spine-rigc 2.0.1 → 2.0.2

package/README.md

@@ -668,8 +668,11 @@ bun cli.ts build --rig … --motion … --out build/ --copy-images
 bun tools/editor_roundtrip.ts --build build/ --editor /Applications/Spine.app/Contents/MacOS/Spine
 ```
 
-It prints the import and export exit codes, the validator's verdict on the
-export, every `diff` measure that moved, `check`'s mean MAE and worst drift per
+Of the editor's `--version` it records one line, the `Spine <x.y.z> …` line that
+carries the version, and nothing else that command prints — the rest of it
+names the licence holder — or `editor version: not found in --version output`
+where no such line is there. It prints the import and export exit codes, the
+validator's verdict on the export, every `diff` measure that moved, `check`'s mean MAE and worst drift per
 animation **for each skin the build and the export both declare** — one
 render-and-check block per skin, with a per-skin roll-up under them, because a
 rig's contested art lives in its named skins and a single un-skinned check draws

package/docs/AUTHORING.md

@@ -230,7 +230,7 @@ What the flags mean:
 | `--candidate` | `check`, `bench`, `render`, `preview`, `chainfit` and `vote` only: a **compiled** artifact — the directory `build --out` wrote, or a `skeleton.json` path. A directory holding no `skeleton.json`, or a path with nothing at it, is refused `nothing at <path>`, exit 2, nothing written, by every command that takes a build — `validate <dir>` and a directory given to `diff` included (`RC27`). `--atlas <path>` names the atlas when it does not sit beside the skeleton. On `render` and `check` a rigc build whose `skeleton.model.json` is `rigc-compiled/3` or `/2` needs no atlas at all: with no `--atlas` and no atlas beside it, it is drawn from the document's `pages`, the same frames, geometry and figures as with it, and the `atlas` line says `— not there`. An atlas that is there is still read, and held to `pages`: one that differs (edited after the build) is drawn through spine-core, and the `poser` line names the first difference. A build drawn through an atlas that is not there — a `rigc-compiled/1` document, or a build the core refuses — is refused `nothing at <the atlas>: … is drawn through its atlas (<why>)`, exit 2, nothing written; a Spine export without its atlas is refused `nothing at <the atlas>` as it always was. A directory whose files are not one build — a `skeleton.json` or a `skeleton.atlas` from another build beside this one's `skeleton.model.json` — is drawn through spine-core where the runtime can load the pair, the `poser` line naming the two digests or the atlas's first difference; where it cannot, it is refused `<skeleton> does not load against <the atlas>: spine-core draws this pair (<the poser line's why>) and could not resolve it — "<the runtime's own words>". <dir> is not one build: …`, exit 2, nothing written (`RC18`) — another build's skeleton beside this build's atlas typically ends `"Region not found in atlas: <region> (attachment: <name>)"`. Rebuild, or put the build's own three files back beside each other. A Spine export beside an atlas it was not exported with is refused in the same words, ending `The skeleton and the atlas are not one pair`. An atlas copied from another build's directory usually stops earlier, at its pages — their paths are relative to the directory it was written in — and is refused naming the first one: `nothing at <the page>: <the atlas> names it as a page, and spine-core draws this pair through that atlas (<why>). … <dir> is not one build: …`, exit 2, nothing written (`RC18`); an export whose atlas names a page that is not there is refused the same way, ending `and the page has to be there`. A build moved or copied whole away from the directory it was built in stops at the same place, on either poser, and is refused naming the page and the file that names it: `nothing at <the page>: <the skeleton.model.json> names it as a page, and the core draws this build from it. A page path is relative to the build's directory, so a build moved or copied away from the directory it was built in names pages that are not here — build it again where it is, or build it with --copy-images, which writes its pages beside it` (under `--poser spine`, `<the atlas> names it as a page, and spine-core draws this pair through that atlas (--poser spine)` with the same ending), exit 2, nothing written (`RC21`); only where the core refused the files does a page refusal say the directory is not one build. `bench --bones` and `rigc bonedist` — on its `--candidate` and on its `--reference` — refuse a pair the runtime cannot load in the words above with `spine-core poses this pair (bonedist's candidate: …)` or `(bonedist's reference: …)`, exit 2, nothing written (`RC20`); they read no page image, so a build whose pages are elsewhere is measured as it is in place. A `skeleton.json` that is not JSON is refused `rigc: cannot read <the file>: <the parser's words> (line N, column N)`, exit 2, by `render`, `check`, `bench` and `bonedist` as by every other command that reads one (`RC22`). With the atlas gone, `check` on a `rigc-compiled/3` build reads its pages' `scale:` lines off the document, so its texture note and `check.json`'s `textureFrom.candidateScales` are what they are with the atlas; on a `/2` build its texture note says whether the atlas declares a `scale:` line is not read (that document does not state one), and `candidateScales` is `null` (`RC13`). **`vote` and `preview` take it more than once**: `vote` 2–4 times, one per pane, labelled A, B, C, D in the order given; `preview` any number of times, one pane per candidate in the order given, each headed by its path and its gate line, and the same skeleton twice (a directory and its `skeleton.json` are one) is refused by name. `--atlas` goes with one candidate only. Everywhere else a repeat is a typo and is refused |
 | `--animation` | `render`, `preview` and `vote` only: which animation to show. The default is **every** one for `render`, the **first** for `preview` (each candidate's own first, with several), and for `vote` the first of candidate A. A name the skeleton does not have is refused, with the ones it does have listed — and for `vote` and a several-candidate `preview`, so is a name that only *some* candidates have, naming the one that lacks it |
 | `--geometry` | `render` only: also write a `geometry.json` into each frame directory — per frame, every bone's world transform and every slot's region or mesh vertices in world units after skinning, plus each attachment's rest geometry and topology, on the frames' own grid and viewport. Every other file is byte for byte what the render writes without it. Refused with `--slot`/`--hide`, because the geometry is the whole pose whatever is drawn — **§8.2** |
-| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core, and so is a build rendered with no `--skin` whose default skin names a skin-required bone or constraint, or whose skins name no `default` one — posed as a fresh skeleton is, no skin's bones or constraints applied (the default skin's included) and every slot resolved through the default skin alone, so the second draws nothing and stops at `there is nothing to draw` (exit 2) under either poser (issue #1051). Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. A fallback whose pair the runtime cannot load — another build's `skeleton.json` or atlas beside this build's document, or an export beside an atlas it was not exported with — is not drawn: it is refused `… does not load against <the atlas>: spine-core draws this pair (<why>) and could not resolve it — "<the runtime's own words>"` — or, where the atlas names a page that is not there, `nothing at <the page>: …` — exit 2, nothing written, on `render`, `render --geometry`, `check` and `bench --frames` alike; under `--poser core` the same pair is that flag's refusal, in the words above (`RC18`; the `--candidate` row says what to change). The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; so do the order its animations and skins are listed in, its stage and its pages' `scale:` lines, on a `rigc-compiled/3` document (`editorOrder`, `stage`, `pages`) — a `/2` or `/1` document states none of those, so they come off its own `skeleton.json` and atlas, and the `poser` line then says `a rigc-compiled/2 document, which does not state the order its skins and animations are listed in or its stage, read from` and names both files; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`). On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1) |
+| `--poser` | `render`, `check` and `explain`: `core` or `spine` — on `render` and `check`, which implementation poses the frames (on `check`, the candidate's; the reference side is pixels either way). By default a **rigc build** (the `skeleton.model.json` `build` writes; its atlas, when one is named or present, the one beside it) is posed by rigc's own core and a **Spine export** by spine-core; the render prints a `poser` line saying which and why, and so does the check report (`check.json`'s `poser`, and the pictures' `frames.json` under `--out`; `bench --frames` prints the same line). A concave or an inverse clip is posed by the core, and so is a build rendered with no `--skin` whose default skin names a skin-required bone or constraint, or whose skins name no `default` one — posed as a fresh skeleton is, no skin's bones or constraints applied (the default skin's included) and every slot resolved through the default skin alone, so the second draws nothing and stops at `there is nothing to draw` (exit 2) under either poser (issue #1051). Where the input cannot carry the core, or the core refuses it, the render poses it through spine-core and the `poser` line says why, in one of these words: `no skeleton.model.json beside` (a Spine export) · `is not beside` (`--atlas` names an atlas outside the build's directory) · `does not describe` (a model document whose bones, slots or animations are not the skeleton's) · `is not the skeleton.json` (a `skeleton.json` whose SHA-256 is not the `spine.sha256` its model document records — edited or replaced after the build — both digests named) · `the polygon is not simple` (a clip polygon two of whose edges cross or touch, the slot named) · `depends on the runtime's previous pass` (a constraint moves a posed bone from a bone that a constraint writes into while that bone is inactive, all four named) · `--poser spine` (asked for). Any other refusal of the core's — an unreadable model document among them — reads `the core refused` and then the core's own words. `--poser core` on an input that cannot carry it is refused in the same words (exit 2, nothing written); `--poser spine` forces the runtime. A fallback whose pair the runtime cannot load — another build's `skeleton.json` or atlas beside this build's document, or an export beside an atlas it was not exported with — is not drawn: it is refused `… does not load against <the atlas>: spine-core draws this pair (<why>) and could not resolve it — "<the runtime's own words>"` — or, where the atlas names a page that is not there, `nothing at <the page>: …` — exit 2, nothing written, on `render`, `render --geometry`, `check` and `bench --frames` alike; under `--poser core` the same pair is that flag's refusal, in the words above (`RC18`; the `--candidate` row says what to change). The repository's selftest renders one probe per reason above and holds this list to the lines they print (`RC09`). Both posers draw the same frames, geometry and framing box to the bit on every corpus (issue #968), and `check` through either writes the same report, `check.json` and pictures but for the poser it names on every tree row. A rigc build the core poses reads nothing through spine-core on `render`, `render --geometry` and `check`, `--texture-from` included (and the check `bench --frames` folds in; `bench`'s own `validate`, like `build`'s, is the runtime's round trip by design): its bone tree, slot list and slot roster come off its model document; so do the order its animations and skins are listed in, its stage and its pages' `scale:` lines, on a `rigc-compiled/3` document (`editorOrder`, `stage`, `pages`) — a `/2` or `/1` document states none of those, so they come off its own `skeleton.json` and atlas, and the `poser` line then says `a rigc-compiled/2 document, which does not state the order its skins and animations are listed in or its stage, read from` and names both files; where each region sits and the page images it draws off the document's `pages` (a `rigc-compiled/1` document's off the atlas beside it, and the `poser` line then says `a rigc-compiled/1 document, which does not state where each region sits on its page: that is read from` and names the atlas); and a `--texture-from` atlas off rigc's own atlas reader. The runtime is loaded for a Spine export, `--poser spine` and a fallback the `poser` line names; a run that cannot load it there is refused naming the input and why it needs the runtime (exit 1; `RC11`, `RC13`, `RC34`). On the entry that links none of spine-core — the installed `rigc` without the runtime beside it, `bun cli_core.ts` in a clone — that refusal ends on the route to the entry that does (``the entry that links it runs them — installed, the same `rigc` once @esotericsoftware/spine-core is installed beside the package; from a source checkout, `bun cli.ts` ``); a runtime that is installed and fails to load is refused without it, since installing it is not what that reader has to do. On `explain` the flag chooses the `DEFORM` block's survey (§4.11.2): `core`, the default, reads the skeleton's structure — its deform timelines and their keys, curves and slots, the skin each is keyed under, the sliders — off the model document the compile writes and poses it through the core, and spine-core is not touched (`RC15`); `spine` parses and poses the Spine skeleton through spine-core. The two are the same survey to the byte on every corpus row (`DM12`). Where the core refuses the document, the survey falls back to spine-core and the block says so on a line of its own (`read and posed through spine-core: …`); `--poser core` there is refused instead (exit 2), and a run that cannot load the runtime where it needs it is refused naming the survey and why (exit 1), ending on the same route where the entry links none of it |
 | `--record` | `vote` only: a saved vote to check against its ballot and append to the ledger, instead of writing a ballot. This is the command's second mode; it takes no `--candidate` |
 | `--ballot` | `vote --record` only: the ballot the vote answers (default `ballot.html`). Its embedded manifest is what the vote is checked against, so the ballot file is the record of the question |
 | `--ledger` | `vote --record` only: the append-only JSONL the vote lands in (default `votes.jsonl`), one vote per line |
@@ -666,7 +666,9 @@ and a file's name is not evidence: a production pack shipped WebP pages called
 there — a WebP, JPEG, GIF, KTX or KTX2 file by its signature, or no format rigc
 recognises, with the first bytes in hex either way — and a file that begins as a
 PNG and runs out before its `IEND` chunk is called **truncated**, wherever it was
-cut. `build --atlas-in` and `explain --atlas-in` say so where they open the pack,
+cut. A PNG whose `IHDR` states a width or a height of **0** is refused the same way
+— the format requires each to be at least 1, and such a file describes no texel —
+naming the size it states and which dimension is 0. `build --atlas-in` and `explain --atlas-in` say so where they open the pack,
 every such page in one sentence and before the compile; a loose part that is not a
 PNG is refused as the image it is; and `rigc validate` on a directory holding such
 a page fails `A06` with the same sentence:
@@ -679,6 +681,15 @@ a page fails `A06` with the same sentence:
 #         measured. Re-export it as PNG
 ```
 
