@floless/app 0.60.0 → 0.61.0

package/dist/floless-server.cjs

@@ -53022,7 +53022,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.60.0" : void 0,
+    define: true ? "0.61.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -53032,7 +53032,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.60.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.61.0" : void 0 });
 }
 
 // workflow-update.ts

package/dist/schemas/drawing.vector.v1.schema.json

@@ -91,7 +91,7 @@
       "type": "object",
       "required": ["id", "kind"],
       "additionalProperties": true,
-      "description": "One drawing element. STABLE, sheet-unique `id` (assigned by the post-processor if the extractor omitted it) so it can be selected, exported, and targeted for modification.",
+      "description": "One drawing element. STABLE, sheet-unique `id`, REQUIRED on write (the store validates before the post-processor runs; the post-processor only repairs id collisions on read) — so every element can be selected, exported, and targeted for modification.",
       "properties": {
         "id":    { "type": "string", "description": "Stable, sheet-unique element id (e.g. 'e12')." },
         "kind":  { "enum": ["line", "arc", "polyline", "spline", "text"], "description": "Geometry class (broader than steel's line/text)." },

package/dist/skills/floless-app-vectorize/SKILL.md

@@ -1,26 +1,33 @@
 ---
 name: floless-app-vectorize
-description: Vectorize a drawing into an editable drawing.vector/v1 contract in floless.app — the "Vectorize" reader. Triggers on a pending floless `rebake` request for the `vectorize` app (queued from its "Re-read & re-bake ▸" button), or asks like "vectorize this PDF", "turn my drawing into clean CAD linework", "read this detail into vectors", "trace this sheet". Teaches the host AI to run ONE deterministic PyMuPDF pass at COMPOSE time (no LLM, no API key) over a vector PDF, emit the drawing.vector/v1 contract, PUT it to the contract store, and hand the 2D vector editor to the user.
+description: Vectorize a drawing into an editable drawing.vector/v1 contract in floless.app — the "Vectorize" reader. Triggers on a pending floless `rebake` request for the `vectorize` app (queued from its "Re-read & re-bake ▸" button), or asks like "vectorize this PDF", "turn my sketch into clean CAD linework", "read this detail into vectors", "trace this photo". Teaches the host AI to read a drawing at COMPOSE time — a vector PDF via ONE deterministic PyMuPDF pass (no LLM), a scan/photo/hand sketch via AWARE's fenced vision.extract (schema-bound, cached) — emit the drawing.vector/v1 contract, PUT it to the contract store, and hand the 2D vector editor to the user.
 metadata:
-  version: 0.1.0
+  version: 0.3.0
 ---
 
 # Vectorize — read a drawing into a drawing.vector/v1 contract
 
 ## What this is
 
-`vectorize` is a FloLess app that turns a drawing (PDF today; scans/photos are a later
-slice) into clean, editable **2D vector linework** — a `drawing.vector/v1` contract
+`vectorize` is a FloLess app that turns a drawing — a vector PDF, a scan, a photo, a hand
+sketch — into clean, editable **2D vector linework**: a `drawing.vector/v1` contract
 (vocabulary-free; every element has a stable id) rendered in the 2D vector editor, where the
-user pans/zooms, toggles Lines/Curves/Text and layers, inspects weak traces, and exports SVG.
+user pans/zooms, toggles Lines/Curves/Text and layers, reviews weak traces, and exports SVG.
 
-The drawing is read **at compose time** with one deterministic PyMuPDF pass. There is **no
-model in the run path and no API key** — and for a vector PDF no vision either: the geometry
-is exact, extracted, never guessed. The app ships with a tiny hard-coded example; this skill
-is how the user's OWN drawing replaces it.
+The drawing is read **at compose time**, by one of two paths:
 
-**Later slices (mention as "next", do not attempt here):** raster/photo input via AWARE
-`vision.extract`, editor Save/edit, multi-view 3D reconstruction, DXF export.
+- **Vector PDF → deterministic.** One PyMuPDF pass; the geometry is exact, extracted, never
+  guessed. No model, no API key.
+- **Raster (scan/photo/sketch) → AWARE `vision.extract`.** The substrate's fenced extraction
+  carve-out: a FIXED schema + prompt + pinned model, content-hash cached (same input → same
+  JSON, no repeat model call). Coordinates come from the model, flagged with per-element
+  confidence the editor surfaces for review — never from you eyeballing pixels.
+
+There is **no model in the run path** either way. The app ships with a tiny hard-coded
+example; this skill is how the user's OWN drawing replaces it.
+
+**Later slices (mention as "next", do not attempt here):** multi-view 3D reconstruction,
+DXF export.
 
 > **Pasted a request?** If the user pastes a message beginning with a `[floless-request
 > type=rebake id=…]` marker, that's a request copied from the FloLess Dashboard — resolve it
@@ -39,14 +46,15 @@ prose, skip the lookup and proceed from that path. Resolve the port from the run
 floless.app (check `~/.floless/port` or the active server port), as the other floless-app
 skills do.
 
