spine-rigc 1.9.0 → 1.9.1

package/cli.ts

@@ -158,6 +158,7 @@ import {
   PoserChoiceError,
   refuseUnchosen,
   CandidateAtlasError,
+  CandidatePairError,
   SpineRuntimeError,
   throughPoser,
   type Frame,
@@ -4383,6 +4384,14 @@ try {
     console.error(`rigc ${command}: ${err.message}`);
     process.exit(2);
   }
+  // A skeleton spine-core could not load against the atlas beside it (issue #1033) — on a rigc build, a
+  // skeleton.json or an atlas from another build beside this one's model document. The same class as the
+  // missing atlas above: nothing was posed or written, and it is the directory the command was pointed at that
+  // has to change. The message names both files, the reason the runtime drew them and the runtime's own words.
+  if (err instanceof CandidatePairError) {
+    console.error(`rigc ${command}: ${err.message}`);
+    process.exit(2);
+  }
   if (err instanceof SpineRuntimeError) {
     console.error(`rigc ${command}: ${err.message}`);
     process.exit(1);

package/docs/AUTHORING.md

@@ -207,10 +207,10 @@ What the flags mean:
 | `--cut` | `build`, `explain` and `validate`: look up a named cut in `--cuts <cuts.json>`, **instead of** `--rig`/`--motion`/`--out` — the two spellings are one build stated two ways and are refused together. A `cuts.json` is `{ "<name>": { "rig": …, "motion": …, "out": …, "manifest"?: … } }`, every path in it relative to the table's own file, so the table lives with the project that owns the art |
 | `--cuts` | the `cuts.json` `--cut` names. Required beside it — `--cut` alone is refused, with no guess at where the table lives |
 | `--profile` | `spine` = the 34 validity rules (**the default**) · `spine-html` = all 49, opt-in |
-| `--candidate` | `check`, `bench`, `render`, `preview`, `chainfit` and `vote` only: a **compiled** artifact — the directory `build --out` wrote, or a `skeleton.json` path. `--atlas <path>` names the atlas when it does not sit beside the skeleton. On `render` and `check` a rigc build whose `skeleton.model.json` is `rigc-compiled/3` or `/2` needs no atlas at all: with no `--atlas` and no atlas beside it, it is drawn from the document's `pages`, the same frames, geometry and figures as with it, and the `atlas` line says `— not there`. An atlas that is there is still read, and held to `pages`: one that differs (edited after the build) is drawn through spine-core, and the `poser` line names the first difference. A build drawn through an atlas that is not there — a `rigc-compiled/1` document, or a build the core refuses — is refused `nothing at <the atlas>: … is drawn through its atlas (<why>)`, exit 2, nothing written; a Spine export without its atlas is refused `nothing at <the atlas>` as it always was. With the atlas gone, `check` on a `rigc-compiled/3` build reads its pages' `scale:` lines off the document, so its texture note and `check.json`'s `textureFrom.candidateScales` are what they are with the atlas; on a `/2` build its texture note says whether the atlas declares a `scale:` line is not read (that document does not state one), and `candidateScales` is `null` (`RC13`). **`vote` and `preview` take it more than once**: `vote` 2–4 times, one per pane, labelled A, B, C, D in the order given; `preview` any number of times, one pane per candidate in the order given, each headed by its path and its gate line, and the same skeleton twice (a directory and its `skeleton.json` are one) is refused by name. `--atlas` goes with one candidate only. Everywhere else a repeat is a typo and is refused |
+| `--candidate` | `check`, `bench`, `render`, `preview`, `chainfit` and `vote` only: a **compiled** artifact — the directory `build --out` wrote, or a `skeleton.json` path. `--atlas <path>` names the atlas when it does not sit beside the skeleton. On `render` and `check` a rigc build whose `skeleton.model.json` is `rigc-compiled/3` or `/2` needs no atlas at all: with no `--atlas` and no atlas beside it, it is drawn from the document's `pages`, the same frames, geometry and figures as with it, and the `atlas` line says `— not there`. An atlas that is there is still read, and held to `pages`: one that differs (edited after the build) is drawn through spine-core, and the `poser` line names the first difference. A build drawn through an atlas that is not there — a `rigc-compiled/1` document, or a build the core refuses — is refused `nothing at <the atlas>: … is drawn through its atlas (<why>)`, exit 2, nothing written; a Spine export without its atlas is refused `nothing at <the atlas>` as it always was. A directory whose files are not one build — a `skeleton.json` or a `skeleton.atlas` from another build beside this one's `skeleton.model.json` — is drawn through spine-core where the runtime can load the pair, the `poser` line naming the two digests or the atlas's first difference; where it cannot, it is refused `<skeleton> does not load against <the atlas>: spine-core draws this pair (<the poser line's why>) and could not resolve it — "<the runtime's own words>". <dir> is not one build: …`, exit 2, nothing written (`RC18`) — another build's skeleton beside this build's atlas typically ends `"Region not found in atlas: <region> (attachment: <name>)"`. Rebuild, or put the build's own three files back beside each other. A Spine export beside an atlas it was not exported with is refused in the same words, ending `The skeleton and the atlas are not one pair`. An atlas copied from another build's directory usually stops earlier, at its pages — their paths are relative to the directory it was written in — and is refused naming the first one: `nothing at <the page>: <the atlas> names it as a page, and spine-core draws