rig-c 0.0.0-stage → 2.20.4

package/src/assertions/bodies/a06.ts

@@ -0,0 +1,245 @@
+/**
+ * A06, the body (issue #1025, step 4c of #380): every page the atlas names is
+ * the size its PNG is, every region lies inside its page, and — under
+ * `spine-html` — no page claims premultiplied alpha and no region is turned.
+ * The clause that refused two regions on one page overlapping is
+ * `A49_PACKED_FOOTPRINTS_DO_NOT_OVERLAP` since issue #1099 (`./a49.ts`).
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the pages and
+ * regions are a fact (`../facts/atlas_regions.ts`), the directory is the
+ * caller's, and the profile's policy switch is passed in. The `check` call —
+ * and the argument for the SKIP guards it shares with A17 and A19 (#568, #608)
+ * — stays in `validate()`.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { Verdicts } from '../harness.ts';
+import type { AtlasRegionFacts } from '../facts/atlas_regions.ts';
+import { SKIP_NO_ATLAS, SKIP_NO_ATLAS_PAGE } from '../reasons.ts';
+import { pageFootprint, pageGridSentence } from '../../atlas.ts';
+import { readPngHeader } from '../../png.ts';
+import { imageDataProblem } from '../../../tools/plate.ts';
+
+export function a06AtlasPageSizeMatchesPng({ fail: failed, skip }: Verdicts, { atlas }: AtlasRegionFacts, input: { atlasDir: string }, policy: boolean): void {
+  if (!atlas) return skip('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', SKIP_NO_ATLAS);
+  if (atlas.pages.length === 0) return skip('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', SKIP_NO_ATLAS_PAGE);
+  // Every sentence this body prints goes through here, so the end of the body
+  // can tell "nothing failed" from "something failed" (issue #1055, below).
+  let failures = 0;
+  const fail = (assertion: string, detail: string): void => {
+    failures++;
+    failed(assertion, detail);
+  };
+  // 🔒 **A page whose file is not on disk is a page whose size was not
+  // measured, and the body says so rather than passing** (issue #1055). Until
+  // this the loop below walked past such a page and the assertion came out
+  // PASS — on a build with every page file deleted, a PASS over a size clause
+  // that had opened nothing, measured on 33 of the 38 recipe-and-profile
+  // pairs of the tree's 19 recipes (the other five failed clauses that read
+  // only the atlas's numbers: overlap and rotation, under `spine-html`). What the body does instead is decided by what `A17` prints on
+  // the same input, so that one missing file is named once, by the rule whose
+  // subject it is: A17 FAILs naming every such file and its path, which keeps
+  // the report red; this body adds no FAIL of its own about the file (a
+  // second naming), and it does not PASS (a certificate over a size nobody
+  // read). It SKIPs with a reason that names the pages it did not read and
+  // points at A17 — `unreadSizes` below, at both of the body's exits.
+  //
+  // ⚠️ Only when nothing else here failed. `skip()` is per assertion, and a
+  // skip beside failures puts A06 in two of the report's buckets (the #705
+  // argument in `a19.ts`); and a FAIL certifies nothing, so the unread page
+  // is A17's alone there. ⚠️ Not the tree's other multi-clause rule either
+  // (`../reasons.ts`, #580: a multi-clause assertion SKIPs only when EVERY
+  // clause had nothing to measure). That rule is about a clause whose subject
+  // list is EMPTY — zero is a count, and a count was measured. A page the
+  // atlas declares is a member of the size clause's subject that is present
+  // and was not read, and the PASS this replaces claimed it was.
+  const unread: string[] = [];
+  const unreadSizes = (): void => {
+    if (failures > 0 || unread.length === 0) return;
+    const total = atlas.pages.length;
+    skip(
+      'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+      unread.length === total
+        ? `no page's size was measured: none of the ${total} page file(s) the atlas declares is on disk, which ` +
+            "A17_ATLAS_PAGE_FILES_EXIST names file by file. The clauses that read only the atlas's own numbers found " +
+            "nothing to fail, and that is not a pass while every page's size is unread"
+        : `the size of ${unread.length} of the ${total} page(s) the atlas declares was not measured — ` +
+            `${unread.map((name) => JSON.stringify(name)).join(', ')} — because the file is not on disk, which ` +
+            `A17_ATLAS_PAGE_FILES_EXIST names. The ${total - unread.length} page(s) that were read, and the clauses ` +
+            "that read only the atlas's own numbers, found nothing to fail, and that is not a pass while a page's size is unread",
+    );
+  };
+  for (const page of atlas.pages) {
+    const abs = resolve(input.atlasDir, page.name);
+    if (!existsSync(abs)) {
+      unread.push(page.name); // A17 names the file; this body says only that it did not read it
+      continue;
+    }
+    // 🔒 **A page that is not a PNG is a named failure, not a throw** (issue
+    // #732). The reader's throw used to reach this rule's catch and print as
+    // `threw: not a PNG (bad signature)`: the verdict right, the sentence a
+    // stack message that named neither what the file was nor what rigc reads.
