Fix two real bugs: CAM opens in new tab, Save preserves format

1. post_stl_export_to_host() now opens the CAM page with
   window.open(..., '_blank') instead of window.location().set_href() -
   the latter navigated the CAD editor's own tab away, which tears down
   its WASM/GPU/worker context. Going back afterward doesn't reliably
   restore it, and a user who then hit Save on the broken restored state
   would silently overwrite the real file with whatever that broken state
   held. A new tab leaves the original completely untouched. (User report:
   CAM froze on load, then going back and saving "blanked" the file.)

2. save_with_default_format(): a plain Save (not Save As) on an
   already-loaded document used to ALWAYS serialize using the hardcoded
   default format (DWG 2018), ignoring what the document actually was -
   confirmed live via a real corrupted attachment (a .dxf that, after one
   Save, contained binary DWG bytes under its original .dxf name and
   filename, size dropped ~11.6MB -> 1.5MB). This is a pre-existing
   upstream gap, not something the CMMS patches introduced - native builds
   never hit it because on_save_file()'s native branch has an early-return
   for "just re-save to the known path" that preserves the current
   version; web has no equivalent and always fell through to this
   function's unconditional default. Extended the same format-preservation
   logic recovery-saves already use to also apply whenever the document
   has a known current_path (i.e. it's not actually a fresh, never-saved
   drawing).

src/app/update/file.rs

@@ -2096,7 +2096,22 @@ pub(super) fn on_open_file(&mut self) -> Task<Message> {
     /// save-before-close flow — the version picker is reserved for Save As.
     pub(in crate::app) fn save_with_default_format(&mut self, tab_idx: usize) -> Task<Message> {
         self.active_tab = tab_idx;
-        self.save_dialog_format = if self.tabs[tab_idx].recovery_save_as_required {
+        // CMMS embedding fix (upstream bug, not introduced by CMMS patches -
+        // real live data corruption caught 2026-08-23): on native, plain
+        // Save on an already-loaded document takes an early-return path in
+        // on_save_file() that preserves scene.document.version, never
+        // reaching this function at all. Web has no equivalent early
+        // return - EVERY web Save (not just recovery/never-saved-yet ones)
+        // used to fall straight to `else { self.default_save_format }`
+        // below, silently re-serializing a loaded DXF as DWG 2018 (the
+        // hardcoded default) under its original .dxf filename. Extending
+        // the same format-preservation branch recovery already uses to
+        // cover "this document has a known current_path" (i.e. it's not
+        // actually a fresh, never-saved drawing) fixes both cases with the
+        // same logic.
+        let preserve_format = self.tabs[tab_idx].recovery_save_as_required
+            || self.tabs[tab_idx].current_path.is_some();
+        self.save_dialog_format = if preserve_format {
             let document = &self.tabs[tab_idx].scene.document;
             let is_dxf = crate::io::source_is_dxf(
                 self.tabs[tab_idx].current_path.as_deref(),

src/sys.rs

@@ -509,10 +509,16 @@ pub async fn post_stl_export_to_host(bytes: &[u8], filename: &str) -> Result<(),
         percent_encode(entity_type),
         percent_encode(entity_id)
     );
+    // Open in a new tab/window rather than navigating this one away. A
+    // full top-level navigation of the CAD editor's own tab (the original
+    // set_href approach) tears down its WASM/GPU/worker context - even
+    // "going back" afterward doesn't reliably restore it, and a user who
+    // then hits Save on the broken restored state would silently overwrite
+    // the real file with whatever the broken state actually held. Opening
+    // a new tab leaves this one completely untouched.
     window
-        .location()
-        .set_href(&url)
-        .map_err(|_| "navigation to the CAM page failed")?;
+        .open_with_url_and_target(&url, "_blank")
+        .map_err(|_| "opening the CAM page failed")?;
     Ok(())
 }