Freeze HD review libraries and checkpoint 441 approved frames

2026-10-11 17:11:36 +11:00
1 parent 26ed9ccdbb
commit aeca7501bb
@@ -2,7 +2,7 @@

 The Rust Options screen includes **HD art**. It starts disabled. Enable it to use reviewed artwork from the selected data directory's `hd/hd.json`; each missing or rejected frame keeps the selected original / 2x / 3x / 4x crisp treatment. The bundled runtime uses `data/`, while development artwork and review jobs live under `../data/`. The scale setting still determines the indexed rendering resolution, and the HD toggle can be changed while paused. HD art is presentation only: simulation, collision sizes, banking positions and save content IDs stay unchanged.

-The development base-game pack currently supplies **340 reviewed replacement frames in 122 complete sequences**. These include all twenty-one light, dark and firing-flash player poses, complete vehicle and boss families, ground defenses and opening bunkers, equipment and pickups, projectile and effect animations, nine pilot portraits, both title logos and sixty-four canonical terrain tiles. A bundled runtime snapshot may have an earlier count until the next packaging refresh; its manifest is the authoritative count for that build. The complete catalog backlog and generation status are listed in [hd-backlog.md](hd-backlog.md).
+The development base-game pack currently supplies **441 reviewed replacement frames in 179 complete sequences**. These include all twenty-one light, dark and firing-flash player poses, complete vehicle and boss families, ground defenses and opening bunkers, equipment and pickups, projectile and effect animations, nine pilot portraits, both title logos, three standalone opening cards and ninety-six canonical terrain tiles. A bundled runtime snapshot may have an earlier count until the next packaging refresh; its manifest is the authoritative count for that build. The complete catalog backlog and generation status are listed in [hd-backlog.md](hd-backlog.md).