+A page whose header and chunks read and whose **image data cannot be decoded** — a
+compressed stream broken behind an intact chunk walk, or one that inflates short of
+the rows its header states — fails `A06` too, under both profiles, with the
+decoder's own words: `… is a PNG whose header and chunks read and whose image data
+cannot be decoded: the decoder stops with "incorrect data check", so no texel of it
+can be read`. The same sentence is what `render` and a mesh part's trace refuse such
+a file with. Without it the default profile built such a page green — no rule it
+runs decoded a texel — and wrote a directory `render` then could not draw.
+
 ⇒ **Re-export the page as PNG under the name the atlas gives it**, and the next run
 measures it like any other. ⚠️ `A06` deliberately does not read the width and
 height a WebP header carries in a fixed field. Doing so would print a size that no
@@ -1330,6 +1341,13 @@ physics constraint ([FACE.md](FACE.md)), and `diff` moved only
 repointed sliders**, and the re-rendered mean absolute error of 8.43–10.41 is the
 size #535 measured out of order. Hence a refusal rather than a note.
 
+⇒ **`diff` names it now** (issue #1078). `constraints.refs` compares every name a
+constraint resolves — its bones and slots, a slider's `animation` and `property`,
+and the `from`/`to` pairs of a transform's `properties` — and its note names each
+constraint wired differently with both sides' names. On the probe above, planted
+without the editor: `0.333 refs 1/3 … — 2 wired differently: slider constraint
+"yaw": animation "-a" vs "5"; slider constraint "tilt": animation "2b" vs "-a"`.
+
 **R11 — The `skins` array is written with `default` first and the rest in exactly
 the order R10 describes.** A skin is a **name** in the JSON half of the format and
 an **ordinal** in the binary half — `skins[readInt()]` for an attachment timeline,
@@ -5721,7 +5739,7 @@ or the key's position in its own track. These are the frequent ones, verbatim:
 | `vertex N binds bone index I, which is not in the bone list` | §3.4 — a `"boneIndexing": "raw"` run on a mesh, bounding box, clipping polygon or path names a bone by its place in the bone array, and I is no place in it: past the end, negative or not a whole number. Count the rig's `bones` from 0, or give the bindings by name as `weights`, which cannot miss this way. ⚠️ **Refused earlier, not newly** (issue #917): the run is decoded to bone names once, when the attachment is built, and this is where an index that names no bone stops. Before that a mesh compiled and `A20` named the index at the gate, a bounding box, clipping polygon or path with its `lengths` stated compiled and `A33` named it, and only a path whose `lengths` rigc measures refused here, in this sentence. `MV04` plants it on each of the four kinds |
 | `the raw weighted run has a bone count of C at index I` / `the raw weighted run is truncated — vertex N claims C bone(s) and the array ends first` / `the raw weighted run decodes to N vertices but there are M uv pairs` | §3.4 — a mesh's `"boneIndexing": "raw"` run is not `boneCount, (index, x, y, weight) × boneCount` per vertex, one vertex per uv pair. These are the polygon's three sentences (whose last clause there reads `but vertexCount is M`), now asked of a mesh as well. Fix the run, or give the bindings by name as `weights`. ⚠️ **Refused earlier, not newly** (issue #917): the mesh run is decoded to bone names when the mesh is built, and a run that does not decode cannot be. Before that it compiled and `A20` named it at the gate (`has weights for 5 vertices but 4 uv pairs`, `vertex 3 has weight NaN`). `MV04` plants each |
 | `image "X.png" is not on disk at …` | fix the name, or point `--images` at the right directory |
-| `image "X.png": /…/X.png is a WebP image (…), not a PNG: its first 12 byte(s) are …` | the file is there and is not a PNG — the name ends in `.png` and the bytes decide. Re-export it as PNG; the same sentence says **truncated** for a PNG that runs out before its `IEND`, and then the repair is a whole copy (§0.2) |
+| `image "X.png": /…/X.png is a WebP image (…), not a PNG: its first 12 byte(s) are …` | the file is there and is not a PNG — the name ends in `.png` and the bytes decide. Re-export it as PNG; the same sentence says **truncated** for a PNG that runs out before its `IEND`, and then the repair is a whole copy, and names the dimension for a PNG whose `IHDR` states a width or height of 0 (§0.2) |
 | `a "contour" generator traces the part's own alpha, and "X.png" is lifted off a packed page at the coordinates the atlas states, which on this file are not where its texels are — so there is no silhouette here to trace, only another part of the page. page "p.png" declares …` | the page's PNG is not the size its atlas declares, and the rest of the message is `A06`'s sentence for it: re-declare the page with the `scale:` header it names, or re-export the page at its declared size (§0.2) |
 | `--atlas-in <pack>.atlas: N of its M page(s) cannot be read as PNG, and nothing was compiled against the pack — page "p.png": …` | the same, for every page of the pack at once, before the compile: re-export each named page as PNG under the name the atlas gives it (§0.2) |
 | `parts/iris_open.png is 96x64 but slot "iris" declares 96x60` | R5 — a manifest `states:` entry whose art is not the window the part declares. Re-export the PNG, or fix the part's `size`; a quad sized against art of another size is the silence `A06` exists for, and the window is what the quad is built from |
@@ -5911,7 +5929,7 @@ Fix A00 and run it again.
 | `A03_REGION_WIDTH_HEIGHT_FINITE` | both | a region loaded `NaN` or a non-positive size — the attachment has no `image` and no `width`/`height`. **SKIP** when the skeleton carries no region attachment |
 | `A04_MESH_TRIANGLES_AND_ENCODING` | both | authored mesh geometry: triangle count not a multiple of 3, an index out of range, or a `vertices` length that disagrees with `uvs` (the weighted/unweighted trap) **SKIP** when the skeleton carries no mesh attachment |
 | `A05_CURVE_ARRAY_LENGTH` | both | a raw `curve` with the wrong number of values, a non-finite number in one, or a curve on a timeline that cannot take one. Four numbers **per value channel**. **SKIP** when no animation carries a timeline at all. Timelines with no `curve` on any key still PASS: every timeline name is checked against the channel table whether or not a curve sits on one Under `cli_core.ts build` the same clause runs over the text the emitter wrote and prints this line in the same words (`RC28`). |
-| `A06_ATLAS_PAGE_SIZE_MATCHES_PNG` | both ◑ | the atlas `size:` disagrees with the PNG on disk — the message names the ratio it measured on **each** axis and the header that states the same art truthfully, and §0.2 has the whole of it: a runtime maps a region as a fraction of the DECLARED size and never reads the texture's own, so such a page draws, and what it breaks is every reader that addresses the page in texels. A uniform ratio is a `size:`/`scale:` pair away from honest and the message prints it; two ratios are not, because `scale:` carries one number, and the message says so rather than offering a header that would not work. **Or** a region's rectangle is not inside the page it names — rotation honoured, so a region at `rotate: 90` or `270` occupies `height x width` of the page and a region that fits only because it is turned is inside it. The message names the region, the rectangle it occupies, the page and the page's size. That clause is **validity** and runs under both profiles: a rectangle outside its page makes `u2 > 1` and samples whatever the wrap mode returns, and `--atlas-in` already refuses the same rectangle at compile time (§0.2). Under `spine-html` also: `pma`, rotation, and two regions on one page over the same texels — a packed page must be **one part covering it exactly** (the unpacked convention) or a **tiling**, and what that message names is the pair that shares texels. **Or** the page file is not a PNG at all, and then nothing about its size is measured: the message carries the page's path and the size the atlas declares, and names what the file is by its first bytes — one of WebP, JPEG, GIF, KTX, KTX2 by its signature, or no image format rigc recognises, the bytes in hex either way — or calls it **truncated** when it begins as a PNG and runs out before its `IEND` (§0.2). That clause is validity too: nothing in rigc can read such a page back — and its failure is the **one** line that names such a page: `A19` SKIPs over it and points here rather than naming it again, the way `A17` alone names a missing file. **SKIP** when the atlas declares no page — and, rather than a PASS, when a page's file is **not on disk** and nothing else here failed: that page's size was not measured, so the reason names the pages not read (or says none was, when every file is missing) and points at `A17`, which fails naming each missing file — one missing file is named once, by the rule whose subject it is. With another `A06` failure standing, the missing page is `A17`'s alone |
