], "stroke": "warm", "width": 2}, {"d": "M5 4.5 L9 2.5 M15 9.5 L19 7.5", "stroke": "accent", "width": 1.5, "dash": [1.5, 1.5]}]}

assets/icons/src/geometry.faces.merge.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 8 L12 4 L21 8 L12 12 Z", "fill": "soft", "stroke": "line"}, {"d": "M3 8 L3 16 L12 20 L12 12 M12 20 L21 16 L21 8", "stroke": "line"}, {"line": [7.5, 6, 16.5, 10], "stroke": "warm", "width": 1.25, "dash": [1.5, 2]}, {"d": "M3 8 L12 4 L21 8 L12 12 Z", "stroke": "accent", "width": 1.75}]}

assets/icons/src/geometry.stitch.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 6 L10.5 6 L10.5 18 L3 18 Z", "fill": "soft", "stroke": "line"}, {"d": "M13.5 6 L21 6 L21 18 L13.5 18 Z", "fill": "soft", "stroke": "line"}, {"line": [9, 8.5, 15, 8.5], "stroke": "warm", "width": 1.75}, {"line": [9, 12, 15, 12], "stroke": "warm", "width": 1.75}, {"line": [9, 15.5, 15, 15.5], "stroke": "warm", "width": 1.75}]}

assets/icons/src/mesh.block.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M4 6 L16 3 L20 15 L8 19 Z", "fill": "soft", "stroke": "line"}, {"d": "M8 5 L12.33 16.33 M12 4 L16.67 17.67 M5.33 10.33 L17.33 7 M6.67 14.67 L18.67 11", "stroke": "accent", "width": 1}]}

assets/icons/src/mesh.export.stl.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M3 9 L9 5 L15 9 L9 13 Z", "fill": "soft", "stroke": "line"}, {"d": "M3 9 L3 17 L9 21 L9 13 M9 21 L15 17 L15 9", "stroke": "line"}, {"d": "M3 9 L9 21 M9 13 L15 17", "stroke": "line", "width": 1}, {"d": "M15 15 L21 15 M18.19 16.53 L21 15 L18.19 13.47", "stroke": "accent", "width": 1.5}]}

assets/icons/src/mesh.hex.extrude.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M6 20 L18 20 L18 11.6 Q12 8.4 6 11.6 Z", "fill": "soft", "stroke": "line"}, {"d": "M6 17.2 L18 17.2 M6 14.4 Q12 12 18 14.4 M10 20 L10 9.9 M14 20 L14 9.9", "stroke": "accent", "width": 1}, {"d": "M3 9.2 Q12 3.4 21 9.2", "stroke": "accent", "width": 2}, {"d": "M12 6 L12 3 M10.5 4.5 L12 3 L13.5 4.5", "stroke": "line"}]}

assets/icons/src/mesh.mirror.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M12 2 L12 22", "stroke": "accent", "width": 1.25, "dash": [2, 1.5]}, {"d": "M10 5 L3 7 L3 17 L10 19 Z", "fill": "soft", "stroke": "line"}, {"d": "M3 12 L10 12 M6.5 6 L6.5 18", "stroke": "line", "width": 1}, {"d": "M14 5 L21 7 L21 17 L14 19 Z", "fill": "soft", "stroke": "line"}, {"d": "M14 12 L21 12 M17.5 6 L17.5 18", "stroke": "line", "width": 1}]}

assets/icons/src/mesh.node.relax.json

@@ -0,0 +1 @@
+{"shapes": [{"circle": [12, 12, 9], "stroke": "line", "width": 1.25, "dash": [2, 2]}, {"d": "M5 12 L19 12 M12 5 L12 19", "stroke": "line", "width": 1.0}, {"d": "M7.5 8 L16.5 8 M7.5 16 L16.5 16 M8 7.5 L8 16.5 M16 7.5 L16 16.5", "stroke": "line", "width": 1.0}, {"circle": [12, 12, 2.4], "fill": "accent", "stroke": "accent"}]}

assets/icons/src/mesh.plan.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M12 3 L20 7 L20 16 L12 20 L4 16 L4 7 Z", "fill": "soft", "stroke": "line"}, {"d": "M4 7 L12 11 L20 7 M12 11 L12 20", "stroke": "line"}, {"d": "M4 11.5 L12 15.5 L20 11.5 M8 9 L8 18 M16 9 L16 18", "stroke": "accent", "width": 1}, {"d": "M12 3 L12 5.4 M20 7 L15.2 7 M12 11 L12 8.6 M4 7 L8.8 7", "stroke": "accent", "width": 1}, {"d": "M8.8 7 A3.2 1.6 0 1 0 15.2 7 A3.2 1.6 0 1 0 8.8 7 Z", "stroke": "warm", "width": 1.5}]}

assets/icons/src/mesh.quality.mark.json

@@ -0,0 +1 @@
+{"shapes": [{"rect": [3, 3, 8, 8], "fill": "soft", "stroke": "line"}, {"rect": [13, 3, 8, 8], "fill": "soft", "stroke": "line"}, {"rect": [3, 13, 8, 8], "fill": "soft", "stroke": "line"}, {"d": "M13 14 L21 13 L20 21 L14 19 Z", "fill": "warm", "stroke": "line"}]}

assets/icons/src/results.export.vtu.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M4 3 L12 3 L16 7 L16 21 L4 21 Z", "fill": "soft", "stroke": "line"}, {"d": "M12 3 L12 7 L16 7", "stroke": "line"}, {"d": "M7 17 L7 14 M10 17 L10 11 M13 17 L13 13", "stroke": "accent", "width": 2}, {"d": "M15 15 L21 15 M18.19 16.53 L21 15 L18.19 13.47", "stroke": "accent", "width": 1.5}]}

assets/icons/src/view.show_all.json

@@ -0,0 +1 @@
+{"shapes": [{"d": "M2.5 13 C5.5 7.5 18.5 7.5 21.5 13 C18.5 18.5 5.5 18.5 2.5 13 Z", "fill": "soft", "stroke": "line"}, {"circle": [12, 13, 2.6], "fill": "accent", "stroke": "accent", "width": 1}, {"d": "M12 2.5 L12 5 M5.5 4.5 L7 6.5 M18.5 4.5 L17 6.5", "stroke": "warm", "width": 1.5}]}

assets/icons/view.show_all.svg

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24">
+  <title>view.show_all</title>
+  <g id="Layer_1" data-name="Layer 1">
+    <path d="M2.5 13 C5.5 7.5 18.5 7.5 21.5 13 C18.5 18.5 5.5 18.5 2.5 13 Z" fill="#2d4e70" stroke="#dde2ea" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M9.4 13 C9.4 11.564 10.564 10.4 12 10.4 C13.436 10.4 14.6 11.564 14.6 13 C14.6 14.436 13.436 15.6 12 15.6 C10.564 15.6 9.4 14.436 9.4 13 Z" fill="#4f9ce8" stroke="#4f9ce8" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M12 2.5 L12 5 M5.5 4.5 L7 6.5 M18.5 4.5 L17 6.5" fill="none" stroke="#f0b44a" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </g>
+</svg>

crates/decks/src/abaqus.rs

@@ -85,6 +85,7 @@
 //! | tet4 | C3D4 (H) | | | |
 //! | tet10 | C3D10 (H) | | | |
 //! | wedge6 | C3D6 (H) | | | |
+//! | pyramid5 | C3D5 (H) | | | |
 //! | hex8 | C3D8, C3D8R, C3D8I (H) | | | |
 //! | hex20 | C3D20, C3D20R (H) | | | |
 //! | tri3, quad4 | | S3 / S3R, S4 / S4R | | |
@@ -148,7 +149,7 @@ use std::fmt::Write as _;
 
 use fieldcraft_model::{
     BeamProfile, BoundaryCondition, ContactSurfaces, CouplingKind, Elastic, Element, ElementKind, Hardening, Hyperelastic, InitialPenetration,
-    Integration, Load, Model, OutputVariable, Plastic, Procedure, Resolved, Section, SectionKind, Step, Symmetry, Target,
+    Integration, Load, Model, OutputVariable, Plastic, Procedure, Resolved, Section, SectionKind, Step, Target,
 };
 
 use crate::{Error, Result, unsupported};
@@ -193,6 +194,7 @@ pub fn write_resolved(model: &Model, r: &Resolved) -> Result<String> {
     d.couplings(model, r);
     d.contacts(model, r)?;
     d.ties(model)?;
+    d.equations(model, r)?;
     d.steps(model, r)?;
     Ok(d.out)
 }
@@ -230,11 +232,12 @@ pub fn element_type(kind: ElementKind, section: &Section) -> std::result::Result
         (S::Solid {}, _, true, true) => return Err("incompatible modes with reduced integration".into()),
         (S::Solid {}, _, _, true) => return Err(format!("incompatible modes on {} elements (hex8 only)", kind.name())),
         (S::Solid {}, K::Tet4, ..) => "C3D4",
-        (S::Solid {}, K::Tet10 | K::Wedge6, true, _) => {
+        (S::Solid {}, K::Tet10 | K::Wedge6 | K::Pyramid5, true, _) => {
             return Err(format!("reduced integration of {} elements (Abaqus has no reduced-integration variant)", kind.name()));
         }
         (S::Solid {}, K::Tet10, ..) => "C3D10",
         (S::Solid {}, K::Wedge6, ..) => "C3D6",
+        (S::Solid {}, K::Pyramid5, ..) => "C3D5",
         (S::Solid {}, K::Hex8, r, _) => ["C3D8", "C3D8R"][usize::from(r)],
         (S::Solid {}, K::Hex20, r, _) => ["C3D20", "C3D20R"][usize::from(r)],
         (S::Shell { .. }, K::Tri3, r, _) => ["S3", "S3R"][usize::from(r)],
@@ -370,9 +373,36 @@ fn check_expressible(model: &Model) -> Result<()> {
             bad.insert(format!("coupling `{name}`: an Abaqus distributing coupling always couples translations 1-3"));
         }
     }
+    for name in inclined_symmetries(model) {
+        if !model.steps().iter().all(|s| s.boundary_conditions.contains(name)) {
+            bad.insert(format!(
+                "boundary condition `{name}`: a symmetry plane not normal to X, Y or Z active in some steps only (it is written as `*EQUATION`, which is model data and holds in every step)"
+            ));
+        }
+    }
     unsupported(FORMAT, bad)
 }
 
