rig-create 1.0.2 → 1.1.0

package/README.md

@@ -117,11 +117,11 @@ selects either a rig or a post version.
 `--by` sign-off/review and `interview-answer --pick` are low-level interfaces for
 people operating the CLI themselves and synthetic fixtures, not an agent route
 for human acts. Agents must not type an owner's answer or signature, or request
-one in chat in place of Review. Until create#493, an agent may type `reopen` only
-using a Review host raw export `act@4`: save its nonempty `value.words`
-byte-for-byte to the `--verbatim-file` and name `actId` with `--source`.
-Empty/missing words are a STOP; the agent never supplies words. `job fetch-act`
-rejects `act@4`; use the host raw export. See [the live Review flow](docs/LIVE-REVIEW.md)
+one in chat in place of Review. After an accepted post is bounced, host
+`job open --plan` for its single direction-review reopen, list the act with
+`job acts --json`, then ingest `reopen direction-review --from-review <actId>`
+and `job close`. The exported act supplies the reviewer, timestamp and unchanged
+words. Other stages retain the direct human `--by`/`--verbatim-file` reopen route. See [the live Review flow](docs/LIVE-REVIEW.md)
 and [the record contract](docs/PROJECT.md#recording-a-sign-off).
 
 ## The clock
@@ -163,6 +163,22 @@ it fails, naming the constant, when a `*_SINCE` date is still in the future.
   are synthetic fixture records, not a person's approval
   ([why](templates/example-draft/README.md)).
 
+## Verify the installed examples
+
+From a consumer project with `@rig-c/create` installed, run:
+
+```sh
+bun node_modules/@rig-c/create/scripts/verify-example-seals.ts
+```
+
+The shipped, dependency-free script verifies every `files[]` entry and
+`project_sha256` in the six example-chain checkpoint manifests (currently
+319 checks). It names missing files and hash mismatches and exits nonzero.
+It reads installed bytes only; it does not regenerate examples or run producers.
+The CLI creates projects from empty templates; it does not copy worked examples.
+
+See [release candidate verification](https://github.com/rig-c/create/blob/main/RELEASING.md#verify-the-release-candidate).
+
 ## Licence
 
 [MIT](LICENSE).

package/docs/AGENT-REFERENCE.md

@@ -0,0 +1,62 @@
+# Agent reference
+
+## Before you ask, plan or show
+
+- **Projection.** Ask and record it per [CHECKS.md § Projection and ground](https://github.com/rig-c/create/blob/main/docs/CHECKS.md#projection-and-ground).
+- **Head turn is a rig decision.** Ask `turn` at rigging-interview: fixed view
+  or head turn with depth. Record the chosen route and reason in the `turn`
+  plan step text. Default to per-part depth: parts 2.37.0's `docs/DEPTH.md`
+  describes it as better by eye. Run `depth-prepare`, the supplied model,
+  `depth-apply`, then `rig`. Retain the prepare manifest with
+  `rig-version --depth-manifest`; registration binds it, `depth-report.json`
+  and rig's `depth_sheets.json` by SHA-256.
+  The layer alternative requires sheets already retained in the accepted
+  assembled parts, bound alongside the existing `config.depth` images:
+  `assemble` consumes `config.depth`, so declaring it after acceptance cannot
+  add sheets. Do not reassemble accepted parts here. Existing sheets need no
+  model manifest.
+- **Camera options.** Post decides fixed framing or camera-box moves. Timed
+  head-turn dials, plate parallax and take-wide gaze remain unavailable in direction.
+- **Seamless loop on a rig with physics.** A looping take that starts at
+  source 0 begins with springs at rest and ends with them moving, so hair and
+  ribbons jump at the seam. Map the take onto a source interval that starts
+  after whole periods of the clip; ten were enough on the measured rig. The
+  number depends on the rig's damping, so compare the first and last frames
+  before choosing it.
+- **Upscale first** a painting smaller than the rig needs (SOURCE.md, step 2 below).
+- **The crux is a bar.** Before rigging, name every risk band, count background
+  or doubled pixels over every frame and both physics/breath extremes, and
+  report the maximum and its frame. Cover every band crossing another bone.
+- **Appearance needs a person**, not a step bar: [CHECKS.md § Appearance bar wording](https://github.com/rig-c/create/blob/main/docs/CHECKS.md#appearance-bar-wording).
+- **Nothing unnamed.** Add no unnamed motion, chain or physics. Read references
+  for what they show; ask about anything more.
+- **Re-run first, cut last**, never a polygon in code or config: the ladder in
+  SOURCE.md, step 2 below.
+- **A full-screen scene is a CG build.** For `rig_type` `fullscreen.*`, each
+  rig version declares the gates in [CHECKS.md § CG gates](https://github.com/rig-c/create/blob/main/docs/CHECKS.md#cg-gates). Refusals are the art's to fix.
+- **The bust is meshed** unless the `meshes` guide excludes it with a reason
+  ([CHECKS.md § The bust at meshes](https://github.com/rig-c/create/blob/main/docs/CHECKS.md#the-bust-at-meshes)).
+- **Overlaps.** A piece over a part with its own animation (glasses over
+  eyelids) holds none of that part's pixels, or the animation shows its copy.
+- **Pairs.** Measure left/right symmetry against the painting before calling a
+  pair uneven ([CRAFT.md G8](https://github.com/rig-c/create/blob/main/docs/CRAFT.md#for-the-gates-not-the-interview)).
+- **Look before the user does**, at native resolution and every crux boundary:
+  a whole-figure |composite − painting| map, each component by box/part and
+  status (in the painting / fixed / left, why). Use the true part stack; crop on
+  white and mid-grey to show light fringes. Check beyond reviewer-chosen boxes.
+
+## What to read, and why
+
+1. **Before the interview**: INTERVIEW.md; CRAFT.md (waypoint defaults);
+   parts AUTHORING §3, *`config.json`, field by field*;
+   [CHECKS.md](https://github.com/rig-c/create/blob/main/docs/CHECKS.md) before a sign-off.
+2. **Before `seethrough` and `assemble`**: SOURCE.md, split/cut order:
+   [bad-split reruns](https://github.com/rig-c/create/blob/main/docs/SOURCE.md#re-run-first),
+   [allowed cuts](https://github.com/rig-c/create/blob/main/docs/SOURCE.md#where-a-cut-is-allowed);
+   parts AUTHORING *See-through head-run source reading*, *Source before
+   scissors* and *Limbs: cut at their joints*.
+3. **Before rigging**: [CRAFT.md § For the gates](https://github.com/rig-c/create/blob/main/docs/CRAFT.md#for-the-gates-not-the-interview)
+   (G1–G9); core RIGGING and MOTION; parts AUTHORING §7, the bars `check` enforces.
+4. **Before showing the user**: [LESSONS.md § The self-check](https://github.com/rig-c/create/blob/main/docs/LESSONS.md#the-self-check),
+   the [per-frame seam count](https://github.com/rig-c/create/blob/main/docs/LESSONS.md#count-the-seam-bar-over-every-frame),
+   [what to show first](https://github.com/rig-c/create/blob/main/docs/LESSONS.md#what-to-show-the-user-first).

