diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2c4b8cb1..093325ba 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,17 @@ updates:
           - "*"
     commit-message:
       prefix: "chore(deps)"
+    # craft-ui is still on egui 0.36, and two eguis in the graph don't build (#1990). Remove this
+    # once craft-ui moves to egui 0.37 (storytold/craft-libs#199).
+    ignore:
+      - dependency-name: "egui"
+        versions: [">=0.37"]
+      - dependency-name: "eframe"
+        versions: [">=0.37"]
+      - dependency-name: "egui-wgpu"
+        versions: [">=0.37"]
+      - dependency-name: "egui_kittest"
+        versions: [">=0.37"]
 
   # Maintain GitHub Actions workflows
   - package-ecosystem: "github-actions"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..64c13bb2
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      timeout-minutes: 90
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libgl1-mesa-dev
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index e7a60718..11d44fca 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -2,6 +2,9 @@
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
 name: FreeBSD
 
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
   push:
     branches: [release]
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 86c724a6..f7bb0996 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -3,15 +3,17 @@
 # binaries are ARM64, run the CLI natively, and uninstall.
 name: Windows ARM64
 
+# Nightly on main and on pushes to `release` (dependency and runner-image drift shows up within a
+# day, and always before a release ships), and on PRs that change the Windows packaging itself.
 on:
+  schedule:
+    - cron: "3 5 * * *"
   push:
     branches: [release]
   pull_request:
     paths:
       - .github/workflows/windows-arm64.yml
       - packaging/windows/**
-  schedule:
-    - cron: "41 3 * * 1"
   workflow_dispatch:
 
 concurrency:
diff --git a/Cargo.lock b/Cargo.lock
index 6ed70601..e5076e82 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "acadrust"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94862189cab6e282ed0433a801a216cd1a712953813284a48fa81c67223e38f6"
+checksum = "5eaa72520f70eb6f7f09b06f44e1ed0d8fad5fa743364f2c3715c30df962ec7c"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -209,9 +209,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
@@ -223,7 +223,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
  "x11rb",
 ]
 
@@ -547,7 +547,7 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadcraft"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -571,7 +571,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-cli"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -582,14 +582,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-color"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-constraints"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-doc",
  "cadcraft-geom",
@@ -599,7 +599,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-doc"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-geom",
@@ -610,14 +610,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-dwg"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "acadrust",
 ]
 
 [[package]]
 name = "cadcraft-dxf"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "encoding_rs",
  "log",
@@ -626,7 +626,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-engine"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-constraints",
@@ -647,24 +647,24 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-fonts"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-geom",
- "harfrust",
- "skrifa 0.47.0",
+ "harfrust 0.14.0",
+ "skrifa 0.48.0",
  "unicode-bidi",
 ]
 
 [[package]]
 name = "cadcraft-geom"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-io"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "acadrust",
  "cadcraft-color",
@@ -674,8 +674,8 @@ dependencies = [
  "cadcraft-fonts",
  "cadcraft-geom",
  "cadcraft-render",
- "miniz_oxide 0.8.9",
- "quick-xml",
+ "miniz_oxide 0.9.1",
+ "quick-xml 0.42.0",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
@@ -684,19 +684,19 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-mcp"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-render",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "log",
  "serde_json",
 ]
 
 [[package]]
 name = "cadcraft-render"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -710,7 +710,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -733,7 +733,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-web"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -1312,7 +1312,7 @@ dependencies = [
  "emath",
  "epaint_default_fonts",
  "font-types",
- "harfrust",
+ "harfrust 0.12.0",
  "log",
  "nohash-hasher",
  "parking_lot",
@@ -1441,9 +1441,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "font-types"
-version = "0.12.6"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
 dependencies = [
  "bytemuck",
  "serde",
@@ -1734,6 +1734,18 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "harfrust"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86aa776d6d32b072119e1f1650f4db843ff4382a4aaa6a2c9c4e35703cd377cb"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytemuck",
+ "read-fonts 0.45.1",
+ "smallvec",
+]
+
 [[package]]
 name = "hash32"
 version = "0.3.1"
@@ -1914,7 +1926,7 @@ dependencies = [
  "byteorder-lite",
  "moxcms",
  "num-traits",
- "png 0.18.1",
+ "png",
  "tiff",
  "zune-core",
  "zune-jpeg",
@@ -2100,9 +2112,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libloading"
@@ -2271,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -2282,8 +2294,7 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
- "png 0.18.1",
+ "png",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
 ]
@@ -2945,19 +2956,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3081,6 +3079,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3159,13 +3166,15 @@ dependencies = [
 
 [[package]]
 name = "read-fonts"
-version = "0.44.0"
+version = "0.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5a0cf4bb6cbce4c29756270d189a5e400ac05e91192161d83a0bcb6e68492e8"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
 dependencies = [
  "bytemuck",
+ "foldhash",
  "font-types",
  "once_cell",
+ "yoke",
 ]
 
 [[package]]
@@ -3244,9 +3253,9 @@ dependencies = [
 
 [[package]]
 name = "rstar"
-version = "0.12.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "421400d13ccfd26dfa5858199c30a5d76f9c54e0dba7575273025b43c5175dbb"
+checksum = "5912b862fa5ffb462607bfd1e35036c458c537921f508c8235a83d5f3987edfe"
 dependencies = [
  "heapless",
  "num-traits",
@@ -3377,9 +3386,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -3464,12 +3473,12 @@ dependencies = [
 
 [[package]]
 name = "skrifa"
-version = "0.47.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "526e654b303ff4ad73a5a40b25de2b3ce3d039c5e3b6da5f89ae6e57004cb40f"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
 dependencies = [
  "bytemuck",
- "read-fonts 0.44.0",
+ "read-fonts 0.45.1",
 ]
 
 [[package]]
@@ -3715,24 +3724,24 @@ dependencies = [
 
 [[package]]
 name = "tiny-skia"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea"
 dependencies = [
  "arrayref",
  "arrayvec",
  "bytemuck",
  "cfg-if",
  "log",
- "png 0.17.16",
+ "png",
  "tiny-skia-path",
 ]
 
 [[package]]
 name = "tiny-skia-path"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+checksum = "edca365c3faccca67d06593c5980fa6c57687de727a03131735bb85f01fdeeb9"
 dependencies = [
  "arrayref",
  "bytemuck",
@@ -4153,7 +4162,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -4510,7 +4519,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4519,16 +4528,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4546,31 +4546,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -4588,96 +4571,48 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
@@ -4740,9 +4675,9 @@ dependencies = [
 
 [[package]]
 name = "winresource"
-version = "0.1.31"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
@@ -4825,7 +4760,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.11.0"
+version = "0.12.0"
 dependencies = [
  "chrono",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index c87f38ff..6e1afaa0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members
 
 [workspace.package]
-version = "0.11.0"
+version = "0.12.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -37,17 +37,17 @@ chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"
 
 # rendering / formats
-tiny-skia = { version = "0.11", default-features = false, features = ["std", "simd", "png-format"] }
+tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd", "png-format"] }
 lyon_tessellation = "1.0.22"
-skrifa = "0.47"
-# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; the version egui's epaint uses)
-# and the Unicode Bidirectional Algorithm for right-to-left drawing text.
-harfrust = "0.12"
+skrifa = "0.48"
+# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; egui's epaint is still on 0.12,
+# so the graph has both) and the Unicode Bidirectional Algorithm for right-to-left drawing text.
+harfrust = "0.14"
 unicode-bidi = "0.3.18"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 encoding_rs = "0.8.35"
 # XML for the SVG reader (streaming parser, no entity expansion beyond the five predefined ones)
-quick-xml = "0.41"
+quick-xml = "0.42"
 
 # ui
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
@@ -69,9 +69,11 @@ type_complexity = "allow"
 
 [profile.dev.package."*"]
 opt-level = 2
+debug = false
 
 [profile.dev]
 opt-level = 1
+debug = "line-tables-only"
 
 [profile.release]
 opt-level = 3
diff --git a/apps/cadcraft-cli/tests/cli.rs b/apps/cadcraft-cli/tests/it/cli.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/cli.rs
rename to apps/cadcraft-cli/tests/it/cli.rs
diff --git a/apps/cadcraft-cli/tests/drafting_spacing.rs b/apps/cadcraft-cli/tests/it/drafting_spacing.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/drafting_spacing.rs
rename to apps/cadcraft-cli/tests/it/drafting_spacing.rs
diff --git a/apps/cadcraft-cli/tests/help.rs b/apps/cadcraft-cli/tests/it/help.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/help.rs
rename to apps/cadcraft-cli/tests/it/help.rs
diff --git a/apps/cadcraft-cli/tests/it/main.rs b/apps/cadcraft-cli/tests/it/main.rs
new file mode 100644
index 00000000..efd49c7d
--- /dev/null
+++ b/apps/cadcraft-cli/tests/it/main.rs
@@ -0,0 +1,6 @@
+mod cli;
+mod drafting_spacing;
+mod help;
+mod mcp_connect;
+mod skipped_records;
+mod undrawn_entities;
diff --git a/apps/cadcraft-cli/tests/mcp_connect.rs b/apps/cadcraft-cli/tests/it/mcp_connect.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/mcp_connect.rs
rename to apps/cadcraft-cli/tests/it/mcp_connect.rs
diff --git a/apps/cadcraft-cli/tests/skipped_records.rs b/apps/cadcraft-cli/tests/it/skipped_records.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/skipped_records.rs
rename to apps/cadcraft-cli/tests/it/skipped_records.rs
diff --git a/apps/cadcraft-cli/tests/undrawn_entities.rs b/apps/cadcraft-cli/tests/it/undrawn_entities.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/undrawn_entities.rs
rename to apps/cadcraft-cli/tests/it/undrawn_entities.rs
diff --git a/apps/cadcraft-web/index.html b/apps/cadcraft-web/index.html
index c8e2e960..6cd4ab97 100644
--- a/apps/cadcraft-web/index.html
+++ b/apps/cadcraft-web/index.html
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>CADCraft</title>
   <link data-trunk rel="rust" data-bin="cadcraft-web" data-wasm-opt="z" data-weak-refs />
   <style>
diff --git a/apps/cadcraft/src/control_server.rs b/apps/cadcraft/src/control_server.rs
index d11671e1..14283e6f 100644
--- a/apps/cadcraft/src/control_server.rs
+++ b/apps/cadcraft/src/control_server.rs
@@ -48,6 +48,8 @@ impl Default for Limits {
     }
 }
 
+/// Start the loopback server with a fresh session token and a bounded request queue.
+/// Binding or token-issuance failure returns a disconnected receiver.
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     match TcpListener::bind(("127.0.0.1", port)) {
         Ok(l) => {
@@ -101,6 +103,7 @@ impl Drop for Slot {
     }
 }
 
+/// Accept clients within the connection limit and give each worker the same session token.
 fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits, token: Arc<String>) {
     let open = Arc::new(AtomicUsize::new(0));
     for mut stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
@@ -162,6 +165,7 @@ enum Line {
     Reject(String),
 }
 
+/// Parse a UTF-8 JSON request and its optional token, distinguishing blank lines from rejected input.
 fn parse_line(bytes: &[u8]) -> Line {
     let Ok(text) = std::str::from_utf8(bytes) else {
         return Line::Reject("not a control request (invalid UTF-8); closing the connection".into());
@@ -198,6 +202,8 @@ fn is_http_request_line(text: &str) -> bool {
         || text.rsplit_once(' ').is_some_and(|(_, version)| version.starts_with("HTTP/"))
 }
 
+/// Serve bounded JSON lines, authenticating each request before enqueueing it for the UI.
+/// Invalid credentials close the connection; queue and reply limits report whether a request ran.
 fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits, token: &str) {
     if stream.set_read_timeout(Some(limits.idle_timeout)).is_err() || stream.set_write_timeout(Some(limits.write_timeout)).is_err() {
         return;
@@ -385,6 +391,7 @@ mod tests {
         assert!(t.elapsed() < Duration::from_secs(4));
     }
 
+    /// Authenticated requests rejected by a full queue retain their IDs and report that they did not run.
     #[test]
     fn a_full_queue_answers_busy() {
         let (addr, rx) = serve_with(short());
@@ -407,6 +414,7 @@ mod tests {
         drop(rx);
     }
 
+    /// Replies on one authenticated connection preserve the ID of each request.
     #[test]
     fn requests_are_answered_with_their_ids() {
         let addr = serve_echo();
@@ -423,6 +431,7 @@ mod tests {
         }
     }
 
+    /// Missing and incorrect session tokens are rejected before dispatch.
     #[test]
     fn a_request_without_the_token_is_unauthorized() {
         // A local peer that does not hold the session token cannot drive the app (CWE-306).
@@ -437,6 +446,7 @@ mod tests {
         assert!(wrong[0]["error"].as_str().unwrap().contains("unauthorized"), "{wrong:?}");
     }
 
+    /// A request carrying the session token reaches the control dispatcher.
     #[test]
     fn a_request_with_the_token_is_dispatched() {
         let addr = serve_echo();
diff --git a/crates/constraints/src/dof.rs b/crates/constraints/src/dof.rs
index 5be5cd57..f0a34b9f 100644
--- a/crates/constraints/src/dof.rs
+++ b/crates/constraints/src/dof.rs
@@ -89,6 +89,8 @@ struct CompDof {
     objects: Vec<Option<usize>>,
 }
 
+/// Compute component and object freedom only when rank and residual-evaluation work fit their budgets.
+/// Return unknown freedom before building the Jacobian when either work limit is exceeded.
 fn analyse(comp: &Comp) -> CompDof {
     let free = comp.free(None);
     let rows = comp.rows(None);
@@ -213,6 +215,7 @@ mod budget_tests {
     use cadcraft_doc::{Common, ConstraintKind, EntityKind, GeomRef, Space};
     use cadcraft_geom::{Spline, Vec2};
 
+    /// An expensive fit-spline endpoint residual produces unknown freedom before numerical differentiation.
     #[test]
     fn endpoint_analysis_rejects_cubic_fit_work_before_differentiation() {
         let mut d = Drawing::default();
diff --git a/crates/constraints/src/lib.rs b/crates/constraints/src/lib.rs
index 33821946..81e81fc2 100644
--- a/crates/constraints/src/lib.rs
+++ b/crates/constraints/src/lib.rs
@@ -328,6 +328,8 @@ pub(crate) fn build(d: &Drawing, cons: &[&Constraint], opts: &SolveOptions) -> R
     build_budgeted(d, cons, opts, &mut members_left)
 }
 
+/// Build constraint components with one caller-owned rigid-member sampling budget shared by every model.
+/// Return constraints that cannot be interpreted as skipped entries.
 pub(crate) fn build_budgeted(
     d: &Drawing,
     cons: &[&Constraint],
diff --git a/crates/constraints/src/model.rs b/crates/constraints/src/model.rs
index 53ace75b..ba7e5854 100644
--- a/crates/constraints/src/model.rs
+++ b/crates/constraints/src/model.rs
@@ -117,6 +117,8 @@ pub fn rigid_points(d: &Drawing, ins: &Insert) -> Vec<Vec2> {
     rigid_points_budgeted(d, ins, &mut members_left)
 }
 
+/// Sample finite block points within per-insert and caller-shared member limits.
+/// Members that contribute no points still consume traversal work; nested blocks are not entered.
 fn rigid_points_budgeted(d: &Drawing, ins: &Insert, members_left: &mut usize) -> Vec<Vec2> {
     let Some(block) = d.block(&ins.block) else { return Vec::new() };
     let m = ins.transform(block.base.xy());
@@ -187,6 +189,7 @@ impl Model {
         Self::build_budgeted(d, handles, &mut members_left)
     }
 
+    /// Build solver parameters for supported entities while sharing rigid-member sampling work with other models.
     pub(crate) fn build_budgeted(d: &Drawing, handles: &[Handle], members_left: &mut usize) -> Model {
         let mut m = Model::default();
         for &h in handles {
@@ -620,6 +623,7 @@ mod budget_tests {
     use cadcraft_geom::Vec3;
     use std::sync::Arc;
 
+    /// Writing an unchanged model back leaves partial rational weights and the original spline geometry intact.
     #[test]
     fn write_back_keeps_partial_rational_weights() {
         let mut drawing = Drawing::default();
@@ -635,6 +639,7 @@ mod budget_tests {
         }
     }
 
+    /// A second model receives no sampled block points after the first model spends the shared member budget.
     #[test]
     fn rigid_sampling_budget_is_shared_between_models() {
         let mut d = Drawing::default();
diff --git a/crates/constraints/src/residual.rs b/crates/constraints/src/residual.rs
index 164ada07..be5723fe 100644
--- a/crates/constraints/src/residual.rs
+++ b/crates/constraints/src/residual.rs
@@ -116,6 +116,7 @@ fn r_at(c: &Constraint, i: usize) -> Option<&GeomRef> {
 }
 
 impl Built {
+    /// Estimate spline reconstruction work for endpoint and join residuals; other residual forms add no such cost.
     pub(crate) fn spline_reconstruct_cost(&self, m: &Model) -> f64 {
         let cost = |i: usize| self.refs.get(i).map_or(0.0, |r| m.spline_reconstruct_cost(r.handle));
         match self.form {
diff --git a/crates/constraints/tests/dof.rs b/crates/constraints/tests/dof.rs
index f863d9b8..ea78ca93 100644
--- a/crates/constraints/tests/dof.rs
+++ b/crates/constraints/tests/dof.rs
@@ -364,6 +364,7 @@ fn hostile_new_geometry_never_panics() {
     let _ = dof(&d, &[Handle(0), Handle(u64::MAX)]);
 }
 
+/// Fit-point vertex constraints retain a known freedom count because they do not reconstruct the spline.
 #[test]
 fn vertex_constraints_on_large_fit_spline_do_not_charge_reconstruction() {
     let mut d = Drawing::default();
diff --git a/crates/doc/tests/lin_pat_parse.rs b/crates/doc/tests/it/lin_pat_parse.rs
similarity index 100%
rename from crates/doc/tests/lin_pat_parse.rs
rename to crates/doc/tests/it/lin_pat_parse.rs
diff --git a/crates/doc/tests/it/main.rs b/crates/doc/tests/it/main.rs
new file mode 100644
index 00000000..dcad121d
--- /dev/null
+++ b/crates/doc/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod lin_pat_parse;
+mod sub_segment_alias;
diff --git a/crates/doc/tests/sub_segment_alias.rs b/crates/doc/tests/it/sub_segment_alias.rs
similarity index 100%
rename from crates/doc/tests/sub_segment_alias.rs
rename to crates/doc/tests/it/sub_segment_alias.rs
diff --git a/crates/dwg/Cargo.toml b/crates/dwg/Cargo.toml
index 398df0a3..a409e5b9 100644
--- a/crates/dwg/Cargo.toml
+++ b/crates/dwg/Cargo.toml
@@ -10,4 +10,4 @@ workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # MPL-2.0: used as an unmodified dependency only (see plan/adr/0001 and NOTICE).
-acadrust = "0.6.4"
+acadrust = "0.6.5"
diff --git a/crates/dwg/src/lib.rs b/crates/dwg/src/lib.rs
index 7cbd40fc..f8a48f2a 100644
--- a/crates/dwg/src/lib.rs
+++ b/crates/dwg/src/lib.rs
@@ -4,6 +4,25 @@
 //! converted to DXF bytes, which CADCraft's own DXF reader maps to its document model; saving
 //! goes the other way. Keeping the dependency behind this byte-level API isolates it: nothing
 //! else in CADCraft depends on its types. Native targets only (it memory-maps files).
+//!
+//! # Guardrails around the third-party decoder
+//!
+//! The decoder allocates tables and section buffers from sizes a (possibly damaged or hostile)
+//! file declares, and once it starts it cannot be interrupted (an allocation failure aborts the
+//! process, which `catch_unwind` cannot recover). Because the dependency is used unmodified, this
+//! crate guards it from the outside:
+//!
+//! - Both directions reject oversized input *before* the decoder runs ([`Limits::max_dwg_bytes`]
+//!   for DWG→DXF, [`Limits::max_dxf_bytes`] for DXF→DWG), and the DWG→DXF output is capped while
+//!   it is written (`CappedWriter`).
+//! - The reader and writer run inside `catch_unwind`, so a decode failure is reported instead of
+//!   crashing.
+//!
+//! These bound the input- and output-size variants. A small file that declares a huge internal
+//! table or section can still make the dependency allocate before any size is known; fully fixing
+//! that requires an upstream fix in `acadrust` (validate declared sizes against a decoded-memory
+//! budget) or running the decode in a separate worker with an OS memory limit. The limits here
+//! keep the blast radius bounded in the meantime.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
@@ -88,7 +107,6 @@ mod native {
         current_style_names(&mut doc);
         table_merges(&mut doc);
         table_style_rows(&mut doc, false);
-        dimension_flags(&mut doc, false);
         let orphans = drop_orphaned_dgn_components(&mut doc);
         if orphans > 0 {
             let (s, were) = if orphans == 1 { ("", "was") } else { ("s", "were") };
@@ -272,24 +290,14 @@ mod native {
         }
     }
 