+| `A06_ATLAS_PAGE_SIZE_MATCHES_PNG` | both ◑ | the atlas `size:` disagrees with the PNG on disk — the message names the ratio it measured on **each** axis and the header that states the same art truthfully, and §0.2 has the whole of it: a runtime maps a region as a fraction of the DECLARED size and never reads the texture's own, so such a page draws, and what it breaks is every reader that addresses the page in texels. A uniform ratio is a `size:`/`scale:` pair away from honest and the message prints it; two ratios are not, because `scale:` carries one number, and the message says so rather than offering a header that would not work. **Or** a region's rectangle is not inside the page it names — rotation honoured, so a region at `rotate: 90` or `270` occupies `height x width` of the page and a region that fits only because it is turned is inside it. The message names the region, the rectangle it occupies, the page and the page's size. That clause is **validity** and runs under both profiles: a rectangle outside its page makes `u2 > 1` and samples whatever the wrap mode returns, and `--atlas-in` already refuses the same rectangle at compile time (§0.2). Under `spine-html` also: `pma`, rotation, and two regions on one page over the same texels — a packed page must be **one part covering it exactly** (the unpacked convention) or a **tiling**, and what that message names is the pair that shares texels. **Or** the page file is not a PNG at all, and then nothing about its size is measured: the message carries the page's path and the size the atlas declares, and names what the file is by its first bytes — one of WebP, JPEG, GIF, KTX, KTX2 by its signature, or no image format rigc recognises, the bytes in hex either way — or calls it **truncated** when it begins as a PNG and runs out before its `IEND`, or names the dimension when its `IHDR` states a width or height of **0**, which the format forbids (§0.2). **Or** the file reads as a PNG and its **image data cannot be decoded** — its compressed stream is inflated (not unfiltered) and the decoder refuses it, or it inflates short of the rows the header states — and the message names the file and carries the decoder's own words (`the decoder stops with "incorrect data check"`). That clause is validity too: nothing in rigc can read such a page back — and its failure is the **one** line that names such a page: `A19` SKIPs over it and points here rather than naming it again, the way `A17` alone names a missing file. **SKIP** when the atlas declares no page — and, rather than a PASS, when a page's file is **not on disk** and nothing else here failed: that page's size was not measured, so the reason names the pages not read (or says none was, when every file is missing) and points at `A17`, which fails naming each missing file — one missing file is named once, by the rule whose subject it is. With another `A06` failure standing, the missing page is `A17`'s alone |
 | `A07_ATLAS_TEXT_SHAPE` | both | atlas text: a region name with stray whitespace, or a blank line splitting a page block. rigc writes the atlas, so this means a hand-edited file. Three sentences are about blank lines and name three different repairs: `line 1: the file begins with a blank line` (or `with N blank lines` for a run, one finding) is a blank before the first page name — delete it; `line N: the file ends with a blank line` (or `with N blank lines`, one finding) is a blank after the last page block's final line — delete it, since rigc ends the file on one newline; `line N: consecutive blank lines` is two blank lines side by side between the first page and the last — delete one. None of the three is `the last page block declares no region`, which means a page name and its fields with no region after them. rigc writes none of the three: under `--atlas-in` the pack's blank lines are put in rigc's shape on re-emission (§0.2), so any of them means a file rigc did not write, handed to `validate`. ⚠️ An atlas with **no page block at all** — no non-blank line — is not one of those: its subject is absent, so this reports **SKIP** naming the byte count it read, and so do the four rules below whose subject is a page ([#608](https://github.com/firejune/rigc/issues/608)). A rig whose skins need no art writes exactly that file (§3.4), and before #608 this row refused it with two findings naming a page block that was not there. What an empty atlas does **not** excuse is an attachment that wants a region out of it — that is `A08` Under `cli_core.ts build` the same clause runs over the text the emitter wrote and prints this line in the same words (`RC28`). |
 | `A08_REGION_NAMES_MATCH_ATTACHMENTS` | both | three things, and the message says which: an attachment whose `path` names **no region** of this atlas; a `path` carrying **stray whitespace**, printed quoted so you can see it; an **atlas region name** carrying stray whitespace (`A07` names that same line with its line number). The first two are read off the raw file **before** the loader is asked, so the miss is named here with the skin, the slot, the placeholder and the attachment's own name — the four things `AtlasAttachmentLoader`'s own `Region not found in atlas: <path> (attachment: <name>)` does not carry. There is no `spine-html` clause here — a placeholder is free to differ from the region its `path` names **SKIP** when no attachment names a region *and* the atlas declares none — both of its subjects at once |
 | `A09_ANIMATION_DURATION_MATCHES_SPEC` | both | the loaded duration ≠ the declared one, or the two sides disagree about which animations exist (R7). Asymmetric by design: a frame of slack for an animation that ends early, and none worth the name for a key *past* the declared end, which is the same rule §4.5 states at compile time — held here against a skeleton the compiler never saw. **SKIP** when neither side has an animation at all — a static rig has no duration |
@@ -5924,7 +5942,7 @@ Fix A00 and run it again.
 | `A16_SKELETON_VERSION_4_3` | both | the `skeleton.spine` label is not on the 4.3 line (`4.3`, `4.3.N`, `4.3.N-suffix`) Under `cli_core.ts build` the same clause runs over the text the emitter wrote and prints this line in the same words (`RC28`). |
 | `A17_ATLAS_PAGE_FILES_EXIST` | both | a page the atlas declares is not a file. Check `--images` and `--out`. This is the one rule that names a missing page file; `A06` and `A19` SKIP over the page they could not read and point here rather than naming it again. **SKIP** when the atlas declares no page — as it is for `A06`, `A19` and `A27`; see `A07` |
 | `A18_DETERMINISTIC_EMIT` | both | a second compile of the same inputs differed — in `skeleton.json`, `skeleton.atlas` or the model document `skeleton.model.json`, the one named (the document's first differing line with it). That is a compiler bug, not a spec bug — report it Under `cli_core.ts build` the same clause runs over the text the emitter wrote and prints this line in the same words (`RC28`). |
-| `A19_OVERLAY_PNGS_HAVE_ALPHA` | renderer | an overlay part cannot draw a transparent pixel, so it would paint a solid rectangle over what is behind it. **The texels decide, on both routes**; the file header is only the fast negative. A file with no alpha channel (colour type 4 or 6) and no `tRNS` chunk has nowhere to keep a clear texel and is refused without being opened, by a sentence that names its colour type — so re-export it as RGBA, or as an indexed / greyscale PNG that keeps its `tRNS`. A file whose header says it **could** be transparent is opened and read until its first texel below full alpha; one clear texel passes, and none is refused in the words the packed route uses for a region, naming the file and what it can hold — `is opaque in every one of its 200x80 texels` … `its file can hold transparency — colour type 6 (truecolour + alpha) carries an alpha channel — and no texel uses it`. Saving as RGBA is not the repair: the runtime draws the texels, not the declaration. On a loose page the file is the part, so the whole decoded image is the rectangle and no atlas coordinate is read. Only the base plate may be opaque, and which image that is is decided once for both routes: the plate the build names — on a cut manifest, the part whose window is the crop — and, only when it names none, an image at least the stage's size. The rig's statement comes first because the two can disagree: a stage stated small enough for an overlay to cover would otherwise exempt that overlay. A rig spec cannot name a base plate, so a stageless rig-spec build, and `validate <dir>` on a stageless skeleton, has nothing to decide it; an opaque part there is refused with *"nothing here decides which image that is: this skeleton declares no stage size to measure one against"* and the two ways to decide it — a `skeleton` stage the plate covers, or a cut manifest (for `validate`, the specs it was built from: `--rig`, `--motion` and the `--manifest`). Indexed-with-`tRNS` — the usual output of ImageMagick, "Export as PNG-8", GIMP's indexed mode, aseprite and pngquant — **passes**: it is transparent art. On a **shared** page the question is asked per REGION over the decoded page rather than per file, because a packed page's own file all but always declares transparency — its gutter is transparent — and the file-level question would then be answered by the packing rather than by the art. ⚠️ **That scan states its verdict over the texels it READ, and never over texels that are not on the page**: a rectangle partly on its page is judged over the part that is on it, and the message carries both