+/// The symmetry conditions on inclined planes some step uses: linear equations rather than held
+/// degrees of freedom.
+fn inclined_symmetries(model: &Model) -> BTreeSet<&String> {
+    model
+        .boundary_conditions()
+        .iter()
+        .filter(|(n, bc)| {
+            matches!(bc, BoundaryCondition::Symmetry { plane, .. } if plane.axis().is_none()) && !model.boundary_condition_users(n).is_empty()
+        })
+        .map(|(n, _)| n)
+        .collect()
+}
+
+/// The boundary conditions of `names` that `*BOUNDARY` writes (inclined symmetry planes are
+/// `*EQUATION`s).
+fn held_conditions(model: &Model, names: &BTreeSet<String>) -> BTreeSet<String> {
+    let inclined = inclined_symmetries(model);
+    names.iter().filter(|n| !inclined.contains(n)).cloned().collect()
+}
+
 /// The property of a group of discrete elements.
 enum DiscreteProperty {
     Mass(f64),
@@ -1076,10 +1106,12 @@ impl Deck {
             match bc {
                 BoundaryCondition::Fixed { .. } => self.line(&format!("{target}, ENCASTRE")),
                 BoundaryCondition::Symmetry { plane, .. } => {
-                    let s = match plane {
-                        Symmetry::X => "XSYMM",
-                        Symmetry::Y => "YSYMM",
-                        Symmetry::Z => "ZSYMM",
+                    let s = match plane.axis() {
+                        Some(0) => "XSYMM",
+                        Some(1) => "YSYMM",
+                        Some(2) => "ZSYMM",
+                        // An inclined plane is an `*EQUATION` (model data), never here.
+                        _ => continue,
                     };
                     self.line(&format!("{target}, {s}"));
                 }
@@ -1097,8 +1129,74 @@ impl Deck {
         Ok(())
     }
 
+    /// The inclined symmetry planes: one `*EQUATION` per node and held direction (n · u = 0, and
+    /// the rotations about the plane's axes at shell and beam nodes), whose first term Abaqus
+    /// eliminates; it is chosen among the degrees of freedom no boundary condition, coupling
+    /// or tie constrains ([`crate::symmetry_equations`]).
+    fn equations(&mut self, model: &Model, r: &Resolved) -> Result<()> {
+        let inclined = inclined_symmetries(model);
+        if inclined.is_empty() {
+            return Ok(());
+        }
+        let steps = model.steps();
+        // Per node and degree of freedom: the value it is held at in each step that holds it.
+        let mut held: BTreeMap<(u32, u8), Vec<f64>> = BTreeMap::new();
+        for step in steps {
+            for name in held_conditions(model, &step.boundary_conditions) {
+                let Some(bc) = model.boundary_condition(&name) else { continue };
+                for &node in r.target_nodes(bc.target()) {
+                    for dof in bc.dofs().list() {
+                        let v = if matches!(step.procedure, Procedure::Frequency { .. } | Procedure::Buckle { .. }) {
+                            0.0
+                        } else {
+                            bc.value(dof).unwrap_or(0.0)
+                        };
+                        held.entry((node, dof)).or_default().push(v);
+                    }
+                }
+            }
+        }
+        let mut dependent: BTreeSet<(u32, u8)> = BTreeSet::new();
+        for c in model.couplings().values().filter(|c| c.kind == CouplingKind::Kinematic) {
+            for &node in r.sets.get(&c.set).map(|s| s.nodes.as_slice()).unwrap_or_default() {
+                dependent.extend(c.dofs.list().into_iter().map(|d| (node, d)));
+            }
+        }
+        for t in model.ties().values() {
+            for &node in r.sets.get(&t.secondary).map(|s| s.nodes.as_slice()).unwrap_or_default() {
+                dependent.extend((1..=6).map(|d| (node, d)));
+            }
+        }
+        let state = |node: u32, dof: u8| {
+            if dependent.contains(&(node, dof)) {
+                return crate::Held::Sometimes;
+            }
+            match held.get(&(node, dof)) {
+                None => crate::Held::Free,
+                Some(v) if v.len() == steps.len() && v.iter().all(|x| *x == v[0]) => crate::Held::Always(v[0]),
+                Some(_) => crate::Held::Sometimes,
+            }
+        };
+        let mut problems = BTreeSet::new();
+        let equations = crate::symmetry_equations(model, r, inclined, &model.rotating_nodes(), state, &mut problems);
+        unsupported(FORMAT, problems)?;
+        self.comment("Symmetry planes not normal to X, Y or Z: per node, no motion along the normal (and no rotation about the plane's axes)");
+        for e in &equations {
+            self.line("*EQUATION");
+            self.line(&e.terms.len().to_string());
+            let mut fields = Vec::new();
+            for (dof, c) in &e.terms {
+                fields.push(format!("{}, {dof}", e.node));
+                fields.push(number(*c)?);
+            }
+            self.line(&fields.join(", "));
+        }
+        Ok(())
+    }
+
     /// Boundary conditions of a step against the state it starts from.
     fn step_boundaries(&mut self, model: &Model, r: &Resolved, base: &BTreeSet<String>, active: &BTreeSet<String>) -> Result<()> {
+        let (base, active) = (&held_conditions(model, base), &held_conditions(model, active));
         if active == base {
             self.comment("boundary conditions: as in the base state");
             Ok(())
@@ -1188,7 +1286,8 @@ impl Deck {
             BTreeSet::new()
         } else {
             let in_every_step = |n: &String| steps.iter().all(|s| s.boundary_conditions.contains(n));
-            model.boundary_conditions().iter().filter(|(n, bc)| holds_at_zero(bc) && in_every_step(n)).map(|(n, _)| n.clone()).collect()
+            let all = model.boundary_conditions().iter().filter(|(n, bc)| holds_at_zero(bc) && in_every_step(n)).map(|(n, _)| n.clone()).collect();
+            held_conditions(model, &all)
         };
         if !initial.is_empty() {
             self.comment("Initial state: boundary conditions active in every step");

crates/decks/src/lib.rs

@@ -16,7 +16,7 @@ pub mod nastran;
 use std::collections::{BTreeMap, BTreeSet};
 
 use fieldcraft_model::nodal::edge_pressure;
-use fieldcraft_model::{Diagnostic, Load, Model, Resolved, ResolvedDirection};
+use fieldcraft_model::{BoundaryCondition, Diagnostic, Load, Model, Resolved, ResolvedDirection};
 
 #[derive(Debug, Clone, PartialEq, thiserror::Error)]
 pub enum Error {
@@ -176,6 +176,120 @@ pub fn edge_pressure_loads<'a>(model: &Model, r: &Resolved, active: impl IntoIte
     Ok(out)
 }
 
