@rig-c/review 0.7.1 → 0.8.1

package/src/rebuild.ts

@@ -24,8 +24,12 @@ import { CHEST_REGIONS_MAX } from './chest-regions.ts';
 import { bustMeshEntry, deriveBust, parseBustSpec, BustSpecError, type BustSpec } from './chest-landmarks.ts';
 import { modelMeshTriangles, remeshCounts, type RemeshCounts } from './mesh-entry.ts';
 import { patchRoute } from './retune-route.ts';
-import { absolutizeBuildFiles, buildLines, buildNamedFiles, buildReadout, needsBuild, newBuildFile, recompositeFigures, type RecompositeFigures } from './build-route.ts';
+import { carriedCheck, RETUNE_CHECK_SINCE, RETUNE_FILE, retuneCheckSummary, revisionBinding } from './retune-check.ts';
+import { absolutizeBuildFiles, buildLines, buildNamedFiles, buildReadout, MAX_BUILD_READOUT, needsBuild, newBuildFile, recompositeFigures, type RecompositeFigures } from './build-route.ts';
 import { jsonDiff } from './config-patch.ts';
+import { CLOTH_KEYPOINTS_UNDECLARED, CLOTH_PATCH_MIXED, CLOTH_SOURCE_UNAVAILABLE, CLOTH_WRITE_SINCE, clothLinks, clothPatchKind, readClothTargets, writtenDiff, type ClothTagView, type WrittenDiff } from './cloth-recipe.ts';
+import { CHECK_ENVIRONMENT_SINCE, parseSchedule, ScheduleError, scheduleText } from './environment-schedule.ts';
+import { samplesClock } from './frame-clock.ts';
 import { cleanArgs, mapText, motionSummary, parseRetargetRequest, retargetArgs, retargetLines, retargetRecord, retargetRecordText, RetargetError, type MotionSummary, type RetargetLine, type RetargetRecord } from './retarget.ts';
 
 export const REBUILD_SCHEMA = 'rig-review-rebuild/1';
@@ -227,9 +231,46 @@ export interface PatchJob {
   build: RebuildBuild | null;
   /** #115, a `build` job only: what the assemble stage read and wrote (absent on every other op, so their jobs are unchanged). */
   assembled?: AssembledView;
+  /** #112: the `rigc-environment/1` schedule check read (`--environment`), by hash; absent when Apply ran under the default world. */
+  environment?: ApplyWorld['record'];
+  /** #111, a `cloth` job only: what `propose --cloth --write-config` wrote and how the written config was built. */
+  cloth?: ClothJob;
+}
+/**
+ * #111: a cloth recipe Apply — `rig-parts propose --cloth cloth.json --write-config config.json` on the handoff's parts,
+ * painting and keypoints, then the written config built as `build` (the config declares `limbs`) or `rig --config`.
+ * `refusals`: every FAIL line propose printed, verbatim; `line`: propose's own `wrote config.json: …` line; `written`:
+ * every JSON Pointer at which the written config differs from cloth.json (the patched handoff config), and those outside
+ * the sections propose splices (none, or the Apply is refused); `links`: the written config's chains per tag.
+ */
+export interface ClothJob {
+  route: 'build' | 'rig';
+  inputs: { source: string; keypoints: { path: string; sha256: string } };
+  refusals: string[]; line: string | null; written: WrittenDiff | null; links: ClothTagView[];
+  wallMs: { propose: number | null; build: number | null };
+}
+/** #111: what a cloth Apply runs with — the handoff's painting and keypoints (absolute), parts.json and the reader's tags; never from the client. */
+export interface ClothPlan { source: string; keypoints: string; partsJson: unknown; targets: string[] }
+/**
+ * The tags the installed reader accepts, read off its own source (`src/cloth.ts`'s `CLOTH_TARGETS`); when that text
+ * does not state them, the tags the config's `cloth` block already declares (and `read: false`).
+ */
+export async function clothTargets(producerRoot: string | null, configText: string): Promise<{ tags: string[]; read: boolean }> {
+  if (producerRoot) { try { const tags = readClothTargets(await readFile(join(producerRoot, 'src', 'cloth.ts'), 'utf8')); if (tags) return { tags, read: true }; } catch { /* not readable: fall back */ } }
+  const cloth = object(JSON.parse(configText), 'config').cloth;
+  return { tags: cloth && typeof cloth === 'object' && !Array.isArray(cloth) ? Object.keys(cloth).filter(k => k !== 'note' && !k.endsWith('_note') && !k.startsWith('x-')) : [], read: false };
+}
+/** A written config that differs from its input outside the drafted sections is not built (bar 1, #111). */
+export const CLOTH_WRITTEN_OUTSIDE_DRAFTED = 'CLOTH_WRITTEN_OUTSIDE_DRAFTED';
+/** #112: the exported schedule an Apply's check reads, as written into the scratch directory, and what the job records of it. */
+export interface ApplyWorld { text: string; record: { sha256: string; steps: number } }
+/** `{patch, environment}`'s schedule: parsed as data and re-serialized, so its hash is the exported bytes'. */
+export function parseApplyWorld(value: unknown): ApplyWorld {
+  try { const schedule = parseSchedule(value), text = scheduleText(schedule); return { text, record: { sha256: sha256(text), steps: schedule.steps.length } }; }
+  catch (e) { if (e instanceof ScheduleError) throw new RebuildError('REBUILD_REQUEST_INVALID', `environment: ${e.message}`); throw e; }
 }
 /** The producer op a patch job ran (#136; `build` since #115). */
-export type AppliedOp = 'rig' | 'retune' | 'remesh' | 'build';
+export type AppliedOp = 'rig' | 'retune' | 'remesh' | 'build' | 'cloth';
 /**
  * #115: a `rig-parts build` job's assemble readout — the inputs it was run with (paths relative to the package root, the
  * assemble-read config files by hash), every FAIL line verbatim, the `cut:` / `limb cut:` / `limb cap:` / uncovered-hole
@@ -262,6 +303,8 @@ export interface RetargetJob {
   lines: string[]; producerLine: string | null; refusals: string[]; exitCode: number | null;
   wallMs: { clean: number | null; retarget: number | null; compile: number | null };
   files: FilesDiff | null; motion: MotionSummary | null; readings: RetargetLine[];
+  /** The run's report `frameTimes` (`motion.report.json`): the new animation's own clock, null when absent or malformed (#164). */
+  frameTimes: number[] | null;
   build: RebuildBuild | null;
 }
 /** Deterministic: the package, the config bytes, the record's bytes and both tool versions. No clock. */
@@ -305,9 +348,10 @@ export interface DeltaJob {
  * Deterministic: the package, the config bytes, the patch's own bytes and both tool versions. No clock. A retune-routed
  * patch adds its op (#136), so a scratch build the whole-rig path left for the same patch is never reused as retune's.
