rig-parts 2.10.0 → 2.11.0

package/docs/AUTHORING.md

@@ -708,8 +708,8 @@ renaming a supplied image does not establish that it was the donor's input.
 The target input is derived from the painting by the existing input model:
 `full` uses the exact centred white `squarePad`, and `head` the configured
 `head_box`. A nonsquare single-run file uses the painting at its original file
-size before the assembler's existing padding. Donor and target run canvases must
-have equal dimensions; donor and target input PNGs must also have equal
+size before the assembler's existing padding. Without a declared `crop`, donor
+and target run canvases must have equal dimensions; donor and target input PNGs must also have equal
 dimensions. Incompatible canvases or input sizes are refused, never resized to
 make the comparison pass.
 
@@ -768,6 +768,34 @@ identity an executable check on supplied original inputs instead of trusting
 that claim or hand-editing `layers.json`. Seed and painting selection remain
 the author's decisions.
 
+
+With a whole-layer donor made from a crop of the original painting, add
+`"crop": {"box": [left, top, right, bottom], "resample": "bilinear"}` to that
+entry. The box uses integer source-painting pixels with exclusive right/bottom
+bounds. Its input must be the white square-padded crop produced by the same
+`inputs` geometry. The crop must be inside the painting. Donor RGBA under the
+selected support and its existing margin must equal that reconstructed input.
+Containment covers alpha > 8 support only. That support must fit both the crop
+and the target canvas.
+
+The map derives from donor canvas, crop padding/origin and target input geometry.
+Unit scale with integer translation copies straight RGBA exactly. Every other map
+uses one premultiplied float32 bilinear affine pass. The derived map uses pixel
+corners. `warpAffine` samples by pixel index, as `layerToRig` does, with the
+existing cv2-compatible fixed-point sampling and transparent border. The receipt's optional `transport`
+records `crop`, `donor_canvas`, `target_canvas`, `scale`, `translate`, `filter`
+(`exact` or `bilinear`) and `input_rgba_sha256`, `before_rgba_sha256`,
+`after_rgba_sha256`. Hashes cover row-major straight RGBA over the entire named
+canvas, with the donor input dimensions derived from the square-padded crop.
+The production transport verifier checks canvas dimensions and the output hash
+before downstream assembly changes. It refuses a changed canvas as
+`PARTS_TAKEN_LAYERS`.
+Resampling establishes the declared output bytes. It does not establish equality
+between separately generated donor and target art. Omitting `crop` retains the
+existing geometry refusal and its message.
+
+Region take entries retain their existing geometry contract and refuse crop donors.
+
 ### Residual front/back edges (`edge_residuals.json`, issue #999)
 
 Under `assemble.project: "visible"`, assemble writes `edge_residuals.json` beside
@@ -858,6 +886,20 @@ every donor author/hidden image requires a valid receipt before pixels are
 copied. A receipted author-layer target is accepted. The plan proposal command
 refuses region entries because their part names depend on an existing plan.
 
+### Scene plate editor receipts (issue #966)
+
+Optional `scene.plate.editor_receipts` uses the assemble ledger shape
+`{receipts: [{file, sha256, from_sha256, editor}], required?}`. Paths resolve
+relative to the scene file. Every declared receipt is verified, and under
+`required: true` the plate must match a verified receipt by content before
+compose writes anything. The shared `trace_parts` boolean also requires a
+matching receipt when true, as in assemble. `from_sha256` and `editor` remain
+author declarations held to form and differing hashes. `provenance` remains
+required and describes pixel origin (`observed`, `generated`, `unknown`).
+A receipt verifies file identity and records an edit declaration. Neither
+field judges pixel content. Omitting the ledger preserves output bytes and
+accepted exit codes.
+
 ### Editor receipts (`assemble.editor_receipts`, issue #946)
 