+/// How a degree of freedom is constrained apart from the inclined symmetry planes, for choosing
+/// the dependent one of a plane's equation (formats eliminate it, so it may carry no other
+/// constraint).
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub(crate) enum Held {
+    Free,
+    /// Held at this value wherever the equation applies: it cannot depend on the others, and an
+    /// equation of held ones alone is redundant when the values satisfy it.
+    Always(f64),
+    /// Held in some steps only, or made dependent by a coupling or tie: it cannot be dependent,
+    /// nor can the equation be dropped.
+    Sometimes,
+}
+
+/// A linear equation Σ cⱼ u(node, dofⱼ) = 0 of an inclined symmetry plane, dependent degree of
+/// freedom first.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct Equation {
+    pub node: u32,
+    pub terms: Vec<(u8, f64)>,
+}
+
+/// A coefficient below this fraction of its row's largest is round-off of the elimination.
+const NEGLIGIBLE: f64 = 1e-12;
+
+/// The equations of the inclined symmetry conditions `names` (others are skipped), node by node
+/// in label order: n · u = 0 and, at a node in `rotating`, t₁ · θ = 0 and t₂ · θ = 0 for the
+/// plane's in-plane axes ([`fieldcraft_model::Symmetry`]). The rows of one node (several planes
+/// meet at an edge) are reduced against each other, so each has a dependent degree of freedom
+/// of its own: the largest coefficient among those `held` says are free. A row of held degrees
+/// of freedom only is left out when their values satisfy it; otherwise it is a problem, as is a
+/// row with none free that cannot be left out.
+pub(crate) fn symmetry_equations<'a>(
+    model: &Model,
+    r: &Resolved,
+    names: impl IntoIterator<Item = &'a String>,
+    rotating: &BTreeSet<u32>,
+    held: impl Fn(u32, u8) -> Held,
+    problems: &mut BTreeSet<String>,
+) -> Vec<Equation> {
+    let mut rows: BTreeMap<u32, Vec<(&str, [f64; 6])>> = BTreeMap::new();
+    let mut seen = BTreeSet::new();
+    for name in names {
+        if !seen.insert(name.as_str()) {
+            continue;
+        }
+        let Some(BoundaryCondition::Symmetry { target, plane }) = model.boundary_condition(name) else { continue };
+        let (Some(n), Some([t1, t2])) = (plane.inclined(), plane.in_plane()) else { continue };
+        for &node in r.target_nodes(target) {
+            let at = rows.entry(node).or_default();
+            at.push((name, [n[0], n[1], n[2], 0.0, 0.0, 0.0]));
+            if rotating.contains(&node) || target.reference_point().is_some() {
+                at.push((name, [0.0, 0.0, 0.0, t1[0], t1[1], t1[2]]));
+                at.push((name, [0.0, 0.0, 0.0, t2[0], t2[1], t2[2]]));
+            }
+        }
+    }
+    let mut out = Vec::new();
+    for (node, rows) in rows {
+        // The equations of this node so far: (dependent index, coefficients).
+        let mut done: Vec<(usize, [f64; 6])> = Vec::new();
+        for (name, mut c) in rows {
+            let scale = c.iter().fold(0.0f64, |m, v| m.max(v.abs()));
+            for (d, e) in &done {
+                let f = c[*d] / e[*d];
+                for k in 0..6 {
+                    c[k] -= f * e[k];
+                }
+                c[*d] = 0.0;
+            }
+            for v in &mut c {
+                if v.abs() <= NEGLIGIBLE * scale {
+                    *v = 0.0;
+                }
+            }
+            if c.iter().all(|v| *v == 0.0) {
+                continue;
+            }
+            let dof = |k: usize| k as u8 + 1;
+            let pivot = (0..6).filter(|&k| c[k] != 0.0 && held(node, dof(k)) == Held::Free).fold(None, |best: Option<usize>, k| match best {
+                Some(b) if c[b].abs() >= c[k].abs() => Some(b),
+                _ => Some(k),
+            });
+            let Some(pivot) = pivot else {
+                let mut residual = 0.0;
+                let mut size = 0.0;
+                let mut always = true;
+                for k in (0..6).filter(|&k| c[k] != 0.0) {
+                    match held(node, dof(k)) {
+                        Held::Always(v) => {
+                            residual += c[k] * v;
+                            size += (c[k] * v).abs();
+                        }
+                        _ => always = false,
+                    }
+                }
+                if !always {
+                    problems.insert(format!(
+                        "boundary condition `{name}`: at node {node} every degree of freedom the inclined symmetry plane relates is held in some steps only or follows a coupling or tie, so none can be eliminated by its equation"
+                    ));
+                } else if residual.abs() > 1e-9 * size {
+                    problems.insert(format!("boundary condition `{name}`: node {node} is held off the inclined symmetry plane"));
+                }
+                continue;
+            };
+            let mut terms = vec![(dof(pivot), c[pivot])];
+            terms.extend((0..6).filter(|&k| k != pivot && c[k] != 0.0).map(|k| (dof(k), c[k])));
+            out.push(Equation { node, terms });
+            done.push((pivot, c));
+        }
+    }
+    out
+}
+
 /// The global degree of freedom (1–6) a spring or dashpot direction acts along, when it is one
 /// (a vector or line along an axis counts: the sign does not matter to a spring).
 pub(crate) fn axis_dof(d: ResolvedDirection) -> Option<u8> {

crates/decks/src/lsdyna/elements.rs

@@ -36,7 +36,7 @@ impl Keyword {
     pub(crate) fn of(kind: ElementKind) -> Keyword {
         match kind {
             ElementKind::Hex20 => Keyword::SolidH20,
-            ElementKind::Tet4 | ElementKind::Tet10 | ElementKind::Wedge6 | ElementKind::Hex8 => Keyword::Solid,
+            ElementKind::Tet4 | ElementKind::Tet10 | ElementKind::Wedge6 | ElementKind::Pyramid5 | ElementKind::Hex8 => Keyword::Solid,
             ElementKind::Tri3 | ElementKind::Tri6 | ElementKind::Quad4 | ElementKind::Quad8 => Keyword::Shell,
             ElementKind::Rod2 | ElementKind::Rod3 | ElementKind::Beam2 => Keyword::Beam,
         }
@@ -64,6 +64,8 @@ pub(crate) fn order(kind: ElementKind) -> &'static [usize] {
         ElementKind::Tet4 => &[0, 1, 2, 3, 3, 3, 3, 3],
         ElementKind::Tet10 => &[0, 1, 2, 3, 4, 5, 6, 8, 9, 7],
         ElementKind::Wedge6 => &[1, 0, 3, 4, 2, 2, 5, 5],
+        // The degenerate hexahedron: the base, then the apex four times.
+        ElementKind::Pyramid5 => &[0, 1, 2, 3, 4, 4, 4, 4],
         ElementKind::Hex8 => &[0, 1, 2, 3, 4, 5, 6, 7],
         ElementKind::Hex20 => &[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19],
     }
@@ -95,7 +97,7 @@ pub(crate) struct Elform {
 ///
 /// Solids: hex8 2 (eight-point), reduced 1 (one-point) with hourglass control, incompatible
 /// modes −18 (eight-point enhanced strain with incompatible modes); wedges 2 (as degenerate
-/// hexahedra), reduced 15 (two-point pentahedron); tet4 10 (one point, exact for a linear
+/// hexahedra), reduced 15 (two-point pentahedron); pyramids 2 (as degenerate hexahedra); tet4 10 (one point, exact for a linear
 /// tetrahedron), hybrid 13 (nodal pressure); tet10 16; hex20 23. Shells: quad4 16 (fully
 /// integrated), reduced 2 (one-point) with hourglass control; tri3 4 (C0 triangle); quad8 23;
 /// tri6 24. Rods: 3 (truss). 2D (in the XY plane): plane stress 12, plane strain 13, both one-point
@@ -122,6 +124,8 @@ pub(crate) fn elform(kind: ElementKind, section: &SectionKind, f: Formulation, s
                 ElementKind::Hex8 => plain(2),
                 ElementKind::Wedge6 if reduced => plain(15),
                 ElementKind::Wedge6 => plain(2),
+                ElementKind::Pyramid5 if reduced => no("there is no reduced-integration form of"),
+                ElementKind::Pyramid5 => plain(2),
                 ElementKind::Tet4 => plain(10),
                 _ if reduced && kind.is_quadratic() => no("there is no reduced-integration form of"),
                 ElementKind::Tet10 => plain(16),

crates/decks/src/lsdyna/mod.rs

@@ -40,7 +40,8 @@
 //!   LS-DYNA's defaults; a step without nonlinear geometry and hyperelastic materials in nonlinear
 //!   steps are refused); boundary conditions
 //!   as `*BOUNDARY_SPC_*_ID` (named) and `*BOUNDARY_PRESCRIBED_MOTION_*_ID` for non-zero
-//!   displacements; forces, moments and tractions as `*LOAD_NODE_SET`/`_POINT` from the
+//!   displacements, a symmetry plane not normal to X, Y or Z as `*BOUNDARY_SPC_*_ID` in a
+//!   `*DEFINE_COORDINATE_SYSTEM` whose x axis is the plane's normal; forces, moments and tractions as `*LOAD_NODE_SET`/`_POINT` from the
 //!   resolved nodal values; pressure as `*LOAD_SEGMENT_SET`; gravity as `*LOAD_BODY_X/Y/Z`
 //!   (with `*LOAD_BODY_PARTS` when it acts on a set); output as `*DATABASE_BINARY_D3PLOT`,
 //!   `*DATABASE_SPCFORC` and `*DATABASE_EXTENT_BINARY`.
@@ -1048,6 +1049,24 @@ fn boundary_condition(
             (r.reference_point_nodes.get(p).copied().ok_or_else(|| broken(format!("boundary condition `{name}`: reference point `{p}`")))?, "NODE")
         }
     };
+    // A symmetry plane not normal to an axis: held in a coordinate system whose x axis is its
+    // normal and whose xy plane holds its first in-plane axis (translation x, rotations y and z).
+    if let BoundaryCondition::Symmetry { plane, .. } = bc
+        && let (Some(n), Some([t1, _])) = (plane.inclined(), plane.in_plane())
+    {
+        *constraint_id = constraint_id.saturating_add(1);
+        let cid = *constraint_id;
+        d.line("*DEFINE_COORDINATE_SYSTEM");
+        d.header(&["cid", "xo", "yo", "zo", "xl", "yl", "zl", "cidl"]);
+        d.card([Field::from(cid), Field::from(0.0), Field::from(0.0), Field::from(0.0), Field::from(n[0]), Field::from(n[1]), Field::from(n[2])]);
+        d.header(&["xp", "yp", "zp"]);
+        d.card([Field::from(t1[0]), Field::from(t1[1]), Field::from(t1[2])]);
+        d.line(&format!("*BOUNDARY_SPC_{suffix}_ID"));
+        id_card(d, constraint_id, name);
+        d.header(&["nsid", "cid", "dofx", "dofy", "dofz", "dofrx", "dofry", "dofrz"]);
+        d.card([Field::from(entity), Field::from(cid)].into_iter().chain([1, 0, 0, 0, 1, 1].map(|v: i32| Field::from(v))));
+        return Ok(());
+    }
     let dofs = bc.dofs();
     // Held degrees of freedom (in a frequency step every constrained one is held).
     let held: Vec<u8> = dofs.list().into_iter().filter(|dof| !is_static || bc.value(*dof).is_none_or(|v| v == 0.0)).collect();

