fix: seven defects an adversarial audit found, and the gates that missed them

Every one of these was reported ok/clean to the caller while being wrong.

Silently wrong numbers
- selection_filter(min_area) read `entity.dxf.get("area", 0.0)` for SOLID,
  TRACE and HATCH, none of which carry that attribute, so every hatch
  measured 0.0. A 1600 mm^2 hatch was excluded by min_area=1.0 while
  `filtered_by` asserted the filter had run, and COM (which reads ActiveX
  .Area) returned a different selection for the same call. It now answers
  from the measurement `entity_measure` uses, so the two cannot disagree.
- Every headless dimension rendered through ezdxf's bare `Standard` style:
  1.0 mm text with a comma decimal marker, against ISO 3098's 2.5 mm minimum
  and ISO 129's point -- while the document header itself said $DIMTXT 2.5.
  `ezdxf.new(setup=True)` is not the fix; measured, it renders a 100 mm
  dimension as "10000". The attributes are now stored explicitly.
- Saving writes `dimrnd = 0.0` onto the Standard style, and ezdxf applies
  `xround(value, dimrnd)` whenever the attribute is present at all --
  `xround(33.333, 0.0)` is 33. So on any reopened file, including one this
  server saved, every dimension was rounded to a whole unit before DIMDEC
  formatted it: a 12.75 mm feature dimensioned 13. AutoCAD means DIMRND 0 as
  *no* rounding; the sentinel is now discarded at every load site, and a real
  0.5 mm rounding is left alone.
- The DIM* header fold gave out-of-range values teeth they did not have when
  they died in the header: dim_decimals=-1 returned ok and then killed the
  next dimension with `ValueError: Format specifier missing precision` from
  inside ezdxf, and 40 printed forty digits of float noise onto the sheet.
  Ranges are now AutoCAD's own (DIMDEC 0-8, DIMZIN 0-15, lengths positive).

Security
- security.py recorded the policy as "sanitize_command and sanitize_lisp each
  have exactly ONE caller ... the policy is scoped to the CHANNEL". The
  premise was false. `_ensure_linetype_loaded` and `ComBackend.linetype_load`
  build `_-LINETYPE _LOAD {name} {file}` and hand it to SendCommand, which
  treats a newline and ';' as segment separators -- so a `linetype=` argument
  carrying either injected further AutoCAD commands, and the 36-verb denylist
  never saw that channel. Guarded with the DXF symbol-name rule (the
  injection characters fall out of it rather than being enumerated) plus
  validate_path for the file argument, which was also the one path-taking
  tool reaching the filesystem unchecked. The policy comment is corrected.

Gates that could not see
- drawing_critique returned zero issues on a quarantined document: all seven
  checks wrapped their backend call in a bare `except Exception`. CLAUDE.md
  rule 7 makes that call the gate an agent is told to trust. Only the
  quarantine now escapes; an ordinary broken check still degrades.
  `_check_dimension_legibility` also read `_doc` directly from the event loop
  thread, missing the gate and performing exactly the unsynchronised access
  the quarantine exists to prevent. `construction_clear` answered
  "deleted: 0" -- there was nothing to clear -- for the same reason.
- The iso128 focus checked layer lineweights only, so a sheet lettered at
  1.0 mm critiqued clean. It now reads the effective dimension height and
  separator, header-then-style, in the order the renderer resolves.
- check_doc_numbers.py derived five values it never checked, and those were
  the ones that had drifted. The collected-test count (README said 1274, the
  tree had 1369) and the A/B pass-rate and Fixed columns are now gated.
- benchmarks/README.md's v1.4.0 table was impossible on its face -- 21
  passing plus 5 fixed is 26, not 24 -- and contradicted the report it
  linked, because `ab-v1.4.0-vs-v1.5.0.json` was regenerated from a tree that
  already carried the dimension fixes and so never measured the v1.5.0 tag.
  Replaced with a real run: ab-v1.4.0-vs-v1.5.1.json, 21/26 -> 26/26.

Release gate
- release.yml ran one ubuntu/3.11 lane, so a Windows-only defect could reach
  PyPI with no Windows job having executed. That is not hypothetical: v1.5.0
  shipped `except pywintypes.com_error` raising NameError wherever pywin32 is
  absent. It now runs the same three lanes as ci.yml, Windows included.

1368 passed, 1 xfailed. ruff clean. Tool inventory and all 16 gated document
numbers match the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server.py

@@ -198,6 +198,11 @@ class CapabilityRefusalMiddleware(Middleware):
     only channel that carries both a machine-readable payload *and* the error
     flag; rebasing the exception on ``FastMCPError`` carries neither, which is
     why no tool function changes here.
+
+    R32 added a sibling kind. A quarantined document is *not* a capability
+    boundary — the engine can draw a circle perfectly well, the document it would
+    draw into is untrusted — so it gets ``kind: "quarantined"`` and carries the
+    abandoned-call record instead of a capability key.
     """
 