  */
-export function patchId(input: { sourceHash: string; configHash: string; patch: ConfigPatch; producer: string; compiler: string; op?: AppliedOp; buildInputs?: string }): string {
+export function patchId(input: { sourceHash: string; configHash: string; patch: ConfigPatch; producer: string; compiler: string; op?: AppliedOp; buildInputs?: string; environment?: string; cloth?: string }): string {
   // #115: a build-routed patch adds its op and the hash of the files assemble reads (painting, runs, named files).
-  return sha256(JSON.stringify([REBUILD_SCHEMA, 'patch', input.sourceHash, input.configHash, patchText(input.patch), input.producer, input.compiler, ...(input.op === 'retune' ? ['retune'] : []), ...(input.op === 'build' ? ['build', input.buildInputs ?? ''] : [])]));
+  // #112: an Apply whose check reads a schedule adds the schedule's hash, so a default-world build is never reused for it.
+  return sha256(JSON.stringify([REBUILD_SCHEMA, 'patch', input.sourceHash, input.configHash, patchText(input.patch), input.producer, input.compiler, ...(input.op === 'retune' ? ['retune'] : []), ...(input.op === 'build' ? ['build', input.buildInputs ?? ''] : []), ...(input.op === 'cloth' ? ['cloth', input.cloth ?? '', input.buildInputs ?? ''] : []), ...(input.environment ? ['environment', input.environment] : [])]));
 }
 const namedFile = (doc: unknown, keys: readonly string[]): unknown => keys.reduce<unknown>((v, k) => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>)[k] : undefined), doc);
 /**
@@ -359,9 +403,35 @@ interface ApplySteps {
   /** #125: diff every producer document against the inspected rig, before the compile. */
   diff?: (files: FilesDiff) => void;
   /** #102: check the scratch rig after the compile. */
-  check?: (summary: CheckSummary, wallMs: number) => void;
+  check?: (summary: CheckSummary, wallMs: number | null) => void;
+  /**
+   * #139: the check the producer op already ran on the spec it wrote, read instead of running check again: a summary
+   * (recorded through `check`, no wall clock), a refusal line (nothing recorded, the build refused), or null — the op
+   * carries none, so check runs as for any other Apply.
+   */
+  carried?: (push: (line: string) => void) => Promise<{ summary: CheckSummary } | { refused: string } | null>;
   /** After the build is hashed, before result.json is written. */
   hashed?: () => Promise<void>;
+  /** #112: the schedule check reads (`--environment environment.json`, written into the scratch directory first). */
+  world?: ApplyWorld | null;
+}
+
+/**
+ * #139: the check `rig-parts retune` ran on the revision it wrote into `spec`, as review's check summary, bound to the
+ * revision's files by `retune.json`'s hash rows (`RETUNE_CHECK_STALE` refuses the Apply). Null — check runs as before —
+ * when the Apply checks under an exported world (retune's check read the default one) or `retune.json` carries no
+ * `line` / `status` (a producer before `RETUNE_CHECK_SINCE`).
+ */
+async function retuneCarried(spec: string, world: ApplyWorld | null, push: (line: string) => void): Promise<{ summary: CheckSummary } | { refused: string } | null> {
+  if (world) { push('review: retune\'s own check read the default world and this Apply checks under the exported schedule, so check runs on the revision'); return null; }
+  const retune = JSON.parse(await readFile(join(spec, RETUNE_FILE), 'utf8')) as unknown;
+  const carried = carriedCheck(retune);
+  if (!carried) { push(`review: ${RETUNE_FILE} carries no check line or block statuses (@rig-c/parts before ${RETUNE_CHECK_SINCE}), so check runs on the revision`); return null; }
+  const stale = await revisionBinding(spec, retune);
+  if (stale) return { refused: stale };
+  const rows = (retune as { revision: unknown[] }).revision.length;
+  push(`review: check not run again — ${RETUNE_FILE} carries retune's check of this revision, bound to it by ${rows} revision hash row(s): ${carried.line}`);
+  return { summary: retuneCheckSummary(carried) };
 }
 
 /** #115: what a build-routed patch runs with — the handoff's painting and runs, absolute; never from the client. */
@@ -481,6 +551,9 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       cuts: inputs ? { config: configCuts(inputs.configText), build: buildGap(handoff) } : null,
       // #104: the config's idle (tracks, blink, bones, chains) and where the inspected idle keys each track.
       idle: inputs ? await idleStatus(inputs) : null,
+      // #111: the cloth recipe form — the reader's tags, the config's recipes as written, each tag's parts and chains (the
+      // link preview) and why a cloth Apply cannot run here (no keypoints, no painting, an older producer), or null.
+      cloth: inputs && handoff ? await clothStatus(handoff, inputs, resolved) : null,
       producer: resolved.ok ? tool(resolved.producer) : null, compiler: resolved.ok ? tool(resolved.compiler) : null,
       // #114: what the retarget editor offers — the pose producer, the declared sequences, the rig's bones and animations.
       retarget: await retargetStatus(inputs),
@@ -488,6 +561,19 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       running,
     };
   }
+  /** #111: what the cloth recipe form starts from. */
+  async function clothStatus(handoff: Handoff, inputs: ProducerInputs, resolved: ReturnType<typeof resolveProducer>) {
+    const config = object(JSON.parse(inputs.configText), 'config');
+    let partsJson: unknown = null;
+    try { partsJson = JSON.parse(await readFile(join(inputs.parts, 'parts.json'), 'utf8')); } catch { /* none: no tag lists its parts */ }
+    const targets = await clothTargets(resolved.ok ? resolved.producer.root : null, inputs.configText);
+    const reason = !handoff.keypoints || !handoff.record.keypoints ? CLOTH_KEYPOINTS_UNDECLARED
+      : !resolved.ok ? resolved.error
+      : !versionAtLeast(resolved.producer.version, CLOTH_WRITE_SINCE) ? modelingProducerTooOld(resolved.producer.version || 'unknown', CLOTH_WRITE_SINCE, 'rig-parts propose --cloth --write-config (entry by entry)')
+      : !handoff.source ? CLOTH_SOURCE_UNAVAILABLE
+      : config.limbs !== undefined && !handoff.full ? BUILD_SOURCE_UNAVAILABLE : null;
+    return { targets: targets.tags, targetsRead: targets.read, recipes: config.cloth ?? null, tags: clothLinks(config, partsJson, targets.tags), keypoints: handoff.record.keypoints ?? null, route: config.limbs !== undefined ? 'build' : 'rig', reason };
+  }
   /** The inspected build's check once it settles (tests); null when the baseline did not reproduce. */
   async function settledInspectedCheck(): Promise<InspectedCheck | null> { await settledBaseline(); return inspectedCheckRun ? await inspectedCheckRun : inspectedCheck; }
   /** The most recent built scratch build of this session (#108 readings run on it), or null. */
@@ -496,7 +582,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const job = latestId ? jobs.get(latestId) : undefined;
     // `spec`: the rig spec directory the job's producer op wrote (#113 checks requirements on it) — a designation's `revision`, a patch's or delta's `rig`.