 An image edited in code — a layer re-segmented by a script, a patch
@@ -5160,7 +5202,8 @@ those settings. Changing a config seed alone cannot change a no-config run.
 | <a id="ASSEMBLE_REGION_TAKE_SEED"></a>`ASSEMBLE_REGION_TAKE_SEED` | the seed touches no qualifying component | name an integer pixel in the derived region on the target run canvas |
 | <a id="ASSEMBLE_REGION_TAKE_BINDING"></a>`ASSEMBLE_REGION_TAKE_BINDING` | active scalar depth or hidden companions have no region binding | supply a part without those companions |
 | <a id="ASSEMBLE_REGION_TAKE_PLAN"></a>`ASSEMBLE_REGION_TAKE_PLAN` | a region entry is present during plan proposal | draft the plan before declaring region takes, then use assemble/build with requirements |
-| <a id="ASSEMBLE_TAKE_GEOMETRY"></a>`ASSEMBLE_TAKE_GEOMETRY` | missing target head, unequal run canvases or unequal original input dimensions | supply matching geometry; the check does not resize inputs |
+| <a id="ASSEMBLE_TAKE_CROP"></a>`ASSEMBLE_TAKE_CROP` | declared crop is outside the source, its square-padded input dimensions differ, or taken support would fall outside the crop or target | supply the original inside integer crop and its exact square-padded input, with explicit `resample: "bilinear"` |
+| <a id="ASSEMBLE_TAKE_GEOMETRY"></a>`ASSEMBLE_TAKE_GEOMETRY` | missing target head, unequal run canvases or unequal original input dimensions | supply matching geometry, or declare the whole-layer donor crop and resample explicitly |
 | <a id="ASSEMBLE_TAKE_META"></a>`ASSEMBLE_TAKE_META` | donor `meta.json` lacks a readable prompt ID or seed | retain the original run metadata |
 | <a id="ASSEMBLE_TAKE_INPUT"></a>`ASSEMBLE_TAKE_INPUT` | declared donor input PNG cannot be read | name its original PNG relative to the config |
 | <a id="ASSEMBLE_TAKE_DEPTH_SHEET"></a>`ASSEMBLE_TAKE_DEPTH_SHEET` | taking layers with an active depth opt-in or bound scalar sheets has no declared mixed-run binding | keep scalar depth inactive; numeric ordering depth is retained, and a target sheet is never attached silently |
@@ -5703,6 +5746,10 @@ and stay absent).
 | --- | --- | --- |
 | <a id="SCENE_FILE"></a><a id="SCENE_SPEC"></a><a id="SCENE_FIELD_PRESENT"></a><a id="SCENE_FIELD_TYPE"></a><a id="SCENE_KEY_KNOWN"></a>`SCENE_FILE`, `SCENE_SPEC`, `SCENE_FIELD_PRESENT`, `SCENE_FIELD_TYPE`, `SCENE_KEY_KNOWN` | the scene file is missing, not a JSON object, not `spine-parts-scene/1`, or a field is missing, of the wrong type or not one the format reads (`canvas` two positive integers; `characters` at least one, each `id`, `build`, `offset` — an offset is never assumed (0, 0) — and an optional `scale`, a positive finite number: 0, a negative number or a non-number is refused at `characters[i].scale`; `order` a list of strings). `note`, `*_note` (strings) and `x-…` (any value) are read by nothing | the field |
 | <a id="SCENE_ID_UNIQUE"></a><a id="SCENE_ID_FORM"></a>`SCENE_ID_UNIQUE`, `SCENE_ID_FORM` | an `id` repeated, empty, or holding `:` — the separator of a prefixed name — or `/`, `\` or a leading `.`, because an id begins every image file of its character | another id |
+| <a id="SCENE_EDITOR_RECEIPT"></a>`SCENE_EDITOR_RECEIPT` | `scene.plate.editor_receipts` has a malformed ledger or receipt (issue #966) | use `{receipts: [{file, sha256, from_sha256, editor}], required?}` with the same shape rules as assemble editor receipts |
+| <a id="SCENE_EDITOR_RECEIPT_FILE"></a>`SCENE_EDITOR_RECEIPT_FILE` | a plate receipt names a missing file | supply the edited image relative to the scene file |
+| <a id="SCENE_EDITOR_RECEIPT_SHA256"></a>`SCENE_EDITOR_RECEIPT_SHA256` | a plate receipt's file hashes differently from its declared `sha256` | record the current edited file's sha256 |
+| <a id="SCENE_EDITOR_RECEIPT_MISSING"></a>`SCENE_EDITOR_RECEIPT_MISSING` | `scene.plate.editor_receipts.required` is true and no verified receipt matches the plate's bytes | edit the plate in an image editor and record a matching receipt |
 | <a id="SCENE_PLATE_PROVENANCE"></a><a id="SCENE_PLATE_PRESENT"></a><a id="SCENE_PLATE_SIZE"></a>`SCENE_PLATE_PROVENANCE`, `SCENE_PLATE_PRESENT`, `SCENE_PLATE_SIZE` | the plate's `provenance` is not `observed`, `generated` or `unknown`; its image is missing or not a PNG; it is not the canvas's size (it is drawn at canvas (0, 0) and never scaled) | the plate |
 | <a id="SCENE_BUILD_PRESENT"></a>`SCENE_BUILD_PRESENT` | a build directory, or a file `build` writes in it (`parts.json`, `rig/rig.json`, `rig/motion.json` with an `idle`, an image its skin names, `check/check.json`), is missing | run `build` for that character |
 | <a id="SCENE_BUILD_GREEN"></a>`SCENE_BUILD_GREEN` | the build's own `check/check.json` does not say `PASS` and `gate_spine_html_green`; under an accept list (`--accept`, `characters[].accept`), it failed a bar the list does not name, its gate is red, a declared requirement is not PASS, or it names no failing bar — the bars not met and the ones accepted are listed | finish that character first: compose binds finished characters. To look at the scene meanwhile, name the failing bars (§7, *Composing several characters*) |
@@ -6446,7 +6493,7 @@ single-character path (§4, steps 0–9) on its own, already isolated input to a
 | field | what it is |
 | --- | --- |
 | `canvas` | the shared stage, canvas px, y down. The composed rig's stage is the canvas, `root` at its bottom centre, as a single character's is its own |
-| `plate` | optional. `image` (relative to the scene file) is a PNG of exactly the canvas's size; `provenance` is `observed` (the painting's own pixels), `generated` or `unknown` (a residual after the people were removed is `unknown` where they stood, and the author says so); `note` is free text. Both are copied into `scene.json` and **judged by nothing** |
+| `plate` | optional. `image` (relative to the scene file) is a PNG of exactly the canvas's size; `provenance` is `observed` (the painting's own pixels), `generated` or `unknown` (a residual after the people were removed is `unknown` where they stood, and the author says so); `note` is free text. `provenance` and `note` are copied into `scene.json` and **judged by nothing**. Optional `editor_receipts` uses the [editor receipt ledger](#scene-plate-editor-receipts-issue-966), with paths relative to the scene file and verified file hashes; `required: true` demands a matching plate receipt |
 | `characters[].id` | the prefix: every bone, slot, attachment (skin entry), constraint (its name, and every bone and path slot it names), `stops` entry (its `chain`, `links` and `against`, issue #431), `invariants.detached` bone, track, group and easing of that character is renamed `<id>:<name>`. `root` is the one shared root. A name resolves to exactly one character, and nothing resolves across characters without its prefix |
 | `characters[].build` | a `build --out` directory (relative to the scene file) whose own `check/check.json` is green |
 | `characters[].offset` | `[x, y]`, a translation from the build's rig px to canvas px. Every character is built at one `assemble.rig_scale`, so its rig px are canvas px at scale 1 |