+    // `pngProblem` ([`src/png.ts`](png.ts)) is the one sentence every reader
+    // of a page states; this rule prefixes the size the atlas declares, the
+    // value the file would have had to carry.
+    //
+    // 🔒 **And this is the one line that names it** (issue #1064). A file's
+    // readability is this rule's subject — it runs under both profiles and
+    // asks `pngProblem` first, so on every input where `A19` would find the
+    // same page unreadable, this FAIL is already printed. `A19` therefore
+    // SKIPs naming the page and pointing here when it failed nothing else,
+    // and says nothing about the page when it did: one unreadable file, one
+    // line, the way #1055 made one missing file A17's alone.
+    //
+    // ⚠️ No size is read off a file rigc cannot decode, deliberately. A WebP
+    // header carries its dimensions in a fixed field, and reading them would
+    // print a number no oracle in this tree has checked (rigc links no WebP
+    // reader to compare a parse against), about a page that is refused here
+    // either way — and measured, the variant that PASSED a WebP page whose
+    // size agreed built green under the default profile and wrote a
+    // directory that `render` then refused.
+    const header = readPngHeader(abs);
+    if (header.problem !== null) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `page "${page.name}" declares ${page.width}x${page.height} and its file cannot be read as PNG, so the ` +
+          `size was not measured: ${header.problem}`,
+      );
+    }
+    // 🔒 **And a page whose header reads and whose image data does not decode
+    // is this rule's too** (issue #1074), for the reason #1064 made the
+    // unreadable header its: this is the one reader of every page that runs
+    // under both profiles. Measured before this, on the tree's 19 recipes with
+    // the first page's compressed stream overwritten past its first half,
+    // this rule PASSED on 19 of 19 (it read the header only) and `A19` alone
+    // named the file, as `threw: cannot decode PNG …`, on the 12 whose first
+    // page carries a part. On the 7 gallery rigs, whose first page is the base
+    // plate `A19` does not scan, nothing did: both rules PASSED under both
+    // profiles, and the default build wrote a directory `render` then died on.
+    //
+    // ⚠️ The stream is inflated, not decoded: `imageDataProblem` is the
+    // decoder's own refusing half and nothing after it — 68.9 ms over the 19
+    // builds' pages against `validate()`'s 286.2 ms under `spine`, where a
+    // whole decode would be 459.6 ms. A page whose data does not decode has no
+    // size worth comparing, so the grid clause is not asked of it: one file,
+    // one line.
+    const undecodable = header.info === null ? null : imageDataProblem(readFileSync(abs), abs);
+    if (undecodable !== null) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `page "${page.name}" declares ${page.width}x${page.height} and its file cannot be read as PNG, so ` +
+          `nothing on it was measured: ${undecodable}`,
+      );
+    }
+    const info = undecodable === null ? header.info : null;
+    const onPage = atlas.regions.filter((region) => region.page.name === page.name);
+    const gridSaid = info === null ? null : pageGridSentence(page, info, onPage);
+    if (gridSaid !== null) {
+      // 🔒 **Still validity, and now for a measured reason rather than an
+      // inherited one** (issue #715). The card that opened this expected the
+      // clause to move behind the profile switch once the runtime's mapping
+      // was measured — it is declared-size-relative, so a rescaled page
+      // draws. What settles it the other way is that the sentence below can
+      // name a repair the FORMAT already provides (`scale:`), and that two of
+      // the three readers a wrong grid breaks are rigc's own and run under
+      // both profiles. The sentence, and the one derivation of the ratio under
+      // it, is `pageGridSentence` in [`src/atlas.ts`](atlas.ts): the compiler's
+      // region lift states the same one when it is asked for texels on such a
+      // page (issue #750), so the two cannot come to describe one page two ways.
