partforge 0.139.0 → 0.141.0

package/docs/AUTHORING-PARTS.md

@@ -105,6 +105,10 @@ export default {
   `"display"` or `"export"`; `ctx.view` is the active view. Default is identity, so simple
   parts omit it. **Display placement must not depend on `view`** — display meshes are built
   once per sub-part and cached across views (the viewer re-centres per view).
+  The viewer applies the display pose as a matrix over the canonical mesh, so `build()` may
+  query geometry freely; only `place()` has to stay a rigid motion of its argument, reading
+  `p` and `d`, for a pose-only param to play at frame rate and for layer lines to stay on
+  the part.
   **Any difference between the display and export pose must be a rigid motion** —
   `translate`/`rotate`/`rotateAbout`/`along`/`at` only. Never put a `mirror` or a
   non-identity `scale` on one purpose but not the other: the exported (printed) part is the
@@ -113,6 +117,8 @@ export default {
   ([place-not-rigid](ERROR-PATTERNS.md#place-not-rigid)). If a part genuinely needs a
   reflected or resized form (e.g. a block that seats flipped), bake that into `build` so
   both purposes share one canonical solid, then pose it rigidly.
+  Branch on `purpose` so the export pose is the print orientation: an export pose that
+  follows an animated param pins the layer lines to the pose at the last rebuild.
 - `enabled(p)` gates a conditional sub-part (e.g. only present when a feature is on).
 - A view's sub-parts are derived, never hard-coded: those whose `views` include the view
   and whose `enabled(p)` is true.
@@ -285,10 +291,11 @@ Rules (all lint-enforced):
       tracks: { lidOpen: [[0, 0], [1, 100]] } },
   ]
   ```
-- Playback drives params through the real param pipeline: a **pose-only**
-  param (feeds only rigid placement — see "Caching & determinism" below) plays
-  at frame rate; anything else rebuilds best-effort at worker cadence. `lint`
-  prints a note per track that can't take the fast path.
+- Playback drives params through the real param pipeline. A param read only
+  inside `place()` plays at frame rate whatever `build()` does. A param
+  `build()` reads rebuilds at worker cadence — except through a trailing
+  translate/rotate, which the viewer still re-poses by delta. `lint` notes a track whose
+  `place()` it cannot read (a query on the solid, a function argument).
 - Playback pauses when the user edits any control; Reset restores the values
   the animation found. Because animated values are real params, exporting
   while paused exports the posed state — by design.
@@ -788,7 +795,8 @@ lid's open angle, an exploded-view offset) therefore re-drags in ~0 ms even on t
 slow exact kernel — keep such transforms as the last ops in `build` (or in `place`)
 rather than baking them into the geometry earlier. In the app, such pose-only edits
 skip the worker entirely — the viewer re-poses the cached mesh — so they stay smooth
-even at animation rates (see `runtime.setParams`).
+even at animation rates (see `runtime.setParams`). `place()` needs no geometry: the viewer
+reads its pose off a geometry-free probe of `place()` alone, so `build()` may query freely.
 
 ---
 
@@ -1793,6 +1801,14 @@ cleanly tells a facet artifact (close to 180°, barely bent) from a real corner
 away from 180°) — filter on that, or pass a coarser `segs` to the tessellated shape
 before unioning, rather than fighting the selector after the fact.
 
+**Which controls a sub-part depends on** is recorded from its real build. The worker notes every `p` and `d` key that `build()` and `place()` read:
+- a derived key expands to the params its `derive` group read. `derive` must return its values, not write them onto `p`: a key `derive` writes onto `p` isn't attributed to anything;
+- a param read by a `fonts`, `images` or `vectors` declaration counts for every sub-part.
+
+The viewer rebuilds a sub-part only when one of those values changes. The panel dims a control that no on-screen sub-part read. `verify` reuses a case's measurement only when the case agrees on the params that measurement read. Geometry-guarded branches such as `if (!pocket.isEmpty())` need no special handling.
+
+Builds must stay pure functions of `(k, p, d)`. They receive `p` and `d` through a read-recording Proxy, so use them like plain objects. Don't `structuredClone` them.
+
 **`Shape2D` methods.** Existing: `union`, `cut`, `cutAll`, `intersect`, `offset`,
 `area`, `boundingBox`, `toRegions`, `simple`, `regions`, `clone`, `extrude`, `revolve`.
 New, all delegating to the pure functions above over the shape's stored contours:
@@ -3020,6 +3036,9 @@ instead of (or in addition to) the built-in `#part` bar:
   only a default angle; an explicit `angle` wins. Pass `background` (any
   `THREE.Color`-compatible value) to override the style's, or `background: null` for no
   background at all — which clears to opaque black unless the embedder has set a clear colour.