-    /// The DWG dimension flags byte. Its bit 0 is the opposite of DXF group 70's bit 128 (set: the
-    /// text is at its default position) and its bit 1 is group 70's bit 32 (ODA DWG
-    /// specification, common dimension data), while acadrust 0.6.4 reads and writes bit 0 as
-    /// `text_user_positioned` itself and keeps no bit 32 from DXF. Without this, every dimension
-    /// of a DWG CADCraft writes is user-positioned for AutoCAD (#1094), and every dimension of an
-    /// AutoCAD DWG is read as user-positioned. `to_dwg` sets the fields up for the writer:
-    /// bit 32 as CADCraft's DXF writer always sets it, and bit 0 through the inverted field;
-    /// otherwise the field is read from bit 0 after a DWG is read.
-    fn dimension_flags(doc: &mut acadrust::CadDocument, to_dwg: bool) {
+    /// The DWG dimension flags byte. Its bit 1 is DXF group 70's bit 32 (ODA DWG specification,
+    /// common dimension data), which acadrust keeps no copy of from DXF: it is set here as
+    /// CADCraft's DXF writer always sets it (#1094). Bit 0, the opposite of group 70's bit 128,
+    /// acadrust 0.6.5 reads and writes itself.
+    fn dimension_flags(doc: &mut acadrust::CadDocument) {
         for e in doc.entities_mut() {
             let acadrust::entities::EntityType::Dimension(d) = e else { continue };
-            let b = d.base_mut();
-            if to_dwg {
-                b.dwg_flags_byte |= 0x02;
-                b.text_user_positioned = !b.text_user_positioned;
-            } else {
-                b.text_user_positioned = b.dwg_flags_byte & 0x01 == 0;
-            }
+            d.base_mut().dwg_flags_byte |= 0x02;
         }
     }
 
@@ -505,6 +513,17 @@ mod native {
     }
 
     fn convert(dxf: &[u8], version: Option<acadrust::DxfVersion>) -> Result<Vec<u8>, String> {
+        // Reject a pathologically large DXF before handing it to the third-party decoder, which
+        // allocates tables and section buffers from the input's declared sizes and cannot be
+        // interrupted once it starts (CWE-789). This bounds the large-input variant; the decoder
+        // runs inside `catch_unwind` so a decode failure is reported rather than crashing.
+        if dxf.len() > Limits::DEFAULT.max_dxf_bytes {
+            return Err(format!(
+                "DXF: the input is {}, larger than the {} CADCraft converts to DWG",
+                mb(dxf.len() as u64),
+                mb(Limits::DEFAULT.max_dxf_bytes as u64)
+            ));
+        }
         let data = dxf.to_vec();
         let mut doc = std::panic::catch_unwind(move || acadrust::DxfReader::from_reader(Cursor::new(data)).and_then(|r| r.read()))
             .map_err(|_| "the DXF→DWG conversion failed".to_string())?
@@ -519,7 +538,7 @@ mod native {
         }
         other_layout_owners(&mut doc);
         table_style_rows(&mut doc, true);
-        dimension_flags(&mut doc, true);
+        dimension_flags(&mut doc);
         drop_unwritable(&mut doc);
         current_dimstyle(&mut doc);
         current_text_style(&mut doc);
@@ -618,6 +637,15 @@ mod tests {
         assert!(dwg_to_dxf(b"").is_err());
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn dxf_to_dwg_rejects_garbage_without_crashing() {
+        // The DXF→DWG path runs the third-party reader inside catch_unwind and reports failures
+        // rather than crashing (and rejects oversized input before decoding).
+        assert!(dxf_to_dwg(b"not a dxf file").is_err());
+        assert!(dxf_to_dwg(b"").is_err());
+    }
+
     /// A DXF with one DIMENSION per (text, group 70, subclass, points) row.
     #[cfg(not(target_arch = "wasm32"))]
     fn dims_dxf(dims: &[(&str, i64, &str, &[(i32, [f64; 2])])]) -> String {
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 04be2919..8be55a2a 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -22,7 +22,7 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
 # R-tree spatial index for picking, window selection and object snaps (MIT OR Apache-2.0).
-rstar = { version = "0.12", default-features = false }
+rstar = { version = "0.13", default-features = false }
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
diff --git a/crates/engine/src/capped_read.rs b/crates/engine/src/capped_read.rs
index d82344bb..05c7267c 100644
--- a/crates/engine/src/capped_read.rs
+++ b/crates/engine/src/capped_read.rs
@@ -44,6 +44,7 @@ pub fn read_capped(path: &Path, max: usize) -> io::Result<Vec<u8>> {
 mod tests {
     use super::*;
 
+    /// Regular-file reads accept the byte boundary and reject any larger payload.
     #[test]
     fn reads_within_limit_and_rejects_oversize() {
         let dir = std::env::temp_dir().join(format!("cadcraft-cr-{}", std::process::id()));
@@ -57,6 +58,7 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    /// An endless device is rejected before its contents can be buffered.
     #[cfg(unix)]
     #[test]
     fn rejects_non_regular_file() {
@@ -66,6 +68,7 @@ mod tests {
             assert!(read_capped(p, 8 << 20).is_err());
         }
     }
+    /// Opening a FIFO without a writer returns an error without waiting for a peer.
     #[cfg(unix)]
     #[test]
     fn rejects_fifo_without_a_writer() {
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 96b86f4e..b6998f42 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -337,6 +337,7 @@ fn opened(s: &Session, i: usize, entities: bool) -> Value {
     }
 }
 
+/// Open a drawing from bounded regular-file bytes or base64 data and resolve its external references.
 fn run_open(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(_path) = str_param(p, "path") {
         #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/engine/src/lisp/builtins.rs b/crates/engine/src/lisp/builtins.rs
index 9ef90f3b..e421686c 100644
--- a/crates/engine/src/lisp/builtins.rs
+++ b/crates/engine/src/lisp/builtins.rs
@@ -698,11 +698,14 @@ fn wcmatch(a: &[Value]) -> R {
 /// cover), but finite so truly exponential `*`-heavy patterns are rejected rather than hanging.
 const WCMATCH_BUDGET: u64 = 200_000_000;
 
+/// Spend one wildcard work unit, returning an error when the shared budget is exhausted.
 fn charge_match(budget: &mut u64) -> Result<(), ()> {
     *budget = budget.checked_sub(1).ok_or(())?;
     Ok(())
 }
 
+/// Split comma-separated wildcard alternatives while preserving escapes and bracket sets.
+/// Every consumed character spends from the same budget used for matching.
 fn split_patterns(pat: &str, budget: &mut u64) -> Result<Vec<Vec<char>>, ()> {
     let mut out = vec![Vec::new()];
     let mut chars = pat.chars().peekable();
@@ -742,6 +745,7 @@ fn split_patterns(pat: &str, budget: &mut u64) -> Result<Vec<Vec<char>>, ()> {
     Ok(out)
 }
 
+/// Match one wildcard alternative, including leading `~` negation, within the shared budget.
 fn match_pattern(text: &[char], pat: &[char], budget: &mut u64) -> Result<bool, ()> {
     if let Some(('~', rest)) = pat.split_first().map(|(c, r)| (*c, r))
         && !rest.is_empty()
@@ -757,6 +761,7 @@ fn glob(text: &[char], pat: &[char], depth: usize, budget: &mut u64) -> Result<b
     glob_cached(text, pat, depth, budget, &mut std::collections::HashSet::new())
 }
 
+/// Match suffixes while memoizing failures; both matching work and retained failure entries are bounded.
 fn glob_cached(
     text: &[char],
     pat: &[char],
@@ -778,6 +783,7 @@ fn glob_cached(
     Ok(matched)
 }
 
+/// Evaluate wildcard tokens and backtracking branches under shared work and recursion limits.
 fn glob_inner(
     text: &[char],
     pat: &[char],
@@ -1060,6 +1066,7 @@ fn findfile(a: &[Value]) -> R {
     Ok(if file_exists(&p) { Value::Str(p) } else { Value::Nil })
 }
 
+/// Read a regular text file up to 64 MiB, replacing invalid UTF-8 and returning `None` on read failure.
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_text_file(path: &str) -> Option<String> {
     // Read through a byte-limited, regular-file-only reader so a path naming an endless device
@@ -1068,6 +1075,7 @@ pub fn read_text_file(path: &str) -> Option<String> {
     let bytes = crate::capped_read::read_capped(std::path::Path::new(path), MAX).ok()?;
     Some(String::from_utf8_lossy(&bytes).into_owned())
 }
+/// Return `None` on the web, where native filesystem paths are unavailable.
 #[cfg(target_arch = "wasm32")]
 pub fn read_text_file(_path: &str) -> Option<String> {
     None
@@ -1588,6 +1596,7 @@ pub fn wild_match(text: &str, pattern: &str) -> bool {
 mod wildcard_budget_tests {
     use super::*;
 
+    /// Pattern splitting, literal matching, and bracket scans all stop when their shared fuel runs out.
     #[test]
     fn all_native_scans_consume_fuel() {
         assert!(split_patterns("abcdefgh", &mut 4).is_err());
diff --git a/crates/engine/src/lisp/drawing.rs b/crates/engine/src/lisp/drawing.rs
index 043b611a..53c7af86 100644
--- a/crates/engine/src/lisp/drawing.rs
+++ b/crates/engine/src/lisp/drawing.rs
@@ -158,6 +158,8 @@ pub fn from_json(v: &serde_json::Value) -> Value {
 const TO_JSON_BUDGET: u64 = 2_000_000;
 const TO_JSON_MAX_DEPTH: usize = 256;
 
+/// Convert a LISP value to owned JSON within element and nesting limits.
+/// Return `None` before a shared cons structure can expand beyond the remaining budget.
 fn to_json_bounded(v: &Value, depth: usize, budget: &mut u64) -> Option<serde_json::Value> {
     if depth > TO_JSON_MAX_DEPTH || *budget == 0 {
         return None;
@@ -185,6 +187,7 @@ pub fn getvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
     Ok(Flow::Value(crate::sysvars::get(ctx.s, &name).map(|v| from_json(&v)).unwrap_or_default()))
 }
 
+/// Set a system variable after bounded JSON conversion, reporting invalid or oversized values as LISP errors.
 pub fn setvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
     arity(&a, 2, 2)?;
     let name = string(&a[0])?;
diff --git a/crates/engine/src/lisp/mod.rs b/crates/engine/src/lisp/mod.rs
index 14ac32c6..47dea46d 100644
--- a/crates/engine/src/lisp/mod.rs
+++ b/crates/engine/src/lisp/mod.rs
@@ -131,6 +131,7 @@ pub(crate) struct Limits {
 }
 
 impl Default for Limits {
+    /// Provide finite cons-cell, string-byte, and synchronous-callback limits for a LISP run.
     fn default() -> Self {
         Limits { cells: value::MAX_CELLS, string_bytes: value::STRING_BUDGET, callback_steps: 500_000_000 }
     }
diff --git a/crates/engine/src/lisp/tests.rs b/crates/engine/src/lisp/tests.rs
index 20669056..9104e252 100644
--- a/crates/engine/src/lisp/tests.rs
+++ b/crates/engine/src/lisp/tests.rs
@@ -221,6 +221,7 @@ fn runaway_routines_are_errors_not_crashes() {
     assert_eq!(r, Ok("3000000".into()));
 }
 
+/// An infinite comparator stops at its callback cap, and a later finite comparator still succeeds.
 #[test]
 fn synchronous_callback_loop_is_an_error_not_a_hang() {
     // A comparator with an infinite loop used to run with u64::MAX fuel and hang the thread; it
@@ -232,6 +233,7 @@ fn synchronous_callback_loop_is_an_error_not_a_hang() {
     assert_eq!(ok(&mut s, "(vl-sort '(3 1 2) '<)"), "(1 2 3)");
 }
 
+/// A zero-step callback limit prevents even the first callback side effect.
 #[test]
 fn a_zero_callback_budget_does_not_run_the_callback() {
     let mut s = session();
@@ -242,6 +244,7 @@ fn a_zero_callback_budget_does_not_run_the_callback() {
     assert_eq!(ok(&mut s, "callback-ran"), "nil");
 }
 
+/// A callback stops at a cap smaller than one scheduling slice without completing all its assignments.
 #[test]
 fn a_callback_must_fit_within_a_partial_slice() {
     let mut s = session();
@@ -252,6 +255,7 @@ fn a_callback_must_fit_within_a_partial_slice() {
     assert_eq!(ok(&mut s, "(and (> callback-count 0) (< callback-count 1000))"), "T");
 }
 
+/// Crossing a scheduling boundary grants only the additional configured step, rather than another slice.
 #[test]
 fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
     let counts: Vec<u64> = [399_999, 400_000]
@@ -270,6 +274,7 @@ fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
     assert!(counts[1] >= counts[0] && counts[1] - counts[0] <= 1, "{counts:?}");
 }
 
+/// System-variable conversion rejects a shared list whose owned JSON expansion would exceed its budget.
 #[test]
 fn setvar_rejects_an_oversized_shared_structure() {
     // A list repeatedly sharing its own contents expands exponentially; setvar's bounded JSON
diff --git a/crates/engine/src/lisp/value.rs b/crates/engine/src/lisp/value.rs
index 99f066d7..09da1d27 100644
--- a/crates/engine/src/lisp/value.rs
+++ b/crates/engine/src/lisp/value.rs
@@ -353,6 +353,7 @@ pub fn equal(a: &Value, b: &Value, fuzz: f64) -> bool {
 /// Largest number of node comparisons one `equal` call may perform.
 const EQUAL_BUDGET: u64 = 50_000_000;
 