this pair through that atlas (<why>). … <dir> is not one build: …`, exit 2, nothing written (`RC18`); an export whose atlas names a page that is not there is refused the same way, ending `and the page has to be there`. With the atlas gone, `check` on a `rigc-compiled/3` build reads its pages' `scale:` lines off the document, so its texture note and `check.json`'s `textureFrom.candidateScales` are what they are with the atlas; on a `/2` build its texture note says whether the atlas declares a `scale:` line is not read (that document does not state one), and `candidateScales` is `null` (`RC13`). **`vote` and `preview` take it more than once**: `vote` 2–4 times, one per pane, labelled A, B, C, D in the order given; `preview` any number of times, one pane per candidate in the order given, each headed by its path and its gate line, and the same skeleton twice (a directory and its `skeleton.json` are one) is refused by name. `--atlas` goes with one candidate only. Everywhere else a repeat is a typo and is refused |
 | `--animation` | `render`, `preview` and `vote` only: which animation to show. The default is **every** one for `render`, the **first** for `preview` (each candidate's own first, with several), and for `vote` the first of candidate A. A name the skeleton does not have is refused, with the ones it does have listed — and for `vote` and a several-candidate `preview`, so is a name that only *some* candidates have, naming the one that lacks it |
 | `--geometry` | `render` only: also write a `geometry.json` into each frame directory — per frame, every bone's world transform and every slot's region or mesh vertices in world units after skinning, plus each attachment's rest geometry and topology, on the frames' own grid and viewport. Every other file is byte for byte what the render writes without it. Refused with `--slot`/`--hide`, because the geometry is the whole pose whatever is drawn — **§8.2** |
-| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core. Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `the "default" skin names` (no `--skin`, and the default skin names a skin-required bone or constraint, each named) · `and no "default" one` (no `--skin`, and skins with none named `default` — spine-core draws nothing there either, so the render stops at `there is nothing to draw`, exit 2, and only `--poser core` prints this refusal) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; so do the order its animations and skins are listed in, its stage and its pages' `scale:` lines, on a `rigc-compiled/3` document (`editorOrder`, `stage`, `pages`) — a `/2` or `/1` document states none of those, so they come off its own `skeleton.json` and atlas, and the `poser` line then says `a rigc-compiled/2 document, which does not state the order its skins and animations are listed in or its stage, read from` and names both files; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`). On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1) |
+| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core. Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `the "default" skin names` (no `--skin`, and the default skin names a skin-required bone or constraint, each named) · `and no "default" one` (no `--skin`, and skins with none named `default` — spine-core draws nothing there either, so the render stops at `there is nothing to draw`, exit 2, and only `--poser core` prints this refusal) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. A fallback whose pair the runtime cannot load — another build's `skeleton.json` or atlas beside this build's document, or an export beside an atlas it was not exported with — is not drawn: it is refused `… does not load against <the atlas>: spine-core draws this pair (<why>) and could not resolve it — "<the runtime's own words>"` — or, where the atlas names a page that is not there, `nothing at <the page>: …` — exit 2, nothing written, on `render`, `render --geometry`, `check` and `bench --frames` alike; under `--poser core` the same pair is that flag's refusal, in the words above (`RC18`; the `--candidate` row says what to change). The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; so do the order its animations and skins are listed in, its stage and its pages' `scale:` lines, on a `rigc-compiled/3` document (`editorOrder`, `stage`, `pages`) — a `/2` or `/1` document states none of those, so they come off its own `skeleton.json` and atlas, and the `poser` line then says `a rigc-compiled/2 document, which does not state the order its skins and animations are listed in or its stage, read from` and names both files; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`). On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1) |
 | `--record` | `vote` only: a saved vote to check against its ballot and append to the ledger, instead of writing a ballot. This is the command's second mode; it takes no `--candidate` |
 | `--ballot` | `vote --record` only: the ballot the vote answers (default `ballot.html`). Its embedded manifest is what the vote is checked against, so the ballot file is the record of the question |
 | `--ledger` | `vote --record` only: the append-only JSONL the vote lands in (default `votes.jsonl`), one vote per line |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-rigc",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "AI-authored Spine 2D rigging and animation, verified before it is written. rigc compiles a rig spec into Spine 4.3 skeleton data, round-trips it through spine-core and named assertions, and emits nothing that fails. Output imports into the Spine editor. Ships as an agent skill.",
   "type": "module",
   "bin": {

