Fix HD atlas sampling and protected terrain joins

Add rational atlas cells and bounded authenticated Original-detail retention with standalone synthetic regression checks. Rebuild Linux and Windows runtimes; validate all 5384 supplied frames and preserve three exact 1080p regression controls.

tools/hd_art_audit.py

@@ -12,7 +12,7 @@ import struct
 from pathlib import Path
 from PIL import Image
 from hd_art_source import decode
-from hd_frame_policy import FRAME_KEYS, validate_frame_policy
+from hd_frame_policy import FRAME_KEYS, validate_frame_policy, atlas_grid_geometry
 
 CATEGORIES = ["Player banking", "Bosses", "Enemies and ground objects", "Player and enemy projectiles", "Explosions and effects", "Equipment and pickups", "Terrain", "Menus, portraits, HUD and other pictures"]
 
@@ -32,7 +32,12 @@ def integer_rounded_aspect(width, height, logical_width, logical_height):
     )
 
 def validate_hd_frame(root, frame, payload, picture):
-    """Mirror loader checks; artistic approval is deliberately a separate step."""
+    """Mirror loader checks, including actual-Source extended retention density.
+
+    Schema-only preparation is not enough for65..128 cells; the shared policy
+    validator receives the decoded authentic payload here before any PNG read.
+    Artistic approval remains separate.
+    """
     validate_frame_policy(frame, payload)
     if frame["source_sha256"] != hashlib.sha256(payload).hexdigest():
         raise ValueError("original source hash changed")
@@ -56,6 +61,22 @@ def validate_hd_frame(root, frame, payload, picture):
         image = source.convert("RGBA")
     png_size = image.size
     source_alpha_min, source_alpha_max = picture.getchannel("A").getextrema()
+    geometry = atlas_grid_geometry(frame, image.width, image.height)
+    if geometry is not None:
+        # Every raw pixel with positive area inside the rational viewport is
+        # checked. This read-only view is not a fitted crop or replacement PNG.
+        left, top, right, bottom = geometry["pixels"]
+        alpha_min, alpha_max = image.getchannel("A").crop((left, top, right, bottom)).getextrema()
+        if source_alpha_min == 0 and alpha_min != 0:
+            raise ValueError("transparent original needs a transparent HD background")
+        if alpha_max < 128:
+            raise ValueError("artwork has no visible pixels")
+        width, height = geometry["resident"]
+        # Mirror the new fractional sampler's explicit working-buffer bound.
+        integral = all(value.denominator == 1 for value in geometry["bounds"])
+        if not integral and width * (bottom - top) > 4_194_304:
+            raise ValueError("rational atlas temporary canvas exceeds limit")
+        return width * height * 4
     if frame.get("crop") is not None:
         x, y, width, height = frame["crop"]
         if min(x, y) < 0 or min(width, height) <= 0 or x + width > image.width or y + height > image.height:

tools/hd_frame_policy.py

@@ -1,8 +1,57 @@
 """Strict optional HD presentation metadata; source fidelity requires peer review."""
 import struct
+from fractions import Fraction
 
 FRAME_KEYS = {"frame", "file", "logical_width", "logical_height", "origin",
-              "source_sha256", "crop", "preserve_reserved_coverage", "native_nearest_cues", "original_detail_cells"}
+              "source_sha256", "crop", "atlas_grid", "preserve_reserved_coverage", "native_nearest_cues", "original_detail_cells"}
+
+def validate_atlas_grid(frame):
+    grid = frame.get("atlas_grid")
+    if grid is None:
+        return None
+    if type(grid) is not dict or set(grid) != {"columns", "rows", "column", "row"}:
+        raise ValueError("atlas_grid needs exactly columns/rows/column/row")
+    if any(type(value) is not int or not 0 <= value < 2**32 for value in grid.values()):
+        raise ValueError("atlas_grid fields must be u32 integers")
+    if frame.get("crop") is not None:
+        raise ValueError("atlas_grid and crop are mutually exclusive")
+    if grid["columns"] == 0 or grid["rows"] == 0 or grid["columns"] * grid["rows"] > 16384:
+        raise ValueError("atlas_grid axes or cell count invalid")
+    if grid["column"] >= grid["columns"] or grid["row"] >= grid["rows"]:
+        raise ValueError("atlas_grid cell is outside its declared axes")
+    return grid
+
+def atlas_grid_geometry(frame, width, height):
+    """Exact equal bounds and a bounded, uniform resident2x–4x canvas."""
+    grid = validate_atlas_grid(frame)
+    if grid is None:
+        return None
+    if any(type(value) is not int or value <= 0 for value in [width, height]):
+        raise ValueError("invalid atlas dimensions")
+    lw, lh = frame["logical_width"], frame["logical_height"]
+    if any(type(value) is not int or not 0 < value < 2**32 for value in [lw, lh]):
+        raise ValueError("invalid logical dimensions")
+    cols, rows = grid["columns"], grid["rows"]
+    if width * lh * rows != height * lw * cols:
+        raise ValueError("rational atlas cell aspect differs from original canvas")
+    if width < 2 * cols * lw or height < 2 * rows * lh:
+        raise ValueError("rational atlas cell needs at least twice the logical resolution")
+    factor = min(width // (cols * lw), height // (rows * lh), 4)
+    left, right = Fraction(width * grid["column"], cols), Fraction(width * (grid["column"] + 1), cols)
+    top, bottom = Fraction(height * grid["row"], rows), Fraction(height * (grid["row"] + 1), rows)
+    floor = lambda value: value.numerator // value.denominator
+    ceil = lambda value: -(-value.numerator // value.denominator)
+    return dict(bounds=(left, top, right, bottom),
+                pixels=(floor(left), floor(top), ceil(right), ceil(bottom)),
+                resident=(lw * factor, lh * factor))
+
+LEGACY_RETAINED_POLICY = "retained-original-details-v2-painted0255"
+EXTENDED_RETAINED_POLICY = "retained-original-details-v3-max128-quarter-painted0255"
+
+def retained_review_version_ok(version, retained_details):
+    """The old declaration cannot authorize a new longer list; old bytes stay valid."""
+    return version == EXTENDED_RETAINED_POLICY or (version == LEGACY_RETAINED_POLICY
+            and all(len(cells) <= 64 for cells in retained_details.values()))
 