     const dir = job ? rebuildDir(options.stateDir, p.sourceHash, job.id) : '';
-    return job && job.status === 'built' && job.build ? { id: job.id, build: join(dir, 'build'), modelHash: job.build.modelHash, spec: join(dir, !('kind' in job) ? 'revision' : job.op === 'build' ? 'out/rig' : 'rig') } : null;
+    return job && job.status === 'built' && job.build ? { id: job.id, build: join(dir, 'build'), modelHash: job.build.modelHash, spec: join(dir, !('kind' in job) ? 'revision' : job.op === 'build' || (job.kind === 'patch' && job.cloth?.route === 'build') ? 'out/rig' : 'rig') } : null;
   }
   /** The baseline once it settles (tests, and the whole-rig ops of #102/#103 through assertWholeRigBaseline). */
   async function settledBaseline(): Promise<BaselineResult | null> { if (!baselineRun) ensureBaseline(resolveProducer(options.starts)); return baselineRun ? await baselineRun : baseline; }
@@ -509,7 +595,14 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       if (stored.schema !== REBUILD_SCHEMA || stored.id !== id || stored.status !== 'built' || !stored.build) return null;
       const now = await hashBuild(join(dir, 'build'), id);
       if (JSON.stringify(now.files) !== JSON.stringify(stored.build.files)) return null;
-      return { ...stored, reused: true };
+      const job = { ...stored, reused: true };
+      // A retarget built before the job carried its report's frameTimes (#164): read them from the build's own report.
+      if ('kind' in job && job.kind === 'retarget' && (job as RetargetJob).frameTimes === undefined) {
+        let times: unknown = null;
+        try { times = (JSON.parse(await readFile(join(dir, 'motion.report.json'), 'utf8')) as { frameTimes?: unknown }).frameTimes; } catch { /* no report: no clock */ }
+        const clock = samplesClock(times); (job as RetargetJob).frameTimes = clock?.kind === 'samples' ? clock.frameTimes : null;
+      }
+      return job;
     } catch { return null; }
   }
 
@@ -542,10 +635,14 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       const compile = await runTool(resolved.compiler.bin, compileArgs({ rig: `${op.spec}/rig.json`, motion: `${op.spec}/motion.json`, out: 'build', pageEdges, packShape }), { cwd: dir, onLine: push });
       job.wallMs.compile = compile.wallMs;
       if (compile.exitCode !== 0) { job.exitCode = compile.exitCode; job.producerLine = firstRefusal(compile.lines) ?? `rigc build exited ${compile.exitCode} without a named refusal`; job.status = 'refused'; return; }
-      if (steps.check) {
+      const carried = steps.check && steps.carried ? await steps.carried(push) : null;
+      if (carried && 'refused' in carried) { job.producerLine = carried.refused; job.status = 'refused'; push(`review: ${carried.refused}`); return; }
+      if (steps.check && carried) steps.check(carried.summary, null);
+      else if (steps.check) {
         // check measures the scratch rig; a FAIL is its judgment, recorded beside the build, not a refusal of the build.
-        push(`review: ${producer.package} ${producer.version} check --rig ${op.spec} --out check --parts <handoff parts>`);
-        const check = await runTool(producer.bin, ['check', '--rig', op.spec, '--out', 'check', '--parts', inputs.parts, '--page-edges', pageEdges, '--pack-shape', packShape], { cwd: dir, onLine: push });
+        if (steps.world) await writeFile(join(dir, 'environment.json'), steps.world.text, { mode: 0o600 });
+        push(`review: ${producer.package} ${producer.version} check --rig ${op.spec} --out check --parts <handoff parts>${steps.world ? ` --environment environment.json (the exported schedule, ${steps.world.record.steps} step(s), sha256 ${steps.world.record.sha256.slice(0, 16)})` : ''}`);
+        const check = await runTool(producer.bin, ['check', '--rig', op.spec, '--out', 'check', '--parts', inputs.parts, '--page-edges', pageEdges, '--pack-shape', packShape, ...(steps.world ? ['--environment', 'environment.json'] : [])], { cwd: dir, onLine: push });
         let checkJson: unknown = null;
         try { checkJson = JSON.parse(await readFile(join(dir, 'check', 'check.json'), 'utf8')); } catch { /* check refused before writing it; its line says why */ }
         steps.check(checkSummary(checkJson, check.exitCode, check.lines, firstRefusal(check.lines)), check.wallMs);
@@ -590,28 +687,68 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * #102: the patched config → `rig-parts rig` (whole rig), `retune` (#136: the constraints and the idle spliced onto the
    * inspected rig) or `remesh` (one part's patched entry) → `<dir>/rig`; the tail adds the diff and check.
    */
-  function executePatch(job: PatchJob, dir: string, inputs: ProducerInputs, resolved: Resolved, patched: JsonValue, part: string | null, plan: BuildPlan | null = null): Promise<void> {
+  function executePatch(job: PatchJob, dir: string, inputs: ProducerInputs, resolved: Resolved, patched: JsonValue, part: string | null, plan: BuildPlan | null = null, world: ApplyWorld | null = null, cloth: ClothPlan | null = null): Promise<void> {
     const args = job.request.patch.op.args, producer = resolved.producer;
     let counts: RemeshCounts | null = null;
     let built: ProcessResult | null = null;
+    /** #111: a cloth job whose written config declares limbs is built as `build` does; otherwise as `rig --config`. */
+    const building = job.op === 'build' || (job.op === 'cloth' && job.cloth?.route === 'build');
+    /** #115 (and #111's build route): assemble → rig → check on `config.json`, already written into the scratch directory. */
+    async function runBuild(push: (line: string) => void, what: string): Promise<ProcessResult> {
+      // #112: build forwards `--environment` to its check stage (rig-parts build --help, 1.48.0).
+      if (world) await writeFile(join(dir, 'environment.json'), world.text, { mode: 0o600 });
+      push(`review: ${producer.package} ${producer.version} build --config config.json (${what}) --source <handoff source> --full <handoff full>${plan!.head ? ' --head <handoff head>' : ''} --seam-pairs${world ? ` --environment environment.json (the exported schedule, ${world.record.steps} step(s), sha256 ${world.record.sha256.slice(0, 16)})` : ''} → scratch out (assemble → rig → check)`);
+      // `--seam-pairs` (forwarded to check): the setup-pose seam split by pair on a pass too, so every Apply shows its `seam pair` lines.
+      built = await runTool(producer.bin, ['build', '--config', 'config.json', '--source', plan!.source, '--full', plan!.full, ...(plan!.head ? ['--head', plan!.head] : []), '--out', 'out', '--seam-pairs', ...(world ? ['--environment', 'environment.json'] : []), ...args], { cwd: dir, onLine: push });
+      const readout = buildReadout(built.lines);
+      // A check that ran and found a bar not met is check's judgment, kept beside the build (as for a `rig` patch):
+      // build prints "stopped at check; N bar(s) not met" (a check that refused its input says "no later stage ran").