-### 2. Gate — is it a VECTOR PDF?
+### 2. Pick the path — vector or raster?
 
-This skill's deterministic path reads **vector** PDFs only. If `page.get_drawings()` returns
-nothing on every page (a scan, a photo, a hand sketch), **stop and say so honestly** — the
-raster/vision path is a later slice and is not shipped. Never trace pixels by eye into
-made-up coordinates; fabricated geometry is worse than no geometry.
+Probe the file: a PDF whose pages return `page.get_drawings()` paths is a **vector PDF** →
+step 3a (deterministic, always preferred). An image file, or a PDF with no vector paths (a
+scan, a photo, a hand sketch) → step 3b (vision). **Never trace pixels by eye into made-up
+coordinates** — fabricated geometry is worse than no geometry; the raster path exists so the
+extraction is fenced, cached, and confidence-flagged instead.
 
-### 3. Extract — one deterministic PyMuPDF pass
+### 3a. Vector path — one deterministic PyMuPDF pass
 
 Run the bundled extractor (it lives beside this file):
 
@@ -81,6 +89,36 @@ above is the contract. Hard schema requirements the server enforces on PUT: `typ
 dedupe, snap, or derive layers yourself — the server post-processes every read of this
 contract type.
 
+### 3b. Raster path — AWARE `vision.extract` (the fenced exception)
+
+For each raster image (or rasterized PDF page exported to an image):
+
+1. Copy `references/vision-inputs.template.json` (beside this file) to a scratch file and set
+   **only** `"file"` to the image's absolute path. The `prompt`, `schema`, and pinned `model`
+   are FIXED — together with the file bytes they form the extraction's content-hash cache key
+   and its fence; do not tweak them per run.
+2. Invoke the substrate:
+
+   ```
+   aware agent invoke vision extract --inputs @<scratch>/vision-inputs.json --json > <scratch>/vision-out.json
+   ```
+
+   A cache miss shells out to the local authenticated `claude`/`codex` CLI (no API key) and can
+   take a minute; a repeat of the same input replays from cache instantly. If neither CLI nor a
+   `vision-model` credential is available, stop and tell the user what to set up.
+3. Convert to the contract (the model traces in a normalized 0..1000 frame; this maps it onto
+   the image's real pixel size and carries per-element confidence):
+
+   ```
+   python <skill dir>/scripts/vision_to_contract.py <scratch>/vision-out.json <image> --out contract.json
+   ```
+
+   For a multi-image set, run steps 1–3 per image and append with
+   `--merge-into contract.json` instead of `--out`.
+4. Sanity-check the result before PUT: element count > 0, and the traced text you can see in
+   the vision output matches what the drawing actually says. A wildly wrong trace usually means
+   the image is too low-contrast — say so rather than shipping garbage.
+
 ### 4. Write to the contract store
 
 ```
@@ -101,10 +139,14 @@ Tell the user:
 
 - **What was read** — e.g. "2 sheets, 214 lines, 12 curves, 96 text spans from `detail.pdf`".
 - **Open the editor**: double-click the `read` node on the Vectorize canvas. It renders their
-  drawing — pan/zoom + Fit, Lines/Curves/Text toggles, per-layer toggles, weak-trace isolation
-  (deterministic reads have none), and **Export SVG**.
-- The editor is **view-only for now** — no Save/Approve path yet (a later slice); corrections
-  mean re-running this read with a better source.
+  drawing — pan/zoom + Fit, Lines/Curves/Text toggles, per-layer toggles, weak-trace isolation,
+  and **Export SVG**. Deterministic reads have no weak traces; after a **vision** read, point
+  the user at the **Confidence** panel — each trace the model was unsure about (confidence
+  < 0.5) is listed there with **Accept** (mark correct) and **Delete** (remove, with Undo), and
+  a "Reviewed N/M" counter tracks progress. Edits auto-save to the contract store.
+- **Approve & bake lock**: when satisfied, the user clicks Approve in the editor header — it
+  bakes the (edited) contract into the `read` node's `config.takeoff` and recompiles, arming
+  the Run gate. Never auto-approve on their behalf.
 
 ### 6. Clear the request
 
@@ -119,8 +161,11 @@ DELETE http://localhost:<port>/api/requests/<id>
 - **Compose-time only.** The drawing is read HERE, by the terminal AI, then PUT to the store.
   Never add a runtime node that reads the drawing — `aware app validate` rejects it, and it
   breaks determinism.
-- **Deterministic or nothing.** Vector geometry is extracted exactly; a raster with no vector
-  paths is out of scope until the vision slice ships. No eyeballed coordinates, ever.
+- **Deterministic first, fenced second, eyeballs never.** Vector geometry is extracted
+  exactly; raster interpretation goes ONLY through `vision.extract` (fixed schema/prompt/model,
+  cached, confidence-flagged). Never hand-write coordinates you read off pixels yourself, and
+  never swap the vision path for your own vision — the fence is what makes the extraction
+  reproducible.