package/docs/STABILITY.md

@@ -156,7 +156,8 @@ part name, `[i]` an entry of a list):
 - **assemble.alternates[i]** — required: `name`; optional: `source`, `full`, `head`, `parts`, `hides`, `head_box`, `cuts`, `skeleton`, `anchor`, `base_anchor`, `drawn`, `tips`, `front`, `layers`, `focus` (issues #454, #465, #543, #652, #664, #666, #719, #780). `focus` is an authored finite `[x, y]` in painting pixels, within its canvas (edges included), refused as CONFIG_SET_FOCUS before assemble output when invalid; only when present, `parts.json` records it with focus_source_size and `sets.json` emits it in setup-world coordinates through the actual rig resize and `src/coords.ts`. Absent focus emits no field or inferred value; changing/removing it requires reassembly
 - **assemble.extend_below_crop[i]** — required: `part`, `run`, `tag`
 - **assemble.extend_painting[i]** — required: `part`, `band`, `max_distance`; optional: `min_held_alpha`, `order` (issues #848, #854, #855; explicit final layer-derived part, half-open rig band and positive four-neighbour path bound; base painting only). The optional integer floor 1–255 admits exact original alpha-over coverage strictly below it; absent or 1 blocks every nonzero holder. Only selected target samples below the floor may take painting RGBA; target samples at/above the floor and every non-target holder remain exact. By default overlapping reachable claims refuse. With `order` on every entry (unique nonnegative safe integers), lower values claim first and their gains block later candidates and paths; array order never breaks ties or supplies missing precedence
-- **assemble.take[i]** — required: `run`, `run_dir`, `st_input`; optional: `tags`, `part`, `seed`, `reference` (issues #866, #1000, #1031). Whole-layer entries require `tags`; region entries require `part` and `seed`. An absent `reference` preserves the shipped `source: true` predicate and emits one named implicit-reference warning; only an explicitly declared painting reference makes the mask invariant to changes in `--source`
+- **assemble.take[i]** — required: `run`, `run_dir`, `st_input`; optional: `tags`, `part`, `seed`, `reference`, `crop` (issues #866, #973, #1000, #1031). Whole-layer entries require `tags`; region entries require `part` and `seed`. An absent `reference` preserves the shipped `source: true` predicate and emits one named implicit-reference warning; only an explicitly declared painting reference makes the mask invariant to changes in `--source`
+- **assemble.take[i].crop** — required when present: `box`, `resample` (issue #973, additive, whole-layer entries only). `box` is an inside nonempty integer source-painting `[left, top, right, bottom]` with exclusive right/bottom. `resample: "bilinear"` is required explicitly. Donor input must match the square-padded crop under taken support plus its margin. Unit scale and integer translation copy RGBA exactly; other maps use the declared premultiplied float32 affine filter. Absent, the shipped geometry predicate and refusal message remain unchanged. Region entries reject this field
 - **assemble.take[i].reference** — required: `sha256`; optional: `source`, `painting` (issue #1031). Exactly one of `source: true` or a config-relative `painting` PNG is required
 - **assemble.editor_receipts** — required: `receipts`; optional: `required` (issue #946, additive), `trace_parts` (issue #947, additive)
 - **assemble.editor_receipts.receipts[i]** — required: `file`, `sha256`, `from_sha256`, `editor` (issue #946)
@@ -616,6 +617,20 @@ stale evidence rather than reconstructing original art from emitted siblings.
 Without the block the API reading is SKIP; CLI stdout and emitted bytes remain unchanged.
 See [Source before scissors](AUTHORING.md#source-before-scissors).
 
+### Scene plate editor receipts
+
+`scene.plate.editor_receipts` (issue #966, additive) is optional and uses the
+assemble receipt ledger shape, including `required` and `trace_parts`.
+Receipt file paths resolve against the scene file. Declared receipts are
+verified even without `required`; when required, the plate needs a verified
+receipt matching its bytes. Receipt refusals occur before compose writes new
+artifacts. As before, compose creates `--out` and clears its owned outputs,
+including an earlier `rig/` and `scene.json`, before input validation, so a
+refused re-run can remove earlier artifacts. Omitting the field preserves
+exit codes and `scene.json` bytes. The existing required
+`provenance` field is preserved. It declares pixel origin, while the receipt
+verifies file identity and records the author's edit declaration.
+
 ### Editor receipts
 
 The optional `assemble.editor_receipts` block (issue #946, additive) records
@@ -664,3 +679,16 @@ reads that rate (issue #965, additive for readers). Measurements in
 `requirements` still require a positive `fps`, with no default. Declarations
 whose instruments use their own rate keep that rate.
 The output `check.json` omits `requirements.fps` when the file supplies no `fps`.
+
+### Crop donor transport receipts (issue #973)
+
+Whole-layer `parts[].taken_layers[]` optionally adds `transport` when its config
+entry declares `crop`. The ordered fields are `crop`, `donor_canvas`,
+`target_canvas`, `scale`, `translate`, `filter`, `input_rgba_sha256`,
+`before_rgba_sha256` and `after_rgba_sha256`. Hashes bind whole-canvas row-major
+straight RGBA before and after transport, and the donor input reconstructed from
+the declared crop. `filter: "exact"` requires unit scale and integer translation.
+Other maps carry `"bilinear"`. The strict reader refuses incomplete or malformed
+transport records. Absent, the existing receipt fields and bytes are unchanged.
+The output hash describes transport before downstream assembly, independently of
+final part geometry. Existing no-take inputs emit no transport metadata.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rig-parts",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "AI-authored 2D character parts from one anime painting and its See-through layer decomposition: measured parts, weighted-mesh rig specs, verified through rig-c before anything is written. A CLI for agents that cannot see the image.",
   "type": "module",
   "bin": {

package/src/config.ts

@@ -2501,7 +2501,7 @@ function checkTakeLayers(c: Check, value: Json, plan: string[] | null = null): v
     const region = isPlainObject(v) && ('part' in v || 'seed' in v);
     const o = region
       ? c.object(p, v, ['run', 'run_dir', 'st_input', 'part', 'seed'], ['reference'])
-      : c.object(p, v, ['run', 'run_dir', 'st_input', 'tags'], []);
+      : c.object(p, v, ['run', 'run_dir', 'st_input', 'tags'], ['crop']);
     if (o === null) return;
     if (o.run !== 'full' && o.run !== 'head') c.fail('CONFIG_FIELD_TYPE', p + '.run', '"full" or "head" is required');
     for (const k of ['run_dir', 'st_input']) c.string(`${p}.${k}`, o[k]);
@@ -2526,6 +2526,14 @@ function checkTakeLayers(c: Check, value: Json, plan: string[] | null = null): v
       }
       return;
     }
+    if ('crop' in o) {
+      const crop = c.object(`${p}.crop`, o.crop, ['box', 'resample'], []);
+      if (crop !== null) {
+        const box = crop.box;
+        if (!(Array.isArray(box) && box.length === 4 && box.every(n => typeof n === 'number' && Number.isSafeInteger(n) && n >= 0) && box[2] > box[0] && box[3] > box[1])) c.fail('CONFIG_FIELD_TYPE', `${p}.crop.box`, 'requires [left, top, right, bottom], nonnegative safe integers with positive width/height in source-painting pixels');
+        if (crop.resample !== 'bilinear') c.fail('CONFIG_FIELD_TYPE', `${p}.crop.resample`, '"bilinear" is required explicitly');
+      }
+    }
     if (!c.array(p + '.tags', o.tags, true)) return;
     (o.tags as Json[]).forEach((tag, j) => {
       const reading = typeof tag === 'string' ? readLayerTag(tag) : null;
@@ -2537,6 +2545,13 @@ function checkTakeLayers(c: Check, value: Json, plan: string[] | null = null): v
   });
 }
 
