rig-parts 1.79.1 → 1.80.0

package/docs/AUTHORING.md

@@ -23,6 +23,17 @@ A path this page names that the installed package does not hold — anything und
 `bun run` names — is in the repository, https://github.com/rig-c/parts; the package holds the files
 `package.json` lists under `files` (`npm pack --dry-run` prints them).
 
+For repository changes, run `bun run selftest:pre` on an ordinary Nova slot,
+beside the change's targeted suites (or add them with
+`bun run selftest:pre -- --only rig,propose`). Its fixed minimum forms are demo's
+AE02, TY12/TY16, one demo build with CH04/CH05 goldens, and declaration ownership
+plus RT14, accounting and the family-memory check. It uses one worker and needs
+demo's pinned inputs. Missing inputs, SKIPs and HOLEs cannot pass. Its result
+covers those forms only: **the full forms and full-tree verdict belong to PR CI**.
+[CONTRIBUTING](../CONTRIBUTING.md#before-you-open-a-pull-request) records their
+historical derivation, the selected forms and the separate pre/ordinary-PARTIAL
+exit contracts.
+
 The examples' names: `reference-sample` and `reference-demo` are the two characters
 the reference implementation ran (published as `sample` and `demo` until issue #227),
 kept as fixtures because their `expected/` is that implementation's own output; every
@@ -116,11 +127,12 @@ read by no CPU stage).
 | `assemble.rig_scale` | assemble — the rig is `trunc(w × rig_scale)` x `trunc(h × rig_scale)`, and every rig-px value after it (`bones`, `meshes`, `motion`, `patches`, `cuts`) is in that rig's pixels; `check --source` (`CHECK_SOURCE_SIZE`) and `compose` (`SCENE_RIG_SCALE_AGREES`) read it back off `parts.json` | authored; rig pixels per source pixel. 0.5 in both examples (a 1664x2432 painting makes an 832x1216 rig). **Keep the figure about 1,100 to 1,200 rig px tall** — the `H` of `propose`'s `mesh spacing:` note, the height of the parts' boxes together — so for another painting, about 1,150 over the figure's height in painting px: that is the size the proposer's spacing divisor was calibrated at (H 1106–1185, the `mesh spacing` note says so) and the size of the two examples `check`'s bars are derived from, and the proposer and `check` also hold fixed rig-px values that do not scale with it (the fringe's 10 px step, the trunk segments' 18, 20, 30 and 100 px, the 15 px wrist tolerance, the 10-row pendant floor, the seam bar's 50 rig px over 40). What else it trades, measured on `demo` with the README loop from a fresh config at 0.25, 0.5 and 1 (issue #345, rig-c 2.47.1): the same plan and the same ten chains; every bar but the one the uncorrected `demo` always fails (`bottomwear` `TIP_OVER_ROOT`, the README loop's `RL01`) passing at all three; the atlas page 418x606, 832x1205 and 1825x2047; the figure's mesh spacing 16, 32 and 64, so 830, 868 and 932 triangles; the breath 2.5 % of a torso that scales with it; and the proposed bones, scaled to 0.5, off the 0.5 proposal's by up to 38 px at 0.25 and 22.5 px at 1 (the hairpin's origin; the skirt roots 20 and 10.5) — the fixed-px values above. `propose` records it on the proposal as `proposed_rig_scale` (issue #354), and changing `assemble.rig_scale` after the rig sections are written is refused (`CONFIG_PROPOSED_RIG_SCALE`): without that refusal `demo`'s tracked config built at 0.25 gated green and `check` failed only `TIP_OVER_ROOT` on both sleeves (`propose --from-config` named 54 `LINT` lines, links off the art) — re-run `assemble` and `propose` at the new scale. Absent: `CONFIG_FIELD_PRESENT`; 0, negative or not a number: `CONFIG_FIELD_TYPE`; a rig under 1x1: `ASSEMBLE_RIG_SIZE` |
 | `assemble.plan` | assemble; also the list every `meshes`/`regions` key must come from | **proposed** by `assemble --propose-plan`. `[part name, "full" \| "head", See-through tag]`, in draw order back to front. Names are free; roles come from the tag. A layer the author made and added to a run takes `author:<label>` in the tag's place, and has no role (§5, *A layer the author made*). When `generation.control.skeleton` is present and a full-run `handwear-r` or `handwear-l` layer merges sleeve, bare hand and overgarment drape into one layer — a skin-coloured hand cluster (`>= 40` run px, `GHOST_MIN_AREA`, measured `516..4,787` run px across the 9-standee corpus) lies within `0.35` forearm lengths of `<s>_wrist` and non-skin pixels reach more than `1.0x` the forearm length (`<s>_elbow -> <s>_wrist`) below `<s>_wrist` (issue #490; measured `-0.15x..0.45x` on the 6 clean standees vs `1.25x..2.02x` on the 3 merged standees, placing `1.0x` inside the `0.45x..1.25x` gap) — the layer is split into `drape-<s>`, `handwear-<s>` and `hand-<s>` (back to front) when the Euclidean RGB distance between the sleeve median colour above `<s>_wrist` and the drape median colour below `<s>_wrist` is at least `80` (`ARM_DRAPE_COLOR_DISTANCE`, measured `103.6..236.0` on the two distinct-colour merged standees vs `20.8..28.2` on the same-colour merged standee, placing `80` between `28.2` and `103.6`), or refused with `SEETHROUGH_ARM_RUN_MERGED` when the distance is under `80` |
 | `assemble.extend_below_crop` | assemble | **proposed** with the plan: `{part, run, tag}` — a head-run part that reaches the bottom of the head crop is continued from a full-run layer, whole connected components |
+| `assemble.extend_painting` | assemble, base painting only — assigns unheld opaque painting samples to declared final layer-derived parts | **authored**, optional array of `{part, band: [x0,y0,x1,y1], max_distance}`; all fields required, integer rig pixels, half-open band and positive maximum four-neighbour path length. Off when absent or empty. See [Bounded painting extension](#bounded-painting-extension-issue-848) |
 | `assemble.patches` | assemble; `meshes`/`regions` keys may name them too | **authored**, optional: `[{name, box, alpha, draw}]` — an extra part cut from the **painting** itself, for figure no See-through layer holds (a hem both runs dropped). `box` is `[x0, y0, x1, y1]` in **rig** pixels, `x1`/`y1` exclusive — the space of `parts.json` and `recomposite_rig.png`, where the hole is found; `alpha` is `"silhouette"` (the painting's figure silhouette inside the box, the one `--seam silhouette` uses) or `"box"` (the whole box); `draw` is `"back"`, `"front"` or `{"before": "<plan part>"}`. A patch is always a region: its bone is `regions.<name>`, in the one place every region's bone lives, and a `meshes` entry for it is refused. `draw` sets assembled part order; an exclusively bound limb rider's final rig slot joins that limb's block (see the limbs subsection). Use [Source before scissors](#source-before-scissors) before a patch; §5 describes structural placement |
 | `assemble.cuts` | assemble; `meshes`/`regions` keys may name the new parts too, and must (each is a part like any other) | **authored**, optional (issue #170): `[{from, into, polygon, draw, overlap, under, under_fill}]`, `under` and `under_fill` optional — a structural separation under [Source before scissors](#source-before-scissors), cut from a plan part's layer by the author's polygon: the pixels of plan part `from` whose **centre** lies inside `polygon` (even-odd; a centre exactly on an edge is outside) leave `from` and make the new part `into`, colour and alpha, so every pixel of the layer ends in exactly one of the two. `polygon` is `[[x, y], …]`, at least three points, non-negative integer **rig** pixels — the space of `parts.json` and of the patches' boxes. The file that shows the layer in those coordinates is `assemble`'s own `rig/parts/<from>.png`, placed at its `parts.json` `x`, `y` (the PNG's pixel `(i, j)` is rig pixel `(x + i, y + j)`), or `render/recomposite_rig.png`, the whole rig 1:1; the contact sheets (`sheet`) are scaled and carry no coordinates. `draw` is `"back"`, `"front"` or `{"before": "<plan part>"}`, as for a patch (to keep the setup pose, draw the piece immediately in front of `from` — `{"before": "<the plan part after from>"}`, or `"front"` when `from` is the last plan part; `{"before": "<from>"}` draws it behind `from`, which `under` refuses as `ASSEMBLE_UNDER_DRAW` because the fill would hide it). `from` must be a plan part (`CONFIG_NAME_RESOLVES`; a patch or another cut's piece is refused; a part a limb takes may be cut where no segment of the limb holds it, issue #564, §5 *Limbs*), `into` a new name (`CONFIG_PART_UNIQUE`), the polygon three or more integer points (`CONFIG_FIELD_TYPE`). The piece's `parts.json` record carries `from`'s `<run>:<tag>` and its own counts, each split from the layer's by where the pixel lies; it is a mesh or a region under its own name, and the coverage rule holds it like a plan part. What the config cannot know the stage refuses: a polygon point past the rig (`ASSEMBLE_CUT_INSIDE`), two cuts of one part sharing a pixel (`ASSEMBLE_CUT_OVERLAP`), a cut that takes none of the layer's opaque pixels or leaves `from` none (`ASSEMBLE_CUT_PIXELS`), a cut of a part a limb takes that takes a pixel a segment of the limb holds (`ASSEMBLE_CUT_CROSSES_LIMB`). `overlap` is required, a non-negative integer of rig pixels with no default (`CONFIG_FIELD_TYPE`): the **band** — the polygon's pixels within `overlap` px of its edge by Chebyshev distance (the polygon's mask less its erosion by a `2 * overlap + 1` square) — stays in `from` as well as going to the piece, so the piece's resampled edge has art under it; the counts stay a strict partition and the band is the base's extra copy, printed on the `cut:` line. At `0` the two abut and `check`'s seam bar judges the edge between them (`CHECK_SEAM_WITHIN_BAR`, §5). A band only covers the edge at rest: a piece that swings well clear of where it was painted shows the hole it leaves, and a thin piece's band shows a ghost of the piece. `under` (issue #193), optional, is the author's image of what lies under the piece: a PNG path relative to the config's directory (`CONFIG_FIELD_TYPE` unless a non-empty string), in rig pixels over the polygon's **bounding box** — the least and greatest polygon x and y, so the image is `max x − min x` by `max y − min y` and its pixel `(i, j)` is rig pixel `(min x + i, min y + j)`. Where the cut removed pixels from `from` — the piece's pixels (alpha above 0) less the band — `from` takes the image's pixel, colour and alpha wherever the image's alpha is at least the alpha the cut removed there (**filled**); elsewhere `from` stays empty there (**left empty**): a transparent pixel is the author's statement that nothing lies under it (the background, or a part drawn behind), and a less opaque one is not half-filled. The image is read nowhere else, so its pixels over the band, over the box outside the polygon or where the layer had no art never change `from`. The `cut:` line then ends `; under <n> px filled, <m> px left empty` (`n + m` is every removed pixel), so an unintended hole is a number in the log, not a guess; the filled pixels count in `from`'s `opaque_px` and `occluded_px` (the piece is drawn over them), never as visible or projected. The stage refuses: a file that is not there (`ASSEMBLE_UNDER_PRESENT`) or not a PNG (`ASSEMBLE_UNDER_DECODES`), an image not exactly the box's size (`ASSEMBLE_UNDER_SIZE`, both sizes given), an image that fills none of the removed pixels — all transparent there, or another file (`ASSEMBLE_UNDER_EMPTY`; to leave the whole hole, drop `under`), and a piece drawn behind `from` (`ASSEMBLE_UNDER_DRAW`: the fill would hide it; draw it `"front"` or `{"before": "<the plan part after from>"}`). Producing the image is the author's, by whatever means; absent, `from` keeps only its band. `under_fill` (issue #360), optional, is the one value `"colour"` (`CONFIG_FIELD_TYPE` on any other): the same pixels are filled and left empty, and a filled pixel takes the image's **colour** at the alpha the cut removed there instead of the image's alpha, so `from`'s alpha is the uncut layer's wherever the image fills and its silhouette does not grow — an opaque image over a soft edge leaves the edge soft. It applies to the part's hidden-art layer as well as to a file; a cut with neither is refused (`ASSEMBLE_UNDER_FILL_SOURCE`). The `cut:` line's filled count then says how many took the colour only: `; under 190 px filled (190 colour only, at the alpha the cut removed), 0 px left empty`. Absent, a filled pixel takes the image's colour and alpha, as above |
 | `assemble.alternates` | assemble, rig, check (`--set`, `--all-sets`) | **authored**, optional (issues #454, #465, #472, #473, #476): `[{name, source?, full?, head?, head_box?, parts?, hides?, cuts?, skeleton?, anchor?, base_anchor?, drawn?, tips?, front?}]` — alternate painting sets assembled into `<out>/rig/parts/<set>_<part>.png` (`parts.json` `alternates`), attached on each covered slot in `rig.json` as `<set>_<part>` beside the base attachment, and indexed in `<out>/rig/sets.json` (`rig-parts-sets/1`: `sets.<set>.slots`, `.hides`, `.drawn` when present, and `.threshold: {yaw: 15, pitch: 12}` when the set replaces `face` on a rig with `turn` or `turn`/`tilt` slider animations). `source`, `full` and `head` may instead be given on the CLI with `--alt <name>=<source>:<full>[:<head>]`. Windows absolute drive paths such as `C:\paint\painting.png` are accepted as written; each segment's leading drive colon belongs to that path, while other colons still separate `source`, `full` and `head`. `parts` lists the subset of parts the set replaces (default: every part not in `hides`); a **subset set** (issue #473, e.g. mouth visemes `a`, `i`, `u` with `"parts": ["mouth"]`) cuts only its covered parts from the alternate runs (refusing with `ASSEMBLE_ALT_INPUT_PRESENT` if a covered part's layer is missing or empty), writes only `{slot: "<set>_<slot>"}` in `sets.json` so `@rig-c/play`'s `setSet(name)` switches those slots while leaving every other slot on its base attachment (and `setSet(null)` restores the base pose), may be keyed on a slot attachment track in `motion.animations_from` as `{"t": …, "set": "<name>" \| null}` (`CONFIG_SET_COVERS_SLOT` if `"set"` is undeclared or does not cover the track's slot), and under `check --set <name>` counts `ANIMATIONS_DO_NOT_FOLD` only on its own covered slots; `hides` lists slots the set hides (`null` in `sets.json`). A **gesture subset set** (issue #476) covers a limb chain declared in `config.limbs.<limb>` (all of its segment `part`s; with `drawn` alone, cut at the base's joints posed to the set's own `drawn` angles by `poseBoneEntriesForDrawn`, each segment keeping the base's length; with `skeleton` (issue #539), cut at the skeleton's own joint positions by `placeBoneEntriesForSkeleton` — each covered bone the body-18 table names (`sleeve_*`, `arm_*0`/`arm_*1`, `leg_*0`/`leg_*1`) at its skeleton origin with the skeleton segment's own length and direction (`drawn` overriding the direction of a bone it names), and a covered bone the table does not name (a hand link `arm_r2`, a single `foot_r`) placed from its parent's new place — its base offset from the parent, stretched along the parent by the parent's length change and turned by its turn, so a link or a foot at the parent's end lands on the skeleton's end — with its base length and the drawn or base direction, so a foreshortened shin or forearm is cut where it is painted; naming the unsplit `from` layer, covering only some segments of the limb, or declaring polygon `cuts` on a limb set is refused with `CONFIG_LIMB_SET_JOINTS`) and carries `drawn` (or `skeleton`) for the covered bones only (giving `drawn` for an uncovered bone is refused with `CONFIG_SET_COVERS_BONE` / `RIG_SET_COVERS_BONE`; uncovered bones keep the base's `drawn`). A subset set's limb part takes no pixel that a base part drawn after it, which the set neither covers nor hides, covers at setup (issue #587): the set's attachment is drawn in the base slot's place, so that base part is drawn over it and what the set's painting shows there is that base part (shorts over a leg set's thigh top, which See-through synthesised in the set's leg layer); `assemble` clears those pixels — the base part's PNG at alpha above 8, at its `parts.json` x, y, on the shared canvas — from the set's part once its limbs are cut, before any count — its `merged_px` and its cap's record too (issue #603): a cap pixel it clears leaves the count it was in (`layer_px`, `image_px`, `upper_px`, `lower_px`, `lower_kept_px`) for the cap's `excluded_px`, written only when above 0, so every count is the written PNG's — and prints `LINT set "<set>" <part>: <n> px under <base part> excluded` per part and base part that took a pixel (n counts alpha above 8); a set that carries that base part itself (`"parts": ["thigh_l", "shin_l", "bottomwear"]`) excludes nothing and writes what it wrote before. A subset set that names one limb side of a layer more limbs take (issue #588: `"parts": ["thigh_r", "shin_r"]` where `leg_r` and `leg_l` both take the one `legs` layer) would put every pixel of that layer on its one limb, so each of its parts would hold a piece of both legs; when the set's layer holds more than one island (8-connected pixels with alpha above 8) of at least 1 % of its largest (issue #608: the ghost clean-up's own share; a smaller island is a speck, which goes with the island nearest it — the one holding the pixel centre nearest one of the speck's, none when two are equally near — and is never an island of its own), each segment part keeps the island its joints fall on — its bone's origin and the next segment's bone's origin, at the set's own bones, a joint on the island of a pixel whose square holds the point, and a joint on no island on the one island whose nearest pixel centre lies within the radius of the cap cut at that joint (`cap.radius`: an ankle just past the legwear's edge, on the shoe) — and drops the rest, once its limbs are cut and before the exclusion above, and `assemble` prints `LINT set "<set>" <part>: <layer part> holds <n> islands (8-connected, alpha above 8)[, and <s> speck(s) under 1 % of the largest (<f> px), each with the island nearest it], kept the one under <bone> [x, y] and <bone> [x, y][ (<e> px off it, within its cap's radius <r>)] (<k> px), dropped <m> (<d> px)` per part (k and d count the part's pixels above alpha 8, m the islands it lost one from, and `dropped none` when it lost none); a joint on no island with none or two within that radius, or with no cap cut at it (a limb's first joint), and a segment whose joints fall on two, are refused with `ASSEMBLE_ALT_LIMB_ISLAND` rather than guessed. A layer of one island — specks aside — may hold both legs over each other (a folded shin across the standing leg; issue #609): each of the set's segment parts then keeps the pixels nearer its own limb's segment line — the polyline of only its segments taking that source, their bone origins and the last segment's supplied tip or following segment's joint (issue #638) — than the other limb's, both in the set's pose, and gives the rest away, once its limbs are cut and before the exclusion above; a pixel whose two distances differ by 0.5 px or less (the overlap band: half a pixel, the reach by which a pixel centre is read as on a line) goes to the limb whose part there is drawn later in the base's draw order, and the `LINT set` line above counts what each part kept, gave and held in the band. The other limb stands where the set's `skeleton` places it — its keypoints place every limb bone of the body-18 table, the other leg's as well as the set's own (its `drawn` and `drawnLength` stay the covered bones') — and never at the base's place: a set that does not place it (a `drawn` set, which may not name a bone it does not cover, or a set with neither) is refused with `ASSEMBLE_ALT_LIMB_POSE` when its layer has art where the base draws that limb, and when it has none nothing says the layer holds it and the layer is cut as before; two limbs whose segment lines run closer than the limb's half-width over most of where their art can meet are refused with `ASSEMBLE_ALT_LIMB_OVERLAP`. A set that carries every limb of the layer is cut as before. For a subset set, where a limb's own source layer holds art (`alpha > 8`) under another layer of that run drawn in front (`alpha > 8`, by the projection's plan/depth order), the limb keeps its own layer pixels through projection, limb cutting, island/nearest-line assignment, base-footprint exclusion, fringe clearing and seam correction (issue #637). Those pixels are occluded, never counted as painting projection; no base footprint or painting colour replaces them. After source-art island/nearest-line assignment, a source-transparent cap pixel is assigned before protection, in both doors: its centre is compared against only the segments taking the recipient's source, at the set's supplied bones (ankle-to-toe for a separate foot source), with the existing 0.5 px overlap band and base draw order. A missing last endpoint is refused with `ASSEMBLE_ALT_LIMB_POSE`; an actual following joint may supply that endpoint, never a guessed point. An unposed other limb with base art beneath these cap pixels is likewise refused; without such overlap the existing compatible path retains the cap without inventing the other limb's pose. A pixel cleared by this assignment is never restored. `CAP_FROM_UPPER` records a copy made before assignment and alone proves no ownership: only a retained copy is protected beneath the upper segment, which is drawn over it. The source-art island selection itself is unchanged. Other retained cap pixels (from the layer or a supplied cap image) are protected under an actual front layer even where the lower source is transparent. Protection follows each assigned piece through exclusion, fringe clearing and seam correction; it never restores a pixel ownership removed. Cap pixels removed during ownership leave their original counts for `excluded_px`, just as excluded pixels do, so the cap ledger describes the written PNG. Target assignment reconciles this ledger even when there are no source-transparent cap candidates and when a direct caller does not request cover protection. Unprotected source pixels still obey the base-footprint exclusion. Missing limb/cap art is never extended or guessed. Base builds and uncovered, unexcluded sets keep their existing bytes. `skeleton` (a pose file path relative to the config's directory, `{"width": W, "height": H, "points": {…}}` with all 18 body-18 keypoints on the canvas, validated by the same rules as `generation.control.skeleton`: `CONFIG_FILE_PRESENT`, `CONFIG_IS_JSON`, `CONFIG_FIELD_TYPE`, `CONFIG_KEY_KNOWN`, `CONFIG_KEY_UNIQUE`, `CONFIG_POSE_CANVAS`, `CONFIG_POSE_KEYPOINTS`, `CONFIG_POSE_IN_CANVAS`) or `drawn` (`{<bone>: <worldDegrees>}`, each bone resolved against `bones`, `CONFIG_NAME_RESOLVES`) declares the posed angles the alternate was painted at (issue #465); when `skeleton` is given, `assemble` derives `drawn` from its 18 keypoints (filtered to covered bones on a subset set, with `drawn` overriding any bone named in both), records both `skeleton` (scaled by `assemble.rig_scale` to rig px) and `drawn` in `parts.json` `alternates` — and, when the skeleton placed the set's limb bones (issue #539), `drawnLength` (`{<bone>: <ratio>}`, each covered table bone's skeleton segment length over its base length, 6 places) and `registration` (`{offset: [dx, dy], scale}`: the similarity without rotation, about the canvas origin, that maps the skeleton's torso — the mean of its shoulders `r_shoulder`/`l_shoulder` to the mean of its hips `r_hip`/`l_hip`, read where the base declares the bone rooted there, `sleeve_*0`/`arm_*0` and `leg_*0` — onto those base bones' origins, 6 places), both also written to `sets.json`; the set's painting must be registered, its torso within 1 rig px and 1 % in scale of the base's, or the set is refused by name before any joint is cut (`ASSEMBLE_ALT_SKELETON_REGISTERED`, with the offset and scale the painting would need) — and the `rig` stage writes `<set>_*` region and mesh attachments in the bone-local frame of `poseRigBonesForDrawn(bones, drawn)` (weighting limb segments directly from `skeleton`'s joint endpoints when `skeleton` is present) and emits `drawn` in `sets.json` so `rig-pose` and `check --set <name>` / `--all-sets` pose the bones at `drawn` without rotating the already-posed art a second time. `front` (issue #664) lists covered limb segment parts the set draws on their **front slot** instead of the base slot: each must be in the set's `parts` and not its `hides`, and listed in some `config.limbs.<limb>.front.parts` (`CONFIG_SET_FRONT`); the set then maps `<part>_front` (never `<part>`) to `<set>_<part>` in `parts.json` and `sets.json` and hides `<part>` (and `<part>_still`), its #587 exclusion counts only base parts drawn after the front slot's target, and keying that part's set on a slot track is refused (`CONFIG_SET_FRONT_KEYED`) — *Front slots (issue #664)* below `layers` optionally maps covered, nonhidden output part names to layer names in their existing source run (issue #666); for example `"layers": {"upperarm_r": "author:raised", "forearm_r": "author:raised"}`. Limb cuts, caps, islands and base exclusions read the selected layer; the base plan stays unchanged. |