package/src/assertions/bodies/a09.ts

@@ -0,0 +1,82 @@
+/**
+ * A09, the body (issue #1025, cut 4c-3 of step 4c of #380): the compiled
+ * duration is the declared duration (rule 4).
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the
+ * animations, their durations and their timelines' durations as one fact
+ * (`../facts/animation_durations.ts`) where it read the loaded skeleton's
+ * `animations`, `findAnimation` and each timeline's `getDuration()`. The
+ * declared durations are the caller's on both sides, as the rig info is. The
+ * `check` call stays in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { AnimationDurationFacts } from '../facts/animation_durations.ts';
+import { SKIP_NO_DECLARED_DURATION } from '../reasons.ts';
+import { float32Step } from '../../timelines.ts';
+
+/** One frame at 60 fps: how far a last key may fall short of the declared end before the declared duration reads as wrong. */
+const FRAME = 1 / 60;
+
+export function a09AnimationDurationMatchesSpec({ fail, skip }: Verdicts, facts: AnimationDurationFacts, declaredDurations: Record<string, number> | undefined): void {
+  // Without the spec there is no declared duration to compare the compiled
+  // one against, and returning here used to count as a PASS — a gate saying
+  // it checked something it never looked at.
+  if (!declaredDurations) {
+    return skip('A09_ANIMATION_DURATION_MATCHES_SPEC', 'no motion spec supplied, so no declared duration to compare against');
+  }
+  // Same trap one level down. A **static rig** — a skeleton that exists to
+  // be posed and carries no animation at all, which is what
+  // `1-weight-and-mass`'s second export is — declares nothing and loads
+  // nothing, so both loops below iterate zero times and the assertion
+  // reported PASS. That is the vacuous green this report is built to refuse:
+  // there is no duration here, and saying so is the honest answer.
+  if (Object.keys(declaredDurations).length === 0 && facts.animations.length === 0) {
+    return skip('A09_ANIMATION_DURATION_MATCHES_SPEC', SKIP_NO_DECLARED_DURATION);
+  }
+  for (const [name, declared] of Object.entries(declaredDurations)) {
+    const anim = facts.animations.find((a) => a.name === name);
+    if (!anim) {
+      fail('A09_ANIMATION_DURATION_MATCHES_SPEC', `spec declares animation "${name}" but the skeleton has none`);
+      continue;
+    }
+    // Two arms, and the asymmetry is the point.
+    //
+    // UNDERSHOOT is R7's question — is the declared duration wrong? An
+    // animation may hold its final pose, so a last key a little before the
+    // end is ordinary and a frame of that is slack.
+    //
+    // OVERSHOOT is a different question with a different tolerance.
+    // `anim.duration` IS the largest key time (`SkeletonJson.ts:1261` takes
+    // the max over every timeline's own duration), so a loaded duration past
+    // the declared one means a KEY is past it — and nothing that plays the
