fix(geometry): one MAX_PLACEMENT_DEPTH, and it is 100 not 32 (#2873) (#2969)

Two constants bounded the SAME `IfcLocalPlacement.PlacementRelTo` walk with
different values. `router::transforms` (mesh path) capped at 32,
`profile_extractor` (2D drawing path) at 100, and both exceed-branches return
`Matrix4::identity()`. So an element on a 33-to-101-link chain was composed in
full by one path and flattened by the other: the same element in two places, no
error from either side.

## The decision: 100 survives, 32 does not

The 32 carried the only stated rationale — "keep low for WASM, each frame uses
~2KB+ of stack with Matrix4<f64> locals". Checked rather than repeated:

  - The stack budget is 8 MiB. `-C link-arg=-zstack-size=8388608` in
    `.cargo/config.toml` and in both extra bundles in `scripts/build-wasm.sh`;
    geometry web workers each instantiate their own module, so none gets a
    smaller one. Native hosts give the geometry pool 256 MiB (`rust/ffi`,
    `rust/python`).
  - Frames measured, not assumed: a stack-address probe at each recursion level
    over a synthetic chain gives 944 B/frame for the router walk and 1008 B for
    the extractor's, unoptimised aarch64. 101 frames = 100,800 B — 1.2% of the
    wasm stack. Measured native; NOT measured on wasm32 (the shipped bundle has
    its name section stripped).
  - Fan-out is 1. `PlacementRelTo` is a single reference, so this walk costs
    O(depth), not the O(k^depth) that makes a depth cap the wrong instrument
    elsewhere (AGENTS.md).

The two candidates are not symmetric, which is what decides it. Equalising UP
lets the mesh path compose chains it currently flattens. Equalising DOWN would
make the 2D path START flattening chains it composes correctly today — a new
silent truncation, bought for 68 frames (~68 KB) of stack that is not scarce.

Corpus, so the risk of either direction is quantified rather than asserted: over
the 111 files in `tests/models` that contain placements, the deepest chain is 7
links (deepest: 7, `ara3d/ISSUE_021_Mini Project.ifc`). Zero files exceed 16.
Neither cap binds on any fixture, so no fixture's geometry moves either way.

## What is NOT fixed here

Both sites still fall back to a silent identity. On a chain past the cap the
geometry is placed wrongly with nothing reported, which is the failure mode the
#2866 family spent a week converting into catchable errors elsewhere. Making it
loud is a larger behaviour change than #2873 asked for and is deliberately left
out; this change makes the two paths wrong in the SAME way rather than in two
different ways.

## Tests

Following #2955: one `pub const` in `ifc_lite_core::limits`, and a test at EACH
site asserting its constant IS the shared one — sharing alone does not stop a
private copy shadowing the import. Mutation-verified, both directions:

  private `= 32` back in the router     -> the_router_cap_is_the_shared_cap FAILS
  private `= 50` back in the extractor  -> the_profile_extractor_cap_... FAILS

plus a test that pins the divergence itself: a chain longer than the cap must
give the same transform from both walks. RED before the fix, verbatim:

  assertion `left == right` failed: the mesh path and the 2D drawing path must
  place a 109-link chain identically; they differ by 68 links of translation,
  and neither reports an error
    left: 33.0
   right: 101.0

The fixture translates +1 X per link so the composed X literally counts the
placements each walk composed, and each walk gets its own decoder — the router
memoises composed placements, and a shared decoder would hand walk one's answer
to walk two.

`ifc-lite-geometry` 932 passed / 0 failed / 27 ignored, `ifc-lite-core` 159
passed / 0 failed, module_size_ratchet 5 passed (profile_extractor.rs 757 lines,
budget 758, unchanged), `cargo clippy --workspace --all-targets -D warnings`
clean.

Author: BIMvoice

.changeset/placement-depth-cap-unify.md

@@ -0,0 +1,5 @@
+---
+'@ifc-lite/geometry': patch
+---
+
+Raise the mesh path's `IfcLocalPlacement.PlacementRelTo` depth cap from 32 to 100, matching the 2D drawing path, and make the two share one constant (`ifc_lite_core::limits::MAX_PLACEMENT_DEPTH`). The two walks follow the same attribute of the same entity and both return the IDENTITY on exceeding their cap, so an element on a 33-to-101-link placement chain was composed in full by the 2D profile extractor and flattened by the router — the same element drawn in two different places, with no error from either side. The cap's stated basis for 32 ("keep low for WASM — each frame uses ~2KB+ of stack") does not hold against the linked stack budget: every wasm bundle is built with `-zstack-size=8388608`, and the walk's frames measure ~1KB in an unoptimised native build, so the deeper cap's worst case is around 1% of the 8MiB stack; `PlacementRelTo` is a single reference, so the walk has fan-out 1 and costs O(depth). Chains beyond the cap are still truncated silently, exactly as before — only the depth at which that happens changes, and it now happens at the same depth on both paths. No file in the `tests/models` corpus has a chain deeper than 7 links, so no fixture's geometry moves. New tests pin each site's cap to the shared constant and require both walks to return the same transform for a chain past it.