 | `assemble.head_face_underfill` | assemble, `assemble --propose-plan` | **authored**, optional (issue #492): `boolean` (`CONFIG_FIELD_TYPE` on any other). When both runs exist and `full:face` has at least `200` opaque run px (`PROPOSE_MIN_PX`), the stage maps `full:face` into the head canvas via `fullLayerToHead` and measures how much of its hole-filled silhouette (`alpha > 8`) is covered by `head:face` (`alpha > 8`). A head-run `face` covering less than `75 %` (`HEAD_FACE_COVERAGE_FLOOR`, measured `0.0 %..48.6 %` on hollow/omitted head runs vs `84.8 %..99.6 %` on clean head runs across the 4 public examples and 9-standee corpus) is refused with `SEETHROUGH_HEAD_RUN_HOLLOW` unless `head_face_underfill: true` is declared. When `head_face_underfill: true` is declared and `head:face` exists (`opaqueRunPx >= 200`), `fullLayerToHead(full:face)` is composited under `head:face` on the head canvas (`alpha = max(headAlpha, fullAlpha)`, RGB blended by `headAlpha / 255`) before `head:face` is placed in rig space (`underfill=<N>px(full:face)` on the `face` part log line and a `face: head_face_underfill composited …` note in `assemble --propose-plan`). The fill restores transparent pixels only and leaves the cut's own edge where it is — a hollow whose edge is not under hair stays visible; follow [Source before scissors](#source-before-scissors) for its source remedy. When `head:face` has fewer than `200` opaque pixels, `SEETHROUGH_HEAD_RUN_HOLLOW` still fires even under `head_face_underfill: true` because the head run omitted the face layer and cannot supply a jawline |
-| `assemble.yield_refused` | assemble | **authored**, optional boolean, default `false` (issue #819; other types: `CONFIG_FIELD_TYPE`). With `true`, an original front projection-core pixel refused at max-channel drift > `DRIFT_LIMIT` (90) can yield when its original source pixel is still opaque. Non-core rim pixels (0 < alpha < `CORE_ALPHA`, 250) on the same 8-connected part body can then yield too (issue #832). Connectivity reads the part support before clearing: the opaque border outside the eroded projection core connects the body to its rim but is not itself newly cleared. A separate rim island without a yielded core seed is unchanged. At every cleared pixel, the actual top-most opaque holder below it (alpha >= 250), after earlier yields, must have colour within 90 of the painting. A deeper matching part cannot bypass an intervening opaque mismatch. This setting also applies to alternate sets. Its alpha becomes 0; RGB is not repainted. Merge/ring replacements, samples explicitly kept by `keep_under_occluders`, and pixels outside a derived piece cannot connect a rim or be newly yielded. Front is relative to the matching part behind, so original refusals in another run are eligible even when a different part is the global top holder. The reading proceeds back to front against the current behind pixels; alpha changes do not repaint or create a new matching colour. `yieldReadings` records `yieldedRim` as the rim subset of total `yielded`, skipped core merge/ring/nonopaque/no-match counts and original/final global holders; a yielded pixel also taken by projection closing is omitted from the written `source_px_taken` count. Existing cuts/patches and thresholds are unchanged. The `drift:` line reports `yielded N px` per affected part, even below the drift-body size bar; with the setting off it names `assemble.yield_refused: true` as the conditional remedy. Rebuild and inspect the newly exposed layer in motion before considering any cut; a mismatching or absent behind holder cannot be repaired by this setting. |
+| `assemble.yield_refused` | assemble | **authored**, optional boolean, default `false` (issue #819; other types: `CONFIG_FIELD_TYPE`). With `true`, an original front projection-core pixel refused at max-channel drift > `DRIFT_LIMIT` (90) can yield when its original source pixel is still opaque. Non-core rim pixels (0 < alpha < `CORE_ALPHA`, 250) on the same 8-connected part body can then yield too (issue #832). Connectivity reads the part support before clearing: the opaque border outside the eroded projection core connects the body to its rim but is not itself newly cleared. A separate rim island without a yielded core seed is unchanged. At every cleared pixel, the actual top-most opaque holder below it (alpha >= 250), after earlier yields, must have colour within 90 of the painting. A deeper matching part cannot bypass an intervening opaque mismatch. This setting also applies to alternate sets. A yielded pixel's alpha becomes 0 and its RGB is not repainted. Accepted own-core pixels in the same connected support within the original yielded core's Gaussian footprint (radius 4 rig pixels), with a matching opaque behind holder, finish to painting RGB while retaining alpha and ownership (issue #841); original refusals, protected samples and replacements are excluded. Away from that footprint projection is unchanged. Merge/ring replacements, samples explicitly kept by `keep_under_occluders`, and pixels outside a derived piece cannot connect a rim or be newly yielded. Front is relative to the matching part behind, so original refusals in another run are eligible even when a different part is the global top holder. The reading proceeds back to front against the current behind pixels; alpha changes do not repaint or create a new matching colour. `yieldReadings` optionally records `finishedProjection` (accepted samples whose RGB changed), and records `yieldedRim` as the rim subset of total `yielded`, skipped core merge/ring/nonopaque/no-match counts and original/final global holders; a yielded pixel also taken by projection closing is omitted from the written `source_px_taken` count. Existing cuts/patches and thresholds are unchanged. The `drift:` line reports `yielded N px` per affected part, even below the drift-body size bar; with the setting off it names `assemble.yield_refused: true` as the conditional remedy. Rebuild and inspect the newly exposed layer in motion before considering any cut; a mismatching or absent behind holder cannot be repaired by this setting. |
 | `assemble.keep_under_occluders` | assemble | **authored**, optional array of unique source part names from `assemble.plan`, default `[]` (issue #825). For each named part, keep its own See-through RGBA where the front-most covering part in the final draw stack has alpha greater than 0 and below `CORE_ALPHA` (250), including a cover in the other run. For an explicitly named part, original alpha 1–8 fringe removed by ghost cleanup also counts as source cover, within its final piece region: those pixels still contributed to the painting. Only original opaque own-layer samples are restored after source projection/closing and protected from later seam re-take; merged/rim, cap, under-fill and authored replacement pixels are excluded. This keeps their existing provenance and makes no holes; fully opaque cover and absent cover keep the old path. Cuts and limb pieces inherit the source part's protection. Unknown names: `CONFIG_NAME_RESOLVES`; duplicates: `CONFIG_PART_UNIQUE`; invalid shape: `CONFIG_FIELD_TYPE`. Inspect the part's own amodal layer first: this handle preserves its existing content and cannot complete a missing pixel. Example: `"keep_under_occluders": ["shin_r"]`. |
 | `limbs` | assemble (the cut and the caps), rig (through `regions`), check (`LIMB_ONE_BONE`) | **proposed** by `propose --keypoints` (issue #349), then checked: `{<limb>: {segments: [{part, from, bone}, {part, from, bone, joint, range?, cap?, edge?, cap_shape?, cut_band?, hybrid?}, …], split?, layout?, front?}}`, the upper segment first. The rule is *Limbs: cut at their joints* below the table. `part` is a new part (`CONFIG_PART_NAME`, `CONFIG_PART_UNIQUE` against the plan, patches, cuts and every other limb part); `from` a plan part or a cut's piece (`CONFIG_NAME_RESOLVES`) — the layer the segment's pixels come from, which is cut into the limb parts and is not itself made: a `meshes` or `regions` entry for it is `CONFIG_NAME_RESOLVES`, and the segments of one limb that take one part are consecutive (`CONFIG_LIMB_FROM_RUN`); `bone` a declared bone, each segment's the child of the one before (`CONFIG_LIMB_BONES_CHAIN`); the upper segment names no `joint`, `range`, `cap`, `edge`, `cap_shape` or `cut_band` (`CONFIG_KEY_KNOWN`), every other names its `joint` (`CONFIG_FIELD_PRESENT`) — the joint is its bone's origin; `range` is `[min, max]` degrees from rest with `min <= 0 <= max` (`CONFIG_LIMB_RANGE`), which `assemble` writes into the lower part's `parts.json` record and `check` poses the joint at — its two ends and its middle — reading the seam there (`SEAM_OVER_RANGE`, issue #360; rig-c needs no rotation limit); `cap` a PNG path relative to the config's directory (`CONFIG_FIELD_TYPE`); `edge` `"feather"` (issue #360), the one value it takes, and `cap_shape` `"disc"` (issue #360) or `"ball"` (issue #579) (`CONFIG_FIELD_TYPE` on any other) — the cut's geometry at that joint, *Limbs: cut at their joints* below; absent, the cut is hard and the cap the layer's half-disc of half the limb's width; `cut_band` a whole number of px, 1 or more (`CONFIG_FIELD_TYPE`), on a segment that takes the segment above's part — between two layers nothing is cut, so a band there is `CONFIG_KEY_KNOWN` — places the cut within that many px of the joint line (issue #360, *Limbs: cut at their joints*); absent, the cut is the joint line. Each limb part is attached like any part — `regions.<part>`, which must be the segment's `bone` (`CONFIG_LIMB_BONE`), or a mesh, which `check` holds to that bone alone (`LIMB_ONE_BONE`). With `limbs`, `assemble` reads `bones` too (`CONFIG_FIELD_PRESENT` without it). Absent, nothing is cut at a joint and no byte of any output moves. Optional `front` (issue #664), `{parts: [<own segment part>, …], after: "<produced part>"}`, gives each named segment a second slot `<part>_front`, empty at setup, placed after `after`'s slot family, for a gesture set to draw on (`CONFIG_FRONT_SCOPE`, `CONFIG_FRONT_NAME`, `CONFIG_FRONT_LAYOUT`; *Front slots (issue #664)* below) |
 | `bones` | rig; `propose --from-config` | **proposed** by `propose`, then corrected. A single bone `{name, parent, at, tip?}` or a chain `{chain, parent, points, tip, link_inherit?}` whose links are named `<chain>0 … <chain>n`. Parents come before children. In `rig.json` each link is **turned along its chain** — `rotation` is the direction from its origin to the next link's (the last link's to `tip`) and `length` that distance (issue #73), so a physics constraint added downstream finds a lever; under `--idle-keys ctl` the link's `<link>_ctl` carries the turn and the length and the link sits at local rotation 0 beneath it. A single bone with a `tip` is turned the same way, towards its tip, with that distance as its length (issue #239); a tip on the bone's own origin is refused (`RIG_TIP_DISTINCT`). The five face bones `eye_r`, `eye_l`, `brow_r`, `brow_l` and `mouth` (by name, when one has no tip of its own) are turned to the eye line — the line through the origins of `eye_r` and `eye_l` as `bones` writes them, read image-left to image-right, drawn when parts.json holds both an `eyewhite-r` and an `eyewhite-l` part — so the blink's `scaley` squashes across the eye line on a tilted head; move an eye bone and the line moves with it. With one eyewhite or none, or an eye bone missing, the rig stage's `face axis:` line says so and they keep the page's axes. A bone under a face bone keeps the face's axis. With the line, `rig.json` also declares `invariants.axes` — one entry, `"face"`, through `eye_r` and `eye_l`, holding the turned face bones (and their controls) — so rig-c's gate holds the build to the line; the line is the one rigc draws through the same two bones, so the tolerance is only the float floor — the largest gap the emitted (float32) bones have to it, rounded up to 6 places plus one 6-place unit — and the `face axis:` line prints it. With the line the rig stage also adds `head_up` (issue #250): a slotless bone under `head`, at head's origin, turned to the eye line + 90 degrees and as long as the eye midpoint lies from head's origin along that axis — the head's frame, which a rule that needs it reads; `head` keeps its own frame, so no key on it or under it changes meaning, and a config bone of that name is refused (`RIG_HEAD_UP_NAME_FREE`). A face bone with its own `tip` is held too (issue #258), in a second entry, `"face_tips"`, when its tip lies along the line within whole-pixel rounding — a tip written in whole pixels sits at most sqrt(2)/2 px off the point of the line it stands for, so its direction may sit up to asin((sqrt(2)/2) / length) degrees off — with its tolerance measured the same way; a tip further off is the bone's own axis, and the `face axis:` line names it with its gap and that bound. A failure is rig-c's `A51_BONES_LIE_ALONG_THEIR_DECLARED_AXIS` line, which names the bone and the fix (rig-c's `docs/AUTHORING.md` §3.7 and §5.2); with no line no entry is written and A51 reports SKIP. Every region on a turned bone is turned back, so the setup pose does not move. Any other single bone keeps world rotation 0; one whose parent is a link is turned back upright. A single bone may declare `inherit` (issue #348): what it takes from its parent's transform, one of rig-c's own mode names exactly as rig-c's table spells them — `normal`, `onlyTranslation`, `noRotationOrReflection`, `noScale`, `noScaleOrReflection` (rig-c's `RigBone.inherit`) — written to that bone in `rig.json` as declared; any other spelling, `"NoScale"` included (the runtime would fold its first letter; nothing here folds or maps), is refused (`CONFIG_BONE_INHERIT`), and a chain takes no `inherit` (`CONFIG_KEY_KNOWN`). A chain may instead declare `link_inherit` (issue #369), an object mapping its own expanded link names to those same modes, for example `"link_inherit": {"leg_r1": "noScale"}`. Only the named link changes; omitted links inherit normally. A key outside this chain is `CONFIG_NAME_RESOLVES`, with this chain's valid link names in the detail; a non-object or non-string mode is `CONFIG_FIELD_TYPE`, and another mode spelling is `CONFIG_BONE_INHERIT`. The mode is forwarded to the expanded link, or to its control under `--idle-keys ctl`, by the same rule as a single bone. This is an authored opt-in: `propose` does not add it. Its setup rotation is the turn from where rig-c's own poser puts the bone with no rotation of its own under that mode, so it still stands upright (or along its tip) at the setup pose. Where the idle gives the bone a `<bone>_ctl`, the mode goes on the control: the control is the bone the parent's rotation reaches, and the bone under it inherits normally, so the idle's keys moved onto the control still turn it. A foot that does not take its shin's rotation (`noRotationOrReflection` or `onlyTranslation`) keeps its shoe level while the leg is posed (`FEET_STAY_LEVEL`, §7); which mode is the author's. `noScale` keeps a shin or shoe's shape under a scaled parent but still takes the parent's rotation: a shoe that must also stay level needs a separate rotation constraint, for example a transform constraint from an unrotated bone. This does not change the proposed feet's existing inheritance or `FEET_STAY_LEVEL` default. An automatic mesh weighted through a bone with a mode other than `normal` gets no derived amplitude (its row names the bone) and no residual envelope (rig-c's `SKINNING_RANGE_UNSUPPORTED`). Absent, `rig.json` carries no `inherit` and no byte moves |
@@ -3498,7 +3510,7 @@ existing hardlinks are refused before artifact output; the ordinary mode names
 | `compare` | one line per pair (origin, parent, tip, length, direction — or SKIP and why), then the per-row summary, the unmapped bones of each side, `required:`, each side's roles and the `controls:` line | proposal against the config you corrected: the rows you changed and no others. Config against the `rig.json` `build` writes for it: measured on both examples, every origin within 6.19e-7 px (the rig's offsets are written to 6 places) and every chain link's tip and length within 4.99e-4 px (`length` is written to 3), printed to three places as `0.000` (a signed figure as `+0.000` or `-0.000`); `parent … is the right's ancestor at depth 2, <bone>_ctl between` for every keyed mesh bone, no `DIFFERENT` and no `NOT MAPPED` | `parent DIFFERENT: left a, right b` — a bone hangs from another parent than the other side's; `frames not related` — a rig with no stage (`skeleton.width`/`height`), two configs at different `rig_scale`: the distance rows SKIP, so declare the frame in a `--map` file if the author knows it; `FAIL  STRUCTURE_REQUIRED_PRESENT` — a bone the map requires is missing through its pairs |
 | `rig` (inside `build`) | one line per mesh: vertices, triangles, bones, influences, `cover`; the `bones` line; the `idle keys` line; then rigc's gate lines (with A15's declared SKIP under `--idle-keys direct`); in `rig.json`, each chain link's (or its `_ctl`'s) `length` and `rotation` | `cover 1.00000` on every mesh, both gate summaries `0 failed` (the compile and the packed pages); every link's `length` the distance to the next link and `rotation` its direction (Spine degrees, counter-clockwise, y up, local to the parent), every offset under it — a child bone's `x, y`, a weight's bind `x, y`, a region's `x, y` — in that turned frame, and a region on a link carrying `rotation` that turns it back upright. Nothing moved: `flattenRig` (`src/rig.ts`) turns every offset back and gives the unturned numbers | `RIG_LATTICE_ONE_LOOP`: change that mesh's `grid` |
 | `check` (inside `build`) | the gate lines verbatim, the pack line, `loop:` (and `loop physics:` when the rig declares a physics constraint, §7), `seam:`, the six judgement lines, then — when `motion.json` holds an animation, the idle included — `ANIMATIONS_DO_NOT_FOLD` and one `folds` line per folding mesh, rigc's own (issues #320, #333), then — where a `footwear` part rides a bone that hangs from another — `FEET_STAY_LEVEL` and one `foot` line per such part (issue #348), then — when `parts.json` names a `handwear` part and there is an idle — `STRESS_OFF_CHAIN` (issue #347), then — where `parts.json` holds a limb segment's part — `LIMB_ONE_BONE` and one `limb` line per such part (issue #349), then — where a limb record carries a `range` — `SEAM_OVER_RANGE` and one `joint` line per joint and angle (issue #360), then `SEAM_OVER_MOTION` — a SKIP naming why on a rig that declares no neighbour pair, else the pairs read in every animation; existing internal-joint and explicit-seam pairs retain their `WARN seam` policy (issue #493), while proven body-root tears print `FAIL seam` and fail a counted bar (issue #686), then `CLOTH_SETTLES` — a SKIP naming why on a rig with no physics constraint, else the chains read and one `WARN chain` line per chain whose tip comes to rest before the idle's loop length (issue #501, a warning and never a bar), `RECOMPOSITE_HOLES` and, under `--source`, `SETUP_POSE_VS_SOURCE` (§7), `check.json`; the last line says how many of the bars measured — nine, ten with the fold bar, one more each with the feet-level bar, the stress bar, the limb bar, the range bar and, where proven body-root pairs exist, the body-root seam bar — and names the ones that said SKIP, then — where `SEAM_OVER_MOTION` read a pair — how many warnings it printed, `; N warning(s) (SEAM_OVER_MOTION, not a bar)` — with `CLOTH_SETTLES` named beside it, and N their sum, where the rig declares a physics constraint — which no bar counts | `check: PASS; 11 of 11 bar(s) measured, 0 skipped` on `demo` and `scarf`, whose sleeves each ride one chain; `check: PASS; 10 of 11 bar(s) measured, 1 skipped (STRESS_OFF_CHAIN)` on `reference-demo` and `reference-sample`, whose one `sleeves` mesh rides both sleeve chains (issue #347) — no example writes `FEET_STAY_LEVEL`, every shoe riding `root`; a judgement line SKIP only where the character lacks what it reads; on a rig spec with no `parts.json` or no `idle` (a merged rig, §7 *Measuring a rig rig-parts did not assemble*), PASS with the skipped bars named | `CHECK_SEAM_WITHIN_BAR` or `CHECK_LOOP_CLOSES` (§6); `CHECK_ANIMATIONS_DO_NOT_FOLD` — a clip turns a mesh over (§6); `CHECK_STRESS_OFF_CHAIN` — a sleeve weighted off its chain (§6); `CHECK_LIMB_ONE_BONE` — a limb part on a second bone (§6); `CHECK_SEAM_OVER_RANGE` — a joint that opens when bent (§6); `CHECK_SEAM_OVER_MOTION` — a proven body-root seam opens over the existing floor (§6) |
-| `check` / `build`: extremes observations | `extremes/<anim>/extremes.png` and `extremes.json` beside the other check outputs, generated by core `render --extremes` at 12 fps on its fitted world box at scale 1; one `EXTREMES` geometry-pair frame/distance summary per animation | open the native setup/min/max/diffs and label every changed boundary tear, ghost or clean before human review (step 9) | core's named static/observation SKIPs retain JSON without a PNG; diagnostic failure is `CHECK_EXTREMES_RENDER_FAILED` SKIP and leaves the measured verdict unchanged; `--no-extremes` runs no extra render and removes stale `extremes/` |
+| `check` / `build`: extremes observations | `extremes/<anim>/extremes.png` and `extremes.json` beside the other check outputs, generated by core `render --extremes-only` at 12 fps on its fitted world box at scale 1; one `EXTREMES` geometry-pair frame/distance summary per animation | open the native setup/min/max/diffs and label every changed boundary tear, ghost or clean before human review (step 9) | core's named static/observation SKIPs retain JSON without a PNG; diagnostic failure is `CHECK_EXTREMES_RENDER_FAILED` SKIP and leaves the measured verdict unchanged; `--no-extremes` runs no extra render and removes stale `extremes/` |
 | `check --requirements` (and `build --requirements`) | after the lines above, one line per declared requirement, `NAME: PASS`, `FAIL` or `NOT MEASURABLE — …` with its figures, the bar as declared and the worst frame; then `requirements: N declared — M measured (P PASS, F FAIL), K NOT MEASURABLE; not declared: <kinds>`; `check.json`'s `requirements` block, first its `file` record (issue #556); the renders under `requirements/` (§7, *Declared requirements*) — `build` reads `config.requirements` in place of the flag when it is not given | every line PASS and `0 NOT MEASURABLE`; a follow's `released_copy` says whether rigc's consumer-driven door was taken on the throwaway copy; a `stretch` line's `held_by` (issue #321), right after `worst`, names the bones the worst edge's two vertices hang on and their idle chains, in `CHECK_TEXTURE_STRETCH`'s words (§6) and by the same function, on a PASS as on a FAIL | `CHECK_REQUIREMENT_MET` (a figure past its bar; the line names the frame) or `CHECK_REQUIREMENT_MEASURABLE` (the quantity is undefined in the frames: a tip or an axis on a bone of length 0, an aim with no line, a follow no frame of which reaches its least drive); the last line then reads `check: FAIL — B bar(s) not met, R declared requirement(s) not PASS` |
 | `compose` | the `[compose]` lines: one per character (its offset, its scale, its placed bounds, the shift and how many first-level bones, regions on `root` and weights bound to `root` it moved, its bone, slot, track and constraint counts, its `rig_scale` and idle), the declared order and the slot count it expands to, rigc's gate lines; then the `[check]` lines as for `check`, and `scene.json` | both gate summaries `0 failed`, `check: PASS` with the bars that measured and the ones that said SKIP named — on a composed rig `4 of 9`: the gate, the loop, `CHAIN_LAG` and `TEXTURE_STRETCH` (there is no `parts.json`; each character's own `build` measured all nine). `scene.json`'s `order.slots` is the order the compiled skeleton draws | a `SCENE_*` refusal (§6, *compose*) — the scene file, a build, or the order; `COMPOSE_RIGC_GREEN` — rigc's own line, quoted |
 | `loop` (inside `build --loop`, or `loop --frames … --out …`) | the dropped-duplicate line, or, when the end frame is not frame 0, the jump line: its max \|d\| and px over 40, then why — under `build`, `the rig holds N physics constraint(s), and rigc's render starts every one at rest at frame 0` with the remedy `build --loop --lead-in <n>`, or `the rig holds no physics constraint, so the idle itself does not close` (`CHECK_LOOP_CLOSES`); under `loop --frames`, which reads frames alone, both causes (issue #325); under `build --lead-in`, the lead-in line in its place (the frames kept and the jump at the wrap); each file's line, then `loop: idle.png N B (lossless); idle-indexed.png N B (max …, mean …); idle.gif N B (max …, mean …)` | `f0048.png equals f0000.png byte for byte, so it is dropped` | `LOOP_ENCODE` (§6) |
@@ -3725,6 +3737,67 @@ run on a `direct` build (it has no rig spec to read) refuses A15 once per keyed
 bone. No stage runs `validate`: the gate is `rigc build`, which reads the rig spec
 and its declaration, and is green on both (`RG19`).
 
