spine-rigc 1.8.0 → 1.9.0

package/cli.ts

@@ -1237,7 +1237,7 @@ function cmdBuild(flags: Record<string, string>): void {
 
   writeFileSync(join(opts.outDir, 'skeleton.json'), result.skeletonText);
   writeFileSync(join(opts.outDir, 'skeleton.atlas'), atlasText);
-  // rigc's own record of the compiled rig (`rigc-compiled/2`, issue #922;
+  // rigc's own record of the compiled rig (`rigc-compiled/3`, issue #922;
   // its `pages` the atlas just written, issue #1016), written with the pair
   // and only after the same gate — under `--pack`, the packed one. rigc's own posing core
   // reads it (`readModel`, `src/core/index.ts`, issue #380's step 2).
@@ -1588,7 +1588,7 @@ function resolveViewable(flags: Record<string, string>): {
 }
 
 /** What `render` and `check` say where a rigc build's atlas is not there (issue #1020). */
-const ATLAS_ABSENT = 'a build the core poses from a rigc-compiled/2 document needs none';
+const ATLAS_ABSENT = 'a build the core poses from a rigc-compiled/2 or /3 document needs none';
 
 /**
  * The candidate `render` and `check` draw, with its atlas text — or `null`

package/docs/AUTHORING.md

@@ -195,7 +195,7 @@ What the flags mean:
 | --- | --- |
 | `--rig` | the rig spec — skeleton structure |
 | `--motion` | the motion spec — time |
-| `--out` | directory for `skeleton.json` + `skeleton.atlas`, and on `build` `skeleton.model.json` beside them; atlas page paths and `skeleton.images` are written relative to it. `skeleton.model.json` is rigc's own record of the compiled rig (`rigc-compiled/2`: the bones, slots, skins, constraints, events and animations the Spine files were emitted from, in the spec's order, and the rest of what posing them takes; then `pages`, every page of the `skeleton.atlas` written beside it and where each region sits on it — after `--pack` the packed pages, after `--copy-images` the copies' names), written after the same gate as the pair and ending in `spine.sha256`, the digest of the `skeleton.json` written beside it. A `rigc-compiled/1` document (rigc 1.6) has no `pages` and is still read: the core then takes the placement from the atlas beside it, the `poser` line says so, and with no atlas there `render` and `check` refuse it naming the file. A `rigc-compiled/2` build is rendered and checked with its `skeleton.atlas` gone (`--candidate` below). It is what rigc's own posing core (`src/core/`) poses: `render` and `check` — and `bench --frames`, which folds `check` in — pose a build through it, and `--poser` below says when they do not. On `check` it is a directory of **pictures** instead: one per frame the table lists (every compared frame under `--all-frames`), reference · candidate · difference · overlay at the comparison grid's native size, as `<dir>/<set>/f####.png` beside a `frames.json` that says what they are pictures of. Each `<dir>/<set>/` is cleared first; a file at `<dir>`, or a directory that is or holds `--frames`, is refused by name — **§9.2.1** |
+| `--out` | directory for `skeleton.json` + `skeleton.atlas`, and on `build` `skeleton.model.json` beside them; atlas page paths and `skeleton.images` are written relative to it. `skeleton.model.json` is rigc's own record of the compiled rig (`rigc-compiled/3`: the stage the header declares, or `null`; the bones, slots, skins, constraints, events and animations the Spine files were emitted from, in the spec's order, and `editorOrder`, the order `skeleton.json` lists the skins, each skin's slot keys and the animations in; the rest of what posing them takes; then `pages`, every page of the `skeleton.atlas` written beside it, its `pma` and its `scale:` line (`null` where it states none), and where each region sits on it — after `--pack` the packed pages, after `--copy-images` the copies' names), written after the same gate as the pair and ending in `spine.sha256`, the digest of the `skeleton.json` written beside it. A `rigc-compiled/2` document (rigc 1.7) states no stage, editor order, `pma` or `scale`, and is still read: `render` and `check` then read those off `skeleton.json` and the atlas, and the `poser` line names both files. A `rigc-compiled/1` document (rigc 1.6) has no `pages` either and is still read: the core then takes the placement from the atlas beside it, the `poser` line says so, and with no atlas there `render` and `check` refuse it naming the file. A `rigc-compiled/2` or `/3` build is rendered and checked with its `skeleton.atlas` gone (`--candidate` below). It is what rigc's own posing core (`src/core/`) poses: `render` and `check` — and `bench --frames`, which folds `check` in — pose a build through it, and `--poser` below says when they do not. On `check` it is a directory of **pictures** instead: one per frame the table lists (every compared frame under `--all-frames`), reference · candidate · difference · overlay at the comparison grid's native size, as `<dir>/<set>/f####.png` beside a `frames.json` that says what they are pictures of. Each `<dir>/<set>/` is cleared first; a file at `<dir>`, or a directory that is or holds `--frames`, is refused by name — **§9.2.1** |
 | `--copy-images` | `build` only: also copies every page **the emitted atlas names** into `--out` and rewrites the atlas to the copies, so the directory is self-contained enough to zip or commit on its own, and points `skeleton.images` at `--out` itself so the editor's import finds the parts beside the skeleton (§3.1 says why it is spelled `../<out>/` and not `./`). Under `--atlas-in` those pages are the pack's, not one per part (**§0.2**). Without it, page paths point at the source art |
 | `--pack` | `build` only: arrange every part onto **shared** atlas page(s), written into `--out` as real PNGs, instead of one page per part. Lossless — nothing is resampled, trimmed or rotated. The default is one page per part — **§0.1** |
 | `--page-size` | `build --pack` only: the largest page edge (default `2048`). A ceiling, not the size: page edges are powers of two and the one written is the smallest that holds the pack — **§0.1** |
@@ -207,10 +207,10 @@ What the flags mean:
 | `--cut` | `build`, `explain` and `validate`: look up a named cut in `--cuts <cuts.json>`, **instead of** `--rig`/`--motion`/`--out` — the two spellings are one build stated two ways and are refused together. A `cuts.json` is `{ "<name>": { "rig": …, "motion": …, "out": …, "manifest"?: … } }`, every path in it relative to the table's own file, so the table lives with the project that owns the art |
 | `--cuts` | the `cuts.json` `--cut` names. Required beside it — `--cut` alone is refused, with no guess at where the table lives |
 | `--profile` | `spine` = the 34 validity rules (**the default**) · `spine-html` = all 49, opt-in |
