Constant DEFAULT_ELEMENT_CAP 

pub const DEFAULT_ELEMENT_CAP: u64 = 100_000;

Default per-ELEMENT exact-evaluation cap (#1109 follow-up).

The per-boolean cap above bounds a SINGLE boolean, but it left two holes that kept boolean-heavy models stalling at 95% even after the per-boolean budget shipped:

1. Distributed cost. An element with many openings (a 24-opening slab, a window-dense facade) runs one boolean PER opening, each well under the per-boolean cap, so none trips — yet the element’s TOTAL exact work is huge and the geometry batch blows the stream watchdog.
2. Overshoot. A single heavily-fragmented host face retriangulates all its constraint points in ONE triangulate call between two per-triangle tripped() checks, so one boolean ran to ~1.7M escalations (3.3× a 500k cap) before bailing — seconds of work past the cap.

This cap counts escalations across the WHOLE element (every boolean it runs) and trips once the element total crosses it, so a hard element degrades as a UNIT (its remaining cuts bail to the #635 AABB box-cut) instead of grinding. It is still a deterministic COUNT, so native and wasm degrade the SAME element identically (parity). Calibrated on the model corpus (the csg_model_profile harness): healthy per-element totals are p50=0, p95≈150, p99≈13k — so this cap is ~8× the 99th-percentile healthy element and never false-trips a legitimate cut, while the pathological slabs that hung the stream (one needed 7.7M escalations → 4 MINUTES) all sit far above it. At the measured ~50-60k escalations/sec it bounds a hard element to ~2 s of exact work before its remaining cuts degrade. The per-element cap only engages when begin_element is called (the unified batch path); direct kernel / router / server / offline-export callers that never open an element scope stay unbounded, exactly as before — so the pinned kernel snapshots are unchanged.