package/docs/CHECKS.md

@@ -25,6 +25,7 @@ requires Bun 1.4 or later. See [Live review](LIVE-REVIEW.md).
 | Code | Finding and remedy |
 | --- | --- |
 | `JOB_PUBLISH_PENDING` | A committed `project.json` result awaits publication. Restore its bound host and sources, then run `job reconcile` before another participating write or close. |
+| `JOB_ROOT_REPLACED` | `project.json`: the managed Review state belongs to a replaced project directory, or its ownership/liveness cannot be established safely. Stop the original `job open` host in its terminal, then retry `job open` or `job reconcile`. With no pending publication or startup claim, both commands preserve the old state in a dated `.replaced-…` sibling only when its recorded PID is absent and its recorded loopback port refuses connections. Missing/unsafe metadata, an occupied port or uncertain liveness refuses without retiring state; restore the retained metadata or original directory before retrying. |
 | `JOB_HOST_ATTACH_REFUSED` | Strict reuse-only attach to the bound live host was refused. The pending receipt names the host `reason` and `phase` (including `incarnation-missing` on `record` or `probe`). Reopen or restore the bound live host before reconciling. |
 | `JOB_HOST_REUSE_MISMATCH` | The private binding's host tuple or `listenerIncarnation` (`jobId`, `origin`, `listenerIncarnation`, `root`, `stateDir`, `fingerprint`, `reviewer.id`, `reviewer.role`, `readerId`, `bindingId`, `partsEnumeratorId`, `partsEnumeratorVersion`, `apiSchema`, `actSchema`, `port`) differs. The pending receipt names the `field` and both `expected` and `actual` values. Restore the original host configuration before reconciling. |
 | `JOB_PUBLICATION_STALE` | The pending version entry is missing or has a different entry hash. Restore that retained version and its files before reconciling. Later surrounding-record changes do not invalidate version publications. Exception: a record publication binds the whole project.json byte hash, so any record change while it is pending makes it stale; restore the bound record bytes before reconciling. The check preserves the receipt and names the HOLE. |
@@ -47,20 +48,20 @@ requires Bun 1.4 or later. See [Live review](LIVE-REVIEW.md).
 | Code | Finding and remedy |
 | --- | --- |
 | `REVIEW_API_SCHEMA_UNSUPPORTED` | `project.json.review_acts` received an unsupported API schema. Restore a live job using job-api@2 and fetch again. |
-| `REVIEW_ACT_SCHEMA_UNSUPPORTED` | `project.json.review_acts` received an unsupported act schema, explicitly including act@1. Request a new act@2 without migrating the old act. |
+| `REVIEW_ACT_SCHEMA_UNSUPPORTED` | `project.json.review_acts` received an unsupported act schema, explicitly including act@1. Request a supported act from Review without migrating the old act; record reopen uses act@4. |
 | `REVIEW_PARTS_ENUMERATOR_UNSUPPORTED` | The act's Parts enumerator is missing or outside `>=2.25.0 <4.0.0`. Publish through an accepted installed Parts enumerator and review again. |
-| `REVIEW_ACT_INVALID` | The fetched/retained act, response identity, authority, date or rig/post or parts value is malformed. Restore the original act evidence or request a new act. |
-| `REVIEW_ACT_KIND_MISMATCH` | The act is for another version or a kind outside the requested review-verdict, parts-verdict, interview-picks, checkpoint or signoff writer, or a signoff act signs a stage other than the one `signoff <stage> --from-review` names. Use the matching version, stage and supported writer. |
+| `REVIEW_ACT_INVALID` | The fetched/retained act, response identity, authority, date, rig/post or parts value, or record reopen value is malformed. Restore the original act evidence or request a new act. |
+| `REVIEW_ACT_KIND_MISMATCH` | The act is for another version or a kind outside the requested review-verdict, parts-verdict, interview-picks, checkpoint, signoff or reopen writer, or a signoff/reopen act names a stage other than the requested writer stage. Use the matching version, stage and supported writer. |
 | `REVIEW_ACT_TARGET_MISMATCH` | `signoffs[].target.version`: a `rig-review` or `direction-review` signoff act is ingested with `signoff <stage> --from-review <actId>`, but its `source.selector` names no version of that stage's kind (`rig` for rig-review, `post` for direction-review), or `--version` names another version than the one the person approved. The signature's target is the version Review displayed, so drop `--version` or ask for the sign-off again in Review on the version to sign. Refusal preserves the project record. |
 | `REVIEW_ACT_DRAFT_MISMATCH` | `signoffs[].draft_id`: a `parts-review` signoff act is ingested with `signoff parts-review --from-review <actId>`, and its `source.selector` is a non-draft selector or names another draft than `--draft`. Drop `--draft` so the signature takes the draft from the act's `{ kind: 'draft', id }` selector, or ask for `parts-review` again in Review on the draft to sign. Refusal preserves the project record. |
 | `REVIEW_ACT_CHECKPOINT_MISMATCH` | `signoff <stage> --checkpoint <id> --from-review <actId>` fetched a checkpoint act whose `planStepId` is not `<id>`, or whose `checkpointId` differs from its `planStepId` (create publishes no checkpoint alias). Sign the checkpoint the act names, or ask Review for this one. Refusal preserves the project record. |
 | `REVIEW_ACT_CHECKPOINT_FAILED` | The fetched checkpoint act's outcome is `fail`. A failed checkpoint is feedback, never a sign-off: nothing is written. Fix the step from the act's words and ask for the checkpoint again in the live Review job. |
-| `REVIEW_ACT_SUBJECT_UNDECLARED` | `signoff <stage> --from-review <actId>` or `signoff <stage> --checkpoint <id> --from-review <actId>` fetched an act whose subject (`signoff` for its stage, or `checkpoint` for its checkpoint id) is not among the subjects create declared for the act's publication, as kept in the private acknowledged receipt. A package publication declares only the record's own signable stage and its enabled checkpoints (LIVE-REVIEW.md). Ask for the sign-off in Review on a publication made while the record can sign it. A receipt written before declarations were retained, or none (a clone), skips this comparison. Refusal preserves the project record. |
+| `REVIEW_ACT_SUBJECT_UNDECLARED` | `signoff <stage> --from-review <actId>` or `signoff <stage> --checkpoint <id> --from-review <actId>` or `reopen <stage> --from-review <actId>` fetched an act whose subject (`signoff` for its stage, `checkpoint` for its checkpoint id, or `reopen` for its stage) is not among the subjects create declared for the act's publication, as kept in the private acknowledged receipt. A package publication declares only the record's own signable stage and its enabled checkpoints (LIVE-REVIEW.md). Ask for the sign-off in Review on a publication made while the record can sign it. A receipt written before declarations were retained, or none (a clone), skips this comparison. Refusal preserves the project record. |
 | `REVIEW_FILE_ROUTE_REMOVED` | `project.json.review_acts` cannot ingest saved act files (exit 2). Use `review <version> --from-review <actId>` through the live Review job API. |
 | `REVIEW_ACT_FETCH_REFUSED` | The live job refused or could not complete finalized-act fetch. The diagnostic retains the producer refusal code without exposing its private details. Restore the live job and its writer grant. |
 | `REVIEW_ACT_SOURCE_STALE` | A current source binding or retained version/draft-entry identity differs from the displayed act, including a plan-bound signoff act (`plan-approved`, `rigging-interview`, `post-interview`) whose `source.plan` step ids and hashes, in order, differ from the current `plan.steps`. Restore the retained bytes or publish the current plan and request a new review or sign-off. Replays also refuse without changing the recorded verdict. |
 | `REVIEW_ACT_REPLAY_CONFLICT` | A `(jobId, actId)` appears twice or its immutable value changed. Restore the original receipt and its single linked verdict. |
-| `REVIEW_ACT_LEDGER_INVALID` | `review_acts[]` or one receipt's identity, hash, target, linked verdict, linked signoff (the one `signoffs[]` entry whose `source` names the act, with the act's stage, `by`, `at` and words, and for rig-review or direction-review a `target.version` equal to the act's `source.selector` version) or retained parts evidence is invalid. Restore the original receipt and verdict or signoff together. |
+| `REVIEW_ACT_LEDGER_INVALID` | `review_acts[]` or one receipt's identity, hash, target, linked verdict, linked signoff (the one `signoffs[]` entry whose `source` names the act, with the act's stage, `by`, `at` and words, and for rig-review or direction-review a `target.version` equal to the act's `source.selector` version), linked reopen (including its original status snapshot and exact exported reviewer, date and words), or retained parts evidence is invalid. Restore the original receipt and recorded act together. |
 | `REVIEW_ACT_VERSION_UNVERIFIED` | WARN on ingest when the acknowledged publication receipt is unavailable. The version-entry comparison was skipped, and all explicit source bindings were checked. Preserve private acknowledged receipts for future ingests. |
 | `PARTS_REVIEW_OPTION_INVALID` | `project.json.review_acts` received missing, duplicate or competing parts-review options. Use `parts-review --from-review <actId>` and submit human values through Review. |
 | `PARTS_REVIEW_EVIDENCE_CONFLICT` | The deterministic semantic evidence path contains different bytes or unsafe filesystem entries. Preserve that evidence and restore the original act before retrying. Refusal preserves the project record. |
@@ -645,7 +646,7 @@ This new record has no retroactive requirement on earlier project records.
 | `REOPEN_STAGE_UNKNOWN` | a target is unknown, `paused` or `accepted` | choose a stage in the order that can be reopened |
 | `REOPEN_NOT_PASSED` | the target is later than its own from_stage and historical signatures/versions dated by the reopen | reopen a previously reached stage |
 | `REOPEN_MALFORMED` | reopens is not a list, an entry lacks its human signature, from_stage, valid date or status snapshot, source is not text, or the writer cannot identify a plan step | restore the named record to the PROJECT.md reopen shape |
-| `REOPEN_OPTION_INVALID` | missing/repeated option values or invalid argument count (exit 2) | supply a stage, --by, optional source and one optional folder |
+| `REOPEN_OPTION_INVALID` | missing/repeated option values, invalid argument count, or --from-review mixed with human flags (exit 2) | supply a stage and either --from-review or --by with optional source and words file, plus one optional folder |
 | `SIGNOFF_NOT_HUMAN` | a reopen is signed by agent, case-insensitively | obtain a person's signature |
 