+    // animation for the duration it declares will ever reach that key. Rung
+    // 6 lost a one-frame attachment reveal to a key 3.4e-5 s past the end,
+    // 1/500 of FRAME, which this comparison read as agreement (issue #54).
+    // `compile.ts` refuses that per timeline now; this is the same rule held
+    // against a skeleton the compiler never saw.
+    // The slack is one float32 step at the declared duration, and it is the
+    // same function the compiler's Rule 4 refuses on (`float32Step`, in
+    // `timelines.ts`, which says why it is a step of the float and no longer
+    // a fixed 1e-6 plus one).
+    const slack = float32Step(declared);
+    const past = anim.duration - declared;
+    if (past > slack) {
+      const late = anim.timelineDurations.filter((d) => d - declared > slack).length;
+      fail(
+        'A09_ANIMATION_DURATION_MATCHES_SPEC',
+        `animation "${name}" has ${late} timeline(s) keyed past the declared duration ${declared}s — ` +
+          `the last key is at ${anim.duration}s, ${past.toFixed(6)}s late, so nothing ever samples it`,
+      );
+    } else if (declared - anim.duration > FRAME) {
+      fail(
+        'A09_ANIMATION_DURATION_MATCHES_SPEC',
+        `animation "${name}" loaded duration ${anim.duration}s, spec declares ${declared}s`,
+      );
+    }
+  }
+  for (const anim of facts.animations) {
+    if (!(anim.name in declaredDurations)) {
+      fail('A09_ANIMATION_DURATION_MATCHES_SPEC', `skeleton has animation "${anim.name}" with no spec entry`);
+    }
+  }
+}

package/src/assertions/bodies/a12.ts

@@ -0,0 +1,30 @@
+/**
+ * A12, the body (issue #1025, cut 4c-4 of #380): no dark colour and no
+ * two-colour timeline — both parsed, then silently ignored by spine-html.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the slots
+ * are a fact (`../facts/skeleton_roster.ts`) and the slot timelines are A45's
+ * (`../facts/slot_colour.ts`), rather than the raw JSON and `walkTimelines`
+ * over it. The path printed is the one `walkTimelines` built for a slot
+ * timeline, `<animation>.slots.<slot>.<timeline>`, and only a timeline whose
+ * keys are a list is one it visited.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkeletonRosterFacts } from '../facts/skeleton_roster.ts';
+import type { SlotTimelines } from '../facts/slot_colour.ts';
+
+export function a12NoDarkColor({ fail }: Verdicts, { slots }: SkeletonRosterFacts, slotTimelines: readonly SlotTimelines[]): void {
+  for (const slot of slots) {
+    if (slot.dark) {
+      fail('A12_NO_DARK_COLOR', `slot "${slot.name}" declares a dark colour; the renderer ignores it`);
+    }
+  }
+  for (const { animation, slot, timelines } of slotTimelines) {
+    for (const [name, keys] of Object.entries(timelines)) {
+      if (!Array.isArray(keys)) continue;
+      if (name === 'rgba2' || name === 'rgb2') {
+        fail('A12_NO_DARK_COLOR', `${animation}.slots.${slot}.${name}: two-colour timeline "${name}" is silently ignored by the renderer`);
+      }
+    }
+  }
+}

