docs: correct user-facing docs for the next release

Remove a private part reference from the lead-in notes, fix the Options and
New menu paths, say that release ZIPs never auto-update, describe current
Cincinnati CL ordering, clamp validation coverage and empty-plate saving,
list every built-in engine, and drop internal decision labels.

README.md

@@ -21,7 +21,7 @@ A Windows desktop application for CNC nesting — imports DXF drawings, arranges
 - Windows 10+ for the desktop app; the console, API, and most test projects build on Linux/macOS too.
 - [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0) to build from source.
 
-Windows release ZIPs are self-contained: extract the entire archive into a new folder and run `OpenNest.exe`; no separate .NET installation is needed. The Rectangles and Irregular nesting engines are built in; see [nesting engines](docs/nesting-engines.md). Use the ZIP and SHA-256 checksum from [GitHub Releases](https://github.com/ajisaacs/OpenNest/releases), not the source-code archives.
+Windows release ZIPs are self-contained: extract the entire archive into a new folder and run `OpenNest.exe`; no separate .NET installation is needed. To update, close OpenNest and extract the new release into a new folder; ZIP releases do not auto-update (optional installer-based updates need a separately hosted [Velopack feed](docs/auto-update.md)). All nesting engines (Default, Rectangles, Irregular, Circles, FlatBar and the fill strategies) are built in; see [nesting engines](docs/nesting-engines.md). Use the ZIP and SHA-256 checksum from [GitHub Releases](https://github.com/ajisaacs/OpenNest/releases), not the source-code archives.
 
 ## Build, Test, Run
 
@@ -39,7 +39,7 @@ dotnet run --project OpenNest/OpenNest.csproj                   # desktop app (W
 
 ### Quick start
 
-1. File > New Nest
+1. File > New
 2. Import DXFs via the CAD Converter (layer/color filtering, per-entity exclude and cut/etch/display-only roles, bend detection, G-code preview) or create built-in shapes
 3. Define plate size, material, quadrant, spacing
 4. Fill — the engine arranges parts
@@ -58,7 +58,7 @@ dotnet run --project OpenNest.Console -- project.zip                          #
 | Option | What it does |
 |--------|--------------|
 | `--size WxL` | Set the plate size; required for DXF-only input. |
-| `--autonest` | Run validated whole-job nesting on one sheet. |
+| `--autonest` | Run validated whole-job nesting; one sheet unless `--max-sheets <n>` allows more. |
 | `--engine <name>` | Choose a whole-job engine with `--autonest`, or a fill strategy without it. |
 | `--quantity <n>` | Limit parts placed (0 means unlimited). |
 | `--spacing <value>` | Override part spacing. |

docs/auto-update.md

@@ -9,16 +9,18 @@ unsaved nest is never discarded automatically.
 
 ## Configuring the feed
 
-The feed URL is a per-machine setting
-(`OpenNest.Properties.Settings.UpdateFeedUrl`), set from **File > Options >
+The feed URL is saved for the current Windows user
+(`OpenNest.Properties.Settings.UpdateFeedUrl`), set from **Tools > Options >
 Auto-update feed URL**. It is blank by default, which disables update checks
 entirely — this is intentional: the feed URL is operator infrastructure, not
 something that belongs in source control, so no default ships in the repo.
 Enter a feed's base URL (`http://host:port`) and restart the app to pick it
 up.
 
-Velopack only applies updates to an installed copy (`UpdateManager.IsInstalled`);
-running from a build output directory never attempts an update.
+Velopack only applies updates to an installed copy (`UpdateManager.IsInstalled`):
+one installed with the `Setup.exe` that `Deploy-OpenNest.ps1` produces. The ZIPs on
+GitHub Releases and ordinary build output are not Velopack installations and never
+auto-update, even with a feed URL configured.
 
 ## Hosting a feed
 

docs/automatic-nesting.md

@@ -167,11 +167,11 @@ MCP `autonest_plate` requires an empty target. The stdio server serializes all t
 
 MCP `pack_plate` and `autonest_plate` report each requested drawing's newly placed count and remaining quantity, indexed by request; partial fulfillment is explicitly warned about. Per-sheet ratios are not enforced or required: an uneven sheet is acceptable if the remaining quantities are placed elsewhere in the nest. These two plate tools operate on a single selected plate and do not automatically finish a multi-sheet job; callers can use `autonest_job` for that. Duplicate request tokens and ambiguous drawing names are refused before placement. A zero-quantity pack request places zero parts for that drawing; negative quantities are rejected.
 