+- `runtime.controlsFor(selection) → string[]` — the param keys relevant to a pick
+  (`selection.subPart`): today the picked sub-part's recorded reads plus its show/hide gate
+  (`enabled()`) params.
 
 Pass `onViewChange(name)` to `mount()` to be told the active view: it fires once
 synchronously during mount with the initial resolved view (before `runtime.ready` settles),
@@ -3695,19 +3714,19 @@ key, which the runtime ignores), `animations-not-object`,
 `animation-autoplay-invalid` (all errors). One
 more rule does execute `build`, geometry-free: `animation-track-rebuilds` probes
 each track's endpoint values and emits a **note** when the animated param feeds
-real geometry (or the probe can't be trusted), because such a track plays
-best-effort rather than at frame rate. Notes are informational — they never
+real geometry, or when its `place()` can't be read (it queries the solid or
+passes a function), because such a track plays best-effort rather than at frame
+rate. Notes are informational — they never
 affect `ok`, `measure`, or `--strict`.
 
-**Place invariants**, found by running the geometry-free pose probe (the same
+**Place invariants**, found by running the geometry-free place probe (the same
 one animation's `animation-track-rebuilds` uses) against each sub-part's
-`place()` — `view-dependent-display-place` (display placement must not depend
+`place()`, even when `build()` queries the solid — `view-dependent-display-place` (display placement must not depend
 on the active view, since display meshes are cached across views) and
 `place-not-rigid` (display vs. export placement may differ only by a rigid
-motion — translate/rotate — never a reshape) (both errors). An untrusted probe
-(a query op or function selector reached during `build`/`place`) proves
-nothing either way and stays silent, matching `animation-track-rebuilds`'s own
-trust handling.
+motion — translate/rotate — never a reshape) (both errors). A `place()` the probe
+cannot read (it queries the solid or passes a function) stays silent for the two
+place rules and earns the `animation-track-rebuilds` note.
 
 **Appearance** (all warnings) — `unknown-material` (a `display.material` the
 library does not know; the viewer draws it as if it named none — a PLA print

package/docs/ERROR-PATTERNS.md

@@ -142,13 +142,13 @@ Variant literals under this entry: `extrude: unknown bevel option`, `extrude: be
 
 - **Symptom:** A sub-part renders correctly in one view but appears misplaced (usually in its other-view pose) after switching views.
 - **Cause:** A `place` that depends on `ctx.view` for `purpose: "display"` — display meshes are built once per sub-part and cached across views.
-- **Fix:** Make display placement view-independent; only `place(..., { purpose: "export" })` may branch on `view`. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "The `PartDefinition` contract".
+- **Fix:** Make display placement view-independent; only `place(..., { purpose: "export" })` may branch on `view`. The rule sees a `place()` behind any `build()`, including one that queries the solid; a `place()` it cannot read stays silent. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "The `PartDefinition` contract".
 
 ## place-not-rigid
 
 - **Symptom:** The exported/printed part is a mirror image of — or a different size than — the same part shown in the assembly/display view. Nothing throws: the preview looks right and only the STL/STEP is wrong, or vice-versa.
 - **Cause:** A `place` whose `purpose: "display"` and `"export"` branches differ by a non-rigid transform — `mirror` (flips handedness) or a non-identity `scale` (changes size) — so display and export are no longer the same solid, only its reflection/resize.
-- **Fix:** Keep the display-vs-export `place` difference a rigid motion (`translate`/`rotate`/`rotateAbout`/`along`/`at`) only. If the part genuinely needs a reflected or resized form, bake that into `build` so both purposes share one canonical solid and pose it rigidly. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "The `PartDefinition` contract".
+- **Fix:** Keep the display-vs-export `place` difference a rigid motion (`translate`/`rotate`/`rotateAbout`/`along`/`at`) only. If the part genuinely needs a reflected or resized form, bake that into `build` so both purposes share one canonical solid and pose it rigidly. The rule sees a `place()` behind any `build()`, including one that queries the solid; a `place()` it cannot read stays silent. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "The `PartDefinition` contract".
 
 ## wrong-node-version
 
@@ -485,8 +485,8 @@ Variant literal for a curve-adjacent corner: `filletProfile: corner <i> at (<x>,
 ## animation-plays-choppy
 
 - **Symptom:** An animation stutters or updates a few times a second instead of smoothly; `?debug` shows `rebuilt` counts climbing during playback.
-- **Cause:** A track drives a param that feeds real geometry (or a build the pose probe can't trust — a query op or function selector), so every frame is a worker rebuild instead of a pose repair.
-- **Fix:** Run `npx partforge lint <part>` — the `animation-track-rebuilds` note names the track. Restructure so the param only feeds rigid placement (`place()` or a trailing translate/rotate in `build`), or accept best-effort playback if geometry morphing is the intent. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "Animations".