-| `--candidate` | `check`, `bench`, `render`, `preview`, `chainfit` and `vote` only: a **compiled** artifact — the directory `build --out` wrote, or a `skeleton.json` path. `--atlas <path>` names the atlas when it does not sit beside the skeleton. On `render` and `check` a rigc build whose `skeleton.model.json` is `rigc-compiled/2` needs no atlas at all: with no `--atlas` and no atlas beside it, it is drawn from the document's `pages`, the same frames, geometry and figures as with it, and the `atlas` line says `— not there`. An atlas that is there is still read, and held to `pages`: one that differs (edited after the build) is drawn through spine-core, and the `poser` line names the first difference. A build drawn through an atlas that is not there — a `rigc-compiled/1` document, or a build the core refuses — is refused `nothing at <the atlas>: … is drawn through its atlas (<why>)`, exit 2, nothing written; a Spine export without its atlas is refused `nothing at <the atlas>` as it always was. With the atlas gone, `check`'s texture note says whether it declares a `scale:` line is not read (the document does not state one), and `check.json`'s `textureFrom.candidateScales` is `null` (`RC13`). **`vote` and `preview` take it more than once**: `vote` 2–4 times, one per pane, labelled A, B, C, D in the order given; `preview` any number of times, one pane per candidate in the order given, each headed by its path and its gate line, and the same skeleton twice (a directory and its `skeleton.json` are one) is refused by name. `--atlas` goes with one candidate only. Everywhere else a repeat is a typo and is refused |
+| `--candidate` | `check`, `bench`, `render`, `preview`, `chainfit` and `vote` only: a **compiled** artifact — the directory `build --out` wrote, or a `skeleton.json` path. `--atlas <path>` names the atlas when it does not sit beside the skeleton. On `render` and `check` a rigc build whose `skeleton.model.json` is `rigc-compiled/3` or `/2` needs no atlas at all: with no `--atlas` and no atlas beside it, it is drawn from the document's `pages`, the same frames, geometry and figures as with it, and the `atlas` line says `— not there`. An atlas that is there is still read, and held to `pages`: one that differs (edited after the build) is drawn through spine-core, and the `poser` line names the first difference. A build drawn through an atlas that is not there — a `rigc-compiled/1` document, or a build the core refuses — is refused `nothing at <the atlas>: … is drawn through its atlas (<why>)`, exit 2, nothing written; a Spine export without its atlas is refused `nothing at <the atlas>` as it always was. With the atlas gone, `check` on a `rigc-compiled/3` build reads its pages' `scale:` lines off the document, so its texture note and `check.json`'s `textureFrom.candidateScales` are what they are with the atlas; on a `/2` build its texture note says whether the atlas declares a `scale:` line is not read (that document does not state one), and `candidateScales` is `null` (`RC13`). **`vote` and `preview` take it more than once**: `vote` 2–4 times, one per pane, labelled A, B, C, D in the order given; `preview` any number of times, one pane per candidate in the order given, each headed by its path and its gate line, and the same skeleton twice (a directory and its `skeleton.json` are one) is refused by name. `--atlas` goes with one candidate only. Everywhere else a repeat is a typo and is refused |
 | `--animation` | `render`, `preview` and `vote` only: which animation to show. The default is **every** one for `render`, the **first** for `preview` (each candidate's own first, with several), and for `vote` the first of candidate A. A name the skeleton does not have is refused, with the ones it does have listed — and for `vote` and a several-candidate `preview`, so is a name that only *some* candidates have, naming the one that lacks it |
 | `--geometry` | `render` only: also write a `geometry.json` into each frame directory — per frame, every bone's world transform and every slot's region or mesh vertices in world units after skinning, plus each attachment's rest geometry and topology, on the frames' own grid and viewport. Every other file is byte for byte what the render writes without it. Refused with `--slot`/`--hide`, because the geometry is the whole pose whatever is drawn — **§8.2** |
-| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core. Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `the "default" skin names` (no `--skin`, and the default skin names a skin-required bone or constraint, each named) · `and no "default" one` (no `--skin`, and skins with none named `default` — spine-core draws nothing there either, so the render stops at `there is nothing to draw`, exit 2, and only `--poser core` prints this refusal) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; the order its animations and skins are listed in, and its stage, off its own `skeleton.json`, because the document states neither; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`). On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1) |
+| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core. Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `the "default" skin names` (no `--skin`, and the default skin names a skin-required bone or constraint, each named) · `and no "default" one` (no `--skin`, and skins with none named `default` — spine-core draws nothing there either, so the render stops at `there is nothing to draw`, exit 2, and only `--poser core` prints this refusal) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; so do the order its animations and skins are listed in, its stage and its pages' `scale:` lines, on a `rigc-compiled/3` document (`editorOrder`, `stage`, `pages`) — a `/2` or `/1` document states none of those, so they come off its own `skeleton.json` and atlas, and the `poser` line then says `a rigc-compiled/2 document, which does not state the order its skins and animations are listed in or its stage, read from` and names both files; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`). On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1) |
 | `--record` | `vote` only: a saved vote to check against its ballot and append to the ledger, instead of writing a ballot. This is the command's second mode; it takes no `--candidate` |
 | `--ballot` | `vote --record` only: the ballot the vote answers (default `ballot.html`). Its embedded manifest is what the vote is checked against, so the ballot file is the record of the question |
 | `--ledger` | `vote --record` only: the append-only JSONL the vote lands in (default `votes.jsonl`), one vote per line |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-rigc",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "AI-authored Spine 2D rigging and animation, verified before it is written. rigc compiles a rig spec into Spine 4.3 skeleton data, round-trips it through spine-core and named assertions, and emits nothing that fails. Output imports into the Spine editor. Ships as an agent skill.",
   "type": "module",
   "bin": {