package/src/assertions/bodies/a24.ts

@@ -0,0 +1,68 @@
+/**
+ * A24, the body (issue #1025, cut 4c-4 of #380): motion under the axis bone
+ * stays in AXIS space, and the axis bone itself carries no keys.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the bone
+ * timelines are a fact (`../facts/bone_timelines.ts`) rather than the raw
+ * JSON's `animations`, walked in the same order, and the rig info is the
+ * caller's. Why the rule exists — the generator that wrote screen-space travel
+ * — stays above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { BoneTimelineFacts } from '../facts/bone_timelines.ts';
+import type { RigInfo } from '../../types.ts';
+import { isObj, type Json } from '../values.ts';
+
+export function a24AxisSpaceStroke({ fail, skip }: Verdicts, { boneTimelines }: BoneTimelineFacts, input: { rig?: RigInfo }): void {
+  const rig = input.rig;
+  if (!rig) return skip('A24_AXIS_SPACE_STROKE', 'no rig info (validating a bare directory)');
+  if (!rig.axisBone) {
+    return skip(
+      'A24_AXIS_SPACE_STROKE',
+      `the rig "${rig.archetype}" declares no axis bone, so there is no axis space for a stroke to leave`,
+    );
+  }
+  const subtree = new Set(rig.axisSubtree);
+  // The stroke is the subject and its keys are where it lives (#580). A rig
+  // that names an axis bone and then keys neither it nor anything under it has
+  // no stroke for this rule to find out of axis space, and a loop over nothing
+  // used to report that as held.
+  let keyed = 0;
+  for (const { animation: animName, bone: boneName, timelines } of boneTimelines) {
+    if (boneName === rig.axisBone) {
+      keyed++;
+      fail(
+        'A24_AXIS_SPACE_STROKE',
+        `"${animName}" keys the axis bone "${boneName}"; the axis angle is a per-cut SETUP value, not animation`,
+      );
+      continue;
+    }
+    if (subtree.has(boneName)) keyed++;
+    if (!subtree.has(boneName) || !isObj(timelines)) continue;
+    if ('translatey' in timelines) {
+      fail(
+        'A24_AXIS_SPACE_STROKE',
+        `"${animName}" gives "${boneName}" a translatey timeline; a bone under "${rig.axisBone}" moves along the axis only`,
+      );
+    }
+    const keys = (timelines as Json).translate;
+    if (!Array.isArray(keys)) continue;
+    for (const key of keys) {
+      if (!isObj(key)) continue;
+      const y = Number(key.y ?? 0);
+      if (Number.isFinite(y) && Math.abs(y) > 1e-6) {
+        fail(
+          'A24_AXIS_SPACE_STROKE',
+          `"${animName}" keys "${boneName}" translate y=${y} at t=${String(key.time ?? 0)}; the axis bone carries the direction, so keys are translateX only`,
+        );
+      }
+    }
+  }
+  if (keyed === 0) {
+    return skip(
+      'A24_AXIS_SPACE_STROKE',
+      `no animation keys the axis bone "${rig.axisBone}" or any of the ${rig.axisSubtree.length} bone(s) under ` +
+        'it, so this rig has no stroke to hold in axis space',
+    );
+  }
+}