+- **Cause:** A track drives a param `build()` reads (that rebuilds at worker cadence — except through a trailing translate/rotate, which the viewer still re-poses by delta), or a `place()` the probe cannot read (it queries the solid or passes a function), so every frame is a worker rebuild instead of a matrix pose.
+- **Fix:** Run `npx partforge lint <part>` — the `animation-track-rebuilds` note names the track and says which case it is. Restructure so the param is read only by `place()` (a rigid translate/rotate of its argument, reading `p`/`d`), or accept best-effort playback if geometry morphing is the intent. See [AUTHORING-PARTS.md](AUTHORING-PARTS.md) § "Animations".
 
 ## phantom-edges-on-curved-surface
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "partforge",
-  "version": "0.139.0",
+  "version": "0.141.0",
   "description": "Turn a declarative part definition into a parametric-CAD web app (three.js + Manifold/Replicad). Requires a Vite-based consumer.",
   "type": "module",
   "license": "MIT",

package/src/framework/assembly.js

@@ -7,8 +7,8 @@ import { viewSubParts, resolveParams, buildPosed } from "./part-model.js";
 // don't trip it. Manifold-only (needs Solid.intersect + Solid.volume); meant for
 // part tests so an author/LLM editing a part sees collisions fail.
 //   → [{ a, b, volume, location }] for each offending pair (empty = no collisions)
-export function assemblyOverlaps(kernel, part, view, params = {}, { tolerance = 1 } = {}) {
-  const { p, d } = resolveParams(part, params);
+export function assemblyOverlaps(kernel, part, view, params = {}, { tolerance = 1, reads } = {}) {
+  const { p, d } = resolveParams(part, params, undefined, reads);
   // Same posed solids buildView builds, so this round is almost entirely hits off
   // that one; only the pairwise intersects below are new. Its own oracle partition,
   // for the reason buildView's comment gives.

package/src/framework/debug-overlay.js

@@ -47,17 +47,18 @@ export function createDebugOverlay({ initialCachingOn = true, onToggle } = {}) {
   // figure doesn't blank the others: a pose-only edit ran no build and no L2 ops,
   // and would otherwise wipe the last build's timing back to "—" on its way to
   // showing a posed count.
-  const shown = { ms: null, hits: 0, misses: 0, skipped: 0, rebuilt: 0, posed: 0 };
+  const shown = { ms: null, hits: 0, misses: 0, skipped: 0, rebuilt: 0, posed: 0, frame: null };
 
   return {
     update(counts = {}) {
       Object.assign(shown, counts);
-      const { ms, hits, misses, skipped, rebuilt, posed } = shown;
+      const { ms, hits, misses, skipped, rebuilt, posed, frame } = shown;
       const l2 = cb.checked ? `${hits} hit / ${misses} miss` : "off";
       readout.textContent =
         `build: ${ms != null ? Math.round(ms) + " ms" : "—"}\n` +
         `L2 ops: ${l2}\n` +
-        `L1 parts: ${skipped} skipped / ${rebuilt} rebuilt / ${posed} posed`;
+        `L1 parts: ${skipped} skipped / ${rebuilt} rebuilt / ${posed} posed` +
+        (frame ? ` · ${frame}` : ""); // delivery frames of the in-view meshes
     },
     detach: () => box.remove(),
   };

package/src/framework/derive.js

@@ -1,3 +1,5 @@
+import { recorder } from "./read-recorder.js";
+
 // Resolve a part's `derive` into the derived-values object `d` that builds receive.
 //
 // Two authoring forms:
@@ -26,3 +28,46 @@ export function resolveDerived(part, p) {
   for (const fn of Object.values(derive)) Object.assign(d, fn(p, guard) ?? {});
   return d;
 }
+
+// resolveDerived plus attribution: which raw params each derived key came from.
+// MUST produce resolveDerived's `d`, throw its errors, and (with through) leave
+// its writes on p — tests pin all three; the worker builds with this `d`.
+// Grouped form: depsOf maps each key to its own group's raw reads, transitively
+// through the earlier groups it read. Single-function form: depsOf is null.