+/** Shared receipt shape validation for config and scene input doors. */
+export function editorReceiptProblems(value: unknown, at: string): Problem[] {
+  const c = new Check();
+  checkEditorReceipts(c, value, at);
+  return c.problems;
+}
+
 /**
  * `config.assemble.editor_receipts` (issue #946): `{receipts, required?, trace_parts?}` (`trace_parts`, issue #947).
  * Shape refusals are the loader's own; a receipt whose `from_sha256` equals
@@ -2544,8 +2559,7 @@ function checkTakeLayers(c: Check, value: Json, plan: string[] | null = null): v
  * Whether the file exists and hashes to `sha256` is read at assemble
  * (`src/editreceipt.ts`), where the file is.
  */
-function checkEditorReceipts(c: Check, value: Json): void {
-  const at = 'config.assemble.editor_receipts';
+function checkEditorReceipts(c: Check, value: Json, at = 'config.assemble.editor_receipts'): void {
   const o = c.object(at, value, ['receipts'], ['required', 'trace_parts']);
   if (o === null) return;
   for (const k of ['required', 'trace_parts'] as const) {

package/src/editreceipt.ts

@@ -89,6 +89,8 @@ export interface VerifiedReceipt extends EditorReceipt {
 /** The receipts read for one build: those that verified, keyed by sha256, and the refusals of those that did not. */
 export interface ReceiptLedger {
   required: boolean;
+  /** Input location, defaulting to the assemble ledger. */
+  at?: string;
   /** The field that made receipts required, as a refusal names it: `required`, else `trace_parts` (issue #947). */
   by: 'required' | 'trace_parts';
   bySha: ReadonlyMap<string, VerifiedReceipt>;
@@ -101,17 +103,17 @@ export interface ReceiptLedger {
  * `file`). A missing file is `ASSEMBLE_EDITOR_RECEIPT_FILE`; bytes that hash
  * to another value are `ASSEMBLE_EDITOR_RECEIPT_SHA256`, naming both values.
  */
-export function readEditorReceipts(spec: EditorReceipts | undefined, configPath: string): ReceiptLedger {
+export function readEditorReceipts(spec: EditorReceipts | undefined, configPath: string, at = AT, relativeTo: 'config' | 'scene file' = 'config'): ReceiptLedger {
   const problems: Problem[] = [];
   const bySha = new Map<string, VerifiedReceipt>();
   if (spec === undefined) return { required: false, by: 'required', bySha, problems };
   const base = dirname(resolve(configPath));
   spec.receipts.forEach((r, i) => {
-    const at = `${AT}.receipts[${i}]`;
+    const receiptAt = `${at}.receipts[${i}]`;
     const path = resolve(base, r.file);
-    const object = `${at} (file "${r.file}")`;
+    const object = `${receiptAt} (file "${r.file}")`;
     if (!existsSync(path) || !statSync(path).isFile()) {
-      problems.push({ code: 'ASSEMBLE_EDITOR_RECEIPT_FILE', object, detail: `names ${path}, which is no such file; the edited image, its path relative to the config's directory, is required` });
+      problems.push({ code: 'ASSEMBLE_EDITOR_RECEIPT_FILE', object, detail: `names ${path}, which is no such file; the edited image, its path relative to the ${relativeTo}'s directory, is required` });
       return;
     }
     const found = fileSha256(path);
@@ -119,10 +121,10 @@ export function readEditorReceipts(spec: EditorReceipts | undefined, configPath:
       problems.push({ code: 'ASSEMBLE_EDITOR_RECEIPT_SHA256', object, detail: `the file's bytes hash to sha256 ${found}; the receipt's sha256 ${r.sha256} is required — the file changed after its receipt was written, or the receipt names another file` });
       return;
     }
-    if (!bySha.has(found)) bySha.set(found, { ...r, at, path });
+    if (!bySha.has(found)) bySha.set(found, { ...r, at: receiptAt, path });
   });
   const by = spec.required === true || spec.trace_parts !== true ? 'required' : 'trace_parts';
-  return { required: spec.required === true || spec.trace_parts === true, by, bySha, problems };
+  return { required: spec.required === true || spec.trace_parts === true, by, bySha, problems, at };
 }
 
 /** An image the input itself says was made or edited outside See-through. */
@@ -181,7 +183,7 @@ export function missingReceipts(ledger: ReceiptLedger, images: readonly EditedIm
     problems.push({
       code: 'ASSEMBLE_EDITOR_RECEIPT_MISSING',
       object: image.object,
-      detail: `${image.path} (sha256 ${found}) carries no editor receipt; ${AT}.${ledger.by} is true, so a receipt {file, sha256, from_sha256, editor} whose sha256 is this file's is required — edit the image in an image editor and record it, never generate or patch it in code`,
+      detail: `${image.path} (sha256 ${found}) carries no editor receipt; ${ledger.at ?? AT}.${ledger.by} is true, so a receipt {file, sha256, from_sha256, editor} whose sha256 is this file's is required — edit the image in an image editor and record it, never generate or patch it in code`,
     });
   }
   return problems;

package/src/parts.ts

@@ -507,9 +507,26 @@ function orderedProvenance(p: PixelProvenance): PixelProvenance {
     ...(p.depth === undefined ? {} : { depth: { kind: p.depth.kind, values: p.depth.values.map(v => ({ group: v.group, ...(v.bone === undefined ? {} : { bone: v.bone }), value: v.value })) } }) };
 }
 
+function orderedTakenSource(source: TakenLayerSource): TakenLayerSource {
+  const transport = source.transport;
+  return {
+    run: source.run, tag: source.tag, run_dir: source.run_dir, st_input: source.st_input,
+    prompt_id: source.prompt_id, seed: source.seed, support_px: source.support_px,
+    checked_px: source.checked_px, differing_px: source.differing_px,
+    ...(transport === undefined ? {} : { transport: {
+      crop: transport.crop, donor_canvas: transport.donor_canvas,
+      target_canvas: transport.target_canvas, scale: transport.scale,
+      translate: transport.translate, filter: transport.filter,
+      input_rgba_sha256: transport.input_rgba_sha256,
+      before_rgba_sha256: transport.before_rgba_sha256,
+      after_rgba_sha256: transport.after_rgba_sha256,
+    } }),
+  };
+}
+
 function serializePartList(parts: readonly PartRecord[]): Array<Record<string, unknown>> {
   return parts.map((p) =>
-    Object.fromEntries(PART_KEYS.filter((k) => p[k] !== undefined).map((k) => [k, k === FRINGE_KEY ? (p.fringe_pushed_back ?? []).map((q) => ({ part: q.part, px: q.px })) : k === LIMB_KEY ? orderedLimb(p.limb as LimbRecord) : k === 'taken_layers' ? p.taken_layers?.map(t => ({ run: t.run, tag: t.tag, run_dir: t.run_dir, st_input: t.st_input, prompt_id: t.prompt_id, seed: t.seed, support_px: t.support_px, checked_px: t.checked_px, differing_px: t.differing_px })) : k === 'provenance' ? orderedProvenance(p.provenance as PixelProvenance) : p[k]])),
+    Object.fromEntries(PART_KEYS.filter((k) => p[k] !== undefined).map((k) => [k, k === FRINGE_KEY ? (p.fringe_pushed_back ?? []).map((q) => ({ part: q.part, px: q.px })) : k === LIMB_KEY ? orderedLimb(p.limb as LimbRecord) : k === 'taken_layers' ? p.taken_layers?.map(orderedTakenSource) : k === 'provenance' ? orderedProvenance(p.provenance as PixelProvenance) : p[k]])),
   );
 }
 