+      const stoppedAtCheck = built.exitCode !== 0 && built.lines.some(l => /^build: stopped at check; \d+ bar\(s\) not met/.test(l.trim())) && (await exists(join(dir, 'out', 'rig', 'rig.json')));
+      job.assembled = { ...job.assembled!, refusals: stoppedAtCheck ? [] : readout.refusals, checkFails: stoppedAtCheck ? readout.refusals : [], lines: readout.assemble, seam: readout.seam, seamPairs: readout.seamPairs, recomposite: { ...job.assembled!.recomposite, line: readout.recomposite } };
+      const lines = buildLines(built.lines);
+      return { ...built, exitCode: stoppedAtCheck ? 0 : built.exitCode, lines, stdout: lines };
+    }
+    /** #111: propose writes the config, review checks the written diff, then the written config is built. */
+    async function runCloth(push: (line: string) => void): Promise<ProcessResult> {
+      const c = job.cloth!, plan2 = cloth!;
+      // cloth.json: the patched handoff config with every path it names made absolute (the scratch copy reads the
+      // handoff's files), so the config propose writes beside it builds from the same files.
+      const input = JSON.parse(scratchConfigText(inputs.config, patched)) as Record<string, unknown>;
+      absolutizeBuildFiles(input, value => (isAbsolute(value) ? value : resolve(dirname(inputs.config), value)));
+      await writeFile(join(dir, 'cloth.json'), JSON.stringify(input, null, 2) + '\n', { mode: 0o600 });
+      push(`review: ${producer.package} ${producer.version} propose --parts <handoff parts> --source <handoff source> --keypoints <handoff keypoints> --out propose --cloth cloth.json (the handoff config with ${job.request.patch.ops.length} patch op(s)) --write-config config.json`);
+      const proposed = await runTool(producer.bin, ['propose', '--parts', inputs.parts, '--source', plan2.source, '--keypoints', plan2.keypoints, '--out', 'propose', '--cloth', 'cloth.json', '--write-config', 'config.json'], { cwd: dir, onLine: push });
+      c.wallMs.propose = proposed.wallMs;
+      if (proposed.exitCode !== 0) { c.refusals = proposed.lines.filter(l => /^\s*FAIL\s/.test(l)).map(l => l.trim()).slice(0, MAX_BUILD_READOUT); return proposed; }
+      c.line = proposed.stdout.map(l => l.trim()).find(l => l.startsWith('wrote config.json:')) ?? null;
+      const written = JSON.parse(await readFile(join(dir, 'config.json'), 'utf8')) as unknown;
+      c.written = writtenDiff(input, written);
+      c.links = clothLinks(written, plan2.partsJson, plan2.targets);
+      if (c.written.outside.length) {
+        const line = `${CLOTH_WRITTEN_OUTSIDE_DRAFTED}: the config propose wrote differs from cloth.json outside the sections it splices, at ${c.written.outside.slice(0, 8).join(', ')}${c.written.outside.length > 8 ? ', …' : ''}; not built`;
+        push(`review: ${line}`);
+        return { exitCode: 1, lines: [line], stdout: [], wallMs: proposed.wallMs };
+      }
+      push(`review: the written config differs from cloth.json at ${c.written.count} path(s), every one under the sections propose splices${c.written.sections.length ? ` (${c.written.sections.join(', ')})` : ''}`);
+      let op: ProcessResult;
+      if (c.route === 'build') op = await runBuild(push, 'the config propose wrote');
+      else {
+        push(`review: ${producer.package} ${producer.version} rig --config config.json (the config propose wrote) → scratch rig`);
+        op = await runTool(producer.bin, ['rig', '--config', 'config.json', '--parts', inputs.parts, '--out', 'rig', ...args], { cwd: dir, onLine: push });
+      }
+      c.wallMs.build = op.wallMs;
+      return { ...op, wallMs: proposed.wallMs + op.wallMs };
+    }
     return apply(job, dir, inputs, resolved, {
-      cmd: job.op, spec: job.op === 'build' ? 'out/rig' : 'rig',
+      cmd: job.op === 'cloth' ? 'propose' : job.op, spec: building ? 'out/rig' : 'rig',
       async run(push) {
+        if (job.op === 'cloth' && cloth) return runCloth(push);
         if (job.op === 'build' && plan) {
           // #115: assemble → rig → check from the painting and the runs, the patched config's assemble-read files absolute.
           const doc = JSON.parse(scratchConfigText(inputs.config, patched)) as Record<string, unknown>;
           absolutizeBuildFiles(doc, value => (isAbsolute(value) ? value : resolve(dirname(inputs.config), value)));
           await writeFile(join(dir, 'config.json'), JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
-          push(`review: ${producer.package} ${producer.version} build --config config.json (the handoff config with ${job.request.patch.ops.length} patch op(s)) --source <handoff source> --full <handoff full>${plan.head ? ' --head <handoff head>' : ''} --seam-pairs → scratch out (assemble → rig → check)`);
-          // `--seam-pairs` (forwarded to check): the setup-pose seam split by pair on a pass too, so every Apply shows its `seam pair` lines.
-          built = await runTool(producer.bin, ['build', '--config', 'config.json', '--source', plan.source, '--full', plan.full, ...(plan.head ? ['--head', plan.head] : []), '--out', 'out', '--seam-pairs', ...args], { cwd: dir, onLine: push });
-          const readout = buildReadout(built.lines);
-          // A check that ran and found a bar not met is check's judgment, kept beside the build (as for a `rig` patch):
-          // build prints "stopped at check; N bar(s) not met" (a check that refused its input says "no later stage ran").
-          const stoppedAtCheck = built.exitCode !== 0 && built.lines.some(l => /^build: stopped at check; \d+ bar\(s\) not met/.test(l.trim())) && (await exists(join(dir, 'out', 'rig', 'rig.json')));
-          job.assembled = { ...job.assembled!, refusals: stoppedAtCheck ? [] : readout.refusals, checkFails: stoppedAtCheck ? readout.refusals : [], lines: readout.assemble, seam: readout.seam, seamPairs: readout.seamPairs, recomposite: { ...job.assembled!.recomposite, line: readout.recomposite } };
-          const lines = buildLines(built.lines);
-          return { ...built, exitCode: stoppedAtCheck ? 0 : built.exitCode, lines, stdout: lines };
+          return runBuild(push, `the handoff config with ${job.request.patch.ops.length} patch op(s)`);
         }
         if (job.op === 'retune') {
           // retune reads the inspected rig and writes only --out; what it holds it refuses by name (RETUNE_REQUEST_HELD).
