rig-parts 1.80.0 → 1.82.0

package/docs/AUTHORING.md

@@ -127,7 +127,7 @@ read by no CPU stage).
 | `assemble.rig_scale` | assemble — the rig is `trunc(w × rig_scale)` x `trunc(h × rig_scale)`, and every rig-px value after it (`bones`, `meshes`, `motion`, `patches`, `cuts`) is in that rig's pixels; `check --source` (`CHECK_SOURCE_SIZE`) and `compose` (`SCENE_RIG_SCALE_AGREES`) read it back off `parts.json` | authored; rig pixels per source pixel. 0.5 in both examples (a 1664x2432 painting makes an 832x1216 rig). **Keep the figure about 1,100 to 1,200 rig px tall** — the `H` of `propose`'s `mesh spacing:` note, the height of the parts' boxes together — so for another painting, about 1,150 over the figure's height in painting px: that is the size the proposer's spacing divisor was calibrated at (H 1106–1185, the `mesh spacing` note says so) and the size of the two examples `check`'s bars are derived from, and the proposer and `check` also hold fixed rig-px values that do not scale with it (the fringe's 10 px step, the trunk segments' 18, 20, 30 and 100 px, the 15 px wrist tolerance, the 10-row pendant floor, the seam bar's 50 rig px over 40). What else it trades, measured on `demo` with the README loop from a fresh config at 0.25, 0.5 and 1 (issue #345, rig-c 2.47.1): the same plan and the same ten chains; every bar but the one the uncorrected `demo` always fails (`bottomwear` `TIP_OVER_ROOT`, the README loop's `RL01`) passing at all three; the atlas page 418x606, 832x1205 and 1825x2047; the figure's mesh spacing 16, 32 and 64, so 830, 868 and 932 triangles; the breath 2.5 % of a torso that scales with it; and the proposed bones, scaled to 0.5, off the 0.5 proposal's by up to 38 px at 0.25 and 22.5 px at 1 (the hairpin's origin; the skirt roots 20 and 10.5) — the fixed-px values above. `propose` records it on the proposal as `proposed_rig_scale` (issue #354), and changing `assemble.rig_scale` after the rig sections are written is refused (`CONFIG_PROPOSED_RIG_SCALE`): without that refusal `demo`'s tracked config built at 0.25 gated green and `check` failed only `TIP_OVER_ROOT` on both sleeves (`propose --from-config` named 54 `LINT` lines, links off the art) — re-run `assemble` and `propose` at the new scale. Absent: `CONFIG_FIELD_PRESENT`; 0, negative or not a number: `CONFIG_FIELD_TYPE`; a rig under 1x1: `ASSEMBLE_RIG_SIZE` |
 | `assemble.plan` | assemble; also the list every `meshes`/`regions` key must come from | **proposed** by `assemble --propose-plan`. `[part name, "full" \| "head", See-through tag]`, in draw order back to front. Names are free; roles come from the tag. A layer the author made and added to a run takes `author:<label>` in the tag's place, and has no role (§5, *A layer the author made*). When `generation.control.skeleton` is present and a full-run `handwear-r` or `handwear-l` layer merges sleeve, bare hand and overgarment drape into one layer — a skin-coloured hand cluster (`>= 40` run px, `GHOST_MIN_AREA`, measured `516..4,787` run px across the 9-standee corpus) lies within `0.35` forearm lengths of `<s>_wrist` and non-skin pixels reach more than `1.0x` the forearm length (`<s>_elbow -> <s>_wrist`) below `<s>_wrist` (issue #490; measured `-0.15x..0.45x` on the 6 clean standees vs `1.25x..2.02x` on the 3 merged standees, placing `1.0x` inside the `0.45x..1.25x` gap) — the layer is split into `drape-<s>`, `handwear-<s>` and `hand-<s>` (back to front) when the Euclidean RGB distance between the sleeve median colour above `<s>_wrist` and the drape median colour below `<s>_wrist` is at least `80` (`ARM_DRAPE_COLOR_DISTANCE`, measured `103.6..236.0` on the two distinct-colour merged standees vs `20.8..28.2` on the same-colour merged standee, placing `80` between `28.2` and `103.6`), or refused with `SEETHROUGH_ARM_RUN_MERGED` when the distance is under `80` |
 | `assemble.extend_below_crop` | assemble | **proposed** with the plan: `{part, run, tag}` — a head-run part that reaches the bottom of the head crop is continued from a full-run layer, whole connected components |
-| `assemble.extend_painting` | assemble, base painting only — assigns unheld opaque painting samples to declared final layer-derived parts | **authored**, optional array of `{part, band: [x0,y0,x1,y1], max_distance}`; all fields required, integer rig pixels, half-open band and positive maximum four-neighbour path length. Off when absent or empty. See [Bounded painting extension](#bounded-painting-extension-issue-848) |
+| `assemble.extend_painting` | assemble, base painting only — assigns unheld opaque painting samples to declared final layer-derived parts | **authored**, optional array of `{part, band: [x0,y0,x1,y1], max_distance, min_held_alpha?, order?}`; part, band and max_distance required, integer rig pixels, half-open band and positive maximum four-neighbour path length. Off when absent or empty. See [Bounded painting extension](#bounded-painting-extension-issue-848) |
 | `assemble.patches` | assemble; `meshes`/`regions` keys may name them too | **authored**, optional: `[{name, box, alpha, draw}]` — an extra part cut from the **painting** itself, for figure no See-through layer holds (a hem both runs dropped). `box` is `[x0, y0, x1, y1]` in **rig** pixels, `x1`/`y1` exclusive — the space of `parts.json` and `recomposite_rig.png`, where the hole is found; `alpha` is `"silhouette"` (the painting's figure silhouette inside the box, the one `--seam silhouette` uses) or `"box"` (the whole box); `draw` is `"back"`, `"front"` or `{"before": "<plan part>"}`. A patch is always a region: its bone is `regions.<name>`, in the one place every region's bone lives, and a `meshes` entry for it is refused. `draw` sets assembled part order; an exclusively bound limb rider's final rig slot joins that limb's block (see the limbs subsection). Use [Source before scissors](#source-before-scissors) before a patch; §5 describes structural placement |