+/// Compare nested values within depth and node-work limits, returning false when either limit is reached.
 fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize, budget: &mut u64) -> bool {
     if depth > MAX_DEPTH || *budget == 0 {
         return false;
diff --git a/crates/engine/src/spatial.rs b/crates/engine/src/spatial.rs
index 98999b71..ca15bd4c 100644
--- a/crates/engine/src/spatial.rs
+++ b/crates/engine/src/spatial.rs
@@ -208,7 +208,7 @@ impl SpatialIndex {
         let pad = (b.width() + b.height()) * 1e-9 + (b.min.x.abs() + b.min.y.abs() + b.max.x.abs() + b.max.y.abs()) * 1e-12 + 1e-300;
         let env = AABB::from_corners([b.min.x - pad, b.min.y - pad], [b.max.x + pad, b.max.y + pad]);
         let mut out: Vec<u32> =
-            self.tree.locate_in_envelope_intersecting(&env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
+            self.tree.locate_in_envelope_intersecting(env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
         if with_infinite {
             out.extend_from_slice(&self.infinite);
         }
diff --git a/crates/engine/tests/angle_prompts.rs b/crates/engine/tests/it/angle_prompts.rs
similarity index 100%
rename from crates/engine/tests/angle_prompts.rs
rename to crates/engine/tests/it/angle_prompts.rs
diff --git a/crates/engine/tests/angle_settings.rs b/crates/engine/tests/it/angle_settings.rs
similarity index 100%
rename from crates/engine/tests/angle_settings.rs
rename to crates/engine/tests/it/angle_settings.rs
diff --git a/crates/engine/tests/annotate_options.rs b/crates/engine/tests/it/annotate_options.rs
similarity index 100%
rename from crates/engine/tests/annotate_options.rs
rename to crates/engine/tests/it/annotate_options.rs
diff --git a/crates/engine/tests/annotative.rs b/crates/engine/tests/it/annotative.rs
similarity index 100%
rename from crates/engine/tests/annotative.rs
rename to crates/engine/tests/it/annotative.rs
diff --git a/crates/engine/tests/arc_ctrl_direction.rs b/crates/engine/tests/it/arc_ctrl_direction.rs
similarity index 100%
rename from crates/engine/tests/arc_ctrl_direction.rs
rename to crates/engine/tests/it/arc_ctrl_direction.rs
diff --git a/crates/engine/tests/array_commands.rs b/crates/engine/tests/it/array_commands.rs
similarity index 100%
rename from crates/engine/tests/array_commands.rs
rename to crates/engine/tests/it/array_commands.rs
diff --git a/crates/engine/tests/assoc_array.rs b/crates/engine/tests/it/assoc_array.rs
similarity index 100%
rename from crates/engine/tests/assoc_array.rs
rename to crates/engine/tests/it/assoc_array.rs
diff --git a/crates/engine/tests/attdisp_attsync.rs b/crates/engine/tests/it/attdisp_attsync.rs
similarity index 100%
rename from crates/engine/tests/attdisp_attsync.rs
rename to crates/engine/tests/it/attdisp_attsync.rs
diff --git a/crates/engine/tests/attedit_prompts.rs b/crates/engine/tests/it/attedit_prompts.rs
similarity index 100%
rename from crates/engine/tests/attedit_prompts.rs
rename to crates/engine/tests/it/attedit_prompts.rs
diff --git a/crates/engine/tests/attrib_modes.rs b/crates/engine/tests/it/attrib_modes.rs
similarity index 100%
rename from crates/engine/tests/attrib_modes.rs
rename to crates/engine/tests/it/attrib_modes.rs
diff --git a/crates/engine/tests/attrib_props.rs b/crates/engine/tests/it/attrib_props.rs
similarity index 100%
rename from crates/engine/tests/attrib_props.rs
rename to crates/engine/tests/it/attrib_props.rs
diff --git a/crates/engine/tests/attribute_tools.rs b/crates/engine/tests/it/attribute_tools.rs
similarity index 100%
rename from crates/engine/tests/attribute_tools.rs
rename to crates/engine/tests/it/attribute_tools.rs
diff --git a/crates/engine/tests/block_keep.rs b/crates/engine/tests/it/block_keep.rs
similarity index 100%
rename from crates/engine/tests/block_keep.rs
rename to crates/engine/tests/it/block_keep.rs
diff --git a/crates/engine/tests/block_redefine.rs b/crates/engine/tests/it/block_redefine.rs
similarity index 100%
rename from crates/engine/tests/block_redefine.rs
rename to crates/engine/tests/it/block_redefine.rs
diff --git a/crates/engine/tests/break_closed_polyline.rs b/crates/engine/tests/it/break_closed_polyline.rs
similarity index 100%
rename from crates/engine/tests/break_closed_polyline.rs
rename to crates/engine/tests/it/break_closed_polyline.rs
diff --git a/crates/engine/tests/break_join_locked_layers.rs b/crates/engine/tests/it/break_join_locked_layers.rs
similarity index 100%
rename from crates/engine/tests/break_join_locked_layers.rs
rename to crates/engine/tests/it/break_join_locked_layers.rs
diff --git a/crates/engine/tests/break_keeps_z.rs b/crates/engine/tests/it/break_keeps_z.rs
similarity index 100%
rename from crates/engine/tests/break_keeps_z.rs
rename to crates/engine/tests/it/break_keeps_z.rs
diff --git a/crates/engine/tests/burst.rs b/crates/engine/tests/it/burst.rs
similarity index 100%
rename from crates/engine/tests/burst.rs
rename to crates/engine/tests/it/burst.rs
diff --git a/crates/engine/tests/constraint_geometry.rs b/crates/engine/tests/it/constraint_geometry.rs
similarity index 100%
rename from crates/engine/tests/constraint_geometry.rs
rename to crates/engine/tests/it/constraint_geometry.rs
diff --git a/crates/engine/tests/constraint_infer.rs b/crates/engine/tests/it/constraint_infer.rs
similarity index 100%
rename from crates/engine/tests/constraint_infer.rs
rename to crates/engine/tests/it/constraint_infer.rs
diff --git a/crates/engine/tests/count.rs b/crates/engine/tests/it/count.rs
similarity index 100%
rename from crates/engine/tests/count.rs
rename to crates/engine/tests/it/count.rs
diff --git a/crates/engine/tests/dash_block.rs b/crates/engine/tests/it/dash_block.rs
similarity index 100%
rename from crates/engine/tests/dash_block.rs
rename to crates/engine/tests/it/dash_block.rs
diff --git a/crates/engine/tests/data_extraction.rs b/crates/engine/tests/it/data_extraction.rs
similarity index 100%
rename from crates/engine/tests/data_extraction.rs
rename to crates/engine/tests/it/data_extraction.rs
diff --git a/crates/engine/tests/dim_baseline_spacing.rs b/crates/engine/tests/it/dim_baseline_spacing.rs
similarity index 100%
rename from crates/engine/tests/dim_baseline_spacing.rs
rename to crates/engine/tests/it/dim_baseline_spacing.rs
diff --git a/crates/engine/tests/dim_chain.rs b/crates/engine/tests/it/dim_chain.rs
similarity index 100%
rename from crates/engine/tests/dim_chain.rs
rename to crates/engine/tests/it/dim_chain.rs
diff --git a/crates/engine/tests/dim_commands.rs b/crates/engine/tests/it/dim_commands.rs
similarity index 100%
rename from crates/engine/tests/dim_commands.rs
rename to crates/engine/tests/it/dim_commands.rs
diff --git a/crates/engine/tests/dim_explode_text.rs b/crates/engine/tests/it/dim_explode_text.rs
similarity index 100%
rename from crates/engine/tests/dim_explode_text.rs
rename to crates/engine/tests/it/dim_explode_text.rs
diff --git a/crates/engine/tests/dim_properties.rs b/crates/engine/tests/it/dim_properties.rs
similarity index 100%
rename from crates/engine/tests/dim_properties.rs
rename to crates/engine/tests/it/dim_properties.rs
diff --git a/crates/engine/tests/dim_radial_inside.rs b/crates/engine/tests/it/dim_radial_inside.rs
similarity index 100%
rename from crates/engine/tests/dim_radial_inside.rs
rename to crates/engine/tests/it/dim_radial_inside.rs
diff --git a/crates/engine/tests/dim_radial_outside.rs b/crates/engine/tests/it/dim_radial_outside.rs
similarity index 100%
rename from crates/engine/tests/dim_radial_outside.rs
rename to crates/engine/tests/it/dim_radial_outside.rs
diff --git a/crates/engine/tests/dim_vars.rs b/crates/engine/tests/it/dim_vars.rs
similarity index 100%
rename from crates/engine/tests/dim_vars.rs
rename to crates/engine/tests/it/dim_vars.rs
diff --git a/crates/engine/tests/dimtedit_prompts.rs b/crates/engine/tests/it/dimtedit_prompts.rs
similarity index 100%
rename from crates/engine/tests/dimtedit_prompts.rs
rename to crates/engine/tests/it/dimtedit_prompts.rs
diff --git a/crates/engine/tests/drafting_spacing.rs b/crates/engine/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/engine/tests/drafting_spacing.rs
rename to crates/engine/tests/it/drafting_spacing.rs
diff --git a/crates/engine/tests/draw_prompts.rs b/crates/engine/tests/it/draw_prompts.rs
similarity index 100%
rename from crates/engine/tests/draw_prompts.rs
rename to crates/engine/tests/it/draw_prompts.rs
diff --git a/crates/engine/tests/draworder.rs b/crates/engine/tests/it/draworder.rs
similarity index 100%
rename from crates/engine/tests/draworder.rs
rename to crates/engine/tests/it/draworder.rs
diff --git a/crates/engine/tests/dyn_input.rs b/crates/engine/tests/it/dyn_input.rs
similarity index 100%
rename from crates/engine/tests/dyn_input.rs
rename to crates/engine/tests/it/dyn_input.rs
diff --git a/crates/engine/tests/dynamic_block_data.rs b/crates/engine/tests/it/dynamic_block_data.rs
similarity index 100%
rename from crates/engine/tests/dynamic_block_data.rs
rename to crates/engine/tests/it/dynamic_block_data.rs
diff --git a/crates/engine/tests/dynamic_grips.rs b/crates/engine/tests/it/dynamic_grips.rs
similarity index 99%
rename from crates/engine/tests/dynamic_grips.rs
rename to crates/engine/tests/it/dynamic_grips.rs
index 42cfaba0..75ed1b78 100644
--- a/crates/engine/tests/dynamic_grips.rs
+++ b/crates/engine/tests/it/dynamic_grips.rs
@@ -29,7 +29,7 @@ fn session() -> (Session, Handle) {
 /// As [`session`], with the fixture's text changed by `edit` first.
 fn session_with(edit: impl Fn(String) -> String) -> (Session, Handle) {
     let grip = "0 BLOCKLINEARGRIP\n5 68\n330 61\n100 AcDbEvalExpr\n90 9\n98 33\n99 232\n100 AcDbBlockElement\n300 End Grip\n98 33\n99 232\n1071 0\n";
-    let src = include_str!("../../io/tests/data/dynblock_door.txt")
+    let src = include_str!("../../../io/tests/data/dynblock_door.txt")
         .replace("\r\n", "\n")
         .replace("170 4\n91 0\n91 0\n", "170 4\n91 8\n91 9\n")
         .replace("1030 0\n93 0\n170 0\n171 0\n100 AcDbBlockVisibilityParameter", "1030 0\n93 10\n170 0\n171 0\n100 AcDbBlockVisibilityParameter")
diff --git a/crates/engine/tests/fillet_chamfer.rs b/crates/engine/tests/it/fillet_chamfer.rs
similarity index 100%
rename from crates/engine/tests/fillet_chamfer.rs
rename to crates/engine/tests/it/fillet_chamfer.rs
diff --git a/crates/engine/tests/fix_holds_grips.rs b/crates/engine/tests/it/fix_holds_grips.rs
similarity index 100%
rename from crates/engine/tests/fix_holds_grips.rs
rename to crates/engine/tests/it/fix_holds_grips.rs
diff --git a/crates/engine/tests/followups_626.rs b/crates/engine/tests/it/followups_626.rs
similarity index 100%
rename from crates/engine/tests/followups_626.rs
rename to crates/engine/tests/it/followups_626.rs
diff --git a/crates/engine/tests/grip_dim_input.rs b/crates/engine/tests/it/grip_dim_input.rs
similarity index 100%
rename from crates/engine/tests/grip_dim_input.rs
rename to crates/engine/tests/it/grip_dim_input.rs
diff --git a/crates/engine/tests/grip_options.rs b/crates/engine/tests/it/grip_options.rs
similarity index 100%
rename from crates/engine/tests/grip_options.rs
rename to crates/engine/tests/it/grip_options.rs
diff --git a/crates/engine/tests/grip_selection.rs b/crates/engine/tests/it/grip_selection.rs
similarity index 100%
rename from crates/engine/tests/grip_selection.rs
rename to crates/engine/tests/it/grip_selection.rs
diff --git a/crates/engine/tests/group_selection.rs b/crates/engine/tests/it/group_selection.rs
similarity index 100%
rename from crates/engine/tests/group_selection.rs
rename to crates/engine/tests/it/group_selection.rs
diff --git a/crates/engine/tests/groups.rs b/crates/engine/tests/it/groups.rs
similarity index 100%
rename from crates/engine/tests/groups.rs
rename to crates/engine/tests/it/groups.rs
diff --git a/crates/engine/tests/hatch_assoc.rs b/crates/engine/tests/it/hatch_assoc.rs
similarity index 100%
rename from crates/engine/tests/hatch_assoc.rs
rename to crates/engine/tests/it/hatch_assoc.rs
diff --git a/crates/engine/tests/hatch_dialog_helpers.rs b/crates/engine/tests/it/hatch_dialog_helpers.rs
similarity index 100%
rename from crates/engine/tests/hatch_dialog_helpers.rs
rename to crates/engine/tests/it/hatch_dialog_helpers.rs
diff --git a/crates/engine/tests/hatch_numeric_validation.rs b/crates/engine/tests/it/hatch_numeric_validation.rs
similarity index 100%
rename from crates/engine/tests/hatch_numeric_validation.rs
rename to crates/engine/tests/it/hatch_numeric_validation.rs
diff --git a/crates/engine/tests/hatch_options.rs b/crates/engine/tests/it/hatch_options.rs
similarity index 100%
rename from crates/engine/tests/hatch_options.rs
rename to crates/engine/tests/it/hatch_options.rs
diff --git a/crates/engine/tests/helix.rs b/crates/engine/tests/it/helix.rs
similarity index 100%
rename from crates/engine/tests/helix.rs
rename to crates/engine/tests/it/helix.rs
diff --git a/crates/engine/tests/inquiry_keywords.rs b/crates/engine/tests/it/inquiry_keywords.rs
similarity index 100%
rename from crates/engine/tests/inquiry_keywords.rs
rename to crates/engine/tests/it/inquiry_keywords.rs
diff --git a/crates/engine/tests/inquiry_z.rs b/crates/engine/tests/it/inquiry_z.rs
similarity index 100%
rename from crates/engine/tests/inquiry_z.rs
rename to crates/engine/tests/it/inquiry_z.rs
diff --git a/crates/engine/tests/insert_prompts.rs b/crates/engine/tests/it/insert_prompts.rs
similarity index 100%
rename from crates/engine/tests/insert_prompts.rs
rename to crates/engine/tests/it/insert_prompts.rs
diff --git a/crates/engine/tests/isometric.rs b/crates/engine/tests/it/isometric.rs
similarity index 100%
rename from crates/engine/tests/isometric.rs
rename to crates/engine/tests/it/isometric.rs
diff --git a/crates/engine/tests/join_close.rs b/crates/engine/tests/it/join_close.rs
similarity index 100%
rename from crates/engine/tests/join_close.rs
rename to crates/engine/tests/it/join_close.rs
diff --git a/crates/engine/tests/json_param_validation.rs b/crates/engine/tests/it/json_param_validation.rs
similarity index 100%
rename from crates/engine/tests/json_param_validation.rs
rename to crates/engine/tests/it/json_param_validation.rs
diff --git a/crates/engine/tests/layer_cmdline.rs b/crates/engine/tests/it/layer_cmdline.rs
similarity index 100%
rename from crates/engine/tests/layer_cmdline.rs
rename to crates/engine/tests/it/layer_cmdline.rs
diff --git a/crates/engine/tests/layer_merge_delete.rs b/crates/engine/tests/it/layer_merge_delete.rs
similarity index 100%
rename from crates/engine/tests/layer_merge_delete.rs
rename to crates/engine/tests/it/layer_merge_delete.rs
diff --git a/crates/engine/tests/layoff_repeat.rs b/crates/engine/tests/it/layoff_repeat.rs
similarity index 100%
rename from crates/engine/tests/layoff_repeat.rs
rename to crates/engine/tests/it/layoff_repeat.rs
diff --git a/crates/engine/tests/layout_prompts.rs b/crates/engine/tests/it/layout_prompts.rs
similarity index 100%
rename from crates/engine/tests/layout_prompts.rs
rename to crates/engine/tests/it/layout_prompts.rs
diff --git a/crates/engine/tests/lisp_corpus.rs b/crates/engine/tests/it/lisp_corpus.rs
similarity index 99%
rename from crates/engine/tests/lisp_corpus.rs
rename to crates/engine/tests/it/lisp_corpus.rs
index 09f9ea04..06838e3c 100644
--- a/crates/engine/tests/lisp_corpus.rs
+++ b/crates/engine/tests/it/lisp_corpus.rs
@@ -2,7 +2,6 @@
 //! leave exactly the expected entities, layers and printed text. The corpus lives in its own
 //! repository; point `CADCRAFT_LISP_CORPUS` at its `cases` directory (or the repository) to run
 //! it. Without it the test only says so.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::path::{Path, PathBuf};
 