@@ -634,7 +771,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       },
       wallMs: ms => { job.wallMs.op = ms; },
       async flags(push) {
-        if (job.op === 'build' && built) {
+        if (building && built) {
           job.exitCode = built.exitCode;
           const lines = buildLines(built.lines);
           job.producerLine = lines.filter(l => /^build:\s/.test(l)).at(-1) ?? job.producerLine;
@@ -659,8 +796,12 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     }, {
       diff: files => { const rigJson = files.documents.find(d => d.file === 'rig.json'); job.files = files; job.diff = rigJson ? { count: rigJson.count, paths: rigJson.paths } : null; },
       // #115: build runs check itself, on the parts it assembled; its check.json is read after the op (flags).
-      ...(job.op === 'build' ? {} : { check: (summary: CheckSummary, wallMs: number) => { job.wallMs.check = wallMs; job.check = summary; } }),
+      ...(building ? {} : { check: (summary: CheckSummary, wallMs: number | null) => { job.wallMs.check = wallMs; job.check = summary; } }),
+      // #139: a retune Apply reads the check retune ran on its revision (retune.json, bound by its hash rows) unless the
+      // Apply checks under an exported world (retune's check reads the default one) or the producer carries no line.
+      ...(job.op === 'retune' ? { carried: (push: (line: string) => void) => retuneCarried(join(dir, 'rig'), world, push) } : {}),
       hashed: async () => { if (counts) job.remesh = { ...counts, modelTriangles: modelMeshTriangles(JSON.parse(await readFile(join(dir, 'build', 'skeleton.model.json'), 'utf8')), counts.part) }; },
+      world,
     });
   }
 
@@ -670,7 +811,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
    * on a producer that has it (#136, `src/retune-route.ts`); any other `rig` patch rebuilds the whole rig and first needs
    * the baseline to have reproduced the inspected rig (`EDIT_BASELINE_MISMATCH` naming the path). Refusals come before anything is run.
    */
-  async function startPatch(input: unknown): Promise<{ status: number; body: unknown }> {
+  async function startPatch(input: unknown, world: ApplyWorld | null = null): Promise<{ status: number; body: unknown }> {
     let patch: ConfigPatch;
     try { patch = parseConfigPatch(input); } catch (e) { if (e instanceof ConfigPatchError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertStateOutside();
@@ -685,27 +826,44 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
       if (patch.op.cmd === 'remesh') part = remeshPart(patch);
     } catch (e) { if (e instanceof ConfigPatchError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     assertNamedFilesHeld(original, patched);
+    // #111: a cloth recipe patch (every op under /cloth) runs propose --cloth --write-config, then builds what it wrote.
+    // Decision 1: without the declared keypoints the draft moves the body bones, so it is refused before anything else.
+    const clothKind = clothPatchKind(patch.ops);
+    if (clothKind === 'mixed') throw new RebuildError('CLOTH_PATCH_MIXED', CLOTH_PATCH_MIXED.slice('CLOTH_PATCH_MIXED: '.length));
+    const clothing = clothKind === 'cloth' && patch.op.cmd === 'rig';
+    if (clothing && (!p.handoff!.keypoints || !p.handoff!.record.keypoints)) throw new RebuildError('CLOTH_KEYPOINTS_UNDECLARED', CLOTH_KEYPOINTS_UNDECLARED.slice('CLOTH_KEYPOINTS_UNDECLARED: '.length));
     const resolved = resolveProducer(options.starts);
     if (!resolved.ok) return { status: 200, body: { status: 'refused', error: resolved.error, producerLine: resolved.error } };
     if (patch.producer.name !== resolved.producer.package || patch.producer.version !== resolved.producer.version) throw new RebuildError('EDIT_PRODUCER_MISMATCH', `the patch was made for ${patch.producer.name} ${patch.producer.version}; the installed producer is ${resolved.producer.package} ${resolved.producer.version}`);
+    // #112: `check --environment` is @rig-c/parts 1.48.0's (parts#538); an older producer is refused by name, nothing run.
+    if (world && !versionAtLeast(resolved.producer.version, CHECK_ENVIRONMENT_SINCE)) { const error = modelingProducerTooOld(resolved.producer.version || 'unknown', CHECK_ENVIRONMENT_SINCE, 'rig-parts check --environment'); return { status: 200, body: { status: 'refused', error, producerLine: error } }; }
     // #136: the whole-rig rebuild is the fast path (~18 s) and gives the same bytes when the baseline is reproduced,
     // so it stays the default. Only when the config cannot reproduce the inspected rig (a repaired build) does a
     // patch inside retune's scope run retune, which holds the rest of the inspected rig itself (~52 s).
     // #115: a cut, patch or limb edit (or a bone edit on a config with limbs) is read by assemble, so it runs `build`.
-    const building = patch.op.cmd === 'rig' && needsBuild(patch.ops, original);
+    let clothPlan: ClothPlan | null = null;
+    if (clothing) {
+      if (!versionAtLeast(resolved.producer.version, CLOTH_WRITE_SINCE)) { const error = modelingProducerTooOld(resolved.producer.version || 'unknown', CLOTH_WRITE_SINCE, 'rig-parts propose --cloth --write-config (entry by entry)'); return { status: 200, body: { status: 'refused', error, producerLine: error } }; }
+      if (!p.handoff!.source) throw new RebuildError('MODELING_INPUT_UNAVAILABLE', CLOTH_SOURCE_UNAVAILABLE.slice('MODELING_INPUT_UNAVAILABLE: '.length));
+      let partsJson: unknown = null;
+      try { partsJson = JSON.parse(await readFile(join(inputs.parts, 'parts.json'), 'utf8')); } catch { /* propose reads parts.json itself and refuses by name */ }
+      clothPlan = { source: p.handoff!.source, keypoints: p.handoff!.keypoints!, partsJson, targets: (await clothTargets(resolved.producer.root, inputs.configText)).tags };
+    }
+    // Decision 2 (#111): the written config is built as #115 builds when it declares limbs, else by `rig --config`.