package/src/assertions/bodies/a25.ts

@@ -0,0 +1,39 @@
+/**
+ * A25, the body (issue #1025, cut 4c-4 of #380): a bone the rig declares
+ * detached from another is not its descendant.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the bones
+ * and their parents are a fact (`../facts/skeleton_roster.ts`) rather than the
+ * raw JSON's `bones`, and the rig info is the caller's. Why some bones are
+ * detached on purpose stays above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkeletonRosterFacts } from '../facts/skeleton_roster.ts';
+import type { RigInfo } from '../../types.ts';
+
+export function a25DetachedBoneParentage({ fail, skip }: Verdicts, { bones }: SkeletonRosterFacts, input: { rig?: RigInfo }): void {
+  const rig = input.rig;
+  if (!rig) return skip('A25_DETACHED_BONE_PARENTAGE', 'no rig info (validating a bare directory)');
+  if (!rig.detached.length) {
+    return skip('A25_DETACHED_BONE_PARENTAGE', `the rig "${rig.archetype}" declares no forbidden parentage`);
+  }
+  const parentOf = new Map<string, string | null>();
+  for (const bone of bones) parentOf.set(bone.name, bone.parent);
+  for (const [child, forbidden] of rig.detached) {
+    if (!parentOf.has(child)) {
+      fail('A25_DETACHED_BONE_PARENTAGE', `the rig declares "${child}" detached from "${forbidden}" but has no such bone`);
+      continue;
+    }
+    const seen = new Set<string>();
+    for (let cursor = parentOf.get(child) ?? null; cursor; cursor = parentOf.get(cursor) ?? null) {
+      if (seen.has(cursor)) break; // a cycle; the loader would have thrown first
+      seen.add(cursor);
+      if (cursor !== forbidden) continue;
+      fail(
+        'A25_DETACHED_BONE_PARENTAGE',
+        `"${child}" is a descendant of "${forbidden}"; it must not be dragged by that bone's motion`,
+      );
+      break;
+    }
+  }
+}

package/src/assertions/bodies/a26.ts

@@ -0,0 +1,61 @@
+/**
+ * A26, the body (issue #1025, cut 4c-4 of #380): the slots array IS the rig's
+ * slot table — nothing out of order and nothing missing.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the slots'
+ * names are a fact (`../facts/skeleton_roster.ts`) rather than the raw JSON's
+ * `slots`, and the rig info is the caller's. Why the second half exists (issue
+ * #575) stays above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { SkeletonRosterFacts } from '../facts/skeleton_roster.ts';
+import type { RigInfo } from '../../types.ts';
+
+export function a26SlotDrawOrder({ fail, skip }: Verdicts, { slots }: SkeletonRosterFacts, input: { rig?: RigInfo }): void {
+  if (!input.rig) return skip('A26_SLOT_DRAW_ORDER', 'no rig info (validating a bare directory)');
+  const order = input.rig.slotOrder;
+  if (!order) {
+    return skip(
+      'A26_SLOT_DRAW_ORDER',
+      `the rig "${input.rig.archetype}" declares no canonical slot order, so the emitted order has nothing to disagree with`,
+    );
+  }
+  const names = slots.map((s) => s.name);
+  // ⛔ **No empty-subject SKIP here, and #575 is the whole reason** (#580). The
+  // empty sequence is a subsequence of every table, so before #575 a skeleton
+  // with no slot reported its draw order held and this rule wanted the same
+  // guard its neighbours got. It no longer does: the completeness clause below
+  // reads zero emitted slots against a declared table as EVERY slot lost,
+  // which is the maximal case of exactly the defect #575 filed — so the honest
+  // verdict is a FAIL naming them, and a SKIP here would suppress it. Measured:
+  // with the guard in place a rig declaring one slot beside an artifact
+  // carrying none reported SKIP; with it gone, `"block" is declared and not
+  // emitted`. A26 therefore has no vacuous pass left to convert, the way
+  // `A07_ATLAS_TEXT_SHAPE` has none.
+  let at = 0;
+  for (const name of names) {
+    const found = order.indexOf(name, at);
+    if (found < 0) {
+      const known = order.indexOf(name);
+      fail(
+        'A26_SLOT_DRAW_ORDER',
+        known < 0
+          ? `slot "${name}" is not in the archetype's slot table`
+          : `slot "${name}" is drawn out of order (table position ${known}, after a slot at ${at})`,
+      );
+      return;
+    }
+    at = found + 1;
+  }
+  const emitted = new Set(names);
+  const missing = order.filter((name) => !emitted.has(name));
+  if (missing.length > 0) {
+    fail(
+      'A26_SLOT_DRAW_ORDER',
+      `the rig "${input.rig.archetype}" declares ${order.length} slot(s) and the skeleton has ${names.length}: ` +
+        `${missing.map((name) => `"${name}"`).join(', ')} ${missing.length === 1 ? 'is' : 'are'} declared and ` +
+        'not emitted. A slot nothing fills is emitted with no setup attachment, not dropped — dropping one ' +
+        'moves every slot below it up one index',
+    );
+  }
+}