 | `assemble.cuts` | assemble; `meshes`/`regions` keys may name the new parts too, and must (each is a part like any other) | **authored**, optional (issue #170): `[{from, into, polygon, draw, overlap, under, under_fill}]`, `under` and `under_fill` optional — a structural separation under [Source before scissors](#source-before-scissors), cut from a plan part's layer by the author's polygon: the pixels of plan part `from` whose **centre** lies inside `polygon` (even-odd; a centre exactly on an edge is outside) leave `from` and make the new part `into`, colour and alpha, so every pixel of the layer ends in exactly one of the two. `polygon` is `[[x, y], …]`, at least three points, non-negative integer **rig** pixels — the space of `parts.json` and of the patches' boxes. The file that shows the layer in those coordinates is `assemble`'s own `rig/parts/<from>.png`, placed at its `parts.json` `x`, `y` (the PNG's pixel `(i, j)` is rig pixel `(x + i, y + j)`), or `render/recomposite_rig.png`, the whole rig 1:1; the contact sheets (`sheet`) are scaled and carry no coordinates. `draw` is `"back"`, `"front"` or `{"before": "<plan part>"}`, as for a patch (to keep the setup pose, draw the piece immediately in front of `from` — `{"before": "<the plan part after from>"}`, or `"front"` when `from` is the last plan part; `{"before": "<from>"}` draws it behind `from`, which `under` refuses as `ASSEMBLE_UNDER_DRAW` because the fill would hide it). `from` must be a plan part (`CONFIG_NAME_RESOLVES`; a patch or another cut's piece is refused; a part a limb takes may be cut where no segment of the limb holds it, issue #564, §5 *Limbs*), `into` a new name (`CONFIG_PART_UNIQUE`), the polygon three or more integer points (`CONFIG_FIELD_TYPE`). The piece's `parts.json` record carries `from`'s `<run>:<tag>` and its own counts, each split from the layer's by where the pixel lies; it is a mesh or a region under its own name, and the coverage rule holds it like a plan part. What the config cannot know the stage refuses: a polygon point past the rig (`ASSEMBLE_CUT_INSIDE`), two cuts of one part sharing a pixel (`ASSEMBLE_CUT_OVERLAP`), a cut that takes none of the layer's opaque pixels or leaves `from` none (`ASSEMBLE_CUT_PIXELS`), a cut of a part a limb takes that takes a pixel a segment of the limb holds (`ASSEMBLE_CUT_CROSSES_LIMB`). `overlap` is required, a non-negative integer of rig pixels with no default (`CONFIG_FIELD_TYPE`): the **band** — the polygon's pixels within `overlap` px of its edge by Chebyshev distance (the polygon's mask less its erosion by a `2 * overlap + 1` square) — stays in `from` as well as going to the piece, so the piece's resampled edge has art under it; the counts stay a strict partition and the band is the base's extra copy, printed on the `cut:` line. At `0` the two abut and `check`'s seam bar judges the edge between them (`CHECK_SEAM_WITHIN_BAR`, §5). A band only covers the edge at rest: a piece that swings well clear of where it was painted shows the hole it leaves, and a thin piece's band shows a ghost of the piece. `under` (issue #193), optional, is the author's image of what lies under the piece: a PNG path relative to the config's directory (`CONFIG_FIELD_TYPE` unless a non-empty string), in rig pixels over the polygon's **bounding box** — the least and greatest polygon x and y, so the image is `max x − min x` by `max y − min y` and its pixel `(i, j)` is rig pixel `(min x + i, min y + j)`. Where the cut removed pixels from `from` — the piece's pixels (alpha above 0) less the band — `from` takes the image's pixel, colour and alpha wherever the image's alpha is at least the alpha the cut removed there (**filled**); elsewhere `from` stays empty there (**left empty**): a transparent pixel is the author's statement that nothing lies under it (the background, or a part drawn behind), and a less opaque one is not half-filled. The image is read nowhere else, so its pixels over the band, over the box outside the polygon or where the layer had no art never change `from`. The `cut:` line then ends `; under <n> px filled, <m> px left empty` (`n + m` is every removed pixel), so an unintended hole is a number in the log, not a guess; the filled pixels count in `from`'s `opaque_px` and `occluded_px` (the piece is drawn over them), never as visible or projected. The stage refuses: a file that is not there (`ASSEMBLE_UNDER_PRESENT`) or not a PNG (`ASSEMBLE_UNDER_DECODES`), an image not exactly the box's size (`ASSEMBLE_UNDER_SIZE`, both sizes given), an image that fills none of the removed pixels — all transparent there, or another file (`ASSEMBLE_UNDER_EMPTY`; to leave the whole hole, drop `under`), and a piece drawn behind `from` (`ASSEMBLE_UNDER_DRAW`: the fill would hide it; draw it `"front"` or `{"before": "<the plan part after from>"}`). Producing the image is the author's, by whatever means; absent, `from` keeps only its band. `under_fill` (issue #360), optional, is the one value `"colour"` (`CONFIG_FIELD_TYPE` on any other): the same pixels are filled and left empty, and a filled pixel takes the image's **colour** at the alpha the cut removed there instead of the image's alpha, so `from`'s alpha is the uncut layer's wherever the image fills and its silhouette does not grow — an opaque image over a soft edge leaves the edge soft. It applies to the part's hidden-art layer as well as to a file; a cut with neither is refused (`ASSEMBLE_UNDER_FILL_SOURCE`). The `cut:` line's filled count then says how many took the colour only: `; under 190 px filled (190 colour only, at the alpha the cut removed), 0 px left empty`. Absent, a filled pixel takes the image's colour and alpha, as above |