+    const building = patch.op.cmd === 'rig' && (needsBuild(patch.ops, original) || (clothing && !!original && typeof original === 'object' && !Array.isArray(original) && (original as Record<string, unknown>).limbs !== undefined));
     let plan: BuildPlan | null = null;
     if (building) {
       const held = newBuildFile(original, patched);
       if (held) throw new RebuildError('EDIT_PATCH_PATH_HELD', `${held} names a file the handoff config does not; a patch may not name a new file (review sends no path)`);
       plan = await buildPlan(p.handoff!, patched, abs => relative(p.root, abs).split(sep).join('/'));
     }
-    const route = patch.op.cmd === 'remesh' ? 'remesh' : building ? 'build' : patchRoute(patch.ops, resolved.producer.version);
+    const route = patch.op.cmd === 'remesh' ? 'remesh' : clothing ? 'cloth' : building ? 'build' : patchRoute(patch.ops, resolved.producer.version);
     const baselineNow = route === 'retune' ? await settledBaseline() : null;
     const op: AppliedOp = route === 'retune' && baselineNow?.status === 'reproduced' ? 'rig' : route;
-    if (op === 'rig' || op === 'build') {
+    if (op === 'rig' || op === 'build' || op === 'cloth') {
       try { assertWholeRigBaseline(await settledBaseline()); } catch (e) { if (e instanceof BaselineError) throw new RebuildError(e.code, e.message.slice(e.code.length + 2)); throw e; }
     }
-    const id = patchId({ sourceHash: p.sourceHash, configHash: inputs.configHash, patch, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}`, op, ...(plan ? { buildInputs: plan.inputsHash } : {}) });
+    const id = patchId({ sourceHash: p.sourceHash, configHash: inputs.configHash, patch, producer: `${resolved.producer.package}@${resolved.producer.version}`, compiler: `${resolved.compiler.package}@${resolved.compiler.version}`, op, ...(plan ? { buildInputs: plan.inputsHash } : {}), ...(world ? { environment: world.record.sha256 } : {}), ...(clothPlan ? { cloth: p.handoff!.record.keypoints!.sha256 } : {}) });
     const current = jobs.get(id);
     if (current?.status === 'running') return { status: 202, body: snapshot(current) };
     if (running) return { status: 200, body: { status: 'refused', error: `REBUILD_BUSY: rebuild ${running} is still running`, producerLine: null } };
@@ -713,9 +871,11 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const reused = await reuse<PatchJob>(dir, id);
     if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
     const job: PatchJob = { schema: REBUILD_SCHEMA, kind: 'patch', id, status: 'running', reused: false, op, request: { patch, patchSha256: patchSha256(patch), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, exitCode: null, wallMs: { op: null, compile: null, check: null }, check: null, diff: null, files: null, remesh: null, build: null,
-      ...(plan ? { assembled: { inputs: plan.inputs, refusals: [], checkFails: [], lines: [], seam: [], seamPairs: [], recomposite: { line: null, before: null, after: null, errorMap: null }, parts: null } } : {}) };
+      ...(plan ? { assembled: { inputs: plan.inputs, refusals: [], checkFails: [], lines: [], seam: [], seamPairs: [], recomposite: { line: null, before: null, after: null, errorMap: null }, parts: null } } : {}),
+      ...(world ? { environment: world.record } : {}),
+      ...(clothPlan ? { cloth: { route: building ? 'build' as const : 'rig' as const, inputs: { source: p.handoff!.record.source?.path ?? '', keypoints: { ...p.handoff!.record.keypoints! } }, refusals: [], line: null, written: null, links: [], wallMs: { propose: null, build: null } } } : {}) };
     jobs.set(id, job); running = id;
-    void executePatch(job, dir, inputs, resolved, patched, part, plan).finally(() => { if (running === id) running = null; });
+    void executePatch(job, dir, inputs, resolved, patched, part, plan, world, clothPlan).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
   }
 
@@ -841,6 +1001,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
         await writeFile(join(out, 'motion.json'), text, { mode: 0o600 });
         let frameTimes: number[] | null = null;
         try { const report = JSON.parse(await readFile(join(dir, 'motion.report.json'), 'utf8')) as { frameTimes?: unknown }; if (Array.isArray(report.frameTimes) && report.frameTimes.every(t => typeof t === 'number')) frameTimes = report.frameTimes as number[]; } catch { /* no report: the lines' own t= */ }
+        const clock = samplesClock(frameTimes); job.frameTimes = clock?.kind === 'samples' ? clock.frameTimes : null;
         job.readings = retargetLines(retargetRun?.lines ?? [], frameTimes).slice(0, MAX_RETARGET_LINES);
         let inspected: unknown = null;
         try { inspected = JSON.parse(await readFile(join(inputs.rig, 'motion.json'), 'utf8')); } catch { /* a rig without motion.json: nothing to keep */ }
@@ -881,7 +1042,7 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     const dir = rebuildDir(options.stateDir, p.sourceHash, id);
     const reused = await reuse<RetargetJob>(dir, id);
     if (reused) { jobs.set(id, reused); latestId = id; return { status: 200, body: snapshot(reused) }; }
-    const job: RetargetJob = { schema: REBUILD_SCHEMA, kind: 'retarget', id, status: 'running', reused: false, op: 'retarget', request: { record, recordSha256: sha256(retargetRecordText(record)), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, refusals: [], exitCode: null, wallMs: { clean: null, retarget: null, compile: null }, files: null, motion: null, readings: [], build: null };
+    const job: RetargetJob = { schema: REBUILD_SCHEMA, kind: 'retarget', id, status: 'running', reused: false, op: 'retarget', request: { record, recordSha256: sha256(retargetRecordText(record)), configHash: inputs.configHash }, producer: tool(resolved.producer), compiler: tool(resolved.compiler), lines: [], producerLine: null, refusals: [], exitCode: null, wallMs: { clean: null, retarget: null, compile: null }, files: null, motion: null, readings: [], frameTimes: null, build: null };
     jobs.set(id, job); running = id;
     void executeRetarget(job, dir, inputs, resolved, sequence).finally(() => { if (running === id) running = null; });
     return { status: 202, body: snapshot(job) };
@@ -895,8 +1056,11 @@ export function createRebuilds(p: ReviewPackage, options: RebuildOptions) {
     }
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'delta')) return startDelta(input);
     if (input && typeof input === 'object' && !Array.isArray(input) && Object.hasOwn(input, 'patch')) {
-      if (Object.keys(input).length !== 1) bad('expected exactly {patch} or {part, regions, configHash}');
-      return startPatch((input as { patch: unknown }).patch);
+      // #112: `{patch, environment}` — the exported schedule Apply's check reads.
+      const keys = Object.keys(input).sort().join(',');
+      if (keys !== 'patch' && keys !== 'environment,patch') bad('expected exactly {patch}, {patch, environment} or {part, regions, configHash}');
+      const world = Object.hasOwn(input, 'environment') ? parseApplyWorld((input as { environment: unknown }).environment) : null;
+      return startPatch((input as { patch: unknown }).patch, world);
     }
     const request = parseRebuildRequest(input, options.bones);
     assertStateOutside();

package/src/retune-check.ts

@@ -0,0 +1,100 @@
+/**
+ * #139: a retune Apply reads the check retune already ran on its revision instead of running `rig-parts check` a second
+ * time. `rig-parts retune` gates the revision and checks it (`checkStage` over the staged revision, the same `--parts`
+ * and pack flags review passes) before it writes `retune.json`; from `@rig-c/parts` 1.49.0 (parts#541, its CHANGELOG:
+ * "remesh,retune: the provenance carries check's final line and every block's status, as check itself reports") each
+ * check side also carries `line` — check's own last line, composed by the one function check prints it from — and
+ * `status` — every block's status as that tree's `check.json` records it, in the file's order. The writer
+ * (`src/retune.ts`): `revision: hashRows(revision)` and `check: { ...sides, scope }` with
+ * `sides = { input: checkSide(inCheck), revision: checkSide(revCheck) }`.