package/src/scene.ts

@@ -96,9 +96,10 @@ import { dirname, join, resolve } from 'node:path';
 import type { RigStop } from '@rig-c/core/rig';
 import { checkStage, gateThroughRigc, type Log } from './build.ts';
 import { ACCEPTABLE_BARS, barsNotMet, type CheckReport, DEFAULT_PACK_SHAPE, DEFAULT_PAGE_EDGES, type PackMode, requirementsNotPass, type RigcRunner } from './check.ts';
-import { CONSTRAINT_BONE_FIELDS, ROOT_BONE } from './config.ts';
+import { CONSTRAINT_BONE_FIELDS, editorReceiptProblems, ROOT_BONE } from './config.ts';
 import { cropToSpineY } from './coords.ts';
 import { failLine, PartsError, type Problem, refuseIfAny } from './errors.ts';
+import { missingReceipts, readEditorReceipts, type EditorReceipts } from './editreceipt.ts';
 import type { MotionSpec } from './motion.ts';
 import { readPng } from './raster/png.ts';
 import { readRequirements, type RequirementsFile } from './requirements.ts';
@@ -161,6 +162,7 @@ export interface ScenePlate {
   image: string;
   imagePath: string;
   provenance: Provenance;
+  editor_receipts?: EditorReceipts;
   note: string | null;
 }
 
@@ -221,7 +223,8 @@ export function acceptProblems(names: readonly string[], where: string): Problem
 /**
  * Read and shape-check a scene file. Every problem is collected before one
  * refusal: the file, `spec`, `canvas` (two positive integers), `plate`
- * (optional: `image`, `provenance`, an optional `note`), `characters` (at
+ * (optional, with required `image` and `provenance` and optional `note`
+ * and `editor_receipts` with the shared ledger shape), `characters` (at
  * least one; each `id`, `build`, `offset`), `order` (a list of strings), and
  * any key the format does not read. Resolving the ids and slots `order`
  * names is {@link composeScene}'s, which has the builds.
@@ -270,7 +273,10 @@ export function loadScene(path: string): SceneFile {
     const p = o.plate;
     if (!isRecord(p)) fail('SCENE_FIELD_TYPE', 'scene.plate', `is ${show(p)}; {"image": "<png>", "provenance": ${PROVENANCES.map((x) => `"${x}"`).join(' | ')}} is required when the key is present`);
     else {
-      known(p, 'scene.plate', ['image', 'provenance', 'note']);
+      known(p, 'scene.plate', ['image', 'provenance', 'note', 'editor_receipts']);
+      if ('editor_receipts' in p) {
+        problems.push(...editorReceiptProblems(p.editor_receipts, 'scene.plate.editor_receipts').map((problem) => ({ ...problem, code: 'SCENE_EDITOR_RECEIPT' })));
+      }
       const image = p.image;
       const prov = p.provenance;
       if (!('image' in p)) fail('SCENE_FIELD_PRESENT', 'scene.plate.image', 'is absent and required; the plate PNG, relative to the scene file');
@@ -278,7 +284,7 @@ export function loadScene(path: string): SceneFile {
       if (!('provenance' in p)) fail('SCENE_FIELD_PRESENT', 'scene.plate.provenance', `is absent and required; one of ${PROVENANCES.join(', ')} — what the plate's pixels are, which the author states and nothing judges`);
       else if (typeof prov !== 'string' || !(PROVENANCES as readonly string[]).includes(prov)) fail('SCENE_PLATE_PROVENANCE', 'scene.plate.provenance', `is ${show(prov)}; one of ${PROVENANCES.join(', ')} is required`);
       if (typeof image === 'string' && image !== '' && typeof prov === 'string' && (PROVENANCES as readonly string[]).includes(prov)) {
-        plate = { image, imagePath: resolve(base, image), provenance: prov as Provenance, note: typeof p.note === 'string' ? p.note : null };
+        plate = { image, imagePath: resolve(base, image), provenance: prov as Provenance, ...('editor_receipts' in p ? { editor_receipts: p.editor_receipts as EditorReceipts } : {}), note: typeof p.note === 'string' ? p.note : null };
       }
     }
   }
@@ -1375,6 +1381,14 @@ export function composeFromFiles(scenePath: string, requirementsPath?: string, m
   const builds = scene.characters.map((c) => readCharacterBuild(c, problems, accept));
   let plate: PlateImage | null = null;
   if (scene.plate !== null) {
+    const ledger = readEditorReceipts(scene.plate.editor_receipts, scene.path, 'scene.plate.editor_receipts', 'scene file');
+    const receiptCodes: Readonly<Record<string, string>> = {
+      ASSEMBLE_EDITOR_RECEIPT_FILE: 'SCENE_EDITOR_RECEIPT_FILE',
+      ASSEMBLE_EDITOR_RECEIPT_SHA256: 'SCENE_EDITOR_RECEIPT_SHA256',
+      ASSEMBLE_EDITOR_RECEIPT_MISSING: 'SCENE_EDITOR_RECEIPT_MISSING',
+    };
+    const receiptProblems = [...ledger.problems, ...missingReceipts(ledger, [{ object: 'scene.plate.image', path: scene.plate.imagePath }])];
+    problems.push(...receiptProblems.map((problem) => ({ ...problem, code: receiptCodes[problem.code] ?? problem.code })));
     const where = `scene.plate.image (${scene.plate.image})`;
     if (!existsSync(scene.plate.imagePath)) problems.push({ code: 'SCENE_PLATE_PRESENT', object: where, detail: `${scene.plate.imagePath} does not exist; a PNG of the canvas's size is required` });
     else {