diff --git a/crates/engine/tests/it/main.rs b/crates/engine/tests/it/main.rs
new file mode 100644
index 00000000..b6e088a1
--- /dev/null
+++ b/crates/engine/tests/it/main.rs
@@ -0,0 +1,143 @@
+mod angle_prompts;
+mod angle_settings;
+mod annotate_options;
+mod annotative;
+mod arc_ctrl_direction;
+mod array_commands;
+mod assoc_array;
+mod attdisp_attsync;
+mod attedit_prompts;
+mod attrib_modes;
+mod attrib_props;
+mod attribute_tools;
+mod block_keep;
+mod block_redefine;
+mod break_closed_polyline;
+mod break_join_locked_layers;
+mod break_keeps_z;
+mod burst;
+mod constraint_geometry;
+mod constraint_infer;
+mod count;
+mod dash_block;
+mod data_extraction;
+mod dim_baseline_spacing;
+mod dim_chain;
+mod dim_commands;
+mod dim_explode_text;
+mod dim_properties;
+mod dim_radial_inside;
+mod dim_radial_outside;
+mod dim_vars;
+mod dimtedit_prompts;
+mod drafting_spacing;
+mod draw_prompts;
+mod draworder;
+mod dyn_input;
+mod dynamic_block_data;
+mod dynamic_grips;
+mod fillet_chamfer;
+mod fix_holds_grips;
+mod followups_626;
+mod grip_dim_input;
+mod grip_options;
+mod grip_selection;
+mod group_selection;
+mod groups;
+mod hatch_assoc;
+mod hatch_dialog_helpers;
+mod hatch_numeric_validation;
+mod hatch_options;
+mod helix;
+mod inquiry_keywords;
+mod inquiry_z;
+mod insert_prompts;
+mod isometric;
+mod join_close;
+mod json_param_validation;
+mod layer_cmdline;
+mod layer_merge_delete;
+mod layoff_repeat;
+mod layout_prompts;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod lisp_corpus;
+mod malformed_handles;
+mod matchprop;
+mod measure_distance_snapping;
+mod metric_linetypes;
+mod mleader_content;
+mod mleader_remember;
+mod mline;
+mod mocoro;
+mod modify_curves;
+mod mtext_columns;
+mod mtext_options;
+mod multiline_attributes;
+mod named_views;
+mod non_finite_edits;
+mod offset_closed_spline;
+mod offset_ellipse_side;
+mod offset_move;
+mod options_profile;
+mod overkill;
+mod parallel_display_list;
+mod pedit_splinedit;
+mod pick_text;
+mod pickdrag;
+mod pline_arc_xline_options;
+mod plot_styles;
+mod point_modifiers;
+mod post_command_passes;
+mod prompt_keywords;
+mod props_bad_lineweight;
+mod props_insert_scale_attribs;
+mod purge_mlinestyles;
+mod purge_prompts;
+mod qdim;
+mod qdim_modes;
+mod query_entities;
+mod quickcalc;
+mod recent_commands;
+mod rectang_ortho;
+mod refedit;
+mod region;
+mod rename_cmdline;
+mod rotate_reference;
+mod select_keywords;
+mod select_similar;
+mod select_underscore_keywords;
+mod selection_cycling;
+mod selection_modes;
+mod setvar_coverage;
+mod shapes;
+mod snap_annotations;
+mod snap_blocks;
+mod snap_curves;
+mod snap_intersections_aperture;
+mod snap_nearest;
+mod snap_overrides;
+mod snap_tracking;
+mod snaps_more;
+mod space_is_enter;
+mod spline_degree;
+mod spline_options;
+mod stretch;
+mod stretch_select;
+mod table_formulas;
+mod table_styles;
+mod temp_tracking;
+mod text_commands;
+mod text_left_justify;
+mod tolerance;
+mod transparent;
+mod trim_closed_polyline;
+mod trim_extend_options;
+mod undo_count;
+mod undo_layout_tab;
+mod viewport_clip;
+mod vplayer_prompts;
+mod vports;
+mod xdata_follows_entity;
+mod zoom_keywords;
+mod zoom_viewport;
+mod zoom_window_ortho;
diff --git a/crates/engine/tests/malformed_handles.rs b/crates/engine/tests/it/malformed_handles.rs
similarity index 100%
rename from crates/engine/tests/malformed_handles.rs
rename to crates/engine/tests/it/malformed_handles.rs
diff --git a/crates/engine/tests/matchprop.rs b/crates/engine/tests/it/matchprop.rs
similarity index 100%
rename from crates/engine/tests/matchprop.rs
rename to crates/engine/tests/it/matchprop.rs
diff --git a/crates/engine/tests/measure_distance_snapping.rs b/crates/engine/tests/it/measure_distance_snapping.rs
similarity index 100%
rename from crates/engine/tests/measure_distance_snapping.rs
rename to crates/engine/tests/it/measure_distance_snapping.rs
diff --git a/crates/engine/tests/metric_linetypes.rs b/crates/engine/tests/it/metric_linetypes.rs
similarity index 100%
rename from crates/engine/tests/metric_linetypes.rs
rename to crates/engine/tests/it/metric_linetypes.rs
diff --git a/crates/engine/tests/mleader_content.rs b/crates/engine/tests/it/mleader_content.rs
similarity index 100%
rename from crates/engine/tests/mleader_content.rs
rename to crates/engine/tests/it/mleader_content.rs
diff --git a/crates/engine/tests/mleader_remember.rs b/crates/engine/tests/it/mleader_remember.rs
similarity index 100%
rename from crates/engine/tests/mleader_remember.rs
rename to crates/engine/tests/it/mleader_remember.rs
diff --git a/crates/engine/tests/mline.rs b/crates/engine/tests/it/mline.rs
similarity index 100%
rename from crates/engine/tests/mline.rs
rename to crates/engine/tests/it/mline.rs
diff --git a/crates/engine/tests/mocoro.rs b/crates/engine/tests/it/mocoro.rs
similarity index 100%
rename from crates/engine/tests/mocoro.rs
rename to crates/engine/tests/it/mocoro.rs
diff --git a/crates/engine/tests/modify_curves.rs b/crates/engine/tests/it/modify_curves.rs
similarity index 100%
rename from crates/engine/tests/modify_curves.rs
rename to crates/engine/tests/it/modify_curves.rs
diff --git a/crates/engine/tests/mtext_columns.rs b/crates/engine/tests/it/mtext_columns.rs
similarity index 100%
rename from crates/engine/tests/mtext_columns.rs
rename to crates/engine/tests/it/mtext_columns.rs
diff --git a/crates/engine/tests/mtext_options.rs b/crates/engine/tests/it/mtext_options.rs
similarity index 100%
rename from crates/engine/tests/mtext_options.rs
rename to crates/engine/tests/it/mtext_options.rs
diff --git a/crates/engine/tests/multiline_attributes.rs b/crates/engine/tests/it/multiline_attributes.rs
similarity index 100%
rename from crates/engine/tests/multiline_attributes.rs
rename to crates/engine/tests/it/multiline_attributes.rs
diff --git a/crates/engine/tests/named_views.rs b/crates/engine/tests/it/named_views.rs
similarity index 100%
rename from crates/engine/tests/named_views.rs
rename to crates/engine/tests/it/named_views.rs
diff --git a/crates/engine/tests/non_finite_edits.rs b/crates/engine/tests/it/non_finite_edits.rs
similarity index 100%
rename from crates/engine/tests/non_finite_edits.rs
rename to crates/engine/tests/it/non_finite_edits.rs
diff --git a/crates/engine/tests/offset_closed_spline.rs b/crates/engine/tests/it/offset_closed_spline.rs
similarity index 100%
rename from crates/engine/tests/offset_closed_spline.rs
rename to crates/engine/tests/it/offset_closed_spline.rs
diff --git a/crates/engine/tests/offset_ellipse_side.rs b/crates/engine/tests/it/offset_ellipse_side.rs
similarity index 100%
rename from crates/engine/tests/offset_ellipse_side.rs
rename to crates/engine/tests/it/offset_ellipse_side.rs
diff --git a/crates/engine/tests/offset_move.rs b/crates/engine/tests/it/offset_move.rs
similarity index 100%
rename from crates/engine/tests/offset_move.rs
rename to crates/engine/tests/it/offset_move.rs
diff --git a/crates/engine/tests/options_profile.rs b/crates/engine/tests/it/options_profile.rs
similarity index 100%
rename from crates/engine/tests/options_profile.rs
rename to crates/engine/tests/it/options_profile.rs
diff --git a/crates/engine/tests/overkill.rs b/crates/engine/tests/it/overkill.rs
similarity index 100%
rename from crates/engine/tests/overkill.rs
rename to crates/engine/tests/it/overkill.rs
diff --git a/crates/engine/tests/parallel_display_list.rs b/crates/engine/tests/it/parallel_display_list.rs
similarity index 100%
rename from crates/engine/tests/parallel_display_list.rs
rename to crates/engine/tests/it/parallel_display_list.rs
diff --git a/crates/engine/tests/pedit_splinedit.rs b/crates/engine/tests/it/pedit_splinedit.rs
similarity index 100%
rename from crates/engine/tests/pedit_splinedit.rs
rename to crates/engine/tests/it/pedit_splinedit.rs
diff --git a/crates/engine/tests/pick_text.rs b/crates/engine/tests/it/pick_text.rs
similarity index 100%
rename from crates/engine/tests/pick_text.rs
rename to crates/engine/tests/it/pick_text.rs
diff --git a/crates/engine/tests/pickdrag.rs b/crates/engine/tests/it/pickdrag.rs
similarity index 100%
rename from crates/engine/tests/pickdrag.rs
rename to crates/engine/tests/it/pickdrag.rs
diff --git a/crates/engine/tests/pline_arc_xline_options.rs b/crates/engine/tests/it/pline_arc_xline_options.rs
similarity index 100%
rename from crates/engine/tests/pline_arc_xline_options.rs
rename to crates/engine/tests/it/pline_arc_xline_options.rs
diff --git a/crates/engine/tests/plot_styles.rs b/crates/engine/tests/it/plot_styles.rs
similarity index 100%
rename from crates/engine/tests/plot_styles.rs
rename to crates/engine/tests/it/plot_styles.rs
diff --git a/crates/engine/tests/point_modifiers.rs b/crates/engine/tests/it/point_modifiers.rs
similarity index 100%
rename from crates/engine/tests/point_modifiers.rs
rename to crates/engine/tests/it/point_modifiers.rs
diff --git a/crates/engine/tests/post_command_passes.rs b/crates/engine/tests/it/post_command_passes.rs
similarity index 100%
rename from crates/engine/tests/post_command_passes.rs
rename to crates/engine/tests/it/post_command_passes.rs
diff --git a/crates/engine/tests/prompt_keywords.rs b/crates/engine/tests/it/prompt_keywords.rs
similarity index 100%
rename from crates/engine/tests/prompt_keywords.rs
rename to crates/engine/tests/it/prompt_keywords.rs
diff --git a/crates/engine/tests/props_bad_lineweight.rs b/crates/engine/tests/it/props_bad_lineweight.rs
similarity index 100%
rename from crates/engine/tests/props_bad_lineweight.rs
rename to crates/engine/tests/it/props_bad_lineweight.rs
diff --git a/crates/engine/tests/props_insert_scale_attribs.rs b/crates/engine/tests/it/props_insert_scale_attribs.rs
similarity index 100%
rename from crates/engine/tests/props_insert_scale_attribs.rs
rename to crates/engine/tests/it/props_insert_scale_attribs.rs
diff --git a/crates/engine/tests/purge_mlinestyles.rs b/crates/engine/tests/it/purge_mlinestyles.rs
similarity index 100%
rename from crates/engine/tests/purge_mlinestyles.rs
rename to crates/engine/tests/it/purge_mlinestyles.rs
diff --git a/crates/engine/tests/purge_prompts.rs b/crates/engine/tests/it/purge_prompts.rs
similarity index 100%
rename from crates/engine/tests/purge_prompts.rs
rename to crates/engine/tests/it/purge_prompts.rs
diff --git a/crates/engine/tests/qdim.rs b/crates/engine/tests/it/qdim.rs
similarity index 100%
rename from crates/engine/tests/qdim.rs
rename to crates/engine/tests/it/qdim.rs
diff --git a/crates/engine/tests/qdim_modes.rs b/crates/engine/tests/it/qdim_modes.rs
similarity index 100%
rename from crates/engine/tests/qdim_modes.rs
rename to crates/engine/tests/it/qdim_modes.rs
diff --git a/crates/engine/tests/query_entities.rs b/crates/engine/tests/it/query_entities.rs
similarity index 100%
rename from crates/engine/tests/query_entities.rs
rename to crates/engine/tests/it/query_entities.rs
diff --git a/crates/engine/tests/quickcalc.rs b/crates/engine/tests/it/quickcalc.rs
similarity index 100%
rename from crates/engine/tests/quickcalc.rs
rename to crates/engine/tests/it/quickcalc.rs
diff --git a/crates/engine/tests/recent_commands.rs b/crates/engine/tests/it/recent_commands.rs
similarity index 100%
rename from crates/engine/tests/recent_commands.rs
rename to crates/engine/tests/it/recent_commands.rs
diff --git a/crates/engine/tests/rectang_ortho.rs b/crates/engine/tests/it/rectang_ortho.rs
similarity index 100%
rename from crates/engine/tests/rectang_ortho.rs
rename to crates/engine/tests/it/rectang_ortho.rs
diff --git a/crates/engine/tests/refedit.rs b/crates/engine/tests/it/refedit.rs
similarity index 100%
rename from crates/engine/tests/refedit.rs
rename to crates/engine/tests/it/refedit.rs
diff --git a/crates/engine/tests/region.rs b/crates/engine/tests/it/region.rs
similarity index 100%
rename from crates/engine/tests/region.rs
rename to crates/engine/tests/it/region.rs
diff --git a/crates/engine/tests/rename_cmdline.rs b/crates/engine/tests/it/rename_cmdline.rs
similarity index 100%
rename from crates/engine/tests/rename_cmdline.rs
rename to crates/engine/tests/it/rename_cmdline.rs
diff --git a/crates/engine/tests/rotate_reference.rs b/crates/engine/tests/it/rotate_reference.rs
similarity index 100%
rename from crates/engine/tests/rotate_reference.rs
rename to crates/engine/tests/it/rotate_reference.rs
diff --git a/crates/engine/tests/select_keywords.rs b/crates/engine/tests/it/select_keywords.rs
similarity index 100%
rename from crates/engine/tests/select_keywords.rs
rename to crates/engine/tests/it/select_keywords.rs
diff --git a/crates/engine/tests/select_similar.rs b/crates/engine/tests/it/select_similar.rs
similarity index 100%
rename from crates/engine/tests/select_similar.rs
rename to crates/engine/tests/it/select_similar.rs
diff --git a/crates/engine/tests/select_underscore_keywords.rs b/crates/engine/tests/it/select_underscore_keywords.rs
similarity index 100%
rename from crates/engine/tests/select_underscore_keywords.rs
rename to crates/engine/tests/it/select_underscore_keywords.rs
diff --git a/crates/engine/tests/selection_cycling.rs b/crates/engine/tests/it/selection_cycling.rs
similarity index 100%
rename from crates/engine/tests/selection_cycling.rs
rename to crates/engine/tests/it/selection_cycling.rs
diff --git a/crates/engine/tests/selection_modes.rs b/crates/engine/tests/it/selection_modes.rs
similarity index 100%
rename from crates/engine/tests/selection_modes.rs
rename to crates/engine/tests/it/selection_modes.rs
diff --git a/crates/engine/tests/setvar_coverage.rs b/crates/engine/tests/it/setvar_coverage.rs
similarity index 100%
rename from crates/engine/tests/setvar_coverage.rs
rename to crates/engine/tests/it/setvar_coverage.rs
diff --git a/crates/engine/tests/shapes.rs b/crates/engine/tests/it/shapes.rs
similarity index 100%
rename from crates/engine/tests/shapes.rs
rename to crates/engine/tests/it/shapes.rs
diff --git a/crates/engine/tests/snap_annotations.rs b/crates/engine/tests/it/snap_annotations.rs
similarity index 100%
rename from crates/engine/tests/snap_annotations.rs
rename to crates/engine/tests/it/snap_annotations.rs
diff --git a/crates/engine/tests/snap_blocks.rs b/crates/engine/tests/it/snap_blocks.rs
similarity index 100%
rename from crates/engine/tests/snap_blocks.rs
rename to crates/engine/tests/it/snap_blocks.rs
diff --git a/crates/engine/tests/snap_curves.rs b/crates/engine/tests/it/snap_curves.rs
similarity index 100%
rename from crates/engine/tests/snap_curves.rs
rename to crates/engine/tests/it/snap_curves.rs
diff --git a/crates/engine/tests/snap_intersections_aperture.rs b/crates/engine/tests/it/snap_intersections_aperture.rs
similarity index 100%
rename from crates/engine/tests/snap_intersections_aperture.rs
rename to crates/engine/tests/it/snap_intersections_aperture.rs
diff --git a/crates/engine/tests/snap_nearest.rs b/crates/engine/tests/it/snap_nearest.rs
similarity index 100%
rename from crates/engine/tests/snap_nearest.rs
rename to crates/engine/tests/it/snap_nearest.rs
diff --git a/crates/engine/tests/snap_overrides.rs b/crates/engine/tests/it/snap_overrides.rs
similarity index 100%
rename from crates/engine/tests/snap_overrides.rs
rename to crates/engine/tests/it/snap_overrides.rs
diff --git a/crates/engine/tests/snap_tracking.rs b/crates/engine/tests/it/snap_tracking.rs
similarity index 100%
rename from crates/engine/tests/snap_tracking.rs
rename to crates/engine/tests/it/snap_tracking.rs
diff --git a/crates/engine/tests/snaps_more.rs b/crates/engine/tests/it/snaps_more.rs
similarity index 100%
rename from crates/engine/tests/snaps_more.rs
rename to crates/engine/tests/it/snaps_more.rs
diff --git a/crates/engine/tests/space_is_enter.rs b/crates/engine/tests/it/space_is_enter.rs
similarity index 100%
rename from crates/engine/tests/space_is_enter.rs
rename to crates/engine/tests/it/space_is_enter.rs
diff --git a/crates/engine/tests/spline_degree.rs b/crates/engine/tests/it/spline_degree.rs
similarity index 100%
rename from crates/engine/tests/spline_degree.rs
rename to crates/engine/tests/it/spline_degree.rs
diff --git a/crates/engine/tests/spline_options.rs b/crates/engine/tests/it/spline_options.rs
similarity index 100%
rename from crates/engine/tests/spline_options.rs
rename to crates/engine/tests/it/spline_options.rs
diff --git a/crates/engine/tests/stretch.rs b/crates/engine/tests/it/stretch.rs
similarity index 100%
rename from crates/engine/tests/stretch.rs
rename to crates/engine/tests/it/stretch.rs
diff --git a/crates/engine/tests/stretch_select.rs b/crates/engine/tests/it/stretch_select.rs
similarity index 100%
rename from crates/engine/tests/stretch_select.rs
rename to crates/engine/tests/it/stretch_select.rs
diff --git a/crates/engine/tests/table_formulas.rs b/crates/engine/tests/it/table_formulas.rs
similarity index 100%
rename from crates/engine/tests/table_formulas.rs
rename to crates/engine/tests/it/table_formulas.rs
diff --git a/crates/engine/tests/table_styles.rs b/crates/engine/tests/it/table_styles.rs
similarity index 100%
rename from crates/engine/tests/table_styles.rs
rename to crates/engine/tests/it/table_styles.rs
diff --git a/crates/engine/tests/temp_tracking.rs b/crates/engine/tests/it/temp_tracking.rs
similarity index 100%
rename from crates/engine/tests/temp_tracking.rs
rename to crates/engine/tests/it/temp_tracking.rs
diff --git a/crates/engine/tests/text_commands.rs b/crates/engine/tests/it/text_commands.rs
similarity index 100%
rename from crates/engine/tests/text_commands.rs
rename to crates/engine/tests/it/text_commands.rs
diff --git a/crates/engine/tests/text_left_justify.rs b/crates/engine/tests/it/text_left_justify.rs
similarity index 100%
rename from crates/engine/tests/text_left_justify.rs
rename to crates/engine/tests/it/text_left_justify.rs
diff --git a/crates/engine/tests/tolerance.rs b/crates/engine/tests/it/tolerance.rs
similarity index 100%
rename from crates/engine/tests/tolerance.rs
rename to crates/engine/tests/it/tolerance.rs
diff --git a/crates/engine/tests/transparent.rs b/crates/engine/tests/it/transparent.rs
similarity index 100%
rename from crates/engine/tests/transparent.rs
rename to crates/engine/tests/it/transparent.rs
diff --git a/crates/engine/tests/trim_closed_polyline.rs b/crates/engine/tests/it/trim_closed_polyline.rs
similarity index 100%
rename from crates/engine/tests/trim_closed_polyline.rs
rename to crates/engine/tests/it/trim_closed_polyline.rs
diff --git a/crates/engine/tests/trim_extend_options.rs b/crates/engine/tests/it/trim_extend_options.rs
similarity index 100%
rename from crates/engine/tests/trim_extend_options.rs
rename to crates/engine/tests/it/trim_extend_options.rs
diff --git a/crates/engine/tests/undo_count.rs b/crates/engine/tests/it/undo_count.rs
similarity index 100%
rename from crates/engine/tests/undo_count.rs
rename to crates/engine/tests/it/undo_count.rs
diff --git a/crates/engine/tests/undo_layout_tab.rs b/crates/engine/tests/it/undo_layout_tab.rs
similarity index 100%
rename from crates/engine/tests/undo_layout_tab.rs
rename to crates/engine/tests/it/undo_layout_tab.rs
diff --git a/crates/engine/tests/viewport_clip.rs b/crates/engine/tests/it/viewport_clip.rs
similarity index 100%
rename from crates/engine/tests/viewport_clip.rs
rename to crates/engine/tests/it/viewport_clip.rs
diff --git a/crates/engine/tests/vplayer_prompts.rs b/crates/engine/tests/it/vplayer_prompts.rs
similarity index 100%
rename from crates/engine/tests/vplayer_prompts.rs
rename to crates/engine/tests/it/vplayer_prompts.rs
diff --git a/crates/engine/tests/vports.rs b/crates/engine/tests/it/vports.rs
similarity index 100%
rename from crates/engine/tests/vports.rs
rename to crates/engine/tests/it/vports.rs
diff --git a/crates/engine/tests/xdata_follows_entity.rs b/crates/engine/tests/it/xdata_follows_entity.rs
similarity index 100%
rename from crates/engine/tests/xdata_follows_entity.rs
rename to crates/engine/tests/it/xdata_follows_entity.rs
diff --git a/crates/engine/tests/zoom_keywords.rs b/crates/engine/tests/it/zoom_keywords.rs
similarity index 100%
rename from crates/engine/tests/zoom_keywords.rs
rename to crates/engine/tests/it/zoom_keywords.rs
diff --git a/crates/engine/tests/zoom_viewport.rs b/crates/engine/tests/it/zoom_viewport.rs
similarity index 100%
rename from crates/engine/tests/zoom_viewport.rs
rename to crates/engine/tests/it/zoom_viewport.rs
diff --git a/crates/engine/tests/zoom_window_ortho.rs b/crates/engine/tests/it/zoom_window_ortho.rs
similarity index 100%
rename from crates/engine/tests/zoom_window_ortho.rs
rename to crates/engine/tests/it/zoom_window_ortho.rs
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index 7eb2a784..6df86f7e 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -18,9 +18,11 @@ fn main() {
         match craft_fonts(&dir) {
             Ok(entries) => src.push_str(&entries),
             Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
-                println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
+                println!("cargo::error=CRAFT_FONTS_DIR={}: {}", one_line(&dir.display().to_string()), one_line(&e));
+            }
+            Err(e) => {
+                println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {}", one_line(&dir.display().to_string()), one_line(&e))
             }
-            Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
         }
     }
     src.push_str("];\n");
@@ -37,7 +39,9 @@ const BARRED_FAMILIES: [&str; 5] = ["Source Han", "Source Serif", "Source Sans",
 /// One `CraftFont { .. }` initialiser per manifest line, in manifest order.
 fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     let manifest = dir.join("fonts/manifest.txt");
-    println!("cargo::rerun-if-changed={}", manifest.display());
+    rerun_if_changed(&manifest)?;
+    // Resolve the checkout root once so every manifest file can be confined inside it.
+    let root = dir.canonicalize().map_err(|e| format!("{}: {e}", dir.display()))?;
     let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
     let mut out = String::new();
@@ -55,8 +59,8 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
         if wasm && !web_face {
             continue;
         }
-        let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
-        println!("cargo::rerun-if-changed={}", path.display());
+        let path = resolve_font(&root, file)?;
+        rerun_if_changed(&path)?;
         let scripts: Vec<String> = scripts.split(',').map(|s| format!("{:?}", s.trim())).collect();
         let _ = writeln!(
             out,
@@ -67,3 +71,38 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     }
     Ok(out)
 }
+
+/// Resolve a manifest `file` field to a real path *confined to the checkout* `root` (CWE-22).
+///
+/// The field is rejected if it is absolute or contains a parent (`..`) component, and the
+/// canonicalised result must still live inside `root`, so a crafted manifest or a symlink in the
+/// checkout cannot make the generated `include_bytes!` read an arbitrary file on the build host.
+fn resolve_font(root: &std::path::Path, file: &str) -> Result<PathBuf, String> {
+    let rel = std::path::Path::new(file);
+    if rel.is_absolute() || rel.components().any(|c| matches!(c, std::path::Component::ParentDir)) {
+        return Err(format!("{file}: manifest paths must be relative and stay inside the checkout"));
+    }
+    let path = root.join(rel).canonicalize().map_err(|e| format!("{file}: {e}"))?;
+    if !path.starts_with(root) {
+        return Err(format!("{file}: resolves outside the craft-fonts checkout"));
+    }
+    Ok(path)
+}
+
+/// Collapse CR/LF in a diagnostic derived from checkout contents to a single space, so it cannot
+/// introduce an additional Cargo directive on the newline-delimited build-script stream (CWE-74).
+fn one_line(s: &str) -> String {
+    s.replace(['\n', '\r'], " ")
+}
+
+/// Emit a `cargo::rerun-if-changed` directive for `path`, refusing paths that contain a line
+/// separator (CWE-74): Cargo's build-script protocol is newline-delimited, so a path with an
+/// embedded CR/LF could smuggle an extra directive such as `cargo::rustc-env=OUT_DIR=…`.
+fn rerun_if_changed(path: &std::path::Path) -> Result<(), String> {
+    let shown = path.display().to_string();
+    if shown.contains(['\n', '\r']) {
+        return Err(format!("{shown:?}: path contains a line separator"));
+    }
+    println!("cargo::rerun-if-changed={shown}");
+    Ok(())
+}
diff --git a/crates/fonts/src/complex.rs b/crates/fonts/src/complex.rs
index fdfef151..dafabdc7 100644
--- a/crates/fonts/src/complex.rs
+++ b/crates/fonts/src/complex.rs
@@ -8,6 +8,7 @@
 
 use std::ops::Range;
 use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::Arc;
 
 use cadcraft_geom::Vec2;
 
@@ -60,6 +61,7 @@ pub(crate) fn shape(primary: Option<&Face>, s: &str, height: f64, width_factor:
     catch_unwind(AssertUnwindSafe(|| shape_chars(primary, &chars, height, width_factor, oblique))).ok()
 }
 
+/// Lay out decoded directional runs, keeping advances and decoration spans for empty glyphs.
 fn shape_chars(primary: Option<&Face>, chars: &[(char, bool, bool)], height: f64, width_factor: f64, oblique: f64) -> Shaped {
     let h = if height.is_finite() && height > 0.0 { height } else { 1.0 };
     let wf = if width_factor.is_finite() && width_factor.abs() > 1e-6 { width_factor } else { 1.0 };
@@ -181,28 +183,31 @@ struct Glyph {
 /// Shape characters `r` of `cs` (one direction, one face) into glyphs in display order.
 fn shape_run(face: &Face, cs: &[char], r: Range<usize>, rtl: bool) -> Vec<Glyph> {
     let run = cs.get(r.clone()).unwrap_or_default();
-    let Ok(font) = harfrust::FontRef::from_index(&face.bytes, face.index) else { return Vec::new() };
-    let data = harfrust::ShaperData::new(&font);
-    let shaper = data.shaper(&font).build();
-    let mut buf = harfrust::UnicodeBuffer::new();
+    // Shares the face's bytes instead of copying them.
+    let bytes: Arc<dyn AsRef<[u8]> + Send + Sync> = face.bytes.clone();
+    let Some(font) = harfrust::Font::new(bytes, face.index) else { return Vec::new() };
+    let shaper = harfrust::ShaperFont::new(&font);
+    let mut buf = harfrust::Buffer::new();
     let arabic = run.iter().any(|c| matches!(*c, '\u{0600}'..='\u{08FF}'));
     if arabic && !face.has_joining_features() {
         for (c, i) in bidi::presentation_forms(run, |p| face.has_glyph(p)) {
-            buf.add(c, u32::try_from(r.start + i).unwrap_or(u32::MAX));
+            buf.push(u32::from(c), u32::try_from(r.start + i).unwrap_or(u32::MAX));
         }
     } else {
         for (i, c) in run.iter().enumerate() {
-            buf.add(*c, u32::try_from(r.start + i).unwrap_or(u32::MAX));
+            buf.push(u32::from(*c), u32::try_from(r.start + i).unwrap_or(u32::MAX));
         }
     }
     buf.set_direction(if rtl { harfrust::Direction::RightToLeft } else { harfrust::Direction::LeftToRight });
     buf.guess_segment_properties();
-    let shaped = shaper.shape(buf, harfrust::ShapeOptions::new());
-    let k = 1000.0 / f64::from(shaper.units_per_em().max(1));
-    shaped
-        .glyph_infos()
+    // Without a plan, shaping fails only on an already shaped buffer or an unset direction.
+    if harfrust::shape(&shaper, &mut buf, harfrust::ShapeOptions::new()).is_err() {
+        return Vec::new();
+    }
+    let k = 1000.0 / f64::from(font.units_per_em().max(1));
+    buf.glyph_infos()
         .iter()
-        .zip(shaped.glyph_positions())
+        .zip(buf.glyph_positions())
         .map(|(gi, gp)| Glyph {
             gid: gi.glyph_id,
             cluster: usize::try_from(gi.cluster).unwrap_or(usize::MAX),
@@ -290,6 +295,32 @@ mod tests {
         assert!((crate::line_width("قیمت 25 تومان", 1.0, 1.0) - sh.width).abs() < 1e-9);
     }
 
+    #[test]
+    fn devanagari_run_is_reordered_with_line_clusters_and_advances_per_1000_em() {
+        use skrifa::MetadataProvider;
+        use skrifa::instance::{LocationRef, Size};
+        let Some(face) = ttf::fallback_for('\u{0915}') else { return };
+        let Some(ka) = nominal(&face, '\u{0915}') else { return };
+        // "कि" after two other characters of the line: the vowel sign i is drawn before the
+        // consonant (Indic reordering, which needs the script the shaper guesses from the text),
+        // both glyphs carry the cluster of the consonant's index in the line, not in the run.
+        let cs: Vec<char> = "ab\u{0915}\u{093F}".chars().collect();
+        let gs = shape_run(&face, &cs, 2..4, false);
+        let gids: Vec<u32> = gs.iter().map(|g| g.gid).collect();
+        assert_eq!(gids.len(), 2, "{gids:?}");
+        assert!(gids.first() != Some(&ka) && gids.last() == Some(&ka), "vowel sign before ka: {gids:?}");
+        assert!(gs.iter().all(|g| g.cluster == 2), "{:?}", gs.iter().map(|g| g.cluster).collect::<Vec<_>>());
+        // Advances come out at 1000 units per em, whatever the font's own em. A font that is
+        // already at 1000 per em could not tell a missing scale apart, so it checks nothing here.
+        let Some(font) = face.font() else { return };
+        if font.metrics(Size::unscaled(), LocationRef::default()).units_per_em == 1000 {
+            return;
+        }
+        let hmtx = font.glyph_metrics(Size::new(1000.0), LocationRef::default()).advance_width(skrifa::GlyphId::new(ka));
+        let adv = gs.last().map(|g| g.advance);
+        assert!(matches!((adv, hmtx), (Some(a), Some(h)) if (a - f64::from(h)).abs() < 1e-3), "{adv:?} vs {hmtx:?}");
+    }
+
     #[test]
     fn hostile_rtl_lines_never_panic() {
         for s in ["\u{202E}%%u\u{05D0}%%", "\u{2067}\u{0644}\u{0627}\u{2069}%%o", "\u{064E}\u{064E}\u{05D0}", "\u{05D0}\u{E000}\u{10FFFF}"] {
diff --git a/crates/fonts/src/mtext.rs b/crates/fonts/src/mtext.rs
index 916bdf33..0c6cb074 100644
--- a/crates/fonts/src/mtext.rs
+++ b/crates/fonts/src/mtext.rs
@@ -685,6 +685,7 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
 mod tests {
     use super::*;
 
+    /// Incremental character accounting preserves the text of a multi-word line without introducing wrapping.
     #[test]
     fn line_char_offsets_track_incrementally() {
         // A multi-word line lays out correctly even though the per-line character count is now
diff --git a/crates/fonts/src/ttf.rs b/crates/fonts/src/ttf.rs
index aedcbb07..52998900 100644
--- a/crates/fonts/src/ttf.rs
+++ b/crates/fonts/src/ttf.rs
@@ -624,6 +624,7 @@ struct GlyphCache {
     points: usize,
 }
 