 | `assemble.alternates` | assemble, rig, check (`--set`, `--all-sets`) | **authored**, optional (issues #454, #465, #472, #473, #476): `[{name, source?, full?, head?, head_box?, parts?, hides?, cuts?, skeleton?, anchor?, base_anchor?, drawn?, tips?, front?}]` — alternate painting sets assembled into `<out>/rig/parts/<set>_<part>.png` (`parts.json` `alternates`), attached on each covered slot in `rig.json` as `<set>_<part>` beside the base attachment, and indexed in `<out>/rig/sets.json` (`rig-parts-sets/1`: `sets.<set>.slots`, `.hides`, `.drawn` when present, and `.threshold: {yaw: 15, pitch: 12}` when the set replaces `face` on a rig with `turn` or `turn`/`tilt` slider animations). `source`, `full` and `head` may instead be given on the CLI with `--alt <name>=<source>:<full>[:<head>]`. Windows absolute drive paths such as `C:\paint\painting.png` are accepted as written; each segment's leading drive colon belongs to that path, while other colons still separate `source`, `full` and `head`. `parts` lists the subset of parts the set replaces (default: every part not in `hides`); a **subset set** (issue #473, e.g. mouth visemes `a`, `i`, `u` with `"parts": ["mouth"]`) cuts only its covered parts from the alternate runs (refusing with `ASSEMBLE_ALT_INPUT_PRESENT` if a covered part's layer is missing or empty), writes only `{slot: "<set>_<slot>"}` in `sets.json` so `@rig-c/play`'s `setSet(name)` switches those slots while leaving every other slot on its base attachment (and `setSet(null)` restores the base pose), may be keyed on a slot attachment track in `motion.animations_from` as `{"t": …, "set": "<name>" \| null}` (`CONFIG_SET_COVERS_SLOT` if `"set"` is undeclared or does not cover the track's slot), and under `check --set <name>` counts `ANIMATIONS_DO_NOT_FOLD` only on its own covered slots; `hides` lists slots the set hides (`null` in `sets.json`). A **gesture subset set** (issue #476) covers a limb chain declared in `config.limbs.<limb>` (all of its segment `part`s; with `drawn` alone, cut at the base's joints posed to the set's own `drawn` angles by `poseBoneEntriesForDrawn`, each segment keeping the base's length; with `skeleton` (issue #539), cut at the skeleton's own joint positions by `placeBoneEntriesForSkeleton` — each covered bone the body-18 table names (`sleeve_*`, `arm_*0`/`arm_*1`, `leg_*0`/`leg_*1`) at its skeleton origin with the skeleton segment's own length and direction (`drawn` overriding the direction of a bone it names), and a covered bone the table does not name (a hand link `arm_r2`, a single `foot_r`) placed from its parent's new place — its base offset from the parent, stretched along the parent by the parent's length change and turned by its turn, so a link or a foot at the parent's end lands on the skeleton's end — with its base length and the drawn or base direction, so a foreshortened shin or forearm is cut where it is painted; naming the unsplit `from` layer, covering only some segments of the limb, or declaring polygon `cuts` on a limb set is refused with `CONFIG_LIMB_SET_JOINTS`) and carries `drawn` (or `skeleton`) for the covered bones only (giving `drawn` for an uncovered bone is refused with `CONFIG_SET_COVERS_BONE` / `RIG_SET_COVERS_BONE`; uncovered bones keep the base's `drawn`). A subset set's limb part takes no pixel that a base part drawn after it, which the set neither covers nor hides, covers at setup (issue #587): the set's attachment is drawn in the base slot's place, so that base part is drawn over it and what the set's painting shows there is that base part (shorts over a leg set's thigh top, which See-through synthesised in the set's leg layer); `assemble` clears those pixels — the base part's PNG at alpha above 8, at its `parts.json` x, y, on the shared canvas — from the set's part once its limbs are cut, before any count — its `merged_px` and its cap's record too (issue #603): a cap pixel it clears leaves the count it was in (`layer_px`, `image_px`, `upper_px`, `lower_px`, `lower_kept_px`) for the cap's `excluded_px`, written only when above 0, so every count is the written PNG's — and prints `LINT set "<set>" <part>: <n> px under <base part> excluded` per part and base part that took a pixel (n counts alpha above 8); a set that carries that base part itself (`"parts": ["thigh_l", "shin_l", "bottomwear"]`) excludes nothing and writes what it wrote before. A subset set that names one limb side of a layer more limbs take (issue #588: `"parts": ["thigh_r", "shin_r"]` where `leg_r` and `leg_l` both take the one `legs` layer) would put every pixel of that layer on its one limb, so each of its parts would hold a piece of both legs; when the set's layer holds more than one island (8-connected pixels with alpha above 8) of at least 1 % of its largest (issue #608: the ghost clean-up's own share; a smaller island is a speck, which goes with the island nearest it — the one holding the pixel centre nearest one of the speck's, none when two are equally near — and is never an island of its own), each segment part keeps the island its joints fall on — its bone's origin and the next segment's bone's origin, at the set's own bones, a joint on the island of a pixel whose square holds the point, and a joint on no island on the one island whose nearest pixel centre lies within the radius of the cap cut at that joint (`cap.radius`: an ankle just past the legwear's edge, on the shoe) — and drops the rest, once its limbs are cut and before the exclusion above, and `assemble` prints `LINT set "<set>" <part>: <layer part> holds <n> islands (8-connected, alpha above 8)[, and <s> speck(s) under 1 % of the largest (<f> px), each with the island nearest it], kept the one under <bone> [x, y] and <bone> [x, y][ (<e> px off it, within its cap's radius <r>)] (<k> px), dropped <m> (<d> px)` per part (k and d count the part's pixels above alpha 8, m the islands it lost one from, and `dropped none` when it lost none); a joint on no island with none or two within that radius, or with no cap cut at it (a limb's first joint), and a segment whose joints fall on two, are refused with `ASSEMBLE_ALT_LIMB_ISLAND` rather than guessed. A layer of one island — specks aside — may hold both legs over each other (a folded shin across the standing leg; issue #609): each of the set's segment parts then keeps the pixels nearer its own limb's segment line — the polyline of only its segments taking that source, their bone origins and the last segment's supplied tip or following segment's joint (issue #638) — than the other limb's, both in the set's pose, and gives the rest away, once its limbs are cut and before the exclusion above; a pixel whose two distances differ by 0.5 px or less (the overlap band: half a pixel, the reach by which a pixel centre is read as on a line) goes to the limb whose part there is drawn later in the base's draw order, and the `LINT set` line above counts what each part kept, gave and held in the band. The other limb stands where the set's `skeleton` places it — its keypoints place every limb bone of the body-18 table, the other leg's as well as the set's own (its `drawn` and `drawnLength` stay the covered bones') — and never at the base's place: a set that does not place it (a `drawn` set, which may not name a bone it does not cover, or a set with neither) is refused with `ASSEMBLE_ALT_LIMB_POSE` when its layer has art where the base draws that limb, and when it has none nothing says the layer holds it and the layer is cut as before; two limbs whose segment lines run closer than the limb's half-width over most of where their art can meet are refused with `ASSEMBLE_ALT_LIMB_OVERLAP`. A set that carries every limb of the layer is cut as before. For a subset set, where a limb's own source layer holds art (`alpha > 8`) under another layer of that run drawn in front (`alpha > 8`, by the projection's plan/depth order), the limb keeps its own layer pixels through projection, limb cutting, island/nearest-line assignment, base-footprint exclusion, fringe clearing and seam correction (issue #637). Those pixels are occluded, never counted as painting projection; no base footprint or painting colour replaces them. After source-art island/nearest-line assignment, a source-transparent cap pixel is assigned before protection, in both doors: its centre is compared against only the segments taking the recipient's source, at the set's supplied bones (ankle-to-toe for a separate foot source), with the existing 0.5 px overlap band and base draw order. A missing last endpoint is refused with `ASSEMBLE_ALT_LIMB_POSE`; an actual following joint may supply that endpoint, never a guessed point. An unposed other limb with base art beneath these cap pixels is likewise refused; without such overlap the existing compatible path retains the cap without inventing the other limb's pose. A pixel cleared by this assignment is never restored. `CAP_FROM_UPPER` records a copy made before assignment and alone proves no ownership: only a retained copy is protected beneath the upper segment, which is drawn over it. The source-art island selection itself is unchanged. Other retained cap pixels (from the layer or a supplied cap image) are protected under an actual front layer even where the lower source is transparent. Protection follows each assigned piece through exclusion, fringe clearing and seam correction; it never restores a pixel ownership removed. Cap pixels removed during ownership leave their original counts for `excluded_px`, just as excluded pixels do, so the cap ledger describes the written PNG. Target assignment reconciles this ledger even when there are no source-transparent cap candidates and when a direct caller does not request cover protection. Unprotected source pixels still obey the base-footprint exclusion. Missing limb/cap art is never extended or guessed. Base builds and uncovered, unexcluded sets keep their existing bytes. `skeleton` (a pose file path relative to the config's directory, `{"width": W, "height": H, "points": {…}}` with all 18 body-18 keypoints on the canvas, validated by the same rules as `generation.control.skeleton`: `CONFIG_FILE_PRESENT`, `CONFIG_IS_JSON`, `CONFIG_FIELD_TYPE`, `CONFIG_KEY_KNOWN`, `CONFIG_KEY_UNIQUE`, `CONFIG_POSE_CANVAS`, `CONFIG_POSE_KEYPOINTS`, `CONFIG_POSE_IN_CANVAS`) or `drawn` (`{<bone>: <worldDegrees>}`, each bone resolved against `bones`, `CONFIG_NAME_RESOLVES`) declares the posed angles the alternate was painted at (issue #465); when `skeleton` is given, `assemble` derives `drawn` from its 18 keypoints (filtered to covered bones on a subset set, with `drawn` overriding any bone named in both), records both `skeleton` (scaled by `assemble.rig_scale` to rig px) and `drawn` in `parts.json` `alternates` — and, when the skeleton placed the set's limb bones (issue #539), `drawnLength` (`{<bone>: <ratio>}`, each covered table bone's skeleton segment length over its base length, 6 places) and `registration` (`{offset: [dx, dy], scale}`: the similarity without rotation, about the canvas origin, that maps the skeleton's torso — the mean of its shoulders `r_shoulder`/`l_shoulder` to the mean of its hips `r_hip`/`l_hip`, read where the base declares the bone rooted