crates/decks/src/nastran/mod.rs

@@ -6,7 +6,7 @@
 //! data (the entries). What the model holds becomes:
 //!
 //! - nodes and reference points: `GRID`;
-//! - solids: `CTETRA` (tet4, tet10), `CPENTA` (wedge6), `CHEXA` (hex8, hex20) with `PSOLID`;
+//! - solids: `CTETRA` (tet4, tet10), `CPENTA` (wedge6), `CPYRAM` (pyramid5), `CHEXA` (hex8, hex20) with `PSOLID`;
 //!   shells: `CTRIA3`, `CQUAD4`, `CTRIA6`, `CQUAD8` with `PSHELL`; beams: `CBEAM` with `PBEAML`;
 //!   rods: `CROD` with `PROD`. Nastran numbers a 20-node hexahedron's mid-side nodes bottom
 //!   edges, vertical edges, top edges, where the model has bottom, top, vertical
@@ -22,6 +22,9 @@
 //!   the basic X axis through a `CORD2R`;
 //! - boundary conditions: per step, one constraint set of `SPC1` (held degrees of freedom) and
 //!   `SPC` (prescribed values); in a modes step every constrained degree of freedom is held;
+//!   symmetry about a plane not normal to X, Y or Z: one `MPC` set per step, an equation per node
+//!   and held direction (n · u = 0, and t · θ = 0 about the plane's two axes at shell and beam
+//!   grids), its dependent component one no `SPC` or rigid element constrains;
 //! - forces, moments and tractions: `FORCE` and `MOMENT` at the nodal values the model resolves,
 //!   so every writer and the solver share one distribution; pressure: `PLOAD4` per element face;
 //!   gravity: `GRAV`; a step with several loads combines them with `LOAD`;
@@ -110,6 +113,7 @@ pub fn element_card(kind: ElementKind) -> &'static str {
         ElementKind::Quad8 => "CQUAD8",
         ElementKind::Tet4 | ElementKind::Tet10 => "CTETRA",
         ElementKind::Wedge6 => "CPENTA",
+        ElementKind::Pyramid5 => "CPYRAM",
         ElementKind::Hex8 | ElementKind::Hex20 => "CHEXA",
     }
 }
@@ -241,6 +245,8 @@ type Constraints = BTreeMap<u32, [Option<f64>; 6]>;
 struct Subcase<'m> {
     step: &'m Step,
     spc: Option<u32>,
+    /// The equations of its inclined symmetry planes.
+    mpc: Option<u32>,
     load: Option<u32>,
     method: Option<u32>,
 }
@@ -269,6 +275,8 @@ struct Deck<'m> {
     dependent: BTreeMap<u32, (Dofs, &'m str)>,
     /// Constraint sets by id.
     spc_sets: Vec<(u32, Constraints)>,
+    /// Multipoint constraint sets (inclined symmetry planes) by id.
+    mpc_sets: Vec<(u32, Vec<crate::Equation>)>,
     /// Load name → load set id.
     load_sids: BTreeMap<&'m str, u32>,
     /// Combinations: (id, load set ids).
@@ -310,7 +318,7 @@ impl<'m> Deck<'m> {
             model,
             r,
             sol,
-            subcases: steps.into_iter().map(|step| Subcase { step, spc: None, load: None, method: None }).collect(),
+            subcases: steps.into_iter().map(|step| Subcase { step, spc: None, mpc: None, load: None, method: None }).collect(),
             problems,
             next_sid: 1,
             materials: BTreeMap::new(),
@@ -321,6 +329,7 @@ impl<'m> Deck<'m> {
             discrete: Vec::new(),
             dependent: BTreeMap::new(),
             spc_sets: Vec::new(),
+            mpc_sets: Vec::new(),
             load_sids: BTreeMap::new(),
             combinations: Vec::new(),
         }
@@ -587,6 +596,7 @@ impl<'m> Deck<'m> {
     /// One constraint set per distinct step constraint, checked against coupled nodes.
     fn plan_constraints(&mut self) -> Result<()> {
         let (model, r) = (self.model, self.r);
+        let rotating = model.rotating_nodes();
         // Conflicts, one problem per pair of definitions: the nodes they meet on.
         let mut clashes: BTreeMap<(&str, &str, &str), BTreeSet<u32>> = BTreeMap::new();
         let mut on_dependent: BTreeMap<(&str, &str), BTreeSet<u32>> = BTreeMap::new();
@@ -598,6 +608,10 @@ impl<'m> Deck<'m> {
             for name in &step.boundary_conditions {
                 let Some(bc) = model.boundary_condition(name) else { continue };
                 let dofs = bc.dofs();
+                // Inclined symmetry planes hold no global degree of freedom: they are equations.
+                if dofs.is_empty() {
+                    continue;
+                }
                 // In a modes step every constrained degree of freedom is held.
                 let values: Vec<(u8, f64)> = dofs.list().into_iter().filter_map(|d| Some((d, if modes { 0.0 } else { bc.value(d)? }))).collect();
                 for &node in r.target_nodes(bc.target()) {
@@ -622,6 +636,19 @@ impl<'m> Deck<'m> {
                     }
                 }
             }
+            let dependent = &self.dependent;
+            let held = |node: u32, dof: u8| match (
+                dependent.get(&node),
+                set.get(&node).and_then(|v| v.get(usize::from(dof).checked_sub(1)?).copied().flatten()),
+            ) {
+                (Some((d, _)), _) if d.contains(dof) => crate::Held::Sometimes,
+                (_, Some(v)) => crate::Held::Always(v),
+                _ => crate::Held::Free,
+            };
+            let equations = crate::symmetry_equations(model, r, &step.boundary_conditions, &rotating, held, &mut self.problems);
+            if !equations.is_empty() {
+                sub.mpc = Some(intern(&mut self.mpc_sets, &mut self.next_sid, equations)?);
+            }
             if !set.is_empty() {
                 sub.spc = Some(intern(&mut self.spc_sets, &mut self.next_sid, set)?);
             }
@@ -707,7 +734,7 @@ impl<'m> Deck<'m> {
             let _ = writeln!(out, "SUBCASE {}", i + 1);
             let title: String = format!("  SUBTITLE = {}", sub.step.name).chars().take(72).collect();
             let _ = writeln!(out, "{title}");
-            for (key, sid) in [("SPC", sub.spc), ("LOAD", sub.load), ("METHOD", sub.method)] {
+            for (key, sid) in [("SPC", sub.spc), ("MPC", sub.mpc), ("LOAD", sub.load), ("METHOD", sub.method)] {
                 if let Some(sid) = sid {
                     let _ = writeln!(out, "  {key} = {sid}");
                 }
@@ -715,6 +742,7 @@ impl<'m> Deck<'m> {
             for v in &sub.step.output {
                 let request = match v {
                     OutputVariable::Displacement => "DISPLACEMENT",
+                    OutputVariable::ReactionForce if sub.mpc.is_some() => "SPCFORCES = ALL\n  MPCFORCES",
                     OutputVariable::ReactionForce => "SPCFORCES",
                     OutputVariable::Stress => "STRESS",
                     OutputVariable::Strain => "STRAIN",
@@ -892,6 +920,23 @@ impl<'m> Deck<'m> {
                 Card::new("SPC").int(*sid).int(node).int(component(Dofs::from_bits(mask))).real(value).write(out)?;
             }
         }
+        for (sid, equations) in &self.mpc_sets {
+            for sub in self.subcases.iter().filter(|s| s.mpc == Some(*sid)) {
+                comment(out, &format!("step {}: inclined symmetry planes, MPC {sid} (the first grid component is dependent)", sub.step.name));
+            }
+            for e in equations {
+                // SID, then (G, C, A) triples: two on the first line (its last field blank), two
+                // per continuation after a blank first field.
+                let mut card = Card::new("MPC").int(*sid);
+                for (i, (dof, c)) in e.terms.iter().enumerate() {
+                    if i % 2 == 0 && i > 0 {
+                        card = card.blank().blank();
+                    }
+                    card = card.int(e.node).int(i64::from(*dof)).real(*c);
+                }
+                card.write(out)?;
+            }
+        }
         Ok(())
     }
 

