[Jun 26] Foundational undo fix + op-robustness sweep. A behavioral audit ("is this actually how undo should work?") found the real bug 47 green tests had sailed past: position snapshots stored raw Vert*, so move→delete→undo dereferenced freed verts (use-after-free, corrupted mesh), and a move on a topology-created vert lost silently on redo — desyncing the IntentLog and corrupting the saved .replay. Fix: store the persistent id at push, look the vert up in the CURRENT mesh at restore, writing present ones and skipping absent. Deleted ~90 lines of rebase logic; never touches a possibly-freed pointer. Alongside, a malformed-input sweep hardened the REPL / replay-runner / file-load edges (a safe_stof rejecting nan/inf/overflow across 43 call sites, assign_material index bounds, inset dedup guards) and fixed an inset_region crash on a duplicate-face selection. No app-reachable crashes remain from normal interaction.