     async def on_call_tool(self, context: MiddlewareContext, call_next):
@@ -205,19 +210,25 @@ class CapabilityRefusalMiddleware(Middleware):
             return await call_next(context)
         except Exception as exc:
             capability = _batch_capability_of(exc)
-            if capability is None:
+            quarantine = None if capability else _batch_quarantine_of(exc)
+            if capability is None and quarantine is None:
                 raise  # not ours — leave it byte-for-byte as it was
             message = _refusal_message(exc)
+            payload = {
+                "ok": False,
+                "error": message,
+                "tool": context.message.name,
+                "backend": _backend_name_or_none(context),
+            }
+            if capability is not None:
+                payload["kind"] = "unsupported"
+                payload["capability"] = capability
+            else:
+                payload["kind"] = "quarantined"
+                payload["quarantine"] = quarantine
             return ToolResult(
                 content=message,  # prose-only clients still get a full sentence
-                structured_content={
-                    "ok": False,
-                    "kind": "unsupported",
-                    "capability": capability,
-                    "error": message,
-                    "tool": context.message.name,
-                    "backend": _backend_name_or_none(context),
-                },
+                structured_content=payload,
                 is_error=True,
             )
 
@@ -3514,6 +3525,43 @@ def _batch_capability_of(exc: BaseException) -> str | None:
     return None
 
 
+_quarantine_error_type: type | None = None
+
+
+def _quarantine_refusal_type() -> type | None:
+    """``DocumentQuarantineError``, imported lazily like the capability types.
+
+    It lives in ``backends.quarantine``, which deliberately imports no ezdxf, so
+    this resolves even on a box where a backend's dependencies are missing.
+    """
+    global _quarantine_error_type
+    if _quarantine_error_type is None:
+        from backends.quarantine import DocumentQuarantineError
+
+        _quarantine_error_type = DocumentQuarantineError
+    return _quarantine_error_type
+
+
+def _batch_quarantine_of(exc: BaseException) -> dict | None:
+    """The abandoned-call record ``exc`` refuses on behalf of, or None.
+
+    Recognised by type, not structurally: ``DocumentQuarantineError``
+    deliberately has no ``capability`` attribute, because
+    ``_batch_capability_of`` would then report it to the client as
+    ``kind: "unsupported"`` — telling them the ezdxf engine cannot draw a circle
+    when the engine is fine and the document is not.
+    """
+    try:
+        quarantine_type = _quarantine_refusal_type()
+    except Exception as exc_import:  # pragma: no cover - core module
+        log.debug("quarantine refusal type unavailable: %s", exc_import)
+        return None
+    for error in _batch_cause_chain(exc):
+        if isinstance(error, quarantine_type):
+            return getattr(error, "quarantine", None) or {}
+    return None
+
+
 def _refusal_message(exc: BaseException) -> str:
     """The most specific message on the cause chain, in full.
 
@@ -3560,6 +3608,16 @@ def _classify_batch_error(exc: BaseException) -> dict:
             "capability": capability,
             "message": _batch_message(exc),
         }
+    quarantine = _batch_quarantine_of(exc)
+    if quarantine is not None:
+        # R32: its own kind. Filing it under "unsupported" would tell the batch
+        # reader the engine lacks a feature; filing it under "failed" would hide
+        # that every remaining step will refuse for the same reason.
+        return {
+            "kind": "quarantined",
+            "quarantine": quarantine,
+            "message": _batch_message(exc),
+        }
     chain = _batch_cause_chain(exc)
     if any(isinstance(error, NotFoundError) for error in chain):
         return {"kind": "unknown_tool", "message": _batch_message(exc)}
@@ -4849,8 +4907,10 @@ async def drawing_settings(
             description=(
                 "Omit to READ every setting; pass a dict to CHANGE them. Friendly keys: "
                 "units (mm/cm/m/inch/feet), linear_precision, angular_precision, ltscale, "
-                "dimscale, text_size, point_mode, point_size, osmode, fillet_radius. "
-                'Example: {"units": "mm", "dimscale": 1.0, "linear_precision": 2}.'
+                "dimscale, dim_text_height, dim_arrow_size, dim_decimals, "
+                'decimal_separator ("." or ","), zero_suppression, text_size, point_mode, '
+                "point_size, osmode, fillet_radius. "
+                'Example: {"units": "mm", "dimscale": 1.0, "dim_text_height": 3.5}.'
             ),
         ),
     ] = None,
@@ -4859,9 +4919,14 @@ async def drawing_settings(
     """Read or change common AutoCAD drawing settings by friendly name.
 
     A convenience facade over the system variables (INSUNITS, LUPREC, LTSCALE,
-    DIMSCALE, TEXTSIZE, OSMODE, …) so the user can say "set units to mm and
-    dimension scale to 1" without memorising sysvar names. Call with no argument
-    to get a full snapshot of the current settings.
+    DIMSCALE, DIMTXT, DIMASZ, DIMDEC, DIMDSEP, DIMZIN, TEXTSIZE, OSMODE, …) so
+    the user can say "set units to mm and dimension text to 3.5" without
+    memorising sysvar names. Call with no argument to get a full snapshot of the
+    current settings.
+
+    `dim_text_height` / `dim_arrow_size` / `dim_decimals` / `decimal_separator`
+    / `zero_suppression` shape the *dimension* — `text_size` is TEXTSIZE, the
+    height of a standalone TEXT entity, and does not touch dimensions.
     """
     if settings:
         await ctx.info(f"Applying drawing settings: {', '.join(settings)}")