 The existing `UNKNOWN_OPTION`, `VERBATIM_*`, `PROJECT_JSON_*` and
@@ -738,7 +739,7 @@ are unchanged. No prepared files are silently registered or repaired.
 | `DERIVED_FILE_CHANGED` | either file's bytes differ from its recorded sha256 | restore the recorded bytes, or record the new preparation |
 | `AGENT_BOUNCE_MALFORMED` | a history entry dated on or after `AGENT_BOUNCE_SINCE` has a `bounce` other than `{ cause: "agent", failed, bar, replacement }` with non-empty text | write what failed, the bar, and its replacement |
 
-Contract dates (`AGENT_BOUNCE_SINCE`, `ASK_COVERAGE_SINCE`, `DIFF_MAP_SINCE`, `DIFF_MAP_AGENT_SINCE`, `APPLIED_REVIEW_SINCE`, `PROJECTION_ASKS_SINCE`, `SETUP_PAINTING_SINCE`, `FIGURE_MASK_SINCE`, `FIGURE_MASK_INPUTS_SINCE`, `CHOICE_ANSWERS_SINCE`, `BUILD_IDENTITY_SINCE`, `PART_FILE_IDENTITY_SINCE`, `CONFIG_INPUTS_SINCE`, `DESCRIBED_DIRECTION_SINCE`, `SIGNOFF_TARGET_SINCE`, `SIGNOFF_PAIR_SINCE`, `SIGNOFF_ANSWERS_SINCE`, `STAGE_PROGRESS_SINCE`, `INPUT_WRITER_SINCE`, `DIRECTION_SCENE_SINCE`, `OVERRIDDEN_ANSWERS_SINCE`, `RUN_RECORD_SINCE`, `PROGRESS_HISTORY_SINCE`, `SCENE_CONTEXT_SINCE`, `PARTS_CHECK_SINCE`, `PLATE_RECEIPT_SINCE`, `REVIEW_READ_SINCE`, `PARTS_VERDICT_DRAFT_SINCE`, `PARTS_VERDICT_LATEST_SINCE`, `PARTS_VERDICT_RECEIPT_SINCE`, `FIX_LEDGER_SINCE` and `DRAFT_CONFIG_INPUTS_SINCE`) are the day the change lands, at 00:00Z, so they are never in the future; a record made earlier that day is checked against pilot projects before the change lands.
+Contract dates (`HEAD_TURN_SINCE`, `AGENT_BOUNCE_SINCE`, `ASK_COVERAGE_SINCE`, `DIFF_MAP_SINCE`, `DIFF_MAP_AGENT_SINCE`, `APPLIED_REVIEW_SINCE`, `PROJECTION_ASKS_SINCE`, `SETUP_PAINTING_SINCE`, `FIGURE_MASK_SINCE`, `FIGURE_MASK_INPUTS_SINCE`, `CHOICE_ANSWERS_SINCE`, `BUILD_IDENTITY_SINCE`, `PART_FILE_IDENTITY_SINCE`, `CONFIG_INPUTS_SINCE`, `DESCRIBED_DIRECTION_SINCE`, `SIGNOFF_TARGET_SINCE`, `SIGNOFF_PAIR_SINCE`, `SIGNOFF_ANSWERS_SINCE`, `STAGE_PROGRESS_SINCE`, `INPUT_WRITER_SINCE`, `DIRECTION_SCENE_SINCE`, `OVERRIDDEN_ANSWERS_SINCE`, `RUN_RECORD_SINCE`, `PROGRESS_HISTORY_SINCE`, `SCENE_CONTEXT_SINCE`, `PARTS_CHECK_SINCE`, `PLATE_RECEIPT_SINCE`, `REVIEW_READ_SINCE`, `PARTS_VERDICT_DRAFT_SINCE`, `PARTS_VERDICT_LATEST_SINCE`, `PARTS_VERDICT_RECEIPT_SINCE`, `FIX_LEDGER_SINCE` and `DRAFT_CONFIG_INPUTS_SINCE`) are the day the change lands, at 00:00Z, so they are never in the future; a record made earlier that day is checked against pilot projects before the change lands.
 
 Exception for #117 (2026-11-06): `original_n` has no `*_SINCE` boundary because repo HQ counted zero consumer records with `pre_interview: true`, only the synthetic fixture being updated, and historical build dates cannot date a migration.
 
@@ -1353,6 +1354,15 @@ cited by the latest live post. With no live post, no scene is current. Every
 scene still requires historical human acceptance, its matching package identity
 and all schema, raw-byte seal, model, animation, frame, plate and citation checks.
 
+`scene write --animation <name>` selects an exact name from the bound model's
+catalog, defaulting to `idle`. Idle still copies `registration.idle` exactly.
+New non-idle scenes omit optional `animation.frames`: there is no named-animation
+registration to copy. The reader preserves the previously accepted non-idle
+`frames === registration.idle` binding as legacy metadata, verifying its bytes
+without claiming it proves frames of the selected non-idle clip. Other provided
+non-idle frame bindings were already refused and remain refused. No historical
+acceptance is narrowed, so this change introduces no SINCE date or pilot migration.
+
 | Code | Refuses when | Remedy |
 | --- | --- | --- |
 | `SCENE_MALFORMED` | unknown keys at any level, wrong types, schema, n, paths or registration frames | restore the closed scene@1 record and run scene write |
@@ -1360,7 +1370,8 @@ and all schema, raw-byte seal, model, animation, frame, plate and citation check
 | `SCENE_RIG_STALE` | rig lacks the cited historical human acceptance, or the current rig is not the latest live accepted rig | accept the current rig and run scene write |
 | `SCENE_ACCEPTANCE_STALE` | historical acceptance/package identity differs, or a current signoff has lapsed | restore the accepted package and sign rig-review again |
 | `SCENE_MODEL_MISMATCH` | model path or raw-byte hash differs from the accepted package inventory | retain the accepted compiled model and run scene write |
-| `SCENE_ANIMATION_MISSING` | animation is absent from the model | select a model naming the animation and run scene write |
+| `SCENE_ANIMATION_MISSING` | animation is absent from the bound model catalog | pass --animation with a name from the accepted model and run scene write (default: idle) |
+| `SCENE_ANIMATION_FRAMES_UNBOUND` | non-idle frames are present but differ from registration.idle, which the previous reader also refused | omit optional frames and run scene write --animation <name> |
 | `SCENE_STAGE_MISSING` | compiled model stage is null or absent | compile a model declaring a stage before scene write |
 | `SCENE_STAGE_MISMATCH` | frame.stage differs from model.stage | copy the exact compiled stage through scene write |