rust/core/src/lib.rs

@@ -89,7 +89,7 @@ pub use fast_parse::{
 };
 pub use generated::{IfcType, IFC_TYPES};
 pub use georef::{GeoRefExtractor, GeoRefSource, GeoReference, RtcOffset};
-pub use limits::MAX_MAPPED_ITEM_DEPTH;
+pub use limits::{MAX_MAPPED_ITEM_DEPTH, MAX_PLACEMENT_DEPTH};
 pub use legacy_entities::{
     get_legacy_entity_info, is_legacy_entity, map_legacy_to_base_type, LegacyEntityInfo,
 };

rust/core/src/limits.rs

@@ -36,6 +36,41 @@
 /// sufficient (see the module docs above for which kind).
 pub const MAX_MAPPED_ITEM_DEPTH: u32 = 32;
 
+/// Maximum `IfcLocalPlacement.PlacementRelTo` chain any walk in this workspace
+/// will follow. A chain longer than this composes only its first
+/// `MAX_PLACEMENT_DEPTH + 1` placements and the rest is dropped — silently, on
+/// every site that uses it.
+///
+/// Shared because two walks follow the SAME attribute of the SAME entity and
+/// their bounds must agree: `ifc_lite_geometry::router::transforms` (the mesh
+/// path) and `ifc_lite_geometry::profile_extractor` (the 2D drawing path).
+/// They disagreed — 32 against 100 — and because both exceed-branches return
+/// the IDENTITY rather than an error, an element on a 33-to-101-link chain was
+/// drawn in two different places by the two paths with nothing reported. #2873
+///
+/// ## Why 100 and not 32
+///
+/// The 32 carried the rationale "keep low for WASM — each frame uses ~2KB+ of
+/// stack". The wasm bundles are linked with `-zstack-size=8388608`
+/// (`.cargo/config.toml` and both extra bundles in `scripts/build-wasm.sh`), so
+/// the budget is 8 MiB and the cap's own worst case is ~0.1% of it; native
+/// hosts give the geometry pool 256 MiB (`rust/ffi`, `rust/python`). Measured
+/// rather than assumed: see the frame figures in #2873. `PlacementRelTo` is a
+/// single reference, so this walk has fan-out 1 and costs O(depth) — the
+/// breadth blow-up that makes a depth cap the wrong instrument elsewhere (see
+/// AGENTS.md) does not apply here.
+///
+/// The two candidates are not symmetric. Equalising UP lets the mesh path
+/// compose chains it currently flattens; equalising DOWN would make the 2D path
+/// start flattening chains it composes correctly today, silently. Across the
+/// 111 fixtures in `tests/models` that contain placements the deepest chain is
+/// 7 links, so neither value binds on any file in the corpus and the choice is
+/// decided entirely by which failure is worse on a file that does exceed it.
+///
+/// This bounds one path's LENGTH only. A walk over a chain that can revisit
+/// also needs a cycle guard; see the module docs above.
+pub const MAX_PLACEMENT_DEPTH: usize = 100;
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -47,4 +82,12 @@ mod tests {
     fn mapped_item_depth_is_the_documented_32() {
         assert_eq!(MAX_MAPPED_ITEM_DEPTH, 32);
     }
+
+    /// The documented contract, pinned separately from the two sites that
+    /// import it — those assert they ARE this constant, which cannot also pin
+    /// its value.
+    #[test]
+    fn placement_depth_is_the_documented_100() {
+        assert_eq!(MAX_PLACEMENT_DEPTH, 100);
+    }
 }

rust/geometry/src/profile_extractor.rs

@@ -19,6 +19,7 @@
 
 use crate::profiles::ProfileProcessor;
 use crate::{Error, Point3, Result, TessellationQuality, Vector3};
+pub(crate) use ifc_lite_core::MAX_PLACEMENT_DEPTH;
 use ifc_lite_core::{
     build_entity_index, AttributeValue, DecodedEntity, EntityDecoder, EntityScanner, IfcSchema,
     IfcType,
@@ -519,9 +520,8 @@ fn get_placement_transform(
     }
 }
 