+      fail('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', gridSaid);
+    }
+    // 📐 PROFILE, from here down. `pma: false` and no rotation are rigc's atlas
+    // CONVENTION, not the atlas format's rules — a packed page with
+    // `rotate: 90` is what the Spine packer produces and every official example
+    // ships one. Under `spine` an atlas is judged only on whether its declared
+    // size matches the file it names.
+    if (policy && page.pma) {
+      fail('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', `page "${page.name}" claims premultiplied alpha; parts are straight alpha`);
+    }
+  }
+  // 🔒 **A region's rectangle lies inside the page it names, and that is
+  // VALIDITY** (issue #694). The clause is not new — it has read the same four
+  // numbers since issue #266 — but it stood inside the policy half below, and
+  // behind a guard that skipped any page carrying one region that covered it.
+  // Both fences were wrong for it. A rectangle that leaves its page is not a
+  // convention somebody else may hold differently: `u2 > 1` samples whatever
+  // the wrap mode returns, which is never the drawing the pack was made of, so
+  // the part draws garbage or nothing at all. Measured on a pack shaped like
+  // the two production atlases that found this — a page declaring 2048x256
+  // with regions at `2274,0 980x200` and `0,252 100x258` — every atlas
+  // assertion passed under the default profile and the first of the two parts
+  // drew 0 of the 10,517 pixels it draws when the same rig is built loose.
+  //
+  // ⭐ The tool's other half already said so, which is what settles where the
+  // clause belongs. `resolveFromAtlas` ([`src/compile.ts`](compile.ts)) refuses
+  // exactly this rectangle as a `CompileError` under every profile when a pack
+  // arrives through `--atlas-in`, so while it was policy here the compiler and
+  // the gate disagreed about the same four numbers — and the gate is the only
+  // half that a skeleton and a pack somebody else made ever reach.
+  //
+  // ⚠️ It is stated over `atlas.regions` rather than per page group, because
+  // the question is about one region and its own page and needs no neighbour:
+  // a page carrying a single full-page region is measured too, and answers
+  // trivially. The rectangle is `pageFootprint`'s and nobody else's here
+  // (issue #579): what `TextureAtlas` transposes at 90 and not at 270 is
+  // `u2`/`v2`, a UV pair `MeshAttachment.computeUVs` never reads for an atlas
+  // region, and the page rectangle is a different quantity — transposed at
+  // BOTH quarter turns. A region that fits only *because* it is turned is
+  // inside its page, and this clause says so.
+  for (const region of atlas.regions) {
+    const foot = pageFootprint(region);
+    if (
+      region.x < 0 ||
+      region.y < 0 ||
+      region.x + foot.width > region.page.width ||
+      region.y + foot.height > region.page.height
+    ) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `region "${region.name}" occupies ${region.x},${region.y} ${foot.width}x${foot.height} of page ` +
+          `"${region.page.name}", which is ${region.page.width}x${region.page.height} — a region that runs off ` +
+          'its page samples texels that are not there',
+      );
+    }
+  }
+  if (!policy) return unreadSizes();
+  // ⭐ **One part per page OR a tiling page** (issue #266, follow-up 2), and
+  // since issue #1099 the tiling half is not this assertion's. It held that no
+  // two regions on one page overlap — the check that makes shared-page
+  // sampling well defined — and it was stated over rectangles, which is the
+  // right statement for a region attachment and the wrong one for a mesh: a
+  // mesh draws its hull, and `--pack-shape polygon` puts a neighbour inside a
+  // mesh's rectangle wherever the hull is not. The clause is now
+  // `A49_PACKED_FOOTPRINTS_DO_NOT_OVERLAP` ([`./a49.ts`](a49.ts)), which
+  // refuses a pair only where the rectangles overlap AND what the two regions
+  // draw does — so every pair this clause refused where neither region is a
+  // readable mesh hull (an alias, a sequence frame, a rotated region, two
+  // rectangles planted over the same texels) is refused there, by the same two
+  // rectangles, under the same profile.