+ *
+ * The carried side is bound to the files by the `revision` hash rows: every row's file in the scratch revision must
+ * hash to its row, none missing and none extra (`RETUNE_CHECK_STALE`). A `retune.json` without `line` and `status` (an
+ * older producer) is not refused: the caller falls back to running check. Pure but for the binding's reads.
+ */
+import { createHash } from 'node:crypto';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+import { CHECK_SUMMARY_SCHEMA, type CheckSummary } from './applied-context.ts';
+
+/** The first `@rig-c/parts` release whose `retune.json` check sides carry `line` and `status` (CHANGELOG 1.49.0, parts#541). */
+export const RETUNE_CHECK_SINCE = '1.49.0';
+/** retune's provenance file, at the revision's root (parts `RETUNE_FILE`). */
+export const RETUNE_FILE = 'retune.json';
+export const RETUNE_CHECK_STALE = 'RETUNE_CHECK_STALE';
+
+const isObject = (v: unknown): v is Record<string, unknown> => !!v && typeof v === 'object' && !Array.isArray(v);
+/** check.json's bar keys as review's `checkSummary` reads them: an upper-case name. */
+const BAR = /^[A-Z][A-Z0-9_]+$/;
+const STATUSES = new Set(['PASS', 'FAIL', 'SKIP', 'WARN', 'CLEAR', 'REPORTED']);
+
+export interface RetuneRevisionRow { path: string; bytes: number; sha256: string }
+export interface CarriedCheck { pass: boolean; line: string; status: Record<string, string> }
+
+/**
+ * `check.revision`'s carried fields, or null when there is no such side or it carries neither `line` nor `status` (a producer before
+ * {@link RETUNE_CHECK_SINCE}). A side with one of them and not the other, or with a malformed one, throws: that is not
+ * an older producer and not a check review can record.
+ */
+export function carriedCheck(retune: unknown): CarriedCheck | null {
+  const side = isObject(retune) && isObject(retune.check) ? retune.check.revision : undefined;
+  // No side at all carries neither field either: check runs, as for an older producer.
+  if (!isObject(side)) return null;
+  const hasLine = Object.hasOwn(side, 'line'), hasStatus = Object.hasOwn(side, 'status');
+  if (!hasLine && !hasStatus) return null;
+  if (typeof side.line !== 'string' || !/^check: (PASS|FAIL)/.test(side.line)) throw new Error(`${RETUNE_FILE}: check.revision.line is not check's last line`);
+  if (!isObject(side.status) || !Object.values(side.status).every(s => typeof s === 'string' && STATUSES.has(s))) throw new Error(`${RETUNE_FILE}: check.revision.status is not {block: status}`);
+  if (side.status.gate !== 'PASS' && side.status.gate !== 'FAIL') throw new Error(`${RETUNE_FILE}: check.revision.status.gate is not PASS or FAIL`);
+  if (typeof side.pass !== 'boolean') throw new Error(`${RETUNE_FILE}: check.revision.pass is not a boolean`);
+  return { pass: side.pass, line: side.line, status: side.status as Record<string, string> };
+}
+
+/**
+ * The carried side in the summary shape review records for a check it ran (`checkSummary`), field by field:
+ * `pass` ← `pass` (`figures.PASS === true`, check.json's `PASS`); `exitCode` ← 0 when it passes, else 1 (`rig-parts
+ * check` exits `r.figures.PASS ? EXIT_OK : EXIT_REFUSED`); `line` ← `line` (check's last line, byte for byte);
+ * `bars` ← every upper-case entry of `status` (check.json's top-level blocks with a `status`, in the file's order; the
+ * figure-read `gate`, `loop` and `seam` are lower-case and are not bars in check.json); `gate` ← `status.gate` is
+ * `PASS` (`gate_spine_html_green === true`, the one way `barsNotMet` leaves `gate` out). `source` says where it came from.
+ */
+export function retuneCheckSummary(carried: CarriedCheck): CheckSummary {
+  const bars: Record<string, string> = {};
+  for (const [name, status] of Object.entries(carried.status)) if (BAR.test(name)) bars[name] = status;
+  return { schema: CHECK_SUMMARY_SCHEMA, pass: carried.pass, exitCode: carried.pass ? 0 : 1, line: carried.line, bars, gate: carried.status.gate === 'PASS', source: 'retune' };
+}
+
+/** The `revision` hash rows, or a refusal when they are not rows. */
+function revisionRows(retune: unknown): RetuneRevisionRow[] | string {
+  const rows = isObject(retune) ? retune.revision : undefined;
+  if (!Array.isArray(rows) || rows.length === 0) return `${RETUNE_CHECK_STALE}: ${RETUNE_FILE} names no revision hash rows; its check is bound to no files`;
+  for (const r of rows) if (!isObject(r) || typeof r.path !== 'string' || !r.path || typeof r.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(r.sha256)) return `${RETUNE_CHECK_STALE}: ${RETUNE_FILE} has a revision row that is not {path, bytes, sha256}`;
+  return rows as RetuneRevisionRow[];
+}
+
+async function files(root: string): Promise<string[]> {
+  const out: string[] = [];
+  const walk = async (dir: string) => { for (const e of await readdir(dir, { withFileTypes: true })) { const full = join(dir, e.name); if (e.isDirectory()) await walk(full); else out.push(relative(root, full).split(sep).join('/')); } };
+  await walk(root);
+  return out.sort();
+}
+
+/**
+ * The binding: every `revision` row's file under `dir` hashes to its row, none is missing, and `dir` holds no file
+ * but those rows and `retune.json`. Null when bound; otherwise the first mismatch as
+ * `RETUNE_CHECK_STALE: <file> sha256 <in retune.json> … <on disk>` (`absent` on the side that has no such file).
+ */
+export async function revisionBinding(dir: string, retune: unknown): Promise<string | null> {
+  const rows = revisionRows(retune);
+  if (typeof rows === 'string') return rows;
+  const onDisk = await files(dir), named = new Set(rows.map(r => r.path));
+  for (const row of rows) {
+    let actual = 'absent';
+    if (onDisk.includes(row.path)) actual = createHash('sha256').update(await readFile(join(dir, ...row.path.split('/')))).digest('hex');
+    if (actual !== row.sha256) return `${RETUNE_CHECK_STALE}: ${row.path} sha256 ${row.sha256} in ${RETUNE_FILE} … ${actual} on disk; retune's check is not this revision's, so no build is recorded`;
+  }
+  for (const path of onDisk) if (path !== RETUNE_FILE && !named.has(path)) {
+    const actual = createHash('sha256').update(await readFile(join(dir, ...path.split('/')))).digest('hex');
+    return `${RETUNE_CHECK_STALE}: ${path} sha256 absent in ${RETUNE_FILE} … ${actual} on disk; retune's check is not this revision's, so no build is recorded`;
+  }
+  return null;
+}

package/src/server.ts

@@ -12,6 +12,7 @@ import { ReadingsError } from './readings.ts';
 import { BONES_CHECK_LIMIT, createBonesCheck } from './bones-check.ts';
 import { createRequirementsCheck } from './requirements-run.ts';
 import { REQUIREMENTS_LIMIT, RequirementsError } from './requirements.ts';
+import { createEnvironmentCheck, ENVIRONMENT_CHECK_LIMIT, EnvironmentCheckError } from './environment-check.ts';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 const headers={ 'X-Content-Type-Options':'nosniff','Cache-Control':'no-store','Content-Security-Policy':"default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; media-src 'self'; connect-src 'self'; font-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'",'Referrer-Policy':'no-referrer'};
@@ -38,11 +39,13 @@ export async function startServer(p:ReviewPackage,options:{port?:number;stateDir
   const bonesCheck=createBonesCheck(p,{stateDir,starts,unchanged});
   // Declared requirements (#113): review writes the file into scratch; the installed producer's check measures it.
   const requirements=createRequirementsCheck(p,{stateDir,starts,unchanged,latest:rebuilds.latest});
+  // Check under this world (#112): the exported schedule written into scratch; the installed producer's check --environment reads it.