package/src/assertions/bodies/a29.ts

@@ -0,0 +1,34 @@
+/**
+ * A29, the body (issue #1025, cut 4c-4 of #380): inward travel stops where the
+ * two masses meet — the measured `stroke.contact_depth`.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the travel
+ * is measured over the bone timelines as a fact (`../inward_advance.ts` over
+ * `../facts/bone_timelines.ts`) rather than over the raw JSON, and the rig
+ * info is the caller's. Why the ceiling is a measured fact about the art stays
+ * above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { BoneTimelineFacts } from '../facts/bone_timelines.ts';
+import type { RigInfo } from '../../types.ts';
+import { deepestInwardAdvance } from '../inward_advance.ts';
+
+export function a29StrokeWithinContactDepth({ fail, skip, stats }: Verdicts, facts: BoneTimelineFacts, input: { rig?: RigInfo }): void {
+  const rig = input.rig;
+  if (!rig) return skip('A29_STROKE_WITHIN_CONTACT_DEPTH', 'no rig info (validating a bare directory)');
+  if (!rig.contactDepth) {
+    return skip(
+      'A29_STROKE_WITHIN_CONTACT_DEPTH',
+      'the manifest declares no `stroke.contact_depth`, so this cut has no measured contact ceiling to hold the stroke to',
+    );
+  }
+  const deep = deepestInwardAdvance(facts, rig);
+  stats.contactDepth = rig.contactDepth;
+  stats.deepestAdvance = Math.round(deep.total * 1000) / 1000;
+  if (deep.total > rig.contactDepth + 1e-6) {
+    fail(
+      'A29_STROKE_WITHIN_CONTACT_DEPTH',
+      `${deep.describe()} but the masses meet at ${rig.contactDepth}px — the two plates would interpenetrate`,
+    );
+  }
+}

package/src/assertions/bodies/a30.ts

@@ -0,0 +1,50 @@
+/**
+ * A30, the body (issue #1025, cut 4c-4 of #380): inward travel stops where the
+ * drawn cover runs out — the measured `stroke.cap_containment_ceiling` — and
+ * no bone under the axis scales while that ceiling is declared.
+ *
+ * Moved out of `src/validate.ts` unchanged but for what it reads: the travel
+ * and the scale timelines are read off the bone timelines as a fact
+ * (`../facts/bone_timelines.ts`, through `../inward_advance.ts`) rather than
+ * off the raw JSON, and the rig info is the caller's. Why this is not a
+ * restatement of A29, and why a scale key is refused rather than measured,
+ * stay above the `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { BoneTimelineFacts } from '../facts/bone_timelines.ts';
+import type { RigInfo } from '../../types.ts';
+import { deepestInwardAdvance } from '../inward_advance.ts';
+import { isObj } from '../values.ts';
+
+export function a30StrokeWithinCapContainment({ fail, skip, stats }: Verdicts, facts: BoneTimelineFacts, input: { rig?: RigInfo }): void {
+  const rig = input.rig;
+  if (!rig) return skip('A30_STROKE_WITHIN_CAP_CONTAINMENT', 'no rig info (validating a bare directory)');
+  if (!rig.capContainmentCeiling) {
+    return skip(
+      'A30_STROKE_WITHIN_CAP_CONTAINMENT',
+      'the manifest declares no `stroke.cap_containment_ceiling`, so this cut has no measured containment ceiling',
+    );
+  }
+  const deep = deepestInwardAdvance(facts, rig);
+  stats.capCeiling = rig.capContainmentCeiling;
+  stats.deepestAdvance = Math.round(deep.total * 1000) / 1000;
+  if (deep.total > rig.capContainmentCeiling + 1e-6) {
+    fail(
+      'A30_STROKE_WITHIN_CAP_CONTAINMENT',
+      `${deep.describe()} but the leading contour leaves the occluder's opaque footprint at ` +
+        `${rig.capContainmentCeiling}px — the part would be drawn where it should be covered`,
+    );
+  }
+  const subtree = new Set(rig.axisSubtree);
+  for (const { animation: animName, bone: boneName, timelines } of facts.boneTimelines) {
+    if (!subtree.has(boneName) || !isObj(timelines)) continue;
+    for (const name of Object.keys(timelines)) {
+      if (name !== 'scale' && name !== 'scalex' && name !== 'scaley') continue;
+      fail(
+        'A30_STROKE_WITHIN_CAP_CONTAINMENT',
+        `"${animName}" gives "${boneName}" a ${name} timeline while a cap-containment ceiling is declared; ` +
+          'the ceiling was measured on the undeformed contour, so a scaled plate is outside its evidence',
+      );
+    }
+  }
+}

