diff --git a/scripts/kernel-test.sh b/scripts/kernel-test.sh
new file mode 100755
index 0000000000..21e398c747
--- /dev/null
+++ b/scripts/kernel-test.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# Headless CAD-kernel test loop. THE verification contract for delegated work:
+# exit 0 means the kernel builds and the selected Catch2 tags pass. Nothing else counts.
+#
+# Builds only the `libslic3r_tests` target (not the GUI app), so a round trip is
+# minutes, not tens of minutes. Needs no display: every [CadDocument] case builds a
+# CadDocument, recompute()s it and asserts on geometry.
+#
+# Usage:
+#   scripts/kernel-test.sh                        # [CadDocument] tags, default volume
+#   scripts/kernel-test.sh --tags '[CadDocument],[Sketch]'
+#   scripts/kernel-test.sh --vol wt_mirror        # private build cache (parallel workers)
+#   scripts/kernel-test.sh --host tommaso@100.103.234.2   # build on a remote host
+#
+# Parallel workers MUST pass a distinct --vol: two builds sharing one cache corrupt
+# each other. A new volume pays one full build; runs after that are incremental.
+#
+# --host exists because the deps image lives wherever it was first built. It rsyncs this
+# working tree to a per-volume staging dir on that host and re-runs this same script
+# there, so the verification contract is identical either way. Drop --host once the image
+# is present locally.
+set -euo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+IMAGE="${IMAGE:-snaporca-deps}"
+VOL="${BUILD_VOL:-snaporca_buildcache}"
+# Two pre-existing failures are excluded by default (see [known-broken] in
+# test_caddocument.cpp): one of them SIGABRTs inside the vendored solver and takes the
+# whole process down, so without this exclusion a green run is simply unreachable and the
+# suite stops after ~12 of 32 cases. CI runs everything and still reports both.
+TAGS="${TAGS:-[CadDocument]~[known-broken]}"
+HOST=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --vol)   VOL="$2";   shift 2 ;;
+    --tags)  TAGS="$2";  shift 2 ;;
+    --image) IMAGE="$2"; shift 2 ;;
+    --host)  HOST="$2";  shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+echo "REPO=$REPO IMAGE=$IMAGE VOL=$VOL TAGS=$TAGS HOST=${HOST:-local}"
+
+if [[ -n "$HOST" ]]; then
+  # Stage per-volume so parallel workers never share a remote tree.
+  REMOTE="kt-$VOL"   # relative: ssh and rsync both start in the remote home dir
+  ssh "$HOST" "mkdir -p $REMOTE"
+  # Only the inputs the build reads. --delete keeps a stale file from a prior worker from
+  # silently compiling in.
+  rsync -a --delete \
+    "$REPO/src" "$REPO/tests" "$REPO/resources" "$REPO/cmake" "$REPO/scripts" \
+    "$REPO/CMakeLists.txt" \
+    "$HOST:$REMOTE/"
+  exec ssh "$HOST" "cd $REMOTE && scripts/kernel-test.sh --vol '$VOL' --tags '$TAGS' --image '$IMAGE'"
+fi
+
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+  echo "FATAL: image '$IMAGE' not present locally. Either transfer it, or pass" >&2
+  echo "       --host <user@host> to build where the image already exists." >&2
+  exit 3
+fi
+
+# A private volume is always built CLEAN on first use. Cloning a warm cache from another
+# tree looks tempting but is a correctness trap: rsync preserves source mtimes, so ninja
+# compares foreign object timestamps against them, decides everything is up to date, and
+# relinks stale objects. That produced a binary with NO [CadDocument] tests at all while
+# reporting success -- a green run that tested nothing. Pay the one-off full build instead;
+# incremental rebuilds within a volume are correct because the mtimes then share a lineage.
+if ! docker volume inspect "$VOL" >/dev/null 2>&1; then
+  echo "=== $VOL: new volume, clean configure + full build (one-off, slow) ==="
+  docker volume create "$VOL" >/dev/null
+fi
+
+# tests/ is mounted too -- unlike docker-iter-build.sh, this script exists precisely to
+# compile tests being edited. CMakeLists.txt and cmake/ carry the SLIC3R_CAD gate; taking
+# them from the baked image instead leaves the gate off and the CAD symbols vanish.
