Preserve finer original sprite details in HD rendering

docs/hd-streaming.md

@@ -1,5 +1,7 @@
 # Full-catalog HD loading and caches
 
+The included SourceF runtime supports the optional 129–256-cell retained-Original tier described below. Artwork coverage remains 5,463 pictures, with 290 awaiting approval; this runtime update admits no new artwork. Actual production validation is recorded separately in [runtime release evidence](hd-runtime-release.json).
+
 The runtime can register the complete original picture catalog without retaining every decoded replacement in RAM. Registration accepts up to 8 MiB of JSON metadata, 8,192 sequences and 16,384 distinct asset IDs. Each sequence still has at most 512 declared frames. These are validation ceilings, not coverage claims.
 
 `HdAssets::load_lazy(root, catalog, cache_dir)` checks all sequence IDs before committing the manifest. Duplicate IDs, arithmetic overflow, unsupported formats and invalid sequence lengths reject the pack atomically. Each supplied frame must match the checked original payload SHA-256, logical canvas and `[0,0]` anchor. Its PNG path must resolve inside the pack, including symlinks. Missing files and individual source mismatches produce diagnostics and native-art fallback.
@@ -24,9 +26,9 @@ Terrain must pass the trusted domain returned by `terrain_sprite_with_palette` i
 
 Palette-constrained frames have a separate versioned frame/indexed/prepared-terrain identity. Default keys remain exact. A validated domain costs 48 bytes on 64-bit targets and is included in the existing combined 32 MiB Source-reference budget; no additional full Source raster or unbounded per-domain transition table is retained.
 
-- `original_detail_cells: [[x, y], ...]` retains explicitly listed **Original** logical details at gameplay scales 1–4. Legacy lists of up to 64 cells keep their existing behavior. Lists of 65–128 cells additionally require `4 * retained_cell_count <= painted_Source_cell_count`, counted from the decoded authentic Original payload (indices 0–255, excluding transparency), never canvas area or generated PNG alpha. All cells must remain sorted, unique, in bounds, painted and disjoint from `native_nearest_cues`; transparent Source cells are rejected. The runtime copies the exact Original ScaleNx footprint into the generated replacement only in SourceClasses/gameplay mode. Terrain conditions retained samples with the authentic joined Original control before blending neighbors, then restores their exact footprints after all joins. This can also change neighboring pixels within the existing join bands; unrelated pixels and fallback behavior remain unchanged. Static cards continue to sample the PNG. Raw PNG bytes, alpha, framing and loader eligibility do not change.
+- `original_detail_cells: [[x, y], ...]` retains explicitly listed **Original** logical details at gameplay scales 1–4, up to a universal maximum of 256 cells. Legacy lists of up to 64 cells keep their existing behavior. Lists of 65–256 cells additionally require `4 * retained_cell_count <= painted_Source_cell_count`, counted from the decoded authentic Original payload (indices 0–255, excluding transparency), never canvas area or generated PNG alpha. Coordinates must be sorted, unique, in bounds, painted and disjoint from `native_nearest_cues`; transparent Source cells and lists above 256 are rejected. The runtime copies the exact Original ScaleNx footprints in SourceClasses/gameplay mode. Terrain conditions retained samples with the authentic joined Original control before blending neighbors, then restores their exact footprints after all joins. Neighboring pixels within existing join bands can change; unrelated pixels and fallback behavior are unchanged. Static cards continue to sample the PNG. Raw PNG bytes, alpha, framing and loader eligibility do not change.
 
-Retained pixels are Original details, not generated HD. Original palette cycling, water/fire and blinking labels remain live Source indices; ScaleNx may also contain transparent subpixels shaped by Original neighbors. Coarse detail or palette effects can form visible seams and require explicit independent all-scale and genuine-context hybrid review. The ordinary-only predecessor is not a current hybrid approval. Registration accepts the existing `retained-original-details-v2-painted0255` declaration only for legacy lists of up to 64, or `retained-original-details-v3-max128-quarter-painted0255` with exact selected cells. Longer lists always require v3 and actual catalog Source validation by the registrar. Metadata-only candidate preparation cannot prove the density bound. Lists up to 64 preserve existing per-frame, indexed and rejected-fallback cache identities; longer lists use new indexed and rejected-fallback namespaces. Protected terrain joins follow the conditioning rule above for either list size. The combined 32 MiB Source-reference budget is unchanged. Retained cells never count as generated detail, and the area rule does not prove novelty in the unretained cells. A whole-Source fallback cannot gain artistic HD approval through this option; legacy acceptance is preserved without relabeling its pixels. Material, all-scale and genuine-context gates stay in force (the separately bounded unused-catalog scope still explicitly declares no genuine runtime context). Existing default artwork holds are preserved; this option does not rescue invalid framing, provider refusals or broad geometry/material failures.
+Retained pixels are Original details, not generated HD. Original palette cycling, water/fire and blinking labels remain live Source indices; ScaleNx may also contain transparent subpixels shaped by Original neighbors. Registration accepts `retained-original-details-v2-painted0255` only up to 64 cells, `retained-original-details-v3-max128-quarter-painted0255` up to 128, and `retained-original-details-v4-max256-quarter-painted0255` up to 256, with exact selected cells and the actual catalog Source density check above 64. A v3 declaration still rejects a list above 128 after SourceF is installed; lists of 129–256 need v4. Metadata-only preparation cannot establish the painted-cell bound. Existing per-frame, indexed, rejected-fallback and prepared-terrain cache identities through 128 cells remain exact; lists of 129–256 use distinct v4 namespaces. The combined 32 MiB Source-reference budget is unchanged. Coarse detail, palette effects and changes within neighboring join bands still require independent whole-frame, all-scale and genuine-context hybrid review. The count allowance does not establish novel generated detail in the remaining cells or turn whole-Source fallback into artistic HD approval. Legacy acceptance is preserved without relabeling Original pixels. The separately bounded unused-catalog scope still explicitly declares no genuine runtime context. Existing artwork HOLDs and actual refusals remain in force; this option does not rescue invalid framing or broad geometry/material failures.
 
 Opt-in metadata participates in both derived and indexed cache identities. Frames without these policies retain their previous cache keys and pixels. Retained-detail opt-ins have a distinct versioned frame, rejected-fallback and prepared-terrain key; absent/empty selections keep the previous identities. The candidate and original-art audit tools validate the same metadata restrictions as the Rust loader.