 | `SCENE_PLATE_CONFLICT` | background is absent, roles duplicate, or roles share a path or hash | designate one background and at most one distinct foreground |
@@ -1462,7 +1473,7 @@ the record unchanged.
 | Code | Finding and remedy |
 | --- | --- |
 | `JOB_RECORD_SUBJECT_INVALID` | `project.json` does not bind the explicitly requested question, option set and effective stage, including a question whose pick is already recorded and so has no pending set, or a subject id cannot be represented by the record publication contract. Publish the exact current pending subject with its original representable id. |
-| `JOB_DIRECTION_VERDICT_REQUIRED` | `job open --plan` at `direction-review` finds no accepted live direction verdict on the current live post in `project.json.versions`. Open the post with `job open --rig <n>` and ingest `review <n> --from-review <actId>` before requesting direction sign-off. This is a publication precondition, not a new record-check rule. |
+| `JOB_DIRECTION_VERDICT_REQUIRED` | `job open --plan` at `direction-review` finds no accepted live direction verdict on the current live post in `project.json.versions`. Open the post with `job open --rig <n>` and ingest `review <n> --from-review <actId>` before requesting direction sign-off. An accepted-then-bounced post instead offers exactly one reopen subject, for direction-review; it does not offer direction sign-off. Ordinary record-plan pages declare no reopen subjects. This is a publication precondition, not a new record-check rule. |
 | `INTERVIEW_SIGNOFF_NOT_CLEAN` | An interview record-plan publication or first record-mode sign-off ingest finds a refusal or delivery hole from the full `interview --check` function on `project.json`. Resolve that check, republish with `job open --plan` and ask for the interview signature again. This is a new-route precondition; existing records and CLI `--by` signatures keep their checks. A refused ingest leaves the record byte-identical. |
 | `INTERVIEW_SIGNOFF_PLAN_REQUIRED` | An interview record-plan publication or first record-mode sign-off ingest has no displayed `project.json.plan.steps`. Draft non-empty plan steps through the writers and publish with `job open --plan` before asking for the interview signature. A refused operation leaves the record byte-identical. |
 | `REVIEW_ACT_RECORD_TARGET_INVALID` | A direction record publication or first sign-off ingest cannot resolve one current/latest live post with an accepted live direction verdict from the hash-bound `project.json` bytes (including a duplicated current version number). Review that current post and publish its corrected record through the writers. Historical accepted posts do not create ambiguity. A refused ingest leaves the record byte-identical. |
@@ -1681,3 +1692,28 @@ These CI-only codes name `.github/workflows/release.yml` or its tagged
 | `RELEASE_ALREADY_PUBLISHED` | `release.yml`: npm already serves the version; verify that publication rather than republishing it. |
 | `RELEASE_REGISTRY_UNCONFIRMED` | `release.yml`: confirmation of both names timed out; inspect npm before recovery because publication may already have succeeded. |
 | `ALIAS_SAME_CONTENT` | `scripts/alias_tarball.ts compare`: an alias differs beyond the `package/package.json` name line; rebuild it from the reviewed scoped tarball and resolve every named file difference before publication. |
+
+## Head turn before rigging
+
+`HEAD_TURN_SINCE = 2026-11-14T00:00:00Z` dates new rig depth obligations
+by the rig version's build date. Earlier records WARN with the same code;
+fixed-view records retain their historical placement and need no depth outputs.
+New interviews put `turn` and `depth` on rigging waypoint `turn`.
+
+| Code | Meaning and remedy |
+| --- | --- |
+| `RIG_DEPTH_PLAN_MISSING` | `plan.steps[turn]` is absent or ordered after the rig steps for an approved depth turn. Draft a rig-phase depth step resting on `turn` before the rig steps and approve it at rigging-interview. Answers before `HEAD_TURN_SINCE` WARN. |
+| `RIG_DEPTH_BINDING_MISSING` | A depth-driven rig lacks its retained producer manifests. Register a new rig version with rig's `depth_sheets.json`; for per-part depth include `--depth-manifest` and parts' `depth-report.json`. Before `HEAD_TURN_SINCE` this is a WARN. |
+| `RIG_DEPTH_BINDING_INVALID` | `versions[].registration.depth` has changed bytes, the wrong producer spec, or disagrees with its retained inventory/report manifest hash. Restore the exact retained producer files or register a new rig version. |
+
+For a per-part depth registration, `registration.depth.source_parts` retains
+the accepted pre-apply manifest. `REVIEW_PACKAGE_PARTS_MISMATCH` permits its
+depth-only enrichment only when that manifest matches the accepted hash, the
+new package matches the registered output hash, all other JSON declarations
+are identical, and the producer depth hash chain verifies. Art-file identity
+checks remain in force; no source measurement is recomputed.
+
+`interview.turn_question: "rig-create/turn-question@1"` explicitly adopts the
+new placement. Re-signing or adopting the split order on a later date alone
+does not retrofit it into historical interviews. Missing `turn` on an adopted
+interview is the existing `WAYPOINT_MISSING` refusal.