package/src/takelayers.ts

@@ -1,16 +1,19 @@
 /** Verified replacement in an existing full/head run; never writes or forges a run manifest. */
 import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { dirname, resolve } from 'node:path';
 import type { EarlyConfig, PlanEntry, Run } from './config.ts';
 import { CORE_KERNEL, fullPlanBand } from './assemble.ts';
-import { makeInputs } from './inputs.ts';
+import { makeInputs, squarePad } from './inputs.ts';
 import { OPAQUE_ALPHA_ABOVE, readLayers, type Layer, type LayerSet } from './layers.ts';
 import { PartsError, refuseIfAny, type Problem } from './errors.ts';
 import { dilate } from './raster/morph.ts';
-import { newMask, type Raster } from './raster/types.ts';
+import { newMask, newRaster, newFloatImage, type Raster } from './raster/types.ts';
 import { readPng } from './raster/png.ts';
 import type { TakeDeclaration } from './takeregion.ts';
-import type { TakenLayerSource } from './takesource.ts';
+import { crop, pad } from './raster/composite.ts';
+import { warpAffine, type ScaleTranslate } from './raster/warp.ts';
+import { takenTransportProblems, type TakenLayerSource, type TakenLayerTransport } from './takesource.ts';
 
 export interface TakeLayers {
   run: Run;
@@ -18,6 +21,8 @@ export interface TakeLayers {
   /** The exact PNG supplied to See-through, resolved from the config directory. */
   st_input: string;
   tags: string[];
+  /** Original painting pixels, right/bottom exclusive; donor input is squarePad(crop). */
+  crop?: { box: [number, number, number, number]; resample: 'bilinear' };
 }
 function refuse(code: string, object: string, detail: string): never { throw new PartsError([{ code, object, detail }]); }
 function metadata(path: string): { prompt_id: string; seed: number } {
@@ -49,6 +54,92 @@ function identity(layer: Layer, canvas: LayerSet['canvas'], donor: Raster, targe
   if (differing > 0) return refuse('ASSEMBLE_TAKE_INPUT_IDENTITY', object, `${differing} differing pixel(s), bbox [${x0}, ${y0}, ${x1}, ${y1}] in st_input pixels (right/bottom exclusive); exact RGBA identity under alpha > ${OPAQUE_ALPHA_ABOVE}, grown by ${CORE_KERNEL}x${CORE_KERNEL}, is required`);
   return { support, checked };
 }
+/** Hash straight RGBA, with the dimensions carried separately in the transport receipt. */
+function rgbaHash(image: Raster): string {
+  return createHash('sha256').update(image.data).digest('hex');
+}
+
+function cropGeometry(d: TakeLayers, painting: Raster, target: Raster, donor: LayerSet, set: LayerSet, inputs: ReturnType<typeof makeInputs>, at: string): { expected: Raster; map: ScaleTranslate; exact: boolean } {
+  const declaration = d.crop!;
+  const [x0, y0, x1, y1] = declaration.box;
+  if (declaration.resample !== 'bilinear' || !declaration.box.every(Number.isSafeInteger) || x0 < 0 || y0 < 0 || x1 <= x0 || y1 <= y0 || x1 > painting.width || y1 > painting.height) {
+    return refuse('ASSEMBLE_TAKE_CROP', at, `crop [${declaration.box.join(', ')}] on painting ${painting.width}x${painting.height}; an inside nonempty integer box and resample "bilinear" are required`);
+  }
+  const w = x1 - x0, h = y1 - y0;
+  const donorPad = squarePad(w, h);
+  const expected = pad(crop(painting, x0, y0, w, h), donorPad.left, donorPad.top, donorPad.side - w - donorPad.left, donorPad.side - h - donorPad.top, [255, 255, 255, 255]);
+  const origin = target === painting ? [0, 0] : d.run === 'head' ? [-inputs.headBox![0], -inputs.headBox![1]] : [inputs.padLeft, inputs.padTop];
+  const scaleXUnit = BigInt(donorPad.side) * BigInt(set.canvas.w) === BigInt(donor.canvas.w) * BigInt(target.width);
+  const scaleYUnit = BigInt(donorPad.side) * BigInt(set.canvas.h) === BigInt(donor.canvas.h) * BigInt(target.height);
+  const offsetX = BigInt(x0 - donorPad.left + origin[0]) * BigInt(set.canvas.w);
+  const offsetY = BigInt(y0 - donorPad.top + origin[1]) * BigInt(set.canvas.h);
+  const integerX = offsetX % BigInt(target.width) === 0n;
+  const integerY = offsetY % BigInt(target.height) === 0n;
+  return { expected, exact: scaleXUnit && scaleYUnit && integerX && integerY, map: {
+    sx: scaleXUnit ? 1 : donorPad.side / donor.canvas.w * set.canvas.w / target.width,
+    sy: scaleYUnit ? 1 : donorPad.side / donor.canvas.h * set.canvas.h / target.height,
+    tx: integerX ? Number(offsetX / BigInt(target.width)) : (x0 - donorPad.left + origin[0]) * set.canvas.w / target.width,
+    ty: integerY ? Number(offsetY / BigInt(target.height)) : (y0 - donorPad.top + origin[1]) * set.canvas.h / target.height,
+  } };
+}
+
+/** One full-canvas affine pass, using the same premultiplied float32 convention as layerToRig. */
+function transportLayer(layer: Layer, donor: LayerSet, set: LayerSet, image: Raster, d: TakeLayers, map: ScaleTranslate, exact: boolean, at: string): { layer: Layer; transport: TakenLayerTransport } {
+  const canvas = newRaster(donor.canvas.w, donor.canvas.h);
+  for (let y = 0; y < layer.pixels.height; y++) {
+    canvas.data.set(layer.pixels.data.subarray(y * layer.pixels.width * 4, (y + 1) * layer.pixels.width * 4), ((y + layer.top) * canvas.width + layer.left) * 4);
+  }
+  const [x0, y0, x1, y1] = d.crop!.box;
+  const donorPad = squarePad(x1 - x0, y1 - y0);
+  for (let y = layer.top; y < layer.bottom; y++) for (let x = layer.left; x < layer.right; x++) {
+    if (canvas.data[(y * canvas.width + x) * 4 + 3] <= OPAQUE_ALPHA_ABOVE) continue;
+    const dx = x * donorPad.side / canvas.width - donorPad.left;
+    const dy = y * donorPad.side / canvas.height - donorPad.top;
+    const tx = map.sx * x + map.tx, ty = map.sy * y + map.ty;
+    if (dx < 0 || dy < 0 || (x + 1) * donorPad.side / canvas.width - donorPad.left > x1 - x0 || (y + 1) * donorPad.side / canvas.height - donorPad.top > y1 - y0 || tx < 0 || ty < 0 || tx + map.sx > set.canvas.w || ty + map.sy > set.canvas.h) {
+      return refuse('ASSEMBLE_TAKE_CROP', at, `supported donor cell [${x}, ${y}] falls outside the declared painting crop or target canvas; the whole taken support must be retained`);
+    }
+  }
+  const out = newRaster(set.canvas.w, set.canvas.h);
+  if (exact) {