-`autonest_job(plateIndex, drawingNames, quantities, engine?, no_new_plates=false, sheets?)` is the whole-session completion path. Quantities are total targets across existing placed parts (physical plate quantity included) plus newly proposed sheets. Without `sheets`, the selected empty cutoff-free plate supplies stock size, spacing, quadrant, grain and cutting settings; other empty plates with equivalent persisted settings may be reused first, then additional matching plates are created as needed. `no_new_plates=true` caps physical stock by the number of existing matching empty plates, not the number of grouped output layouts or their old repeat quantities. Exact repeats still attach once with their total quantity; redundant empty entries remain unchanged and are omitted on save. Empty entries consumed by those physical copies are reserved by their populated layout in the live MCP session and cannot be offered again or filled by another nesting tool while that owner remains populated. Clearing or removing the owner (including replacement by `load_nest`) releases only its surviving placeholders; clearing or deleting a placeholder does not release the owner's other copies or another layout's reservations. Genuinely unused entries remain available. No automatic deletion of user plates occurs. No new layout entries are created in this mode. The request uses the independently validated `NestPipeline` and commits only when every requested quantity is met; invalid, incomplete, cancelled or unknown-engine proposals leave existing plates and counts unchanged. A no-placement solver result is not proof that geometry cannot fit. `pack_plate` and `autonest_plate` remain single-sheet operations.
+`autonest_job(plateIndex, drawingNames, quantities, engine?, no_new_plates=false, sheets?)` is the whole-session completion path. Quantities are total targets across existing placed parts (physical plate quantity included) plus newly proposed sheets. Without `sheets`, the selected empty cutoff-free plate supplies stock size, spacing, quadrant, grain and cutting settings; other empty plates with equivalent persisted settings may be reused first, then additional matching plates are created as needed. `no_new_plates=true` caps physical stock by the number of existing matching empty plates, not the number of grouped output layouts or their old repeat quantities. Exact repeats still attach once with their total quantity; redundant empty entries remain unchanged and are normally omitted on save. Empty entries consumed by those physical copies are reserved by their populated layout in the live MCP session and cannot be offered again or filled by another nesting tool while that owner remains populated. Clearing or removing the owner (including replacement by `load_nest`) releases only its surviving placeholders; clearing or deleting a placeholder does not release the owner's other copies or another layout's reservations. Genuinely unused entries remain available. No automatic deletion of user plates occurs. No new layout entries are created in this mode. The request uses the independently validated `NestPipeline` and commits only when every requested quantity is met; invalid, incomplete, cancelled or unknown-engine proposals leave existing plates and counts unchanged. A no-placement solver result is not proof that geometry cannot fit. `pack_plate` and `autonest_plate` remain single-sheet operations.
 
 For finite mixed-size inventory, supply `sheets` as an array, for example `{"plateIndex":0,"drawingNames":"large,small","quantities":"1,1","engine":"Rectangles","sheets":[{"width":60,"length":120,"quantity":1},{"width":48,"length":96,"quantity":2}]}`. Width and length have the same units and orientation as `create_plate`. Every row's positive integer `quantity` is the total physical sheets available for this solve, including any compatible pre-created empty plates; it is never a `Plate.Quantity` repeat multiplier or additional stock. The selected plate supplies common spacing, edge spacing, quadrant, grain and cutting settings, but is reused only if its size matches a chosen sheet. Other compatible empty sheets can be reused; occupied or cutoff-bearing sheets cannot. Only needed different-sized sheets are created. Duplicate size pairs, nonpositive or nonfinite dimensions, unusable work areas, nonpositive quantities, an empty list and excessive total inventory are refused before solving. `sheets` cannot be combined with `no_new_plates=true`. Omit `sheets` to retain the previous single-size behavior. Successful output reports `stock-0`, `stock-1`, etc. in input order with physical used/remaining counts, reused/created layout counts, plus committed session layout index to stock ID and per-drawing totals. Stock is request-local, not a persistent purchasing catalog. Unused empty templates may be omitted by the `.nest` writer on save.
 