+  //
+  // ⚠️ Its sibling — every region inside the page it names — moved above and
+  // out of this profile in issue #694, and the two are not symmetrical. That
+  // one is broken for every consumer; the overlap is a statement about what a
+  // pack MEANS, and the corpus is the evidence rather than the taste:
+  // measured over the ten atlases in `examples/`, 0 of 132 regions are off
+  // their page and 49 pairs on four of those pages overlap, editor-exported
+  // and correct. That is why A49 is a renderer rule.
+  //
+  // ⚠️ Rotation stays refused either way, and that is not the same clause: it
+  // is about rigc's own packer never turning a region, which is a statement
+  // about what rigc WRITES. It stopped being a statement about what rigc can
+  // read in issue #570 — `extractRegion` now lifts a rotated region back off
+  // its page, measured against `MeshAttachment.computeUVs` (`PKR02`) — and the two
+  // must not be re-merged: an artifact under the renderer's own rulebook that
+  // rigc did not pack is still a foreign artifact, whatever rigc can measure.
+  for (const region of atlas.regions) {
+    if (region.degrees !== 0) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `region "${region.name}" is rotated; rigc's own packer never turns a region (see PACK_NO_ROTATE in ` +
+          'src/atlas.ts), so this atlas came from somewhere else',
+      );
+    }
+  }
+  unreadSizes();
+}

package/src/assertions/bodies/a07.ts

@@ -0,0 +1,68 @@
+/**
+ * A07, restated over the emitted text (issue #1060): the clause
+ * `validate()` runs in `src/validate.ts`, word for word, over the atlas text — the
+ * text rigc wrote, read by rigc's own reader rather than by spine-core's. The
+ * round trip's copy is unchanged and runs in `cli.ts build`; this one runs in
+ * the gate of the entry that links none of the runtime
+ * (`../emitted/index.ts`), and the selftest's `RC28` holds the two to the
+ * same lines on every recipe and on this assertion's mutants.
+ */
+import type { Verdicts } from '../harness.ts';
+import { SKIP_NO_ATLAS_PAGE } from '../reasons.ts';
+
+export function a07AtlasTextShape({ fail, skip }: Verdicts, atlasText: string): void {
+  const atlasLines = atlasText.replace(/\n$/, '').split('\n');
+  const atlasPageLines = atlasLines.filter((line) => line.trim().length > 0).length;
+  if (atlasPageLines === 0) {
+    // One of the exported reason constants, not a sentence of its own: the
+    // static-rig suite's arithmetic (S50, #580) counts a rule as skipped
+    // for want of a SUBJECT only when its reason is one of those constants.
+    return skip('A07_ATLAS_TEXT_SHAPE', SKIP_NO_ATLAS_PAGE);
+  }
+  // A blank line at either END of the file is named as that end (issues #803,
+  // #810), and a run of them is one finding stating its length. They are taken
+  // off both ends before the walk below, so the walk sees the page blocks and
+  // the blank lines between them and nothing else: a blank line after the last
+  // region is not a page block, and "consecutive blank lines" and "the last
+  // page block declares no region" are about blocks. `TextureAtlas` reads a
+  // blank at either end as nothing (`TextureAtlas.js:98-100` skips the leading
+  // run, `:116-118` ends a page block on each blank line), and rigc writes
+  // neither (`writeAtlasText`, and `--atlas-in` through `canonicalAtlasShape`),
+  // so a file that has one was written by something else and is refused.
+  let leading = 0;
+  while (leading < atlasLines.length && atlasLines[leading].trim().length === 0) leading++;
+  if (leading > 0) {
+    fail('A07_ATLAS_TEXT_SHAPE', `line 1: the file begins with ${leading === 1 ? 'a blank line' : `${leading} blank lines`}`);
+  }
+  let trailing = 0;
+  while (trailing < atlasLines.length - leading && atlasLines[atlasLines.length - 1 - trailing].trim().length === 0) trailing++;
+  const blockEnd = atlasLines.length - trailing;
+  let expectPage = true;
+  let sawRegionForPage = false;
+  for (let i = leading; i < blockEnd; i++) {
+    const line = atlasLines[i];
+    if (line.trim().length === 0) {
+      if (expectPage) fail('A07_ATLAS_TEXT_SHAPE', `line ${i + 1}: consecutive blank lines`);
+      else if (!sawRegionForPage) {
+        fail('A07_ATLAS_TEXT_SHAPE', `line ${i + 1}: blank line before this page had any region`);
+      }
+      expectPage = true;
+      sawRegionForPage = false;
+      continue;
+    }
+    if (expectPage) {
+      expectPage = false;
+      continue; // page name line
+    }
+    if (line.includes(':')) continue; // key: value line
+    // A bare non-key line is a region name, and it is used untrimmed.