there, `sleeve_*0`/`arm_*0` and `leg_*0` — onto those base bones' origins, 6 places), both also written to `sets.json`; the set's painting must be registered, its torso within 1 rig px and 1 % in scale of the base's, or the set is refused by name before any joint is cut (`ASSEMBLE_ALT_SKELETON_REGISTERED`, with the offset and scale the painting would need) — and the `rig` stage writes `<set>_*` region and mesh attachments in the bone-local frame of `poseRigBonesForDrawn(bones, drawn)` (weighting limb segments directly from `skeleton`'s joint endpoints when `skeleton` is present) and emits `drawn` in `sets.json` so `rig-pose` and `check --set <name>` / `--all-sets` pose the bones at `drawn` without rotating the already-posed art a second time. `front` (issue #664) lists covered limb segment parts the set draws on their **front slot** instead of the base slot: each must be in the set's `parts` and not its `hides`, and listed in some `config.limbs.<limb>.front.parts` (`CONFIG_SET_FRONT`); the set then maps `<part>_front` (never `<part>`) to `<set>_<part>` in `parts.json` and `sets.json` and hides `<part>` (and `<part>_still`), its #587 exclusion counts only base parts drawn after the front slot's target, and keying that part's set on a slot track is refused (`CONFIG_SET_FRONT_KEYED`) — *Front slots (issue #664)* below `layers` optionally maps covered, nonhidden output part names to layer names in their existing source run (issue #666); for example `"layers": {"upperarm_r": "author:raised", "forearm_r": "author:raised"}`. Limb cuts, caps, islands and base exclusions read the selected layer; the base plan stays unchanged. |
@@ -3762,7 +3762,19 @@ schema; they are not proposed coordinates for a particular painting.
 The stage reads the final assembled stack after cuts, limb splits, exclusions,
 fringe push-back and yield. A candidate is unheld only if **every assembled
 part has alpha exactly zero** there; even alpha 1 on another part blocks it.
-Its painting alpha, Lanczos-resampled to rig size, must be at least 250.
+Per declaration, optional `min_held_alpha` (issue #854) is an integer from 1
+through 255. It instead treats a pixel as unheld when the **combined alpha-over
+coverage** of the original stack is strictly below that floor:
+`255 * (1 - product(1 - alpha / 255))`. This is neither the maximum nor the sum
+of the holders' alphas. It is compared exactly, without intermediate byte
+rounding: coverage equal to the floor blocks. Absent, or explicitly 1, retains
+the nonzero-holder blocker. Every declaration reads the same frozen stack;
+without precedence, a declaration's gains never change another declaration's
+eligibility or seeds. Overlapping reachable claims refuse by default.
+
+Its painting alpha, Lanczos-resampled to rig size, must be at least 250 and
+strictly greater than the target's own alpha there, so assigning a sample
+always increases coverage and never weakens a more opaque target.
 The original target silhouette (alpha above 8) seeds candidate pixels one
 horizontal or vertical step away, including from just outside the band. Paths
 then traverse only eligible pixels inside the band, up to `max_distance` steps
@@ -3770,15 +3782,52 @@ from the original silhouette. Diagonal contact alone does not connect a pixel.
 Growing a candidate never resets the distance or fills a whole component.
 A disconnected painted island, a pixel outside the band and a connected pixel
 past the distance bound stay unheld. Two declared parts reaching the same
-pixel are refused as `ASSEMBLE_PAINTING_EXTENSION_CONFLICT`; declaration order
-does not choose the owner.
+pixel are refused as `ASSEMBLE_PAINTING_EXTENSION_CONFLICT` unless explicit
+precedence is declared; array order never chooses the owner.
+
+To share a band, add `order` (issue #855) to **every** entry. Each value must
+be a unique nonnegative safe integer. Lower values claim first; their gained
+pixels block later entries' candidates and paths. Original holder coverage,
+target silhouette seeds, painting alpha, band and distance checks still apply.
+Gains never become new seeds. Reordering the array preserves claims by name.
+A missing order among ordered entries, duplicate order, or malformed order is
+a named refusal; no implicit priority or tie break is supplied. Omitting order
+from every entry retains the disjoint-claim refusal. For example:
+
+```json
+"extend_painting": [
+  {"part": "shin_l", "band": [40, 80, 56, 88], "max_distance": 3, "min_held_alpha": 250, "order": 0},
+  {"part": "foot_l", "band": [48, 84, 56, 88], "max_distance": 2, "min_held_alpha": 250, "order": 1}
+]
+```
+
+Precedence assigns overlapping reachable samples to the earlier target; it
+does not infer which target should move them. A restriction to a target's own
+faint alpha alone was rejected: a general entry can already reach those
+samples when combined original coverage is below its floor, including alpha
+1 through 8. Two targets may also hold faint alpha at the same coordinate.
+The public interleaving controls exercise these ambiguities, default refusal
+and the explicitly ordered, array-invariant assignment. The declarations
+authorize only their targets; every non-target holder stays byte-exact.
 
 Each gained sample takes the **exact RGB of the existing rig-space painting
 resample** (`sourceInRig`, the legacy RGB-only Lanczos resample), and alpha from
 the separately resampled painting alpha. At `rig_scale: 1` this copies the
 painting's RGB bytes directly; at other scales it copies that resample's RGB
-bytes, not a nearest source texel. It never feathers, repaints, invents hidden
-art, changes an already held sample or infers which opaque colour is figure.