package/src/assertions/bodies/a04.ts

@@ -0,0 +1,40 @@
+/**
+ * A04, the body (issue #1025, step 4c of #380): every mesh has triangles, in
+ * threes, each an index into its own vertices (case 6f).
+ *
+ * Moved out of `src/validate.ts` clause by clause. The three clauses about
+ * the triangles are about the rig — a document's mesh states its triangles
+ * and its vertices, so the same wrongness has a place to live there (where
+ * the reader refuses two of the three by the record's name) — and moved. The
+ * two about the vertex run — a weighted run whose length is not a multiple of
+ * three, an unweighted array of another length than the `uvs` — are about
+ * the encoding: the document states the weighted form outright, and the flat
+ * run is written by the emitter. They stay with the round trip, which hands
+ * their findings in as each mesh's `encoding`, printed where the body always
+ * printed them.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { MeshFacts } from '../facts/mesh_attachments.ts';
+import { SKIP_NO_MESH_ATTACHMENT } from '../reasons.ts';
+
+export function a04MeshTrianglesAndEncoding({ fail, skip }: Verdicts, { meshes }: MeshFacts): void {
+  if (meshes.length === 0) return skip('A04_MESH_TRIANGLES_AND_ENCODING', SKIP_NO_MESH_ATTACHMENT);
+  for (const mesh of meshes) {
+    if (!mesh.triangles || mesh.triangles.length === 0) {
+      fail('A04_MESH_TRIANGLES_AND_ENCODING', `mesh "${mesh.name}" has no triangles`);
+      continue;
+    }
+    if (mesh.triangles.length % 3 !== 0) {
+      fail('A04_MESH_TRIANGLES_AND_ENCODING', `mesh "${mesh.name}" triangle count is not a multiple of 3`);
+    }
+    const vertexCount = mesh.worldVerticesLength / 2;
+    for (const idx of mesh.triangles) {
+      if (idx < 0 || idx >= vertexCount) {
+        fail('A04_MESH_TRIANGLES_AND_ENCODING', `mesh "${mesh.name}" index ${idx} is outside 0..${vertexCount - 1}`);
+        break;
+      }
+    }
+    // The encoding's own clauses, kept with the round trip (the header).
+    for (const detail of mesh.encoding) fail('A04_MESH_TRIANGLES_AND_ENCODING', detail);
+  }
+}