+export function resolveDerivedAttributed(part, p, { through = false } = {}) {
+  const allInputs = new Set();
+  const derive = part.derive;
+  if (!derive) return { d: {}, depsOf: null, allInputs };
+  if (typeof derive === "function") {
+    return { d: derive(recorder(p, allInputs, { through })) ?? {}, depsOf: null, allInputs };
+  }
+  const d = {};
+  const depsOf = new Map();
+  for (const fn of Object.values(derive)) {
+    const raw = new Set();
+    const fromEarlier = new Set();
+    const written = new Set();
+    const dProxy = new Proxy(d, {
+      get(t, key) {
+        if (typeof key === "string" && key !== "then") {
+          if (!(key in t)) throw new Error(`derive: group read "${key}" before any earlier group produced it`);
+          fromEarlier.add(key);
+        }
+        return Reflect.get(t, key);
+      },
+      set(t, key, v) {
+        if (typeof key === "string") written.add(key);
+        return Reflect.set(t, key, v);
+      },
+    });
+    const out = fn(recorder(p, raw, { through }), dProxy) ?? {};
+    const deps = new Set(raw);
+    for (const k of fromEarlier) for (const dep of depsOf.get(k) ?? []) deps.add(dep);
+    for (const r of raw) allInputs.add(r);
+    for (const key of [...Object.keys(out), ...written]) {
+      depsOf.set(key, deps);
+      if (Object.hasOwn(out, key)) d[key] = out[key];
+    }
+  }
+  return { d, depsOf, allInputs };
+}

package/src/framework/geometry/pose.js

@@ -11,8 +11,9 @@
 
 const IDENTITY = [1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1];
 
-// column-major 4x4 product: (A·B)[c][r] = Σk A[k][r]·B[c][k]
-function mulMat4(A, B) {
+// column-major 4x4 product: (A·B)[c][r] = Σk A[k][r]·B[c][k]. Exported for the
+// pose fast path, which composes a place pose over a build delta.
+export function mulMat4(A, B) {
   const o = new Array(16);
   for (let c = 0; c < 4; c++)
     for (let r = 0; r < 4; r++)

package/src/framework/jobs.js

@@ -14,7 +14,9 @@ import { ensureImports, resolveImports } from "./imports.js";
 import { safeName } from "./safe-name.js";
 import { vectorControlAllows, vectorSourceAllowed, isNoVectorSource } from "./vector-source.js";
 import { vectorsFor, ensureVectors } from "./vectors.js";
-import { exportSubParts, resolveParams, buildPosed } from "./part-model.js";
+import { exportSubParts, resolveParamsAttributed, recordedParams, buildPosed } from "./part-model.js";
+import { newReadSink, expandReads } from "./read-recorder.js";
+import { probeSubPartPose } from "./pose-probe-core.js";
 
 export const FONT_SOURCE_CACHE_MAX = 4;
 
@@ -173,7 +175,7 @@ export async function handle(kernel, part, msg, post, opts = {}) {
     // rewriting p[key] afterwards would leave derive() — and therefore `d`, and
     // therefore the geometry — holding the refused value while build() saw the
     // default.
-    const { p, d } = resolveParams(part, msg.params, (params) => {
+    const { p, d, attribution } = resolveParamsAttributed(part, msg.params, (params) => {
       // A param bound to a `type: "font"` control is user input — on a shared
       // link a STRING value is arbitrary attacker-supplied text that
       // `fonts: (p) => …` would turn into a fetch URL. A BYTE value
@@ -234,12 +236,17 @@ export async function handle(kernel, part, msg, post, opts = {}) {
         params[key] = part.defaults?.[key];
       }
     });
+    // Params the ASSET declarations read (fonts/images/vectors may be functions
+    // of p). A build names an asset, never the param that chose it, so these are
+    // attributed to every sub-part this job builds — coarse, sound (spec §1).
+    const assetSink = newReadSink();
+    const assetP = recordedParams({ p, d }, assetSink).p;
     // Preload any part-declared fonts into the kernel before building. A lazy
     // dynamic import because this is async context (unlike the synchronous
     // kernel-front), so it doesn't cost sync callers anything. The namespace
     // shape differs between bundler and Node resolution (a bare `.default`
     // here is undefined in every browser bundle) — normalize it.
-    const fontsDecl = fontsFor(part, p);
+    const fontsDecl = fontsFor(part, assetP);
     // A nullish/empty source means "no font declared" for that name, not an
     // error — e.g. `fonts: (p) => ({ face: p.face })` when p.face ended up
     // undefined because the refusal above had no default to fall back to, or
@@ -339,7 +346,7 @@ export async function handle(kernel, part, msg, post, opts = {}) {
     // the kernel's image map (a host or test harness may have seeded it
     // directly via _registerImage).
     if (part.images && typeof kernel._registerImage === "function") {
-      const imagesDecl = imagesFor(part, p) ?? {};
+      const imagesDecl = imagesFor(part, assetP) ?? {};
       const declared = Object.fromEntries(
         Object.entries(imagesDecl).filter(([name, src]) => {
           if (!isNoImageSource(src)) return true;
@@ -380,7 +387,7 @@ export async function handle(kernel, part, msg, post, opts = {}) {
     // on. An unset source declares NO artwork for that name; a build that
     // still calls k.vector2d on it gets the ordinary unknown-vector throw, and
     // the progress note keeps a genuine typo visible rather than swallowed.