crates/decks/tests/abaqus.rs

@@ -461,10 +461,11 @@ fn written_connectivity_has_a_positive_jacobian_in_abaqus_conventions() {
 #[test]
 fn model_faces_are_abaqus_faces() {
     // Each face's node positions (1-based, Abaqus element library, our transcription).
-    let table: [(ElementKind, &[&[usize]]); 3] = [
+    let table: [(ElementKind, &[&[usize]]); 4] = [
         (ElementKind::Hex8, &[&[1, 2, 3, 4], &[5, 8, 7, 6], &[1, 5, 6, 2], &[2, 6, 7, 3], &[3, 7, 8, 4], &[4, 8, 5, 1]]),
         (ElementKind::Tet4, &[&[1, 2, 3], &[1, 4, 2], &[2, 4, 3], &[3, 4, 1]]),
         (ElementKind::Wedge6, &[&[1, 2, 3], &[4, 6, 5], &[1, 4, 5, 2], &[2, 5, 6, 3], &[3, 6, 4, 1]]),
+        (ElementKind::Pyramid5, &[&[1, 2, 3, 4], &[1, 5, 2], &[2, 5, 3], &[3, 5, 4], &[4, 5, 1]]),
     ];
     for (kind, faces) in table {
         assert_eq!(kind.faces().len(), faces.len());

crates/decks/tests/inclined_symmetry.rs

@@ -0,0 +1,193 @@
+//! Symmetry about a plane not normal to X, Y or Z in the three decks (#242): Abaqus `*EQUATION`s,
+//! Nastran `MPC` sets and an LS-DYNA `*BOUNDARY_SPC` in a local coordinate system, on a small
+//! shell plate of our own whose diagonal x = y is the plane.
+
+use fieldcraft_decks::{Error, abaqus, lsdyna, nastran};
+use fieldcraft_model::{
+    BoundaryCondition, Elastic, ElementFace, ElementKind, Formulation, Load, Material, Model, Procedure, Section, SectionKind, Set, Step, Symmetry,
+    Target,
+};
+
+/// A 2 × 2 quad4 shell plate in the XY plane (nodes 1–9, x and y in 0, 1, 2), clamped on x = 0,
+/// the inclined plane (normal (1, −1, 0)) on the diagonal nodes 1, 5 and 9, under pressure;
+/// steps `Load` (static) and `Modes`, `in_modes` saying whether the plane is active in both.
+fn plate(in_modes: bool) -> Model {
+    let mut m = Model::default();
+    for j in 0..3u32 {
+        for i in 0..3u32 {
+            m.set_node(1 + i + 3 * j, [f64::from(i), f64::from(j), 0.0]).unwrap();
+        }
+    }
+    for (e, n) in [(1, [1, 2, 5, 4]), (2, [2, 3, 6, 5]), (3, [4, 5, 8, 7]), (4, [5, 6, 9, 8])] {
+        m.set_element(e, ElementKind::Quad4, n.to_vec()).unwrap();
+    }
+    m.add_material(
+        "Steel",
+        Material { elastic: Some(Elastic::Isotropic { young: 210e3, poisson: 0.3 }), density: Some(7.85e-9), ..Material::default() },
+    )
+    .unwrap();
+    m.add_set("all", Set { elements: vec![1, 2, 3, 4], ..Set::default() }).unwrap();
+    let kind = SectionKind::Shell { thickness: 0.1, offset: 0.0, points: 5 };
+    m.add_section("plate", Section { set: "all".into(), material: "Steel".into(), kind, formulation: Formulation::default() }).unwrap();
+    m.add_set("edge", Set { nodes: vec![1, 4, 7], ..Set::default() }).unwrap();
+    m.add_set("diagonal", Set { nodes: vec![1, 5, 9], ..Set::default() }).unwrap();
+    let faces = (1..=4).map(|element| ElementFace { element, face: 1 }).collect();
+    m.add_set("top", Set { faces, ..Set::default() }).unwrap();
+    m.add_boundary_condition("clamp", BoundaryCondition::Fixed { target: Target::Set("edge".into()) }).unwrap();
+    let plane = Symmetry::from_normal([1.0, -1.0, 0.0]).unwrap();
+    m.add_boundary_condition("sym", BoundaryCondition::Symmetry { target: Target::Set("diagonal".into()), plane }).unwrap();
+    m.add_load("q", Load::Pressure { set: "top".into(), magnitude: 0.01 }).unwrap();
+    let mut load = Step::new("Load", Procedure::Static {});
+    load.boundary_conditions = ["clamp", "sym"].map(String::from).into();
+    load.loads = ["q".to_string()].into();
+    m.add_step(load, None).unwrap();
+    let mut modes = Step::new("Modes", Procedure::Frequency { modes: 3, min_hz: None, max_hz: None });
+    modes.boundary_conditions = if in_modes { ["clamp", "sym"].map(String::from).into() } else { ["clamp".to_string()].into() };
+    m.add_step(modes, None).unwrap();
+    m
+}
+
+/// A Nastran real: an exponent may come without `E`.
+fn real(s: &str) -> f64 {
+    let split = s.char_indices().skip(1).find(|(i, c)| (*c == '+' || *c == '-') && !s[..*i].ends_with(['E', 'e']));
+    match split {
+        Some((i, _)) => format!("{}E{}", &s[..i], &s[i..]).parse().unwrap(),
+        None => s.parse().unwrap(),
+    }
+}
+
+fn dot(a: [f64; 3], b: [f64; 3]) -> f64 {
+    (0..3).map(|k| a[k] * b[k]).sum()
+}
+
+/// Every equation is one of the plane's at a free node: its terms on one node, its coefficients
+/// along the normal (translations) or along an in-plane axis (rotations), unit length; nodes 5
+/// and 9 get three each (n · u, t₁ · θ, t₂ · θ); node 1 is clamped, so its equations are left out;
+/// no dependent degree of freedom repeats.
+fn check(equations: &[(u32, Vec<(u8, f64)>)]) {
+    let n = [1.0 / 2f64.sqrt(), -1.0 / 2f64.sqrt(), 0.0];
+    let mut dependents = std::collections::BTreeSet::new();
+    let mut per_node = std::collections::BTreeMap::<u32, usize>::new();
+    for (node, terms) in equations {
+        assert!(dependents.insert((*node, terms[0].0)), "{node} {terms:?}");
+        *per_node.entry(*node).or_default() += 1;
+        let mut v = [0.0; 3];
+        let rotation = terms[0].0 > 3;
+        for (dof, c) in terms {
+            assert_eq!(*dof > 3, rotation, "{terms:?}");
+            v[usize::from((dof - 1) % 3)] = *c;
+        }
+        assert!((dot(v, v) - 1.0).abs() < 1e-12, "{terms:?}");
+        if rotation {
+            assert!(dot(v, n).abs() < 1e-12, "{terms:?}");
+        } else {
+            assert!((dot(v, n).abs() - 1.0).abs() < 1e-12, "{terms:?}");
+        }
+    }
+    assert_eq!(per_node, [(5, 3), (9, 3)].into());
+}
+
+#[test]
+fn abaqus_writes_equations_in_the_model_data() {
+    let deck = abaqus::write(&plate(true)).unwrap();
+    let lines: Vec<&str> = deck.lines().collect();
+    let mut equations = Vec::new();
+    for (i, l) in lines.iter().enumerate() {
+        if *l == "*EQUATION" {
+            let count: usize = lines[i + 1].trim().parse().unwrap();
+            let f: Vec<&str> = lines[i + 2].split(',').map(str::trim).collect();
+            assert_eq!(f.len(), 3 * count, "{}", lines[i + 2]);
+            let node: u32 = f[0].parse().unwrap();
+            let terms = f.chunks(3).map(|t| (t[1].parse().unwrap(), t[2].parse().unwrap())).collect();
+            assert!(f.chunks(3).all(|t| t[0] == f[0]));
+            equations.push((node, terms));
+        }
+    }
+    check(&equations);
+    // Model data, before the first step; the plane is no `*BOUNDARY` line.
+    let first_step = deck.find("*STEP").unwrap();
+    assert!(deck.rfind("*EQUATION").unwrap() < first_step);
+    assert!(!deck.contains("SYMM"), "{deck}");
+
+    let e = abaqus::write(&plate(false)).unwrap_err();
+    assert!(matches!(&e, Error::Unsupported { what, .. } if what.contains("boundary condition `sym`") && what.contains("some steps only")), "{e}");
+}
+
+#[test]
+fn nastran_writes_one_mpc_set_per_step() {
+    // A static deck and a modes deck (one solution per run).
+    for (steps, sol) in [("Load", 101), ("Modes", 103)] {
+        let m = fieldcraft_decks::with_steps(&plate(true), &[steps.to_string()]).unwrap();
+        let deck = nastran::write(&m).unwrap();
+        assert!(deck.contains(&format!("SOL {sol}")));
+        let sid = deck.lines().find_map(|l| l.trim().strip_prefix("MPC = ")).unwrap().to_string();
+        // MPC entries: SID, then (grid, component, coefficient) triples; the continuation after
+        // two triples starts with a blank field. Large-field lines are 16 columns per field.
+        let mut equations = Vec::new();
+        let mut fields: Vec<String> = Vec::new();
+        let flush = |fields: &mut Vec<String>, equations: &mut Vec<(u32, Vec<(u8, f64)>)>| {
+            if fields.is_empty() {
+                return;
+            }
+            assert_eq!(fields[0], sid);
+            let data: Vec<&String> = fields[1..].iter().enumerate().filter(|(i, _)| !matches!(i % 8, 6 | 7)).map(|(_, f)| f).collect();
+            let triples: Vec<(u32, u8, f64)> = data
+                .chunks(3)
+                .filter(|t| t.len() == 3 && !t[0].is_empty())
+                .map(|t| (t[0].parse().unwrap(), t[1].parse().unwrap(), real(t[2])))
+                .collect();
+            assert!(triples.iter().all(|t| t.0 == triples[0].0));
+            equations.push((triples[0].0, triples.iter().map(|t| (t.1, t.2)).collect()));
+            fields.clear();
+        };
+        for line in deck.lines() {
+            let (head, rest) = line.split_at(8.min(line.len()));
+            let row: Vec<String> = rest.as_bytes().chunks(16).map(|c| String::from_utf8_lossy(c).trim().to_string()).collect();
+            let mut row = row;
+            row.resize(4, String::new());
+            match head.trim() {
+                "MPC*" => {
+                    flush(&mut fields, &mut equations);
+                    fields.extend(row);
+                }
+                "*" if !fields.is_empty() => fields.extend(row),
+                _ => flush(&mut fields, &mut equations),
+            }
+        }
+        flush(&mut fields, &mut equations);
+        check(&equations);
+    }
+}
+
+#[test]
+fn lsdyna_holds_the_plane_in_a_local_system() {
+    let deck = lsdyna::write(&plate(true)).unwrap().text;
+    let block = |keyword: &str| -> Vec<Vec<f64>> {
+        let at = deck.find(keyword).unwrap();
+        deck[at..]
+            .lines()
+            .skip(1)
+            .filter(|l| !l.starts_with('$'))
+            .take_while(|l| !l.starts_with('*'))
+            .map(|l| l.as_bytes().chunks(20).filter_map(|c| String::from_utf8_lossy(c).trim().parse().ok()).collect())
+            .collect()
+    };
+    let system = block("*DEFINE_COORDINATE_SYSTEM");
+    let (cid, x, p) = (system[0][0], [system[0][4], system[0][5], system[0][6]], [system[1][0], system[1][1], system[1][2]]);
+    assert!((x[0] + x[1]).abs() < 1e-12 && x[2] == 0.0 && (dot(x, x) - 1.0).abs() < 1e-12, "{x:?}");
+    assert!(dot(x, p).abs() < 1e-12, "{p:?}");
+    // The SPC after the system: its id card, then nsid, cid and the held local directions.
+    let at = deck.find("*DEFINE_COORDINATE_SYSTEM").unwrap();
+    let spc = deck[at..].find("*BOUNDARY_SPC_SET_ID").unwrap() + at;
+    let card: Vec<f64> = deck[spc..]
+        .lines()
+        .skip(2)
+        .find(|l| !l.starts_with('$'))
+        .unwrap()
+        .as_bytes()
+        .chunks(20)
+        .map(|c| String::from_utf8_lossy(c).trim().parse().unwrap())
+        .collect();
+    assert_eq!(card[1], cid);
+    assert_eq!(&card[2..], [1.0, 0.0, 0.0, 0.0, 1.0, 1.0]);
+}

