partforge 0.109.0 → 0.110.0

package/docs/AUTHORING-PARTS.md

@@ -3456,6 +3456,16 @@ symptom first** — it maps error text → cause → fix. The invariants, one li
   For the case that causes this most often — a tapped hole — reach for
   `k.tappedBore`, which owns the bore and the thread together and cannot land them
   on the same face.
+- **A boolean that comes back geometrically impossible is a build error, not a
+  part.** Every `cut`/`cutAll`/`intersect`/`union` result is judged by volume against
+  its operands on both backends: a union smaller than an input, a cut that grew, a
+  negative volume, or the exact kernel's silent "returned one operand instead of the
+  union" all throw `boolean result invalid: …` with the fix menu above instead of
+  shipping a wrong preview or STEP file
+  ([boolean-dropped-operand](ERROR-PATTERNS.md#boolean-dropped-operand),
+  [boolean-impossible-result](ERROR-PATTERNS.md#boolean-impossible-result)). A
+  legitimately degenerate design — a hole wider than its plate — is not impossible and
+  builds as before; `verify` is what catches that.
 
 ---
 

package/docs/ERROR-PATTERNS.md

@@ -68,6 +68,18 @@ The framework itself rebuilds each sub-part fresh per job and applies `place` on
 - **Detected:** The exact kernel now refuses the common cylindrical form of this contact up front — several swept faces lying exactly on one cylindrical face fail the boolean immediately with `<op> between exactly-touching surfaces: … (radius <r>)` and the fix menu below, instead of grinding. Scope, honestly: the guard needs the contact to tile the cylinder (a thread does, ~6+ hugging faces per turn; a sub-turn thread can slip under it — that is the old grinding behavior, not a new one), it covers swept-face-on-cylinder contact only (two swept faces mated exactly, or contact with non-cylindrical faces, can still hang), and a hand-sunk thread whose chord-bands happen to hug the wall can be refused even though it would have built — `k.tappedBore` resolves that refusal too, since its internal composition is exempt. The rule below applies everywhere regardless.
 - **Fix:** For a tapped hole — far and away the most common cause — use `k.tappedBore({ d, pitch, turns, depth })`, which returns the bore and its thread as one tool and cannot put them on the same face. Otherwise: give the surfaces a deliberate clearance instead of letting them land on the same number. Derive one from the other with an explicit gap — `const boreD = threadRootD - 2 * boreClearance;` with `boreClearance` around 0.05-0.1 mm — rather than reusing the same expression for both. The gap is far below a printable layer, so the fit is unchanged. The same rule covers a cut that ends exactly flush with a face (overshoot it by a few tenths, as the surrounding examples do with `+ 0.4` / `- 0.2`) and two tools that abut exactly end-to-end.
 
+## boolean-dropped-operand
+
+- **Symptom:** `dropped an operand` — the full message reads `boolean result invalid: <op> dropped an operand — the result's volume (<v>) equals operand <i>'s exactly, but operand <j> (<vj>) has <x> mm³ of material outside it that the union lost.`, thrown from a `union` (or from `cutAll`, labelled `cutAll (tools)`, whose tools are fused before the cut; or labelled `k.tappedBore's bore ∪ thread union`, in which case the author wrote no union — the framework's own composition failed, report it). Before partforge 0.110 the same construction shipped silently: a STEP export that is a plain cylinder, a preview missing the thread, a `measure` volume equal to the core's alone ([screw-thread-vanishes-on-occt](#screw-thread-vanishes-on-occt)).
+- **Cause:** The exact kernel's fuse failed without reporting it and returned one operand instead of the union — a thin or near-self-touching swept operand (a sub-pitch thread ridge riding a core, a thread tool whose root sits on the bore wall) is the case seen on real parts. The gate (`boolean-gate.js`) noticed because the result's volume is one operand's to float precision while the other operand has material outside it, which no union can lose.
+- **Fix:** Give the operands genuine overlap rather than a tangent contact (sink one 0.05 mm or more into the other — derive one radius from the other with an explicit offset, never the same expression twice). Build a thread in the **periodic** `screwSweep` form, which needs no union at all, or a tapped hole with `k.tappedBore`, which owns the bore and thread together. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "Helical & threaded features". Do not "fix" it by catching the error — the geometry it refused is wrong, and the previous good preview stays on screen while you correct the construction.
+
+## boolean-impossible-result
+
+- **Symptom:** `produced an impossible result` — the full message reads `boolean result invalid: <op> produced an impossible result — …`, thrown from `union`, `cut`, `cutAll` or `intersect`, naming one of: `a negative volume`, `a union smaller than its largest operand`, `a cut larger than its body`, `a cut that emptied its body although the tools cover at most <x> mm³ of its <y> mm³`, `an intersection larger than its smallest operand`.
+- **Cause:** The kernel's boolean returned geometry that violates the one property no boolean may (a union contains its inputs, a cut only removes, an intersection lies inside each input, a solid has non-negative volume) without reporting an error. On the exact kernel this follows a tangent or self-touching contact the coincidence guard could not recognise up front ([boolean-coincident-faces-hang](#boolean-coincident-faces-hang) covers the form it does refuse); on the mesh kernel it should never happen and would be a kernel bug worth reporting. The gate carries 1% slack on the largest operand, so volume-integration noise cannot trip it.
+- **Fix:** The same menu as the coincidence guard's — genuine overlap or genuine clearance (0.05 mm or more) instead of exact contact, cut tools overcut past the faces they pierce, threads in the periodic `screwSweep` form or via `k.tappedBore`. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "Gotchas". A refusal is a throw, not a warning, on purpose: the alternative is the silently wrong part these rules exist to stop, and a live preview keeps its last good mesh on screen across a failed rebuild.
+
 ## chamfer-rescue-bisection
 