+/// Return the process-wide outline cache whose retained glyph and point counts are bounded during insertion.
 fn glyph_cache() -> &'static RwLock<GlyphCache> {
     static C: OnceLock<RwLock<GlyphCache>> = OnceLock::new();
     C.get_or_init(|| RwLock::new(GlyphCache::default()))
@@ -643,6 +644,7 @@ struct Pen {
 const MAX_OUTLINE_POINTS: usize = 65_536;
 
 impl Pen {
+    /// Append one flattened outline point, discarding all contours if the per-glyph point limit is exceeded.
     fn push(&mut self, point: Vec2) {
         if self.truncated {
             return;
@@ -661,6 +663,7 @@ impl Pen {
     fn pt(x: f32, y: f32) -> Vec2 {
         Vec2::new(f64::from(x), f64::from(y))
     }
+    /// Close and retain a nondegenerate contour only if its closing point also fits the outline budget.
     fn flush(&mut self) {
         if self.cur.len() > 2 {
             if let (Some(f), Some(l)) = (self.cur.first().copied(), self.cur.last().copied())
@@ -678,13 +681,16 @@ impl Pen {
 }
 
 impl OutlinePen for Pen {
+    /// Finish the preceding contour and begin a new one through the budgeted point writer.
     fn move_to(&mut self, x: f32, y: f32) {
         self.flush();
         self.push(Self::pt(x, y));
     }
+    /// Append a line endpoint through the budgeted point writer.
     fn line_to(&mut self, x: f32, y: f32) {
         self.push(Self::pt(x, y));
     }
+    /// Flatten a quadratic segment into six samples, charging each retained point to the glyph budget.
     fn quad_to(&mut self, cx0: f32, cy0: f32, x: f32, y: f32) {
         let a = self.cur.last().copied().unwrap_or_default();
         let c = Self::pt(cx0, cy0);
@@ -695,6 +701,7 @@ impl OutlinePen for Pen {
             self.push(a * (u * u) + c * (2.0 * u * t) + b * (t * t));
         }
     }
+    /// Flatten a cubic segment into eight samples, charging each retained point to the glyph budget.
     fn curve_to(&mut self, cx0: f32, cy0: f32, cx1: f32, cy1: f32, x: f32, y: f32) {
         let a = self.cur.last().copied().unwrap_or_default();
         let c0 = Self::pt(cx0, cy0);
@@ -742,6 +749,8 @@ pub fn glyph_contours(face: &Face, gid: u16) -> Arc<[Vec<Vec2>]> {
     glyph_by_id(face, u32::from(gid)).contours.clone()
 }
 
+/// Load or build a glyph outline with bounded flattening, retaining its advance even when contours are discarded.
+/// Cache insertion clears existing entries when the glyph-count or aggregate point allowance would be exceeded.
 fn outline(face: &Face, k: GlyphKey) -> Arc<GlyphOutline> {
     let key = (face.bytes.as_ptr() as usize, face.bytes.len(), face.index, k);
     if let Some(g) = glyph_cache().read().unwrap_or_else(PoisonError::into_inner).glyphs.get(&key) {
@@ -812,6 +821,8 @@ pub(crate) fn text_glyph_at(g: &GlyphOutline, c: char, origin: Vec2, scale: f64,
     })
 }
 
+/// Charge source outline points before copying and transforming a glyph.
+/// Return `None` without spending fuel when it cannot fit; empty outlines remain valid at zero budget.
 pub(crate) fn place_glyph_budgeted(g: &GlyphOutline, x: f64, h: f64, wf: f64, shear: f64, points_left: &mut usize) -> Option<Vec<Vec<Vec2>>> {
     *points_left = points_left.checked_sub(g.points)?;
     Some(place_glyph(g, x, h, wf, shear))
@@ -926,6 +937,7 @@ mod family_tests {
 #[cfg(test)]
 mod geometry_budget_tests {
     use super::*;
+    /// Placement checks the source point cost before copying and accepts empty outlines without spending points.
     #[test]
     fn placement_checks_source_size_and_accepts_empty_glyphs() {
         let glyph = GlyphOutline { contours: vec![vec![Vec2::ZERO; 4]].into(), points: 4, cap: 1.0, ..Default::default() };
@@ -939,6 +951,7 @@ mod geometry_budget_tests {
         assert_eq!(budget, 0);
         assert!(place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut budget).is_none());
     }
+    /// Exceeding the per-glyph flattening limit discards all contour geometry before it reaches the cache.
     #[test]
     fn flattened_outlines_are_bounded_before_caching() {
         let mut pen = Pen::default();
@@ -951,6 +964,7 @@ mod geometry_budget_tests {
         assert!(pen.contours.is_empty() && pen.cur.is_empty());
         assert_eq!(pen.points, MAX_OUTLINE_POINTS);
     }
+    /// A mapped empty glyph retains text metadata referring to an existing empty outline slot.
     #[test]
     fn mapped_empty_glyph_keeps_text_and_a_valid_outline_slot() {
         // Metadata placement does not parse the face; an empty face suffices to check the index contract.
@@ -963,6 +977,7 @@ mod geometry_budget_tests {
         assert!(shaped.glyphs[shaped.text[0].outline].is_empty());
     }
 
+    /// An empty glyph with no text mapping leaves the shaped result empty.
     #[test]
     fn unmapped_empty_glyph_does_not_make_the_shape_nonempty() {
         let glyph = GlyphOutline { cap: 1.0, ..Default::default() };
@@ -973,6 +988,7 @@ mod geometry_budget_tests {
         assert!(shaped.text.is_empty());
     }
 
+    /// Missing text metadata does not discard a glyph that has drawable contours.
     #[test]
     fn an_unmapped_glyph_with_contours_still_draws() {
         let mut shaped = Shaped::default();
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 84adfec4..395ec496 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -19,10 +19,10 @@ cadcraft-fonts = { workspace = true }
 thiserror = { workspace = true }
 serde_json = { workspace = true }
 serde = { workspace = true }
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 quick-xml = { workspace = true }
 
 [dev-dependencies]
 # Reads CADCraft's DWG output as written (tests only; the same version as cadcraft-dwg's).
-acadrust = "0.6.4"
+acadrust = "0.6.5"
 tiny-skia = { workspace = true }
diff --git a/crates/io/src/dxf_image.rs b/crates/io/src/dxf_image.rs
index a4f57a5d..8f4685a2 100644
--- a/crates/io/src/dxf_image.rs
+++ b/crates/io/src/dxf_image.rs
@@ -156,6 +156,8 @@ pub(crate) fn resolve(secs: &[Section], d: &mut Drawing) {
     }
 }
 
+/// Resolve image definitions under a shared copied-string budget.
+/// When strings no longer fit, keep applying pixel-size and resolution metadata.
 fn fill(store: &mut EntityStore, by_image: &HashMap<Handle, &Def>, budget: &mut usize) {
     let hs: Vec<Handle> =
         store.iter().filter(|e| matches!(e.kind, EntityKind::Image(_)) && by_image.contains_key(&e.handle)).map(|e| e.handle).collect();
diff --git a/crates/io/src/dxf_read.rs b/crates/io/src/dxf_read.rs
index e8839dc5..bfd1ec0a 100644
--- a/crates/io/src/dxf_read.rs
+++ b/crates/io/src/dxf_read.rs
@@ -248,6 +248,7 @@ fn entity(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKind)> {
     entity_with_table_budget(kind, tags, &mut 4_000_000)
 }
 
+/// Parse one entity while charging materialized table cells to the caller's shared import budget.
 fn entity_with_table_budget(kind: &str, tags: &[Tag], table_cells_left: &mut usize) -> Option<(Common, EntityKind)> {
     // The paper-space viewport our writer adds (dxf_write::paper_view) stays implicit.
     if kind == "VIEWPORT" && crate::dxf_ext::is_paper_view(tags) {
@@ -1398,6 +1399,7 @@ fn style_font(tags: &[Tag], file: String) -> String {
     }
 }
 
+/// Load symbol tables and resolve handle references, indexing layer names for case-insensitive updates.
 fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
     let recs = records(tags);
     // STYLE handle → name, or the shape file of an unnamed shape style (linetype elements).
@@ -1681,6 +1683,7 @@ pub fn read(bytes: &[u8]) -> Result<Drawing> {
     read_budgeted(bytes, 4_000_000)
 }
 
+/// Import DXF sections while sharing one materialized-table-cell budget across blocks and entity sections.
 fn read_budgeted(bytes: &[u8], mut table_cells_left: usize) -> Result<Drawing> {
     let tags = cadcraft_dxf::parse(bytes).map_err(|e| IoError::Format(e.to_string()))?;
     let secs = sections(&tags);
@@ -2345,9 +2348,11 @@ pub fn entity_from_groups(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKin
 #[cfg(test)]
 mod table_budget_tests {
     use super::*;
+    /// Build synthetic table tags with a requested row and column count for allocation-budget checks.
     fn table_tags(rows: i64, cols: i64) -> Vec<Tag> {
         vec![Tag::s(100, "AcDbTable"), Tag::i(91, rows), Tag::i(92, cols), Tag::i(171, 1), Tag::s(1, "cell")]
     }
+    /// A table that cannot fit allocates no cell grid, while a smaller table spends only its cell count.
     #[test]
     fn exhausted_budget_rejects_before_materializing_cells() {
         let mut left = 3;
@@ -2358,6 +2363,7 @@ mod table_budget_tests {
         assert_eq!(table.cells[0].len(), 2);
         assert_eq!(left, 1);
     }
+    /// Tables in blocks and repeated entity sections consume one document-wide cell allowance.
     #[test]
     fn blocks_and_entity_sections_share_one_budget() {
         let table = "0\nACAD_TABLE\n100\nAcDbTable\n91\n1\n92\n2\n171\n1\n1\ncell\n";
diff --git a/crates/io/src/svg_read.rs b/crates/io/src/svg_read.rs
index 8e555216..4b2892c3 100644
--- a/crates/io/src/svg_read.rs
+++ b/crates/io/src/svg_read.rs
@@ -172,6 +172,7 @@ impl LeftOut {
 }
 
 impl Parser {
+    /// Initialize a metric SVG drawing with one document-wide generated-vertex allowance.
     fn new() -> Self {
         Parser {
             drawing: Drawing::new_metric(),
@@ -206,15 +207,15 @@ impl Parser {
             match reader.read_event().map_err(parse_err)? {
                 Event::Start(e) => {
                     let name = e.name();
-                    self.on_start(name.as_ref(), &e)?;
+                    self.on_start(name.into_inner().as_bytes(), &e)?;
                 }
                 Event::Empty(e) => {
                     let name = e.name();
-                    self.on_element(name.as_ref(), &e)?;
+                    self.on_element(name.into_inner().as_bytes(), &e)?;
                 }
                 Event::End(e) => {
                     let name = e.name();
-                    self.on_end(name.as_ref());
+                    self.on_end(name.into_inner().as_bytes());
                 }
                 Event::Eof => break,
                 _ => {}
@@ -334,6 +335,7 @@ impl Parser {
         self.cur().apply_vec(v)
     }
 
+    /// Charge an entity against element and retained-vertex limits before adding it to model space.
     fn add(&mut self, kind: EntityKind) -> Result<()> {
         self.elements += 1;
         if self.elements > MAX_ELEMENTS {
@@ -576,7 +578,7 @@ fn hidden(e: &BytesStart) -> bool {
 
 fn attr(e: &BytesStart, name: &[u8]) -> Option<String> {
     for a in e.attributes().flatten() {
-        if a.key.as_ref() == name {
+        if a.key.into_inner().as_bytes() == name {
             return a.normalized_value(XmlVersion::Explicit1_0).ok().map(|v| v.into_owned());
         }
     }
diff --git a/crates/io/tests/acad_interop.rs b/crates/io/tests/it/acad_interop.rs
similarity index 100%
rename from crates/io/tests/acad_interop.rs
rename to crates/io/tests/it/acad_interop.rs
diff --git a/crates/io/tests/acis_data_store.rs b/crates/io/tests/it/acis_data_store.rs
similarity index 99%
rename from crates/io/tests/acis_data_store.rs
rename to crates/io/tests/it/acis_data_store.rs
index 137b31f2..74b9809c 100644
--- a/crates/io/tests/acis_data_store.rs
+++ b/crates/io/tests/it/acis_data_store.rs
@@ -2,7 +2,6 @@
 //! don't carry it themselves: it lives in the file's data store section (ACDSDATA), one record per
 //! entity bound by a 320 handle. CADCraft doesn't model solids, so it keeps the section as read and
 //! writes it back (and the DWG bridge reads it), without the records of deleted entities.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::EntityKind;
 
diff --git a/crates/io/tests/angle_header.rs b/crates/io/tests/it/angle_header.rs
similarity index 100%
rename from crates/io/tests/angle_header.rs
rename to crates/io/tests/it/angle_header.rs
diff --git a/crates/io/tests/annotative_roundtrip.rs b/crates/io/tests/it/annotative_roundtrip.rs
similarity index 100%
rename from crates/io/tests/annotative_roundtrip.rs
rename to crates/io/tests/it/annotative_roundtrip.rs
diff --git a/crates/io/tests/assoc_array_roundtrip.rs b/crates/io/tests/it/assoc_array_roundtrip.rs
similarity index 100%
rename from crates/io/tests/assoc_array_roundtrip.rs
rename to crates/io/tests/it/assoc_array_roundtrip.rs
diff --git a/crates/io/tests/attrib_modes.rs b/crates/io/tests/it/attrib_modes.rs
similarity index 100%
rename from crates/io/tests/attrib_modes.rs
rename to crates/io/tests/it/attrib_modes.rs
diff --git a/crates/io/tests/attrib_props.rs b/crates/io/tests/it/attrib_props.rs
similarity index 100%
rename from crates/io/tests/attrib_props.rs
rename to crates/io/tests/it/attrib_props.rs
diff --git a/crates/io/tests/block_expansion.rs b/crates/io/tests/it/block_expansion.rs
similarity index 100%
rename from crates/io/tests/block_expansion.rs
rename to crates/io/tests/it/block_expansion.rs
diff --git a/crates/io/tests/closed_spline.rs b/crates/io/tests/it/closed_spline.rs
similarity index 100%
rename from crates/io/tests/closed_spline.rs
rename to crates/io/tests/it/closed_spline.rs
diff --git a/crates/io/tests/codepages.rs b/crates/io/tests/it/codepages.rs
similarity index 100%
rename from crates/io/tests/codepages.rs
rename to crates/io/tests/it/codepages.rs
diff --git a/crates/io/tests/dim_block_resave_roundtrip.rs b/crates/io/tests/it/dim_block_resave_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dim_block_resave_roundtrip.rs
rename to crates/io/tests/it/dim_block_resave_roundtrip.rs
diff --git a/crates/io/tests/dim_block_text.rs b/crates/io/tests/it/dim_block_text.rs
similarity index 100%
rename from crates/io/tests/dim_block_text.rs
rename to crates/io/tests/it/dim_block_text.rs
diff --git a/crates/io/tests/dim_marks_roundtrip.rs b/crates/io/tests/it/dim_marks_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dim_marks_roundtrip.rs
rename to crates/io/tests/it/dim_marks_roundtrip.rs
diff --git a/crates/io/tests/dimstyle_vars_roundtrip.rs b/crates/io/tests/it/dimstyle_vars_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dimstyle_vars_roundtrip.rs
rename to crates/io/tests/it/dimstyle_vars_roundtrip.rs
diff --git a/crates/io/tests/drafting_spacing.rs b/crates/io/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/io/tests/drafting_spacing.rs
rename to crates/io/tests/it/drafting_spacing.rs
diff --git a/crates/io/tests/dwg_header_vars.rs b/crates/io/tests/it/dwg_header_vars.rs
similarity index 98%
rename from crates/io/tests/dwg_header_vars.rs
rename to crates/io/tests/it/dwg_header_vars.rs
index 178a5d27..d1850278 100644
--- a/crates/io/tests/dwg_header_vars.rs
+++ b/crates/io/tests/it/dwg_header_vars.rs
@@ -1,7 +1,6 @@
 //! Unit, angle and drafting settings in the drawing header survive saving as DXF or DWG and
 //! reopening. The DWG bridge converts with acadrust, whose DXF writer leaves some header
 //! variables out; the snap grid's origin and rotation live in the `*ACTIVE` VPORT record.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::{Drawing, HVal};
 use cadcraft_geom::Vec3;
diff --git a/crates/io/tests/dwg_layout_owner.rs b/crates/io/tests/it/dwg_layout_owner.rs
similarity index 100%
rename from crates/io/tests/dwg_layout_owner.rs
rename to crates/io/tests/it/dwg_layout_owner.rs
diff --git a/crates/io/tests/dwg_roundtrip_losses.rs b/crates/io/tests/it/dwg_roundtrip_losses.rs
similarity index 99%
rename from crates/io/tests/dwg_roundtrip_losses.rs
rename to crates/io/tests/it/dwg_roundtrip_losses.rs
index 813ae659..c0852eff 100644
--- a/crates/io/tests/dwg_roundtrip_losses.rs
+++ b/crates/io/tests/it/dwg_roundtrip_losses.rs
@@ -1,6 +1,5 @@
 //! Data that used to be lost only when a drawing is saved as DWG and reopened (the DWG bridge
 //! converts our DXF with acadrust), and the paper-space viewport the DXF writer adds for it.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_color::{Color, Rgb};
 use cadcraft_doc::*;
diff --git a/crates/io/tests/dwt_template.rs b/crates/io/tests/it/dwt_template.rs
similarity index 100%
rename from crates/io/tests/dwt_template.rs
rename to crates/io/tests/it/dwt_template.rs
diff --git a/crates/io/tests/dxf_versions.rs b/crates/io/tests/it/dxf_versions.rs
similarity index 100%
rename from crates/io/tests/dxf_versions.rs
rename to crates/io/tests/it/dxf_versions.rs
diff --git a/crates/io/tests/dynblock_read.rs b/crates/io/tests/it/dynblock_read.rs
similarity index 99%
rename from crates/io/tests/dynblock_read.rs
rename to crates/io/tests/it/dynblock_read.rs
index 3d7569d3..d265f9e7 100644
--- a/crates/io/tests/dynblock_read.rs
+++ b/crates/io/tests/it/dynblock_read.rs
@@ -22,7 +22,7 @@ fn dxf(src: &str) -> String {
 /// The DOOR drawing as `code value` lines (shared with the engine's dynamic grip tests), with
 /// LF line ends whatever a checkout gave the file.
 fn fixture() -> String {
-    include_str!("data/dynblock_door.txt").replace("\r\n", "\n")
+    include_str!("../data/dynblock_door.txt").replace("\r\n", "\n")
 }
 
 fn h(hex: &str) -> Handle {
diff --git a/crates/io/tests/entity_props_roundtrip.rs b/crates/io/tests/it/entity_props_roundtrip.rs
similarity index 100%
rename from crates/io/tests/entity_props_roundtrip.rs
rename to crates/io/tests/it/entity_props_roundtrip.rs
diff --git a/crates/io/tests/followups_626.rs b/crates/io/tests/it/followups_626.rs
similarity index 100%
rename from crates/io/tests/followups_626.rs
rename to crates/io/tests/it/followups_626.rs
diff --git a/crates/io/tests/groups_roundtrip.rs b/crates/io/tests/it/groups_roundtrip.rs
similarity index 100%
rename from crates/io/tests/groups_roundtrip.rs
rename to crates/io/tests/it/groups_roundtrip.rs
diff --git a/crates/io/tests/hatch_assoc_roundtrip.rs b/crates/io/tests/it/hatch_assoc_roundtrip.rs
similarity index 100%
rename from crates/io/tests/hatch_assoc_roundtrip.rs
rename to crates/io/tests/it/hatch_assoc_roundtrip.rs
diff --git a/crates/io/tests/hatch_pattern_def.rs b/crates/io/tests/it/hatch_pattern_def.rs
similarity index 100%
rename from crates/io/tests/hatch_pattern_def.rs
rename to crates/io/tests/it/hatch_pattern_def.rs
diff --git a/crates/io/tests/helix_roundtrip.rs b/crates/io/tests/it/helix_roundtrip.rs
similarity index 100%
rename from crates/io/tests/helix_roundtrip.rs
rename to crates/io/tests/it/helix_roundtrip.rs
diff --git a/crates/io/tests/layout_paper_units.rs b/crates/io/tests/it/layout_paper_units.rs
similarity index 100%
rename from crates/io/tests/layout_paper_units.rs
rename to crates/io/tests/it/layout_paper_units.rs
diff --git a/crates/io/tests/layout_plot_window.rs b/crates/io/tests/it/layout_plot_window.rs
similarity index 100%
rename from crates/io/tests/layout_plot_window.rs
rename to crates/io/tests/it/layout_plot_window.rs
diff --git a/crates/io/tests/low_handseed.rs b/crates/io/tests/it/low_handseed.rs
similarity index 98%
rename from crates/io/tests/low_handseed.rs
rename to crates/io/tests/it/low_handseed.rs
index 6b7a9e09..fbc1a77b 100644
--- a/crates/io/tests/low_handseed.rs
+++ b/crates/io/tests/it/low_handseed.rs
@@ -1,7 +1,6 @@
 //! Another program's file can name a $HANDSEED below handles it uses. Entities CADCraft makes
 //! while reading (the faces a polyface mesh becomes) must not take handles that records further
 //! on still have: a DWG keeps one object per handle, so the duplicates were lost on save.
-#![cfg(not(target_arch = "wasm32"))]
 