 - **Thin-UI contract.** The browser recorded intent and the file path; the brain is the
   terminal AI. The UI never reads the drawing and never writes the contract itself.
 - **Stay in scope.** Producing and handing off the contract is the whole job — do not wire

package/dist/skills/floless-app-vectorize/references/vision-inputs.template.json

@@ -0,0 +1,40 @@
+{
+  "file": "<FILL IN: absolute path to the raster image/PDF>",
+  "model": "claude-sonnet-5",
+  "prompt": "Trace every visible stroke and label in this drawing into vector geometry. Use a coordinate frame where x runs 0..1000 left to right and y runs 0..1000 top to bottom over the full image. Emit each straight stroke as kind 'line' (exactly two points) or a connected run of straight strokes as 'polyline' (a vertex chain); follow smooth curves with a 'polyline' of enough vertices to track the curve (at most 20). Emit every piece of text as kind 'text' with the text content and its bounding box [x0,y0,x1,y1]. Mark a stroke dashed:true only if it is visibly drawn dashed. Do NOT invent geometry that is not visibly drawn; skip shading, hatching texture, smudges and paper artifacts. For every element report confidence between 0 and 1 — report 0.5 or lower whenever you are unsure the stroke exists, its endpoints are ambiguous, or the text is hard to read.",
+  "schema": {
+    "type": "object",
+    "required": ["elements"],
+    "properties": {
+      "elements": {
+        "type": "array",
+        "items": {
+          "type": "object",
+          "required": ["kind", "confidence"],
+          "allOf": [
+            { "if": { "properties": { "kind": { "enum": ["line", "polyline"] } } }, "then": { "required": ["pts"] } },
+            { "if": { "properties": { "kind": { "const": "text" } } }, "then": { "required": ["text", "bbox"] } }
+          ],
+          "properties": {
+            "kind": { "enum": ["line", "polyline", "text"] },
+            "pts": {
+              "type": "array",
+              "items": { "type": "array", "items": { "type": "number" }, "minItems": 2, "maxItems": 2 },
+              "description": "Vertices in the 0..1000 frame (line/polyline)"
+            },
+            "text": { "type": "string" },
+            "bbox": {
+              "type": "array",
+              "items": { "type": "number" },
+              "minItems": 4,
+              "maxItems": 4,
+              "description": "[x0,y0,x1,y1] in the 0..1000 frame (text)"
+            },
+            "dashed": { "type": "boolean" },
+            "confidence": { "type": "number", "minimum": 0, "maximum": 1 }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/skills/floless-app-vectorize/scripts/vision_to_contract.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""vision.extract result -> drawing.vector/v1 contract (the Slice-2 raster path).
+
+Takes the JSON that `aware agent invoke vision extract --json` printed (the invoke envelope
+or the bare `{result: {elements: [...]}}`) plus the image it was extracted from, and emits a
+raw drawing.vector/v1 contract ready to PUT to /api/contract/vectorize. The model traces in a
+normalized 0..1000 frame (see references/vision-inputs.template.json); this script maps that
+frame onto the image's real pixel size, carries each element's model-reported confidence
+(the 2D editor flags traces below 0.5 for review), and assigns the ids the PUT schema requires.
+
+Usage:
+
+  python vision_to_contract.py vision-out.json sketch.png --out contract.json
+  python vision_to_contract.py vision-out2.json page2.png --merge-into contract.json
+
+--merge-into appends the extraction as the next sheet of an existing contract (multi-image sets).
+Requires PyMuPDF (used only to read the image/PDF pixel size).
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import sys
+from datetime import datetime, timezone
+
+import fitz  # PyMuPDF
+
+
+def unwrap(payload):
+    """Accept the aware invoke envelope ({ok,data:{result,model}}) or the bare output."""
+    if payload.get("ok") is False:
+        sys.exit(f"vision.extract failed: {payload.get('error') or 'unknown error'}")
+    if isinstance(payload.get("data"), dict):
+        payload = payload["data"]
+    result = payload.get("result", payload)
+    model = payload.get("model", "?")
+    if not isinstance(result, dict) or "elements" not in result:
+        sys.exit("vision output has no result.elements — did the extraction fail?")
+    return result["elements"], model
+
+
+def to_sheet(elements, image_path):
+    # Images only: a multi-page PDF has no single 0..1000 frame, so the caller rasterizes each
+    # PDF page to its own image first (SKILL.md step 3b) and runs one extraction per image.
+    if image_path.lower().endswith(".pdf"):
+        sys.exit("pass the rasterized image, not the PDF — export each PDF page to a PNG first")
+    # True pixel dimensions (a Pixmap ignores DPI metadata, which would skew the frame).
+    pix = fitz.Pixmap(image_path)