-const MAX_PLACEMENT_DEPTH: usize = 100;
-
-fn get_placement_recursive(
+/// `pub(crate)` so the #2873 divergence test can drive this walk and the mesh path's.
+pub(crate) fn get_placement_recursive(
     placement: &DecodedEntity,
     decoder: &mut EntityDecoder,
     depth: usize,

rust/geometry/src/router/transforms/mod.rs

@@ -43,6 +43,10 @@ pub(crate) fn cartesian_point_at(
 
 mod parsers;
 
+#[cfg(test)]
+#[path = "placement_depth_tests.rs"]
+mod placement_depth_tests;
+
 use super::GeometryRouter;
 use crate::{Mesh, Result, SubMeshCollection};
 use ifc_lite_core::{DecodedEntity, EntityDecoder, IfcType};
@@ -256,8 +260,8 @@ impl GeometryRouter {
 
     /// Recursively resolve placement hierarchy
     ///
-    /// Uses a depth limit (100) to prevent stack overflow on malformed files
-    /// with circular placement references or extremely deep hierarchies.
+    /// Bounded by [`Self::MAX_PLACEMENT_DEPTH`] so a malformed file with a
+    /// circular or absurdly deep placement hierarchy cannot overflow the stack.
     pub(super) fn get_placement_transform(
         &self,
         placement: &DecodedEntity,
@@ -267,8 +271,12 @@ impl GeometryRouter {
     }
 
     /// Internal helper with depth tracking to prevent stack overflow.
-    /// Keep low for WASM — each frame uses ~2KB+ of stack with Matrix4<f64> locals.
-    const MAX_PLACEMENT_DEPTH: usize = 32;
+    ///
+    /// The bound is [`ifc_lite_core::limits::MAX_PLACEMENT_DEPTH`], shared with
+    /// `profile_extractor`'s walk over the same attribute. It was a private 32
+    /// against that walk's 100, and since both exceed-branches return the
+    /// identity the two paths drew a deep chain in two places, silently. #2873
+    pub(super) const MAX_PLACEMENT_DEPTH: usize = ifc_lite_core::MAX_PLACEMENT_DEPTH;
 