+    if (line !== line.trim()) {
+      fail('A07_ATLAS_TEXT_SHAPE', `line ${i + 1}: region name has stray whitespace: ${JSON.stringify(line)}`);
+    }
+    sawRegionForPage = true;
+  }
+  if (!sawRegionForPage) fail('A07_ATLAS_TEXT_SHAPE', 'the last page block declares no region');
+  if (trailing > 0) {
+    fail('A07_ATLAS_TEXT_SHAPE', `line ${blockEnd + 1}: the file ends with ${trailing === 1 ? 'a blank line' : `${trailing} blank lines`}`);
+  }
+}

package/src/assertions/bodies/a08.ts

@@ -0,0 +1,76 @@
+/**
+ * A08, the body (issue #1025, step 4c of #380): every region an attachment
+ * resolves through is a region the atlas has, spelled exactly.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the atlas's
+ * region names and the skin entries' lookups are a fact
+ * (`../facts/region_joins.ts`) rather than a `TextureAtlas` built here and the
+ * raw JSON's walk. Why the rule runs before the round trip, and what A00 does
+ * about a miss it names, is argued above the `check` call in `validate()`,
+ * which stays there.
+ *
+ * `pathsWithNoRegion` is filled, not read: every lookup this body refuses for
+ * want of a region, which `validate()`'s A00 reads to defer to this rule rather
+ * than restate the miss. The model side hands a set nobody reads.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { RegionJoinFacts } from '../facts/region_joins.ts';
+import { SKIP_NO_ATTACHMENT_REGION_JOIN } from '../reasons.ts';
+
+export function a08RegionNamesMatchAttachments({ fail, skip }: Verdicts, facts: RegionJoinFacts, pathsWithNoRegion: Set<string>): void {
+  if (facts.regionNames === null) {
+    return skip(
+      'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+      'the atlas text does not parse, so there are no region names to join against (A00 owns that failure)',
+    );
+  }
+  const regionNames = new Set(facts.regionNames);
+  if (facts.joins === null) {
+    return skip('A08_REGION_NAMES_MATCH_ATTACHMENTS', 'the skeleton JSON did not parse (A00 owns that failure)');
+  }
+  let joined = 0;
+  for (const join of facts.joins) {
+    // A `sequence` the walk will not guess at: say nothing rather than invent
+    // a region name. A00 still has the last word on it.
+    if (join.lookups === null) continue;
+    for (const lookup of join.lookups) {
+      joined++;
+      const at = `skin "${join.skin}" slot "${join.slot}" placeholder "${join.placeholder}"`;
+      const present = regionNames.has(lookup);
+      if (!present) pathsWithNoRegion.add(lookup);
+      if (lookup !== lookup.trim()) {
+        fail(
+          'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+          `${at}: attachment "${join.name}" resolves through path ${JSON.stringify(lookup)}, which has stray ` +
+            `whitespace — the atlas is matched on the exact string, and ${
+              present
+                ? 'the region it finds carries the same padding'
+                : regionNames.has(lookup.trim())
+                  ? `the region this atlas has is ${JSON.stringify(lookup.trim())}, without it`
+                  : 'no region of this atlas carries it'
+            }`,
+        );
+      } else if (!present) {
+        // Not a guess and not a repair — a region the atlas DOES hold that
+        // differs from the wanted name only by case or padding. It is
+        // reported because it was measured, and where there is none the
+        // sentence says nothing at all.
+        const near = [...regionNames].find((r) => r.trim().toLowerCase() === lookup.toLowerCase());
+        fail(
+          'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+          `${at}: attachment "${join.name}" wants region "${lookup}", which this atlas does not have${
+            near === undefined ? '' : ` — it does have ${JSON.stringify(near)}`
+          }. Either the skeleton's "path" or the atlas region name is the one that moved`,
+        );
+      }
+    }
+  }
+  for (const region of regionNames) {
+    if (region !== region.trim()) {
+      fail('A08_REGION_NAMES_MATCH_ATTACHMENTS', `atlas region ${JSON.stringify(region)} has stray whitespace`);
+    }
+  }
+  if (joined === 0 && regionNames.size === 0) {
+    return skip('A08_REGION_NAMES_MATCH_ATTACHMENTS', SKIP_NO_ATTACHMENT_REGION_JOIN);
+  }
+}

package/src/assertions/bodies/a09.ts

@@ -0,0 +1,82 @@
+/**
+ * A09, the body (issue #1025, cut 4c-3 of step 4c of #380): the compiled
+ * duration is the declared duration (rule 4).