-    const vectorsDecl = vectorsFor(part, p) ?? {};
+    const vectorsDecl = vectorsFor(part, assetP) ?? {};
     const declaredVectors = Object.fromEntries(
       Object.entries(vectorsDecl).filter(([name, src]) => {
         if (!isNoVectorSource(src)) return true;
@@ -391,6 +398,24 @@ export async function handle(kernel, part, msg, post, opts = {}) {
     await ensureVectors(kernel, declaredVectors);
     // Local shorthand over the shared helper: kernel/part/view/p/d are fixed per job.
     const posed = (name, purpose, prog) => buildPosed(kernel, part, name, { purpose, view: msg.view, p, d, onProgress: prog });
+    // Canonical delivery (spec 2026-10-03 place-only pose, §2): when place() can be read
+    // off a token — rigid, no query, no function — the mesh is built WITHOUT it and
+    // stamped with build reads alone; the viewer applies the display pose as a matrix.
+    // Otherwise the pose is baked and both halves' reads are recorded, as before.
+    // The probe runs on the plain p/d, never the recorders, so place reads cannot
+    // land in a canonical stamp.
+    const displayWithReads = (name) => {
+      const sp = part.parts[name];
+      const sink = newReadSink();
+      sink.attribution = attribution;
+      const rec = recordedParams({ p, d }, sink);
+      const canonical = probeSubPartPose(sp, { view: msg.view, purpose: "display", p, d }, { scope: "place" }).trusted === true;
+      const solid = canonical
+        ? sp.build(kernel, rec.p, rec.d)
+        : buildPosed(kernel, part, name, { purpose: "display", view: msg.view, p: rec.p, d: rec.d });
+      for (const key of assetSink.raw) sink.raw.add(key);
+      return { solid, reads: expandReads(sink), frame: canonical ? "canonical" : "posed" };
+    };
     // Explicit selection (headless exportParts) overrides view-derived selection.
     const selected = () =>
       msg.parts
@@ -413,8 +438,9 @@ export async function handle(kernel, part, msg, post, opts = {}) {
       for (const [i, name] of msg.subparts.entries()) {
         if (useCache) kernel.beginSubPart?.(name); // open the per-sub-part cache round
         try {
-          const m = posed(name, "display").toMesh({ quality: "preview" });
-          meshes.push({ name, positions: m.positions, normals: m.normals, indices: m.indices, triangles: m.triangles, edges: m.edges, featureIds: m.featureIds, features: m.features });
+          const { solid, reads, frame } = displayWithReads(name);
+          const m = solid.toMesh({ quality: "preview" });
+          meshes.push({ name, positions: m.positions, normals: m.normals, indices: m.indices, triangles: m.triangles, edges: m.edges, featureIds: m.featureIds, features: m.features, reads, frame });
         } finally {
           for (const message of kernel.takeBuildWarnings?.() ?? []) warnings.push({ part: name, message });
           if (useCache) kernel.endSubPart?.(); // always close the bracket — a throw mid-build must not strand pinned solids
@@ -563,9 +589,10 @@ export async function handle(kernel, part, msg, post, opts = {}) {
       const quick = msg.checks === "quick";
       const [{ buildView }, { measure }, { verify }] = await loadInspect();
       const view = msg.view ?? Object.keys(part.views)[0];
-      const built = buildView(kernel, part, view, msg.params ?? {});
+      const reads = newReadSink();
+      const built = buildView(kernel, part, view, msg.params ?? {}, { reads });
       const measured = measure(kernel, part, view, msg.params ?? {},
-        { minWall: !quick, gaps: !quick, built });
+        { minWall: !quick, gaps: !quick, built, reads });
       const report = {
         measure: measured,
         verify: verify(kernel, part, {

package/src/framework/lint/rules-animations.js

@@ -14,7 +14,8 @@ import { err, note } from "./finding.js";
 import { EASINGS } from "../animation.js";
 import { CANONICAL_VIEWS, CAMERA_CUE_VIEWS } from "../view-angles.js";
 import { probeSubPartPose } from "../pose-probe-core.js";
-import { resolveDerived } from "../derive.js";
+import { resolveDerivedAttributed } from "../derive.js";
+import { recorder, expandDerivedReads } from "../read-recorder.js";
 import { desugar } from "../panel/legacy.js";
 import { controlNodes } from "../panel/model.js";
 
@@ -467,8 +468,10 @@ export const ANIMATION_RULES = [
           out.push(note("animation-track-rebuilds",
             cls === "rebuild"
               ? `animation "${name}" track "${key}" rebuilds geometry — playback is best-effort, not frame-rate`
-              : `animation "${name}" track "${key}" cannot use the pose fast path (untrusted probe) — playback is best-effort`,
-            "Frame-rate playback needs the param to feed only rigid placement (translate/rotate in `place()` or at the end of `build`). If that's the intent, restructure so the param never feeds a geometry op, a query, or a function selector; if geometry morphing is the intent, this is expected.",
+              : `animation "${name}" track "${key}" — \`place()\` cannot be probed (it queries the solid or passes a function), so playback is best-effort`,
+            cls === "rebuild"
+              ? "Frame-rate playback needs the param to be read only by `place()` (or by a trailing translate/rotate in `build`) — if geometry morphing is the intent, this note is expected."