+  const environmentCheck=createEnvironmentCheck(p,{stateDir,starts,unchanged,latest:rebuilds.latest});
   const control=options.control?createControlServer({identity:options.control,sourceHash:p.sourceHash,mode:'single',unchanged,activity:options.activity}):null;
   const handle=async(req:Request,port:number|undefined):Promise<Response>=>{try {
       const url=new URL(req.url);const origin=`http://127.0.0.1:${port}`;
       if(url.origin!==origin)return json({error:'Loopback host required'},403);
-      const refused=openNonceGate(req,options.open)??accessGate(req,options.capability);if(refused)return refused;
+      const refused=openNonceGate(req,options.open)??accessGate(req,options.capability,!!control);if(refused)return refused;
       const controlled=await control?.(req,origin);if(controlled)return controlled;
       options.activity?.();const gate=openGate(req,options.open);if(gate){if(gate.status===200){try{await unchanged();}catch{return staleOpenStatus(options.open!);}}return gate;}
       if(req.method==='PUT'&&url.pathname==='/api/session'){
@@ -66,9 +69,14 @@ export async function startServer(p:ReviewPackage,options:{port?:number;stateDir
       try{const result=await requirements.start(await bodyJson(req,REQUIREMENTS_LIMIT,'REQUIREMENTS_BODY_LIMIT: maximum 64 KiB'));return json(result.body,result.status);}
       catch(e){if(e instanceof RequirementsError)return json({status:'refused',error:e.message},e.code==='REQUIREMENTS_REQUEST_INVALID'?400:200);throw e;}
     }
+    if(req.method==='POST'&&url.pathname==='/api/environment-check'){
+      if(req.headers.get('origin')!==origin)return json({error:'Same-origin Origin required'},403);
+      try{const result=await environmentCheck.start(await bodyJson(req,ENVIRONMENT_CHECK_LIMIT,'ENVIRONMENT_CHECK_BODY_LIMIT: maximum 64 KiB'));return json(result.body,result.status);}
+      catch(e){if(e instanceof EnvironmentCheckError)return json({status:'refused',error:e.message},e.code==='ENVIRONMENT_CHECK_REQUEST_INVALID'?400:200);throw e;}
+    }
     if(req.method==='POST'&&url.pathname==='/api/readings'){
       if(req.headers.get('origin')!==origin)return json({error:'Same-origin Origin required'},403);
-      try{const result=await readings.start(await bodyJson(req,16*1024,'READINGS_BODY_LIMIT: maximum 16 KiB'));return json(result.body,result.status);}
+      try{const result=await readings.start(await bodyJson(req,64*1024,'READINGS_BODY_LIMIT: maximum 64 KiB'));return json(result.body,result.status);}
       catch(e){if(e instanceof ReadingsError)return json({status:'refused',error:e.message},e.code==='READINGS_REQUEST_INVALID'?400:200);throw e;}
     }
     if(req.method==='POST'&&url.pathname==='/api/strip'){
@@ -85,6 +93,8 @@ export async function startServer(p:ReviewPackage,options:{port?:number;stateDir
       if(url.pathname==='/api/requirements')return json(await requirements.describe());
       const requirementsStatus=/^\/api\/requirements\/([a-f0-9]{64})$/.exec(url.pathname);
       if(requirementsStatus){try{return json(requirements.read(requirementsStatus[1]!));}catch(e){if(e instanceof RequirementsError)return json({error:e.message},404);throw e;}}
+      const environmentCheckStatus=/^\/api\/environment-check\/([a-f0-9]{64})$/.exec(url.pathname);
+      if(environmentCheckStatus){try{return json(environmentCheck.read(environmentCheckStatus[1]!));}catch(e){if(e instanceof EnvironmentCheckError)return json({error:e.message},404);throw e;}}
       const readingsStatus=/^\/api\/readings\/([a-f0-9]{64})$/.exec(url.pathname);
       if(readingsStatus){try{return json(readings.read(readingsStatus[1]!));}catch(e){if(e instanceof ReadingsError)return json({error:e.message},404);throw e;}}
       const rebuildFile=/^\/rebuild\/([a-f0-9]{64})\/(.+)$/.exec(url.pathname);

package/src/session.ts

@@ -9,6 +9,7 @@ import { parseEnvironmentContext } from './environment.ts';
 import { appliedCheckRefusal, parseAppliedContext } from './applied-context.ts';
 import { parseReadingsContext } from './readings.ts';
 import { parseRequirementsContext } from './requirements.ts';
+import { parseScheduleContext } from './environment-schedule.ts';
 import { choice, object, string, type Json, type ReviewPackage, type ReviewedSource } from './manifest.ts';
 export interface Feedback {id:string;frameStart:number;frameEnd:number;target:{kind:'bone'|'slot'|'rig';name:string};category:'defect'|'quality';summary:string;context?:Json}
 export function parseFeedback(item:unknown,strict=true):Feedback {
@@ -37,6 +38,8 @@ export function validatePackageFeedback(feedback:Feedback,p:ReviewPackage,animat
   if(context.readings!==undefined)parseReadingsContext(context.readings);
   // The declared requirements (#113): absent or null stays valid; a present record carries the file's text and its sha256, recomputed here.
   if(context.requirements!==undefined)parseRequirementsContext(context.requirements,text=>createHash('sha256').update(text).digest('hex'));
+  // The exported environment schedule (#112): absent or null stays valid; a present record carries its bytes and their sha256, recomputed here.
+  if(context.environmentSchedule!==undefined)parseScheduleContext(context.environmentSchedule,text=>createHash('sha256').update(text).digest('hex'));
   const selected=animation??(typeof context.animation==='string'?context.animation:null);
   validateFeedbackSelection(p.feedbackCatalog,{frameStart:feedback.frameStart,frameEnd:feedback.frameEnd,target:feedback.target,animation:selected});
   return {...feedback,context:{...context,...(animation===undefined?{}:{animation}),interval} as Json};