 use std::collections::HashSet;
 
diff --git a/crates/io/tests/it/main.rs b/crates/io/tests/it/main.rs
new file mode 100644
index 00000000..1b1462ae
--- /dev/null
+++ b/crates/io/tests/it/main.rs
@@ -0,0 +1,67 @@
+mod acad_interop;
+#[cfg(not(target_arch = "wasm32"))]
+mod acis_data_store;
+mod angle_header;
+mod annotative_roundtrip;
+mod assoc_array_roundtrip;
+mod attrib_modes;
+mod attrib_props;
+mod block_expansion;
+mod closed_spline;
+mod codepages;
+mod dim_block_resave_roundtrip;
+mod dim_block_text;
+mod dim_marks_roundtrip;
+mod dimstyle_vars_roundtrip;
+mod drafting_spacing;
+#[cfg(not(target_arch = "wasm32"))]
+mod dwg_header_vars;
+mod dwg_layout_owner;
+#[cfg(not(target_arch = "wasm32"))]
+mod dwg_roundtrip_losses;
+mod dwt_template;
+mod dxf_versions;
+mod dynblock_read;
+mod entity_props_roundtrip;
+mod followups_626;
+mod groups_roundtrip;
+mod hatch_assoc_roundtrip;
+mod hatch_pattern_def;
+mod helix_roundtrip;
+mod layout_paper_units;
+mod layout_plot_window;
+#[cfg(not(target_arch = "wasm32"))]
+mod low_handseed;
+mod mleader_content;
+mod mleader_roundtrip;
+mod mline_roundtrip;
+#[cfg(not(target_arch = "wasm32"))]
+mod model_layout_plot_type;
+mod mtext_columns_roundtrip;
+mod mtext_embedded_object;
+mod mtext_line_spacing;
+mod multiline_attributes;
+mod paperview_marker;
+mod passthrough_image_roundtrip;
+mod pdf_followups;
+mod pdf_layers;
+mod plot_layout_scale;
+mod plot_model_png_scale;
+mod plot_styles;
+mod region_roundtrip;
+mod roundtrip_audit;
+mod skipped_records;
+mod sortents;
+mod spline_fit_data;
+mod split_entities_section;
+mod style_typeface;
+mod svg_arc_budget;
+mod svg_tiny_extents;
+mod table_cellstyle_roundtrip;
+mod tables_objects_roundtrip;
+mod text_left_justify;
+mod tolerance_roundtrip;
+mod user_lin_pat_roundtrip;
+mod view_tables_roundtrip;
+mod viewport_clip_roundtrip;
+mod xref_roundtrip;
diff --git a/crates/io/tests/mleader_content.rs b/crates/io/tests/it/mleader_content.rs
similarity index 100%
rename from crates/io/tests/mleader_content.rs
rename to crates/io/tests/it/mleader_content.rs
diff --git a/crates/io/tests/mleader_roundtrip.rs b/crates/io/tests/it/mleader_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mleader_roundtrip.rs
rename to crates/io/tests/it/mleader_roundtrip.rs
diff --git a/crates/io/tests/mline_roundtrip.rs b/crates/io/tests/it/mline_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mline_roundtrip.rs
rename to crates/io/tests/it/mline_roundtrip.rs
diff --git a/crates/io/tests/model_layout_plot_type.rs b/crates/io/tests/it/model_layout_plot_type.rs
similarity index 98%
rename from crates/io/tests/model_layout_plot_type.rs
rename to crates/io/tests/it/model_layout_plot_type.rs
index 3de6380e..55c6d62a 100644
--- a/crates/io/tests/model_layout_plot_type.rs
+++ b/crates/io/tests/it/model_layout_plot_type.rs
@@ -2,7 +2,6 @@
 //! fitted to the paper. Plot type 5 ("Layout information", DXF Reference, PLOTSETTINGS group 74)
 //! means nothing for model space; another program's Plot dialog then showed no plot area and no
 //! scale for Model.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::*;
 use cadcraft_geom::Vec3;
diff --git a/crates/io/tests/mtext_columns_roundtrip.rs b/crates/io/tests/it/mtext_columns_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mtext_columns_roundtrip.rs
rename to crates/io/tests/it/mtext_columns_roundtrip.rs
diff --git a/crates/io/tests/mtext_embedded_object.rs b/crates/io/tests/it/mtext_embedded_object.rs
similarity index 100%
rename from crates/io/tests/mtext_embedded_object.rs
rename to crates/io/tests/it/mtext_embedded_object.rs
diff --git a/crates/io/tests/mtext_line_spacing.rs b/crates/io/tests/it/mtext_line_spacing.rs
similarity index 100%
rename from crates/io/tests/mtext_line_spacing.rs
rename to crates/io/tests/it/mtext_line_spacing.rs
diff --git a/crates/io/tests/multiline_attributes.rs b/crates/io/tests/it/multiline_attributes.rs
similarity index 100%
rename from crates/io/tests/multiline_attributes.rs
rename to crates/io/tests/it/multiline_attributes.rs
diff --git a/crates/io/tests/paperview_marker.rs b/crates/io/tests/it/paperview_marker.rs
similarity index 100%
rename from crates/io/tests/paperview_marker.rs
rename to crates/io/tests/it/paperview_marker.rs
diff --git a/crates/io/tests/passthrough_image_roundtrip.rs b/crates/io/tests/it/passthrough_image_roundtrip.rs
similarity index 100%
rename from crates/io/tests/passthrough_image_roundtrip.rs
rename to crates/io/tests/it/passthrough_image_roundtrip.rs
diff --git a/crates/io/tests/pdf_followups.rs b/crates/io/tests/it/pdf_followups.rs
similarity index 100%
rename from crates/io/tests/pdf_followups.rs
rename to crates/io/tests/it/pdf_followups.rs
diff --git a/crates/io/tests/pdf_layers.rs b/crates/io/tests/it/pdf_layers.rs
similarity index 100%
rename from crates/io/tests/pdf_layers.rs
rename to crates/io/tests/it/pdf_layers.rs
diff --git a/crates/io/tests/plot_layout_scale.rs b/crates/io/tests/it/plot_layout_scale.rs
similarity index 100%
rename from crates/io/tests/plot_layout_scale.rs
rename to crates/io/tests/it/plot_layout_scale.rs
diff --git a/crates/io/tests/plot_model_png_scale.rs b/crates/io/tests/it/plot_model_png_scale.rs
similarity index 100%
rename from crates/io/tests/plot_model_png_scale.rs
rename to crates/io/tests/it/plot_model_png_scale.rs
diff --git a/crates/io/tests/plot_styles.rs b/crates/io/tests/it/plot_styles.rs
similarity index 100%
rename from crates/io/tests/plot_styles.rs
rename to crates/io/tests/it/plot_styles.rs
diff --git a/crates/io/tests/region_roundtrip.rs b/crates/io/tests/it/region_roundtrip.rs
similarity index 100%
rename from crates/io/tests/region_roundtrip.rs
rename to crates/io/tests/it/region_roundtrip.rs
diff --git a/crates/io/tests/roundtrip_audit.rs b/crates/io/tests/it/roundtrip_audit.rs
similarity index 100%
rename from crates/io/tests/roundtrip_audit.rs
rename to crates/io/tests/it/roundtrip_audit.rs
diff --git a/crates/io/tests/skipped_records.rs b/crates/io/tests/it/skipped_records.rs
similarity index 100%
rename from crates/io/tests/skipped_records.rs
rename to crates/io/tests/it/skipped_records.rs
diff --git a/crates/io/tests/sortents.rs b/crates/io/tests/it/sortents.rs
similarity index 100%
rename from crates/io/tests/sortents.rs
rename to crates/io/tests/it/sortents.rs
diff --git a/crates/io/tests/spline_fit_data.rs b/crates/io/tests/it/spline_fit_data.rs
similarity index 100%
rename from crates/io/tests/spline_fit_data.rs
rename to crates/io/tests/it/spline_fit_data.rs
diff --git a/crates/io/tests/split_entities_section.rs b/crates/io/tests/it/split_entities_section.rs
similarity index 100%
rename from crates/io/tests/split_entities_section.rs
rename to crates/io/tests/it/split_entities_section.rs
diff --git a/crates/io/tests/style_typeface.rs b/crates/io/tests/it/style_typeface.rs
similarity index 100%
rename from crates/io/tests/style_typeface.rs
rename to crates/io/tests/it/style_typeface.rs
diff --git a/crates/io/tests/svg_arc_budget.rs b/crates/io/tests/it/svg_arc_budget.rs
similarity index 88%
rename from crates/io/tests/svg_arc_budget.rs
rename to crates/io/tests/it/svg_arc_budget.rs
index b3b096e3..dbcc9715 100644
--- a/crates/io/tests/svg_arc_budget.rs
+++ b/crates/io/tests/it/svg_arc_budget.rs
@@ -17,6 +17,7 @@ fn arc_bomb(arcs: usize) -> Vec<u8> {
     svg.into_bytes()
 }
 
+/// A small transformed-arc input remains accepted within the generated-geometry budget.
 #[test]
 fn a_modest_arc_svg_still_reads() {
     // A handful of arcs is well within budget and parses fine.
@@ -24,6 +25,7 @@ fn a_modest_arc_svg_still_reads() {
     assert!(d.model.iter().count() >= 1, "expected some geometry");
 }
 
+/// Repeated flattened arcs fail with a geometry-budget error before retaining excessive vertices.
 #[test]
 fn an_arc_heavy_svg_is_rejected_by_the_vertex_budget() {
     // ~1000 arcs x up to 10_000 chords each would far exceed the 8M vertex budget.
diff --git a/crates/io/tests/svg_tiny_extents.rs b/crates/io/tests/it/svg_tiny_extents.rs
similarity index 100%
rename from crates/io/tests/svg_tiny_extents.rs
rename to crates/io/tests/it/svg_tiny_extents.rs
diff --git a/crates/io/tests/table_cellstyle_roundtrip.rs b/crates/io/tests/it/table_cellstyle_roundtrip.rs
similarity index 100%
rename from crates/io/tests/table_cellstyle_roundtrip.rs
rename to crates/io/tests/it/table_cellstyle_roundtrip.rs
diff --git a/crates/io/tests/tables_objects_roundtrip.rs b/crates/io/tests/it/tables_objects_roundtrip.rs
similarity index 100%
rename from crates/io/tests/tables_objects_roundtrip.rs
rename to crates/io/tests/it/tables_objects_roundtrip.rs
diff --git a/crates/io/tests/text_left_justify.rs b/crates/io/tests/it/text_left_justify.rs
similarity index 100%
rename from crates/io/tests/text_left_justify.rs
rename to crates/io/tests/it/text_left_justify.rs
diff --git a/crates/io/tests/tolerance_roundtrip.rs b/crates/io/tests/it/tolerance_roundtrip.rs
similarity index 100%
rename from crates/io/tests/tolerance_roundtrip.rs
rename to crates/io/tests/it/tolerance_roundtrip.rs
diff --git a/crates/io/tests/user_lin_pat_roundtrip.rs b/crates/io/tests/it/user_lin_pat_roundtrip.rs
similarity index 100%
rename from crates/io/tests/user_lin_pat_roundtrip.rs
rename to crates/io/tests/it/user_lin_pat_roundtrip.rs
diff --git a/crates/io/tests/view_tables_roundtrip.rs b/crates/io/tests/it/view_tables_roundtrip.rs
similarity index 100%
rename from crates/io/tests/view_tables_roundtrip.rs
rename to crates/io/tests/it/view_tables_roundtrip.rs
diff --git a/crates/io/tests/viewport_clip_roundtrip.rs b/crates/io/tests/it/viewport_clip_roundtrip.rs
similarity index 100%
rename from crates/io/tests/viewport_clip_roundtrip.rs
rename to crates/io/tests/it/viewport_clip_roundtrip.rs
diff --git a/crates/io/tests/xref_roundtrip.rs b/crates/io/tests/it/xref_roundtrip.rs
similarity index 100%
rename from crates/io/tests/xref_roundtrip.rs
rename to crates/io/tests/it/xref_roundtrip.rs
diff --git a/crates/mcp/Cargo.toml b/crates/mcp/Cargo.toml
index c4452955..955a6b6d 100644
--- a/crates/mcp/Cargo.toml
+++ b/crates/mcp/Cargo.toml
@@ -15,4 +15,4 @@ cadcraft-io = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 # Secure randomness for the per-session control token (MIT OR Apache-2.0).
-getrandom = "0.3"
+getrandom = "0.4"
diff --git a/crates/mcp/src/backend.rs b/crates/mcp/src/backend.rs
index c758bac9..69383933 100644
--- a/crates/mcp/src/backend.rs
+++ b/crates/mcp/src/backend.rs
@@ -10,9 +10,11 @@ use serde_json::{Value, json};
 /// Something that answers control-channel methods (`engine.execute`, `cmdline.input`,
 /// `drawing.inspect`, `ui.render`…). See `cadcraft_ui_egui::control` for the full list.
 pub trait Backend {
+    /// Invoke a control method and return its result or a descriptive error.
     fn call(&mut self, method: &str, params: Value) -> Result<Value, String>;
     /// True when a real UI is attached (`ui.screenshot` works).
     fn has_ui(&self) -> bool;
+    /// Describe the backend connection for client-facing status.
     fn describe(&self) -> String;
 }
 
@@ -37,6 +39,7 @@ fn port_of(addr: &str) -> Option<u16> {
 const LAUNCH_WAIT: Duration = Duration::from_secs(30);
 
 impl Remote {
+    /// Connect to a running control server; its session token is read lazily when the first request is sent.
     pub fn connect(addr: &str) -> std::io::Result<Self> {
         let mut r = Self { addr: addr.to_string(), conn: None, next_id: 1, launch: false, token: None };
         r.reconnect()?;
@@ -182,6 +185,8 @@ fn is_read_only(method: &str) -> bool {
 }
 
 impl Backend for Remote {
+    /// Send a control request with the token when available, refreshing it before a safe retry.
+    /// A mutation that may have reached the server is never resent automatically.
     fn call(&mut self, method: &str, params: Value) -> Result<Value, String> {
         let id = self.next_id;
         self.next_id += 1;
@@ -447,6 +452,7 @@ mod tests {
             server.join().unwrap();
         }
     }
+    /// Retrying a read after a lost reply reloads the replacement server session token.
     #[test]
     fn safe_retry_rereads_a_rotated_token_after_a_lost_reply() {
         let listener = TcpListener::bind("127.0.0.1:0").unwrap();
@@ -473,6 +479,7 @@ mod tests {
         assert_eq!(remote.call("ping", json!({})).unwrap(), json!("pong"));
         server.join().unwrap();
     }
+    /// A failed mutation write reports uncertain delivery and does not open a retry connection.
     #[test]
     fn failed_mutation_write_is_not_resent() {
         let listener = TcpListener::bind("127.0.0.1:0").unwrap();
diff --git a/crates/mcp/src/control_token.rs b/crates/mcp/src/control_token.rs
index 84677ae4..084f8b45 100644
--- a/crates/mcp/src/control_token.rs
+++ b/crates/mcp/src/control_token.rs
@@ -23,6 +23,7 @@ pub fn token_path(port: u16) -> io::Result<PathBuf> {
     Ok(private_dir()?.join(format!("cadcraft-control-{port}.token")))
 }
 
+/// Choose the Unix runtime directory, home cache, or temporary directory for an owner-only token file.
 #[cfg(unix)]
 fn private_dir() -> io::Result<PathBuf> {
     if let Some(d) = std::env::var_os("XDG_RUNTIME_DIR").filter(|v| !v.is_empty()) {
@@ -34,11 +35,13 @@ fn private_dir() -> io::Result<PathBuf> {
     Ok(std::env::temp_dir())
 }
 
+/// Require the Windows per-user local app-data directory for session token storage.
 #[cfg(windows)]
 fn private_dir() -> io::Result<PathBuf> {
     windows_private_dir(std::env::var_os("LOCALAPPDATA"))
 }
 
+/// Validate that Windows supplied a nonempty local app-data path instead of using a shared fallback.
 #[cfg(any(windows, test))]
 fn windows_private_dir(local: Option<std::ffi::OsString>) -> io::Result<PathBuf> {
     local
@@ -47,6 +50,7 @@ fn windows_private_dir(local: Option<std::ffi::OsString>) -> io::Result<PathBuf>
         .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "LOCALAPPDATA is required for a private control token"))
 }
 
+/// Reject token storage on platforms without a supported private-directory convention.
 #[cfg(not(any(unix, windows)))]
 fn private_dir() -> io::Result<PathBuf> {
     Err(io::Error::new(io::ErrorKind::Unsupported, "no private control token directory on this platform"))
@@ -61,6 +65,7 @@ pub fn issue(port: u16) -> io::Result<String> {
     Ok(token)
 }
 
+/// Create missing parent directories, then write the session token through the platform privacy helper.
 fn issue_at(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)?;
@@ -98,6 +103,7 @@ pub fn matches(expected: &str, given: &str) -> bool {
     diff == 0
 }
 
+/// Encode 256 bits of operating-system randomness as lowercase hexadecimal, propagating entropy failures.
 fn random_hex() -> io::Result<String> {
     let mut bytes = [0u8; TOKEN_BYTES];
     getrandom::fill(&mut bytes).map_err(|e| io::Error::other(format!("no secure randomness: {e}")))?;
@@ -109,6 +115,7 @@ fn random_hex() -> io::Result<String> {
     Ok(s)
 }
 
+/// Replace a stale token with an exclusively created file using Unix mode `0600`, then flush its bytes.
 #[cfg(unix)]
 fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
     use std::io::Write;
@@ -120,6 +127,7 @@ fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
     f.flush()
 }
 
+/// Exclusively create and flush a replacement token within the per-user directory selected by the caller.
 #[cfg(not(unix))]
 fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
     use std::io::Write;
@@ -134,6 +142,7 @@ fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
 mod tests {
     use super::*;
 
+    /// An issued token has the expected size, can be read back, and disappears after revocation.
     #[test]
     fn issue_then_read_round_trips() {
         let port = 50000 + (std::process::id() % 10000) as u16;
@@ -144,6 +153,7 @@ mod tests {
         assert!(read(port).is_err());
     }
 
+    /// Token comparison rejects different bytes and lengths while accepting identical tokens.
     #[test]
     fn matches_is_exact() {
         assert!(matches("abc", "abc"));
@@ -152,6 +162,7 @@ mod tests {
         assert!(!matches("", "x"));
     }
 
+    /// A token issued on Unix grants no file permission bits to group or other users.
     #[cfg(unix)]
     #[test]
     fn token_file_is_owner_only() {
@@ -162,6 +173,7 @@ mod tests {
         assert_eq!(mode & 0o077, 0, "token file is readable by group/other: {:o}", mode);
         revoke(port);
     }
+    /// Windows token storage rejects absent or empty app-data paths and preserves a supplied path.
     #[test]
     fn windows_requires_local_app_data() {
         assert!(windows_private_dir(None).is_err());
@@ -169,6 +181,7 @@ mod tests {
         assert_eq!(windows_private_dir(Some("private-app-data".into())).unwrap(), PathBuf::from("private-app-data"));
     }
 
+    /// Token issuance creates its missing directory hierarchy before writing the credential.
     #[test]
     fn issuance_creates_missing_parent() {
         let dir = std::env::temp_dir().join(format!("cadcraft-token-parent-{}", std::process::id()));
diff --git a/crates/mcp/tests/cmdline_key.rs b/crates/mcp/tests/it/cmdline_key.rs
similarity index 94%
rename from crates/mcp/tests/cmdline_key.rs
rename to crates/mcp/tests/it/cmdline_key.rs
index 77486e66..0f074beb 100644
--- a/crates/mcp/tests/cmdline_key.rs
+++ b/crates/mcp/tests/it/cmdline_key.rs
@@ -1,5 +1,5 @@
 //! The headless backend answers `cmdline.key` like `cmdline.input` and like the app's control
-//! channel (`crates/ui-egui/tests/control_cmdline_key.rs`): a refused Enter is echoed and reported
+//! channel (`crates/ui-egui/tests/it/control_cmdline_key.rs`): a refused Enter is echoed and reported
 //! in `error`, and the call itself succeeds.
 
 use cadcraft_mcp::{Backend, Headless};
diff --git a/crates/mcp/tests/cmdline_parity.rs b/crates/mcp/tests/it/cmdline_parity.rs
similarity index 97%
rename from crates/mcp/tests/cmdline_parity.rs
rename to crates/mcp/tests/it/cmdline_parity.rs
index deaaa29f..27209b57 100644
--- a/crates/mcp/tests/cmdline_parity.rs
+++ b/crates/mcp/tests/it/cmdline_parity.rs
@@ -1,5 +1,5 @@
 //! The headless backend answers `cmdline.input` and `app.open` with the same reply shape as the
-//! app's control channel (`cadcraft_ui_egui::control`, tested in `crates/ui-egui/tests/control_cmdline.rs`).
+//! app's control channel (`cadcraft_ui_egui::control`, tested in `crates/ui-egui/tests/it/control_cmdline.rs`).
 