+              : "Keep `place()` to translate/rotate of its argument, reading `p`/`d` only; `build()` may query freely.",
             base));
         }
       }
@@ -502,28 +505,54 @@ export const ANIMATION_RULES = [
   },
 ];
 
-// Classify one animated param by probing every sub-part the OWNING view can
-// show, at the track's two endpoint values: identical trusted baseHashes at
-// both ends → the param only re-poses ("pose"); differing hashes → real
-// geometry ("rebuild"); any untrusted probe → "untrusted" (the fast path will
-// decline it at runtime too). Mirrors the runtime trust model in
-// pose-probe-core.js. Sub-parts outside the owning view cannot be moved by this
-// animation, so probing them would only manufacture false notes.
+// Classify one animated param per sub-part the OWNING view can show, at the
+// track's two endpoint values (spec 2026-10-03-place-only-pose §8):
+//   1. place-scope probe unreadable at either end → "untrusted" — the only way
+//      the untrusted note fires: the viewer cannot pose that mesh without a rebuild.
+//   2. build-scope probe trusted at both ends with different baseHash → "rebuild".
+//   3. build-scope probe untrusted (build() queries) → "rebuild" when the build
+//      READ the key, recorded by the probe run itself and derive-expanded as
+//      subPartReadKeys does. A prediction: a read behind a dummy query branch is
+//      missed, which costs a missing note, never a wrong behaviour.
+//   4. otherwise → "pose".
+// A place() that is readable but RESHAPES (scale/mirror/boolean, so its baseHash
+// is not CANONICAL) is delivered posed and played by the full-scope delta fast
+// path, so it is classified as before that path changed: the full probe trusted
+// with equal hashes → "pose", anything else → "rebuild" (the runtime rebuilds it).
+// Sub-parts outside the owning view cannot be moved by this animation, so probing
+// them would only manufacture false notes.
 function classifyTrack(part, p, key, v0, v1, view) {
   let result = "pose";
   for (const sp of Object.values(isPlainObject(part?.parts) ? part.parts : {})) {
     if (!Array.isArray(sp?.views) || !sp.views.includes(view)) continue;
-    const probes = [];
+    const ends = [];
     for (const v of [v0, v1]) {
       const pv = { ...p, [key]: v };
-      let dv;
-      try { dv = resolveDerived(part, pv) ?? {}; } catch { return "untrusted"; }
-      try { if (sp.enabled && !sp.enabled(pv)) { probes.push(null); continue; } } catch { return "untrusted"; }
-      probes.push(probeSubPartPose(sp, { view, purpose: "display", p: pv, d: dv }));
+      // An endpoint whose derive() or enabled() throws cannot be shown to be
+      // pose-only; "best-effort" is the honest claim, and the untrusted note names
+      // place() specifically, so it would mislead here.
+      let attributed;
+      try { attributed = resolveDerivedAttributed(part, pv); } catch { return "rebuild"; }
+      const dv = attributed.d ?? {};
+      try { if (sp.enabled && !sp.enabled(pv)) { ends.push(null); continue; } } catch { return "rebuild"; }
+      const ctx = { view, purpose: "display", p: pv, d: dv };
+      const place = probeSubPartPose(sp, ctx, { scope: "place" });
+      if (place.baseHash === undefined) return "untrusted";
+      if (!place.trusted) { ends.push({ full: probeSubPartPose(sp, ctx) }); continue; }
+      const reads = new Set();
+      const dSeen = new Set();
+      const build = probeSubPartPose(sp, { ...ctx, p: recorder(pv, reads), d: recorder(dv, dSeen) }, { scope: "build" });
+      ends.push({ build, reads: expandDerivedReads(reads, dSeen, attributed) });
+    }
+    const [a, b] = ends;
+    if (!a || !b) continue;
+    if (a.full || b.full) {
+      if (!a.full?.trusted || !b.full?.trusted || a.full.baseHash !== b.full.baseHash) result = "rebuild";
+    } else if (a.build.trusted && b.build.trusted) {
+      if (a.build.baseHash !== b.build.baseHash) result = "rebuild";
+    } else if (a.reads.has(key) || b.reads.has(key)) {
+      result = "rebuild";
     }
-    if (probes.some((x) => x && !x.trusted)) return "untrusted";
-    const [a, b] = probes;
-    if (a && b && a.baseHash !== b.baseHash) result = "rebuild";
   }
   return result;
 }

package/src/framework/lint/rules-place.js

@@ -4,9 +4,13 @@
 //   1. Display placement must not depend on the active view (display meshes
 //      are cached across views; a view-dependent pose serves stale geometry).
