docs: release v1.1.0 — accurate counts, changelog, audit report

- pyproject: version 1.0.0 -> 1.1.0
- README: 110 tools / 5 resources (was 87 / 6), 318 tests, new "Closed-Loop
  Quality Gate" highlight, Engineering + Premium tool categories, refreshed
  roadmap (1.1 shipped; 1.2 closed-loop moat; 1.3 ISO production).
- CHANGELOG: comprehensive [1.1.0] entry (Added/Changed/Fixed/Security).
- CLAUDE.md: drop removed CommandResult dataclass; ~110 tool count.
- docs/analysis/03-AUDIT-VERIFICATION.md: the verified audit + fix plan.

CHANGELOG.md

@@ -7,36 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+_Next: 1.2 — closed-loop validation moat (scalar drawing-score, pre-plan clarification, iterative refiner + transaction-stack isolation)._
+
+## [1.1.0] — 2026-06-19
+
+Correctness, cross-backend parity, and an **enforced** quality gate, landed across four audited
+sprints (see `docs/analysis/`). 318 tests, ruff-clean.
+
 ### Added
-- Security module (`security.py`) with path traversal protection and command injection prevention
-- Centralized configuration (`config.py`) with environment variable support
-- `.env.example` for environment variable documentation
-- Path validation for all file operations (`drawing_open`, `drawing_save`, `drawing_export_*`)
-- Command sanitization for `system_run_command` and `system_run_lisp`
-- Ruff linting configuration in `pyproject.toml`
-- Pre-commit hooks (`.pre-commit-config.yaml`) for automated code quality
-- pytest-cov for test coverage reporting
-- Comprehensive test suite: 95 tests across 7 test files
-  - `test_entity_creation.py` — 13 entity creation tests
-  - `test_drawing.py` — 8 drawing operation tests
-  - `test_dimensions.py` — 5 dimension tests
-  - `test_layer_block.py` — 12 layer and block tests
-  - `test_analysis.py` — 12 analysis and modification tests
-  - `test_security.py` — 29 security tests
-- GitHub Actions CI workflow (lint + test on Python 3.11/3.12)
-- README.md with full documentation
-- CHANGELOG.md
-- `.gitignore`
+- **Premium drafting workflow** (shared across both backends): `drawing_plan`, `drawing_critique`
+  (ISO-128 focuses), `point_from_snap`, `drawing_apply_iso_layers`, `dimension_auto`,
+  `entity_select_smart`, `construction_xline` / `construction_clear`.
+- **Deterministic geometry** for exact OSNAP coordinates: `point_intersection`
+  (line/line, line/circle, circle/circle) and `point_tangent` (external point → circle).
+- **Engineering / deterministic CAD layer**: involute gear front view + section A-A,
+  DIN 6885 keyed bore, ISO A3 title block, and the 8-step `drawing_finalize` validator.
+- **HTTP bearer-token auth**: `StaticTokenVerifier` wired into FastMCP when `MCP_AUTH_TOKEN` is set.
+- Mocked-COM test harness (`tests/test_com_backend.py` + Sprint-3/4 suites) — COM logic is now
+  regression-tested on Linux CI without a live AutoCAD.
+- `entity_create_mtext` rotation parameter; `dimension_auto` layer override; `bounding_box` /
+  ARC `length` / TEXT-MTEXT `rotation`+`char_height` on both backends; `BlockInfo.description`.
+- Security module (`security.py`), centralized config (`config.py`), `.env.example`, path
+  validation, command/LISP sanitization, ruff config, pre-commit hooks, pytest-cov, GitHub Actions CI.
 
 ### Changed
-- All silent `except Exception: pass` blocks now include logging
-- Removed unused imports across all source files
-- Renamed ambiguous variable `l` to `lyr` in layer iteration code
-- Import sorting organized with ruff isort rules
+- **`drawing_finalize` now enforces the premium critique** in addition to the structural validator:
+  leftover construction geometry, non-ISO-128 lineweights, untrimmed corners, duplicate entities,
+  and dimension overlap block the gate (was advisory-only). `strict_critique=True` fails on warnings too.
+- **`drawing_save_as` derives the on-disk format from the file extension** — `part.dxf` writes DXF,
+  not DWG. ezdxf refuses to mislabel a `.dwg` file.
+- Dimension and construction layers resolve from the active layer set (iso13567 → `M-DIMEN-T-N` /
+  `M-CONST-E-N`, not the hardcoded `DIM` / `CONSTRUCTION`).
+- Premium meta-tools lifted into the shared `AutoCADBackend` base class (single source of truth).
+- Dead code removed (`section.py`, `generate_tooth_profile`, `CommandResult`, `set_layer_active`, …).
 
 ### Fixed
-- `_detect_autocad_running` now logs detection failures instead of silently swallowing them
-- Resource functions now log errors before returning error JSON
+- ezdxf `dimension_aligned` / `dimension_angular` raised `TypeError` (wrong ezdxf 1.4 args) — fixed.
+- Full-circle polar array placed a duplicate copy over the original — fixed (divisor = count).
+- `entity_offset` ignored `side_x`/`side_y` on both backends — now honored (and COM no longer leaks extras).
+- COM `entity_create_hatch` built an associative hatch then deleted its boundary — now non-associative.
+- Lineweight mm-vs-hundredths truncation wiped ISO-128 weights — fixed via `normalize_lineweight`.
+- **`view_screenshot` / `drawing_export_pdf` could SIGSEGV** (matplotlib GUI backend in a worker thread)
+  — now render headless via `Agg` (`Figure` + `FigureCanvasAgg`).
+- `entity_select_smart` `length_range` silently rejected all ARCs (no `length`) — fixed.
+- Gear tooth profile self-overlapped for high tooth counts (z ≥ ~42); section view drew duplicate
+  bore lines; validator keyway heuristic was a permanent false-negative — all fixed.
+- COM `system_run_lisp` always reported `"nil"`; `system_set_variable` didn't coerce numeric sysvars
+  — fixed. `system_about` tool groups / `_registered_tool_count` no longer drift or surface `-1`.
+- `drawing_new` bootstrap failures now surface as `degraded` instead of reporting success.
+
+### Security
+- HTTP remote-bind guard now fires on **every** launch path (including `fastmcp run server.py:mcp`),
+  not only the `__main__` block — closing an anonymous-remote-bind gap.
+- AutoLISP allowlist bypass-vector regression tests (newline injection, symbol aliasing, `vla*`/`acet-*`,
+  `c:` custom commands).
+- COM apartment leak bounded (`CoUninitialize` on teardown); transaction commit/rollback and
+  `system_run_lisp` now respect the CMDACTIVE guard.
 
 ## [1.0.0] — 2026-03-01