+### Bounded painting extension (issue #848)
+
+When two See-through layers both omit painted pixels, projection, keep/yield
+and the seam colour guard have no existing sample to transfer. Declare an
+owner only for the measured missing region:
+
+```json
+"extend_painting": [
+  {"part": "shin_l", "band": [40, 80, 56, 88], "max_distance": 3}
+]
+```
+
+This field is inside `assemble`. `part` names a **final layer-derived output
+part**, including a cut piece or limb segment, after cuts and limb splitting;
+not a consumed plan source or a painting patch. Each part may appear once.
+`band` is `[x0,y0,x1,y1]` in rig pixels (painting pixels times `rig_scale`),
+x right/y down, upper bounds exclusive, wholly inside the rig. Every coordinate
+is a nonnegative safe integer; the rectangle must have positive width and
+height. `max_distance` is a positive safe integer of **four-neighbour steps**.
+Neither bound is inferred or clipped. The example numbers illustrate the
+schema; they are not proposed coordinates for a particular painting.
+
+The stage reads the final assembled stack after cuts, limb splits, exclusions,
+fringe push-back and yield. A candidate is unheld only if **every assembled
+part has alpha exactly zero** there; even alpha 1 on another part blocks it.
+Its painting alpha, Lanczos-resampled to rig size, must be at least 250.
+The original target silhouette (alpha above 8) seeds candidate pixels one
+horizontal or vertical step away, including from just outside the band. Paths
+then traverse only eligible pixels inside the band, up to `max_distance` steps
+from the original silhouette. Diagonal contact alone does not connect a pixel.
+Growing a candidate never resets the distance or fills a whole component.
+A disconnected painted island, a pixel outside the band and a connected pixel
+past the distance bound stay unheld. Two declared parts reaching the same
+pixel are refused as `ASSEMBLE_PAINTING_EXTENSION_CONFLICT`; declaration order
+does not choose the owner.
+
+Each gained sample takes the **exact RGB of the existing rig-space painting
+resample** (`sourceInRig`, the legacy RGB-only Lanczos resample), and alpha from
+the separately resampled painting alpha. At `rig_scale: 1` this copies the
+painting's RGB bytes directly; at other scales it copies that resample's RGB
+bytes, not a nearest source texel. It never feathers, repaints, invents hidden
+art, changes an already held sample or infers which opaque colour is figure.
+An opaque background inside the declared reachable band is eligible too:
+choose the band from the measured omission. Transparent painting pixels cannot
+bridge a path. No depth is invented: a gain on a target with registered layer
+depth refuses `DEPTH_PART_SUPPORT`, because the painting supplies no declared
+scalar material for those new samples.
+
+`parts.json` attributes gained output samples to
+`provenance.automatic[].stage: "paintingExtension"` when their final RGBA
+differs from the normalized raw layer. The optional part field
+`painting_extension_px` records the exact count assigned from the painting,
+including zero when the declaration reaches nothing. It is independent of the
+value partition: a newly assigned painting sample that happens to equal a raw
+layer sample remains `unchanged_layer` on the value axis. They contribute to `opaque_px` and `visible_px`, not the older
+projection's `source_px_taken` or `merged_px`. Existing provenance partitions
+and reader sum checks still apply. Absent/empty declarations take no extension
+path. Declarations apply to the **base painting only** and are not inherited
+into alternate paintings. Native setup and animation boundary checks remain
+consumer acceptance work; assembly provenance does not establish motion quality.
+
 ### Source before scissors
 