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the
+ * animations, their durations and their timelines' durations as one fact
+ * (`../facts/animation_durations.ts`) where it read the loaded skeleton's
+ * `animations`, `findAnimation` and each timeline's `getDuration()`. The
+ * declared durations are the caller's on both sides, as the rig info is. The
+ * `check` call stays in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { AnimationDurationFacts } from '../facts/animation_durations.ts';
+import { SKIP_NO_DECLARED_DURATION } from '../reasons.ts';
+import { float32Step } from '../../timelines.ts';
+
+/** One frame at 60 fps: how far a last key may fall short of the declared end before the declared duration reads as wrong. */
+const FRAME = 1 / 60;
+
+export function a09AnimationDurationMatchesSpec({ fail, skip }: Verdicts, facts: AnimationDurationFacts, declaredDurations: Record<string, number> | undefined): void {
+  // Without the spec there is no declared duration to compare the compiled
+  // one against, and returning here used to count as a PASS — a gate saying
+  // it checked something it never looked at.
+  if (!declaredDurations) {
+    return skip('A09_ANIMATION_DURATION_MATCHES_SPEC', 'no motion spec supplied, so no declared duration to compare against');
+  }
+  // Same trap one level down. A **static rig** — a skeleton that exists to
+  // be posed and carries no animation at all, which is what
+  // `1-weight-and-mass`'s second export is — declares nothing and loads
+  // nothing, so both loops below iterate zero times and the assertion
+  // reported PASS. That is the vacuous green this report is built to refuse:
+  // there is no duration here, and saying so is the honest answer.
+  if (Object.keys(declaredDurations).length === 0 && facts.animations.length === 0) {
+    return skip('A09_ANIMATION_DURATION_MATCHES_SPEC', SKIP_NO_DECLARED_DURATION);
+  }
+  for (const [name, declared] of Object.entries(declaredDurations)) {
+    const anim = facts.animations.find((a) => a.name === name);
+    if (!anim) {
+      fail('A09_ANIMATION_DURATION_MATCHES_SPEC', `spec declares animation "${name}" but the skeleton has none`);
+      continue;
+    }
+    // Two arms, and the asymmetry is the point.
+    //
+    // UNDERSHOOT is R7's question — is the declared duration wrong? An
+    // animation may hold its final pose, so a last key a little before the
+    // end is ordinary and a frame of that is slack.
+    //
+    // OVERSHOOT is a different question with a different tolerance.
+    // `anim.duration` IS the largest key time (`SkeletonJson.ts:1261` takes
+    // the max over every timeline's own duration), so a loaded duration past
+    // the declared one means a KEY is past it — and nothing that plays the
+    // animation for the duration it declares will ever reach that key. Rung
+    // 6 lost a one-frame attachment reveal to a key 3.4e-5 s past the end,
+    // 1/500 of FRAME, which this comparison read as agreement (issue #54).
+    // `compile.ts` refuses that per timeline now; this is the same rule held
+    // against a skeleton the compiler never saw.
+    // The slack is one float32 step at the declared duration, and it is the
+    // same function the compiler's Rule 4 refuses on (`float32Step`, in
+    // `timelines.ts`, which says why it is a step of the float and no longer
+    // a fixed 1e-6 plus one).