+bytes, not a nearest source texel. It never feathers, invents hidden art or
+infers which opaque colour is figure. Without a floor, already held
+samples are unchanged. With a floor, **only the declared target's gained
+samples below the floor** may change, including its own faint RGBA. Every
+**target sample at or above the floor** keeps its exact RGBA, as do the target's
+other nonselected samples. **Every holder not declared as a target** keeps its exact RGBA and PNG
+bytes, at every alpha and draw order. These are preservation gates, not counts.
+Keeping the target's own faint
+sample byte-identical while increasing its alpha in the same attachment is
+impossible; the explicit declaration authorizes that replacement. The gained
+target RGB is exactly the painting, but the final composite can differ when
+an unchanged holder with a different RGB draws above it. The normal draw order
+and alpha-over compositor still apply; the stage neither recolours that holder
+nor compensates the target RGB to cancel it.
 An opaque background inside the declared reachable band is eligible too:
 choose the band from the measured omission. Transparent painting pixels cannot
 bridge a path. No depth is invented: a gain on a target with registered layer
@@ -4301,7 +4350,8 @@ says why each requirement exists and what breaks without it.
 | <a id="SEETHROUGH_HEAD_RUN_HOLLOW"></a>`SEETHROUGH_HEAD_RUN_HOLLOW` | `full:face` has at least `200` opaque run px (`PROPOSE_MIN_PX`) and `head:face` covers less than `75 %` (`HEAD_FACE_COVERAGE_FLOOR`, measured `0.0 %..48.6 %` on hollow/omitted head runs vs `84.8 %..99.6 %` on clean head runs across the 4 public examples and 9-standee corpus) of `fullLayerToHead(full:face)`'s hole-filled silhouette (`alpha > 8`) in the head canvas while `config.assemble.head_face_underfill: true` is not declared, or `head:face` has fewer than `200` opaque pixels so there is no head-run `face` layer to under-fill (issue #492; the detail gives the full-run mapped count, the head-run overlap and upper/lower half shares) | re-seed `config.seethrough.seed`, or set `config.assemble.head_face_underfill: true` when `head:face` exists so the stage composites `fullLayerToHead(full:face)` under `head:face` on the head canvas (the fill restores transparent pixels only and leaves the cut's own edge where it is — a hollow whose edge is not under hair stays visible; follow [Source before scissors](#source-before-scissors) for its source remedy) |
 | <a id="ASSEMBLE_PLAN_TAG_IN_RUN"></a><a id="ASSEMBLE_EXTEND_TAG_IN_RUN"></a>`ASSEMBLE_PLAN_TAG_IN_RUN`, `ASSEMBLE_EXTEND_TAG_IN_RUN` | an entry takes a tag its run does not hold (the detail lists what it does hold) | that entry's run or tag |
 | <a id="ASSEMBLE_PAINTING_BAND_INSIDE"></a>`ASSEMBLE_PAINTING_BAND_INSIDE` | an extension band reaches past the rig canvas | supply an in-canvas half-open band in rig pixels; no bound is clipped |
-| <a id="ASSEMBLE_PAINTING_EXTENSION_CONFLICT"></a>`ASSEMBLE_PAINTING_EXTENSION_CONFLICT` | two declared final parts can reach the same unheld painting pixel | make their reachable bands disjoint; order never guesses ownership |
+| <a id="CONFIG_ORDER_UNIQUE"></a>`CONFIG_ORDER_UNIQUE` | two `assemble.extend_painting` entries declare the same precedence order | give every entry a unique nonnegative safe integer `order`; lower orders claim first, no implicit tie break |
+| <a id="ASSEMBLE_PAINTING_EXTENSION_CONFLICT"></a>`ASSEMBLE_PAINTING_EXTENSION_CONFLICT` | two declared final parts can reach the same eligible painting pixel without explicit precedence | make their reachable claims disjoint, or declare a unique nonnegative integer `order` on every entry; lower orders claim first, never array order |
 | <a id="ASSEMBLE_PAINTING_CANVAS"></a>`ASSEMBLE_PAINTING_CANVAS` | a callable extension stage receives a part outside the rig canvas | pass the final in-canvas assembled stack with its crop offsets |
 | <a id="ASSEMBLE_PART_OPAQUE"></a>`ASSEMBLE_PART_OPAQUE` | a part ended with no opaque pixel | drop the entry, or take the tag from the other run |
 | <a id="ASSEMBLE_PATCH_BOX_INSIDE"></a>`ASSEMBLE_PATCH_BOX_INSIDE` | a patch's box reaches past the rig (the painting times `rig_scale`; the detail gives the size) | that patch's `box` — it is in rig pixels, not painting pixels |

package/docs/STABILITY.md

@@ -132,7 +132,7 @@ part name, `[i]` an entry of a list):
 - **assemble** — required: `rig_scale`, `plan` (from plain `assemble` on); optional: `extend_below_crop`, `patches`, `cuts`, `alternates`, `head_face_underfill`, `yield_refused`, `keep_under_occluders`, `extend_painting`
 - **assemble.alternates[i]** — required: `name`; optional: `source`, `full`, `head`, `parts`, `hides`, `head_box`, `cuts`, `skeleton`, `anchor`, `base_anchor`, `drawn`, `tips`, `front`, `layers`, `focus` (issues #454, #465, #543, #652, #664, #666, #719, #780). `focus` is an authored finite `[x, y]` in painting pixels, within its canvas (edges included), refused as CONFIG_SET_FOCUS before assemble output when invalid; only when present, `parts.json` records it with focus_source_size and `sets.json` emits it in setup-world coordinates through the actual rig resize and `src/coords.ts`. Absent focus emits no field or inferred value; changing/removing it requires reassembly
 - **assemble.extend_below_crop[i]** — required: `part`, `run`, `tag`
-- **assemble.extend_painting[i]** — required: `part`, `band`, `max_distance` (issue #848; explicit final layer-derived part, half-open rig band and positive four-neighbour path bound; base painting only)