 <a id="source-before-scissors-issue-819"></a>
@@ -3744,7 +3817,17 @@ problem. Follow this repair ladder, recording what each step measured:
    opaque behind holder, measure
    `assemble.yield_refused: true` (issue #819). It clears original refused front
    cores and their connected non-core rim alpha (issue #832) under the conditions
-   in the field table; it does not paint a repair.
+   in the field table. Beside an actually yielded core, accepted own-core samples
+   in the same connected part support finish to the painting's RGB within the
+   existing Gaussian footprint (sigma 1, radius 4 rig pixels; issue #841), provided
+   the exposed opaque behind holder also matches within `DRIFT_LIMIT`. Their
+   alpha and ownership stay intact; original refusals, kept samples, merge/ring
+   replacements and other cut regions are excluded. Outside that footprint the
+   projection weights stay unchanged. The synthetic 16x16 refused square with a
+   four-pixel accepted surround has 320 opaque surround samples: before finishing,
+   140 retain colour error (maximum 27 channel levels); afterwards the maximum
+   is 0, with the body holding all 256 yielded pixels and no open hole. These are
+   fixture measurements, not a claim about an arbitrary painting.
 5. For a moving part under a soft hem, inspect its own amodal See-through layer.
    If the painting's blended hem is re-taken onto otherwise complete hidden art,
    measure `assemble.keep_under_occluders: ["<source-part>"]`. The informational
@@ -3792,8 +3875,11 @@ still ends in the unchanged class by the first comparison.
 