 //   2. Display vs export may differ only by a rigid motion (translate/rotate).
-// Both checks run the geometry-free pose probe; an untrusted probe (query op /
-// function selector in build or place) proves nothing and stays silent — the
-// runtime declines the fast path for those sub-parts anyway.
+// Both checks run the place-scope pose probe: place() alone, on a canonical token,
+// so build() may query freely without hiding a finding. A READABLE result carries
+// `baseHash` (CANONICAL for translate/rotate only, another hash when place()
+// reshapes) and `pose`; a place() the probe cannot read (it queries the solid or
+// passes a function) returns `{ trusted: false }` with no baseHash, proves nothing,
+// and stays silent. Readability, not `trusted`, gates the rules: the same reshape
+// on both purposes is allowed, so a reshaping place() must still be compared.
 import { err } from "./finding.js";
 import { probeSubPartPose } from "../pose-probe-core.js";
 
@@ -23,6 +27,8 @@ function viewNames(part, view, p) {
 }
 
 const poseKey = (pose) => JSON.stringify(pose);
+const readable = (probe) => probe.baseHash !== undefined;
+const probePlace = (sp, ctx) => probeSubPartPose(sp, ctx, { scope: "place" });
 
 export const PLACE_RULES = [
   {
@@ -34,8 +40,8 @@ export const PLACE_RULES = [
       for (const [name, sp] of Object.entries(isPlainObject(part?.parts) ? part.parts : {})) {
         const inViews = views.filter((v) => viewNames(part, v, p).includes(name));
         if (inViews.length < 2) continue;
-        const probes = inViews.map((view) => probeSubPartPose(sp, { view, purpose: "display", p, d }));
-        if (probes.some((x) => !x.trusted)) continue;
+        const probes = inViews.map((view) => probePlace(sp, { view, purpose: "display", p, d }));
+        if (!probes.every(readable)) continue;
         const first = probes[0];
         const differs = probes.some((x) => x.baseHash !== first.baseHash || poseKey(x.pose) !== poseKey(first.pose));
         if (differs) {
@@ -57,9 +63,9 @@ export const PLACE_RULES = [
         if (!sp?.place) continue;
         for (const view of Object.keys(isPlainObject(part?.views) ? part.views : {})) {
           if (!viewNames(part, view, p).includes(name)) continue;
-          const display = probeSubPartPose(sp, { view, purpose: "display", p, d });
-          const exportP = probeSubPartPose(sp, { view, purpose: "export", p, d });
-          if (!display.trusted || !exportP.trusted) continue;
+          const display = probePlace(sp, { view, purpose: "display", p, d });
+          const exportP = probePlace(sp, { view, purpose: "export", p, d });
+          if (!readable(display) || !readable(exportP)) continue;
           if (display.baseHash !== exportP.baseHash) {
             out.push(err("place-not-rigid",
               `sub-part "${name}" display and export placements differ by more than a rigid motion (view "${view}")`,

package/src/framework/materials/print-frame.js

@@ -5,12 +5,20 @@
 // list of rigid steps — so the display→export map is E · D⁻¹, with no geometry.
 // Three-free and DOM-free: the pose probe and pose.js are pure.
 import { probeSubPartPose } from "../pose-probe-core.js";
-import { poseDelta } from "../geometry/pose.js";
+import { poseDelta, composePose } from "../geometry/pose.js";
 
 const IDENTITY = [1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1];
 
-export function printFrameMatrix(subPart, { view, p, d }) {
+// `frame` is the delivery's frame. A "canonical" mesh is the build before place(), so its
+// map to the printed part is the export pose itself (place-scope: no geometry is read, so a
+// build that queries its solid cannot make it untrusted); a "posed" mesh already carries the
+// display pose, so the map is E · D⁻¹.