package/docs/INTERVIEW.md

@@ -223,7 +223,7 @@ seeing a build. Read from `@rig-c/parts` 2.4.0:
 | `meshes`, `regions` | waypoint `meshes` | what deforms and what rides rigid |
 | `constraints`, `stops`, `cloth` | waypoint `constraints` | what moves on physics and how far |
 | `motion` | waypoint `motion` | what moves, how far, how fast |
-| `turn`, `depth` | post item `camera_depth` | historical question mapping only; direction cannot carry depth or turn, so do not offer these as options |
+| `turn`, `depth` | rigging waypoint `turn` | fixed view or head turn with depth; before rig, after approved parts |
 | `key`, `generation`, `proposed_rig_scale`, `requirements`, `motion_seams`, `note` | not a waypoint | a name, a record of a run, a value the tool proposes, a path to a checks file, an observation, an annotation — none is a direction call. `requirements` is where translated guide sentences will land, not where they are asked. |
 
 The agent writes the checks file named by the config's `requirements` path.
@@ -345,12 +345,24 @@ names ([PROJECT.md § The hand-off to post-production](PROJECT.md#the-hand-off-t
 | `post_timing` | — | How long, does it loop, and where are the beats? | clip length, loop point, timing of motions against each other | *"Ten seconds, looping; the gust comes once, in the middle."* |
 | `post_composition` | — | What is around the figure — background, framing, other figures, light? | framing, background plate, what else is on screen | *"Frame from the knees up; keep the lighthouse in shot."* |
 
-The `camera_depth` question text in `project.json` still names a head turn and
-parallax: recorded projects and the hash-sealed examples carry those bytes, so they stay.
-Ask it as this table words it, with options that fit the current writers. Offer fixed framing, a push-in or another camera-box path. A head turn
-is not available yet: the direction format cannot carry depth or turn. It also
-has no relative plate motion for parallax, or take-wide gaze/dial cycle. Do not
-offer those as buildable choices or sign plan bars promising them.
+Ask `turn` at rigging-interview, against the accepted parts: “Should this rig
+keep the painted view, or turn its head with depth?” Offer **Fixed view**,
+**Head turn**, **Other** and **Let the agent decide**. Fixed view adds no depth
+step. Head turn records only `{ "mode": "depth" }`; the agent records the chosen
+route and reason in the `turn` plan step text. Draft that step in phase `rig`,
+resting on `turn`, before the steps that run rig. Its bar reads the retained
+producer reports, and rigging-interview approval covers it. The default
+per-part sequence runs `depth-prepare`, a separately supplied model (face
+normals, scalar depth for the other parts), then `depth-apply`; the ordinary
+`rig` writes the consumed `depth_sheets.json`. Read parts' `docs/DEPTH.md` for
+the producer contract. `rig-version --depth-manifest <file>` retains the
+prepare manifest with the applied report and rig sheet manifest; all are bound
+by bytes and spec, without redoing producer measurements.
+
+Post `camera_depth` asks only about fixed framing or a camera-box path such as
+a push-in. Historical question text and citations keep their original bytes.
+Timed head-turn dials, relative plate parallax and take-wide gaze remain
+unavailable in direction; do not promise them in plan bars.
 