counts — `opaque in every one of the 77 texels of its 12x8 rectangle at -1,-1 … the other 19 of the 96 it declares are not on the page and are not measured here`. A rectangle with **no** texel on the page is reported **not measured** by name — the region, its rectangle, the page image's size, and the pointer to `A06`, which is the rule that judges a region's rectangle — and no verdict about opacity is printed at all. ⚠️ **A page whose IMAGE is not the size the atlas declares for it is the same non-measurement for every region on it**, and the clause above does not cover that case: a page rescaled after packing leaves most rectangles partly on it, at coordinates that address a different part of the picture, so a scan would come back with a confident verdict over texels nobody had located — on a two-region pack at a uniform 0.5 an opaque part's failure **disappears**, the scan finding a transparent texel 32 texels away from it. The row names the page's two sizes and points at `A06`, which judges the page grid and prints the header that repairs it (§0.2). It stays a failure rather than becoming a SKIP because a SKIP is per ASSERTION: it would delete the verdicts on every other part of the same page, and an assertion cannot be skipped and failed at once without the report counting it twice. **SKIP** when the atlas declares no page — and, rather than a PASS, when a page carrying a part was not read and nothing else here failed: the reason names the pages not read and how many of the pages carrying a part were (or says none was), and for each page points at the one rule that names its file — `A17` when the file is **not on disk**, `A06` when it is on disk and **cannot be read as PNG** (not a PNG, or truncated; `A06` fails naming what the file is on every such page, under both profiles). So one unreadable file is one red line, never two: with another `A19` failure standing, the unread page is that rule's alone and this one says nothing about it. A page holding only the base plate moves nothing here, missing or unreadable: this rule had no part on it to read. ⚠️ A page whose header reads as PNG and whose pixel data the decoder then refuses (an intact chunk walk over a broken compressed stream) is not caught by `A06`, which reads the header only; it reaches this rule's texel scan, which fails on it with the decoder's own error (`threw: cannot decode PNG …`) |
+| `A19_OVERLAY_PNGS_HAVE_ALPHA` | renderer | an overlay part cannot draw a transparent pixel, so it would paint a solid rectangle over what is behind it. **The texels decide, on both routes**; the file header is only the fast negative. A file with no alpha channel (colour type 4 or 6) and no `tRNS` chunk has nowhere to keep a clear texel and is refused without being opened, by a sentence that names its colour type — so re-export it as RGBA, or as an indexed / greyscale PNG that keeps its `tRNS`. A file whose header says it **could** be transparent is opened and read until its first texel below full alpha; one clear texel passes, and none is refused in the words the packed route uses for a region, naming the file and what it can hold — `is opaque in every one of its 200x80 texels` … `its file can hold transparency — colour type 6 (truecolour + alpha) carries an alpha channel — and no texel uses it`. Saving as RGBA is not the repair: the runtime draws the texels, not the declaration. On a loose page the file is the part, so the whole decoded image is the rectangle and no atlas coordinate is read. Only the base plate may be opaque, and which image that is is decided once for both routes: the plate the build names — on a cut manifest, the part whose window is the crop — and, only when it names none, an image at least the stage's size. The rig's statement comes first because the two can disagree: a stage stated small enough for an overlay to cover would otherwise exempt that overlay. A rig spec cannot name a base plate, so a stageless rig-spec build, and `validate <dir>` on a stageless skeleton, has nothing to decide it; an opaque part there is refused with *"nothing here decides which image that is: this skeleton declares no stage size to measure one against"* and the two ways to decide it — a `skeleton` stage the plate covers, or a cut manifest (for `validate`, the specs it was built from: `--rig`, `--motion` and the `--manifest`). Indexed-with-`tRNS` — the usual output of ImageMagick, "Export as PNG-8", GIMP's indexed mode, aseprite and pngquant — **passes**: it is transparent art. On a **shared** page the question is asked per REGION over the decoded page rather than per file, because a packed page's own file all but always declares transparency — its gutter is transparent — and the file-level question would then be answered by the packing rather than by the art. ⚠️ **That scan states its verdict over the texels it READ, and never over texels that are not on the page**: a rectangle partly on its page is judged over the part that is on it, and the message carries both counts — `opaque in every one of the 77 texels of its 12x8 rectangle at -1,-1 … the other 19 of the 96 it declares are not on the page and are not measured here`. A rectangle with **no** texel on the page is reported **not measured** by name — the region, its rectangle, the page image's size, and the pointer to `A06`, which is the rule that judges a region's rectangle — and no verdict about opacity is printed at all. ⚠️ **A page whose IMAGE is not the size the atlas declares for it is the same non-measurement for every region on it**, and the clause above does not cover that case: a page rescaled after packing leaves most rectangles partly on it, at coordinates that address a different part of the picture, so a scan would come back with a confident verdict over texels nobody had located — on a two-region pack at a uniform 0.5 an opaque part's failure **disappears**, the scan finding a transparent texel 32 texels away from it. The row names the page's two sizes and points at `A06`, which judges the page grid and prints the header that repairs it (§0.2). It stays a failure rather than becoming a SKIP because a SKIP is per ASSERTION: it would delete the verdicts on every other part of the same page, and an assertion cannot be skipped and failed at once without the report counting it twice. **SKIP** when the atlas declares no page — and, rather than a PASS, when a page carrying a part was not read and nothing else here failed: the reason names the pages not read and how many of the pages carrying a part were (or says none was), and for each page points at the one rule that names its file — `A17` when the file is **not on disk**, `A06` when it is on disk and **cannot be read as PNG** (not a PNG, truncated, an `IHDR` dimension of 0, or image data that does not decode; `A06` fails naming what the file is on every such page, under both profiles). Undecodable data is found where this rule decodes, so the header's fast negative above still refuses a part with no alpha channel and no `tRNS` without opening it — a verdict about the header, not about the pixels. So one unreadable file is one red line, never two: with another `A19` failure standing, the unread page is that rule's alone and this one says nothing about it. A page holding only the base plate moves nothing here, missing or unreadable: this rule had no part on it to read. |
 | `A20_MESH_WEIGHTS_COHERENT` | both ◑ | a weighted vertex with no bone, a negative weight, a bone index out of range, or weights that do not sum to 1. On a rig spec's `"boneIndexing": "raw"` mesh an index out of range or a run that does not decode is refused at compile first (§5.1, issue #917), so here it names a skeleton rigc did not compile. Under `spine-html` also: an unweighted mesh, a binding at weight 0, or **a bone the mesh declares that no vertex binds** — `mesh "x" declares bone "grip_b" and none of its 25 vertices binds it; the weights reference "box", "grip_a"`. Those three are one sentence about rigc's own generators: the bone set a generated mesh declares is the bone set its weights reference, so a `controls` or `chain` name that moves nothing is a defect where a foreign mesh's is not. Fix the rig spec's `controls`/`chain`, a `segments` generator's `bones` (its `influence` line names a bone no vertex binds), or the manifest's `control_bones`. **SKIP** when the skeleton carries no mesh attachment |
 | `A21_MESH_RIM_PINNED` | archetype | a generated ring's rim, a ribbon's entry row, or a contour's outline (which is all of it) is not pinned to its anchor bone at weight 1. **SKIPs** by name on authored or linked geometry and on a `segments` mesh, whose outline is weighted by distance like the rest of it — none of them claims a pinned rim |
 | `A22_MESH_UVS_IN_UNIT_RANGE` | both | a mesh UV outside its region, or a UV array that disagrees with the vertex count. **SKIP** when the skeleton carries no mesh attachment |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-rigc",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "AI-authored Spine 2D rigging and animation, verified before it is written. rigc compiles a rig spec into Spine 4.3 skeleton data, gates it with named assertions held to a spine-core round trip's verdicts, and emits nothing that fails. Output imports into the Spine editor. Ships as an agent skill.",
   "type": "module",
   "bin": {