+    w, h = float(pix.width), float(pix.height)
+    sx, sy = w / 1000.0, h / 1000.0
+
+    out = []
+    for el in elements:
+        kind = el.get("kind")
+        conf = el.get("confidence")
+        if kind == "text":
+            bbox = el.get("bbox")
+            if not el.get("text") or not bbox or len(bbox) != 4:
+                continue
+            x0, y0, x1, y1 = (v * s for v, s in zip(bbox, (sx, sy, sx, sy)))
+            e = {
+                "kind": "text",
+                "text": el["text"],
+                "bbox": [round(v, 1) for v in (x0, y0, x1, y1)],
+                "origin": [round(x0, 1), round(y1, 1)],  # baseline ~ bbox bottom-left
+                "size": round((y1 - y0) * 0.85, 1),      # approx font size from box height
+            }
+        elif kind in ("line", "polyline"):
+            pts = el.get("pts") or []
+            if len(pts) < 2:
+                continue
+            e = {
+                "kind": "line" if len(pts) == 2 else "polyline",
+                "pts": [[round(p[0] * sx, 1), round(p[1] * sy, 1)] for p in pts],
+            }
+            if el.get("dashed"):
+                e["dashed"] = True
+        else:
+            continue
+        # Schema: confidence is a number when present; ABSENT means trusted. A model that omits
+        # it must not become `null` — one null fails the whole PUT (server validates every write).
+        if isinstance(conf, (int, float)):
+            e["confidence"] = max(0.0, min(1.0, conf))
+        out.append(e)
+    for i, el in enumerate(out):
+        el["id"] = f"e{i + 1}"
+    return {"page": {"w": round(w, 2), "h": round(h, 2)}, "elements": out}
+
+
+def main():
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8")
+        except AttributeError:
+            pass
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("vision_json", help="output of `aware agent invoke vision extract --json`")
+    ap.add_argument("image", help="the raster image the extraction ran on (rasterize PDF pages first)")
+    ap.add_argument("--out", help="write a NEW one-sheet contract here")
+    ap.add_argument("--merge-into", help="append as the next sheet of this existing contract")
+    args = ap.parse_args()
+    if bool(args.out) == bool(args.merge_into):
+        sys.exit("pass exactly one of --out / --merge-into")
+
+    with open(args.vision_json, encoding="utf-8") as f:
+        elements, model = unwrap(json.load(f))
+    sheet = to_sheet(elements, args.image)
+    stem = os.path.splitext(os.path.basename(args.image))[0]
+
+    if args.merge_into:
+        with open(args.merge_into, encoding="utf-8") as f:
+            contract = json.load(f)
+        if not isinstance(contract.get("sheets"), list):
+            sys.exit(f"{args.merge_into} is not a drawing.vector contract (no sheets[])")
+        used = {s.get("id") for s in contract["sheets"]}
+        n = len(contract["sheets"]) + 1
+        while f"s{n}" in used:
+            n += 1
+        sheet["id"] = f"s{n}"
+        sheet["label"] = stem
+        contract["sheets"].append(sheet)
+        path = args.merge_into
+    else:
+        sheet["id"] = "s1"
+        sheet["label"] = stem
+        with open(args.image, "rb") as f:
+            digest = hashlib.sha256(f.read()).hexdigest()
+        contract = {
+            "type": "drawing.vector/v1",
+            "units": "px",  # no transform emitted -> the image's pixel frame is world 1:1
+            "source": {
+                "name": os.path.basename(args.image),
+                "path": os.path.abspath(args.image),
+                "kind": "image",
+                "sha256": digest,
+                "read_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+                "extractor": f"vision.extract@{model}",
+            },
+            "sheets": [sheet],
+        }
+        path = args.out
+
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump(contract, f, ensure_ascii=False)
+    weak = sum(1 for e in sheet["elements"] if (e.get("confidence") or 1) < 0.5)
+    print(f"{path}: sheet {sheet['id']} ({stem}), {len(sheet['elements'])} element(s), {weak} weak", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/dist/templates/vectorize.flo

@@ -1,18 +1,22 @@
 app:           vectorize
-version:       0.1.0
+version:       0.2.0
 display-name:  Vectorize
 publisher:     floless
 description: |
   Turn any drawing — a sketch, a PDF, a photo — into clean, editable 2D vectors. Your terminal AI
-  reads the drawing ONCE at compose time (a deterministic PyMuPDF pass — no LLM) and bakes it into a
-  drawing.vector contract; double-click the node to open the 2D vector editor, where you pan and zoom,
-  toggle what's shown, flag weak traces, and export SVG. Attach a drawing and use "Re-read & re-bake ▸"
-  (or ask your terminal AI) to vectorize your own; the deterministic run just re-renders a short summary
-  of what was read. Ships with a tiny example so it works out of the box.