+    for (let y = 0; y < canvas.height; y++) for (let x = 0; x < canvas.width; x++) {
+      const tx = x + map.tx, ty = y + map.ty;
+      if (tx >= 0 && ty >= 0 && tx < out.width && ty < out.height) out.data.set(canvas.data.subarray((y * canvas.width + x) * 4, (y * canvas.width + x + 1) * 4), (ty * out.width + tx) * 4);
+    }
+  } else {
+    const pre = newFloatImage(canvas.width, canvas.height, 4);
+    for (let p = 0; p < canvas.width * canvas.height; p++) {
+      const a = canvas.data[p * 4 + 3];
+      for (let c = 0; c < 3; c++) pre.data[p * 4 + c] = Math.fround(canvas.data[p * 4 + c] * Math.fround(a / 255));
+      pre.data[p * 4 + 3] = a;
+    }
+    const warped = warpAffine(pre, map, out.width, out.height, 'bilinear');
+    const clip = (v: number): number => Math.max(0, Math.min(255, v));
+    for (let p = 0; p < out.width * out.height; p++) {
+      const a = Math.fround(clip(warped.data[p * 4 + 3]));
+      for (let c = 0; c < 3; c++) {
+        const value = Math.fround(clip(warped.data[p * 4 + c]));
+        const straight = Math.fround(Math.fround(value * 255) / Math.max(a, Math.fround(1e-3)));
+        out.data[p * 4 + c] = a > 0 ? Math.trunc(clip(straight)) : 0;
+      }
+      out.data[p * 4 + 3] = Math.trunc(a);
+    }
+  }
+  let opaquePx = 0;
+  for (let p = 3; p < out.data.length; p += 4) if (out.data[p] > OPAQUE_ALPHA_ABOVE) opaquePx++;
+  if (opaquePx === 0) return refuse('ASSEMBLE_TAKE_SUPPORT', at, `has 0 pixels of alpha above ${OPAQUE_ALPHA_ABOVE} after the declared transport; a nonempty taken layer is required`);
+  const transport: TakenLayerTransport = {
+    crop: [...d.crop!.box], donor_canvas: [canvas.width, canvas.height], target_canvas: [out.width, out.height],
+    scale: [map.sx, map.sy], translate: [map.tx, map.ty], filter: exact ? 'exact' : 'bilinear',
+    input_rgba_sha256: rgbaHash(image), before_rgba_sha256: rgbaHash(canvas), after_rgba_sha256: rgbaHash(out),
+  };
+  refuseIfAny(takenTransportProblems(transport, out, at));
+  return {
+    layer: { ...layer, left: 0, top: 0, right: out.width, bottom: out.height, pixels: out, opaquePx },
+    transport,
+  };
+}
+
 export function takeLayerNote(source: TakenLayerSource): string {
   return `take ${source.run}:${source.tag} from ${source.run_dir}; prompt_id ${source.prompt_id}; seed ${source.seed}; st_input ${source.st_input}; support ${source.support_px} run px; checked ${source.checked_px} input px; differing ${source.differing_px}; alpha > ${OPAQUE_ALPHA_ABOVE}, ${CORE_KERNEL}x${CORE_KERNEL} margin`;
 }
@@ -81,7 +172,10 @@ export function applyTakenLayers(runs: { full: LayerSet; head: LayerSet; single:
     const meta = metadata(resolve(base, d.run_dir, 'meta.json'));
     let image: Raster;
     try { image = readPng(resolve(base, d.st_input)); } catch { return refuse('ASSEMBLE_TAKE_INPUT', at, `st_input "${d.st_input}" must name the original readable PNG supplied to the donor run`); }
-    if (target === null || donor.canvas.w !== set.canvas.w || donor.canvas.h !== set.canvas.h || image.width !== target.width || image.height !== target.height) return refuse('ASSEMBLE_TAKE_GEOMETRY', at, `donor canvas ${donor.canvas.w}x${donor.canvas.h}, target canvas ${set.canvas.w}x${set.canvas.h}, donor st_input ${image.width}x${image.height}, target st_input ${target?.width ?? 0}x${target?.height ?? 0}; equal canvases and equal input dimensions are required (full uses squarePad; head uses head_box)`);
+    if (d.crop === undefined && (target === null || donor.canvas.w !== set.canvas.w || donor.canvas.h !== set.canvas.h || image.width !== target.width || image.height !== target.height)) return refuse('ASSEMBLE_TAKE_GEOMETRY', at, `donor canvas ${donor.canvas.w}x${donor.canvas.h}, target canvas ${set.canvas.w}x${set.canvas.h}, donor st_input ${image.width}x${image.height}, target st_input ${target?.width ?? 0}x${target?.height ?? 0}; equal canvases and equal input dimensions are required (full uses squarePad; head uses head_box)`);
+    if (target === null) return refuse('ASSEMBLE_TAKE_CROP', at, 'a target input is required for a declared crop');
+    const geometry = d.crop === undefined ? undefined : cropGeometry(d, painting, target, donor, set, inputs, at);
+    if (geometry !== undefined && (image.width !== geometry.expected.width || image.height !== geometry.expected.height)) return refuse('ASSEMBLE_TAKE_CROP', at, `donor st_input ${image.width}x${image.height}; declared square-padded crop requires ${geometry.expected.width}x${geometry.expected.height}`);
     const union = new Uint8Array(image.width * image.height);
     for (const tag of d.tags) {
       const key = `${d.run}:${tag}`;
@@ -89,10 +183,12 @@ export function applyTakenLayers(runs: { full: LayerSet; head: LayerSet; single:
       seen.add(key);
       const layer = donor.layers.find(l => l.name === tag);
       if (layer === undefined) return refuse('ASSEMBLE_TAKE_TAG_IN_RUN', at, `tag "${tag}" is absent; a named See-through tag held by that donor is required`);
-      const checked = identity(layer, donor.canvas, image, target, `${at} tag "${tag}"`);
+      const checked = identity(layer, donor.canvas, image, geometry?.expected ?? target, `${at} tag "${tag}"`);
       for (let p = 0; p < union.length; p++) union[p] |= checked.checked[p];
       const source: TakenLayerSource = { run: d.run, tag, run_dir: d.run_dir, st_input: d.st_input, prompt_id: meta.prompt_id, seed: meta.seed, support_px: checked.support, checked_px: checked.checked.reduce((a, b) => a + b, 0), differing_px: 0 };
-      const replacement: Layer = { ...layer, takenLayers: [source] };
+      const transported = geometry === undefined ? undefined : transportLayer(layer, donor, set, image, d, geometry.map, geometry.exact, `${at} tag "${tag}"`);
+      if (transported !== undefined) source.transport = transported.transport;
+      const replacement: Layer = { ...(transported?.layer ?? layer), takenLayers: [source] };
       lists[d.run] = [...lists[d.run].filter(l => l.name !== tag), replacement];
       origins.set(replacement, resolve(base, d.run_dir));
       notes.push(takeLayerNote(source));