+- **assemble.extend_painting[i]** — required: `part`, `band`, `max_distance`; optional: `min_held_alpha`, `order` (issues #848, #854, #855; explicit final layer-derived part, half-open rig band and positive four-neighbour path bound; base painting only). The optional integer floor 1–255 admits exact original alpha-over coverage strictly below it; absent or 1 blocks every nonzero holder. Only selected target samples below the floor may take painting RGBA; target samples at/above the floor and every non-target holder remain exact. By default overlapping reachable claims refuse. With `order` on every entry (unique nonnegative safe integers), lower values claim first and their gains block later candidates and paths; array order never breaks ties or supplies missing precedence
 - **assemble.patches[i]** — required: `name`, `box`, `alpha`, `draw`
 - **assemble.patches[i].draw**, when an object — required: `before`
 - **assemble.cuts[i]** — required: `from`, `into`, `polygon`, `draw`, `overlap`; optional: `under`, `under_fill`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rig-parts",
-  "version": "1.80.0",
+  "version": "1.82.0",
   "description": "AI-authored 2D character parts from one anime painting and its See-through layer decomposition: measured parts, weighted-mesh rig specs, verified through rig-c before anything is written. A CLI for agents that cannot see the image.",
   "type": "module",
   "bin": {

package/src/config.ts

@@ -2413,7 +2413,7 @@ function checkRunTag(c: Check, path: string, run: Json, tag: Json): void {
 function checkPaintingExtensions(c: Check, value: Json, names: ReadonlySet<string> | null = null): void {
   const at = 'config.assemble.extend_painting';
   if (c.array(at, value, false)) (value as Json[]).forEach((entry, i) => {
-    c.object(`${at}[${i}]`, entry, ['part', 'band', 'max_distance'], []);
+    c.object(`${at}[${i}]`, entry, ['part', 'band', 'max_distance'], ['min_held_alpha', 'order']);
   });
   for (const p of paintingExtensionProblems(value, names)) {
     if (!c.problems.some(old => old.code === p.code && old.object === p.object)) c.problems.push(p);

package/src/paintingextension.ts

@@ -10,6 +10,10 @@ export interface PaintingExtension {
   band: [number, number, number, number];
   /** Maximum four-neighbour path length from the original target silhouette. */
   max_distance: number;
+  /** Optional coverage floor, 1..255. Absent keeps the alpha >0 blocker. */
+  min_held_alpha?: number;
+  /** Optional explicit total precedence; lower orders claim first. */
+  order?: number;
 }
 
 /** Shared by every config door and the callable assemble API. */
@@ -20,15 +24,25 @@ export function paintingExtensionProblems(value: unknown, names: ReadonlySet<str
     fail('CONFIG_FIELD_TYPE', at, 'requires an array of {part, band, max_distance}; omit it for no extension');
     return out;
   }
-  const seen = new Set<string>();
+  const seen = new Set<string>(), orders = new Set<number>();
+  const ordered = value.some(entry => typeof entry === 'object' && entry !== null && 'order' in entry);
   value.forEach((entry: unknown, i) => {
     const path = `${at}[${i}]`;
     if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
       fail('CONFIG_FIELD_TYPE', path, 'requires {part, band, max_distance}'); return;
     }
     const e = entry as Record<string, unknown>;
-    for (const key of Object.keys(e)) if (!['part', 'band', 'max_distance'].includes(key)) fail('CONFIG_KEY_KNOWN', `${path}.${key}`, 'is unknown; only part, band and max_distance are read');
+    for (const key of Object.keys(e)) if (!['part', 'band', 'max_distance', 'min_held_alpha', 'order'].includes(key)) fail('CONFIG_KEY_KNOWN', `${path}.${key}`, 'is unknown; only part, band, max_distance, min_held_alpha and order are read');
     for (const key of ['part', 'band', 'max_distance']) if (!(key in e)) fail('CONFIG_FIELD_PRESENT', `${path}.${key}`, 'is absent and required; no bound or target is inferred');
+    if (ordered && !('order' in e)) fail('CONFIG_FIELD_PRESENT', `${path}.order`, 'is absent; when precedence is declared, every entry requires a unique nonnegative safe integer order');
+    if ('order' in e) {
+      if (!(Number.isSafeInteger(e.order) && (e.order as number) >= 0)) fail('CONFIG_FIELD_TYPE', `${path}.order`, `is ${JSON.stringify(e.order)}; a nonnegative safe integer is required; lower orders claim first`);
+      else {
+        const order = e.order as number;
+        if (orders.has(order)) fail('CONFIG_ORDER_UNIQUE', `${path}.order`, `is ${order} again; a unique order per entry is required, no array-order tie break is applied`);
+        orders.add(order);
+      }
+    }
     if ('part' in e) {
       if (typeof e.part !== 'string' || e.part === '') fail('CONFIG_FIELD_TYPE', `${path}.part`, `is ${JSON.stringify(e.part)}; a nonempty final layer-derived output part name is required`);
       else {
@@ -40,6 +54,9 @@ export function paintingExtensionProblems(value: unknown, names: ReadonlySet<str
     if ('band' in e && !(Array.isArray(e.band) && e.band.length === 4 && e.band.every(n => Number.isSafeInteger(n) && n >= 0) && e.band[0] < e.band[2] && e.band[1] < e.band[3])) {
       fail('CONFIG_FIELD_TYPE', `${path}.band`, `is ${JSON.stringify(e.band)}; [x0,y0,x1,y1] as nonnegative safe integers with x0 < x1 and y0 < y1 is required, rig pixels, upper bounds exclusive`);
     }
+    if ('min_held_alpha' in e && !(Number.isSafeInteger(e.min_held_alpha) && (e.min_held_alpha as number) >= 1 && (e.min_held_alpha as number) <= 255)) {
+      fail('CONFIG_FIELD_TYPE', `${path}.min_held_alpha`, `is ${JSON.stringify(e.min_held_alpha)}; an integer alpha-over coverage floor from 1 through 255 is required; omit it to block every nonzero holder`);
+    }
     if ('max_distance' in e && !(Number.isSafeInteger(e.max_distance) && (e.max_distance as number) > 0)) {
       fail('CONFIG_FIELD_TYPE', `${path}.max_distance`, `is ${JSON.stringify(e.max_distance)}; a positive safe integer of four-neighbour rig-pixel steps is required`);
     }
@@ -49,10 +66,14 @@ export function paintingExtensionProblems(value: unknown, names: ReadonlySet<str
 
 /**
  * Returns disjoint gain masks from one frozen final stack, without changing it.
