chore: deliver the fork delta since the 1105 sync wave - #833

Review of PR 833 (fork delta since the 1105 sync wave)

Reviewed the full diff of f953e8c against master 66ee62e (57 files, +10779/-108): the new IFC scanner and its CLI command, the drawing/report fixes, the V18/V19 UI surfaces, the model-command tests, the test-gate change, the USD differential harness with its fixtures, and the docs.

Verdict: approved. No inline findings — nothing in this delta requires a change.

Checked in depth:

• crates/ifc/src/read.rs — a bounded scanner of untrusted input. The size cap is re-checked before parsing, non-UTF-8 bytes are refused, slicing is byte-safe on non-ASCII text, argument splitting tracks bracket depth, the name inventory and losses are capped, and the units resolution refuses instead of guessing (the no-fallback rule is pinned by tests). No panic or unbounded-allocation path found: interpreted bodies are slices of lines already bounded by MAX_LINE_BYTES, and first_string/split_args walk bytes via get, never by index.
• Drawing fixes (svg.rs, pdf.rs, sheet.rs) — the line-normal label placement reproduces the old above/below result for horizontal lines and clears the line for vertical and inclined ones (offset = LABEL_GAP plus half the box extent projected onto the normal); polyline chaining compares 4-decimal formatted points, so it cannot merge distinct geometry; the title block now closes at the top and its divider follows the label column. SVG and PDF carry equivalent fixes and tests.
• Report precision (bom.rs, schedule.rs) — quantity trimming is dot-anchored (the formatted value always contains a point, so trailing-zero trimming cannot eat integer digits) with a -0 fix-up; the mass column is matched per template column and falls back safely to the old rendering when cell and column counts disagree.
• V18 grips and V19/V10 benches — every vertex and edge access goes through get/get_mut, the modulo is only reached with a nonzero count, single-flight covers all new job kinds through other_command_running, a worker that dies without a result lands in the CLI_FAILED path, and the corner editor is bound to the selection id so a changed selection cannot author on the wrong plate.
• The gate change (tools/test-gate/src/local.rs) — the vacuous doctest pass triggers only on a nonzero exit without a timeout plus the exact cargo refusal line in the retained stderr log; the new process tests pin both sides (a real doctest failure is never vacuous).
• registry.rs and COMMANDS.md agree on the new ifc-inspect entry and on --decimals 0..3; the engine already refused decimal_places > 3 (crates/engine/src/drawing.rs:376), so the registry/docs edit only aligns the documented contract with the enforced one.
• tools/usd-sdk-differential/run.sh — writes only under a mktemp directory it removes on exit, asserts with fixed-string grep, and reads the oracle exit status from the assignment rather than a pipeline.

Non-blocking notes, for the record only:

• In weld_click and bolt_click, clicking the already-picked main part as the second pick fills the secondary slot and is refused only at Create. Refusing the duplicate pick at click time would be friendlier; the current behaviour writes nothing.
• The two 32 MiB cap tests (read.rs and ifc_inspect.rs) allocate or write the full cap on every run — acceptable, but they are the heaviest additions to the suite on a loaded machine.
• In the scanner, once MAX_DISTINCT_NAMES names are present, further instances of already-known names also land in unclassified_instances. That matches the documented cap wording; worth knowing when reading the JSON.

The recorded gate receipt covers the full workspace; the new behaviour carries tests in the same commit, including real-binary CLI suites and egui-driven UI suites that assert both the refusal path and hand-typed equivalence.