package/src/assertions/bodies/a06.ts

@@ -10,13 +10,14 @@
  * and the argument for the SKIP guards it shares with A17 and A19 (#568, #608)
  * — stays in `validate()`.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import type { Verdicts } from '../harness.ts';
 import type { AtlasRegionEntry, AtlasRegionFacts } from '../facts/atlas_regions.ts';
 import { SKIP_NO_ATLAS, SKIP_NO_ATLAS_PAGE } from '../reasons.ts';
 import { pageFootprint, pageGridSentence } from '../../atlas.ts';
 import { readPngHeader } from '../../png.ts';
+import { imageDataProblem } from '../../../tools/plate.ts';
 
 export function a06AtlasPageSizeMatchesPng({ fail: failed, skip }: Verdicts, { atlas }: AtlasRegionFacts, input: { atlasDir: string }, policy: boolean): void {
   if (!atlas) return skip('A06_ATLAS_PAGE_SIZE_MATCHES_PNG', SKIP_NO_ATLAS);
@@ -104,7 +105,32 @@ export function a06AtlasPageSizeMatchesPng({ fail: failed, skip }: Verdicts, { a
           `size was not measured: ${header.problem}`,
       );
     }
-    const info = header.info;
+    // 🔒 **And a page whose header reads and whose image data does not decode
+    // is this rule's too** (issue #1074), for the reason #1064 made the
+    // unreadable header its: this is the one reader of every page that runs
+    // under both profiles. Measured before this, on the tree's 19 recipes with
+    // the first page's compressed stream overwritten past its first half,
+    // this rule PASSED on 19 of 19 (it read the header only) and `A19` alone
+    // named the file, as `threw: cannot decode PNG …`, on the 12 whose first
+    // page carries a part. On the 7 gallery rigs, whose first page is the base
+    // plate `A19` does not scan, nothing did: both rules PASSED under both
+    // profiles, and the default build wrote a directory `render` then died on.
+    //
+    // ⚠️ The stream is inflated, not decoded: `imageDataProblem` is the
+    // decoder's own refusing half and nothing after it — 68.9 ms over the 19
+    // builds' pages against `validate()`'s 286.2 ms under `spine`, where a
+    // whole decode would be 459.6 ms. A page whose data does not decode has no
+    // size worth comparing, so the grid clause is not asked of it: one file,
+    // one line.
+    const undecodable = header.info === null ? null : imageDataProblem(readFileSync(abs), abs);
+    if (undecodable !== null) {
+      fail(
+        'A06_ATLAS_PAGE_SIZE_MATCHES_PNG',
+        `page "${page.name}" declares ${page.width}x${page.height} and its file cannot be read as PNG, so ` +
+          `nothing on it was measured: ${undecodable}`,
+      );
+    }
+    const info = undecodable === null ? header.info : null;
     const onPage = atlas.regions.filter((region) => region.page.name === page.name);
     const gridSaid = info === null ? null : pageGridSentence(page, info, onPage);
     if (gridSaid !== null) {

package/src/assertions/bodies/a19.ts

@@ -17,8 +17,8 @@ import type { SkinEntryFacts } from '../facts/skin_entries.ts';
 import type { StageFacts } from '../facts/stage.ts';
 import { SKIP_NO_ATLAS, SKIP_NO_ATLAS_PAGE } from '../reasons.ts';
 import { pageFootprint } from '../../atlas.ts';
-import { colourTypeName, readPngHeader } from '../../png.ts';
-import { readPlate } from '../../../tools/plate.ts';
+import { colourTypeName, NotAPngError, readPngHeader } from '../../png.ts';
+import { type Plate, readPlate } from '../../../tools/plate.ts';
 import type { RigInfo } from '../../types.ts';
 
 export function a19OverlayPngsHaveAlpha({ fail: failed, skip }: Verdicts, { atlas }: AtlasRegionFacts, stage: StageFacts, { regionAttachments }: Pick<SkinEntryFacts, 'regionAttachments'>, input: { atlasDir: string; rig?: RigInfo }): void {
@@ -160,16 +160,32 @@ export function a19OverlayPngsHaveAlpha({ fail: failed, skip }: Verdicts, { atla
     // holding nothing but the base plate had nothing for this rule to read
     // either way and moves nothing, exactly as a missing one does.
     //
-    // ⚠️ Only what `pngProblem` refuses comes here. A page whose header it
-    // accepts and whose texels the decoder then refuses (a broken zlib stream
-    // in an intact chunk walk) reaches `readPlate` below, which A06 never
-    // calls — this rule is the one reader that finds that file unreadable,
-    // and its line is unchanged by this.
+    // 🔒 **So does a page whose header reads and whose image data does not
+    // decode** (issue #1074). It used to reach `readPlate` below and come out
+    // as this rule's `threw: cannot decode PNG …` — a stack message as the
+    // detail, on 12 of the 19 recipes with a stream broken — because `A06`
+    // read the header only. `A06` now asks the decoder's refusing half too
+    // (`imageDataProblem`) and fails naming the file under both profiles, so
+    // the page is its, by #1064's rule, and joins the same list — at the two
+    // places below where this rule decodes (`decoded`), and not before them:
+    // the header's fast negative (#215) still refuses a file that has nowhere
+    // to keep a clear texel without opening it, which is a verdict about the
+    // header and not about the pixels A06 found unreadable (PT13).
     const header = readPngHeader(abs);
-    if (header.problem !== null) {
+    if (header.info === null) {
       if (carriesPart) unreadable.push(page.name); // A06 names the file; this body says only that it did not read it
       continue;
     }
+    const decoded = (): Plate | null => {
+      try {
+        return readPlate(abs);
+      } catch (err) {
+        // `pngProblem` has accepted the file, so this is the decoder's refusal (`readPlate`'s, #1074): A06 names it.
+        if (!(err instanceof NotAPngError)) throw err;
+        if (carriesPart) unreadable.push(page.name);
+        return null;
+      }
+    };
     if (on.length > 1) {
       // 🚨 A rotated region is refused by A06 under this profile, so this
       // reading was assumed to be cosmetic — a rectangle printed beside a
@@ -203,7 +219,8 @@ export function a19OverlayPngsHaveAlpha({ fail: failed, skip }: Verdicts, { atla
       // what was not measured, which is also what "green means measured"
       // requires: a part this rule could not read must not be certified by
       // it.
-      const plate = readPlate(abs);
+      const plate = decoded();
+      if (plate === null) continue;
       // 🚨 **The scan's coordinates are the atlas's, so a file that is not the
       // declared grid is a non-measurement for every region on it** (issue
       // #715), and #705's clause above does not cover it. That one fires when
@@ -315,7 +332,8 @@ export function a19OverlayPngsHaveAlpha({ fail: failed, skip }: Verdicts, { atla
     // loose page the file IS the part, so no atlas coordinate is read and
     // #705's and #715's non-measurements cannot arise here — and the scan
     // stops at the first clear texel, as the shared page's does.
-    const plate = readPlate(abs);
+    const plate = decoded();
+    if (plate === null) continue;
     let transparent = false;
     for (let y = 0; y < plate.height && !transparent; y++) {
       for (let x = 0; x < plate.width; x++) {