package/src/takesource.ts

@@ -1,6 +1,28 @@
 /** Layer identity receipts, retained independently of part names and derived geometry. */
+import { createHash } from 'node:crypto';
+import type { Raster } from './raster/types.ts';
 import type { Problem } from './errors.ts';
 import { readLayerTag } from './tags.ts';
+export interface TakenLayerTransport {
+  crop: [number, number, number, number];
+  donor_canvas: [number, number];
+  target_canvas: [number, number];
+  scale: [number, number];
+  translate: [number, number];
+  filter: 'exact' | 'bilinear';
+  input_rgba_sha256: string;
+  before_rgba_sha256: string;
+  after_rgba_sha256: string;
+}
+/** Verify a transported run canvas against its sealed receipt before downstream assembly. */
+export function takenTransportProblems(transport: TakenLayerTransport, image: Raster, at: string): Problem[] {
+  const actual = createHash('sha256').update(image.data).digest('hex');
+  if (image.width !== transport.target_canvas[0] || image.height !== transport.target_canvas[1] || actual !== transport.after_rgba_sha256) {
+    return [{ code: 'PARTS_TAKEN_LAYERS', object: at,
+      detail: `transported canvas ${image.width}x${image.height}, RGBA sha256 ${actual}; receipt requires ${transport.target_canvas.join('x')}, RGBA sha256 ${transport.after_rgba_sha256}` }];
+  }
+  return [];
+}
 export interface TakenLayerSource {
   run: 'full' | 'head';
   tag: string;
@@ -11,6 +33,7 @@ export interface TakenLayerSource {
   support_px: number;
   checked_px: number;
   differing_px: 0;
+  transport?: TakenLayerTransport;
 }
 export function unionTakenSources(lists: readonly (readonly TakenLayerSource[] | undefined)[]): TakenLayerSource[] {
   const out: TakenLayerSource[] = [];
@@ -28,13 +51,27 @@ export function takenSourceProblems(value: unknown, at: string): Problem[] {
     if (typeof item !== 'object' || item === null || Array.isArray(item)) { fail('each source must be a complete identity receipt'); continue; }
     const o = item as Record<string, unknown>;
     const tag = typeof o.tag === 'string' ? readLayerTag(o.tag) : null;
-    if (Object.keys(o).some(k => !keys.includes(k)) || keys.some(k => !(k in o)) ||
+    if (Object.keys(o).some(k => !keys.includes(k) && k !== 'transport') || keys.some(k => !(k in o)) ||
         (o.run !== 'full' && o.run !== 'head') || tag === null || tag.group === 'author' ||
         ['run_dir', 'st_input', 'prompt_id'].some(k => typeof o[k] !== 'string' || !(o[k] as string).trim()) ||
         !Number.isSafeInteger(o.seed) || (o.seed as number) < 0 ||
         ['support_px', 'checked_px'].some(k => !Number.isSafeInteger(o[k]) || (o[k] as number) <= 0) || o.differing_px !== 0) {
       fail('each source requires exactly run, See-through tag, run_dir, st_input, prompt_id, nonnegative safe integer seed, positive support_px/checked_px and differing_px 0'); continue;
     }
+    if (o.transport !== undefined) {
+      const t = o.transport as Record<string, unknown> | null;
+      const fields = ['crop', 'donor_canvas', 'target_canvas', 'scale', 'translate', 'filter', 'input_rgba_sha256', 'before_rgba_sha256', 'after_rgba_sha256'];
+      const pair = (v: unknown, positive: boolean, integer: boolean): v is number[] => Array.isArray(v) && v.length === 2 && v.every(n => typeof n === 'number' && Number.isFinite(n) && (!positive || n > 0) && (!integer || Number.isSafeInteger(n)));
+      if (typeof t !== 'object' || t === null || Array.isArray(t) || Object.keys(t).length !== fields.length || fields.some(k => !(k in t)) ||
+          !Array.isArray(t.crop) || t.crop.length !== 4 || !t.crop.every(n => Number.isSafeInteger(n) && n >= 0) || t.crop[2] <= t.crop[0] || t.crop[3] <= t.crop[1] ||
+          !pair(t.donor_canvas, true, true) || !pair(t.target_canvas, true, true) || !pair(t.scale, true, false) || !pair(t.translate, false, false) ||
+          (t.filter !== 'exact' && t.filter !== 'bilinear') ||
+          ['input_rgba_sha256', 'before_rgba_sha256', 'after_rgba_sha256'].some(k => typeof t[k] !== 'string' || !/^[0-9a-f]{64}$/.test(t[k] as string))) {
+        fail('transport requires exactly crop, donor_canvas, target_canvas, scale, translate, filter and three lowercase RGBA SHA-256 hashes');
+      } else if ((t.filter === 'exact') !== (t.scale[0] === 1 && t.scale[1] === 1 && t.translate.every(Number.isSafeInteger))) {
+        fail('transport filter exact requires unit scale and integer translation; every other map requires bilinear');
+      }
+    }
     const key = JSON.stringify([o.run, o.tag, o.run_dir]);
     if (seen.has(key)) fail(`duplicate source ${key}; each source must appear once`);
     seen.add(key);