+docker run --rm \
+  -v "$REPO/src":/OrcaSlicer/src \
+  -v "$REPO/tests":/OrcaSlicer/tests \
+  -v "$REPO/resources":/OrcaSlicer/resources \
+  -v "$REPO/CMakeLists.txt":/OrcaSlicer/CMakeLists.txt \
+  -v "$REPO/cmake":/OrcaSlicer/cmake \
+  -v "$VOL":/OrcaSlicer/build \
+  "$IMAGE" \
+  bash -lc "set -e
+    cd /OrcaSlicer
+    DESTDIR=/OrcaSlicer/deps/build/destdir/usr/local
+    export PATH=\$DESTDIR/bin:\$PATH   # wx-config, and anything else the deps prefix ships
+    # Configure unconditionally. Guarding on 'CMakeCache.txt exists' is wrong: a FAILED
+    # configure still writes that file, so the guard then skips reconfiguring forever and
+    # every later run reuses a poisoned cache while ignoring corrected flags. A no-op
+    # reconfigure costs seconds; that bug costs an afternoon.
+    # SLIC3R_GTK=3 and BUILD_TESTS=ON are not optional extras: src/CMakeLists.txt turns
+    # SLIC3R_GTK into 'wx-config --toolkit=gtk<N>', so omitting it asks for toolkit 'gtk'
+    # and no wx build matches -> 'Could NOT find wxWidgets'. BUILD_TESTS=ON is what makes
+    # the libslic3r_tests target exist at all. build_linux.sh sets both (lines 218, 226).
+    cmake -S . -B build -G 'Ninja Multi-Config' \
+      -DCMAKE_PREFIX_PATH=\$DESTDIR \
+      -DwxWidgets_CONFIG_EXECUTABLE=\$DESTDIR/bin/wx-config \
+      -DSLIC3R_GTK=3 -DBUILD_TESTS=ON \
+      -DSLIC3R_CAD=ON -DSLIC3R_STATIC=1 -DORCA_TOOLS=ON -DCMAKE_BUILD_TYPE=Release
+    cmake --build build --config Release --target libslic3r_tests
+    ./build/tests/libslic3r/Release/libslic3r_tests '$TAGS' --order decl"
diff --git a/tests/libslic3r/test_caddocument.cpp b/tests/libslic3r/test_caddocument.cpp
index a6e8942f20..460892d703 100644
--- a/tests/libslic3r/test_caddocument.cpp
+++ b/tests/libslic3r/test_caddocument.cpp
@@ -550,7 +550,12 @@ TEST_CASE("entity constraints: point-on-line positions a centre onto an axis", "
     }
 }
 
-TEST_CASE("entity constraints: tangent/midpoint/symmetric/angle", "[CadDocument]")
+// [known-broken]: the "tangent line to circle" SECTION below aborts inside the vendored
+// solver (slvs/dsc.h FindById, "Cannot find handle"). SIGABRT is fatal to the whole Catch2
+// process, so this one case takes the entire suite down with it and no later test runs.
+// Tagged so the delegated dev loop (scripts/kernel-test.sh) can exclude it and still reach
+// a green baseline; CI runs every test and keeps reporting it, so the bug stays visible.
+TEST_CASE("entity constraints: tangent/midpoint/symmetric/angle", "[CadDocument][known-broken]")
 {
     using R = SketchPointRole;
     using T = SketchConstraintType;
@@ -898,7 +903,10 @@ TEST_CASE("extrude taper + up-to-face distance", "[CadDocument]")
     }
 }
 
-TEST_CASE("internal thread cuts a visible groove into the bore wall", "[CadDocument]")
+// [known-broken]: pre-existing failure, the cut groove volume does not meet the asserted
+// threshold. Excluded from the delegated dev loop so a green run means "I broke nothing";
+// CI still runs and reports it.
+TEST_CASE("internal thread cuts a visible groove into the bore wall", "[CadDocument][known-broken]")
 {
     using namespace Slic3r;
     SketchPlane xy = SketchPlane::XY();