+  reads the drawing ONCE at compose time and bakes it into a drawing.vector contract: a vector PDF
+  is read deterministically (exact geometry, no AI guessing), while a photo, scan or hand sketch is
+  traced by a fenced vision extraction that marks every stroke it was unsure about for your review.
+  Double-click the node to open the 2D vector editor, where you pan and zoom, toggle what's shown,
+  review weak traces, and export SVG. Attach a drawing and use "Re-read & re-bake ▸" (or ask your
+  terminal AI) to vectorize your own; the deterministic run just re-renders a short summary of what
+  was read. Ships with a tiny example so it works out of the box.
 exposes-as-agent: false
 # Workflow changelog (FloLess-published). Newest first; the app shows entries newer than the installed
 # version when offering an update. Plain-English — it surfaces to the user.
 changelog:
+  - version: 0.2.0
+    summary: Photos, scans and hand sketches can now be vectorized too — unsure strokes are flagged for your review
   - version: 0.1.0
     summary: Vectorize a drawing into clean 2D linework you can edit and export
 inputs:
@@ -28,13 +32,17 @@ layout: linear
 nodes:
   # ── node 1: read — vectorize the drawing into clean 2D linework ───────────────
   # This is where your drawing becomes editable vectors. Your terminal AI reads the
-  # attached drawing once (a deterministic PyMuPDF pass — no LLM) and bakes every line,
-  # curve and label into the contract. Double-click this node to open the 2D vector
-  # editor: pan and zoom the drawing, toggle Lines / Curves / Text, flag any weak traces,
-  # and Export SVG. `contract` tells FloLess which editor to open; `takeoff` is the single
-  # source the editor, Approve and the run all read. It ships with a tiny EXAMPLE so it
-  # renders out of the box — "Re-read & re-bake ▸" replaces it with your own drawing. The
-  # deterministic run re-renders the short summary below.
+  # attached drawing once at compose time: a vector PDF is read deterministically (exact
+  # geometry, no AI guessing), while a photo, scan or hand sketch is traced by a fenced
+  # vision extraction that flags every stroke it was unsure about. Every line, curve and
+  # label is baked into the contract. Double-click this node to open the 2D vector
+  # editor: pan and zoom the drawing, toggle Lines / Curves / Text, review each flagged
+  # trace (accept it as correct or delete it — edits save automatically), Export SVG,
+  # and Approve to freeze the reviewed drawing into the runnable lock. `contract` tells
+  # FloLess which editor to open; `takeoff` is the single source the editor, Approve and
+  # the run all read. It ships with a tiny EXAMPLE so it renders out of the box —
+  # "Re-read & re-bake ▸" replaces it with your own drawing. The deterministic run
+  # re-renders the short summary below.
   - id: read
     agent: html-report
     command: render

package/dist/web/aware.js

@@ -1360,14 +1360,18 @@
       // openContractEditor() returns false and the click would silently do nothing.
       if (contractType && window.CONTRACT_RENDERERS && window.CONTRACT_RENDERERS[contractType]) {
         addNodeAction(card, 'Edit contract ▸', () => openContractEditor(currentId, contractType));
-        addNodeAction(card, 'View 3D ▸', () => exportContract3d(currentId));
-        // Export/write group — visually separated from the look-and-read actions above.
-        addNodeActionDivider(card);
-        addNodeAction(card, 'Export IFC ▸', () => exportContractIfc(currentId));
-        addNodeAction(card, 'Export BOM (CSV) ▸', () => exportContractBom(currentId, 'csv'));
-        addNodeAction(card, 'Export BOM (Excel) ▸', () => exportContractBom(currentId, 'xlsx'));
-        const teklaBtn = addNodeAction(card, 'Send to Tekla ▸', () => exportContractTekla(currentId));
-        teklaBtn.dataset.tip = 'Tekla must be open with a model loaded. Click to create native parts in it.';
+        // The 3D/IFC/BOM/Tekla chain derives a scene from the contract — only contract types that
+        // declare `scene` support it (a drawing.vector node would 4xx on these endpoints).
+        if (window.CONTRACT_RENDERERS[contractType].scene) {
+          addNodeAction(card, 'View 3D ▸', () => exportContract3d(currentId));
+          // Export/write group — visually separated from the look-and-read actions above.
+          addNodeActionDivider(card);
+          addNodeAction(card, 'Export IFC ▸', () => exportContractIfc(currentId));
+          addNodeAction(card, 'Export BOM (CSV) ▸', () => exportContractBom(currentId, 'csv'));
+          addNodeAction(card, 'Export BOM (Excel) ▸', () => exportContractBom(currentId, 'xlsx'));
+          const teklaBtn = addNodeAction(card, 'Send to Tekla ▸', () => exportContractTekla(currentId));
+          teklaBtn.dataset.tip = 'Tekla must be open with a model loaded. Click to create native parts in it.';
+        }
         card.dataset.tip = 'Double-click to open the contract editor';
       }