 ## Bars have reading commands
 

package/docs/PROJECT.md

@@ -2515,6 +2515,16 @@ the project's next moves and whose they are from `project.json`:
   - `producer`: a command of a pinned package (`rig-parts`, `rigc`).
   - `human`: a person's act collected through the review tool (`review_act`),
     with `command: null` and never a `--by user` writer.
+- **Host and ingest human acts.** For a recorded Review subject, the human
+  move is surrounded by `job open` with its question, plan, draft or rig
+  selector, `job acts --json`, the writer with `--from-review '<actId>'`, and
+  `job close`. `job open` hosts and blocks until `job close`; keep it running
+  in a separate terminal. Fill the reviewer and exported act placeholders,
+  and follow the matching `job acts` preconditions before ingestion, including
+  its structure snapshot guidance for parts-review sign-off. Moves marked
+  `unanswered_by_record` retain their missing-field guidance.
+- **Scene writing does not plan work.** `scene write` adds no plan step.
+  Author the post plan steps through `plan add` before post-interview sign-off.
 - **Refusals come first.** When `check` reports refusals (or publication holes),
   `next` lists each in `refusals[]` with its `CHECKS.md` remedy (`fix`) before
   any forward move. A project with a blocking refusal has `moves: []` and

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "rig-create",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "type": "module",
   "description": "Create a rig project: its folder, decision record, repository and pinned rig-c packages",
   "license": "MIT",
   "files": [
     "src/",
+    "scripts/verify-example-seals.ts",
+    "scripts/npm-json.ts",
     "templates/",
     "README.md",
     "LICENSE",
+    "docs/AGENT-REFERENCE.md",
     "docs/PROJECT.md",
     "docs/INTERVIEW.md",
     "docs/CHECKS.md",

package/scripts/npm-json.ts

@@ -0,0 +1,74 @@
+/** npm 11 and 12 have different pack and view JSON envelopes. */
+import { readFileSync } from 'node:fs';
+
+export interface NpmPack {
+  filename: string;
+  entryCount: number;
+  size: number;
+  unpackedSize: number;
+}
+
+function object(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function shape(value: unknown): string {
+  if (Array.isArray(value)) return `array(length=${value.length}) ${JSON.stringify(value).slice(0, 200)}`;
+  if (object(value)) return `object(keys=${JSON.stringify(Object.keys(value))})`;
+  return `${value === null ? 'null' : typeof value} ${JSON.stringify(value)}`;
+}
+
+export function readNpmJson(text: string, command: string, kind: 'pack', expected: string): NpmPack;
+export function readNpmJson(text: string, command: string, kind: 'version', expected: string): string;
+export function readNpmJson(text: string, command: string, kind: 'e404'): string;
+export function readNpmJson(text: string, command: string, kind: 'pack' | 'version' | 'e404', expected?: string): NpmPack | string {
+  const fail = (field: string, want: string, actual: unknown): never => {
+    throw Error(`${command}: ${field}: expected ${want}; actual ${shape(actual)}`);
+  };
+  const envelope = kind === 'pack' ? `one-element array or object keyed only by ${JSON.stringify(expected)}`
+    : kind === 'version' ? 'version string or one-element array of that string' : 'object with error.code "E404"';
+  let value: unknown;
+  try { value = JSON.parse(text); }
+  catch { throw Error(`${command}: stdout: expected valid JSON (${envelope}); actual invalid JSON ${JSON.stringify(text.slice(0, 200))}`); }
+
+  if (kind === 'pack') {
+    let entry: unknown;
+    if (Array.isArray(value) && value.length === 1) entry = value[0];
+    else if (object(value) && Object.keys(value).length === 1 && Object.hasOwn(value, expected!)) entry = value[expected!];
+    else return fail('stdout', envelope, value);
+    if (!object(entry)) return fail('pack entry', 'object', entry);
+    if (entry.name !== expected) return fail('name', JSON.stringify(expected), entry.name);
+    if (typeof entry.filename !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*\.tgz$/.test(entry.filename)) {
+      return fail('filename', 'a .tgz basename without directory components', entry.filename);
+    }
+    for (const field of ['entryCount', 'size', 'unpackedSize'] as const) {
+      if (typeof entry[field] !== 'number' || !Number.isSafeInteger(entry[field]) || entry[field] < 0) {
+        return fail(field, 'a nonnegative safe integer', entry[field]);
+      }
+    }
+    return { filename: entry.filename, entryCount: entry.entryCount as number, size: entry.size as number, unpackedSize: entry.unpackedSize as number };
+  }
+  if (kind === 'version') {
+    const version = Array.isArray(value) && value.length === 1 ? value[0] : value;
+    if (typeof version !== 'string' || version !== expected) return fail('version', `${envelope} equal to ${JSON.stringify(expected)}`, value);
+    return version;
+  }
+  if (!object(value) || !object(value.error) || value.error.code !== 'E404') return fail('error.code', '"E404" in an error object', object(value) && object(value.error) ? value.error.code : value);
+  return 'E404';
+}
+
+if (import.meta.main) {
+  try {
+    const [kind, file, spec, version, ...extra] = process.argv.slice(2);
+    if (!file || !spec || extra.length || (kind !== 'version' && kind !== 'e404') || (kind === 'version' ? !version : version !== undefined)) {
+      throw Error('usage: bun scripts/npm-json.ts version <json-file> <package@version> <version> | e404 <json-file> <package@version>');
+    }
+    const text = readFileSync(file, 'utf8');
+    const command = `npm view ${spec} version --json`;
+    if (kind === 'version') readNpmJson(text, command, kind, version!);
+    else readNpmJson(text, command, kind);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/scripts/verify-example-seals.ts