package/src/assertions/bodies/a06.ts

@@ -0,0 +1,195 @@
+/**
+ * A06, the body (issue #1025, step 4c of #380): every page the atlas names is
+ * the size its PNG is, every region lies inside its page, and — under
+ * `spine-html` — no page claims premultiplied alpha, no two regions on one page
+ * overlap and no region is turned.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the pages and
+ * regions are a fact (`../facts/atlas_regions.ts`), the directory is the
+ * caller's, and the profile's policy switch is passed in. The `check` call —
+ * and the argument for the SKIP guards it shares with A17 and A19 (#568, #608)
+ * — stays in `validate()`.
+ */
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { Verdicts } from '../harness.ts';
+import type { AtlasRegionEntry, AtlasRegionFacts } from '../facts/atlas_regions.ts';
+import { SKIP_NO_ATLAS, SKIP_NO_ATLAS_PAGE } from '../reasons.ts';
+import { pageFootprint, pageGridSentence } from '../../atlas.ts';
+import { readPngHeader } from '../../png.ts';
+
+export function a06AtlasPageSizeMatchesPng({ fail, skip }: Verdicts, { atlas }: AtlasRegionFacts, input: { atlasDir: string }, policy: boolean): void {
+  if (!atlas) return skip('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', SKIP_NO_ATLAS);
+  if (atlas.pages.length === 0) return skip('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', SKIP_NO_ATLAS_PAGE);
+  for (const page of atlas.pages) {
+    const abs = resolve(input.atlasDir, page.name);
+    if (!existsSync(abs)) continue; // A17 owns this
+    // 🔒 **A page that is not a PNG is a named failure, not a throw** (issue
+    // #732). The reader's throw used to reach this rule's catch and print as
+    // `threw: not a PNG (bad signature)`: the verdict right, the sentence a
+    // stack message that named neither what the file was nor what rigc reads.
+    // `pngProblem` ([`src/png.ts`](png.ts)) is the one sentence every reader
+    // of a page states; this rule prefixes the size the atlas declares, the
+    // value the file would have had to carry.
+    //
+    // ⚠️ No size is read off a file rigc cannot decode, deliberately. A WebP
+    // header carries its dimensions in a fixed field, and reading them would
+    // print a number no oracle in this tree has checked (rigc links no WebP
+    // reader to compare a parse against), about a page that is refused here
+    // either way — and measured, the variant that PASSED a WebP page whose
+    // size agreed built green under the default profile and wrote a
+    // directory that `render` then refused.
+    const header = readPngHeader(abs);
+    if (header.problem !== null) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `page "${page.name}" declares ${page.width}x${page.height} and its file cannot be read as PNG, so the ` +
+          `size was not measured: ${header.problem}`,
+      );
+    }
+    const info = header.info;
+    const onPage = atlas.regions.filter((region) => region.page.name === page.name);
+    const gridSaid = info === null ? null : pageGridSentence(page, info, onPage);
+    if (gridSaid !== null) {
+      // 🔒 **Still validity, and now for a measured reason rather than an
+      // inherited one** (issue #715). The card that opened this expected the
+      // clause to move behind the profile switch once the runtime's mapping
+      // was measured — it is declared-size-relative, so a rescaled page
+      // draws. What settles it the other way is that the sentence below can
+      // name a repair the FORMAT already provides (`scale:`), and that two of
+      // the three readers a wrong grid breaks are rigc's own and run under
+      // both profiles. The sentence, and the one derivation of the ratio under
+      // it, is `pageGridSentence` in [`src/atlas.ts`](atlas.ts): the compiler's
+      // region lift states the same one when it is asked for texels on such a
+      // page (issue #750), so the two cannot come to describe one page two ways.
+      fail('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', gridSaid);
+    }
+    // 📐 PROFILE, from here down. `pma: false` and no rotation are rigc's atlas
+    // CONVENTION, not the atlas format's rules — a packed page with
+    // `rotate: 90` is what the Spine packer produces and every official example
+    // ships one. Under `spine` an atlas is judged only on whether its declared
+    // size matches the file it names.
+    if (policy && page.pma) {
+      fail('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', `page "${page.name}" claims premultiplied alpha; parts are straight alpha`);
+    }
+  }
+  // 🔒 **A region's rectangle lies inside the page it names, and that is
+  // VALIDITY** (issue #694). The clause is not new — it has read the same four
+  // numbers since issue #266 — but it stood inside the policy half below, and
+  // behind a guard that skipped any page carrying one region that covered it.
+  // Both fences were wrong for it. A rectangle that leaves its page is not a
+  // convention somebody else may hold differently: `u2 > 1` samples whatever
+  // the wrap mode returns, which is never the drawing the pack was made of, so
+  // the part draws garbage or nothing at all. Measured on a pack shaped like
+  // the two production atlases that found this — a page declaring 2048x256
+  // with regions at `2274,0 980x200` and `0,252 100x258` — every atlas
+  // assertion passed under the default profile and the first of the two parts
+  // drew 0 of the 10,517 pixels it draws when the same rig is built loose.
+  //
+  // ⭐ The tool's other half already said so, which is what settles where the
+  // clause belongs. `resolveFromAtlas` ([`src/compile.ts`](compile.ts)) refuses