+export function printFrameMatrix(subPart, { view, p, d, frame = "posed" }) {
   if (!subPart?.place) return [...IDENTITY];
+  if (frame === "canonical") {
+    const exp = probeSubPartPose(subPart, { view, purpose: "export", p, d }, { scope: "place" });
+    return exp.trusted ? composePose(exp.pose) : [...IDENTITY];
+  }
   const disp = probeSubPartPose(subPart, { view, purpose: "display", p, d });
   const exp = probeSubPartPose(subPart, { view, purpose: "export", p, d });
   if (!disp.trusted || !exp.trusted || disp.baseHash !== exp.baseHash) return [...IDENTITY];

package/src/framework/materials/sheet-look.js

@@ -152,7 +152,9 @@ export function burnsFor(sp) {
 // object space into the canonical sheet frame, the sheet's thickness, and how many plies
 // its cut walls show (0 unless its preset is `laminated`). null when burnsFor says no or
 // the pose or thickness cannot be read (the build reports those).
-export function sheetFrameFor(sp, { p, d } = {}) {
+// `frame` "canonical": the delivered mesh is the sheet's own canonical solid (place() not
+// applied), so no frame maps it — identity, same t and plies.
+export function sheetFrameFor(sp, { p, d, frame: delivered = "posed" } = {}) {
   if (!burnsFor(sp)) return null;
   const meta = sheetMeta(sp, p, d);
   if (!meta) return null;
@@ -160,7 +162,7 @@ export function sheetFrameFor(sp, { p, d } = {}) {
   let pose;
   try { pose = typeof sp.sheet.pose === "function" ? sp.sheet.pose(p, d) : sp.sheet.pose; } catch { return null; }
   if (pose != null && validatePose(pose)) return null;
-  const frame = pose == null ? [...IDENTITY] : invertRigid(composePose(poseSteps(pose, t)));
+  const frame = delivered === "canonical" || pose == null ? [...IDENTITY] : invertRigid(composePose(poseSteps(pose, t)));
   return { frame, t, plies: lookOf(sp).preset.laminated ? plyCount(t) : 0 };
 }
 

package/src/framework/measure/measure-mode.js

@@ -12,8 +12,7 @@ import * as THREE from "three";
 import { raycastViewer } from "../selection/raycast.js";
 import { createFeatureHighlight } from "../selection/feature-highlight.js";
 import { createDragTracker } from "../selection/drag-tracker.js";
-import { subPartReadKeys, RELEVANT_ALL } from "../param-deps.js";
-import { byteAwareReplacer } from "../geometry/solid-hash.js";
+import { subPartParamKeys } from "../param-deps.js";
 import { classifyFeature, bboxSpec, unionBounds } from "./feature-dims.js";
 import { paramMatches } from "./param-link.js";
 import { createPinStore, occurrenceOf } from "./pins.js";
@@ -49,7 +48,7 @@ function keyedCache(limit) {
   };
 }
 
-export function createMeasureMode(viewer, { part, getContext, revealParams, getParamsVersion, schedule = (cb) => requestAnimationFrame(cb) }) {
+export function createMeasureMode(viewer, { part, getContext, revealParams, getReads, schedule = (cb) => requestAnimationFrame(cb) }) {
   const pins = createPinStore();
   const pinListeners = new Set();
   const notifyPins = () => { for (const cb of [...pinListeners]) cb(); };
@@ -133,32 +132,9 @@ export function createMeasureMode(viewer, { part, getContext, revealParams, getP
     .filter(([, m]) => m.visible && m.geometry.getAttribute("position")?.count);
 
   // ---- param linking (scoped like selection/resolve.js scopeParams) --------
-  // Memoize the per-sub-part read-key map: subPartReadKeys runs probe builds
-  // (see mesh-cache.js's readsFor), so it must run once per (view, params)
-  // change, not once per pinned item per frame. mount's getContext() returns
-  // the SAME live params object every call (mutated in place on every edit),
-  // so identity is stable across edits and can't key the memo the way
-  // mesh-cache.js's paramsVersion getter does. mount hands in the SAME
-  // late-bound version thunk it gives createMeshCache/createPoseFastPath
-  // (`() => loop.version()`) so this keys on the cheap integer instead of
-  // hashing the whole params object every call; a caller that omits it (or a
-  // direct test) falls back to the content hash.
-  let readsKey = null, readsMap = null;
-  function readsFor(view, params) {
-    const key = `${view}|${getParamsVersion ? getParamsVersion() : JSON.stringify(params, byteAwareReplacer)}`;
-    if (readsKey !== key) {
-      readsKey = key;
-      try { readsMap = subPartReadKeys(part, view, params); } catch { readsMap = null; }
-    }
-    return readsMap;
-  }
   function readKeysFor(subPart) {
     const { view, params } = getContext();
-    const reads = readsFor(view, params);
-    if (!reads) return Object.keys(params);
-    return reads === RELEVANT_ALL
-      ? Object.keys(params)
-      : [...(reads.get(subPart) ?? Object.keys(params))];
+    return subPartParamKeys(part, view, params, getReads, subPart);
   }
   // Clicking a measurement flashes the controls whose value ACTUALLY matches
   // it (within the display quantum; radius-style params match a diameter at