@@ -0,0 +1,148 @@
+/** Verify installed example seals, or pack a temporary copy without nested ignore losses. */
+import { createHash } from 'node:crypto';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { readNpmJson } from './npm-json.ts';
+
+const packageRoot = resolve(import.meta.dir, '..');
+const hash = (path: string): string => createHash('sha256').update(readFileSync(path)).digest('hex');
+
+function within(root: string, path: string): string {
+  const target = resolve(root, path);
+  const rel = relative(root, target);
+  if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw Error(`invalid example path: ${path}`);
+  return target;
+}
+
+function files(root: string): string[] {
+  return readdirSync(root, { withFileTypes: true }).flatMap(entry => {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) return files(path);
+    if (!entry.isFile()) throw Error(`expected a regular example file: ${path}`);
+    return [path];
+  }).sort();
+}
+
+export function verifyExampleSeals(root: string): { ok: number; failures: string[]; sealedFiles: string[] } {
+  const chainRoot = join(root, 'templates/example-chain');
+  const index = JSON.parse(readFileSync(join(chainRoot, 'chain.json'), 'utf8')) as { checkpoints: { name: string }[] };
+  if (!Array.isArray(index.checkpoints) || index.checkpoints.length === 0) throw Error('example-chain/chain.json: no checkpoints to verify');
+  let ok = 0;
+  const failures: string[] = [];
+  const sealedFiles: string[] = [];
+  for (const { name } of index.checkpoints) {
+    const declaration = within(join(chainRoot, 'checkpoints'), `${name}.json`);
+    if (!existsSync(declaration)) { failures.push(`missing checkpoint declaration: ${relative(root, declaration)}`); continue; }
+    const seal = JSON.parse(readFileSync(declaration, 'utf8')) as {
+      schema: string; name: string; files: { path: string; sha256: string }[]; project_sha256: string;
+    };
+    if (seal.schema !== 'rig-create/example-checkpoint@1' || seal.name !== name || !Array.isArray(seal.files) || seal.files.length === 0) {
+      throw Error(`${relative(root, declaration)}: invalid checkpoint seal`);
+    }
+    const checkpoint = within(join(chainRoot, 'checkpoints'), name);
+    for (const entry of [...seal.files, { path: 'project.json', sha256: seal.project_sha256 }]) {
+      const path = within(checkpoint, entry.path);
+      const label = relative(root, path);
+      sealedFiles.push(path);
+      if (!existsSync(path)) failures.push(`missing sealed file: ${label}`);
+      else if (!/^[a-f0-9]{64}$/.test(entry.sha256) || hash(path) !== entry.sha256) failures.push(`sha256 mismatch: ${label}`);
+      else ok++;
+    }
+  }
+  return { ok, failures, sealedFiles };
+}
+
+function report(root: string, log: (line: string) => void): ReturnType<typeof verifyExampleSeals> {
+  const result = verifyExampleSeals(root);
+  for (const failure of result.failures) log(failure);
+  log(`checkpoint seals: ${result.ok} ok / ${result.failures.length} fail (files[] plus project_sha256)`);
+  if (result.failures.length) throw Error('example seals failed; repack the unmodified source with scripts/verify-example-seals.ts --pack <output-dir>');
+  return result;
+}
+
+function run(command: string, args: string[], cwd?: string): string {
+  const result = spawnSync(command, args, { cwd, encoding: 'utf8', timeout: 60_000, killSignal: 'SIGKILL', maxBuffer: 16 * 1024 * 1024 });
+  if (result.error || result.status !== 0) throw Error(`${command} ${args.join(' ')} failed: ${result.error?.message ?? result.status}\n${result.stderr}`);
+  return result.stdout;
+}
+
+/** Only the disposable copy gets .npmignore; every original example byte is retained. */
+function stage(root: string, destination: string): void {
+  const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { files: string[] };
+  mkdirSync(destination);
+  cpSync(join(root, 'package.json'), join(destination, 'package.json'));
+  for (const path of manifest.files) {
+    const target = within(destination, path);
+    mkdirSync(dirname(target), { recursive: true });
+    cpSync(within(root, path), target, { recursive: true });
+  }
+  for (const path of files(join(destination, 'templates')).filter(path => path.endsWith(`${sep}.gitignore`))) {
+    const npmignore = join(dirname(path), '.npmignore');
+    if (existsSync(npmignore)) throw Error(`pack staging would overwrite ${npmignore}`);
+    writeFileSync(npmignore, '!**\n');
+  }
+}
+
+export function verifyTarball(tarball: string, sourceRoot?: string): void {
+  const scratch = mkdtempSync(join(tmpdir(), 'create-example-seals-'));
+  try {
+    run('tar', ['-xzf', resolve(tarball), '-C', scratch]);
+    const root = join(scratch, 'package');
+    const verified = report(root, console.error);
+    if (sourceRoot) {
+      const source = join(sourceRoot, 'templates');
+      const originals = files(source);
+      for (const path of originals) {
+        const target = join(root, 'templates', relative(source, path));
+        if (!existsSync(target) || hash(target) !== hash(path)) throw Error(`packed template missing or changed: templates/${relative(source, path)}`);
+      }
+      console.error(`template byte parity: ${originals.length} files match source`);
+    }
+    // Negative control operates only on the extracted tree, after the positive gate.
+    const deleted = verified.sealedFiles.find(path => path.endsWith(`${sep}.gitignore`))!;
+    unlinkSync(deleted);
+    const planted = verifyExampleSeals(root);
+    const expected = `missing sealed file: ${relative(root, deleted)}`;
+    if (planted.failures.length !== 1 || planted.failures[0] !== expected || planted.ok !== verified.ok - 1) {
+      throw Error(`planted deletion was not detected: ${expected}`);
+    }
+    console.error(`planted deletion detected: ${expected} (${planted.ok} ok / 1 fail)`);
+  } finally { rmSync(scratch, { recursive: true, force: true }); }
+}
+
+export function packExamples(output: string, stageOutput?: string): string {
+  const scratch = mkdtempSync(join(tmpdir(), 'create-example-pack-'));
+  try {
+    const destination = resolve(output);
+    mkdirSync(destination, { recursive: true });
+    const staged = stageOutput === undefined ? join(scratch, 'source') : resolve(stageOutput);
+    stage(packageRoot, staged);
+    const name = (JSON.parse(readFileSync(join(staged, 'package.json'), 'utf8')) as { name: string }).name;
+    const args = ['pack', '.', '--json', '--pack-destination', destination];
+    const packed = readNpmJson(run('npm', args, staged), `npm ${args.join(' ')}`, 'pack', name);
+    const tarball = join(destination, packed.filename);
+    console.error(`npm pack: ${packed.entryCount} files / ${packed.size} bytes compressed / ${packed.unpackedSize} bytes unpacked`);
+    verifyTarball(tarball, packageRoot);
+    return tarball;
+  } finally { rmSync(scratch, { recursive: true, force: true }); }
+}
+
+if (import.meta.main) {
+  try {
+    const [mode, path, ...extra] = process.argv.slice(2);
+    if (mode === undefined) report(packageRoot, console.log);
+    else if (path && extra.length === 0 && mode === '--pack') console.log(packExamples(path));
+    else if (path && extra.length === 0 && mode === '--tarball') verifyTarball(path);
+    else if (path && extra.length === 0 && mode === '--stage') {
+      const scratch = mkdtempSync(join(tmpdir(), 'create-example-stage-gate-'));
+      try { packExamples(scratch, path); console.log(resolve(path)); }
+      finally { rmSync(scratch, { recursive: true, force: true }); }
+    }
+    else throw Error('usage: bun scripts/verify-example-seals.ts [--pack <output-dir> | --tarball <file.tgz> | --stage <fresh-dir>]');
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/src/agent-guide.ts