+  // exactly this rectangle as a `CompileError` under every profile when a pack
+  // arrives through `--atlas-in`, so while it was policy here the compiler and
+  // the gate disagreed about the same four numbers — and the gate is the only
+  // half that a skeleton and a pack somebody else made ever reach.
+  //
+  // ⚠️ It is stated over `atlas.regions` rather than per page group, because
+  // the question is about one region and its own page and needs no neighbour:
+  // a page carrying a single full-page region is measured too, and answers
+  // trivially. The rectangle is `pageFootprint`'s and nobody else's here
+  // (issue #579): what `TextureAtlas` transposes at 90 and not at 270 is
+  // `u2`/`v2`, a UV pair `MeshAttachment.computeUVs` never reads for an atlas
+  // region, and the page rectangle is a different quantity — transposed at
+  // BOTH quarter turns. A region that fits only *because* it is turned is
+  // inside its page, and this clause says so.
+  for (const region of atlas.regions) {
+    const foot = pageFootprint(region);
+    if (
+      region.x < 0 ||
+      region.y < 0 ||
+      region.x + foot.width > region.page.width ||
+      region.y + foot.height > region.page.height
+    ) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `region "${region.name}" occupies ${region.x},${region.y} ${foot.width}x${foot.height} of page ` +
+          `"${region.page.name}", which is ${region.page.width}x${region.page.height} — a region that runs off ` +
+          'its page samples texels that are not there',
+      );
+    }
+  }
+  if (!policy) return;
+  // ⭐ **One part per page OR a tiling page** (issue #266, follow-up 2). This
+  // clause used to be the first alternative alone — every region's UVs
+  // `(0,0)-(1,1)` — which is rigc's *unpacked* convention and exactly what
+  // `build --pack` stops being true, so `--pack --profile spine-html` had to be
+  // a named CLI refusal. A pack is not a defect, and refusing it under this
+  // profile meant the one shape that exercises the renderer's shared-page
+  // sampling could never be gated by the renderer's own rulebook.
+  //
+  // What the first alternative bought was the attachment -> region -> file
+  // chain being checkable exactly, and `A27` already owns that half and already
+  // stands down on a multi-region page. What is left to check on a *tiling*
+  // page is what makes shared-page sampling well defined at all: no two regions
+  // on one page overlapping. A foreign pack can fail that while loading clean,
+  // and two overlapping rectangles put one drawing inside another's.
+  //
+  // ⚠️ Its sibling — every region inside the page it names — moved above and
+  // out of this profile in issue #694, and the two are not symmetrical. That
+  // one is broken for every consumer; this one is a statement about what a
+  // pack MEANS, and the corpus is the evidence rather than the taste:
+  // measured over the ten atlases in `examples/`, 0 of 132 regions are off
+  // their page and 49 pairs on four of those pages overlap, editor-exported
+  // and correct. A rule that called those files broken would be one
+  // consumer's convention refusing everybody else's data, which is the thing
+  // the profile split exists to prevent.
+  //
+  // ⚠️ Rotation stays refused either way, and that is not the same clause: it
+  // is about rigc's own packer never turning a region, which is a statement
+  // about what rigc WRITES. It stopped being a statement about what rigc can
+  // read in issue #570 — `extractRegion` now lifts a rotated region back off
+  // its page, measured against `MeshAttachment.computeUVs` (`PKR02`) — and the two
+  // must not be re-merged: an artifact under the renderer's own rulebook that
+  // rigc did not pack is still a foreign artifact, whatever rigc can measure.
+  const regionsPerPage = new Map<string, AtlasRegionEntry[]>();
+  for (const region of atlas.regions) {
+    const on = regionsPerPage.get(region.page.name);
+    if (on) on.push(region);
+    else regionsPerPage.set(region.page.name, [region]);
+  }
+  for (const [pageName, on] of regionsPerPage) {
+    // The `onePartPerPage` guard that stood here went with the clause it was
+    // written for: with only the pair check left, a page carrying one region
+    // has no pair and the loop below does nothing on it anyway. Nothing reads
+    // `u`/`v`/`u2`/`v2` in this assertion any more, which is the point of
+    // #579 kept rather than restated.
+    const rects = on.map((region) => {
+      const foot = pageFootprint(region);
+      return { name: region.name, x: region.x, y: region.y, width: foot.width, height: foot.height };
+    });
+    for (let i = 0; i < rects.length; i++) {
+      for (let j = i + 1; j < rects.length; j++) {
+        const a = rects[i];
+        const b = rects[j];
+        if (a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height) {
+          fail(
+            'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+            `regions "${a.name}" (${a.x},${a.y} ${a.width}x${a.height}) and "${b.name}" (${b.x},${b.y} ` +
+              `${b.width}x${b.height}) overlap on page "${pageName}"; a page is one part covering it exactly or ` +
+              'a tiling of regions that do not, and two rectangles over the same texels put one drawing inside ' +
+              "the other's",
+          );
+        }
+      }
+    }
+  }
+  for (const region of atlas.regions) {
+    if (region.degrees !== 0) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `region "${region.name}" is rotated; rigc's own packer never turns a region (see PACK_NO_ROTATE in ` +
+          'src/atlas.ts), so this atlas came from somewhere else',
+      );
+    }
+  }
+}