 def _indices(payload):
     if len(payload) < 20:
@@ -40,6 +89,7 @@ def _indices(payload):
 def validate_frame_policy(frame, source_payload=None):
     if set(frame) - FRAME_KEYS:
         raise ValueError("unknown HD frame fields")
+    validate_atlas_grid(frame)
     if type(frame.get("preserve_reserved_coverage", False)) is not bool:
         raise ValueError("preserve_reserved_coverage must be a boolean")
     cues = frame.get("native_nearest_cues", [])
@@ -68,8 +118,8 @@ def validate_frame_policy(frame, source_payload=None):
             raise ValueError("native nearest cue must be an ordinary original source cell")
 
     details = frame.get("original_detail_cells", [])
-    if type(details) is not list or len(details) > 64:
-        raise ValueError("original_detail_cells must contain at most64 Source cells")
+    if type(details) is not list or len(details) > 128:
+        raise ValueError("original_detail_cells must contain at most128 Source cells")
     previous = None
     for cell in details:
         if type(cell) is not list or len(cell) != 2 or any(type(n) is not int or not 0 <= n < 2**32 for n in cell):
@@ -86,3 +136,8 @@ def validate_frame_policy(frame, source_payload=None):
             raise ValueError("Original detail canvas differs from Source")
         if any(not 0 <= indices[y * width + x] < 256 for x, y in details):
             raise ValueError("Original details select painted Source indices0–255 only")
+
+        # Metadata-only preparation can check structure, not claim Source density.
+        # Runtime, audit and extended registrar approval supply actual payloads.
+        if len(details) > 64 and len(details) * 4 > sum(0 <= p <= 255 for p in indices):
+            raise ValueError("65..128 Original details may retain at most one quarter of painted Source")

tools/hd_register_reviewed.py

@@ -17,6 +17,7 @@ from pathlib import Path
 from hd_candidate_review import binding_digest, proposal_frames
 from hd_art_audit import checked_palette, validate_hd_frame
 from hd_art_source import decode
+from hd_frame_policy import validate_frame_policy, retained_review_version_ok
 
 
 def asset_list(value, label):
@@ -454,6 +455,41 @@ def approved_catalog_only_retained_evidence(root, project, declaration, rows, qa
         raise ValueError("catalog-only actual all-scale evidence differs")
 
 
+def validate_extended_retained_sources(project, rows):
+    """Longer lists require authentic catalog bytes, not claimed QA pixel counts.
+
+    Only the two product data layouts are eligible. ID+SHA select the authentic
+    payload; a catalog-only trace is still separately bound to its exact root.
+    No generated PNG or recorded density can supply the denominator.
+    """
+    for asset, frame in rows.items():
+        if len(frame.get("original_detail_cells", [])) <= 64:
+            continue
+        authenticated = False
+        for data in (project / "data", project.parent / "data"):
+            index = data / "INDEX"
+            if not index.is_file():
+                continue
+            matches = [parts for line in index.read_text().splitlines()
+                       if len(parts := line.split()) == 3 and int(parts[0], 16) == int(asset, 16)]
+            if len(matches) != 1:
+                continue
+            relative = Path(matches[0][2])
+            if relative.is_absolute() or ".." in relative.parts:
+                raise ValueError("extended Original Source path escapes catalog")
+            path = (data / relative).resolve()
+            if not path.is_relative_to(data.resolve()):
+                raise ValueError("extended Original Source path escapes catalog")
+            payload = path.read_bytes()
+            if hashlib.sha256(payload).hexdigest() != frame["source_sha256"]:
+                continue
+            validate_frame_policy(frame, payload)
+            authenticated = True
+            break
+        if not authenticated:
+            raise ValueError("extended Original details lack authentic catalog Source bytes")
+
+
 def approved_job(root, identity, project):
     directory = contained(root, Path("jobs") / identity)
     if directory.parent != (root / "jobs").resolve():
@@ -492,7 +528,7 @@ def approved_job(root, identity, project):
                                and declaration.get("catalog_only_independent_whole_material_and_allscale_review") is True)
         if (not same_json(declaration.get("cells_by_asset"), retained_details)
                 or declaration.get("retained_original_not_generated_HD") is not True
-                or declaration.get("policy_version") != "retained-original-details-v2-painted0255"
+                or not retained_review_version_ok(declaration.get("policy_version"), retained_details)
                 or not same_json(declaration.get("painted_Source_palette_domain"), [0, 255])
                 or declaration.get("functional_palette_effects_are_retained_Original") is not True
                 or not qualified_scope
@@ -550,6 +586,7 @@ def approved_job(root, identity, project):
         approved_standalone_evidence(root, selection, review, rows, qa)
     elif retained_details and catalog_only:
         approved_catalog_only_retained_evidence(root, project, declaration, rows, qa)
+    validate_extended_retained_sources(project, rows)
     return candidate, review, rows