       // Filter pre-stage node — opens the served steel-filter view (facets + eyedropper → contract.filter).

package/dist/web/renderers.js

@@ -9,15 +9,16 @@
  * ========================================================================== */
 
 // contract type → descriptor for the editor surface.
+// `scene: true` marks contracts that derive a 3D scene (contract-to-scene) — only those get the
+// node-card View 3D / Export IFC / Export BOM / Send to Tekla chain; other contract types would
+// 4xx or produce nonsense on those endpoints, so the shell hides the whole group.
 window.CONTRACT_RENDERERS = {
   'steel.takeoff/v1': {
     editorUrl: (appId) => '/steel-editor.html?app=' + encodeURIComponent(appId),
+    scene: true,
   },
   'drawing.vector/v1': {
     editorUrl: (appId) => '/vector-editor.html?app=' + encodeURIComponent(appId),
-    // View-only for now: the vector editor renders + exports SVG but has no Save/edit path yet (the
-    // edit/re-bake flow is a later slice), so the shell hides its Approve button (see openContractEditor).
-    viewOnly: true,
   },
 };
 

package/dist/web/vector-editor.html

@@ -47,6 +47,27 @@
   #zoombar #zpct{min-width:42px;text-align:right;color:var(--mut);font-variant-numeric:tabular-nums}
   #zoombar .ghost{height:24px;padding:0 8px;background:transparent;border:1px solid var(--line);color:var(--mut);border-radius:5px;font-size:11px}
   #zoombar .ghost:hover{color:var(--text);border-color:var(--brand)}
+  /* Auto-save chip — same states/colors as steel-editor's #saveStat. */
+  #saveStat{color:var(--mut);font-size:12px}
+  #saveStat.dirty{color:#fbbf24} #saveStat.err{color:#f87171}
+  /* Weak-trace review list (inner scroll box — inherits the themed scrollbar rules above). */
+  #weakList{max-height:280px;overflow:auto;display:flex;flex-direction:column;gap:2px;margin-top:4px}
+  .wrow{display:flex;align-items:center;gap:6px;padding:4px 6px;border-radius:6px;font-size:12px}
+  .wrow:hover{background:var(--line)}
+  .wrow .lbl{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;cursor:pointer}
+  .wrow .pct{color:#f59e0b;font-variant-numeric:tabular-nums;font-size:11px}
+  .wrow button{height:22px;padding:0 8px;font-size:11px;border-radius:5px}
+  .wrow .ghost{background:transparent;border:1px solid var(--line);color:var(--mut)}
+  .wrow .ghost:hover{color:var(--text);border-color:var(--brand);background:transparent}
+  .wrow .danger{background:#7f1d1d;border-color:#991b1b;color:#fecaca}
+  .wrow .danger:hover{background:#991b1b}
+  .wrow.flash{background:var(--line)}
+  #svg .locfl{stroke:var(--brand)!important} #svg text.locfl{fill:var(--brand)!important}
+  /* Single-level Undo toast (styled modal pattern — never a native dialog). */
+  #toast{position:absolute;bottom:12px;left:50%;transform:translateX(-50%);display:none;align-items:center;gap:10px;background:var(--panel);border:1px solid var(--line);border-radius:8px;padding:7px 12px;box-shadow:0 4px 14px rgba(0,0,0,.45);z-index:6;color:var(--text)}
+  #toast.show{display:flex}
+  #toast .ghost{height:24px;padding:0 8px;background:transparent;border:1px solid var(--line);color:var(--mut);border-radius:5px;font-size:11px}
+  #toast .ghost:hover{color:var(--text);border-color:var(--brand)}
 </style>
 </head>
 <body>
@@ -55,6 +76,7 @@
     <span class="stat" id="title">—</span>
     <span class="spacer"></span>
     <span class="stat"><b id="nEl">0</b> elements · <b id="nTx">0</b> text</span>
+    <span id="saveStat" title="Edits save to the app's contract automatically" hidden>Auto-save on</span>
     <button class="primary" id="exportBtn" disabled>Export SVG</button>
   </header>
   <div id="wrap">
@@ -66,6 +88,7 @@
         <input type="range" id="zoom" min="10" max="800" value="100" aria-label="Zoom">
         <span id="zpct">100%</span>
       </div>
+      <div id="toast" role="status"><span id="toastMsg"></span><button class="ghost" id="undoBtn">Undo</button></div>
     </div>
     <aside>
       <div>
@@ -83,7 +106,9 @@
       <div>
         <h3>Confidence</h3>
         <label class="ck" id="weakRow" hidden><input type="checkbox" id="weakOnly"><span>Isolate weak traces</span><span class="ct" id="cWeak">0</span></label>
-        <div class="muted" id="weakNote">No weak traces — read deterministically.</div>
+        <div class="muted" id="revLine" hidden>Reviewed 0/0</div>
+        <div id="weakList" hidden></div>
+        <div class="muted" id="weakNote">No weak traces — traced exactly from the vector PDF (no AI involved).</div>
       </div>
     </aside>
   </div>
@@ -100,6 +125,12 @@
 
   let sheet = null;
   let view = { x: 0, y: 0, w: 100, h: 100 };
+  let C = null; // the full contract (PUT body) — `sheet` is a reference into it
+  // Edits are only possible against the app's live contract store; a static ?src= view stays read-only.
+  const editable = !!app && src.indexOf('/api/contract/') === 0;
+  let initialWeak = 0; // M in "Reviewed N/M" — the weak count when the drawing loaded