package/src/assertions/bodies/a08.ts

@@ -0,0 +1,76 @@
+/**
+ * A08, the body (issue #1025, step 4c of #380): every region an attachment
+ * resolves through is a region the atlas has, spelled exactly.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the atlas's
+ * region names and the skin entries' lookups are a fact
+ * (`../facts/region_joins.ts`) rather than a `TextureAtlas` built here and the
+ * raw JSON's walk. Why the rule runs before the round trip, and what A00 does
+ * about a miss it names, is argued above the `check` call in `validate()`,
+ * which stays there.
+ *
+ * `pathsWithNoRegion` is filled, not read: every lookup this body refuses for
+ * want of a region, which `validate()`'s A00 reads to defer to this rule rather
+ * than restate the miss. The model side hands a set nobody reads.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { RegionJoinFacts } from '../facts/region_joins.ts';
+import { SKIP_NO_ATTACHMENT_REGION_JOIN } from '../reasons.ts';
+
+export function a08RegionNamesMatchAttachments({ fail, skip }: Verdicts, facts: RegionJoinFacts, pathsWithNoRegion: Set<string>): void {
+  if (facts.regionNames === null) {
+    return skip(
+      'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+      'the atlas text does not parse, so there are no region names to join against (A00 owns that failure)',
+    );
+  }
+  const regionNames = new Set(facts.regionNames);
+  if (facts.joins === null) {
+    return skip('A08_REGION_NAMES_MATCH_ATTACHMENTS', 'the skeleton JSON did not parse (A00 owns that failure)');
+  }
+  let joined = 0;
+  for (const join of facts.joins) {
+    // A `sequence` the walk will not guess at: say nothing rather than invent
+    // a region name. A00 still has the last word on it.
+    if (join.lookups === null) continue;
+    for (const lookup of join.lookups) {
+      joined++;
+      const at = `skin "${join.skin}" slot "${join.slot}" placeholder "${join.placeholder}"`;
+      const present = regionNames.has(lookup);
+      if (!present) pathsWithNoRegion.add(lookup);
+      if (lookup !== lookup.trim()) {
+        fail(
+          'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+          `${at}: attachment "${join.name}" resolves through path ${JSON.stringify(lookup)}, which has stray ` +
+            `whitespace — the atlas is matched on the exact string, and ${
+              present
+                ? 'the region it finds carries the same padding'
+                : regionNames.has(lookup.trim())
+                  ? `the region this atlas has is ${JSON.stringify(lookup.trim())}, without it`
+                  : 'no region of this atlas carries it'
+            }`,
+        );
+      } else if (!present) {
+        // Not a guess and not a repair — a region the atlas DOES hold that
+        // differs from the wanted name only by case or padding. It is
+        // reported because it was measured, and where there is none the
+        // sentence says nothing at all.
+        const near = [...regionNames].find((r) => r.trim().toLowerCase() === lookup.toLowerCase());
+        fail(
+          'A08_REGION_NAMES_MATCH_ATTACHMENTS',
+          `${at}: attachment "${join.name}" wants region "${lookup}", which this atlas does not have${
+            near === undefined ? '' : ` — it does have ${JSON.stringify(near)}`
+          }. Either the skeleton's "path" or the atlas region name is the one that moved`,
+        );
+      }
+    }
+  }
+  for (const region of regionNames) {
+    if (region !== region.trim()) {
+      fail('A08_REGION_NAMES_MATCH_ATTACHMENTS', `atlas region ${JSON.stringify(region)} has stray whitespace`);
+    }
+  }
+  if (joined === 0 && regionNames.size === 0) {
+    return skip('A08_REGION_NAMES_MATCH_ATTACHMENTS', SKIP_NO_ATTACHMENT_REGION_JOIN);
+  }
+}