 Automatic value changes are named `sourceProjection`, `extend`, `growRim`,
 `limbCap`, `limbFeather`, `fringeRestore`, `seamOverride`, `armSplit`,
-`headFaceUnderfill` or `ghostCleanup`. `limbSplit` and `limbHybrid` remain
+`headFaceUnderfill`, `ghostCleanup` or `paintingExtension`. `limbSplit` and `limbHybrid` remain
 recognized stage names, but their pure copies do not claim a value change.
+`paintingExtension` copies unheld painting samples within an explicit band;
+`painting_extension_px` counts that ownership assignment independently, even
+when restoring raw-layer values makes its final value class unchanged.
 Run preparation compares actual normalized samples, not layer-wrapper identity:
 the head under-fill loop assigns the full composite, but equal samples keep
 their earlier lineage. Arm-generated tags use their original hand-layer
@@ -4214,6 +4300,9 @@ says why each requirement exists and what breaks without it.
 | <a id="SEETHROUGH_ARM_RUN_MERGED"></a>`SEETHROUGH_ARM_RUN_MERGED` | a full-run `handwear-r` or `handwear-l` layer merges sleeve, bare hand (`>= 40` skin run px around `<s>_wrist`, `GHOST_MIN_AREA`) and overgarment into one arm layer with non-skin pixels reaching more than `1.0x` the forearm length (`<s>_elbow -> <s>_wrist`) below `<s>_wrist` (measured `-0.15x..0.45x` on the 6 clean standees vs `1.25x..2.02x` on the 3 merged standees), and the sleeve above `<s>_wrist` and the drape below `<s>_wrist` have Euclidean RGB distance `< 80` (`ARM_DRAPE_COLOR_DISTANCE`, measured `20.8..28.2` when same-coloured vs `103.6..236.0` when distinct) so the stage cannot split them by colour (issue #490; the detail gives the hand px, the non-skin span, the forearm length and both RGB medians) | follow [Source before scissors](#source-before-scissors): select another layer/run, then a tighter run, then correct depth/role; if no separate source exists and sleeve and overgarment must move independently, a structural `author:` layer or `assemble.cuts` entry separates them |
 | <a id="SEETHROUGH_HEAD_RUN_HOLLOW"></a>`SEETHROUGH_HEAD_RUN_HOLLOW` | `full:face` has at least `200` opaque run px (`PROPOSE_MIN_PX`) and `head:face` covers less than `75 %` (`HEAD_FACE_COVERAGE_FLOOR`, measured `0.0 %..48.6 %` on hollow/omitted head runs vs `84.8 %..99.6 %` on clean head runs across the 4 public examples and 9-standee corpus) of `fullLayerToHead(full:face)`'s hole-filled silhouette (`alpha > 8`) in the head canvas while `config.assemble.head_face_underfill: true` is not declared, or `head:face` has fewer than `200` opaque pixels so there is no head-run `face` layer to under-fill (issue #492; the detail gives the full-run mapped count, the head-run overlap and upper/lower half shares) | re-seed `config.seethrough.seed`, or set `config.assemble.head_face_underfill: true` when `head:face` exists so the stage composites `fullLayerToHead(full:face)` under `head:face` on the head canvas (the fill restores transparent pixels only and leaves the cut's own edge where it is — a hollow whose edge is not under hair stays visible; follow [Source before scissors](#source-before-scissors) for its source remedy) |
 | <a id="ASSEMBLE_PLAN_TAG_IN_RUN"></a><a id="ASSEMBLE_EXTEND_TAG_IN_RUN"></a>`ASSEMBLE_PLAN_TAG_IN_RUN`, `ASSEMBLE_EXTEND_TAG_IN_RUN` | an entry takes a tag its run does not hold (the detail lists what it does hold) | that entry's run or tag |
+| <a id="ASSEMBLE_PAINTING_BAND_INSIDE"></a>`ASSEMBLE_PAINTING_BAND_INSIDE` | an extension band reaches past the rig canvas | supply an in-canvas half-open band in rig pixels; no bound is clipped |
+| <a id="ASSEMBLE_PAINTING_EXTENSION_CONFLICT"></a>`ASSEMBLE_PAINTING_EXTENSION_CONFLICT` | two declared final parts can reach the same unheld painting pixel | make their reachable bands disjoint; order never guesses ownership |
+| <a id="ASSEMBLE_PAINTING_CANVAS"></a>`ASSEMBLE_PAINTING_CANVAS` | a callable extension stage receives a part outside the rig canvas | pass the final in-canvas assembled stack with its crop offsets |
 | <a id="ASSEMBLE_PART_OPAQUE"></a>`ASSEMBLE_PART_OPAQUE` | a part ended with no opaque pixel | drop the entry, or take the tag from the other run |
 | <a id="ASSEMBLE_PATCH_BOX_INSIDE"></a>`ASSEMBLE_PATCH_BOX_INSIDE` | a patch's box reaches past the rig (the painting times `rig_scale`; the detail gives the size) | that patch's `box` — it is in rig pixels, not painting pixels |
 | <a id="ASSEMBLE_PATCH_OPAQUE"></a>`ASSEMBLE_PATCH_OPAQUE` | a patch takes no pixel: a `"silhouette"` patch whose box holds none of the figure | move the box onto the figure, or `"alpha": "box"` |
@@ -4727,6 +4816,7 @@ and stay absent).
 | <a id="CONFIG_TURN_COUNTER_RANGE"></a>`CONFIG_TURN_COUNTER_RANGE` | `config.turn.counter` (or `config.turn.body.counter`) is outside `[0, 1]` | supply a non-negative rear counter-translation fraction in `[0, 1]` |
 | <a id="CONFIG_TURN_ROLE_UNKNOWN"></a>`CONFIG_TURN_ROLE_UNKNOWN` | `config.turn.roles.<part>` (or `config.turn.body.roles.<part>`) is not `"surface"`, `"unit"` or `"rear"` | declare `"surface"`, `"unit"` or `"rear"` |
 | <a id="CONFIG_TURN_SURFACE_REQUIRED"></a>`CONFIG_TURN_SURFACE_REQUIRED` | `config.turn.roles` (or `config.turn.body.roles`) declares no `"surface"` part | declare at least one part as `"surface"` |
+| <a id="CONFIG_TURN_SURFACE_AUTO"></a>`CONFIG_TURN_SURFACE_AUTO` | a part with role `"surface"` in `config.turn.roles` or `config.turn.body.roles` uses `meshes.<part>.auto`; its emitted-mesh deform cannot also key the unreduced reference used by the auto motion gate | use `grid` or `contour` for the named part to keep the depth turn |
 | <a id="CONFIG_TURN_UNIT_MESH_BONES"></a>`CONFIG_TURN_UNIT_MESH_BONES` | `config.turn.roles.<part>` (or `config.turn.body.roles.<part>`) declares `"unit"` for a mesh part in `config.meshes` that binds a bone outside the `"head"` subtree (or outside the torso carrier subtree for `turn.body`), or shares a bound bone or chain with another `"unit"` mesh part, so its bones cannot be moved under `<part>_unit` (#790) | bind each `"unit"` mesh only to `"head"` and its own child bones or chains under `"head"` (or to the torso root bone and its own non-head descendants for `turn.body`), or give the part role `"rear"` |
 | <a id="CONFIG_TURN_EAR_DRAW_ORDER"></a>`CONFIG_TURN_EAR_DRAW_ORDER` | an ear part in `config.turn.roles` is drawn after `face` with role `"surface"` in `assemble.plan` | place `ear_r` and `ear_l` before `face` in `assemble.plan` so the turning cheek occludes the far ear |
 | <a id="CONFIG_TURN_HEAD_BONE"></a>`CONFIG_TURN_HEAD_BONE` | `config.turn.roles` is declared without a single bone `"head"` in `config.bones`, or `config.turn.body` without a single bone `"chest"` / `"hip"` (or its declared `bone`) | declare `"head"` (or the body turn root bone) as a single bone in `config.bones` |
@@ -5808,6 +5898,18 @@ parents and stops keep their emitted names; Core creates the draw bones later.
 A name ending in `_d` alone is not an alias: a missing non-stop bone still
 raises `RIG_TURN_SURFACE_MESH_BINDINGS`. No new config field is required.
 
+Depth-turn `"surface"` parts may use authored weighted `grid`, `contour`,
+`influence` or `explicit` meshes, or the turn-generated grid when attached as
+a region. `auto` cannot combine with `"surface"` in either `turn.roles` or
+`turn.body.roles`: [`CONFIG_TURN_SURFACE_AUTO`](#CONFIG_TURN_SURFACE_AUTO)
+refuses the config before mesh generation or any build output. The turn keys
+the emitted mesh's vertices and influence order, while the auto motion gate
+also substitutes its unreduced source attachment with the same motion. Those
+topologies need separate deform keys even when the reduced candidate itself
+passes the gate. Use `grid` or `contour` for that part to retain depth turning.
+This restriction does not apply to `"unit"` or `"rear"` parts, which use bone
+carriers, or to the legacy scalar-depth turn without `roles`.
+
 A weighted surface spanning the head and body subtrees (#796) takes both
 fields. Declare it as `"surface"` in `turn.roles` or `turn.body.roles` (both is
 also accepted), with both 2.5D groups present. Head descendants belong to the

package/docs/MIGRATION.md

@@ -54,7 +54,7 @@ installed the former upstream name beside this package installs nothing more:
 
 ### Scoped core dependency
 
-The current dependency is `@rig-c/core` at `^2.81.0`, replacing the literal
+The current dependency is `@rig-c/core` at exactly `2.82.0`, replacing the literal
 `rig-c` dependency described for earlier versions above. The alias remains
 published. Imports retain their subpaths: `rig-c/mesh` becomes
 `@rig-c/core/mesh`, and `rig-c/core` becomes `@rig-c/core/core`. The command

package/docs/STABILITY.md

@@ -129,9 +129,10 @@ part name, `[i]` an entry of a list):
 - **generation.control.skeleton**, the pose file it names when it is no built-in — required: `width`, `height`, `points`
 - **seethrough** — required: `resolution`, `steps`, `seed`, `offload`; optional: `head_box`, `arm_split`
 - **seethrough.arm_split** — required: `order`, and one of `x` or `line` (issue #439)
-- **assemble** — required: `rig_scale`, `plan` (from plain `assemble` on); optional: `extend_below_crop`, `patches`, `cuts`, `alternates`, `head_face_underfill`, `yield_refused`, `keep_under_occluders`
+- **assemble** — required: `rig_scale`, `plan` (from plain `assemble` on); optional: `extend_below_crop`, `patches`, `cuts`, `alternates`, `head_face_underfill`, `yield_refused`, `keep_under_occluders`, `extend_painting`
 - **assemble.alternates[i]** — required: `name`; optional: `source`, `full`, `head`, `parts`, `hides`, `head_box`, `cuts`, `skeleton`, `anchor`, `base_anchor`, `drawn`, `tips`, `front`, `layers`, `focus` (issues #454, #465, #543, #652, #664, #666, #719, #780). `focus` is an authored finite `[x, y]` in painting pixels, within its canvas (edges included), refused as CONFIG_SET_FOCUS before assemble output when invalid; only when present, `parts.json` records it with focus_source_size and `sets.json` emits it in setup-world coordinates through the actual rig resize and `src/coords.ts`. Absent focus emits no field or inferred value; changing/removing it requires reassembly
 - **assemble.extend_below_crop[i]** — required: `part`, `run`, `tag`
+- **assemble.extend_painting[i]** — required: `part`, `band`, `max_distance` (issue #848; explicit final layer-derived part, half-open rig band and positive four-neighbour path bound; base painting only)
 - **assemble.patches[i]** — required: `name`, `box`, `alpha`, `draw`
 - **assemble.patches[i].draw**, when an object — required: `before`
 - **assemble.cuts[i]** — required: `from`, `into`, `polygon`, `draw`, `overlap`; optional: `under`, `under_fill`
@@ -303,7 +304,7 @@ in the package.
 
 ## rig-c
 
-`dependencies` takes `@rig-c/core` `^2.81.0`: 2.81.0 or any later 2.x. Bun 1.4 or later
+`dependencies` takes `@rig-c/core` `2.82.0` exactly. Bun 1.4 or later
 is the declared floor (`engines.bun` `>=1.4.0`; older 1.4 releases are not tested in
 CI, which runs `latest`, and compatibility with an older 1.4 release is handled when
 reported as an issue). What this package relies on in rig-c, every import

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rig-parts",
-  "version": "1.79.1",
+  "version": "1.80.0",
   "description": "AI-authored 2D character parts from one anime painting and its See-through layer decomposition: measured parts, weighted-mesh rig specs, verified through rig-c before anything is written. A CLI for agents that cannot see the image.",
   "type": "module",
   "bin": {
@@ -58,6 +58,7 @@
   "scripts": {
     "fetch-examples": "bash scripts/fetch-examples.sh",
     "selftest": "bun selftest.ts",
+    "selftest:pre": "bun selftest.ts --pre",
     "smoke": "bun scripts/install_smoke.ts",
     "typecheck": "bunx tsc --noEmit",
     "lint": "bunx eslint .",
@@ -65,7 +66,7 @@
   },
   "dependencies": {
     "ag-psd": "^31.0.2",
-    "@rig-c/core": "^2.81.0"
+    "@rig-c/core": "2.82.0"
   },
   "devDependencies": {
     "@esotericsoftware/spine-core": "4.3.13",

package/src/assemble.ts

@@ -1,3 +1,4 @@
+import { paintingExtensionMasks, paintingExtensionProblems, type PaintingExtension } from './paintingextension.ts';
 import { AUTOMATIC_WRITERS as AW, compactValueBaseline, pixelProvenance, rgbaEqual, type ValueBaseline } from './provenance.ts';
 import { bindDepthRun, copyDepthMaterial, registerDepthRun, transportPartDepth, type DepthConfig, type RegisteredDepth } from './depthsheets.ts';
 /**
@@ -118,6 +119,7 @@ import {
   erode,
   fillHoles,
   gaussianBlur,
+  gaussianKernelSize,
   type Mask,
   morphClose,
   newFloatImage,
@@ -241,7 +243,7 @@ export interface Geometry {
   keySkeleton?: ControlSkeleton;
   /** `assemble.head_face_underfill` (issue #492): composite `full:face` under `head:face` on the head canvas to fill transparent bare-skin holes. */
   headFaceUnderfill?: boolean;
-  /** `assemble.yield_refused`, default false; alpha-only transfer of refused cores and their connected non-core rims. */
+  /** `assemble.yield_refused`, default false; transfer of refused cores/rims, finishing nearby accepted projection RGB. */
   yieldRefused?: boolean;
   /** Plan parts whose own samples survive source re-take beneath soft front cover. */
   keepUnderOccluders?: readonly string[];
@@ -317,7 +319,7 @@ export interface AssembleInput {
   depth?: DepthConfig;
   /** Config-relative user sheet paths; caller supplies its actual base. */
   depthBase?: string;
-  /** The painting. Its alpha is ignored, as the reference's `convert("RGB")` drops it. */
+  /** The painting. Legacy RGB stages ignore alpha; explicit paintingExtension requires opaque source alpha. */
   source: Raster;
   full: LayerSet;
   head: LayerSet;
@@ -362,10 +364,12 @@ export interface AssembleInput {
   keySkeleton?: ControlSkeleton;
   /** `assemble.head_face_underfill` (issue #492): composite `full:face` under `head:face` on the head canvas to fill transparent bare-skin holes. */
   headFaceUnderfill?: boolean;
-  /** `assemble.yield_refused`, default false; alpha-only transfer of refused cores and their connected non-core rims. */
+  /** `assemble.yield_refused`, default false; transfer of refused cores/rims, finishing nearby accepted projection RGB. */
   yieldRefused?: boolean;
   /** Plan parts whose own samples survive source re-take beneath soft front cover. */
   keepUnderOccluders?: readonly string[];
+  /** Base painting only; named final parts, explicit band and path bound (#848). */
+  paintingExtension?: readonly PaintingExtension[];
   /**
    * Issue #587: rig pixels taken out of named parts once the cuts and the limbs are made, before the fringe pass and
    * every figure a part's record holds — each entry clears `part`'s pixels (alpha, colour and region) where `mask` is
@@ -2169,6 +2173,30 @@ export interface ProjectionStats {
   refusedMask: Mask | null;
 }
 