 use cadcraft_mcp::{Backend, Headless};
 use serde_json::{Value, json};
diff --git a/crates/mcp/tests/control_methods.rs b/crates/mcp/tests/it/control_methods.rs
similarity index 94%
rename from crates/mcp/tests/control_methods.rs
rename to crates/mcp/tests/it/control_methods.rs
index da2727f1..f2f1ce03 100644
--- a/crates/mcp/tests/control_methods.rs
+++ b/crates/mcp/tests/it/control_methods.rs
@@ -1,5 +1,5 @@
 //! The headless backend's `control.methods` lists the methods it answers, all of them documented
-//! in `docs/control-protocol.md` (the app's list is tested in `crates/ui-egui/tests/control_methods.rs`).
+//! in `docs/control-protocol.md` (the app's list is tested in `crates/ui-egui/tests/it/control_methods.rs`).
 
 use std::collections::BTreeSet;
 
@@ -7,7 +7,7 @@ use cadcraft_mcp::{Backend, Headless};
 use serde_json::json;
 
 fn documented() -> BTreeSet<String> {
-    let doc = include_str!("../../../docs/control-protocol.md");
+    let doc = include_str!("../../../../docs/control-protocol.md");
     let table = doc.lines().skip_while(|l| !l.starts_with("| Method |")).skip(2).take_while(|l| l.starts_with('|'));
     table.filter_map(|l| l.split('|').nth(1)).flat_map(|cell| cell.split('`').skip(1).step_by(2).map(str::to_string).collect::<Vec<_>>()).collect()
 }
diff --git a/crates/mcp/tests/it/main.rs b/crates/mcp/tests/it/main.rs
new file mode 100644
index 00000000..85072574
--- /dev/null
+++ b/crates/mcp/tests/it/main.rs
@@ -0,0 +1,3 @@
+mod cmdline_key;
+mod cmdline_parity;
+mod control_methods;
diff --git a/crates/render/src/dim.rs b/crates/render/src/dim.rs
index e79b7b4e..3a14aabc 100644
--- a/crates/render/src/dim.rs
+++ b/crates/render/src/dim.rs
@@ -413,6 +413,7 @@ fn tol_height_code(st: &DimStyle) -> String {
     format!("{}x", format_decimal(f / 0.7, 4, 8, "."))
 }
 
+/// Apply measurement placeholders or append a dimension suffix, bounding the resulting UTF-8 text.
 fn post(template: &str, meas: &str) -> String {
     if template.contains("<>") {
         bounded_replace(template, meas)
@@ -424,6 +425,7 @@ fn post(template: &str, meas: &str) -> String {
     }
 }
 
+/// Apply dimension text overrides: empty uses the base, whitespace suppresses text, and other text substitutes it.
 fn apply_override(base: &str, d: &Dimension) -> String {
     if d.text.is_empty() {
         base.to_string()
@@ -455,6 +457,8 @@ fn bounded_replace(template: &str, value: &str) -> String {
 }
 
 // Returns false when truncation consumed the remaining UTF-8-safe space.
+/// Append within the remaining dimension-text byte allowance without splitting a UTF-8 character.
+/// Return false if any input text had to be truncated.
 fn append_dim_text(out: &mut String, text: &str) -> bool {
     let mut end = text.len().min(MAX_DIM_TEXT.saturating_sub(out.len()));
     while !text.is_char_boundary(end) {
@@ -1363,12 +1367,14 @@ mod tests {
 #[cfg(test)]
 mod text_budget_tests {
     use super::*;
+    /// A dimension suffix without placeholders still obeys the total text limit.
     #[test]
     fn bounds_post_without_markers() {
         let text = post(&"x".repeat(MAX_DIM_TEXT * 2), "12");
         assert_eq!(text.len(), MAX_DIM_TEXT);
         assert!(text.starts_with("12x"));
     }
+    /// Oversized substituted text retains its prefix and ends at a valid UTF-8 boundary.
     #[test]
     fn oversized_value_is_substituted_and_truncated_at_a_character_boundary() {
         let text = bounded_replace("prefix <> mm", &"é".repeat(MAX_DIM_TEXT));
diff --git a/crates/render/src/hatch.rs b/crates/render/src/hatch.rs
index b297618a..dd83a71a 100644
--- a/crates/render/src/hatch.rs
+++ b/crates/render/src/hatch.rs
@@ -79,6 +79,8 @@ fn same_polygon(a: &[Vec2], b: &[Vec2]) -> bool {
     (0..n).any(|k| (0..n).all(|i| near(a[i], b[(i + k) % n]))) || (0..n).any(|k| (0..n).all(|i| near(a[i], b[(k + n - (i % n)) % n])))
 }
 
+/// Remove degenerate and duplicate boundary loops within a shared comparison budget.
+/// Retain remaining loops without further comparisons once the budget is exhausted.
 fn dedup_polygons(loops: &mut Vec<Vec<Vec2>>) {
     // `same_polygon` is O(n²) in a polygon's vertex count (every cyclic alignment, both windings),
     // and each loop is compared against every unique one kept so far, so adversarial boundary
@@ -463,6 +465,7 @@ impl Family<'_> {
         self.origin + p.rotate(self.ang)
     }
 
+    /// Intersect a pattern family with boundary loops, respecting view, output, cancellation, and shared dash-work limits.
     fn sweep(&self, loops: &[Vec<Vec2>], px: f64, view: Option<&Bounds2>, cancel: Option<&AtomicBool>, out: &mut Vec<Vec<Vec2>>, work: &mut u64) {
         let local: Vec<Vec<Vec2>> = loops.iter().map(|l| l.iter().map(|p| self.to_local(*p)).collect()).collect();
         let bb = Bounds2::from_points(local.iter().flatten().copied());
@@ -606,6 +609,7 @@ mod tests {
 #[cfg(test)]
 mod dedup_budget_tests {
     use super::*;
+    /// Loops with different vertex counts leave enough comparison fuel to remove a later duplicate.
     #[test]
     fn unequal_loops_do_not_spend_the_comparison_budget() {
         // The old estimate exhausted the budget on this unequal pair before seeing the triangle.
diff --git a/crates/render/src/linetype.rs b/crates/render/src/linetype.rs
index 8a8cab34..1385a4d3 100644
--- a/crates/render/src/linetype.rs
+++ b/crates/render/src/linetype.rs
@@ -118,6 +118,7 @@ pub fn ranges(len: f64, lt: &Linetype, scale: f64, min_pattern: f64) -> Option<V
 mod tests {
     use super::*;
 
+    /// This gap-only pattern draws nothing, and `ranges` returns before cycling through its repeats.
     #[test]
     fn an_all_gap_pattern_draws_nothing_without_spinning() {
         let lt = Linetype::simple("GAPS", "", &[-0.001, -0.002]);
diff --git a/crates/render/src/table.rs b/crates/render/src/table.rs
index 638a848a..5a571fef 100644
--- a/crates/render/src/table.rs
+++ b/crates/render/src/table.rs
@@ -57,6 +57,8 @@ pub fn table_covered(t: &Table) -> Vec<Vec<bool>> {
 }
 
 // No partial coverage may reach owner assignment: it would revisit unbounded merge rectangles.
+/// Mark cells covered by merges under grid-size and marking-work limits.
+/// Return partial coverage as an error so layout can use its outline fallback instead of assigning owners.
 fn coverage(t: &Table) -> Result<Vec<Vec<bool>>, Vec<Vec<bool>>> {
     let rows = t.row_heights.len().min(10_000);
     let cols = t.col_widths.len().min(10_000);
@@ -395,6 +397,7 @@ mod budget_tests {
     use super::*;
     use cadcraft_doc::TableCell;
 
+    /// Excessive overlapping merges draw only the table outline after coverage work is exhausted.
     #[test]
     fn overlapping_merges_use_outline_fallback() {
         let t = Table {
@@ -409,6 +412,7 @@ mod budget_tests {
         assert!(g.fills.is_empty() && g.texts.is_empty());
     }
 
+    /// A split table within the displayed-cell budget clips a merge to contiguous selected rows.
     #[test]
     fn part_clips_merges_using_displayed_column_count() {
         let t = Table {
diff --git a/crates/render/tests/aci7_display.rs b/crates/render/tests/it/aci7_display.rs
similarity index 100%
rename from crates/render/tests/aci7_display.rs
rename to crates/render/tests/it/aci7_display.rs
diff --git a/crates/render/tests/annotative_viewport.rs b/crates/render/tests/it/annotative_viewport.rs
similarity index 100%
rename from crates/render/tests/annotative_viewport.rs
rename to crates/render/tests/it/annotative_viewport.rs
diff --git a/crates/render/tests/dim_angular_centre.rs b/crates/render/tests/it/dim_angular_centre.rs
similarity index 100%
rename from crates/render/tests/dim_angular_centre.rs
rename to crates/render/tests/it/dim_angular_centre.rs
diff --git a/crates/render/tests/dim_post_tolerance.rs b/crates/render/tests/it/dim_post_tolerance.rs
similarity index 100%
rename from crates/render/tests/dim_post_tolerance.rs
rename to crates/render/tests/it/dim_post_tolerance.rs
diff --git a/crates/render/tests/dim_text_format.rs b/crates/render/tests/it/dim_text_format.rs
similarity index 100%
rename from crates/render/tests/dim_text_format.rs
rename to crates/render/tests/it/dim_text_format.rs
diff --git a/crates/render/tests/hatch_fill.rs b/crates/render/tests/it/hatch_fill.rs
similarity index 100%
rename from crates/render/tests/hatch_fill.rs
rename to crates/render/tests/it/hatch_fill.rs
diff --git a/crates/render/tests/linetype_text.rs b/crates/render/tests/it/linetype_text.rs
similarity index 100%
rename from crates/render/tests/linetype_text.rs
rename to crates/render/tests/it/linetype_text.rs
diff --git a/crates/render/tests/lwdefault.rs b/crates/render/tests/it/lwdefault.rs
similarity index 100%
rename from crates/render/tests/lwdefault.rs
rename to crates/render/tests/it/lwdefault.rs
diff --git a/crates/render/tests/it/main.rs b/crates/render/tests/it/main.rs
new file mode 100644
index 00000000..7469173d
--- /dev/null
+++ b/crates/render/tests/it/main.rs
@@ -0,0 +1,17 @@
+mod aci7_display;
+mod annotative_viewport;
+mod dim_angular_centre;
+mod dim_post_tolerance;
+mod dim_text_format;
+mod hatch_fill;
+mod linetype_text;
+mod lwdefault;
+mod plot_line_styles;
+mod plot_styles;
+mod point_style;
+mod psltscale;
+mod raster_points;
+mod render_props;
+mod viewport_frozen_layer;
+mod wide_pline_linetype;
+mod wipeout_mask;
diff --git a/crates/render/tests/plot_line_styles.rs b/crates/render/tests/it/plot_line_styles.rs
similarity index 100%
rename from crates/render/tests/plot_line_styles.rs
rename to crates/render/tests/it/plot_line_styles.rs
diff --git a/crates/render/tests/plot_styles.rs b/crates/render/tests/it/plot_styles.rs
similarity index 100%
rename from crates/render/tests/plot_styles.rs
rename to crates/render/tests/it/plot_styles.rs
diff --git a/crates/render/tests/point_style.rs b/crates/render/tests/it/point_style.rs
similarity index 100%
rename from crates/render/tests/point_style.rs
rename to crates/render/tests/it/point_style.rs
diff --git a/crates/render/tests/psltscale.rs b/crates/render/tests/it/psltscale.rs
similarity index 100%
rename from crates/render/tests/psltscale.rs
rename to crates/render/tests/it/psltscale.rs
diff --git a/crates/render/tests/raster_points.rs b/crates/render/tests/it/raster_points.rs
similarity index 100%
rename from crates/render/tests/raster_points.rs
rename to crates/render/tests/it/raster_points.rs
diff --git a/crates/render/tests/render_props.rs b/crates/render/tests/it/render_props.rs
similarity index 100%
rename from crates/render/tests/render_props.rs
rename to crates/render/tests/it/render_props.rs
diff --git a/crates/render/tests/viewport_frozen_layer.rs b/crates/render/tests/it/viewport_frozen_layer.rs
similarity index 100%
rename from crates/render/tests/viewport_frozen_layer.rs
rename to crates/render/tests/it/viewport_frozen_layer.rs
diff --git a/crates/render/tests/wide_pline_linetype.rs b/crates/render/tests/it/wide_pline_linetype.rs
similarity index 100%
rename from crates/render/tests/wide_pline_linetype.rs
rename to crates/render/tests/it/wide_pline_linetype.rs
diff --git a/crates/render/tests/wipeout_mask.rs b/crates/render/tests/it/wipeout_mask.rs
similarity index 100%
rename from crates/render/tests/wipeout_mask.rs
rename to crates/render/tests/it/wipeout_mask.rs
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 03a35212..bc6d23ef 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -187,7 +187,7 @@ fn wrap(r: Result<Value, String>) -> Outcome {
 }
 
 /// What `control.methods` replies: method, params, description. Keep in step with `handle` and the
-/// table in `docs/control-protocol.md` (`tests/control_methods.rs` checks the table).
+/// table in `docs/control-protocol.md` (`tests/it/control_methods.rs` checks the table).
 const METHODS: &[(&str, &str, &str)] = &[
     ("cmdline.input", "{text}", "Type a line at the command line exactly like a user (commands, prompts, keywords; empty = Enter)."),
     ("cmdline.script", "{text}", "Run a multi-line script, like a .scr file."),
diff --git a/crates/ui-egui/src/xrefs.rs b/crates/ui-egui/src/xrefs.rs
index 5828169d..fb9cb9ef 100644
--- a/crates/ui-egui/src/xrefs.rs
+++ b/crates/ui-egui/src/xrefs.rs
@@ -24,7 +24,13 @@ pub fn route(app: &mut CadApp, id: &str, params: &Value) -> Option<Result<Value,
             if let Err(e) = app.session.start("xattach") {
                 return Some(Err(e.to_string()));
             }
-            app.cmdline(&path);
+            // Submit the picked filename as literal text, not through the command line: a path is
+            // attacker-controlled (the file picker returns whatever the user selected), and
+            // `cmdline` interprets command syntax, so a name like `'closeall` would run an engine
+            // command instead of naming the file (CWE-74).
+            if let Err(e) = app.session.input(cadcraft_engine::Input::Text(path)) {
+                return Some(Err(e.to_string()));
+            }
             Some(Ok(Value::Null))
         }
         _ => None,
diff --git a/crates/ui-egui/tests/animation_effects.rs b/crates/ui-egui/tests/it/animation_effects.rs
similarity index 100%
rename from crates/ui-egui/tests/animation_effects.rs
rename to crates/ui-egui/tests/it/animation_effects.rs
diff --git a/crates/ui-egui/tests/chrome_geometry.rs b/crates/ui-egui/tests/it/chrome_geometry.rs
similarity index 100%
rename from crates/ui-egui/tests/chrome_geometry.rs
rename to crates/ui-egui/tests/it/chrome_geometry.rs
diff --git a/crates/ui-egui/tests/context_menu.rs b/crates/ui-egui/tests/it/context_menu.rs
similarity index 100%
rename from crates/ui-egui/tests/context_menu.rs
rename to crates/ui-egui/tests/it/context_menu.rs
diff --git a/crates/ui-egui/tests/context_menus.rs b/crates/ui-egui/tests/it/context_menus.rs
similarity index 100%
rename from crates/ui-egui/tests/context_menus.rs
rename to crates/ui-egui/tests/it/context_menus.rs
diff --git a/crates/ui-egui/tests/control_cmdline.rs b/crates/ui-egui/tests/it/control_cmdline.rs
similarity index 98%
rename from crates/ui-egui/tests/control_cmdline.rs
rename to crates/ui-egui/tests/it/control_cmdline.rs
index 0c723cf1..34a3f8cb 100644
--- a/crates/ui-egui/tests/control_cmdline.rs
+++ b/crates/ui-egui/tests/it/control_cmdline.rs
@@ -1,5 +1,5 @@
 //! The app's control channel answers `cmdline.input` and `app.open` with the same reply shape as
-//! the headless MCP backend (`cadcraft_mcp::Headless`, tested in `crates/mcp/tests/cmdline_parity.rs`).
+//! the headless MCP backend (`cadcraft_mcp::Headless`, tested in `crates/mcp/tests/it/cmdline_parity.rs`).
 
 use cadcraft_engine::Session;
 use cadcraft_ui_egui::control::{ControlRequest, Outcome, handle};
diff --git a/crates/ui-egui/tests/control_cmdline_key.rs b/crates/ui-egui/tests/it/control_cmdline_key.rs
similarity index 95%
rename from crates/ui-egui/tests/control_cmdline_key.rs
rename to crates/ui-egui/tests/it/control_cmdline_key.rs
index de02816d..b3858ffa 100644
--- a/crates/ui-egui/tests/control_cmdline_key.rs
+++ b/crates/ui-egui/tests/it/control_cmdline_key.rs
@@ -1,5 +1,5 @@
 //! The app's control channel answers `cmdline.key` like `cmdline.input` and like the headless MCP
-//! backend (`crates/mcp/tests/cmdline_key.rs`): a refused Enter is echoed and reported in `error`.
+//! backend (`crates/mcp/tests/it/cmdline_key.rs`): a refused Enter is echoed and reported in `error`.
 
 use cadcraft_engine::Session;
 use cadcraft_ui_egui::control::{ControlRequest, Outcome, handle};
diff --git a/crates/ui-egui/tests/control_methods.rs b/crates/ui-egui/tests/it/control_methods.rs
similarity index 97%
rename from crates/ui-egui/tests/control_methods.rs
rename to crates/ui-egui/tests/it/control_methods.rs
index 36495657..741d49b8 100644
--- a/crates/ui-egui/tests/control_methods.rs
+++ b/crates/ui-egui/tests/it/control_methods.rs
@@ -22,7 +22,7 @@ fn app() -> CadApp {
 