-MCP `delete_plate(plateIndex)` removes only a sheet with no parts and no cutoff definitions, from either loaded or newly created session plates. Occupied, cutoff-bearing and invalid indices are refused without changing the session. After deletion every later index shifts down by one; inspect `get_plate_info` before further edits. This is session cleanup, not a data purge or a save-time option. `save_nest` lists all session plates in its response, but the existing `.nest` writer omits empty cutoff-free plates from the serialized file; reloading may therefore have fewer plates than the response says. There is no opt-in switch to preserve empty plates in the file.
+MCP `delete_plate(plateIndex)` removes only a sheet with no parts and no cutoff definitions, from either loaded or newly created session plates. Occupied, cutoff-bearing and invalid indices are refused without changing the session. After deletion every later index shifts down by one; inspect `get_plate_info` before further edits. This is session cleanup, not a data purge or a save-time option. `save_nest` lists all session plates in its response, but the `.nest` writer omits empty cutoff-free plates from the serialized file unless one carries clamp settings or clamp removals the saved defaults cannot recreate; reloading may therefore have fewer plates than the response says. There is no opt-in switch to preserve empty plates in the file.
 
 ### MCP engine development harness
 

docs/cutting-planner.md

@@ -106,8 +106,7 @@ the final replay enforce them:
   limited short of an edge, on the sheet edge, stale after a move or in an
   unrecognised program form does not qualify and keeps the crossing rule above.
   Being continuous, a separating line passes through no part. A kept order that cuts
-  it earlier is a constraint conflict naming the separating cutoff (user decision,
-  2026-10-13).
+  it earlier is a constraint conflict naming the separating cutoff.
 - A drawing's break cuts (`LayerType.Break`, see [breakoffs](breakoffs.md)) are open
   cuts inside its material. Preparation keeps them apart from contours (no choices,
   no material); every full and prefix emission cuts them after scribes and before any
@@ -378,7 +377,7 @@ its retention gap, so confirmed-parameters planning refuses it in a planned cont
 
 With confirmed parameters, a locked program (Place Lead-in locks, PEP-imported locked
 parts) is a fixed emission: everything it does after the planner's rapid into it is
-accepted as given (user decision D1a, 2026-10-14). So is each drawing-pinned contour of a
+accepted as given. So is each drawing-pinned contour of a
 regenerated part (see [drawing pins](#drawing-pins)). Their violations are not refusals:
 
 - Its lead-ins and lead-outs meeting another part's material or its own, a rapid inside
@@ -404,8 +403,8 @@ regenerated part (see [drawing pins](#drawing-pins)). Their violations are not r
 ### Drawing pins
 
 A drawing's cut pins (`Drawing.CutPins`, from the drawing library) fix how named contours are
-cut: the entry point, lead-in, lead-out and tab (user decision D1: the drawing wins over the
-plate's settings). Capture resolves each regenerated part's pins against its own rotated
+cut: the entry point, lead-in, lead-out and tab; the drawing's pins take precedence over the
+plate's settings. Capture resolves each regenerated part's pins against its own rotated
 clean contours with `CutPinResolver` and prepares them with
 `PreparedContours.Capture(program, parameters, pins)`:
 
@@ -417,7 +416,7 @@ clean contours with `CutPinResolver` and prepares them with
   The certified tab gap is the pinned outside's own.
 - Unpinned contours on the same part, and every other part, keep the plate's automatic
   selection; a plate without pins plans exactly as before.
-- A pin is never guessed (invariant 5). One that lies on no contour, on several, shares a
+- A pin is never guessed. One that lies on no contour, on several, shares a
   contour with another pin, or cannot be placed on the program leaves its contour automatic
   and adds a `FixedLead` warning naming the pin (`FixedLeadWarning.PinNumber`), for example
   "Drawing pin 2 no longer matches the geometry; planned with nest settings.", which makes the
@@ -432,7 +431,7 @@ clean contours with `CutPinResolver` and prepares them with
   rapids between contours, including the one into a pinned contour, stay strict. Plan
   Cutting does not model clamps, for pinned leads or any other.
 - A placement with `Part.DrawingPinsOff` ignores its drawing's pins and plans entirely from
-  the plate settings, with no warning (D1's per-part escape hatch). `Part.HasActiveDrawingPins`
+  the plate settings, with no warning. `Part.HasActiveDrawingPins`
   is the shared test for "pins apply here".
 - A pinned part is regenerated like any unlocked part, whatever lead-ins or settings it
   carried before. A locked part keeps its exact locked program and warns "Locked lead-ins
@@ -653,9 +652,8 @@ The service does not establish clean-material non-overlap, scrap release by open
 cutoff cuts or sheet edges, or physical retention strength. It does not write CNC
 or set posting consent. A `Ready` proposal can still be unsuitable for cutting.
 