package/src/diff.ts

@@ -884,8 +884,15 @@ function runtimeNames(a: Map<string, AttachmentFact>, b: Map<string, AttachmentF
 
 interface ConstraintFact {
   type: string;
-  /** Every bone or slot the constraint names, sorted — its wiring. */
+  /**
+   * Every name the constraint resolves, as `<field>:<name>` and sorted — its
+   * wiring: the bones and slots it reads and writes, a slider's animation, and
+   * the properties a slider or a transform maps (`property:rotate`,
+   * `property:x>y`). See `constraintFacts` for which fields and why.
+   */
   refs: string;
+  /** The same tokens as a list, for the note that spells a disagreement out. */
+  refList: string[];
 }
 
 /**
@@ -898,6 +905,28 @@ interface ConstraintFact {
  * way, so the report read 1.000 while its own header line counted one constraint
  * more than `constraints.count` did, measured at 14/14 against 13/13 on the
  * export that made the card.
+ *
+ * ⭐ **What the wiring is** (issue #1078): every field of a 4.3 constraint whose
+ * value is a NAME the parser resolves — `SPEC_COVERAGE.md` §1.4, field by field.
+ * `bones`, `bone`, `target`, `source` and `slot` name a bone or a slot; a
+ * slider's `animation` names an animation; a slider's `property` and the
+ * `from`/`to` keys of a transform's `properties` name the property read and the
+ * property written, from a closed set the parser throws outside of. Every other
+ * field is a number, a flag or a mode — a value, which this file does not compare
+ * on either side of any split; the value walk (`diffSkeletonValues`) does.
+ *
+ * 🔍 Until #1078 the list stopped at the five bone and slot fields, so an editor
+ * import that repointed both sliders of a probe (`yaw -> "5"` came back as
+ * `yaw -> "-a"`, issue #1040) read 1.000 on every constraint measure. The two
+ * property fields were blinder still: measured on `gallery/look` and `6-arcs-pro`,
+ * a slider moved from `rotate` to `x` and a transform remapped from `x>x` to
+ * `x>y` moved no measure here and no value in the value walk either (its skip
+ * list names `properties`), so nothing in the tree compared them at all.
+ *
+ * ⚠️ Absent is no token, never a default: a transform with no `properties` maps
+ * nothing, and two sides that both omit a field agree about it. And the tokens
+ * are a set, so the order a file writes `properties` in — an object, re-keyed by
+ * any writer — is not a difference.
  */
 function constraintFacts(root: Json): Map<string, ConstraintFact> {
   const out = new Map<string, ConstraintFact>();
@@ -910,15 +939,91 @@ function constraintFacts(root: Json): Map<string, ConstraintFact> {
       const s = str(b);
       if (s !== null) refs.add(`bone:${s}`);
     }
-    for (const key of ['bone', 'target', 'source', 'slot'] as const) {
+    for (const key of ['bone', 'target', 'source', 'slot', 'animation', 'property'] as const) {
       const s = str(con[key]);
       if (s !== null) refs.add(`${key}:${s}`);
     }
-    out.set(at, { type: str(con.type) ?? '(none)', refs: [...refs].sort().join(' ') });
+    if (isObj(con.properties)) {
+      for (const [from, entry] of Object.entries(con.properties)) {
+        const to = isObj(entry) && isObj(entry.to) ? Object.keys(entry.to) : [];
+        // A `from` with no `to` maps nothing at runtime, but it is still a
+        // statement the file makes, so it is a token of its own rather than
+        // silently equal to the key being absent.
+        if (to.length === 0) refs.add(`property:${from}>`);
+        for (const t of to) refs.add(`property:${from}>${t}`);
+      }
+    }
+    const refList = [...refs].sort();
+    out.set(at, { type: str(con.type) ?? '(none)', refs: refList.join(' '), refList });
   }
   return out;
 }
 
+/** How many disagreeing constraints `constraints.refs`' note spells out before it counts the rest. */
+const REFS_SPELLED_OUT = 3;
+
+/**
+ * One constraint's disagreement, by field: `slider constraint "yaw": animation
+ * "5" vs "-a"` — the candidate's names for each field that differs, then the
+ * reference's, `none` where a side has none.
+ */
+function refsDisagreement(at: string, a: ConstraintFact, b: ConstraintFact): string {
+  const byField = (f: ConstraintFact): Map<string, string[]> => {
+    const m = new Map<string, string[]>();
+    for (const token of f.refList) {
+      const colon = token.indexOf(':');
+      const field = token.slice(0, colon);
+      m.set(field, [...(m.get(field) ?? []), token.slice(colon + 1)]);
+    }
+    return m;
+  };
+  const af = byField(a);
+  const bf = byField(b);
+  const fields = [...new Set([...af.keys(), ...bf.keys()])].sort();
+  const spell = (names: string[] | undefined): string =>
+    names === undefined ? 'none' : names.map((n) => JSON.stringify(n)).join(', ');
+  const parts = fields
+    .filter((f) => (af.get(f) ?? []).join(' ') !== (bf.get(f) ?? []).join(' '))
+    .map((f) => `${f} ${spell(af.get(f))} vs ${spell(bf.get(f))}`);
+  return `${at}: ${parts.join(', ')}`;
+}
+
+/**
+ * `constraints.refs`: `agreement` over the constraints, unchanged in what it
+ * counts, with a note naming each disagreement and both sides' names — the
+ * figure alone says that some constraint is wired differently, and a reader
+ * acting on it needs to know which one and to what (issue #1078).
+ *
+ * The note's two counts partition the misses: a constraint both sides hold whose
+ * wiring differs is spelled out, and one only one side holds is counted, since
+ * `constraints.names` is the measure that names it.
+ */
+function constraintRefs(a: Map<string, ConstraintFact>, b: Map<string, ConstraintFact>): DiffMeasure {
+  const base = agreement(
+    'constraints.refs',
+    'each constraint names the same bones, slots, animation and properties',
+    a,
+    b,
+    (x, y) => x.refs === y.refs,
+  );
+  const differ: string[] = [];
+  for (const [at, fact] of a) {
+    const other = b.get(at);
+    if (other !== undefined && other.refs !== fact.refs) differ.push(refsDisagreement(at, fact, other));
+  }
+  const missed = base.total - base.matched;
+  if (missed === 0) return base;
+  const oneSided = missed - differ.length;
+  const spelled = differ.slice(0, REFS_SPELLED_OUT);
+  const note =
+    (differ.length === 0 ? '' : `${differ.length} wired differently: ${spelled.join('; ')}`) +
+    (differ.length > spelled.length ? `; …and ${differ.length - spelled.length} more` : '') +
+    (oneSided === 0
+      ? ''
+      : `${differ.length === 0 ? '' : '; '}${oneSided} on one side only, which \`constraints.names\` names`);
+  return { ...base, note };
+}
+
 function diffConstraints(c: Json, r: Json): DiffSection {
   const a = constraintFacts(c);
   const b = constraintFacts(r);
@@ -932,7 +1037,7 @@ function diffConstraints(c: Json, r: Json): DiffSection {
       counted([...b.values()].map((f) => f.type)),
     ),
     agreement('constraints.type_by_name', 'each constraint is the same type', a, b, (x, y) => x.type === y.type),
-    agreement('constraints.refs', 'each constraint names the same bones and slots', a, b, (x, y) => x.refs === y.refs),
+    constraintRefs(a, b),
   ]);
 }
 