crates/engine/Cargo.toml

@@ -25,6 +25,8 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
+# app.update.check (docs/updates.md); the browser build has no update check.
+fieldcraft-update = { workspace = true }
 
 [dev-dependencies]
 png = { workspace = true }

crates/engine/src/autosave.rs

@@ -47,6 +47,7 @@ impl Autosaver {
         let bytes = s.file_bytes(None)?;
         self.slot.write(&bytes, s.path.as_deref(), s.model.nodes().len(), s.model.elements().len())?;
         self.saved = Some(s.revision());
+        crate::crash::autosaved(s, &self.slot.file());
         Ok(true)
     }
 

crates/engine/src/bug_report.rs

@@ -0,0 +1,393 @@
+//! Bug report drafts (Help › Report a Bug, and Report it after a crash): a GitHub new-issue link
+//! that fills in the bug form (`.github/ISSUE_TEMPLATE/bug.yml`), and the files to attach.
+//!
+//! Nothing here sends anything. The user reviews the draft, then their browser opens the issue
+//! form, which they submit or not.
+//!
+//! What a draft holds by default: the version, the OS, what went wrong (the user's words, the
+//! last error or the crash's message) and, for a crash, where it happened. The user's home
+//! folder is shown as `~`. Only with **Share my session** does it also carry the commands that
+//! built the model (the replayable journal, which can name the user's files), and only with
+//! **Include the model** as well the model file. A session too long for the link (GitHub
+//! refuses long new-issue links) goes out as a file to attach and on the clipboard instead; the
+//! model file is always one to attach.
+
+use serde_json::{Value, json};
+
+use crate::crash::without_home;
+
+/// The issue form.
+pub const ISSUE_URL: &str = "https://github.com/tangency-labs/fieldcraft/issues/new";
+/// The longest link a draft opens: GitHub refuses new-issue links much past 8 KB.
+pub const MAX_URL: usize = 7000;
+/// The session file a draft attaches.
+pub const SESSION_FILE: &str = "fieldcraft-session.json";
+/// The model file a draft attaches.
+pub const MODEL_FILE: &str = "model.fieldcraft";
+/// Backtrace frames a crash's draft quotes.
+const FRAMES: usize = 12;
+/// A field's text is cut at this many bytes.
+const MAX_FIELD: usize = 3000;
+
+/// What to put in a draft.
+#[derive(Clone, Debug, Default)]
+pub struct Input {
+    pub title: String,
+    /// What happened: the user's words, or the last error.
+    pub observed: String,
+    /// A crash report (`crash::read`), when reporting one.
+    pub crash: Option<Value>,
+    /// Attach the replayable commands.
+    pub share_session: bool,
+    /// The commands (each `{command, params}`) that rebuild the model from `model` (or from an
+    /// empty model when there is none).
+    pub commands: Vec<Value>,
+    /// Attach the model file too (only with `share_session`).
+    pub include_model: bool,
+    pub model: Option<Vec<u8>>,
+}
+
+/// A file the user attaches to the issue.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Attachment {
+    pub name: String,
+    pub bytes: Vec<u8>,
+    /// What it is, for the review.
+    pub what: String,
+}
+
+/// A draft ready for review.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Draft {
+    pub title: String,
+    /// The bug form's fields by id (`observed`, `reproduction`, `evidence`, `version`), as the
+    /// link fills them.
+    pub fields: Vec<(&'static str, String)>,
+    /// The link that opens the filled form.
+    pub url: String,
+    /// Files to attach (the session when too long for the link, the model).
+    pub attachments: Vec<Attachment>,
+    /// Text to put on the clipboard (the session, when it is an attachment).
+    pub clipboard: Option<String>,
+}
+
+impl Draft {
+    /// The draft as JSON (attachments by name, size and what they are).
+    pub fn to_json(&self) -> Value {
+        json!({
+            "title": self.title,
+            "fields": self.fields.iter().map(|(k, v)| (k.to_string(), json!(v))).collect::<serde_json::Map<String, Value>>(),
+            "url": self.url,
+            "attachments": self.attachments.iter().map(|a| json!({"name": a.name, "bytes": a.bytes.len(), "what": a.what})).collect::<Vec<_>>(),
+            "clipboard": self.clipboard.as_ref().map(String::len),
+        })
+    }
+}
+
+/// `v0.5.8 (abc1234), macos aarch64`.
+pub fn version_line(version: &str, commit: &str) -> String {
+    let commit = if commit.is_empty() { String::new() } else { format!(" ({commit})") };
+    format!("v{version}{commit}, {} {}", std::env::consts::OS, std::env::consts::ARCH)
+}
+
+/// Percent-encode `s` for a query value (RFC 3986 unreserved characters stay).
+pub fn encode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for b in s.bytes() {
+        if b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.' | b'~') {
+            out.push(char::from(b));
+        } else {
+            out.push_str(&format!("%{b:02X}"));
+        }
+    }
+    out
+}
+
+fn cut(s: &str, n: usize) -> String {
+    if s.len() <= n {
+        return s.to_string();
+    }
+    let mut end = n;
+    while !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}\n[cut: {} bytes in all]", s.get(..end).unwrap_or_default(), s.len())
+}
+
+fn link(title: &str, fields: &[(&'static str, String)]) -> String {
+    let mut url = format!("{ISSUE_URL}?template=bug.yml&title={}", encode(title));
+    for (k, v) in fields {
+        if !v.is_empty() {
+            url.push_str(&format!("&{k}={}", encode(v)));
+        }
+    }
+    url
+}
+
+/// What a crash report says, for the evidence field: its kind, message, place, command (its id;
+/// its parameters only with the session) and the top of its backtrace.
+fn crash_evidence(report: &Value, share: bool) -> String {
+    let s = |k: &str| report.get(k).and_then(Value::as_str).unwrap_or("?");
+    let mut out =
+        format!("Crash report `{}` ({}), seen {} time(s)\n\n", s("id"), s("kind"), report.get("count").and_then(Value::as_u64).unwrap_or(1));
+    out.push_str(&format!("Message: {}\nAt: {}\n", without_home(s("message")), without_home(s("location"))));
+    if let Some(c) = report.get("command").filter(|c| !c.is_null()) {
+        let id = c.get("command").and_then(Value::as_str).unwrap_or("?");
+        match c.get("params").filter(|_| share) {
+            Some(p) => out.push_str(&format!("Command: `{id}` {}\n", without_home(&p.to_string()))),
+            None => out.push_str(&format!("Command: `{id}`\n")),
+        }
+    }
+    if let Some(a) = report.get("last_activity").and_then(Value::as_str) {
+        out.push_str(&format!("Last activity: {a}\n"));
+    }
+    let frames: Vec<&str> = report.get("backtrace").and_then(Value::as_array).into_iter().flatten().filter_map(Value::as_str).take(FRAMES).collect();
+    if !frames.is_empty() {
+        out.push_str("\nBacktrace (top):\n```\n");
+        for f in frames {
+            out.push_str(&without_home(f));
+            out.push('\n');
+        }
+        out.push_str("```\n");
+    }
+    out
+}
+
+/// The draft for `input`, by the [`version_line`] `version`.
+pub fn draft(input: &Input, version: &str) -> Draft {
+    let crash = input.crash.as_ref();
+    let mut title = input.title.trim().to_string();
+    if title.is_empty() {
+        title = match crash.and_then(|c| c.get("kind")).and_then(Value::as_str) {
+            Some("unclean_exit") => "FieldCraft closed unexpectedly".to_string(),
+            Some(_) => "Internal error".to_string(),
+            None => match input.observed.trim().lines().next().filter(|l| !l.is_empty()) {
+                Some(line) => format!("Bug: {}", line.chars().take(100).collect::<String>()),
+                None => "Bug report".to_string(),
+            },
+        };
+        if let Some(c) = crash.and_then(|c| c.get("command")).and_then(|c| c.get("command")).and_then(Value::as_str) {
+            title.push_str(&format!(" in {c}"));
+        }
+    }
+    let title = cut(&without_home(&title), 200);
+    let mut observed = without_home(input.observed.trim());
+    if observed.is_empty()
+        && let Some(m) = crash.and_then(|c| c.get("message")).and_then(Value::as_str)
+    {
+        observed = without_home(m);
+    }
+    let observed = cut(&observed, MAX_FIELD);
+    let share = input.share_session;
+    let mut evidence = crash.map(|c| crash_evidence(c, share)).unwrap_or_default();
+    let mut attachments = Vec::new();
+    let mut clipboard = None;
+    let mut reproduction = String::new();
+    // The session: the replayable script, from the attached model when there is one.
+    let model = input.model.as_ref().filter(|_| share && input.include_model);
+    let script = share.then(|| {
+        let mut steps = Vec::new();
+        if model.is_some() {
+            steps.push(json!({"command": "file.open", "params": {"path": MODEL_FILE}}));
+        }
+        steps.extend(input.commands.iter().cloned());
+        Value::Array(steps)
+    });
+    if let Some(m) = model {
+        attachments.push(Attachment { name: MODEL_FILE.into(), bytes: m.clone(), what: format!("the model ({} KB)", m.len().div_ceil(1024)) });
+    }
+    if let Some(script) = &script {
+        let n = script.as_array().map_or(0, Vec::len);
+        reproduction = format!("Replay the attached session ({n} command(s)): `fieldcraft-cli run {SESSION_FILE}`");