     pub(super) fn get_placement_transform_with_depth(
         &self,

rust/geometry/src/router/transforms/placement_depth_tests.rs

@@ -0,0 +1,136 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+//! The `IfcLocalPlacement.PlacementRelTo` walk is implemented twice — once in
+//! `router::transforms` (mesh path) and once in `profile_extractor` (2D drawing
+//! path) — and both bound it with a depth cap whose exceed-branch returns the
+//! IDENTITY. Two caps over one chain therefore do not disagree loudly: they
+//! disagree by putting the same element in two different places, with no error
+//! on either side. #2873
+//!
+//! These tests pin (a) each site's cap IS `ifc_lite_core::limits::MAX_PLACEMENT_DEPTH`
+//! and (b) the two walks agree on a chain deeper than that cap. (a) alone is not
+//! enough: a private `const MAX_PLACEMENT_DEPTH` shadows the import and nothing
+//! else notices, which is exactly how #2955's mapped-item family failed.
+
+use super::*;
+use ifc_lite_core::limits::MAX_PLACEMENT_DEPTH;
+use ifc_lite_core::EntityDecoder;
+
+/// `links` chained `IfcLocalPlacement`s, each translating +1.0 in X, so the
+/// composed world X of the deepest one equals the number of placements the walk
+/// actually composed. That makes the truncation directly readable off the
+/// result instead of inferred.
+///
+/// Ids: `#1` axis placement, `#2` its origin, `#10..=#(10 + links)` the chain
+/// (`#10` is the root, `#(10 + links)` the leaf).
+fn deep_placement_chain(links: usize) -> String {
+    let mut s = String::from(
+        "ISO-10303-21;\nHEADER;\nFILE_DESCRIPTION((''),'2;1');\n\
+FILE_NAME('t.ifc','2024-01-01T00:00:00',(''),(''),'','','');\n\
+FILE_SCHEMA(('IFC4'));\nENDSEC;\nDATA;\n\
+#1=IFCAXIS2PLACEMENT3D(#2,$,$);\n\
+#2=IFCCARTESIANPOINT((1.,0.,0.));\n\
+#10=IFCLOCALPLACEMENT($,#1);\n",
+    );
+    for i in 1..=links {
+        s.push_str(&format!("#{}=IFCLOCALPLACEMENT(#{},#1);\n", 10 + i, 9 + i));
+    }
+    s.push_str("ENDSEC;\nEND-ISO-10303-21;\n");
+    s
+}
+
+/// World X of the leaf of a `links`-long chain, from each of the two walks.
+/// Each walk gets its OWN decoder: the router memoises composed placements on
+/// the decoder, and sharing one would let the first walk's answer be handed to
+/// the second, which is the one thing this test must not do.
+fn both_walks(links: usize) -> (f64, f64) {
+    let content = deep_placement_chain(links);
+    let leaf_id = (10 + links) as u32;
+
+    let mut router_decoder = EntityDecoder::new(&content);
+    let leaf = router_decoder.decode_by_id(leaf_id).expect("leaf placement");
+    let router = GeometryRouter::new();
+    let router_x = router
+        .get_placement_transform(&leaf, &mut router_decoder)
+        .expect("router placement transform")
+        .column(3)[0];
+
+    let mut extractor_decoder = EntityDecoder::new(&content);
+    let leaf = extractor_decoder
+        .decode_by_id(leaf_id)
+        .expect("leaf placement");
+    let extractor_x =
+        crate::profile_extractor::get_placement_recursive(&leaf, &mut extractor_decoder, 0)
+            .column(3)[0];
+
+    (router_x, extractor_x)
+}
+
+/// A chain the walk composes in full: both must report every link, which also
+/// proves the fixture measures what it claims before the truncation cases use it.
+#[test]
+fn both_walks_compose_a_chain_inside_the_cap_identically() {
+    let links = MAX_PLACEMENT_DEPTH / 2;
+    let (router_x, extractor_x) = both_walks(links);
+    let expected = (links + 1) as f64;
+    assert_eq!(
+        router_x, expected,
+        "the router must compose all {} placements of an in-cap chain",
+        links + 1
+    );
+    assert_eq!(
+        extractor_x, expected,
+        "the extractor must compose all {} placements of an in-cap chain",
+        links + 1
+    );
+}
+
+/// THE divergence. A chain longer than the shared cap is truncated by both
+/// walks, and truncation is silent on both — so the only thing that can make
+/// the mesh path and the 2D path put an element in the same place is the two
+/// caps being equal. With the router at 32 and the extractor at 100 this
+/// returned 33.0 and 41.0 for a 40-link chain: same file, same element, two
+/// positions, no error.
+#[test]
+fn both_walks_truncate_a_chain_beyond_the_cap_at_the_same_link() {
+    let links = MAX_PLACEMENT_DEPTH + 8;
+    let (router_x, extractor_x) = both_walks(links);
+    assert_eq!(
+        router_x, extractor_x,
+        "the mesh path and the 2D drawing path must place a {}-link chain \
+         identically; they differ by {} links of translation, and neither \
+         reports an error",
+        links + 1,
+        (router_x - extractor_x).abs()
+    );
+    assert_eq!(
+        router_x,
+        (MAX_PLACEMENT_DEPTH + 1) as f64,
+        "the cap admits depths 0..=MAX_PLACEMENT_DEPTH, i.e. MAX_PLACEMENT_DEPTH + 1 placements"
+    );
+}
+
+/// Site 1 of 2. Sharing the constant removes today's drift; this stops a
+/// private copy from reintroducing it. #2955 proved the need by mutation: a
+/// local `const` shadowed the import and 800 tests stayed green.
+#[test]
+fn the_router_cap_is_the_shared_cap() {
+    assert_eq!(
+        GeometryRouter::MAX_PLACEMENT_DEPTH,
+        MAX_PLACEMENT_DEPTH,
+        "router::transforms must bound PlacementRelTo with ifc_lite_core::limits::MAX_PLACEMENT_DEPTH"
+    );
+}
+
+/// Site 2 of 2. See above.
+#[test]
+fn the_profile_extractor_cap_is_the_shared_cap() {
+    assert_eq!(
+        crate::profile_extractor::MAX_PLACEMENT_DEPTH,
+        MAX_PLACEMENT_DEPTH,
+        "profile_extractor must bound PlacementRelTo with ifc_lite_core::limits::MAX_PLACEMENT_DEPTH"
+    );
+}
+