 - **Symptom:** `partforge: chamfer` warning saying the distance `over-ran the geometry — reduced to` a smaller one (or `has no valid distance`), with an attempt count and elapsed seconds, alongside slow builds.
@@ -574,6 +586,13 @@ Variant literal for a curve-adjacent corner: `filletProfile: corner <i> at (<x>,
 - **Cause:** the thread was built as a thin sub-pitch helical sliver and unioned
   onto a core. OCCT's boolean fails on a near-self-touching swept operand and
   silently returns the other operand — or nothing — rather than throwing.
+- **Detected:** since partforge 0.110 the boolean result gate refuses both
+  outcomes instead of shipping them — `boolean result invalid: union dropped an
+  operand` when the core comes back alone
+  ([boolean-dropped-operand](#boolean-dropped-operand)), `… produced an
+  impossible result` when nothing does
+  ([boolean-impossible-result](#boolean-impossible-result)). The fix below is
+  unchanged; the symptom is now a build error naming it.
 - **Fix:** build the thread in the **periodic** form instead — a profile spanning
   exactly one `pitch` with equal first and last radius encloses the axis, so
   `k.screwSweep` yields the whole threaded body with no boolean at all. See

package/docs/KERNEL-CONTRACT.md

@@ -487,6 +487,44 @@ exactly the old behavior. The same array also carries *job-level* notices that
 belong to no single sub-part — currently a font source refused by its control's
 `allow` list — as entries with `part: null`.
 
+**Boolean result gate** (both backends, partforge 0.110, `boolean-gate.js`): every
+author-facing boolean — `cut`, `cutAll`, `intersect`, `union` in both forms, and the
+B-rep backend's internal tool fuse inside `cutAll` — is judged AFTER it runs, by
+volume against its operands, and a result that violates the one property no boolean
+may violate **throws** (`code: "BOOLEAN_RESULT_INVALID"`, message leading
+`boolean result invalid:`): a union smaller than any operand, a cut larger than its
+body, an intersection larger than its smallest operand, a negative volume. Each
+inequality carries 1% of the operand it is compared AGAINST as slack (floored at
+1e-6 mm³) — never of the largest operand, which would switch the cut and intersect
+rules off whenever the tool is the big one — so volume-integration noise can never
+fire them. Two signatures the inequalities cannot decide are confirmed lazily, on that
+signature only: first a free bounding-box enclosure test, then ONE extra intersect. A
+union whose volume equals one operand's to float precision is refused when the other
+operand has material outside it, judged against that operand's OWN size (the
+documented silent failure — a thin thread ridge dropped, the core returned alone);
+a cut that came back empty is refused when its tools cannot have covered the body. A
+probe that fails is inconclusive, never a refusal, and so is a negative OPERAND (broken
+input, not this boolean's doing). On the B-rep class the probe intersect runs through
+the coincidence guard like every other boolean — it runs on exactly the pair that just
+misbehaved — and a guard refusal counts as "nothing inside", which on the equal-volume
+signature is the refusal the gate was about to make anyway rather than an unabortable
+grind. A refusal is remembered by cache key, so a live edit does not re-pay the failing
+boolean per rebuild. This is deliberately NOT the warnings channel: a skipped fillet is
+an honest part minus a feature, whereas a union that lost its core is wrong, and the two
+other provably-wrong cases in this contract (an empty `Shape2D` reaching `extrude`, the
+coincidence guard) throw for the same reason; a refusal raised by a boolean INSIDE a
+degrading feature (the mesh fillet's own cutters and fillers, a B-rep `safeOp`) is
+caught by that feature's policy and reported as its skip, message included. Results are
+judged once, before they enter the solid cache. A conforming mesh kernel is expected
+never to trip it — the rule is stated for both classes so that a mesh-class refusal
+reads as the kernel bug it would be; measured, the volume reads cost ~0.4% on a
+hundred-cut chain there. Classification: additive, `CONTRACT_VERSION` stays 4. The
+Versioning rule below counts "tightened validation that rejects previously valid
+input" as breaking; this rejects input the kernel previously ACCEPTED but never built
+correctly — every refused result is wrong geometry the author could not have wanted —
+so no previously valid part changes, and a part it refuses was already broken on that
+backend, with the breakage now named.
+
 ## Shape2D (2-D booleans)
 