- * Alpha >0 on ANY assembled part blocks a candidate. Only original target
- * alpha >8 seeds paths. A path stays in-band on unheld painting alpha >=250;
- * its first pixel is distance 1. Conflicting claims refuse, never pick a part.
- * RGB copying is the caller's job, from its existing RGB painting resample.
+ * Absent a floor, alpha >0 on ANY assembled part blocks a candidate. With a
+ * floor, exact alpha-over union below that floor is eligible; equality blocks.
+ * Only original target alpha >8 seeds paths. A path stays in-band on painting alpha >=250;
+ * its first pixel is distance 1. Without order, conflicting claims refuse.
+ * With unique explicit orders on every entry, lower orders claim first; their
+ * gains block later candidates and paths, but never become original seeds.
+ * The caller assigns painting RGBA to target gains, including its own faint
+ * samples. Non-target holders are never modified; their draw order still matters.
  */
 export function paintingExtensionMasks(
   declarations: readonly PaintingExtension[],
@@ -72,11 +93,39 @@ export function paintingExtensionMasks(
     else for (let j = 0; j < image.height; j++) for (let i = 0; i < image.width; i++) if (image.data[(j * image.width + i) * 4 + 3] > 0) held[(y + j) * W + x + i] = 1;
   }
   refuseIfAny(problems);
-  for (const e of declarations) {
+  const ordered = declarations.some(e => e.order !== undefined);
+  const entries = ordered ? [...declarations].sort((a, b) => a.order! - b.order!) : declarations;
+  for (const e of entries) {
     const target = parts.find(p => p.name === e.part)!;
     const [x0, y0, x1, y1] = e.band, bw = x1 - x0, bh = y1 - y0;
     const distance = new Uint32Array(bw * bh), queue = new Int32Array(bw * bh), gain = newMask(W, H);
-    const eligible = (x: number, y: number): boolean => held[y * W + x] === 0 && painting.data[(y * W + x) * 4 + 3] >= CORE_ALPHA;
+    const targetAlpha = (x: number, y: number): number => {
+      const tx = x - (target.x ?? 0), ty = y - (target.y ?? 0);
+      return tx >= 0 && ty >= 0 && tx < target.image.width && ty < target.image.height ? target.image.data[(ty * target.image.width + tx) * 4 + 3] : 0;
+    };
+    // Cache only this declaration's band. Integer products compare the exact
+    // alpha-over union 255 * (1 - product(1 - a/255)) without byte rounding,
+    // float boundary error, or dependence on the stack's enumeration order.
+    const candidates = new Uint8Array(bw * bh);
+    for (let y = y0; y < y1; y++) for (let x = x0; x < x1; x++) {
+      const p = y * W + x, alpha = painting.data[p * 4 + 3];
+      if (alpha < CORE_ALPHA || targetAlpha(x, y) >= alpha || (ordered && claimed.has(p))) continue;
+      let eligible = held[p] === 0;
+      if (!eligible && e.min_held_alpha !== undefined) {
+        let remaining = 1n, scale = 1n;
+        for (const { image, x: px = 0, y: py = 0 } of parts) {
+          const tx = x - px, ty = y - py;
+          if (tx < 0 || ty < 0 || tx >= image.width || ty >= image.height) continue;
+          const a = image.data[(ty * image.width + tx) * 4 + 3];
+          if (a === 0) continue;
+          remaining *= BigInt(255 - a); scale *= 255n;
+          if (a === 255) break;
+        }
+        eligible = 255n * remaining > BigInt(255 - e.min_held_alpha) * scale;
+      }
+      if (eligible) candidates[(y - y0) * bw + x - x0] = 1;
+    }
+    const eligible = (x: number, y: number): boolean => candidates[(y - y0) * bw + x - x0] === 1;
     const seed = (x: number, y: number): boolean => {
       const tx = x - (target.x ?? 0), ty = y - (target.y ?? 0);
       return tx >= 0 && ty >= 0 && tx < target.image.width && ty < target.image.height && target.image.data[(ty * target.image.width + tx) * 4 + 3] > OPAQUE_ALPHA_ABOVE;