@@ -53,7 +53,7 @@ export const PACKAGE_DOCS: readonly PackageDoc[] = [
   {
     package: '@rig-c/parts',
     path: 'docs/DEPTH.md',
-    why: 'depth reference; unavailable in current direction',
+    why: 'depth-driven head turn before rigging; timed direction is separate',
   },
   {
     package: '@rig-c/parts',
@@ -177,9 +177,11 @@ export const READ_FIRST = [
  */
 export const INTERVIEW_CHECK_LINE = 'Run `rig-create interview --check` before interview sign-off: it names every `null` answer.';
 
-export const REOPEN_EXCEPTION = 'Until create#493, agents may type `reopen` only from Review host raw export `act@4`: save nonempty `value.words` byte-for-byte to a verbatim file; `--source` names `actId`. Empty/missing words: STOP. Never supply words. `job fetch-act` rejects act@4.';
+export const REOPEN_EXCEPTION = 'After an accepted post is bounced, reopen direction-review through Review: `job open --plan`, then `job acts --json`, ingest `reopen direction-review --from-review <actId>`, and `job close`. The exported act supplies the reviewer, date and verbatim words.';
 
 export const GUIDE_TEMPLATE = 'agent-guide.md';
+/** Copied from the same installed create distribution as the rendered guide. */
+export const AGENT_REFERENCE = 'AGENT-REFERENCE.md';
 
 /** CLAUDE.md is a pointer: Claude Code reads CLAUDE.md, and an `@path` line imports that file into it. */
 export const CLAUDE_MD = [
@@ -230,11 +232,12 @@ export function renderAgentGuide(): string {
 
 /**
  * Writes the guide an agent reads first in a project — AGENTS.md, and a
- * CLAUDE.md that imports it — and returns the paths written (relative to the
+ * CLAUDE.md that imports it, plus its shipped reference — and returns the paths written (relative to the
  * project) so init can add exactly those to git.
  */
 export function writeAgentGuide(dir: string): string[] {
   writeFileSync(join(dir, 'AGENTS.md'), renderAgentGuide());
   writeFileSync(join(dir, 'CLAUDE.md'), CLAUDE_MD);
-  return ['AGENTS.md', 'CLAUDE.md'];
+  writeFileSync(join(dir, AGENT_REFERENCE), readFileSync(join(TEMPLATES_DIR, '..', 'docs', AGENT_REFERENCE)));
+  return ['AGENTS.md', 'CLAUDE.md', AGENT_REFERENCE];
 }

package/src/check.ts

@@ -81,7 +81,7 @@ import { collectReopens, liveSignoff } from './reopen.ts';
 import { reopenLapseWarnings } from './reopen-lapses.ts';
 import { stepHash } from './step-hash.ts';
 import { collectPlanReplaced, checkReplacedSignoffs, collectCheckpointWithdrawals, checkpointRequired } from './plan-history.ts';
-import { deriveWaypoints, FRAMING_IDS, type DerivedSet } from './waypoints.ts';
+import { deriveWaypoints, FRAMING_IDS, TURN_QUESTION_SPEC, type DerivedSet } from './waypoints.ts';
 
 export const PROJECT_SCHEMA = 'rig-create/project@0';
 export const STAGE_ORDER_LEGACY_FINDING: Finding = { code: 'STAGE_ORDER_LEGACY', path: 'interview.order', message: 'interview.order: legacy interview order; preserve old rig guides as history, not as answers asked after parts; adopt explicitly with a fresh rigging-interview sign-off' };
@@ -684,7 +684,7 @@ function checkPlan(ctx: Ctx): void {
   }
   if (planSigned) {
     for (const item of ctx.items) {
-      if (item.kind !== 'waypoint' || !signed(ctx, approvalStageOfStep('rig', item.id, hasStageOrder(ctx.project)))) continue;
+      if (item.kind !== 'waypoint' || item.id === 'turn' || !signed(ctx, approvalStageOfStep('rig', item.id, hasStageOrder(ctx.project)))) continue;
       if ((item.state.state === 'user' || item.state.state === 'delegated') && !ctx.steps.some((s) => s.phase === 'rig' && s.id === item.id)) {
         ctx.refusals.push({ code: 'STEP_MISSING_FOR_WAYPOINT', path: `plan.steps[${item.id}]`, message: `waypoint '${item.id}' has a guide but the signed plan has no rig step '${item.id}'; one step per waypoint the plan passes` });
       }
@@ -950,7 +950,10 @@ function checkProjectOnce(projectDirArg: string, candidate: JsonObject | undefin
   let derived: DerivedSet | null = null;
   try {
     parts = readPartsSections(dir);
-    derived = deriveWaypoints(parts.sections);
+    const interview = isObject(project.interview) ? project.interview : {};
+    const turnInterview = asArray(interview.waypoints).some(w => isObject(w) && w.id === 'turn')
+      || interview.turn_question === TURN_QUESTION_SPEC;
+    derived = deriveWaypoints(parts.sections, turnInterview);
     checkDerived(ctx, parts, derived);
   } catch (e) {
     if (!(e instanceof PartsUnreadable)) throw e;
@@ -981,7 +984,7 @@ function checkProjectOnce(projectDirArg: string, candidate: JsonObject | undefin
   if (!options.recordPublication) checkReviews(ctx);
   if (!options.recordPublication) checkPublicationGenerations(dir, project, refusals);
   if (!options.recordPublication) checkReviewPackages(ctx);
-  if (!options.recordPublication) refusals.push(...rigRegistrationFindings(dir, project, warnings));
+  if (!options.recordPublication) refusals.push(...rigRegistrationFindings(dir, project, warnings, collection));
   if (!options.recordPublication) checkAppliedReview(ctx);
   const provenance = options.recordPublication ? [] : checkProvenance(ctx, parts);
   const feedback = options.recordPublication ? [] : checkFeedback(ctx);