package/src/assertions/bodies/a13.ts

@@ -0,0 +1,51 @@
+/**
+ * A13, the body (issue #1025, step 4c of #380): the mesh slots and each mesh's
+ * triangles stay within the budget the rig declares.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the meshes
+ * are a fact (`../facts/skin_meshes.ts`) rather than the lists `validate()`'s
+ * prelude filled from spine-core's loaded skins, and the rig info is the
+ * caller's. Why the two budgets come from the rig and never from here stays
+ * above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkinMeshFacts } from '../facts/skin_meshes.ts';
+import { SKIP_NO_MESH_ATTACHMENT } from '../reasons.ts';
+import type { RigInfo } from '../../types.ts';
+
+export function a13MeshBudget({ fail, skip }: Verdicts, { meshes }: SkinMeshFacts, input: { rig?: RigInfo }): void {
+  const meshAttachments = meshes;
+  const meshSlots = new Set(meshes.map((mesh) => mesh.slot));
+  const slotBudget = input.rig?.meshSlotBudget ?? null;
+  const triangleBudget = input.rig?.meshTriangleBudget ?? null;
+  if (slotBudget === null && triangleBudget === null) {
+    return skip(
+      'A13_MESH_BUDGET',
+      input.rig
+        ? `the rig "${input.rig.archetype}" declares no \`invariants.meshSlots\` or \`invariants.meshTriangles\` budget`
+        : 'no rig info (validating a bare directory), so no budget is declared',
+    );
+  }
+  // Two clauses and only one of them has a subject that can vanish (#580).
+  // A slot budget is a ceiling on a COUNT, and zero is a count — "this rig
+  // uses 0 of its 3 mesh slots" is a measurement — so that half holds on a
+  // skeleton with no mesh. A triangle budget is a ceiling on each mesh, so a
+  // rig that declares only that one and carries no mesh has measured
+  // nothing at all.
+  if (slotBudget === null && meshAttachments.length === 0) {
+    return skip(
+      'A13_MESH_BUDGET',
+      `the rig "${input.rig?.archetype}" budgets mesh triangles and nothing else, and ${SKIP_NO_MESH_ATTACHMENT}`,
+    );
+  }
+  if (slotBudget !== null && meshSlots.size > slotBudget) {
+    fail('A13_MESH_BUDGET', `${meshSlots.size} mesh slots, the rig budgets ${slotBudget}`);
+  }
+  if (triangleBudget === null) return;
+  for (const mesh of meshAttachments) {
+    const tris = (mesh.triangles?.length ?? 0) / 3;
+    if (tris > triangleBudget) {
+      fail('A13_MESH_BUDGET', `mesh "${mesh.name}" has ${tris} triangles, the rig budgets ${triangleBudget}`);
+    }
+  }
+}

package/src/assertions/bodies/a14.ts

@@ -0,0 +1,35 @@
+/**
+ * A14, the body (issue #1025, step 4c of #380): no mesh spans the whole
+ * stage.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the meshes
+ * and the stage are facts (`../facts/skin_meshes.ts`, `../facts/stage.ts`)
+ * rather than spine-core's loaded skins and skeleton header. The `check` call
+ * stays in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkinMeshFacts } from '../facts/skin_meshes.ts';
+import type { StageFacts } from '../facts/stage.ts';
+
+export function a14NoFullFrameMesh({ fail, skip }: Verdicts, { meshes }: SkinMeshFacts, stage: StageFacts): void {
+  const meshAttachments = meshes;
+  const stageW = stage.width || 0;
+  const stageH = stage.height || 0;
+  // ⚠️ A stage-less skeleton has nothing for a mesh to span, and this rule
+  // used to report that as a PASS — the `stageW && stageH` guard below reads
+  // as a measurement of a 0x0 stage that no mesh can reach. It was only ever
+  // reachable from a foreign file until a rig spec could *declare* no stage
+  // (issue #578), and a pass certifying an unmeasured rig is the exact
+  // failure mode `A21_MESH_RIM_PINNED`'s `|| 'ring'` default was (#44).
+  if (!stageW || !stageH) {
+    return skip(
+      'A14_NO_FULL_FRAME_MESH',
+      'the skeleton declares no stage size, so there is no full frame for a mesh to span',
+    );
+  }
+  for (const mesh of meshAttachments) {
+    if (mesh.width >= stageW && mesh.height >= stageH) {
+      fail('A14_NO_FULL_FRAME_MESH', `mesh "${mesh.name}" spans the whole ${stageW}x${stageH} stage`);
+    }
+  }
+}