+  let lastDeleted = null; // single-level undo: { el, i } of the last deleted trace
+  let toastT = 0;
 
   function showState(msg) { $('stateMsg').textContent = msg; $('state').classList.add('show'); $('state').querySelector('.spin').style.display = msg ? 'none' : ''; }
   function hideState() { $('state').classList.remove('show'); }
@@ -257,20 +288,166 @@
     }
   }
 
+  // ── auto-save (mirrors steel-editor: debounce-chip + flushContract for the shell's Approve) ──
+  let saveT = 0;
+  function setSaved(state) {
+    if (!editable) return;
+    const el = $('saveStat'); el.hidden = false; el.classList.remove('dirty', 'err');
+    if (state === 'dirty') { el.classList.add('dirty'); el.textContent = 'Saving…'; }
+    else if (state === 'err') { el.classList.add('err'); el.textContent = 'Save failed'; }
+    else el.textContent = 'Saved';
+  }
+  // PUT the full contract as the server-side draft — the copy Approve bakes. Saves are
+  // SERIALIZED through a generation-checked queue: overlapping PUTs could land out of order
+  // (last-write-wins on the server), letting an older in-flight snapshot overwrite a newer one
+  // right before Approve. Each queued write stringifies C at send time, and a write that has
+  // been superseded by a newer request skips itself — so the queue's tail always leaves the
+  // LATEST state on the server. Returns the queue tail (ok boolean).
+  let saveGen = 0;
+  let saveQueue = Promise.resolve(true);
+  async function doPut() {
+    try {
+      const res = await fetch('/api/contract/' + encodeURIComponent(app), {
+        method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify(C),
+      });
+      setSaved(res.ok ? 'ok' : 'err');
+      if (!res.ok) console.error('server save rejected (' + res.status + ')', await res.text().catch(() => ''));
+      return res.ok;
+    } catch (e) { setSaved('err'); console.error('server save failed', e); return false; }
+  }
+  function persistServer() {
+    if (!editable || !C) return Promise.resolve(true);
+    const gen = ++saveGen;
+    saveQueue = saveQueue.then(() => (gen === saveGen ? doPut() : true)); // superseded → the newer write carries C
+    return saveQueue;
+  }
+  function scheduleSave() { if (!editable) return; setSaved('dirty'); clearTimeout(saveT); saveT = setTimeout(persistServer, 500); }
+  // The shell's Approve button awaits this before baking — throw so a rejected save aborts the bake.
+  window.flushContract = async function flushContract() {
+    if (!editable) return;
+    clearTimeout(saveT);
+    const ok = await persistServer(); // queued behind any in-flight write → latest state, in order
+    if (!ok) throw new Error('Save failed — the edited contract was rejected; fix it before Approve');
+  };
+
+  // ── weak-trace review: Accept clears the flag (absent = trusted), Delete removes with 1-level Undo ──
+  function isWeak(el) { return el.confidence != null && el.confidence < WEAK; }
+  function elLabel(el) {
+    if (el.kind === 'text') return '“' + (el.text || '') + '”';
+    return (el.kind || 'trace') + ' · ' + (el.id || '?');
+  }
+  function acceptEl(id) {
+    const el = sheet.elements.find((e) => e.id === id);
+    if (!el) return;
+    delete el.confidence; // schema: absent = trusted — cleaner than a magic 1.0
+    afterEdit();
+  }
+  function deleteEl(id) {
+    const i = sheet.elements.findIndex((e) => e.id === id);
+    if (i < 0) return;
+    // Prune the id from any group memberships too — a dangling groups[].elementIds reference
+    // would survive PUT/Approve (the schema only checks it's a string array). Remember each
+    // pruned spot so Undo restores memberships along with the element.
+    const memberships = [];
+    for (const g of sheet.groups || []) {
+      const gi = (g.elementIds || []).indexOf(id);
+      if (gi >= 0) { memberships.push({ g, gi }); g.elementIds.splice(gi, 1); }
+    }
+    lastDeleted = { el: sheet.elements[i], i, memberships };
+    sheet.elements.splice(i, 1);
+    showToast('Trace deleted');
+    afterEdit();
+  }
+  function undoDelete() {
+    if (!lastDeleted) return;
+    sheet.elements.splice(Math.min(lastDeleted.i, sheet.elements.length), 0, lastDeleted.el);
+    for (const m of lastDeleted.memberships) m.g.elementIds.splice(Math.min(m.gi, m.g.elementIds.length), 0, lastDeleted.el.id);
+    lastDeleted = null;
+    hideToast();
+    afterEdit();
+  }
+  function showToast(msg) {
+    $('toastMsg').textContent = msg;
+    $('toast').classList.add('show');
+    clearTimeout(toastT); toastT = setTimeout(hideToast, 6000);
+  }
+  function hideToast() { $('toast').classList.remove('show'); clearTimeout(toastT); }
+  $('undoBtn').addEventListener('click', undoDelete);
+
+  function buildWeakList() {
+    const box = $('weakList');
+    while (box.firstChild) box.removeChild(box.firstChild);
+    const weak = editable ? sheet.elements.filter(isWeak) : [];
+    box.hidden = weak.length === 0;
+    for (const el of weak) {