 `k.shape2d(profile)` (`KERNEL_OPS`) lifts a point list, `{outer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "partforge",
-  "version": "0.109.0",
+  "version": "0.110.0",
   "description": "Turn a declarative part definition into a parametric-CAD web app (three.js + Manifold/Replicad). Requires a Vite-based consumer.",
   "type": "module",
   "license": "MIT",
@@ -96,6 +96,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json",
+    "lint": "eslint .",
+    "lint:dead": "knip",
     "check": "node scripts/check-app.mjs",
     "offset-rates": "node scripts/offset-rates.mjs"
   },
@@ -120,9 +122,13 @@
     "three": "^0.184.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@fontsource-variable/geist": "^5.3.0",
     "@fontsource-variable/geist-mono": "^5.3.0",
+    "eslint": "^10.10.0",
+    "globals": "^17.12.0",
     "happy-dom": "^20.10.6",
+    "knip": "^6.35.1",
     "playwright": "^1.49.0",
     "typescript": "^5.9.3",
     "vite": "^8.0.16",

package/src/framework/geometry/boolean-gate.js

@@ -0,0 +1,200 @@
+// Refuses a boolean whose RESULT is geometrically impossible — after the op ran.
+//
+// The failure this exists for (measured on real parts, and independently in the
+// 2026-09 ModelRift CadQuery/OpenSCAD study): an exact B-rep kernel's boolean
+// does not throw when it fails. It returns one operand instead of the union, an
+// empty solid instead of the cut, or a negative-volume shape that its own
+// validity check still calls valid — and every one of those ships as a STEP
+// file, a preview, or a `measure` report that looks like a part. The
+// coincidence guard (occt-coincidence.js) refuses the one degenerate
+// CONSTRUCTION it can recognise before the op runs; this gate is the other
+// half, judging the result by the one property no boolean may violate: its
+// volume relative to its inputs.
+//
+//   union      ≥ every operand        (a union contains its inputs)
+//   cut        ≤ its body             (a cut only removes)
+//   intersect  ≤ its smallest operand (an intersection lies inside each input)
+//   any        ≥ 0
+//
+// The inequalities are cheap — one volume read per solid, memoized by the
+// backends — and each carries a slack of 1% of the operand it is compared
+// AGAINST (floored at 1e-6 mm³), so B-spline volume integration noise can never
+// fire them. Scaling the slack to the largest operand instead would switch the
+// cut and intersect rules off whenever the tool is the big one, which the
+// "overcut your tools" guidance makes routine. What the inequalities cannot
+// catch is the exact documented signature of a dropped operand: a thin thread
+// ridge unioned onto a core comes back as the core alone, which is LARGER than
+// the ridge and so passes `union ≥ every operand`. That signature — the
+// result's volume equals one operand's to float precision — is the one place
+// the gate asks for more: first a bounding-box enclosure test (an operand whose
+// box lies inside the other's cannot have lost material; free, and it settles
+// the legitimate "boss buried in the plate" union without a boolean), then an
+// overlap volume (`operands[i] ∩ operands[j]`, supplied lazily by the backend
+// so the extra boolean only ever runs on this signature). If the other operand
+// has material outside the equal one, the union lost it — judged against that
+// operand's OWN size, so a thin ridge is not hidden behind the core's slack.
+// The same probe decides a cut that came back EMPTY: impossible unless the
+// tools covered the whole body. A probe that throws is inconclusive, never a
+// refusal; so is a negative OPERAND, which is broken input rather than this
+// boolean's doing (the backends latch orientation where they know to).
+//
+// This module is pure and backend-neutral on purpose: both kernels call it from
+// inside their cached boolean closures (a cache hit is never re-judged), and
+// test/boolean-gate.test.js pins every rule with plain numbers — the
+// malfunctions it exists for have no deterministic fixture, since the
+// reproducible one is now refused up front by the coincidence guard. Mesh CSG
+// is exact arithmetic and is expected never to trip it; measured, the reads
+// cost nothing there (~0.4% on a hundred-cut chain), and a mesh-class refusal
+// would be a kernel bug worth seeing.
+//
+// A refusal THROWS rather than warning. The warnings channel is for honest
+// degradation (a skipped fillet leaves a correct part minus a feature); a union
+// that lost its core is wrong, not degraded, and the two existing precedents for
+// provably wrong geometry — an empty Shape2D reaching `extrude`, and the
+// coincidence guard — both throw with coaching. In the cloud app that throw lands
+// in the export dialog's "Ask the assistant to fix it" path with the message
+// forwarded verbatim, and a live preview keeps its last good mesh on screen.
+// A refusal that reaches a boolean INSIDE a degrading feature (the mesh fillet's
+// own cutters and fillers, a B-rep safeOp) is caught there and reported as that
+// feature's skip, message included — the feature is what failed, and the part
+// minus it is still honest.
+import { BooleanResultError } from "./errors.js";
+
+export const BOOLEAN_RESULT_INVALID = "BOOLEAN_RESULT_INVALID";
+
+// Slack on the inequalities, relative to the operand being compared against and
+// floored absolutely. 1% is far above any volume-integration error either kernel
+// produces (OCCT's GProp on spline faces; Manifold's exact triangle sum) and far
+// below any real failure (the measured cases were 30% and 100% off).
+const REL_TOL = 1e-2;
+const ABS_TOL = 1e-6; // mm³
+const tolOf = (v) => Math.max(ABS_TOL, REL_TOL * v);
+// "Equals one operand exactly": a returned-unchanged operand reports the identical
+// number; a genuine union that added less than this is physically nothing.
+const EQUAL_REL = 1e-9;
+
+const fmt = (v) => Number(v.toPrecision(6)).toString();
+
+const IMPOSSIBLE_COACHING =
+  "The kernel's boolean returned broken geometry without reporting an error, so the build was " +
+  "refused rather than shipping it. This happens on an exact B-rep kernel when operands touch " +
+  "tangentially or a swept operand nearly touches itself; give the surfaces genuine overlap or " +
+  "genuine clearance (0.05 or more) instead of an exact contact, overcut tools past the faces " +
+  "they pierce, and build threads in the periodic screwSweep form or with k.tappedBore. " +
+  "See ERROR-PATTERNS.md#boolean-impossible-result.";
+
+const DROPPED_COACHING =
+  "The kernel's boolean returned one input instead of the union, without reporting an error — " +
+  "usually a thin or near-self-touching swept operand (a sub-pitch thread ridge riding a core). " +
+  "Give the operands genuine overlap instead of a tangent contact; build a thread in the periodic " +
+  "screwSweep form so it needs no union, or a tapped hole with k.tappedBore. " +
+  "See ERROR-PATTERNS.md#boolean-dropped-operand.";
+
+const impossible = (label, detail) =>
+  new BooleanResultError(`boolean result invalid: ${label} produced an impossible result — ${detail} ${IMPOSSIBLE_COACHING}`);
+const dropped = (label, detail) =>
+  new BooleanResultError(`boolean result invalid: ${label} dropped an operand — ${detail} ${DROPPED_COACHING}`);
+
+// Probe `operands[i] ∩ operands[j]`'s volume through the backend's thunk; null when
+// the probe itself fails (an inconclusive answer must not become a refusal).
+function overlapOf(overlap, i, j) {
+  try {
+    const v = overlap(i, j);
+    return Number.isFinite(v) ? Math.max(0, v) : null;
+  } catch {
+    return null;
+  }
+}
+
+// Cheap enclosure pre-test: true only when the backend can say from bounding
+// boxes alone that operand j lies inside operand i. Absent or throwing = unknown.
+function enclosedBy(encloses, i, j) {
+  try { return encloses?.(i, j) === true; } catch { return false; }
+}
+
+/**
+ * Judge a boolean's result by volume.
+ *
+ * @param {"union"|"cut"|"cutAll"|"intersect"} op
+ * @param {number[]} operands  volumes; for cut/cutAll index 0 is the body, the rest tools
+ * @param {number} result      the result's volume
+ * @param {{ overlap: (i: number, j: number) => number, encloses?: (i: number, j: number) => boolean }} probes
+ *   `overlap` lazily computes the volume of `operands[i] ∩ operands[j]`; consulted only
+ *   on the two signatures the inequalities cannot decide, and allowed to throw (treated
+ *   as inconclusive). `encloses(i, j)` answers "does operand i's bounding box contain
+ *   operand j's" — when true the overlap is never asked for.
+ * @param {string} [label=op]  how the message names the op — a backend that fuses
+ *   cutAll's tools before cutting judges that fuse as a `union` labelled `cutAll (tools)`
+ * @returns {BooleanResultError|null}
+ */
+export function checkBooleanResult(op, operands, result, probes, label = op) {
+  if (operands.length < 2) return null;
+  if (!Number.isFinite(result) || !operands.every(Number.isFinite)) return null;
+  if (operands.some((v) => v < 0)) return null; // broken input, not this boolean's result
+  const { overlap, encloses } = probes ?? {};
+  const largest = Math.max(...operands);
+
+  if (result < -tolOf(largest)) {
+    return impossible(label, `a negative volume (${fmt(result)} mm³).`);
+  }
+
+  if (op === "union") {
+    if (result < largest - tolOf(largest)) {
+      return impossible(label, `a union smaller than its largest operand (${fmt(result)} mm³ vs ${fmt(largest)} mm³).`);
+    }
+    // The dropped-operand signature: the result IS one operand. Every other operand
+    // with volume must then lie inside it, or the union lost material.
+    const i = operands.findIndex((v) => v > ABS_TOL && Math.abs(result - v) <= EQUAL_REL * v);
+    if (i < 0) return null;
+    for (let j = 0; j < operands.length; j++) {
+      const vj = operands[j];
+      if (j === i || vj <= ABS_TOL || enclosedBy(encloses, i, j)) continue;
+      const inside = overlapOf(overlap, i, j);
+      if (inside === null) continue;
+      const outside = vj - inside;
+      if (outside > tolOf(vj)) {
+        return dropped(label,
+          `the result's volume (${fmt(result)} mm³) equals operand ${i}'s exactly, but operand ${j} ` +
+          `(${fmt(vj)} mm³) has ${fmt(outside)} mm³ of material outside it that the union lost.`);
+      }
+    }
+    return null;
+  }
+
+  if (op === "cut" || op === "cutAll") {
+    const body = operands[0];
+    const tol = tolOf(body);
+    if (result > body + tol) {
+      return impossible(label, `a cut larger than its body (${fmt(result)} mm³ vs ${fmt(body)} mm³).`);
+    }
+    if (result <= tol && body > tol) {
+      // Empty result: only possible when the tools covered the whole body. A tool
+      // whose box encloses the body's settles it; otherwise each tool's overlap is
+      // summed — an OVER-estimate of coverage (tools may overlap each other), so
+      // this refuses only when even that cannot reach the body's volume.
+      let covered = 0;
+      for (let j = 1; j < operands.length; j++) {
+        if (operands[j] <= ABS_TOL) continue;
+        if (enclosedBy(encloses, j, 0)) return null;
+        const inside = overlapOf(overlap, 0, j);
+        if (inside === null) return null; // inconclusive
+        covered += inside;
+      }
+      if (covered < body - tol) {
+        return impossible(label,
+          `a cut that emptied its body although the tools cover at most ${fmt(covered)} mm³ of its ${fmt(body)} mm³.`);
+      }
+    }
+    return null;
+  }
+
+  if (op === "intersect") {
+    const smallest = Math.min(...operands);
+    if (result > smallest + tolOf(smallest)) {
+      return impossible(label, `an intersection larger than its smallest operand (${fmt(result)} mm³ vs ${fmt(smallest)} mm³).`);
+    }
+    return null;
+  }
+
+  return null;
+}

package/src/framework/geometry/errors.js

@@ -8,3 +8,14 @@ export class KernelCapabilityError extends Error {
     this.code = "NEEDS_OCCT";
   }
 }
+
+// Thrown by the boolean result gate (boolean-gate.js) when a boolean's result is
+// geometrically impossible — the kernel returned wrong geometry without reporting
+// it. Not a capability gap: nothing reroutes on it. `.code` is the stable handle.
+export class BooleanResultError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BooleanResultError";
+    this.code = "BOOLEAN_RESULT_INVALID";
+  }
+}

package/src/framework/geometry/manifold-backend.js

@@ -18,6 +18,7 @@ import { creasedNormals } from "./creased-normals.js";
 import { loftShadingPolicy, SMOOTH, BLEND } from "./shading-policy.js";
 import { meshFillet, meshChamfer, UnsupportedEdgeError } from "./mesh-fillet.js";
 import { meshRoundAll, prismSection, roundAllSegs } from "./mesh-roundall.js";
+import { checkBooleanResult } from "./boolean-gate.js";
 import { KernelCapabilityError } from "./errors.js";
 import { heightfieldMesh, hashGridData } from "./heightfield.js";
 
@@ -55,6 +56,42 @@ export function createManifoldKernel(wasm, { quality = "preview" } = {}) {
   // while Manifold's own batch operator evaluates the same union as a balanced tree.
   // A one-solid "union" returns the operand's own Manifold untouched (see union below).
   const unionRaw = (ms) => (ms.length === 1 ? ms[0] : T(Manifold.union(ms)));
+  // Boolean result gate (boolean-gate.js): every author-facing boolean's result is
+  // judged by volume against its operands before it enters the cache, and an
+  // impossible result throws instead of shipping. Mesh CSG is exact arithmetic,
+  // so this backend is expected never to trip it — it is here because the gate
+  // is one kernel-contract rule, not an OCCT special case, and a refusal on this
+  // backend would itself be a kernel bug worth seeing. Measured at ~0.4% on a
+  // hundred-cut chain: `volume()` forces the lazy CSG node, but chained booleans
+  // were never batched in this binding, so nothing is lost to the read. Volumes
+  // are memoized per Manifold object (a result judged here is an operand a step
+  // later). The probes run only on the dropped-operand / emptied-body
+  // signatures: an enclosure test off bounding boxes first, and an intersect
+  // whose result is freed as soon as its one number is read — NOT tracked, so
+  // an n-ary union of buried features does not hold n intermediates to cleanup.
+  const volumes = new WeakMap();
+  const volumeOf = (mm) => {
+    let v = volumes.get(mm);
+    if (v === undefined) { v = mm.volume(); volumes.set(mm, v); }
+    return v;
+  };
+  const BOX_SLACK = 1e-3; // mm — an enclosure test, not a measurement
+  const judged = (op, operandMs, resultM) => {
+    const box = (mm) => mm.boundingBox();
+    const err = checkBooleanResult(op, operandMs.map(volumeOf), volumeOf(resultM), {
+      overlap: (i, j) => {
+        const x = operandMs[i].intersect(operandMs[j]);
+        try { return x.volume(); } finally { x.delete?.(); }
+      },
+      encloses: (i, j) => {
+        const a = box(operandMs[i]), b = box(operandMs[j]);
+        return [0, 1, 2].every((k) => b.min[k] >= a.min[k] - BOX_SLACK && b.max[k] <= a.max[k] + BOX_SLACK);
+      },
+    });
+    if (err) throw err;
+    return resultM;
+  };
+  const judgedUnion = (ms) => judged("union", ms, unionRaw(ms));
 
   const cache = createSolidCache();
   // Feature-skip warnings (the OCCT backend's safeOp policy, adopted here): a
@@ -348,7 +385,7 @@ export function createManifoldKernel(wasm, { quality = "preview" } = {}) {
     _m: m,
     _hash: hash,
     _canon: canon,
-    cut: (t) => cached(h("cut", hash, t._hash), () => T(m.subtract(t._m))),
+    cut: (t) => cached(h("cut", hash, t._hash), () => judged("cut", [m, t._m], T(m.subtract(t._m)))),
     // THROWING forms. These are the composition primitives — internal callers
     // that have their own recovery (prismRoundAllFast, which answers a failed
     // fillet by falling back to the reference Minkowski roundAll) must use
@@ -411,10 +448,12 @@ export function createManifoldKernel(wasm, { quality = "preview" } = {}) {
     },
     // batch difference: first minus the union of the rest, evaluated as one boolean
     // tree — no materialized intermediate union (the unionRaw memory note applies)
-    cutAll: (tools) => cached(h("cutAll", hash, tools.map((t) => t._hash)),
-      () => T(Manifold.difference([m, ...tools.map((t) => t._m)]))),
-    intersect: (t) => cached(h("intersect", hash, t._hash), () => T(m.intersect(t._m))),
-    union: (t) => cached(h("union", [hash, t._hash]), () => unionRaw([m, t._m])),
+    cutAll: (tools) => cached(h("cutAll", hash, tools.map((t) => t._hash)), () => {
+      const ms = [m, ...tools.map((t) => t._m)];
+      return judged("cutAll", ms, T(Manifold.difference(ms)));
+    }),
+    intersect: (t) => cached(h("intersect", hash, t._hash), () => judged("intersect", [m, t._m], T(m.intersect(t._m)))),
+    union: (t) => cached(h("union", [hash, t._hash]), () => judged("union", [m, t._m], unionRaw([m, t._m]))),
     clone: () => wrap(m, hash),
     // Name this solid's surface for hover/pick feature attribution. asOriginal()
     // stamps a fresh originalID that survives transforms and booleans, so every
@@ -724,8 +763,8 @@ export function createManifoldKernel(wasm, { quality = "preview" } = {}) {
     // would pin one WASM object under two entries and eviction would dispose it twice.
     union: (solids) => solids.length === 1
       ? solids[0]
-      : hoistBoolean("union", solids, (ops) => unionRaw(ops.map((s) => s._m)))
-        ?? cached(h("union", solids.map((s) => s._hash)), () => unionRaw(solids.map((s) => s._m))),
+      : hoistBoolean("union", solids, (ops) => judgedUnion(ops.map((s) => s._m)))
+        ?? cached(h("union", solids.map((s) => s._hash)), () => judgedUnion(solids.map((s) => s._m))),
     // Imported geometry, registered pre-build by the framework via `_registerImport`
     // (ensureImports, Task 8). The master Manifold is kernel-lifetime (untracked —
     // see `imports` above); wrap() is free, so every call is cheap.

package/src/framework/geometry/occt-backend.js

@@ -16,6 +16,7 @@
 //     Ops that need the real B-rep (booleans, fillet/chamfer/shell, exports,
 //     volume, boundingBox) materialize the pending pose through replicad first.
 import { assertNoCoincidentBoolean } from "./occt-coincidence.js";
+import { checkBooleanResult } from "./boolean-gate.js";
 import { toEdgeFinder } from "./edge-selector.js";
 import { toFaceFinder } from "./face-selector.js";
 import { addSugar } from "./solid-sugar.js";
@@ -128,6 +129,66 @@ export function createOcctKernel(replicad) {
   // see occt-repair.js for the policies and why they differ per op.
   const { validChamfer, safeOp } = createOcctRepair(measureVolume, recordWarning);
 
+  // Boolean result gate (boolean-gate.js): the coincidence guard above refuses the
+  // one degenerate CONSTRUCTION it can recognise before a boolean runs; this judges
+  // the RESULT afterwards, by volume, and throws on the impossible — a union
+  // smaller than an input, a cut that grew, a negative volume, and the documented
+  // silent failure where OCCT hands back one operand instead of the union.
+  // `judge(op, shapes, run)` owns the ordering: operand volumes are read BEFORE
+  // `run` (replicad consumes what it fuses/cuts, so a fused tool measured
+  // afterwards would be a deleted shape), the result's after; both are memoized
+  // per replicad shape, since a judged result is the next op's operand. A
+  // one-operand call runs unjudged and unmeasured (the gate has nothing to
+  // compare). The probes run only on the signatures the inequalities cannot
+  // decide: an enclosure test off bounding boxes first — a padded B-spline box
+  // can only make enclosure HARDER to prove, the safe direction — then one
+  // intersect on clones, freed at once. That intersect goes through the
+  // coincidence guard like every other boolean here, because it runs on exactly
+  // the operand pair that just misbehaved: a refused pair answers "nothing
+  // inside", which on the equal-volume signature is the refusal the gate was
+  // about to make anyway rather than a grind the WASM build cannot abort. A
+  // refusal is remembered by cache key so a live edit does not re-pay the failing
+  // boolean and its probe on every rebuild, and the refused shape is freed.
+  const volumes = new WeakMap();
+  const volumeOf = (s) => {
+    let v = volumes.get(s);
+    if (v === undefined) { v = measureVolume(s); volumes.set(s, v); }
+    return v;
+  };
+  const BOX_SLACK = 1e-3; // mm — an enclosure test, not a measurement
+  const encloses = (a, b) => {
+    const [amin, amax] = a.boundingBox.bounds, [bmin, bmax] = b.boundingBox.bounds;
+    return [0, 1, 2].every((k) => bmin[k] >= amin[k] - BOX_SLACK && bmax[k] <= amax[k] + BOX_SLACK);
+  };
+  const judge = (op, shapes, run, label = op) => {
+    if (shapes.length < 2) return run();
+    const operandVolumes = shapes.map(volumeOf);
+    const result = run();
+    const err = checkBooleanResult(op, operandVolumes, volumeOf(result), {
+      encloses: (i, j) => encloses(shapes[i], shapes[j]),
+      overlap: (i, j) => {
+        try { guardBoolean("intersect", [shapes[i], shapes[j]]); }
+        catch (e) { if (e?.code === "COINCIDENT_BOOLEAN") return 0; throw e; }
+        let x;
+        try { x = shapes[i].clone().intersect(shapes[j].clone()); return measureVolume(x); }
+        finally { x?.delete?.(); }
+      },
+    }, label);
+    if (err) { result.delete?.(); throw err; }
+    return result;
+  };
+  const refusals = new Map();
+  const judgedCache = (key, make) => {
+    const remembered = refusals.get(key);
+    if (remembered) throw remembered;
+    return cached(key, () => {
+      try { return make(); } catch (e) {
+        if (e?.code === "BOOLEAN_RESULT_INVALID") refusals.set(key, e);
+        throw e;
+      }
+    });
+  };
+
   // name -> { shape, digest } | { error, digest } — imported geometry the framework
   // registers pre-build via `_registerImport` (kernel-lifetime, untracked by the
   // solid cache: imports are the framework's own memo, keyed by name+digest).
@@ -228,26 +289,32 @@ export function createOcctKernel(replicad) {
       },
       cut: (t) => {
         const key = h("cut", hash, t._hash);
-        return cached(key, () => {
+        return judgedCache(key, () => {
           const a = mat(), b = t._mat();
           guardBoolean("cut", [a._s, b._s]);
-          return wrap(a._s.clone().cut(b._s.clone()), [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
+          const result = judge("cut", [a._s, b._s], () => a._s.clone().cut(b._s.clone()));
+          return wrap(result, [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
         });
       },
       cutAll: (tools) => {
         const key = h("cutAll", hash, tools.map((t) => t._hash));
-        return cached(key, () => {
+        return judgedCache(key, () => {
           const a = mat(), bs = tools.map((t) => t._mat());
           if (bs.length === 0) return wrap(a._s.clone(), cloneLabels(a._labels), key);
+          const toolShapes = bs.map((b) => b._s);
           // All pairs, tools included: the cut below first fuses the tools
           // together, so tool-to-tool contact hangs exactly like target-to-tool
           // (the measured case WAS two tools — a bore and its thread).
-          guardBoolean("cutAll", [a._s, ...bs.map((b) => b._s)]);
-          const fusedTools = bs
-            .slice(1)
-            .reduce((acc, b) => acc.fuse(b._s.clone()), bs[0]._s.clone());
+          guardBoolean("cutAll", [a._s, ...toolShapes]);
+          // The tool fuse is a union in its own right — the bore + thread case
+          // fails HERE (the thread dropped, the cut then honestly removes a plain
+          // bore), so it is judged as one before the cut is.
+          const fusedTools = judge("union", toolShapes,
+            () => bs.slice(1).reduce((acc, b) => acc.fuse(b._s.clone()), bs[0]._s.clone()),
+            "cutAll (tools)");
+          const result = judge("cutAll", [a._s, ...toolShapes], () => a._s.clone().cut(fusedTools));
           return wrap(
-            a._s.clone().cut(fusedTools),
+            result,
             [...cloneLabels(a._labels), ...bs.flatMap((b) => cloneLabels(b._labels))],
             key,
           );
@@ -255,18 +322,20 @@ export function createOcctKernel(replicad) {
       },
       intersect: (t) => {
         const key = h("intersect", hash, t._hash);
-        return cached(key, () => {
+        return judgedCache(key, () => {
           const a = mat(), b = t._mat();
           guardBoolean("intersect", [a._s, b._s]);
-          return wrap(a._s.clone().intersect(b._s.clone()), [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
+          const result = judge("intersect", [a._s, b._s], () => a._s.clone().intersect(b._s.clone()));
+          return wrap(result, [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
         });
       },
       union: (t) => {
         const key = h("union", [hash, t._hash]);
-        return cached(key, () => {
+        return judgedCache(key, () => {
           const a = mat(), b = t._mat();
           guardBoolean("union", [a._s, b._s]);
-          return wrap(a._s.clone().fuse(b._s.clone()), [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
+          const result = judge("union", [a._s, b._s], () => a._s.clone().fuse(b._s.clone()));
+          return wrap(result, [...cloneLabels(a._labels), ...cloneLabels(b._labels)], key);
         });
       },
       clone: () => wrap(shape.clone(), cloneLabels(labels), hash, pose, baseHash),
@@ -343,7 +412,7 @@ export function createOcctKernel(replicad) {
           return wrap(safeOp(a._s.clone(), (sh) => sh.shell(thickness, toFaceFinder(openFaces)), `shell(${thickness})`), cloneLabels(a._labels), key);
         });
       },
-      volume: () => measureVolume(mat()._s),
+      volume: () => volumeOf(mat()._s), // shares the gate's memo — a judged result is already measured
       // Same default as toSTL: an export is an export, so a .3mf must not ship a
       // coarser tessellation than the .stl of the same solid would.
       toIndexedMesh: ({ quality = "print" } = {}) => {
@@ -643,11 +712,11 @@ export function createOcctKernel(replicad) {
     sphere: (r) => cached(h("sphere", r), () => wrap(makeSphere(r), [], h("sphere", r))),
     union: (solids) => {
       const key = h("union", solids.map((s) => s._hash));
-      return cached(key, () => {
+      return judgedCache(key, () => {
         const ms = solids.map((s) => s._mat());
         guardBoolean("union", ms.map((m) => m._s));
         return wrap(
-          ms.map((m) => m._s.clone()).reduce((a, b) => a.fuse(b)),
+          judge("union", ms.map((m) => m._s), () => ms.map((m) => m._s.clone()).reduce((a, b) => a.fuse(b))),
           ms.flatMap((m) => cloneLabels(m._labels)),
           key,
         );
@@ -661,10 +730,15 @@ export function createOcctKernel(replicad) {
     // Same cache key as union — the geometry is identical either way.
     _trustedUnion: (solids) => {
       const key = h("union", solids.map((s) => s._hash));
-      return cached(key, () => {
+      return judgedCache(key, () => {
         const ms = solids.map((s) => s._mat());
+        // Trusted skips the PRE-check only; the result is judged like any union —
+        // the volume gate is precisely what proves the trusted composition worked.
+        // Labelled for what it is: the author never wrote this union, so a refusal
+        // here means the framework's own audited composition broke on this kernel.
         return wrap(
-          ms.map((m) => m._s.clone()).reduce((a, b) => a.fuse(b)),
+          judge("union", ms.map((m) => m._s), () => ms.map((m) => m._s.clone()).reduce((a, b) => a.fuse(b)),
+            "k.tappedBore's bore ∪ thread union (the framework's own composition — report this)"),
           ms.flatMap((m) => cloneLabels(m._labels)),
           key,
         );

package/src/framework/panel/declared-source.js

@@ -13,8 +13,6 @@
 // Main-thread only, and deliberately import-free beyond what a lookup needs: it
 // runs during panel construction, on every rebuild.
 
-const arr = (v) => (Array.isArray(v) ? v : []);
-
 // `images`/`vectors`/`fonts` may each be a plain map or a function of params —
 // the function form is what a control drives. Resolving it can throw (it is
 // author code running on every panel build), and a broken declaration must not

package/src/framework/param-deps.js

@@ -5,7 +5,6 @@
 import { createProbeKernel } from "./geometry/probe.js";
 import { byteAwareReplacer } from "./geometry/solid-hash.js";
 import { viewSubParts } from "./part-model.js";
-import { resolveDerived } from "./derive.js";
 
 export const RELEVANT_ALL = Symbol("relevant-all");
 

package/src/framework/pick-request/server.js

@@ -22,10 +22,7 @@ import {
   isLoopbackOrigin, isLoopbackHost,
 } from "./endpoint.js";
 
-export {
-  PICK_SERVER_DEFAULT_PORT, PICK_SERVER_DEFAULT_TIMEOUT_MS, PICK_SERVER_DEFAULT_HOST,
-  PICK_SERVER_DEFAULT_URL,
-} from "./endpoint.js";
+export { PICK_SERVER_DEFAULT_PORT, PICK_SERVER_DEFAULT_TIMEOUT_MS } from "./endpoint.js";
 
 const MAX_BODY_BYTES = 256 * 1024;   // no route needs more; anything bigger is abuse
 const MAX_SELECTION_CHARS = 16 * 1024;

package/src/parts/faceted-vase.js

@@ -3,7 +3,6 @@
 // running twist plus an alternating half-facet offset, so the facets zig-zag into a
 // woven look. A second, wall-inset loft is cut from the body to hollow it (Manifold
 // backend, so it stays fast — no OCCT). See docs/AUTHORING-PARTS.md for the conventions.
-import { regularPolygon } from "partforge/geometry";
 
 const RINGS = 28; // silhouette resolution (ring count up the height)