+        if model.is_some() {
+            reproduction.push_str(&format!(" in a folder holding `{MODEL_FILE}` too"));
+        } else if crash.is_some_and(|c| c.get("files").and_then(|f| f.get("model")).is_some()) {
+            reproduction.push_str(" (the crash replays from the model, which is not attached)");
+        }
+        reproduction.push('.');
+    }
+    let inline = |evidence: &str, script: &Value| {
+        let text = serde_json::to_string_pretty(script).unwrap_or_default();
+        format!("{evidence}\nSession ({SESSION_FILE}):\n```json\n{text}\n```\n")
+    };
+    let fields = |evidence: String| {
+        vec![("observed", observed.clone()), ("reproduction", reproduction.clone()), ("evidence", evidence), ("version", version.to_string())]
+    };
+    // The session in the link when it fits, else a file to attach (also on the clipboard).
+    let mut url = String::new();
+    if let Some(script) = &script {
+        let candidate = fields(inline(&evidence, script));
+        let u = link(&title, &candidate);
+        if u.len() <= MAX_URL {
+            evidence = inline(&evidence, script);
+            url = u;
+        } else {
+            let text = serde_json::to_string_pretty(script).unwrap_or_default();
+            evidence.push_str(&format!(
+                "\nThe session is too long for this form: FieldCraft saved it as `{SESSION_FILE}` and copied it to the clipboard. Attach the file here (drag it in) or paste it.\n"
+            ));
+            attachments.insert(0, Attachment { name: SESSION_FILE.into(), bytes: text.clone().into_bytes(), what: "the session's commands".into() });
+            clipboard = Some(text);
+        }
+    }
+    if model.is_some() {
+        evidence.push_str(&format!("\nThe model is attached as `{MODEL_FILE}` (drag it in from the folder FieldCraft saved it to).\n"));
+    }
+    if url.is_empty() || model.is_some() {
+        let mut f = fields(evidence.clone());
+        url = link(&title, &f);
+        // Still too long (a very long message): cut the longest field until it fits.
+        while url.len() > MAX_URL {
+            let Some((i, len)) = f.iter().enumerate().map(|(i, (_, v))| (i, v.len())).max_by_key(|(_, l)| *l) else { break };
+            if len < 200 {
+                break;
+            }
+            if let Some((_, v)) = f.get_mut(i) {
+                *v = cut(v, len.saturating_sub(url.len() - MAX_URL + 64).min(len / 2 + 1));
+            }
+            url = link(&title, &f);
+        }
+        evidence = f.get(2).map(|(_, v)| v.clone()).unwrap_or_default();
+    }
+    let fields = fields(evidence);
+    // The fields as the link carries them (a cut field included).
+    let fields = if url == link(&title, &fields) { fields } else { decode_fields(&url) };
+    Draft { title, fields, url, attachments, clipboard }
+}
+
+/// Write a draft's attachments to `bug-reports/<time>/` in the app's data folder (the user
+/// attaches them from there); returns the folder.
+pub fn save_attachments(draft: &Draft) -> Result<std::path::PathBuf, String> {
+    let root = fieldcraft_io::recovery::data_dir().ok_or("no data folder on this system")?;
+    let dir = root.join("bug-reports").join(crate::crash::stamp_now());
+    fieldcraft_io::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+    for a in &draft.attachments {
+        fieldcraft_io::fs::write_atomic(&dir.join(&a.name), &a.bytes, false).map_err(|e| e.to_string())?;
+    }
+    Ok(dir)
+}
+
+/// The fields a link carries (for the review, when a field had to be cut).
+fn decode_fields(url: &str) -> Vec<(&'static str, String)> {
+    let query = url.split_once('?').map_or("", |(_, q)| q);
+    ["observed", "reproduction", "evidence", "version"]
+        .into_iter()
+        .map(|k| {
+            let v = query.split('&').find_map(|kv| kv.strip_prefix(k).and_then(|r| r.strip_prefix('='))).unwrap_or_default();
+            (k, decode(v))
+        })
+        .collect()
+}
+
+fn decode(s: &str) -> String {
+    let b = s.as_bytes();
+    let mut out = Vec::with_capacity(b.len());
+    let mut i = 0;
+    while let Some(&c) = b.get(i) {
+        let hex = b.get(i + 1..i + 3).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok());
+        match (c, hex) {
+            (b'%', Some(v)) => {
+                out.push(v);
+                i += 3;
+            }
+            _ => {
+                out.push(c);
+                i += 1;
+            }
+        }
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn home() -> String {
+        std::env::var("HOME").or_else(|_| std::env::var("USERPROFILE")).unwrap_or_else(|_| "/home/someone".into())
+    }
+
+    fn crash() -> Value {
+        json!({
+            "id": "20261014-101500-00000000deadbeef", "kind": "command_panic", "count": 2,
+            "message": format!("index out of bounds in {}/model.fieldcraft", home()),
+            "location": "crates/mesh/src/tet.rs:42",
+            "command": {"command": "mesh.tet.generate", "params": {"body": "Plate", "path": format!("{}/secret/plate.step", home())}},
+            "backtrace": ["fieldcraft_mesh::tet::insert (crates/mesh/src/tet.rs:42)"],
+            "files": {"model": "model.fieldcraft", "replay": "replay.json"},
+        })
+    }
+
+    #[test]
+    fn without_sharing_a_draft_names_no_paths_commands_or_model() {
+        let input = Input {
+            observed: format!("cannot open {}/parts/bracket.solidcraft", home()),
+            crash: Some(crash()),
+            commands: vec![json!({"command": "geometry.open", "params": {"path": format!("{}/parts/bracket.solidcraft", home())}})],
+            model: Some(b"model bytes".to_vec()),
+            include_model: true,
+            ..Default::default()
+        };
+        let d = draft(&input, "v1.2.3, testos x");
+        assert!(d.url.starts_with("https://github.com/tangency-labs/fieldcraft/issues/new?template=bug.yml&title="), "{}", d.url);
+        assert!(d.attachments.is_empty() && d.clipboard.is_none(), "nothing attached without Share my session");
+        let all = format!("{} {:?} {}", d.title, d.fields, decode(&d.url));
+        assert!(!all.contains(&home()), "no home folder: {all}");
+        assert!(!all.contains("secret") && !all.contains("geometry.open"), "no parameters or commands: {all}");
+        assert!(all.contains("~/parts/bracket.solidcraft"), "the error, its home shown as ~: {all}");
+        assert!(all.contains("mesh.tet.generate") && all.contains("tet.rs:42") && all.contains("v1.2.3, testos x"), "{all}");
+        assert_eq!(d.title, "Internal error in mesh.tet.generate");
+        assert_eq!(decode_fields(&d.url), d.fields, "the review shows what the link carries");
+    }
+
+    #[test]
+    fn a_short_session_goes_in_the_link() {
+        let input = Input {
+            title: "Solve fails".into(),
+            share_session: true,
+            commands: vec![json!({"command": "file.sample", "params": {"name": "cantilever"}}), json!({"command": "solve.run", "params": {}})],
+            ..Default::default()
+        };
+        let d = draft(&input, "v1");
+        assert!(d.attachments.is_empty() && d.clipboard.is_none());
+        let evidence = &d.fields.iter().find(|(k, _)| *k == "evidence").unwrap().1;
+        assert!(evidence.contains("\"command\": \"solve.run\""), "{evidence}");
+        assert!(d.url.len() <= MAX_URL);
+        assert!(decode(&d.url).contains("file.sample"));
+    }
+
+    #[test]
+    fn a_long_session_and_the_model_are_attachments() {
+        let commands: Vec<Value> = (0..400).map(|i| json!({"command": "mesh.node.add", "params": {"label": i + 1, "xyz": [i, 0, 0]}})).collect();
+        let input =
+            Input { share_session: true, include_model: true, commands, model: Some(vec![7; 3000]), crash: Some(crash()), ..Default::default() };
+        let d = draft(&input, "v1");
+        assert!(d.url.len() <= MAX_URL, "{}", d.url.len());
+        let names: Vec<&str> = d.attachments.iter().map(|a| a.name.as_str()).collect();
+        assert_eq!(names, [SESSION_FILE, MODEL_FILE]);
+        let session: Value = serde_json::from_slice(&d.attachments[0].bytes).unwrap();
+        assert_eq!(session[0], json!({"command": "file.open", "params": {"path": MODEL_FILE}}), "the replay opens the attached model");
+        assert_eq!(session.as_array().unwrap().len(), 401);
+        assert_eq!(d.clipboard.as_deref().map(str::as_bytes), Some(d.attachments[0].bytes.as_slice()));
+        let text = decode(&d.url);
+        assert!(text.contains("too long for this form") && text.contains(MODEL_FILE) && !text.contains("\"label\": 399"), "{text}");
+        // With the session shared, the crash's command parameters are shown (home as ~).
+        assert!(text.contains("~/secret/plate.step"), "{text}");
+    }
+
+    #[test]
+    fn a_huge_message_is_cut_to_fit_the_link() {
+        let input = Input { observed: "é".repeat(20_000), ..Default::default() };
+        let d = draft(&input, "v1");
+        assert!(d.url.len() <= MAX_URL, "{}", d.url.len());
+        assert!(d.fields[0].1.contains("[cut:"));
+        assert_eq!(decode_fields(&d.url), d.fields);
+    }
+
+    #[test]
+    fn encoding_round_trips() {
+        let s = "a b&c=d/é\n```json";
+        assert_eq!(decode(&encode(s)), s);
+        assert_eq!(encode("a b&"), "a%20b%26");
+    }
+}