package/src/assertions/bodies/a15.ts

@@ -0,0 +1,97 @@
+/**
+ * A15, the body (issue #1025, step 4c of #380): `idle` keys no bone that
+ * drives a mesh, unless the rig declares that its idle deforms them.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the meshes
+ * and the bones that drive them are a fact (`../facts/skin_meshes.ts`) rather
+ * than spine-core's loaded skins and the weight run decoded here, the bones
+ * `idle` keys are a fact (`../facts/animated_bones.ts`) rather than the raw
+ * JSON, and the rig info is the caller's. Why the rule assumes meshes are
+ * mostly static, and why a painting rig may say otherwise, stays above the
+ * `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { MeshEntry, SkinMeshFacts } from '../facts/skin_meshes.ts';
+import type { AnimatedBoneFacts } from '../facts/animated_bones.ts';
+import type { RigInfo } from '../../types.ts';
+
+export function a15IdleNoMeshBoneKeys({ fail, skip }: Verdicts, { meshes }: SkinMeshFacts, animated: AnimatedBoneFacts, input: { rig?: RigInfo }): void {
+  const A15 = 'A15_IDLE_NO_MESH_BONE_KEYS';
+  /**
+   * Every mesh attachment, loaded, with the bones that drive it — its slot's
+   * bone, and, once weights exist, every bone its weights name. A ring mesh
+   * is driven by its CONTROL bone, a different bone from the slot's, and
+   * checking only the slot bone would let `idle` key the one bone that
+   * actually dirties the canvas every frame.
+   */
+  const meshDrivers: Array<{ mesh: MeshEntry; bones: Set<string> }> = [];
+  for (const mesh of meshes) {
+    const bones = new Set<string>([mesh.slotBone]);
+    for (const bone of mesh.weightBones) bones.add(bone);
+    meshDrivers.push({ mesh, bones });
+  }
+  const meshBoneNames = new Set<string>();
+  for (const { bones } of meshDrivers) for (const name of bones) meshBoneNames.add(name);
+  const declared = input.rig?.idleDrivesMeshes ?? null;
+  /**
+   * A declaration that switches off nothing is refused rather than skipped,
+   * the standard `consumerDrivenMix` is held to: an opt-out that exempts
+   * nothing reads exactly like one that worked, and the next reader cannot
+   * tell the rig that needs it from the rig it was copied onto.
+   */
+  const stale = (why: string): void => {
+    fail(
+      A15,
+      `the rig "${input.rig?.archetype}" declares invariants.idleDrivesMeshes ("${declared}"), but ${why}, so the ` +
+        'declaration switches off nothing — remove it',
+    );
+  };
+  // The same shape as A06's and A17's guards, found by auditing for it
+  // (#568): a rig with no `idle` at all has nothing here to be wrong, and a
+  // rule that reports "held" over a subject that does not exist is the
+  // vacuous pass this file's own doctrine refuses. The two states get their
+  // own sentences because they are different absences — no such animation,
+  // versus one that keys no bone.
+  const idleBones = animated.bonesKeyedBy('idle');
+  if (idleBones === undefined) {
+    if (declared !== null) return stale('the skeleton declares no "idle" animation');
+    return skip(A15, 'the skeleton declares no "idle" animation, so nothing here can key a mesh-driving bone');
+  }
+  if (idleBones === null) {
+    if (declared !== null) return stale('"idle" carries no bone timeline at all');
+    return skip(A15, '"idle" carries no bone timeline at all, so there is no key to hold against the mesh-driving bones');
+  }
+  const keyed = idleBones.filter((name) => meshBoneNames.has(name));
+  if (declared !== null) {
+    if (keyed.length === 0) return stale('"idle" keys no bone that drives a mesh');
+    const keyedSet = new Set(keyed);
+    const moved = meshDrivers.filter(({ bones }) => [...bones].some((name) => keyedSet.has(name)));
+    // `worldVerticesLength` is two numbers per vertex whatever the encoding,
+    // which is the count the runtime recomputes; reading `vertices.length`
+    // would count a weighted mesh's bone entries instead.
+    const vertices = moved.reduce((sum, { mesh }) => sum + mesh.worldVerticesLength / 2, 0);
+    const SHOWN = 8;
+    const names =
+      keyed.slice(0, SHOWN).map((name) => `"${name}"`).join(', ') + (keyed.length > SHOWN ? ` +${keyed.length - SHOWN}` : '');
+    return skip(
+      A15,
+      `declared by the rig ("${declared}"): idle keys ${keyed.length} bone(s) that drive ${moved.length} mesh ` +
+        `attachment(s) totalling ${vertices} vertices — ${names} — and each of those meshes is recomputed on every ` +
+        'frame it is shown',
+    );
+  }
+  for (const [i, boneName] of keyed.entries()) {
+    // The case is named once, on the first line an agent reads, rather than
+    // after every bone: the first painting rig this met printed 42 of these,
+    // and 42 identical sentences read as 42 separate mistakes. It rides the
+    // first finding rather than being a finding of its own, so the count of
+    // FAIL lines is still the count of bones.
+    const hint =
+      i > 0
+        ? ''
+        : `. ${keyed.length} bone(s) keyed by idle drive meshes; if this idle is meant to deform them (a painting ` +
+          'rig), declare invariants.idleDrivesMeshes: { "why": … } in the rig spec — or, where the motion belongs to ' +
+          'a pivot above the mesh, key that pivot one link up (FACE.md §3)';
+    fail(A15, `idle keys bone "${boneName}", which drives a mesh — meshes never idle-skip${hint}`);
+  }
+}