+    const slack = float32Step(declared);
+    const past = anim.duration - declared;
+    if (past > slack) {
+      const late = anim.timelineDurations.filter((d) => d - declared > slack).length;
+      fail(
+        'A09_ANIMATION_DURATION_MATCHES_SPEC',
+        `animation "${name}" has ${late} timeline(s) keyed past the declared duration ${declared}s — ` +
+          `the last key is at ${anim.duration}s, ${past.toFixed(6)}s late, so nothing ever samples it`,
+      );
+    } else if (declared - anim.duration > FRAME) {
+      fail(
+        'A09_ANIMATION_DURATION_MATCHES_SPEC',
+        `animation "${name}" loaded duration ${anim.duration}s, spec declares ${declared}s`,
+      );
+    }
+  }
+  for (const anim of facts.animations) {
+    if (!(anim.name in declaredDurations)) {
+      fail('A09_ANIMATION_DURATION_MATCHES_SPEC', `skeleton has animation "${anim.name}" with no spec entry`);
+    }
+  }
+}

package/src/assertions/bodies/a10.ts

@@ -0,0 +1,116 @@
+/**
+ * A10, the body (issue #1025, cut 4c-5a of step 4c of #380): no pose the
+ * skeleton is stepped through holds a number that is not finite, or a bone
+ * with no inheritance mode.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads, which is
+ * `BoneTimelineFacts` (`../facts/bone_timelines.ts`) for the `inherit` keys
+ * where it read the skeleton JSON, and `SteppedPoseFacts`
+ * (`../facts/stepped_poses.ts`) where it posed a spine-core skeleton itself:
+ * the setup pose, each animation's looping walk, and a bone's mode posed at a
+ * key — which `validate()` takes from spine-core and the model side from
+ * rigc's core. The scan of a pose is `firstNonFinite` (`../../nonfinite.ts`),
+ * the sentence `render` refuses on, called rather than restated. The argument
+ * for each clause is above the `check` call, which stays in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { BoneTimelineFacts } from '../facts/bone_timelines.ts';
+import type { SteppedFrame, SteppedPoseFacts } from '../facts/stepped_poses.ts';
+import { SKIP_NO_POSE } from '../reasons.ts';
+import { isObj } from '../values.ts';
+import { firstNonFinite } from '../../nonfinite.ts';
+import { BONE_INHERIT_KNOWN } from '../../rig.ts';
+
+/** The steps A10 takes through every animation: the walk is `max(duration, 1) / STEP_FRAMES` long per step. */
+export const STEP_FRAMES = 120;
+
+export function a10NoNanAfterStepping({ fail, skip, stats }: Verdicts, boneTimelines: BoneTimelineFacts, facts: SteppedPoseFacts): void {
+  if (facts.steppedAnimations.length === 0 && facts.boneCount === 0) {
+    skip('A10_NO_NAN_AFTER_STEPPING', SKIP_NO_POSE);
+    return;
+  }
+
+  // -- the bone's inheritance mode, posed at every `inherit` key
+  let unresolved = 0;
+  for (const { animation: animName, bone: boneName, timelines } of boneTimelines.boneTimelines) {
+    if (!isObj(timelines) || !Array.isArray(timelines.inherit)) continue;
+    if (!facts.hasAnimation(animName) || !facts.hasBone(boneName)) continue;
+    for (const rawKey of timelines.inherit as unknown[]) {
+      if (!isObj(rawKey)) continue;
+      const time = typeof rawKey.time === 'number' ? rawKey.time : 0;
+      const posed = facts.posedInherit(animName, boneName, time);
+      if (posed === null) continue;
+      unresolved++;
+      fail(
+        'A10_NO_NAN_AFTER_STEPPING',
+        `animation "${animName}" bone "${boneName}" inherit (t=${time}): the bone poses inheritance mode ` +
+          `${String(posed)} — the key spells ${JSON.stringify(rawKey.inherit)}, which the runtime's mode lookup ` +
+          `does not resolve (${BONE_INHERIT_KNOWN}), so no mode applies until the next key and the bone keeps ` +
+          'the world rotation, scale and shear it had',
+      );
+    }
+  }
+  if (unresolved > 0) return;
+
+  // -- the whole world transform, at the setup pose and every stepped frame
+  if (facts.steppedAnimations.length === 0) stats.nanStepping = 'skipped';
+  const atRest = facts.setup();
+  const atSetup = firstNonFinite('the setup pose', atRest.drawn, atRest.bones);
+  if (atSetup !== null) {
+    fail('A10_NO_NAN_AFTER_STEPPING', atSetup);
+    return;
+  }
+
+  /**
+   * What a posed frame shows that the world-transform scan does not read: a
+   * bone posing no inheritance mode, and a slot colour that is not finite.
+   * `where` leads the sentence — the animation's name at a stepped frame,
+   * as it always has, or `the setup pose` on a skeleton with no animation.