package/src/assertions/bodies/a32.ts

@@ -0,0 +1,44 @@
+/**
+ * A32, the body (issue #1025, cut 4c-4 of #380): an event key that sets
+ * `volume` or `balance` fires an event that declares an audio path — and the
+ * clauses that stay with the round trip, printed where they always printed.
+ *
+ * Split per clause (`../facts/event_keys.ts`). The rig's clause moved here: a
+ * readable document can state a key's `volume` on an event with no `audio`,
+ * and the file the emitter writes from it is the file this clause refuses. The
+ * other four — no string `name`, an undeclared event, a time that is not a
+ * finite number, a time before the key before it — are states the model
+ * document's reader refuses by name, so no readable document reaches them;
+ * `validate()` runs them over the skeleton JSON and hands their findings in
+ * (`kept`), and this body prints them at their place, in their order, before
+ * the moved clause and instead of it where one ended the key's reading. The
+ * three failure modes and why the rule reads the raw JSON stay above the
+ * `check` call in `validate()`.
+ */
+import type { Verdicts } from '../harness.ts';
+import type { EventKeyFacts } from '../facts/event_keys.ts';
+
+/** Where a key is, as every A32 line names it — the kept clauses in `src/validate.ts` name it this way too. */
+export function eventKeyAt(animation: string, index: number): string {
+  return `animation "${animation}" event key ${index}`;
+}
+
+export function a32EventKeysResolve({ fail, skip }: Verdicts, facts: EventKeyFacts): void {
+  if (!facts.parsed) return skip('A32_EVENT_KEYS_RESOLVE', 'the skeleton JSON did not parse (A00 owns that failure)');
+  if (!facts.animations) return skip('A32_EVENT_KEYS_RESOLVE', 'the skeleton declares no animations');
+  for (const key of facts.keys) {
+    for (const finding of key.kept) fail('A32_EVENT_KEYS_RESOLVE', finding);
+    if (key.stopped) continue;
+    const at = eventKeyAt(key.animation, key.index);
+    for (const field of ['volume', 'balance'] as const) {
+      if (key.sets[field] && !key.audio) {
+        fail(
+          'A32_EVENT_KEYS_RESOLVE',
+          `${at}: "${key.name}" sets ${field}, but the event declares no audio path — the parser reads ` +
+            `${field} only for an event that has one, so it is dropped in silence`,
+        );
+      }
+    }
+  }
+  if (facts.timelines === 0) return skip('A32_EVENT_KEYS_RESOLVE', 'no animation carries an event timeline');
+}