+/** Finish accepted source RGB near an actually yielded core (#841).
+ * The caller freezes the Gaussian footprint before clearing any rim, and passes
+ * only the original connected support. Recheck material ownership at the write:
+ * a copied sample or another derived piece never inherits the source's acceptance.
+ * Alpha and the projection counts are unchanged; the callback records RGB writes.
+ */
+export function finishYieldedProjection(
+  image: Raster, source: Raster, projection: ProjectionStats, footprint: Mask,
+  support: Int32Array,
+  own: { kept: Mask | null; region: Mask | null; merged: Int32Array; ring: Mask; behind: Int32Array },
+  changed?: (pixel: number) => void,
+): number {
+  let finished = 0;
+  for (const p of support) {
+    if (footprint.data[p] !== 1 || projection.coreMask?.data[p] !== 1 || projection.takenMask.data[p] !== 1 || projection.refusedMask?.data[p] !== 0 || image.data[p * 4 + 3] < CORE_ALPHA || own.behind[p] < 0) continue;
+    if (own.kept?.data[p] === 1 || (own.region !== null && own.region.data[p] !== 1) || own.merged[p] >= 0 || own.ring.data[p] !== 0) continue;
+    if (maxDiff(image.data, p * 4, source.data, p * 4) === 0) continue;
+    for (let c = 0; c < 3; c++) image.data[p * 4 + c] = source.data[p * 4 + c];
+    changed?.(p);
+    finished++;
+  }
+  return finished;
+}
+
 function maxDiff(a: Uint8ClampedArray, i: number, b: Uint8ClampedArray, j: number): number {
   return Math.max(Math.abs(a[i] - b[j]), Math.abs(a[i + 1] - b[j + 1]), Math.abs(a[i + 2] - b[j + 2]));
 }
@@ -4392,6 +4420,8 @@ export interface DriftYieldReading {
   yieldedRim: number;
   /** Yielded refusals also accepted by projection closing; removed from the written projected count. */
   yieldedTaken: number;
+  /** Accepted own-core samples finished to painting RGB near a yielded core (#841); alpha is unchanged. */
+  finishedProjection?: number;
   /** Original refused pixels explicitly kept from their own layer (#825). */
   preserved?: number;
   skipped: { merge: number; ring: number; notOpaque: number; noMatchingBehind: number };
@@ -4604,6 +4634,7 @@ export function checkSingleRun(full: LayerSet, plan: readonly PlanEntry[] | null
  */
 export function assemble(input: AssembleInput): AssembleResult {
   const { source, extend, patches, seamRule, projectRule } = input;
+  if (input.paintingExtension !== undefined) refuseIfAny(paintingExtensionProblems(input.paintingExtension));
   const single = input.single === true;
   const frame = checkGeometry(
     { sourceW: source.width, sourceH: source.height, resolution: input.resolution, headBox: input.headBox, rigScale: input.rigScale, ...(single ? { single: true } : {}) },
@@ -5339,6 +5370,9 @@ export function assemble(input: AssembleInput): AssembleResult {
         yielded++;
       }
       if (yielded > 0) {
+        // The same finite support as projectSource's Gaussian: only original
+        // yielded cores seed this neighbourhood, never a subsequently cleared rim.
+        const finish = dilate(mask, gaussianKernelSize(FEATHER_SIGMA));
         // Connectivity reads the original part support, including the opaque
         // band outside the eroded projection core. Only non-core rim pixels
         // may additionally yield: traversing an opaque pixel never clears it.
@@ -5369,6 +5403,10 @@ export function assemble(input: AssembleInput): AssembleResult {
             yielded++;
           }
         }
+        const finished = finishYieldedProjection(b.r, srcr, b.st, finish, queue.subarray(0, end),
+          { kept: keptRetake[orderIdx], region: b.region, merged: b.trace.from, ring: b.trace.ring, behind: behindAt },
+          p => { writersInOrder[orderIdx][p] = AW.sourceProjection; });
+        if (finished > 0) reading.finishedProjection = finished;
       }
       reading.yielded = yielded;
       reading.originalHolders = [...holders].map(([part, px]) => ({ part, px }));
@@ -5389,6 +5427,32 @@ export function assemble(input: AssembleInput): AssembleResult {
       reading.finalHolders = [...holders].map(([part, px]) => ({ part, px }));
     }
   }
+  // #848: read one frozen final stack after every ownership-changing pass.
+  // The ordinary RGB painting still ignores alpha, as before. Only this opt-in
+  // stage reads separately resampled painting alpha; its RGB is never used.
+  const paintingAlpha = (input.paintingExtension?.length ?? 0) === 0 ? null : resize(source, W, H, 'lanczos3');
+  const paintingGains = paintingAlpha === null ? new Map<string, Mask>()
+    : paintingExtensionMasks(input.paintingExtension!, stack.map(p => ({ name: p.record.name, image: p.image, x: p.record.x, y: p.record.y, canExtend: !p.record.from.startsWith('painting:') })), paintingAlpha);
+  stack.forEach(({ record, image }, i) => {
+    const gain = paintingGains.get(record.name);
+    if (gain === undefined) return;
+    const d = order[i];
+    if (!('patch' in d)) {
+      const b = pieceAt(d).b;
+      if (gain.data.some(v => v === 1) && [b.key, ...b.extendKeys].some(k => registeredDepth.has(k))) {
+        refuseIfAny([{ code: 'DEPTH_PART_SUPPORT', object: `part "${record.name}"`, detail: 'painting extension has no declared painting depth material; remove this extension or the target layer depth, never extrapolate a layer sheet onto new painting samples' }]);
+      }
+    }
+    for (let p = 0; p < W * H; p++) if (gain.data[p] === 1) {
+      image.data.set(srcr.data.subarray(p * 4, p * 4 + 3), p * 4);
+      image.data[p * 4 + 3] = paintingAlpha!.data[p * 4 + 3];
+      writersInOrder[i][p] = AW.paintingExtension;
+      if (!('patch' in d)) {
+        const region = pieceAt(d).b.region;
+        if (region !== null) region.data[p] = 1;
+      }
+    }
+  });
   const pushedOf: FringePushed[][] = plan.map(() => []);
   const pushedOfCut: FringePushed[][] = cuts.map(() => []);
   const pushedOfLimb: FringePushed[][] = lim.parts.map(() => []);
@@ -5425,7 +5489,8 @@ export function assemble(input: AssembleInput): AssembleResult {
       const own = e < 0 ? st : (stats.get(extendKeys[e]) as ProjectionStats);
       // A pixel outside the piece's region is a base pixel filled from a cut's under image (issue #193): occluded, never visible.
       if (r.data[p * 4 + 3] > OPAQUE_ALPHA_ABOVE && own.clear.data[p] === 1 && (region === null || region.data[p] === 1)) visible.data[p] = 1;
-      if (retakeByName.get(name)?.data[p] !== 1 && yields.get(name)?.mask.data[p] !== 1 && trace.ring.data[p] === 0 && own.takenMask.data[p] === 1 && (region === null || region.data[p] === 1)) projected.data[p] = 1;
+      if (paintingGains.get(name)?.data[p] === 1) visible.data[p] = 1;
+      if (paintingGains.get(name)?.data[p] !== 1 && retakeByName.get(name)?.data[p] !== 1 && yields.get(name)?.mask.data[p] !== 1 && trace.ring.data[p] === 0 && own.takenMask.data[p] === 1 && (region === null || region.data[p] === 1)) projected.data[p] = 1;
     }
     const { x0, y0, x1, y1, opaque } = measureBox(r);
     if (opaque === 0) {
@@ -5450,12 +5515,14 @@ export function assemble(input: AssembleInput): AssembleResult {
       visible_px: vc.visible_px,
       occluded_px: vc.occluded_px,
       projected_core_px: region === null ? st.core : count(st.coreMask, region),
-      source_px_taken: (region === null ? st.taken : count(st.takenMask, region)) - (yields.get(name)?.reading.yieldedTaken ?? 0) - (retakeByName.get(name) == null ? 0 : count(st.takenMask, retakeByName.get(name)!)),
+      source_px_taken: (region === null ? st.taken : count(st.takenMask, region)) - (yields.get(name)?.reading.yieldedTaken ?? 0) - (retakeByName.get(name) == null ? 0 : count(st.takenMask, retakeByName.get(name)!)) - (paintingGains.has(name) ? count(st.takenMask, paintingGains.get(name)!) : 0),
       visible_not_projected_px: vc.visible_not_projected_px,
       refused_drift_px: region === null ? st.refused : count(st.refusedMask, region),
       merged_px: merged,
       seam_override_px: 0,
     };
+    const paintingGain = paintingGains.get(name);
+    if (paintingGain !== undefined) record.painting_extension_px = paintingGain.data.reduce((sum, value) => sum + value, 0);
     if (pushedHere.length > 0) record.fringe_pushed_back = pushedHere;
     if (limb !== undefined) record.limb = limb;
     const image = crop(r, x0, y0, record.w, record.h);
@@ -6363,10 +6430,12 @@ export function stageFields(
   armSplit?: ArmSplit;
   keySkeleton?: ControlSkeleton;
   headFaceUnderfill?: boolean;
-  /** `assemble.yield_refused`, default false; alpha-only transfer of refused cores and their connected non-core rims. */
+  /** `assemble.yield_refused`, default false; transfer of refused cores/rims, finishing nearby accepted projection RGB. */
   yieldRefused?: boolean;
   /** Plan parts whose own samples survive source re-take beneath soft front cover. */
   keepUnderOccluders?: readonly string[];
+  /** Base painting only; named final parts, explicit band and path bound (#848). */
+  paintingExtension?: readonly PaintingExtension[];
   turnMovingPair?: (a: string, b: string) => boolean;
 } {
   const problems: Problem[] = [];
@@ -6389,6 +6458,7 @@ export function stageFields(
     ...(cfg.assemble.head_face_underfill === undefined ? {} : { headFaceUnderfill: cfg.assemble.head_face_underfill }),
     ...(cfg.assemble.yield_refused === undefined ? {} : { yieldRefused: cfg.assemble.yield_refused }),
     ...(cfg.assemble.keep_under_occluders === undefined ? {} : { keepUnderOccluders: cfg.assemble.keep_under_occluders }),
+    ...(cfg.assemble.extend_painting === undefined ? {} : { paintingExtension: cfg.assemble.extend_painting }),
     ...(turnMovingPair === null ? {} : { turnMovingPair }),
     rigScale: cfg.assemble.rig_scale,
     plan: cfg.assemble.plan,

package/src/check.ts

@@ -5748,9 +5748,9 @@ export function windBandLines(line: WindBandLine, plant: WindBandPlant = {}): st
  * its grid to one pixel per world unit makes the panels native, without a
  * second framing implementation. Each animation is rendered separately to
  * release its sampled poses before the next. Only the two observation files
- * survive; the ordinary frames and contact sheets are scratch.
+ * survive; core's extremes-only mode omits ordinary frames and contact sheets.
  */
-function renderExtremes(build: string, out: string, animations: readonly string[], frames: unknown, render: RigcRunner): string[] {
+function renderExtremes(build: string, out: string, animations: readonly string[], frames: unknown, frameSets: unknown, render: RigcRunner): string[] {
   if (animations.length === 0) return ['EXTREMES SKIP: CHECK_EXTREMES_NO_ANIMATIONS — no animation in motion.json'];
   const scratch = join(out, '_extremes');
   const dest = join(out, 'extremes');
@@ -5767,15 +5767,18 @@ function renderExtremes(build: string, out: string, animations: readonly string[
     const lines: string[] = [];
     for (const animation of animations) {
       const rendered = join(scratch, 'render');
-      const call = render(['render', '--candidate', build, '--animation', animation, '--fps', String(IDLE_FPS), '--viewport-from', grid, '--extremes', '--out', rendered]);
-      if (call.status !== 0) throw new Error(`render --extremes ${JSON.stringify(animation)} exited ${call.status}: ${call.out.trim()}${rigcRanClause(call)}`);
+      const call = render(['render', '--candidate', build, '--animation', animation, '--fps', String(IDLE_FPS), '--viewport-from', grid, '--extremes-only', '--out', rendered]);
+      if (call.status !== 0) throw new Error(`render --extremes-only ${JSON.stringify(animation)} exited ${call.status}: ${call.out.trim()}${rigcRanClause(call)}`);
       const summaries = call.out.split('\n').map(line => line.trim().replace(/^\.\.\s+/, '')).filter(line => line.startsWith('EXTREMES '));
-      if (summaries.length === 0) throw new Error(`render --extremes ${JSON.stringify(animation)} printed no EXTREMES summary`);
-      // The sidecar owns directory naming, including core's escaping of names.
-      const sidecar = JSON.parse(readFileSync(join(rendered, 'frames.json'), 'utf8')) as { sets: Array<{ animation: string; dir: string }> };
-      const set = sidecar.sets.find(row => row.animation === animation);
-      if (set === undefined) throw new Error(`render --extremes has no set for ${JSON.stringify(animation)}`);
-      const source = join(rendered, set.dir), target = join(dest, set.dir);
+      if (summaries.length === 0) throw new Error(`render --extremes-only ${JSON.stringify(animation)} printed no EXTREMES summary`);
+      // The earlier ordinary render already named every animation's directory.
+      // Observation-only renders deliberately write no new frames.json index.
+      const sets = isRecord(frameSets) && Array.isArray(frameSets.sets) ? frameSets.sets.filter(isRecord).filter(row => row.animation === animation) : [];
+      const dir = sets.length === 1 ? sets[0].dir : undefined;
+      if (typeof dir !== 'string' || dir.length === 0 || isAbsolute(dir) || dir.split(/[\\/]/).includes('..')) throw new Error(`the existing render has no local set for ${JSON.stringify(animation)}`);
+      const source = join(rendered, dir), target = join(dest, dir);
+      const observation: unknown = JSON.parse(readFileSync(join(source, 'extremes.json'), 'utf8'));
+      if (!isRecord(observation) || observation.animation !== animation) throw new Error(`render --extremes-only has no set for ${JSON.stringify(animation)}`);
       mkdirSync(target, { recursive: true });
       copyFileSync(join(source, 'extremes.json'), join(target, 'extremes.json'));
       if (existsSync(join(source, 'extremes.png'))) copyFileSync(join(source, 'extremes.png'), join(target, 'extremes.png'));
@@ -6100,7 +6103,7 @@ export function runCheck(rigDir: string, outDir: string, rigc: RigcRunner, parts
             level = levelLine(feet, inp.rig, levelReadings, fps, stripped.physics.length, levelProblems);
           }
         }
-        if (!noExtremes && idle === null) extremesFrames = readJson(join(stripped === null ? foldDir : join(foldDir, 'on'), 'frames.json'), []);
+        if (!noExtremes) extremesFrames = readJson(join(stripped === null ? foldDir : join(foldDir, 'on'), 'frames.json'), []);
       } finally {
         rmSync(foldDir, { recursive: true, force: true });
       }
@@ -6666,7 +6669,7 @@ export function runCheck(rigDir: string, outDir: string, rigc: RigcRunner, parts
   const publishCheck = (): void => write('check.json', `${JSON.stringify(figures, null, 1)}\n`);
   if (motionSeam.worlds === undefined) publishCheck();
   else publishMotionSeamWorlds(out, seamMotionDir, motionSeam.worlds, publishCheck);
-  const extremes = noExtremes ? [] : renderExtremes(buildDir, out, animationNames, idle === null ? extremesFrames : readJson(join(idleDir, 'frames.json'), []), measured);
+  const extremes = noExtremes ? [] : renderExtremes(buildDir, out, animationNames, idle === null ? extremesFrames : readJson(join(idleDir, 'frames.json'), []), extremesFrames, measured);
   if (existsSync(join(out, 'extremes'))) written.push('extremes/');
   const bars: CheckReport['bars'] = { measured: ['gate'], skipped: [] };
   const tally = (bar: string, reason: string | null): void => {

package/src/config.ts

@@ -1,3 +1,4 @@
+import { paintingExtensionProblems, type PaintingExtension } from './paintingextension.ts';
 import { baseAnchorProblems, type BaseAnchor } from './baseanchor.ts';
 import type { DepthConfig } from './depthsheets.ts';
 /**
@@ -302,6 +303,8 @@ export interface Assemble {
   rig_scale: number;
   plan: PlanEntry[];
   extend_below_crop?: Extend[];
+  /** Bounded base-painting samples assigned to named final output parts (#848). */
+  extend_painting?: PaintingExtension[];
   patches?: Patch[];
   cuts?: Cut[];
   alternates?: AlternateSetConfig[];
@@ -1616,7 +1619,7 @@ export interface EarlyConfig {
   depth?: DepthConfig;
   key: string;
   seethrough: SeeThrough;
-  assemble: { rig_scale: number; head_face_underfill?: boolean; yield_refused?: boolean; keep_under_occluders?: string[] };
+  assemble: { rig_scale: number; head_face_underfill?: boolean; yield_refused?: boolean; keep_under_occluders?: string[]; extend_painting?: PaintingExtension[] };
 }
 
 /** What plain `assemble` reads: the early config plus the plan `--propose-plan` printed. */
@@ -1685,13 +1688,14 @@ function parseEarlyConfigFrom(raw: Json, door: EarlyDoor, base: string | null):
   if (door === 'layers') {
     if ('seethrough' in t) checkSeeThrough(c, t.seethrough);
     if ('assemble' in t) {
-      const a = c.object('config.assemble', t.assemble, sectionRequired(door, 'assemble'), ['plan', 'extend_below_crop', 'patches', 'cuts', 'alternates', 'head_face_underfill', 'yield_refused', 'keep_under_occluders']);
+      const a = c.object('config.assemble', t.assemble, sectionRequired(door, 'assemble'), ['plan', 'extend_below_crop', 'patches', 'cuts', 'alternates', 'head_face_underfill', 'yield_refused', 'keep_under_occluders', 'extend_painting']);
       if (a !== null) {
         if ('rig_scale' in a) c.number('config.assemble.rig_scale', a.rig_scale, 'positive');
         if ('head_face_underfill' in a && typeof a.head_face_underfill !== 'boolean') {
           c.fail('CONFIG_FIELD_TYPE', 'config.assemble.head_face_underfill', `is ${show(a.head_face_underfill)}; true or false is required`);
         }
         checkKeepUnderOccluders(c, a, null);
+        if ('extend_painting' in a) checkPaintingExtensions(c, a.extend_painting);
         if ('yield_refused' in a && typeof a.yield_refused !== 'boolean') {
           c.fail('CONFIG_FIELD_TYPE', 'config.assemble.yield_refused', `is ${show(a.yield_refused)}; true or false is required`);
         }
@@ -1718,6 +1722,7 @@ function parseEarlyConfigFrom(raw: Json, door: EarlyDoor, base: string | null):
       checkAlternates(c, t.assemble.alternates, made, limbs, names?.bones ?? null, names?.chains ?? null, t.regions, t.meshes);
     }
     const output = new Set([...made.parts.filter(n => !limbs?.consumed.has(n)), ...made.patches, ...made.cuts, ...(limbs?.parts.keys() ?? [])]);
+    if (isPlainObject(t.assemble) && 'extend_painting' in t.assemble) checkPaintingExtensions(c, t.assemble.extend_painting, new Set([...output].filter(n => !made.patches.includes(n) && !limbs?.consumed.has(n))));
     if ('motion_seams' in t) {
       c.problems.push(...motionSeamProblems(t.motion_seams, output, 'config.motion_seams', 'CONFIG_MOTION_SEAM'));
     }
@@ -1935,6 +1940,10 @@ function parseConfigFrom(raw: Json, base: string | null): { config: CharacterCon
   if (isPlainObject(t.assemble) && 'alternates' in t.assemble) {
     checkAlternates(c, t.assemble.alternates, { parts, patches, cuts }, limbs, names.bones, names.chains, t.regions, t.meshes);
   }
+  if (isPlainObject(t.assemble) && 'extend_painting' in t.assemble) {
+    const output = new Set([...parts.filter(n => !limbs?.consumed.has(n)), ...cuts.filter(n => !limbs?.consumed.has(n)), ...(limbs?.parts.keys() ?? [])]);
+    checkPaintingExtensions(c, t.assemble.extend_painting, output);
+  }
   if ('meshes' in t) checkMeshes(c, t.meshes, names.bones, names.chains, t.stops);
   if ('regions' in t) checkRegions(c, t.regions, names.bones);
   if ('meshes' in t && 'regions' in t && 'assemble' in t) checkCoverage(c, [...parts, ...cuts], patches, t.meshes, t.regions, limbs);
@@ -2400,6 +2409,17 @@ function checkRunTag(c: Check, path: string, run: Json, tag: Json): void {
  * writes one — the step a config without a plan has most likely skipped.
  */
 /** Validate at the early door too; resolve against the plan once that door reads it. */
+/** Spell the object schema at the config door, then share semantic checks with assemble. */
+function checkPaintingExtensions(c: Check, value: Json, names: ReadonlySet<string> | null = null): void {
+  const at = 'config.assemble.extend_painting';
+  if (c.array(at, value, false)) (value as Json[]).forEach((entry, i) => {
+    c.object(`${at}[${i}]`, entry, ['part', 'band', 'max_distance'], []);
+  });
+  for (const p of paintingExtensionProblems(value, names)) {
+    if (!c.problems.some(old => old.code === p.code && old.object === p.object)) c.problems.push(p);
+  }
+}
+
 function checkKeepUnderOccluders(c: Check, a: Record<string, Json>, plan: readonly string[] | null): void {
   if (!('keep_under_occluders' in a)) return;
   const at = 'config.assemble.keep_under_occluders';
@@ -2415,7 +2435,7 @@ function checkKeepUnderOccluders(c: Check, a: Record<string, Json>, plan: readon
 
 function checkAssemble(c: Check, v: Json, door: 'assemble' | 'full'): { parts: string[]; patches: string[]; cuts: string[] } {
   const required = sectionRequired(door, 'assemble');
-  const a = c.object('config.assemble', v, required.filter((k) => k !== 'plan'), ['plan', 'extend_below_crop', 'patches', 'cuts', 'alternates', 'head_face_underfill', 'yield_refused', 'keep_under_occluders']);
+  const a = c.object('config.assemble', v, required.filter((k) => k !== 'plan'), ['plan', 'extend_below_crop', 'patches', 'cuts', 'alternates', 'head_face_underfill', 'yield_refused', 'keep_under_occluders', 'extend_painting']);
   if (a === null) return { parts: [], patches: [], cuts: [] };
   if (required.includes('plan') && !('plan' in a)) {
     c.fail('CONFIG_FIELD_PRESENT', 'config.assemble.plan', 'is absent and required; `assemble --propose-plan` prints one from the two runs — paste its plan and extend_below_crop into config.assemble');
@@ -2450,6 +2470,7 @@ function checkAssemble(c: Check, v: Json, door: 'assemble' | 'full'): { parts: s
     });
   }
   checkKeepUnderOccluders(c, a, parts);
+  if ('extend_painting' in a) checkPaintingExtensions(c, a.extend_painting);
   if ('extend_below_crop' in a && c.array(`${p}.extend_below_crop`, a.extend_below_crop, false)) {
     (a.extend_below_crop as Json[]).forEach((entry, i) => {
       const at = `${p}.extend_below_crop[${i}]`;
@@ -4676,6 +4697,18 @@ function checkTurn(
   parents: ReadonlyMap<string, string> = new Map(),
 ): void {
   const at = 'config.turn';
+  // The auto motion gate swaps in the unreduced source but retains the motion.
+  // A depth surface's numeric deform belongs to the emitted topology and its
+  // influence order; it cannot also describe that reference attachment.
+  const checkSurfaceMeshMode = (part: string, roleAt: string): void => {
+    if (isPlainObject(rawMeshes) && isPlainObject(rawMeshes[part]) && 'auto' in rawMeshes[part]) {
+      c.fail(
+        'CONFIG_TURN_SURFACE_AUTO',
+        roleAt,
+        `declares "${part}" as "surface", but config.meshes.${part} uses auto; depth-turn deform keys target the emitted mesh, while auto's motion gate also builds its unreduced source with the same motion; use grid or contour for config.meshes.${part} to keep the depth turn`,
+      );
+    }
+  };
   const meshBoundBones = (part: string): string[] => {
     if (!isPlainObject(rawMeshes) || !isPlainObject(rawMeshes[part])) return [];
     const m = rawMeshes[part] as Record<string, Json>;
@@ -4832,6 +4865,7 @@ function checkTurn(
         } else {
           if (role === 'surface') {
             surfaceParts.push(part);
+            checkSurfaceMeshMode(part, `${at}.roles.${part}`);
           }
           if (role === 'unit') {
             if (part === 'ear_r' || part === 'ear_l') earParts.push(part);
@@ -4963,6 +4997,7 @@ function checkTurn(
             c.fail('CONFIG_TURN_ROLE_UNKNOWN', `${bAt}.roles.${part}`, `is ${show(role)}; expected one of ${TURN_ROLES.map((x) => `"${x}"`).join(', ')}`);
           } else if (role === 'surface') {
             bodySurfaceParts.push(part);
+            checkSurfaceMeshMode(part, `${bAt}.roles.${part}`);
           } else if (role === 'unit' && meshParts.has(part)) {
             bodyUnitMeshParts.push(part);
             if (bones.has(bodyRoot)) {

package/src/paintingextension.ts

@@ -0,0 +1,109 @@
+/** Explicit painting ownership, after assembly and before output cropping (#848). */
+import type { Problem } from './errors.ts';
+import { refuseIfAny } from './errors.ts';
+import { CORE_ALPHA, OPAQUE_ALPHA_ABOVE } from './layers.ts';
+import { newMask, type Mask, type Raster } from './raster/types.ts';
+
+export interface PaintingExtension {
+  part: string;
+  /** Half-open rectangle in rig pixels; no candidate or path leaves it. */
+  band: [number, number, number, number];
+  /** Maximum four-neighbour path length from the original target silhouette. */
+  max_distance: number;
+}
+
+/** Shared by every config door and the callable assemble API. */
+export function paintingExtensionProblems(value: unknown, names: ReadonlySet<string> | null = null): Problem[] {
+  const at = 'config.assemble.extend_painting', out: Problem[] = [];
+  const fail = (code: string, object: string, detail: string): void => { out.push({ code, object, detail }); };
+  if (!Array.isArray(value)) {
+    fail('CONFIG_FIELD_TYPE', at, 'requires an array of {part, band, max_distance}; omit it for no extension');
+    return out;
+  }
+  const seen = new Set<string>();
+  value.forEach((entry: unknown, i) => {
+    const path = `${at}[${i}]`;
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+      fail('CONFIG_FIELD_TYPE', path, 'requires {part, band, max_distance}'); return;
+    }
+    const e = entry as Record<string, unknown>;
+    for (const key of Object.keys(e)) if (!['part', 'band', 'max_distance'].includes(key)) fail('CONFIG_KEY_KNOWN', `${path}.${key}`, 'is unknown; only part, band and max_distance are read');
+    for (const key of ['part', 'band', 'max_distance']) if (!(key in e)) fail('CONFIG_FIELD_PRESENT', `${path}.${key}`, 'is absent and required; no bound or target is inferred');
+    if ('part' in e) {
+      if (typeof e.part !== 'string' || e.part === '') fail('CONFIG_FIELD_TYPE', `${path}.part`, `is ${JSON.stringify(e.part)}; a nonempty final layer-derived output part name is required`);
+      else {
+        if (seen.has(e.part)) fail('CONFIG_PART_UNIQUE', `${path}.part`, `names "${e.part}" again; declare each part once`);
+        seen.add(e.part);
+        if (names !== null && !names.has(e.part)) fail('CONFIG_NAME_RESOLVES', `${path}.part`, `names "${e.part}"; a final layer-derived output part is required, after cuts and limb splitting — known: ${[...names].join(', ')}`);
+      }
+    }
+    if ('band' in e && !(Array.isArray(e.band) && e.band.length === 4 && e.band.every(n => Number.isSafeInteger(n) && n >= 0) && e.band[0] < e.band[2] && e.band[1] < e.band[3])) {
+      fail('CONFIG_FIELD_TYPE', `${path}.band`, `is ${JSON.stringify(e.band)}; [x0,y0,x1,y1] as nonnegative safe integers with x0 < x1 and y0 < y1 is required, rig pixels, upper bounds exclusive`);
+    }
+    if ('max_distance' in e && !(Number.isSafeInteger(e.max_distance) && (e.max_distance as number) > 0)) {
+      fail('CONFIG_FIELD_TYPE', `${path}.max_distance`, `is ${JSON.stringify(e.max_distance)}; a positive safe integer of four-neighbour rig-pixel steps is required`);
+    }
+  });
+  return out;
+}
+
+/**
+ * Returns disjoint gain masks from one frozen final stack, without changing it.
+ * Alpha >0 on ANY assembled part blocks a candidate. Only original target
+ * alpha >8 seeds paths. A path stays in-band on unheld painting alpha >=250;
+ * its first pixel is distance 1. Conflicting claims refuse, never pick a part.
+ * RGB copying is the caller's job, from its existing RGB painting resample.
+ */
+export function paintingExtensionMasks(
+  declarations: readonly PaintingExtension[],
+  parts: readonly { name: string; image: Raster; x?: number; y?: number; canExtend?: boolean }[],
+  painting: Raster,
+): ReadonlyMap<string, Mask> {
+  refuseIfAny(paintingExtensionProblems(declarations, new Set(parts.filter(p => p.canExtend !== false).map(p => p.name))));
+  const { width: W, height: H } = painting;
+  const problems: Problem[] = [];
+  declarations.forEach((e, i) => {
+    if (e.band[2] > W || e.band[3] > H) problems.push({ code: 'ASSEMBLE_PAINTING_BAND_INSIDE', object: `config.assemble.extend_painting[${i}] (part "${e.part}")`, detail: `band is [${e.band.join(', ')}]; rig is ${W}x${H}, so x1 <= ${W} and y1 <= ${H} are required; no clipping is applied` });
+  });
+  refuseIfAny(problems);
+  const held = new Uint8Array(W * H), claimed = new Map<number, string>(), masks = new Map<string, Mask>();
+  for (const { name, image, x = 0, y = 0 } of parts) {
+    if (x < 0 || y < 0 || x + image.width > W || y + image.height > H) problems.push({ code: 'ASSEMBLE_PAINTING_CANVAS', object: `part "${name}"`, detail: `is ${image.width}x${image.height}; a final part inside the ${W}x${H} rig is required` });
+    else for (let j = 0; j < image.height; j++) for (let i = 0; i < image.width; i++) if (image.data[(j * image.width + i) * 4 + 3] > 0) held[(y + j) * W + x + i] = 1;
+  }
+  refuseIfAny(problems);
+  for (const e of declarations) {
+    const target = parts.find(p => p.name === e.part)!;
+    const [x0, y0, x1, y1] = e.band, bw = x1 - x0, bh = y1 - y0;
+    const distance = new Uint32Array(bw * bh), queue = new Int32Array(bw * bh), gain = newMask(W, H);
+    const eligible = (x: number, y: number): boolean => held[y * W + x] === 0 && painting.data[(y * W + x) * 4 + 3] >= CORE_ALPHA;
+    const seed = (x: number, y: number): boolean => {
+      const tx = x - (target.x ?? 0), ty = y - (target.y ?? 0);
+      return tx >= 0 && ty >= 0 && tx < target.image.width && ty < target.image.height && target.image.data[(ty * target.image.width + tx) * 4 + 3] > OPAQUE_ALPHA_ABOVE;
+    };
+    let end = 0;
+    for (let y = y0; y < y1; y++) for (let x = x0; x < x1; x++) {
+      if (!eligible(x, y) || !(seed(x - 1, y) || seed(x + 1, y) || seed(x, y - 1) || seed(x, y + 1))) continue;
+      const q = (y - y0) * bw + x - x0;
+      distance[q] = 1; queue[end++] = q;
+    }
+    for (let at = 0; at < end; at++) {
+      const q = queue[at], x = x0 + q % bw, y = y0 + Math.floor(q / bw), p = y * W + x;
+      gain.data[p] = 1;
+      const previous = claimed.get(p);
+      if (previous !== undefined) {
+        refuseIfAny([{ code: 'ASSEMBLE_PAINTING_EXTENSION_CONFLICT', object: `parts "${previous}" and "${e.part}"`, detail: `both claim rig pixel (${x},${y}); disjoint reachable bands are required, no order-based ownership is guessed` }]);
+      }
+      claimed.set(p, e.part);
+      if (distance[q] >= e.max_distance) continue;
+      for (const [nx, ny] of [[x - 1, y], [x + 1, y], [x, y - 1], [x, y + 1]]) {
+        if (nx < x0 || ny < y0 || nx >= x1 || ny >= y1) continue;
+        const n = (ny - y0) * bw + nx - x0;
+        if (distance[n] !== 0 || !eligible(nx, ny)) continue;
+        distance[n] = distance[q] + 1; queue[end++] = n;
+      }
+    }
+    masks.set(e.part, gain);
+  }
+  return masks;
+}

package/src/parts.ts

@@ -99,6 +99,8 @@ import { recordedFocusProblems } from './setfocus.ts';
 export interface PartRecord {
   /** Report-only final last-writer census (#817); absent on older records. */
   provenance?: PixelProvenance;
+  /** Painting ownership gained by #848, independent of final raw-value equality. */
+  painting_extension_px?: number;
   /** Optional #773 input reference; production geometry does not consume it yet. */
   depth?: PartDepthReference;
   name: string;
@@ -430,6 +432,7 @@ export const PART_KEYS = [
   'h',
   'opaque_px',
   'provenance',
+  'painting_extension_px',
   'visible_px',
   'occluded_px',
   'projected_core_px',
@@ -451,7 +454,7 @@ const LIMB_KEY = 'limb';
 const COUNT_KEYS = PART_KEYS.slice(2).filter((k) => k !== FRINGE_KEY && k !== CUT_FROM_KEY && k !== LIMB_KEY && k !== 'depth' && k !== 'provenance') as ReadonlyArray<(typeof PART_KEYS)[number]>;
 /** The port's own counts: all three or none (none = a record the reference wrote). */
 export const VISIBILITY_KEYS = ['visible_px', 'occluded_px', 'visible_not_projected_px'] as const;
-const REQUIRED_KEYS = PART_KEYS.filter((k) => !(VISIBILITY_KEYS as readonly string[]).includes(k) && k !== FRINGE_KEY && k !== CUT_FROM_KEY && k !== LIMB_KEY && k !== 'depth' && k !== 'provenance');
+const REQUIRED_KEYS = PART_KEYS.filter((k) => k !== 'painting_extension_px' && !(VISIBILITY_KEYS as readonly string[]).includes(k) && k !== FRINGE_KEY && k !== CUT_FROM_KEY && k !== LIMB_KEY && k !== 'depth' && k !== 'provenance');
 
 /** Where a part came from: a See-through run and a v3 tag or an author-made layer's `author:<label>` (issue #256), or the painting itself for a patch. */
 export type From = { run: 'full' | 'head'; tag: string } | { run: 'painting'; patch: string };
@@ -571,6 +574,14 @@ export function readParts(path: string): PartsFile {
   return checkParts(raw, path);
 }
 
+/** Additive ownership census; not another term in the value partition. */
+function checkPaintingExtensionCount(r: Record<string, unknown>, label: string, fail: (code: string, object: string, detail: string) => void): void {
+  if (!('painting_extension_px' in r)) return;
+  const n = r.painting_extension_px;
+  if (!Number.isSafeInteger(n) || (n as number) < 0) fail('PARTS_FIELD_TYPE', label + ' painting_extension_px', `is ${show(n)}; a nonnegative safe integer is required`);
+  else if (!Number.isSafeInteger(r.opaque_px) || (n as number) > (r.opaque_px as number)) fail('PARTS_COUNTS_ADD_UP', label + ' painting_extension_px', `is ${show(n)}; at most opaque_px ${show(r.opaque_px)} is required`);
+}
+
 function show(v: unknown): string {
   return v === undefined ? 'absent' : JSON.stringify(v);
 }
@@ -660,6 +671,7 @@ function checkParts(raw: unknown, path: string): PartsFile {
       }
       const count = (k: string): number | null => (Number.isInteger(r[k]) && (r[k] as number) >= 0 ? (r[k] as number) : null);
       if ('provenance' in r) checkProvenance(r.provenance, r.opaque_px, label + ' provenance', fail);
+      checkPaintingExtensionCount(r, label, fail);
       const [op, vis, occ, vnp] = ['opaque_px', 'visible_px', 'occluded_px', 'visible_not_projected_px'].map(count);
       if (held.length === VISIBILITY_KEYS.length && op !== null && vis !== null && occ !== null && vnp !== null) {
         if (vis + occ !== op) fail('PARTS_COUNTS_ADD_UP', `${label}`, `visible_px ${vis} + occluded_px ${occ} = ${vis + occ}; opaque_px ${op} is required`);
@@ -812,6 +824,7 @@ function checkParts(raw: unknown, path: string): PartsFile {
         const r = p as Record<string, unknown>;
         const part817 = typeof r.name === 'string' ? `part "${r.name}"` : `records[${j}]`;
         if ('provenance' in r) checkProvenance(r.provenance, r.opaque_px, `${at} ${part817} provenance`, fail);
+        checkPaintingExtensionCount(r, `${at} ${part817}`, fail);
         const l = r[LIMB_KEY];
         if (typeof l !== 'object' || l === null || Array.isArray(l) || !('cap' in l)) return;
         const part = typeof r.name === 'string' ? `part "${r.name}"` : `records[${j}]`;

package/src/provenance.ts

@@ -7,7 +7,7 @@ import { crop, type Raster } from './raster/index.ts';
 export const AUTOMATIC_WRITERS = {
   sourceProjection: -1, extend: -2, growRim: -3, limbSplit: -4,
   limbCap: -5, limbHybrid: -6, limbFeather: -7, fringeRestore: -8,
-  seamOverride: -9, armSplit: -10, headFaceUnderfill: -11, ghostCleanup: -12, unattributed: -13,
+  seamOverride: -9, armSplit: -10, headFaceUnderfill: -11, ghostCleanup: -12, unattributed: -13, paintingExtension: -14,
 } as const;
 export type AutomaticWriter = keyof typeof AUTOMATIC_WRITERS;
 export interface PixelProvenance {
@@ -77,6 +77,7 @@ export function provenanceLines(parts: readonly PartRecord[]): string[] {
   const edits = new Map<string, number>(), stages = new Map<string, number>();
   const detail = (e: ReadonlyMap<string, number>): string => [...e].map(([name, px]) => `${name} ${px}`).join(', ') || 'none';
   for (const p of parts) {
+    if (p.painting_extension_px !== undefined) lines.push(`  painting extension: part "${p.name}" gained ${p.painting_extension_px} opaque painting samples; source RGB copied exactly in rig space; ownership count independent of final raw-value equality`);
     const v = p.provenance;
     if (v === undefined) continue;
     opaque += p.opaque_px; unchanged += v.unchanged_layer_px; automatic += v.automatic_px; hand += v.hand_px;