package/src/png.ts

@@ -154,11 +154,14 @@ function whatItIs(buf: Uint8Array): string {
  * decode PNG …: unexpected end of file`, and reached `build --atlas-in` as a
  * stack trace — three sentences about one file, and none said what it was.
  *
- * It says three things and decodes nothing: what the file is instead (by the
+ * It says four things and decodes nothing: what the file is instead (by the
  * signature it does carry, with its first bytes in hex either way), whether a
- * file that begins as a PNG ends before its chunks do, and whether IHDR comes
- * first. The chunk walk reads only the eight-byte chunk headers, so it costs a
- * skip through the file and no inflate.
+ * file that begins as a PNG ends before its chunks do, whether IHDR comes
+ * first, and whether IHDR states a size of at least 1x1 (issue #1073). The
+ * chunk walk reads only the eight-byte chunk headers, so it costs a skip
+ * through the file and no inflate — which is also why it cannot say whether
+ * the image data decodes: that is `imageDataProblem` in
+ * [`tools/plate.ts`](../tools/plate.ts), beside the decoder (issue #1074).
  *
  * ⚠️ **"Truncated" is judged by the chunk walk, not by a length floor.** The
  * floor that stood here (`buf.length < 26`, "too short") never said truncated,
@@ -208,6 +211,28 @@ export function pngProblem(buf: Uint8Array, path: string): string | null {
         `its ${type} chunk at byte ${at} declares ${length} byte(s) of data, which with its CRC runs to byte ${next}`,
       );
     }
+    if (type === 'IHDR') {
+      // 🔒 **A dimension of 0 is a file that describes no texel** (issue
+      // #1073), and the format says so: IHDR's width and height are each at
+      // least 1. Accepted here, such a page was read as a valid PNG of the
+      // wrong size — A06 printed its grid sentence over a ratio of 0.0000, A19
+      // a "not measured" line once per region on the page (13 on one export),
+      // the compiler took the 0 as a loose part's size and was refused by A03
+      // and A10 (`non-positive size`, `x NaN`) or by the mesher (`bad part
+      // size 0x150`) without the file named, and `render` drew it in silence.
+      // Refused here, it is one fact about one file, said by the one reader
+      // every other reader asks first.
+      const width = view.getUint32(at + 8);
+      const height = view.getUint32(at + 12);
+      if (width === 0 || height === 0) {
+        const zero = width === 0 && height === 0 ? 'its width and its height are' : width === 0 ? 'its width is' : 'its height is';
+        return (
+          `${path} is a PNG whose IHDR chunk states its size as ${width}x${height}: ${zero} 0, where the format ` +
+          'requires each dimension to be at least 1, so the file describes no texel and nothing in it can be ' +
+          'measured or drawn. Re-export it'
+        );
+      }
+    }
     if (type === 'IEND') return null;
     previous = `its ${type} chunk at byte ${at}`;
     at = next;
@@ -216,9 +241,11 @@ export function pngProblem(buf: Uint8Array, path: string): string | null {
 
 /**
  * A file that is not a PNG rigc can read, thrown by the readers that return a
- * value or nothing (`readPngInfo`, `readPlate`). The message is `pngProblem`'s,
- * whole; a caller that owns a named failure — the gate, a `CompileError` —
- * reads the sentence instead of catching the throw (`readPngHeader`).
+ * value or nothing (`readPngInfo`, `readPlate`). The message is `pngProblem`'s
+ * — or, from `readPlate`, `imageDataProblem`'s for a file whose header reads
+ * and whose image data does not decode (issue #1074) — whole; a caller that
+ * owns a named failure — the gate, a `CompileError` — reads the sentence
+ * instead of catching the throw (`readPngHeader`).
  */
 export class NotAPngError extends Error {
   readonly path: string;

package/src/spine_side.ts

@@ -63,6 +63,21 @@ export const SURVEY_RUNTIME_TAIL =
  */
 export const SPINE_SIDE_ABSENT = 'the runtime side is not installed in this entry, which links nothing of spine-core';
 
+/**
+ * What an entry that registered no Spine side adds after the tail: where the
+ * runtime is (issue #1079). On an install `bin/rigc.cjs` runs this entry
+ * wherever `@esotericsoftware/spine-core` does not resolve, so "the runtime is
+ * not linked" there means "it is not installed" — and a clone runs it as
+ * `bun cli_core.ts`, so both routes are named, each for its reader.
+ *
+ * ⚠️ Only the absent side says it. A runtime that is linked and fails to load
+ * (`./render.ts`, `./deformmeasure.ts`) is installed already, and "install it
+ * beside the package" would be the wrong sentence there.
+ */
+export const SPINE_SIDE_ROUTE =
+  'the entry that links it runs them — installed, the same `rigc` once @esotericsoftware/spine-core is installed beside the package; ' +
+  'from a source checkout, `bun cli.ts`';
+
 /** The one sentence a run that needs the runtime and cannot use it is refused in — `tail` says what the runtime is for. */
 export function spineRuntimeSentence(label: string, why: string, reason: string, tail: string): string {
   return `${label} is posed through spine-core (${why}), and the runtime could not be used: ${reason}. ${tail}`;
@@ -107,13 +122,13 @@ export function registerSpineSurvey(side: SpineSurveySide): void {
 
 /** The posing side, or a refusal of `label` (needed for `why`) naming the runtime as absent. */
 export function spinePosingFor(label: string, why: string): SpinePosingSide {
-  if (posing === null) throw new SpineRuntimeError(spineRuntimeSentence(label, why, SPINE_SIDE_ABSENT, POSING_RUNTIME_TAIL));
+  if (posing === null) throw new SpineRuntimeError(spineRuntimeSentence(label, why, SPINE_SIDE_ABSENT, `${POSING_RUNTIME_TAIL}; ${SPINE_SIDE_ROUTE}`));
   return posing;
 }
 
 /** The survey side, or a refusal of `label` (needed for `why`) naming the runtime as absent. */
 export function spineSurveyFor(label: string, why: string): SpineSurveySide {
-  if (survey === null) throw new SpineRuntimeError(spineRuntimeSentence(label, why, SPINE_SIDE_ABSENT, SURVEY_RUNTIME_TAIL));
+  if (survey === null) throw new SpineRuntimeError(spineRuntimeSentence(label, why, SPINE_SIDE_ABSENT, `${SURVEY_RUNTIME_TAIL}; ${SPINE_SIDE_ROUTE}`));
   return survey;
 }
 

package/tools/editor_roundtrip.ts

@@ -153,6 +153,41 @@ function bundleName(plist: string): string | null {
   }
 }
 
+/**
+ * The editor naming its own version, as MEASURED on a licensed 4.3 editor on
+ * macOS 2026-10-02 (issue #1077). `--version` printed nine lines on stdout and
+ * none on stderr, in this shape:
+ *
+ *     the launcher's banner        `Spine Launcher <x.y.z> (<platform>)`
+ *     the copyright line
+ *     the operating system and its version
+ *     `Starting: Spine <x.y.z> Professional`
+ *     `Spine <x.y.z> Professional`             <- this line
+ *     `Licensed to:`
+ *     the licensee's name
+ *     the licensee's e-mail address
+ *     `Complete.`
+ *
+ * 🚨 The tool used to print the last three of those, which are the licensee's
+ * name, e-mail and `Complete.` — personal data in a log that gets pasted into
+ * PR bodies and cards, and no version at all (issue #1040 found it). So the
+ * report keeps ONE line, the one the editor starts with its own name and a
+ * version, and nothing else from that output.
+ *
+ * ⚠️ Anchored at the start of the line and to a version straight after the
+ * word, which is what separates it from its neighbours: the launcher's banner
+ * has `Launcher` there (and is a different version), and the `Starting:` line
+ * does not start with `Spine`. A line that merely contains a version somewhere —
+ * the operating system's — is not the editor's.
+ */
+const EDITOR_VERSION_LINE = /^Spine[ \t]+\d+\.\d+\.\d+\b[^\n]*$/m;
+
+/** What step 0 prints for the editor's version: its own line, or a sentence saying it was not there. */
+function editorVersionLine(output: string): string {
+  const line = EDITOR_VERSION_LINE.exec(output);
+  return line === null ? 'editor version: not found in --version output' : line[0].trim();
+}
+
 /** The trial naming itself in its own `--version` output, or null. */
 function trialSignalFromVersion(output: string): string | null {
   const banner = TRIAL_BANNER.exec(output);
@@ -981,7 +1016,8 @@ function main(): void {
 
     const ver = run(opts.editor, ['--version'], 60);
     emit(`  editor   ${opts.editor}`);
-    for (const line of ver.stdout.trim().split('\n').slice(-3)) emit(`           ${line}`);
+    // One line, never the output's tail: the tail is the licensee's (issue #1077).
+    emit(`           ${editorVersionLine(`${ver.stdout}\n${ver.stderr}`)}`);
     // The second signal, and the only one that works on a platform whose trial
     // path this repository has never seen: the binary's own banner. It costs no
     // extra call — `--version` above is one the tool already made.