crates/engine/src/cancel_tests.rs

@@ -0,0 +1,130 @@
+//! A cancelled job ([`fieldcraft_model::progress::Progress::cancel`]) stops every solver and
+//! mesher promptly with `cancelled` and leaves the model as it was.
+
+use std::time::{Duration, Instant};
+
+use fieldcraft_geometry::sample::Plate;
+use fieldcraft_model::progress::{self, Progress};
+use serde_json::{Value, json};
+
+use crate::Session;
+use crate::sample::impact;
+
+/// How long a cancelled command may keep running: one increment, time step or pass, far
+/// below the minutes the runs below would take uncancelled.
+const PROMPT: Duration = Duration::from_secs(5);
+
+/// Run `command` on `s` the way a job does and cancel it once it reports the stage `stage`
+/// (mid-run), or before it starts (`None`): it must fail with `cancelled`, soon after, leaving
+/// the model and the journal as they were.
+fn cancel(s: &mut Session, command: &str, params: Value, stage: Option<&str>) {
+    let (model, journal) = (s.model.clone(), s.journal.len());
+    let p = Progress::new();
+    if stage.is_none() {
+        p.cancel();
+    }
+    let (r, waited) = std::thread::scope(|scope| {
+        let worker = {
+            let p = p.clone();
+            let s = &mut *s;
+            let params = params.clone();
+            scope.spawn(move || progress::scoped(Some(p), || s.execute(command, &params)))
+        };
+        let mut at = Instant::now();
+        if let Some(stage) = stage {
+            let deadline = Instant::now() + Duration::from_secs(600);
+            while !worker.is_finished() && Instant::now() < deadline {
+                let now = p.snapshot();
+                if now.stage.starts_with(stage) && now.done > 0.0 {
+                    at = Instant::now();
+                    p.cancel();
+                    break;
+                }
+                std::thread::sleep(Duration::from_millis(1));
+            }
+            assert!(p.is_cancelled(), "{command}: never reached stage `{stage}` ({:?})", p.snapshot());
+        }
+        let r = worker.join().unwrap();
+        (r, at.elapsed())
+    });
+    let e = r.expect_err(&format!("{command}: ran to the end although cancelled"));
+    assert!(e.is_cancelled(), "{command}: {e}");
+    assert_eq!(e.to_string(), "cancelled", "{command}");
+    assert!(waited < PROMPT, "{command}: stopped {waited:?} after the cancel");
+    assert!(s.model == model, "{command}: the model changed");
+    assert_eq!(s.journal.len(), journal, "{command}: journalled");
+}
+
+/// A sample's script run on a fresh session.
+fn session(script: &Value) -> Session {
+    let mut s = Session::default();
+    s.run_script(script).unwrap();
+    s
+}
+
+fn plate() -> (crate::tests::TempDir, Session) {
+    let (dir, path) = crate::tests::sample_design_file(&Plate::default());
+    let mut s = Session::default();
+    s.execute("geometry.open", &json!({"path": path})).unwrap();
+    (dir, s)
+}
+
+#[test]
+fn explicit_stops_between_time_steps() {
+    // A hundred times as long as the sample: hundreds of thousands of increments.
+    let mut script = impact();
+    for c in script.as_array_mut().unwrap() {
+        if c["command"] == "model.step.create" {
+            let p = &mut c["params"]["procedure"];
+            (p["end_time"], p["output_interval"], p["history_interval"]) = (json!(4e-3), json!(4e-4), json!(2e-5));
+        }
+    }
+    let mut s = session(&script);
+    cancel(&mut s, "solve.explicit", json!({}), Some("Time"));
+}
+
+#[test]
+fn fluid_stops_between_lattice_steps() {
+    let mut s = Session::default();
+    s.execute("file.sample", &json!({"name": "flow-past"})).unwrap();
+    cancel(&mut s, "solve.fluid", json!({}), Some("Fluid steps"));
+}
+
+#[test]
+fn nonlinear_stops_between_increments() {
+    let mut s = Session::default();
+    s.execute("file.sample", &json!({"name": "rubber-seal"})).unwrap();
+    cancel(&mut s, "solve.nonlinear", json!({}), Some("Load factor"));
+}
+
+#[test]
+fn transient_heat_stops_between_increments() {
+    let mut s = Session::default();
+    s.execute("file.sample", &json!({"name": "heated-bracket"})).unwrap();
+    s.execute(
+        "model.step.create",
+        &json!({"name": "Warm", "procedure": {"type": "heat_transfer", "transient": {"end_time": 1e5, "increment": 1}},
+            "boundary_conditions": ["Heater"], "loads": ["Air"]}),
+    )
+    .unwrap();
+    cancel(&mut s, "solve.heat", json!({"step": "Warm"}), Some("Time increment"));
+}
+
+#[test]
+fn static_frequency_and_solve_all_stop_at_the_factorization() {
+    let mut s = Session::default();
+    s.execute("file.sample", &json!({"name": "cantilever"})).unwrap();
+    cancel(&mut s, "solve.static", json!({}), None);
+    cancel(&mut s, "solve.frequency", json!({}), None);
+    cancel(&mut s, "solve.run", json!({}), None);
+}
+
+#[test]
+fn meshers_stop_and_leave_no_mesh() {
+    let (_dir, mut s) = plate();
+    cancel(&mut s, "mesh.tet.generate", json!({"body": "Body1", "size": 0.4}), Some("Refinement round"));
+    cancel(&mut s, "mesh.tet.generate", json!({"body": "Body1", "size": 2.5}), None);
+    cancel(&mut s, "mesh.hex.generate", json!({"body": "Body1", "size": 2.5}), None);
+    cancel(&mut s, "mesh.hex.octree", json!({"body": "Body1", "size": 5.0, "max_depth": 2}), None);
+    assert!(s.model.nodes().is_empty());
+}