+   */
+  const poseDefect = (where: string, frame: SteppedFrame): string | null => {
+    for (const bone of frame.bones) {
+      if (bone.inherit !== null) {
+        return (
+          `${where}: bone "${bone.name}" poses inheritance mode ${bone.inherit} — its setup ` +
+          `spells inherit ${facts.statedInherit(bone.name)}, which the ` +
+          `runtime's mode lookup does not resolve (${BONE_INHERIT_KNOWN}), so its world rotation, scale and shear ` +
+          'are never computed — they stay 0 and everything the bone carries collapses to a point'
+        );
+      }
+    }
+    for (const slot of frame.slots) {
+      if (!slot.colour.every(Number.isFinite)) return `${where}: slot "${slot.name}" colour is non-finite`;
+      if (slot.dark !== null && !slot.dark.every(Number.isFinite)) {
+        return `${where}: slot "${slot.name}" dark colour is non-finite`;
+      }
+    }
+    return null;
+  };
+
+  if (facts.steppedAnimations.length === 0) {
+    const atRestDefect = poseDefect('the setup pose', atRest);
+    if (atRestDefect !== null) fail('A10_NO_NAN_AFTER_STEPPING', atRestDefect);
+    return;
+  }
+  for (const anim of facts.steppedAnimations) {
+    const step = Math.max(anim.duration, 1) / STEP_FRAMES;
+    const frames = facts.walk(anim.name, step, STEP_FRAMES);
+    for (let i = 0; i < STEP_FRAMES; i++) {
+      const frame = frames[i];
+      const found = firstNonFinite(
+        `animation ${JSON.stringify(anim.name)} frame ${i + 1} of ${STEP_FRAMES} (t=${((i + 1) * step).toFixed(4)}s)`,
+        frame.drawn,
+        frame.bones,
+      );
+      if (found !== null) {
+        fail('A10_NO_NAN_AFTER_STEPPING', found);
+        return;
+      }
+      const defect = poseDefect(anim.name, frame);
+      if (defect !== null) {
+        fail('A10_NO_NAN_AFTER_STEPPING', defect);
+        return;
+      }
+    }
+  }
+}

package/src/assertions/bodies/a11.ts

@@ -0,0 +1,15 @@
+/**
+ * A11, the body (issue #1025, step 4c of #380): no clipping attachment — the
+ * renderer skips them silently. A `renderer` rule, so `spine` never runs it.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the count is
+ * a fact (`../facts/skin_entries.ts`).
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkinEntryFacts } from '../facts/skin_entries.ts';
+
+export function a11NoClippingAttachments({ fail }: Verdicts, { clippingCount }: SkinEntryFacts): void {
+  if (clippingCount > 0) {
+    fail('A11_NO_CLIPPING_ATTACHMENTS', `${clippingCount} clipping attachment(s); the renderer skips them silently`);
+  }
+}

package/src/assertions/bodies/a12.ts

@@ -0,0 +1,30 @@
+/**
+ * A12, the body (issue #1025, cut 4c-4 of #380): no dark colour and no
+ * two-colour timeline — both parsed, then silently ignored by spine-html.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the slots
+ * are a fact (`../facts/skeleton_roster.ts`) and the slot timelines are A45's
+ * (`../facts/slot_colour.ts`), rather than the raw JSON and `walkTimelines`
+ * over it. The path printed is the one `walkTimelines` built for a slot
+ * timeline, `<animation>.slots.<slot>.<timeline>`, and only a timeline whose
+ * keys are a list is one it visited.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkeletonRosterFacts } from '../facts/skeleton_roster.ts';
+import type { SlotTimelines } from '../facts/slot_colour.ts';
+
+export function a12NoDarkColor({ fail }: Verdicts, { slots }: SkeletonRosterFacts, slotTimelines: readonly SlotTimelines[]): void {
+  for (const slot of slots) {
+    if (slot.dark) {
+      fail('A12_NO_DARK_COLOR', `slot "${slot.name}" declares a dark colour; the renderer ignores it`);
+    }
+  }
+  for (const { animation, slot, timelines } of slotTimelines) {
+    for (const [name, keys] of Object.entries(timelines)) {
+      if (!Array.isArray(keys)) continue;
+      if (name === 'rgba2' || name === 'rgb2') {
+        fail('A12_NO_DARK_COLOR', `${animation}.slots.${slot}.${name}: two-colour timeline "${name}" is silently ignored by the renderer`);
+      }
+    }
+  }
+}