-Later slices route the lead-in side panel's automatic assignment through the planner
-and retire the legacy automatic paths. Windows interaction,
-supplied-job coverage and actual posted order remain separate acceptance gates.
+The lead-in side panel's Auto-Assign Lead-ins remains separate from Plan Cutting.
+Review the desktop preview and the generated CNC output before cutting.
 Fresh [pre-post verification](post-verification.md) is still required; it is not a
 physical safety qualification.
 

docs/geometry/expand-spacing.md

@@ -4,7 +4,7 @@
 
 Every selected/selected and selected/nonselected pair has an operation-entry clearance floor, measured against material with cutouts subtracted. A later move may reuse slack opened by an earlier move, but it cannot reduce a pair below its own starting gap. Existing overlaps are accepted for attempted separation; a remaining overlap is reported as a violation, not a successful positive gap. Geometry whose material side is unresolved at sub-scale is conservatively reported as a violation when native extents intersect; that negative marker is not a measured penetration depth. An unchanged selected part already outside the work area also yields an edge violation and zero credited spacing. Temporarily blocked pairs are retried after another part moves, while a pass without positive movement stops the relaxation. An individual violation's `BlockedByEdge` flag is true only when the work-area edge is the first limiting cause; the desktop status currently displays a blocked-pair count, not those individual causes.
 
-Probes run on scratch poses. Each trial translation is clipped against blocking material along its entire straight path, including cutout walls and regenerated open cut-off paths; a remote cut-off does not pin an unrelated move. Entry floors for open cut-offs use nearest points on every native segment, not a program endpoint or a fictional closing chord. Open paths that strictly enter part material stay as violations even at zero target; boundary contact and paths wholly inside holes remain legal. An open path's broad box is not a blocker when its real segments miss the part. Initially overlapping convex line profiles and complete native disks can take a certified direct separating path, including a safe partial move when the plate edge prevents a full exit; unsupported or ambiguous overlap paths stay put and remain reported. Complete native disks use analytic clearance rather than interpreting a shallow arc overlap as a positive polygon gap. For other curved pairs, a polygon gap inside the combined 0.002-unit chord band is uncertain and conservatively reported as a violation rather than proof of clear material. When a part touches a cutout wall and the usual nearest-boundary direction makes no safe progress, the tool tries the opposite direction through the same checks. Tiny clamp keep-outs use tolerance-free material occupancy and a conservative native-bound motion limit when tolerant geometry cannot certify them. Cancellation before application leaves the live layout unchanged; `Separate` never changes it. A bounded search reports the spacing it found, not an optimum. See `docs/geometry/directional-slides.md` for directional contact behavior.
+Probes run on scratch poses. Each trial translation is clipped against blocking material along its entire straight path, including cutout walls and regenerated open cut-off paths; a remote cut-off does not pin an unrelated move. Entry floors for open cut-offs use nearest points on every native segment, not a program endpoint or a fictional closing chord. Open paths that strictly enter part material stay as violations even at zero target; boundary contact and paths wholly inside holes remain legal. An open path's broad box is not a blocker when its real segments miss the part. Initially overlapping convex line profiles and complete native disks can take a certified direct separating path, including a safe partial move when the plate edge prevents a full exit; unsupported or ambiguous overlap paths stay put and remain reported. Complete native disks use analytic clearance rather than interpreting a shallow arc overlap as a positive polygon gap. For other curved pairs, a polygon gap inside the combined 0.002-unit chord band is uncertain and conservatively reported as a violation rather than proof of clear material. When a part touches a cutout wall and the usual nearest-boundary direction makes no safe progress, the tool tries the opposite direction through the same checks. Tiny clamp keep-outs use tolerance-free material occupancy and a conservative native-bound motion limit when tolerant geometry cannot certify them. Cancellation before application leaves the live layout unchanged; `Separate` never changes it. A bounded search reports the spacing it found, not an optimum. See [directional slides](directional-slides.md) for directional contact behavior.
 