+      const row = document.createElement('div'); row.className = 'wrow'; row.dataset.id = el.id || '';
+      const lbl = document.createElement('span'); lbl.className = 'lbl'; lbl.textContent = elLabel(el);
+      lbl.title = 'Show this trace on the drawing';
+      lbl.addEventListener('click', () => locateOnCanvas(el.id));
+      const pct = document.createElement('span'); pct.className = 'pct'; pct.textContent = Math.round((el.confidence || 0) * 100) + '%';
+      const ok = document.createElement('button'); ok.className = 'ghost'; ok.textContent = 'Accept';
+      ok.title = 'Mark this trace as correct — clears its low-confidence flag.';
+      ok.addEventListener('click', () => acceptEl(el.id));
+      const del = document.createElement('button'); del.className = 'danger'; del.textContent = 'Delete';
+      del.title = 'Remove this trace from the drawing (Undo available).';
+      del.addEventListener('click', () => deleteEl(el.id));
+      row.append(lbl, pct, ok, del); box.appendChild(row);
+    }
+  }
+  // Locate: list row → flash the trace on the canvas; canvas click on a weak trace → flash its row.
+  function locateOnCanvas(id) {
+    const node = [...svg.children].find((n) => n.dataset.id === id);
+    if (!node) return;
+    node.classList.add('locfl');
+    setTimeout(() => node.classList.remove('locfl'), 1200);
+  }
+  svg.addEventListener('click', (e) => {
+    const id = e.target && e.target.dataset && e.target.dataset.id;
+    if (!id || !e.target.classList.contains('weak')) return;
+    const row = [...document.querySelectorAll('#weakList .wrow')].find((r) => r.dataset.id === id);
+    if (!row) return;
+    row.scrollIntoView({ block: 'nearest' });
+    row.classList.add('flash');
+    setTimeout(() => row.classList.remove('flash'), 1200);
+  });
+
+  // Header stats + Confidence section (counts, note wording, Reviewed N/M) — rerun after every edit.
+  function refreshStats() {
+    const c = counts();
+    $('nEl').textContent = sheet.elements.length; $('nTx').textContent = c.text;
+    $('cLines').textContent = c.lines; $('cCurves').textContent = c.curves; $('cText').textContent = c.text;
+    $('cWeak').textContent = c.weak;
+    // The zero-weak wording must match HOW the drawing was read: after a vision read the honest
+    // message is "scored above the bar, still spot-check", never the exact-extraction claim
+    // (the extractor field is the provenance; absent/non-vision = the no-AI deterministic path).
+    const visionRead = /^vision/.test((C && C.source && C.source.extractor) || '');
+    $('weakNote').textContent = c.weak
+      ? (c.weak + ' trace' + (c.weak === 1 ? '' : 's') + ' scored below ' + WEAK + ' confidence.')
+      : (visionRead ? 'No weak traces — every element scored above ' + WEAK + '. Spot-check against the original.' : 'No weak traces — traced exactly from the vector PDF (no AI involved).');
+    $('weakRow').hidden = c.weak === 0; // hide the filter when there's nothing to filter (not disabled)
+    if (c.weak === 0) $('weakOnly').checked = false; // nothing left to isolate — release the filter
+    // Reviewed N/M — M is the weak count at load; Accept and Delete both count as reviewed.
+    const reviewed = Math.max(0, initialWeak - c.weak);
+    $('revLine').hidden = !editable || initialWeak === 0;
+    $('revLine').textContent = c.weak === 0 && initialWeak > 0
+      ? 'All ' + initialWeak + ' reviewed'
+      : 'Reviewed ' + reviewed + '/' + initialWeak;
+  }
+  function afterEdit() { refreshStats(); render(); buildWeakList(); scheduleSave(); }
+
   function load(contract) {
     if (!contract || !Array.isArray(contract.sheets) || !contract.sheets.length) { showState('This app has no vectorized drawing yet. Drop a PDF and re-bake to read one.'); return; }
+    C = contract;
     sheet = contract.sheets[contract.active || 0] || contract.sheets[0];
     if (!sheet || !Array.isArray(sheet.elements)) { showState('The drawing has no elements.'); return; }
-    const c = counts();
+    initialWeak = sheet.elements.filter(isWeak).length;
     const name = (contract.source && contract.source.name) ? contract.source.name : (sheet.label || 'drawing');
     $('title').textContent = name;
     document.title = 'Vectorize — ' + name;
-    $('nEl').textContent = sheet.elements.length; $('nTx').textContent = c.text;
-    $('cLines').textContent = c.lines; $('cCurves').textContent = c.curves; $('cText').textContent = c.text;
-    $('cWeak').textContent = c.weak;
-    $('weakNote').textContent = c.weak ? (c.weak + ' trace' + (c.weak === 1 ? '' : 's') + ' below ' + WEAK + ' confidence.') : 'No weak traces — read deterministically.';
-    $('weakRow').hidden = c.weak === 0; // hide the filter when there's nothing to filter (not disabled)
+    if (editable) setSaved('ok');
+    refreshStats();
     buildLayers();
+    buildWeakList();
     render(); fit(); $('exportBtn').disabled = false; hideState();
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {