Add independent native document panes and satellite windows

.github/workflows/ci.yml

@@ -17,8 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Test product version synchronization
+        run: python3 native/packaging/test-classic-version.py
       - name: Check the version
         run: bash native/packaging/set-version.sh check
+      - name: Test the release signing gate
+        run: python3 native/packaging/test-require-signatures.py
 
   native:
     strategy:

.github/workflows/classic-check.yml

@@ -0,0 +1,36 @@
+name: Classic package metadata
+
+on:
+  pull_request:
+    paths:
+      - 'classic/**'
+      - 'native/packaging/*version*'
+      - '.github/workflows/classic-check.yml'
+  workflow_dispatch:
+
+jobs:
+  windows:
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: classic
+    env:
+      # The pinned public UI dependency must not need an SSH account.
+      GIT_CONFIG_COUNT: '1'
+      GIT_CONFIG_KEY_0: url.https://github.com/.insteadOf
+      GIT_CONFIG_VALUE_0: ssh://git@github.com/
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: classic/package-lock.json
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install locked frontend dependencies
+        run: npm ci
+      - name: Check all product version fields
+        working-directory: .
+        run: bash native/packaging/set-version.sh check
+      - name: Build Windows MSI and NSIS without publishing
+        run: npm exec tauri build -- --bundles msi,nsis

.github/workflows/packages.yml

@@ -720,7 +720,7 @@ jobs:
           sudo apt-get update
           # The MIME database first, so that installing the package triggers it.
           sudo apt-get install -y shared-mime-info libglib2.0-bin desktop-file-utils appstream \
-            xvfb mesa-vulkan-drivers libegl1 libgl1-mesa-dri fuse3 python3-venv
+            xvfb mesa-vulkan-drivers libegl1 libgl1-mesa-dri fuse3 python3-venv labwc
       - name: Install the .deb
         run: sudo apt-get install -y "./packages/open-pointcloud-studio_${NUMBER}_${ARCH}.deb"
       - name: Smoke-test the installed application
@@ -791,6 +791,12 @@ jobs:
           xvfb-run -a -s '-screen 0 1440x900x24' python3 native/packaging/gui-smoke.py \
             "packages/open-pointcloud-studio_${NUMBER}_${ARCH}.AppImage" --version "$NUMBER" \
             --screenshot "screenshots/appimage-$ARCH.png"
+      - name: Managed native app on Wayland without a GPU or FUSE
+        run: |
+          bash native/packaging/managed-wayland-smoke.sh \
+            "$RUNNER_TEMP/appimage/squashfs-root/AppRun" "screenshots/managed-$ARCH"
+          bash native/packaging/managed-wayland-smoke.sh \
+            "$RUNNER_TEMP/appimage/squashfs-root/AppRun" "screenshots/managed-paused-$ARCH" --paused-access
       - name: Start the archive binary
         run: |
           tar -xzf "packages/open-pointcloud-studio_${NUMBER}_linux-${ARCH}.tar.gz"

.github/workflows/release.yml

@@ -194,6 +194,7 @@ jobs:
       packages: write
     outputs:
       gpg_signed: ${{ steps.gpg.outputs.gpg_signed }}
+      updater_signed: ${{ steps.updater.outputs.updater_signed }}
     env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ needs.prepare.outputs.tag }}
@@ -227,41 +228,6 @@ jobs:
           [[ "$missing" -eq 0 ]]
           for sum in *.sha256; do sha256sum -c "$sum"; done
           ls -l
-      # A release whose application is signed never ships a library that is
-      # not; a draft run only warns, so that it can be looked at.
-      - name: Check that the libraries are signed as the applications are
-        env:
-          WINDOWS_SIGNED: ${{ needs.packages.outputs.windows_signed }}
-          MACOS_SIGNED: ${{ needs.packages.outputs.macos_signed }}
-          SDK_WINDOWS_SIGNED: ${{ needs.sdk.outputs.windows_signed }}
-          SDK_MACOS_SIGNED: ${{ needs.sdk.outputs.macos_signed }}
-          DRAFT_ONLY: ${{ inputs.draft_only }}
-        run: |
-          {
-            echo "### Signing gate"
-            echo
-            echo "| Files | Signed |"
-            echo "| --- | --- |"
-            echo "| Windows application and installer | ${WINDOWS_SIGNED:-false} |"
-            echo "| ops_pointcloud.dll | ${SDK_WINDOWS_SIGNED:-false} |"
-            echo "| macOS application and disk image | ${MACOS_SIGNED:-false} |"
-            echo "| libops_pointcloud.dylib | ${SDK_MACOS_SIGNED:-false} |"
-          } >> "$GITHUB_STEP_SUMMARY"
-          problems=()
-          if [[ "$WINDOWS_SIGNED" == true && "$SDK_WINDOWS_SIGNED" != true ]]; then
-            problems+=("the Windows application is signed, ops_pointcloud.dll is not")
-          fi
-          if [[ "$MACOS_SIGNED" == true && "$SDK_MACOS_SIGNED" != true ]]; then
-            problems+=("the macOS application is signed and notarized, libops_pointcloud.dylib is not")
-          fi
-          for problem in "${problems[@]}"; do
-            if [[ "$DRAFT_ONLY" == true ]]; then
-              echo "::warning::$problem"
-            else
-              echo "::error::$problem"
-            fi
-          done
-          [[ ${#problems[@]} -eq 0 || "$DRAFT_ONLY" == true ]]
       - name: Write SHA256SUMS
         working-directory: assets
         run: |
@@ -283,6 +249,29 @@ jobs:
           else
             echo "OpenPGP: not signed; the key of the organisation is not configured." >> "$GITHUB_STEP_SUMMARY"
           fi
+      # The signature the OpenAEC Installer checks before a silent update, on
+      # the files as they are published: after Authenticode and OpenPGP.
+      - name: Sign the installers for the OpenAEC Installer
+        id: updater
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          bash native/packaging/sign-updates.sh assets "$NUMBER"
+          if grep -qxF updater_signed=true "$GITHUB_OUTPUT"; then
+            echo "Updater: the Windows setup and the AppImages carry a .sig for the OpenAEC Installer." >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "Updater: not signed; the updater key is not configured." >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - name: Require signatures before creating or publishing a release
+        env:
+          WINDOWS_SIGNED: ${{ needs.packages.outputs.windows_signed }}
+          MACOS_SIGNED: ${{ needs.packages.outputs.macos_signed }}
+          SDK_WINDOWS_SIGNED: ${{ needs.sdk.outputs.windows_signed }}
+          SDK_MACOS_SIGNED: ${{ needs.sdk.outputs.macos_signed }}
+          LINUX_GPG_SIGNED: ${{ steps.gpg.outputs.gpg_signed }}
+          DRAFT_ONLY: ${{ inputs.draft_only }}
+        run: bash native/packaging/require-signatures.sh
       # Every Linux package and Linux archive of the C library gets a build
       # attestation, signed through Sigstore and kept by GitHub. `gh
       # attestation verify FILE --repo OWNER/REPO --signer-workflow
@@ -323,6 +312,7 @@ jobs:
         working-directory: assets
         env:
           KEEP_SIGNATURES: ${{ steps.gpg.outputs.gpg_signed }}
+          KEEP_UPDATER_SIGNATURES: ${{ steps.updater.outputs.updater_signed }}
         run: |
           for name in $(bash ../native/packaging/expected-assets.sh "$NUMBER"); do
             gh release upload "$TAG" "$name" "$name.sha256" --clobber --repo "$GITHUB_REPOSITORY"
@@ -336,6 +326,7 @@ jobs:
       - name: Remove the files of an earlier run from the draft
         env:
           KEEP_SIGNATURES: ${{ steps.gpg.outputs.gpg_signed }}
+          KEEP_UPDATER_SIGNATURES: ${{ steps.updater.outputs.updater_signed }}
         run: bash native/packaging/prune-release-assets.sh "$TAG" "$NUMBER"
       - name: Publish the release
         if: ${{ !inputs.draft_only }}
@@ -694,3 +685,44 @@ jobs:
           cat "$record" >> "$GITHUB_STEP_SUMMARY"
           gh release upload "$TAG" "$record" "$record.sha256" --clobber --repo "$GITHUB_REPOSITORY"
           [[ "$RESULT" == success ]]
+
+  # The latest.json the OpenAEC Installer reads, made with the release kit of
+  # the installer once the release is public (OpenAEC-Foundation/OpenAEC-Blueprint#33).
+  # It checks every .sig against UPDATER_PUBKEY and the tag against the
+  # version in native/Cargo.toml, and is attached last: until then no
+  # installer offers the update. A release published by this workflow starts
+  # no other workflow, so this is a job here and not a workflow of its own.
+  updater-manifest:
+    needs: [prepare, publish]
+    if: ${{ !cancelled() && !inputs.draft_only && needs.publish.result == 'success' && needs.publish.outputs.updater_signed == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      TAG: ${{ needs.prepare.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch the release kit
+        uses: actions/checkout@v4
+        with:
+          repository: OpenAEC-Foundation/openaec-installer
+          ref: main
+          path: .release-kit
+          sparse-checkout: release-kit
+      - name: Only a published release
+        run: |
+          state=$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isDraft,isPrerelease --jq '"\(.isDraft) \(.isPrerelease)"')
+          [ "$state" = "false false" ] || { echo "::error::$TAG is a draft or pre-release; no latest.json"; exit 1; }
+      - name: Make latest.json (checks every signature)
+        run: |
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir updates \
+            --pattern '*_x64-setup.exe' --pattern '*_x64-setup.exe.sig' \
+            --pattern '*.AppImage' --pattern '*.AppImage.sig'
+          node .release-kit/release-kit/latest-json.mjs \
+            --repo "$GITHUB_REPOSITORY" --tag "$TAG" --dir updates \
+            --pubkey "${{ vars.UPDATER_PUBKEY }}" --version-file native/Cargo.toml \
+            --notes "See https://github.com/$GITHUB_REPOSITORY/releases/tag/$TAG" \
+            --out latest.json
+      - name: Attach latest.json last
+        run: gh release upload "$TAG" latest.json --repo "$GITHUB_REPOSITORY" --clobber

CHANGELOG.md

@@ -17,6 +17,13 @@ section its version and date.
 
 ## Unreleased
 
+- The main-window pane layout, scans and model/photo cameras return after restarting. Detached documents return to the main window.
+
+- Side-by-side model, photo and drawing panes keep their own cameras. Documents can open in separate windows and dock back into the main window; closing the main window closes them together.
+
+- Feedback in the title strip opens a native private Open Feedback Studio form. It sends the entered message and optional reply email with the app version, retains the draft on failure, and attaches no scans, paths, screenshots or logs.
+- The MCP server checkbox at the bottom right allows or pauses external MCP/API commands and remembers the choice. Extension runs and jobs already started continue. API revision 13 reports the bridge state as `mcp_enabled`.
+
 ## 2026.45.1 - 2026-11-03
 
 - E57 exports now retain station photos, spherical and cylindrical panoramas, masks, camera poses and scan associations after filtering, section export and colouring points from photos. Edits that cannot preserve camera poses fail explicitly instead of silently dropping the images.