 ## Cancelling a long search
 

docs/geometry/lead-in-placement.md

@@ -61,17 +61,8 @@ windings and a rotation, auto and manual placement from either edge, preview
 agreement, approach-angle handling, the flat-corner clearance fallback, reflex
 notches, and straight lead-outs.
 
-A headless before/after import of `4980 A01 PT07.dxf` (SHA-256
-`1535D77BC1EEEDD21A27E7CE91EA4C51055118D019C5A09C144F1F41740895B6`)
-reproduced the issue on all five 0.282 × 0.532 rectangular cutouts. At the default
-0.125 lead-in length, all five corrected pierce points are approximately 0.08838835
-inside both adjacent edges. The straight segments stay inside the rectangles
-except for their contour endpoints; the other two generated lead-ins remain
-unchanged. Coordinates were compared with a 1e-8 tolerance to allow incremental
-program round-trip floating-point noise. The source drawing is not bundled.
-
-Windows manual acceptance: import the part and use Plate > Assign Lead-ins.
-Confirm diagonal lead-ins at all five small rectangular cutouts. Under Plate >
+Windows manual check: import a part with small rectangular cutouts and use Plate >
+Assign Lead-ins. Confirm diagonal lead-ins at the cutout corners. Under Plate >
 Place Lead-in, select the part, lock a cutout, and hover a corner: the preview
 should point into the cutout and the committed lead-in should match. Hover a
 mid-edge point and confirm perpendicular placement is unchanged. Windows visual

docs/post-verification.md

@@ -34,8 +34,9 @@ findings without a usable location do not invent a marker. Closing the inspector
 clears the highlight and restores the original plate, zoom, and overlap display mode.
 
 Validation does not change placements, programs, lead-ins, or cutting order, save
-the nest, or write CNC output. Spacing to the plate edge and to clamps, and plate
-boundaries, are not checked.
+the nest, or write CNC output. It includes material overlaps with active clamps and
+cut-off or rapid crossings of their footprints, but does not check minimum spacing
+to clamps or plate edges, or whether parts lie within the plate boundaries.
 It does not verify a post processor's final output. Posting still runs its own
 fresh verification and consent flow.
 
@@ -82,7 +83,7 @@ shows the first three check categories, even when there are no findings:
   height/retracts are not modeled, so inspect the emitted route and machine setup.
   A clamp whose footprint covers the program start point warns on every posting
   attempt by design; there is no exemption for the first rapid and no persisted
-  bypass (settled decision D10).
+  bypass.
 - **Fixed leads:** Plan Cutting accepts fixed emissions as given and only warns (see
   [cutting planner](cutting-planner.md#fixed-emissions-warn)), so posting checks them
   again: every lead-in and lead-out of a locked program, and of each contour a part's
@@ -181,7 +182,8 @@ the gate is installed at OpenNest's desktop and console posting entry points.
 ## Selected post and cut order
 
 Cincinnati CI Fiber preserves the placed part/contour order and pierce positions
-used by this check. The older Cincinnati CL post sorts parts and moves cutoffs;
+used by this check. Cincinnati CL keeps placed part order, including cut-offs, but
+puts etch features before cut features and can add subprogram routing moves;
 Gravograph builds and optimizes separate tool passes. Those two posts, and unknown
 plugins, therefore show an additional **incomplete final rapid sequence** warning
 requiring acknowledgment even if the nest-level checks have no findings. This
@@ -209,9 +211,9 @@ The overlap diagnostic's documented numeric/tessellation limits also apply.
 
 Future hardening should inspect a shared post-specific emitted motion stream,
 including controller retracts and final parking, rather than pretending direct XY
-geometry proves physical head clearance. The [fixed-program route foundation](cutting-planner.md)
-reuses these motion/completion checks but is not yet a desktop planner or an Apply
-API; its route-only `Ready` result does not replace fresh posting review.
+geometry proves physical head clearance. The [cutting planner](cutting-planner.md)
+reuses these motion/completion checks and provides the desktop preview and Apply
+workflow; applying a plan does not replace fresh posting review.
 
 ## Verification on Windows