 /// The method names in the first column of the doc's method table.
 fn documented() -> BTreeSet<String> {
-    let doc = include_str!("../../../docs/control-protocol.md");
+    let doc = include_str!("../../../../docs/control-protocol.md");
     let table = doc.lines().skip_while(|l| !l.starts_with("| Method |")).skip(2).take_while(|l| l.starts_with('|'));
     table.filter_map(|l| l.split('|').nth(1)).flat_map(|cell| cell.split('`').skip(1).step_by(2).map(str::to_string).collect::<Vec<_>>()).collect()
 }
diff --git a/crates/ui-egui/tests/dialog_dispatch.rs b/crates/ui-egui/tests/it/dialog_dispatch.rs
similarity index 100%
rename from crates/ui-egui/tests/dialog_dispatch.rs
rename to crates/ui-egui/tests/it/dialog_dispatch.rs
diff --git a/crates/ui-egui/tests/docking_workflows.rs b/crates/ui-egui/tests/it/docking_workflows.rs
similarity index 100%
rename from crates/ui-egui/tests/docking_workflows.rs
rename to crates/ui-egui/tests/it/docking_workflows.rs
diff --git a/crates/ui-egui/tests/drafting_polar_increment.rs b/crates/ui-egui/tests/it/drafting_polar_increment.rs
similarity index 100%
rename from crates/ui-egui/tests/drafting_polar_increment.rs
rename to crates/ui-egui/tests/it/drafting_polar_increment.rs
diff --git a/crates/ui-egui/tests/drafting_spacing.rs b/crates/ui-egui/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/ui-egui/tests/drafting_spacing.rs
rename to crates/ui-egui/tests/it/drafting_spacing.rs
diff --git a/crates/ui-egui/tests/file_tab_titles.rs b/crates/ui-egui/tests/it/file_tab_titles.rs
similarity index 100%
rename from crates/ui-egui/tests/file_tab_titles.rs
rename to crates/ui-egui/tests/it/file_tab_titles.rs
diff --git a/crates/ui-egui/tests/gpu_viewport_stencil.rs b/crates/ui-egui/tests/it/gpu_viewport_stencil.rs
similarity index 100%
rename from crates/ui-egui/tests/gpu_viewport_stencil.rs
rename to crates/ui-egui/tests/it/gpu_viewport_stencil.rs
diff --git a/crates/ui-egui/tests/hidden_command_line.rs b/crates/ui-egui/tests/it/hidden_command_line.rs
similarity index 100%
rename from crates/ui-egui/tests/hidden_command_line.rs
rename to crates/ui-egui/tests/it/hidden_command_line.rs
diff --git a/crates/ui-egui/tests/lisp_files.rs b/crates/ui-egui/tests/it/lisp_files.rs
similarity index 100%
rename from crates/ui-egui/tests/lisp_files.rs
rename to crates/ui-egui/tests/it/lisp_files.rs
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
new file mode 100644
index 00000000..2e245157
--- /dev/null
+++ b/crates/ui-egui/tests/it/main.rs
@@ -0,0 +1,34 @@
+mod animation_effects;
+mod chrome_geometry;
+mod context_menu;
+mod context_menus;
+mod control_cmdline;
+mod control_cmdline_key;
+mod control_methods;
+mod dialog_dispatch;
+mod docking_workflows;
+mod drafting_polar_increment;
+mod drafting_spacing;
+mod file_tab_titles;
+mod gpu_viewport_stencil;
+mod hidden_command_line;
+mod lisp_files;
+mod measure_distance_snapping;
+mod menubar_hover;
+mod mspace_viewport_view;
+mod options_dialog;
+mod parameters_rename;
+mod pickdrag;
+mod properties_units;
+mod rapid_clicks;
+mod selection_cycling;
+mod shared_controls;
+mod shortcut_menus;
+mod status_bar_toggles;
+mod style_dialogs;
+mod system_cursor;
+mod text_double_click;
+mod toolsets_gear;
+mod toolsets_parametric;
+mod viewport_double_click_selection;
+mod workspace_focus;
diff --git a/crates/ui-egui/tests/measure_distance_snapping.rs b/crates/ui-egui/tests/it/measure_distance_snapping.rs
similarity index 100%
rename from crates/ui-egui/tests/measure_distance_snapping.rs
rename to crates/ui-egui/tests/it/measure_distance_snapping.rs
diff --git a/crates/ui-egui/tests/menubar_hover.rs b/crates/ui-egui/tests/it/menubar_hover.rs
similarity index 100%
rename from crates/ui-egui/tests/menubar_hover.rs
rename to crates/ui-egui/tests/it/menubar_hover.rs
diff --git a/crates/ui-egui/tests/mspace_viewport_view.rs b/crates/ui-egui/tests/it/mspace_viewport_view.rs
similarity index 100%
rename from crates/ui-egui/tests/mspace_viewport_view.rs
rename to crates/ui-egui/tests/it/mspace_viewport_view.rs
diff --git a/crates/ui-egui/tests/options_dialog.rs b/crates/ui-egui/tests/it/options_dialog.rs
similarity index 100%
rename from crates/ui-egui/tests/options_dialog.rs
rename to crates/ui-egui/tests/it/options_dialog.rs
diff --git a/crates/ui-egui/tests/parameters_rename.rs b/crates/ui-egui/tests/it/parameters_rename.rs
similarity index 100%
rename from crates/ui-egui/tests/parameters_rename.rs
rename to crates/ui-egui/tests/it/parameters_rename.rs
diff --git a/crates/ui-egui/tests/pickdrag.rs b/crates/ui-egui/tests/it/pickdrag.rs
similarity index 100%
rename from crates/ui-egui/tests/pickdrag.rs
rename to crates/ui-egui/tests/it/pickdrag.rs
diff --git a/crates/ui-egui/tests/properties_units.rs b/crates/ui-egui/tests/it/properties_units.rs
similarity index 100%
rename from crates/ui-egui/tests/properties_units.rs
rename to crates/ui-egui/tests/it/properties_units.rs
diff --git a/crates/ui-egui/tests/rapid_clicks.rs b/crates/ui-egui/tests/it/rapid_clicks.rs
similarity index 100%
rename from crates/ui-egui/tests/rapid_clicks.rs
rename to crates/ui-egui/tests/it/rapid_clicks.rs
diff --git a/crates/ui-egui/tests/selection_cycling.rs b/crates/ui-egui/tests/it/selection_cycling.rs
similarity index 100%
rename from crates/ui-egui/tests/selection_cycling.rs
rename to crates/ui-egui/tests/it/selection_cycling.rs
diff --git a/crates/ui-egui/tests/shared_controls.rs b/crates/ui-egui/tests/it/shared_controls.rs
similarity index 100%
rename from crates/ui-egui/tests/shared_controls.rs
rename to crates/ui-egui/tests/it/shared_controls.rs
diff --git a/crates/ui-egui/tests/shortcut_menus.rs b/crates/ui-egui/tests/it/shortcut_menus.rs
similarity index 100%
rename from crates/ui-egui/tests/shortcut_menus.rs
rename to crates/ui-egui/tests/it/shortcut_menus.rs
diff --git a/crates/ui-egui/tests/status_bar_toggles.rs b/crates/ui-egui/tests/it/status_bar_toggles.rs
similarity index 100%
rename from crates/ui-egui/tests/status_bar_toggles.rs
rename to crates/ui-egui/tests/it/status_bar_toggles.rs
diff --git a/crates/ui-egui/tests/style_dialogs.rs b/crates/ui-egui/tests/it/style_dialogs.rs
similarity index 100%
rename from crates/ui-egui/tests/style_dialogs.rs
rename to crates/ui-egui/tests/it/style_dialogs.rs
diff --git a/crates/ui-egui/tests/system_cursor.rs b/crates/ui-egui/tests/it/system_cursor.rs
similarity index 100%
rename from crates/ui-egui/tests/system_cursor.rs
rename to crates/ui-egui/tests/it/system_cursor.rs
diff --git a/crates/ui-egui/tests/text_double_click.rs b/crates/ui-egui/tests/it/text_double_click.rs
similarity index 100%
rename from crates/ui-egui/tests/text_double_click.rs
rename to crates/ui-egui/tests/it/text_double_click.rs
diff --git a/crates/ui-egui/tests/toolsets_gear.rs b/crates/ui-egui/tests/it/toolsets_gear.rs
similarity index 100%
rename from crates/ui-egui/tests/toolsets_gear.rs
rename to crates/ui-egui/tests/it/toolsets_gear.rs
diff --git a/crates/ui-egui/tests/toolsets_parametric.rs b/crates/ui-egui/tests/it/toolsets_parametric.rs
similarity index 100%
rename from crates/ui-egui/tests/toolsets_parametric.rs
rename to crates/ui-egui/tests/it/toolsets_parametric.rs
diff --git a/crates/ui-egui/tests/viewport_double_click_selection.rs b/crates/ui-egui/tests/it/viewport_double_click_selection.rs
similarity index 100%
rename from crates/ui-egui/tests/viewport_double_click_selection.rs
rename to crates/ui-egui/tests/it/viewport_double_click_selection.rs
diff --git a/crates/ui-egui/tests/workspace_focus.rs b/crates/ui-egui/tests/it/workspace_focus.rs
similarity index 100%
rename from crates/ui-egui/tests/workspace_focus.rs
rename to crates/ui-egui/tests/it/workspace_focus.rs
diff --git a/docs/autolisp.md b/docs/autolisp.md
index e26702c2..910fc278 100644
--- a/docs/autolisp.md
+++ b/docs/autolisp.md
@@ -85,5 +85,5 @@ filters take radians too.
 ## Testing against the corpus
 
 The AutoLISP conformance corpus (#648) lives in its own repository. Point `CADCRAFT_LISP_CORPUS`
-at it and run `cargo test -p cadcraft-engine --test lisp_corpus`; without the variable the test
+at it and run `cargo test -p cadcraft-engine --test it lisp_corpus::`; without the variable the test
 says it was skipped.
diff --git a/packaging/env.sh b/packaging/env.sh
index e7033480..ab01ce4c 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -19,10 +19,11 @@ workspace_version() {
     /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
     in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
   ' "$ROOT/Cargo.toml"
+  return
 }
 
 VERSION="${CADCRAFT_VERSION:-$(workspace_version)}"
-if [ -z "$VERSION" ]; then
+if [[ -z "$VERSION" ]]; then
   echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
   exit 1
 fi
@@ -32,7 +33,7 @@ DIST="${DIST:-$ROOT/dist/release}"
 mkdir -p "$DIST"
 export DIST
 
-if [ -z "${CADCRAFT_BUILD_SHA:-}" ]; then
+if [[ -z "${CADCRAFT_BUILD_SHA:-}" ]]; then
   CADCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
 fi
 export CADCRAFT_BUILD_SHA
@@ -41,29 +42,33 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
 warn() {
-  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return
 }
 
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
   for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
-    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+    if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
+  return
 }
 
 # Builds made with craft-fonts (CRAFT_FONTS_DIR, set by the release workflow) embed its fonts, so
 # the package carries their licences as OFL-<family-dir>.txt. Nothing without CRAFT_FONTS_DIR.
 copy_font_licences() {
   local dest="$1" f
-  [ -n "${CRAFT_FONTS_DIR:-}" ] || return 0
+  [[ -n "${CRAFT_FONTS_DIR:-}" ]] || return 0
   for f in "$CRAFT_FONTS_DIR"/fonts/*/OFL.txt; do
-    if [ -f "$f" ]; then cp "$f" "$dest/OFL-$(basename "$(dirname "$f")").txt"; fi
+    if [[ -f "$f" ]]; then cp "$f" "$dest/OFL-$(basename "$(dirname "$f")").txt"; fi
   done
 }
 
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return
 }
diff --git a/packaging/icons.sh b/packaging/icons.sh
index 3cb8ea73..d19aa44d 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -12,7 +12,10 @@ TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
 command -v sips >/dev/null || { echo "error: sips not found (macOS only)" >&2; exit 1; }
 
-resize() { sips -s format png -z "$2" "$2" "$1" --out "$3" >/dev/null; }
+resize() {
+  local src="$1" size="$2" out="$3"
+  sips -s format png -z "$size" "$size" "$src" --out "$out" >/dev/null
+}
 
 for s in 16 24 32 48 64 128 256 512; do
   mkdir -p "$DIR/hicolor/${s}x${s}/apps"
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 9baccf92..5154fe07 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -21,7 +21,7 @@ FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
 TARBALL=""
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
@@ -38,7 +38,7 @@ case "$ARCH" in
 esac
 BASENAME="cadcraft-$VERSION-linux-$ARCH"
 TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
-[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+[[ -f "$TARBALL" ]] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
 for tool in flatpak flatpak-builder; do
   command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
 done
@@ -49,7 +49,7 @@ WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"
 tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
-[ -x "$WORK/stage/bin/cadcraft" ] || { echo "error: $TARBALL has no bin/cadcraft" >&2; exit 1; }
+[[ -x "$WORK/stage/bin/cadcraft" ]] || { echo "error: $TARBALL has no bin/cadcraft" >&2; exit 1; }
 cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"
 
 flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
@@ -62,7 +62,7 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
-if [ "$TEST" = 1 ]; then
+if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
   flatpak run --command=cadcraft-cli "$APP_ID" --version
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index d6fa10b9..36b69cec 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -21,7 +21,7 @@ APP_ID=ai.storyteller.cadcraft
 
 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --formats) FORMATS="$2"; shift 2 ;;
@@ -44,8 +44,8 @@ BASENAME="cadcraft-$VERSION-linux-$ARCH"
 
 echo "==> CADCraft $VERSION for Linux $ARCH ($FORMATS)"
 
-if [ "$SKIP_BUILD" = 0 ]; then
-  if [ -n "${CROSS_TARGET:-}" ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
+  if [[ -n "${CROSS_TARGET:-}" ]]; then
     (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli --target "$CROSS_TARGET")
   else
     (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli)
@@ -77,7 +77,7 @@ if command -v appstreamcli >/dev/null; then
   appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi
 
-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() { local format="$1"; case " $FORMATS " in *" $format "*) return 0 ;; *) return 1 ;; esac; }
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -110,9 +110,9 @@ if has appimage; then
   ln -s "$APP_ID.png" "$APPDIR/.DirIcon"
 
   TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
-  if [ -z "$TOOL" ]; then
+  if [[ -z "$TOOL" ]]; then
     TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
-    if [ ! -x "$TOOL" ]; then
+    if [[ ! -x "$TOOL" ]]; then
       curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
       chmod +x "$TOOL"
     fi
@@ -135,16 +135,16 @@ if has appimage; then
   # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
   (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
   echo "wrote $OUT"
-  if [ -s "$OUT.zsync" ]; then
+  if [[ -s "$OUT.zsync" ]]; then
     echo "wrote $OUT.zsync"
   else
     warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
   fi
 fi
 
-if [ -z "${CROSS_TARGET:-}" ]; then
+if [[ -z "${CROSS_TARGET:-}" ]]; then
   "$STAGE/usr/bin/cadcraft-cli" --version
-elif [ -n "${EMULATOR:-}" ]; then
+elif [[ -n "${EMULATOR:-}" ]]; then
   "$EMULATOR" "$STAGE/usr/bin/cadcraft-cli" --version
 fi
 echo "==> done"
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index 16bb38b5..b1fa7143 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -12,7 +12,7 @@ umask 077
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 
-if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
   warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
   exit 0
 fi
@@ -41,13 +41,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS"
 security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
 
 IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
-if [ -z "$IDENTITY" ]; then
+if [[ -z "$IDENTITY" ]]; then
   security find-identity -v -p codesigning "$KEYCHAIN" >&2
   echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
   exit 1
 fi
 echo "Imported signing identity $IDENTITY"
-if [ -n "${GITHUB_ENV:-}" ]; then
+if [[ -n "${GITHUB_ENV:-}" ]]; then
   { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
 else
   echo "MACOS_SIGN_IDENTITY=$IDENTITY"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 203dc20d..fd626fbf 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -19,7 +19,7 @@ HERE="$ROOT/packaging/macos"
 
 ARCH=universal
 SKIP_BUILD=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --arch) ARCH="$2"; shift 2 ;;
     --skip-build) SKIP_BUILD=1; shift ;;
@@ -44,9 +44,9 @@ DMG="$DIST/cadcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/cadcraft-cli-$VERSION-macos-$ARCH.zip"
 
 NOTARIZE=0
-if [ "$IDENTITY" = "-" ]; then
+if [[ "$IDENTITY" = "-" ]]; then
   warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
-elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+elif [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
   NOTARIZE=1
 else
   warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
@@ -55,7 +55,7 @@ fi
 echo "==> CADCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize: $NOTARIZE"
 
 # ---- build -------------------------------------------------------------------------------------
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
   args=()
   for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
   (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli "${args[@]}")
@@ -74,9 +74,9 @@ done
 sign() {
   # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
   local ts=(--timestamp)
-  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  [[ "$IDENTITY" = "-" ]] && ts=(--timestamp=none)
   local kc=()
-  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  [[ -n "${MACOS_KEYCHAIN:-}" ]] && kc=(--keychain "$MACOS_KEYCHAIN")
   codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
 }
 
@@ -88,8 +88,8 @@ notarize() {
   echo "$out"
   id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
   status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
-  if [ "$status" != "Accepted" ]; then
-    if [ -n "$id" ]; then
+  if [[ "$status" != "Accepted" ]]; then
+    if [[ -n "$id" ]]; then
       xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
     fi
     echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
@@ -117,7 +117,7 @@ sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/
 sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
 codesign --verify --strict --deep --verbose=2 "$APP"
 
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/CADCraft-notarize.zip"
   notarize "$WORK/CADCraft-notarize.zip"
   xcrun stapler staple "$APP"
@@ -144,7 +144,7 @@ hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
   xcrun stapler staple "$DMG"
   xcrun stapler validate "$DMG"
@@ -162,7 +162,7 @@ codesign --verify --strict --verbose=2 "$CLI_DIR/cadcraft-cli"
 rm -f "$CLI_ZIP"
 ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
 # A bare Mach-O can't carry a stapled ticket; Gatekeeper looks the notarization up online.
-if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+if [[ "$NOTARIZE" = 1 ]]; then notarize "$CLI_ZIP"; fi
 
 "$WORK/bin/cadcraft-cli" --version
 echo "==> done"
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
index 7caa88ed..6091bf5e 100755
--- a/packaging/web/package.sh
+++ b/packaging/web/package.sh
@@ -11,13 +11,13 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 HERE="$ROOT/packaging/web"
 
-if [ "${1:-}" != "--skip-build" ]; then
+if [[ "${1:-}" != "--skip-build" ]]; then
   command -v trunk >/dev/null || { echo "error: trunk not found (cargo install trunk --locked)" >&2; exit 1; }
   (cd "$ROOT/apps/cadcraft-web" && trunk build --release)
 fi
 
 SITE="$ROOT/dist/web"
-[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+[[ -f "$SITE/index.html" ]] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
 # Paths must be relative so the site works under any prefix (public_url = "./" in Trunk.toml).
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
   echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index c72bc076..5387d161 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -20,6 +20,7 @@ commands:
   assets          check that every icon/image/font/asset is attributed in ATTRIBUTION.md
   layers          enforce the crate dependency layering (plan/architecture.md §3)
   wasm            cargo check --target wasm32-unknown-unknown for the wasm-safe crates
+  test            cargo nextest run (cargo test without nextest) plus the doctests
   ci              fmt --check, clippy -D warnings, test, assets, layers, wasm (stops at first failure)
   corpus [--download]
                   show where test corpora live; --download fetches PngSuite into corpus/pngsuite
@@ -36,6 +37,7 @@ fn main() -> ExitCode {
         Some("assets") => assets::run(&root()),
         Some("layers") => cmd_layers(),
         Some("wasm") => cmd_wasm(),
+        Some("test") => cmd_test(),
         Some("ci") => cmd_ci(),
         Some("corpus") => cmd_corpus(rest.contains(&"--download")),
         Some("stats") => stats::run(&root(), rest.contains(&"--exact")),
@@ -133,19 +135,36 @@ fn wasm_set() -> Result<Vec<String>, String> {
 
 fn cmd_wasm() -> Result<(), String> {
     let set = wasm_set()?;
-    let mut results = Vec::new();
+    let mut c = cargo();
+    c.args(["check", "--target", "wasm32-unknown-unknown", "--keep-going"]);
     for pkg in &set {
-        let mut c = cargo();
-        c.args(["check", "--target", "wasm32-unknown-unknown", "-p", pkg]);
-        let ok = run(c, &format!("cargo check --target wasm32-unknown-unknown -p {pkg}")).is_ok();
-        results.push((pkg.clone(), ok));
+        c.args(["-p", pkg]);
     }
-    println!("\nwasm32-unknown-unknown check:");
-    for (p, ok) in &results {
-        println!("  {:<6} {p}", if *ok { "ok" } else { "FAIL" });
+    run(c, &format!("cargo check --target wasm32-unknown-unknown --keep-going ({} crates)", set.len())).map_err(|e| format!("wasm check failed: {e}"))
+}
+
+/// Whether `cargo nextest` is installed.
+fn has_nextest() -> bool {
+    let mut c = cargo();
+    c.args(["nextest", "--version"]).stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null());
+    c.status().is_ok_and(|s| s.success())
+}
+
+/// Unit and integration tests (examples are not built) with nextest, or `cargo test` when
+/// nextest is missing, then the doctests, which nextest does not run.
+fn cmd_test() -> Result<(), String> {
+    let mut c = cargo();
+    if has_nextest() {
+        c.args(["nextest", "run", "--workspace", "--lib", "--bins", "--tests"]);
+        run(c, "cargo nextest run --workspace --lib --bins --tests")?;
+    } else {
+        eprintln!("note: cargo-nextest is not installed (cargo install cargo-nextest --locked); running cargo test");
+        c.args(["test", "--workspace", "--lib", "--bins", "--tests"]);
+        run(c, "cargo test --workspace --lib --bins --tests")?;
     }
-    let failed = results.iter().filter(|r| !r.1).count();
-    if failed == 0 { Ok(()) } else { Err(format!("{failed} crate(s) failed the wasm check")) }
+    let mut c = cargo();
+    c.args(["test", "--workspace", "--doc"]);
+    run(c, "cargo test --workspace --doc")
 }
 
 fn cmd_ci() -> Result<(), String> {
@@ -163,18 +182,11 @@ fn cmd_ci() -> Result<(), String> {
             "clippy",
             Box::new(|| {
                 let mut c = cargo();
-                c.args(["clippy", "--workspace", "--all-targets", "--", "-D", "warnings"]);
-                run(c, "cargo clippy --workspace --all-targets -- -D warnings")
-            }),
-        ),
-        (
-            "test",
-            Box::new(|| {
-                let mut c = cargo();
-                c.args(["test", "--workspace"]);
-                run(c, "cargo test --workspace")
+                c.args(["clippy", "--workspace", "--all-targets", "--keep-going", "--", "-D", "warnings"]);
+                run(c, "cargo clippy --workspace --all-targets --keep-going -- -D warnings")
             }),
         ),
+        ("test", Box::new(cmd_test)),
         ("assets", Box::new(|| assets::run(&root()))),
         ("layers", Box::new(cmd_layers)),
         ("wasm", Box::new(cmd_wasm)),
diff --git a/xtask/src/stats.rs b/xtask/src/stats.rs
index a5b6e7df..c2c6de3d 100644
--- a/xtask/src/stats.rs
+++ b/xtask/src/stats.rs
@@ -14,11 +14,14 @@ struct Counts {
 /// never make the stats command run unbounded work.
 const MAX_ENTRIES: usize = 2_000_000;
 
+/// Accumulate Rust source counts under one directory with a fresh traversal-entry budget.
 fn walk(dir: &Path, c: &mut Counts) -> Result<(), String> {
     let mut budget = MAX_ENTRIES;
     walk_inner(dir, c, &mut budget)
 }
 
+/// Traverse entries without following symlinks, sharing one budget across descendant directories.
+/// Skip unreadable entries and excluded directories; report budget exhaustion to the caller.
 fn walk_inner(dir: &Path, c: &mut Counts, budget: &mut usize) -> Result<(), String> {
     let Ok(rd) = std::fs::read_dir(dir) else {
         return Ok(());
@@ -84,6 +87,7 @@ fn exact_tests(pkg: &str) -> Option<usize> {
     Some(String::from_utf8_lossy(&out.stdout).lines().filter(|l| l.ends_with(": test")).count())
 }
 
+/// Print per-package source statistics, optionally querying exact test counts, and propagate traversal errors.
 pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
     let meta = crate::metadata()?;
     let mut rows = Vec::new();
@@ -138,6 +142,7 @@ mod tests {
         assert_eq!(count_tests(src), (2, 1));
     }
 
+    /// A directory alias does not cause its Rust source to be counted twice.
     #[cfg(unix)]
     #[test]
     fn walk_does_not_follow_directory_symlinks() {
@@ -154,6 +159,7 @@ mod tests {
         assert_eq!(c.files, 1, "the aliased directory was followed and counted twice");
         std::fs::remove_dir_all(&base).ok();
     }
+    /// Traversal reports an exhausted entry budget and accepts a tree that exactly fits it.
     #[test]
     fn walk_reports_budget_exhaustion() {
         let base = std::env::temp_dir().join(format!("cadcraft-stats-budget-{}", std::process::id()));