package/tools/plate.ts

@@ -15,7 +15,7 @@
 import { deflateSync, inflateSync } from 'node:zlib';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { drawText, textWidth } from './font5x7.ts';
-import { assertPng } from '../src/png.ts';
+import { assertPng, NotAPngError } from '../src/png.ts';
 
 export type RGBA = [number, number, number, number];
 
@@ -266,33 +266,27 @@ function toByte(sample: number, bitDepth: number): number {
   return Math.round((sample * 255) / ((1 << bitDepth) - 1));
 }
 
+/** What `decodePng` has once the stream is inflated and before a scanline is unfiltered. */
+interface InflatedPng {
+  width: number;
+  height: number;
+  bitDepth: number;
+  colourType: number;
+  channels: number;
+  pal: Uint8Array;
+  alphaTable: Uint8Array | null;
+  raw: Uint8Array;
+}
+
 /**
- * Read a PNG back into a `Plate`, expanding whatever it is to straight RGBA.
- *
- * `src/png.ts` parses 26 bytes because that is all the COMPILER needs, and it
- * stays that way: the compiler never re-measures art. This
- * decoder is for the measuring tools, which is where art measurement belongs -
- * the same division that puts `mesh.center` in the manifest as a measured number
- * rather than as something the compiler derives at build time.
- *
- * ⭐ **Every colour type the gate accepts is decodable here** (issue #226). It
- * used to read colour types 2 and 6 only, which was the compiler's own old blind
- * spot rebuilt one step later: `A19` learned in #215 that indexed and greyscale
- * art carrying a `tRNS` chunk is ordinary transparent art — ImageMagick, PNG-8
- * export, GIMP indexed, aseprite and pngquant all write it — so such a part
- * builds and validates green, and would then have been refused by the one command
- * whose whole job is to show the author what they built. A wall removed at the
- * gate and rebuilt at the picture is not a wall removed.
- *
- * So the expansion happens here, at decode: a palette index becomes its `PLTE`
- * entry with its `tRNS` alpha, a greyscale sample becomes three equal channels,
- * and a `tRNS` colour on a type 0 or 2 file becomes alpha 0 on the pixels that
- * match it. Every caller above this line keeps seeing exactly one thing, RGBA.
- *
- * Interlaced files are still refused: Adam7 is a second sample layout rather than
- * a second sample format, and no tool in the corpus writes one.
+ * The half of `decodePng` that can fail: the chunk walk, the header's own
+ * checks, the inflate of every `IDAT` concatenated, and whether what came out
+ * is as long as the header says the image is (issue #1074). Everything after
+ * it — unfiltering, expanding to RGBA — reads bytes that are there and cannot
+ * refuse, so `imageDataProblem` runs exactly this and nothing else, and is the
+ * decoder's own answer rather than a second opinion beside it.
  */
-export function decodePng(buf: Uint8Array): Plate {
+function inflatePng(buf: Uint8Array): InflatedPng {
   const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
   let at = 8;
   let width = 0;
@@ -329,6 +323,47 @@ export function decodePng(buf: Uint8Array): Plate {
   const alphaTable = trns;
 
   const raw = new Uint8Array(inflateSync(Buffer.concat(idat.map((c) => Buffer.from(c)))));
+  // A stream that inflates clean and short is as undecodable as one that does
+  // not inflate: the rows past its end would be read as zeros, a picture the
+  // file never held. Longer is accepted — the spec's decoders ignore the excess.
+  const needed = height * (Math.ceil((width * channels * bitDepth) / 8) + 1);
+  if (raw.length < needed) {
+    throw new Error(
+      `its image data inflates to ${raw.length} byte(s), where a ${width}x${height} image of colour type ` +
+        `${colourType} at bit depth ${bitDepth} needs ${needed}`,
+    );
+  }
+  return { width, height, bitDepth, colourType, channels, pal, alphaTable, raw };
+}
+
+/**
+ * Read a PNG back into a `Plate`, expanding whatever it is to straight RGBA.
+ *
+ * `src/png.ts` parses 26 bytes because that is all the COMPILER needs, and it
+ * stays that way: the compiler never re-measures art. This
+ * decoder is for the measuring tools, which is where art measurement belongs -
+ * the same division that puts `mesh.center` in the manifest as a measured number
+ * rather than as something the compiler derives at build time.
+ *
+ * ⭐ **Every colour type the gate accepts is decodable here** (issue #226). It
+ * used to read colour types 2 and 6 only, which was the compiler's own old blind
+ * spot rebuilt one step later: `A19` learned in #215 that indexed and greyscale
+ * art carrying a `tRNS` chunk is ordinary transparent art — ImageMagick, PNG-8
+ * export, GIMP indexed, aseprite and pngquant all write it — so such a part
+ * builds and validates green, and would then have been refused by the one command
+ * whose whole job is to show the author what they built. A wall removed at the
+ * gate and rebuilt at the picture is not a wall removed.
+ *
+ * So the expansion happens here, at decode: a palette index becomes its `PLTE`
+ * entry with its `tRNS` alpha, a greyscale sample becomes three equal channels,
+ * and a `tRNS` colour on a type 0 or 2 file becomes alpha 0 on the pixels that
+ * match it. Every caller above this line keeps seeing exactly one thing, RGBA.
+ *
+ * Interlaced files are still refused: Adam7 is a second sample layout rather than
+ * a second sample format, and no tool in the corpus writes one.
+ */
+export function decodePng(buf: Uint8Array): Plate {
+  const { width, height, bitDepth, colourType, channels, pal, alphaTable, raw } = inflatePng(buf);
   // The filter operates on BYTES, and its "left neighbour" is one whole pixel
   // back — rounded up to a byte, so sub-byte depths compare against the byte
   // immediately to the left.
@@ -430,6 +465,44 @@ export function readPlate(path: string): Plate {
   try {
     return decodePng(buf);
   } catch (err) {
-    throw new Error(`cannot decode PNG ${path}: ${(err as Error).message}`);
+    // The decoder's refusal as the same sentence the gate prints (issue
+    // #1074), and as the class every command already refuses by name: it was
+    // a bare Error, which `render` and `build` (through a mesh part's trace)
+    // let through as a stack.
+    throw new NotAPngError(path, undecodableSentence(path, (err as Error).message));
+  }
+}
+
+/** What a PNG whose header reads and whose image data does not decode is, as one sentence. */
+function undecodableSentence(path: string, decoder: string): string {
+  return (
+    `${path} is a PNG whose header and chunks read and whose image data cannot be decoded: the decoder stops ` +
+    `with "${decoder}", so no texel of it can be read. Re-export the file, or re-copy it whole`
+  );
+}
+
+/**
+ * Why the image data of a PNG that `pngProblem` accepts cannot be decoded, as
+ * one sentence — or `null` when it can (issue #1074).
+ *
+ * 🔒 **It is the decoder, not a check beside it**: it runs `inflatePng`, the
+ * half of `decodePng` that can refuse, and reports that refusal in the
+ * decoder's own words. `pngProblem` reads chunk headers and never inflates, so
+ * a page with an intact chunk walk over a broken compressed stream passed it,
+ * passed `A06`, and was found only by whichever reader decoded first — `A19`
+ * as `threw: cannot decode PNG …`, `render` and a mesh part's trace as a stack,
+ * and on a page `A19` does not scan (the base plate, or any page under the
+ * default profile) by nobody: such a build was written green.
+ *
+ * ⚠️ Inflate only, deliberately: measured over the 19 recipes' pages it is
+ * 68.9 ms against `validate()`'s 286.2 ms under `spine`, where a whole decode
+ * (`decodePng`, which unfilters and expands every texel) is 459.6 ms.
+ */
+export function imageDataProblem(buf: Uint8Array, path: string): string | null {
+  try {
+    inflatePng(buf);
+    return null;
+  } catch (err) {
+    return undecodableSentence(path, (err as Error).message);
   }
 }