 | Reviewed artwork | Original asset IDs | Supplied / complete frames |
 | --- | --- | ---: |
@@ -21,6 +21,9 @@ The development base-game pack currently supplies **340 reviewed replacement fra
 | `SHIP29`, `SHIP30`, `SHIP32`, `SHIP39` craft | `0x10332`, `0x10333`, `0x10335`, `0x10344` | 4 / 4 |
 | `SHIP33` pod deployment | `0x10336`–`0x10339` | 4 / 4 |
 | `SHIP34` orb light states | `0x1033a`–`0x1033b` | 2 / 2 |
+| Orange rotor aircraft phases | `0x10311`–`0x10314` | 4 / 4 |
+| Triple-cylinder and winged craft | `0x10334`, `0x1033d` | 2 / 2 |
+| Yellow rotor aircraft phases | `0x10340`–`0x10343` | 4 / 4 |
 | First-mission industrial boss `SHIP10G1_PIC` | `0x10306` | 1 / 1 |
 | Industrial bosses `SHIP12G1_PIC`, `SHIP17G1_PIC` | `0x10308`, `0x1030f` | 2 / 2 |
 | Industrial boss `SHIP11G1_PIC` | `0x10307` | 1 / 1 |
@@ -38,6 +41,10 @@ The development base-game pack currently supplies **340 reviewed replacement fra
 | Ground targets `TARGT4G1_PIC`, `TARGT9G1_PIC` | `0x1013b`, `0x10160` | 2 / 2 |
 | Ground target `TARG10G1_PIC` | `0x10161` | 1 / 1 |
 | Bonus crate `BONUS1G1_PIC` | `0x10151` | 1 / 1 |
+| Second-campaign ground defenses | `0x20053`, `0x20054`, `0x20056`, `0x20057` | 4 / 4 |
+| Second-campaign hatch-to-turret sequence | `0x2006f`–`0x2007b` | 13 / 13 |
+| Jungle hatch-to-turret sequence | `0x20080`–`0x20087` | 8 / 8 |
+| Intact and damaged ground turret variants | `0x2008d`, `0x20090`, `0x20093`, `0x20096` | 4 / 4 |
 | Forward Guns equipment | `0x102b0` | 1 / 1 |
 | Plasma Guns equipment | `0x102b1`–`0x102b2` | 2 / 2 |
 | Dumb Missile equipment | `0x102b5` | 1 / 1 |
@@ -52,6 +59,9 @@ The development base-game pack currently supplies **340 reviewed replacement fra
 | Missile Pods equipment | `0x102be` | 1 / 1 |
 | Mega Bomb equipment | `0x102c5` | 1 / 1 |
 | Super Shield pickup | `0x102d0` | 1 / 1 |
+| Death Ray equipment phases | `0x102cc`–`0x102cf` | 4 / 4 |
+| Energy pickup phases | `0x102d1`–`0x102d4` | 4 / 4 |
+| Gold pickup flash phases | `0x102db`–`0x102de` | 4 / 4 |
 | Detector and additional shop/pickup images | `0x102d5`–`0x102da` | 6 / 6 |
 | Plasma projectile | `0x101cf`–`0x101d0` | 2 / 2 |
 | Enemy cannon pulse | `0x101d6`–`0x101d7` | 2 / 2 |
@@ -60,7 +70,10 @@ The development base-game pack currently supplies **340 reviewed replacement fra
 | Ground Missile 2 projectile | `0x101bf`–`0x101c0` | 2 / 2 |
 | Forward Guns / MiniGun firing patterns | `0x101c3`–`0x101c6` | 4 / 4 |
 | Mine pulse | `0x101d1`–`0x101d2` | 2 / 2 |
+| Bomb and enemy missile projectiles | `0x101d3`–`0x101d5` | 3 / 3 |
 | Pulse Cannon projectile phases | `0x10223`–`0x10224` | 2 / 2 |
+| Death Ray projectile phases | `0x10231`–`0x10234` | 4 / 4 |
+| Forward Laser projectile phases | `0x10235`–`0x10238` | 4 / 4 |
 | Enemy coconut phases | `0x1024d`–`0x10250` | 4 / 4 |
 | Energy ring | `0x101ae`–`0x101b9` | 12 / 12 |
 | Blue sparks | `0x1019c`–`0x101a4` | 9 / 9 |
@@ -71,11 +84,14 @@ The development base-game pack currently supplies **340 reviewed replacement fra
 | Pickup glow light masks | `0x10225`–`0x10228` | 4 / 4 |
 | Muzzle flash and casing phases | `0x101c7`–`0x101ca` | 4 / 4 |
 | Small air explosion | `0x101fc`–`0x10209` | 14 / 14 |
+| Enemy laser power phases | `0x10245`–`0x10248` | 4 / 4 |
 | Pilot portraits, small and retained large variants | `0x10111`–`0x10119` | 9 / 9 |
 | Original English and Chinese title logos | `0x10013`, `0x10014` | 2 / 2 |
+| Apogee, Cygnus and Taiwan standalone cards | `0x1002b`, `0x1002d`, `0x1002f` | 3 / 3 |
 | Canonical terrain set 1, first shard | `0x10360`–`0x1036f` | 16 / 16 |
 | Canonical terrain set 2, corrected first shard | `0x2010d`–`0x2011c` | 16 / 16 |
 | Canonical industrial terrain, first two shards | `0x300ed`–`0x3010c` | 32 / 32 |
+| Soil, foliage, shadow and rubble terrain | `0x10390`–`0x103af` | 32 / 32 |

 Every registered frame passed the exact original source hash, logical canvas, aspect, visible alpha and path checks. Complete contact sheets were inspected at source size and the 4× presentation size; per-frame geometry metrics and review evidence remain with each family. Their logical collision sizes are unchanged. Small contours and interpreted metal detail differ. Missing artwork keeps the crisp original fallback. HD remains an opt-in preview while the remaining catalog and game screenshots are reviewed.

@@ -87,16 +103,20 @@ The first four equipment families' visible material masks overlap their original

 Small-scale differences remain visible. At 1×, each Plasma projectile loses one tail row: the original 8/6-pixel heights become 7/5 pixels, while 4× retains the original logical extents. The first energy effect's fine cardinal rays also contract under binary alpha at small scales; its 1× bounds become `(7,5)..(34,34)` against original `(3,2)..(38,37)`. At 4× the rays remain visible but end approximately 1–2 logical pixels inside the source extremes. Later rings use smoother, thinner contours. These differences affect presentation and are follow-up candidates for per-asset fallback; source collision dimensions remain unchanged.

-Generated drafts are not active coverage. Earlier player atlas attempts and shortened extreme-bank variants were rejected. The complete light family replaces the initial straight-frame proof; the dark family uses coherent lighting edits of those reviewed poses and the original dark palette. Its exact runtime logical-mask overlap is 87.3–91.4%, with centroid displacement below 0.68 pixels, bounds within one pixel and no clipped meaningful alpha. The newly added Ground Missile, Turret, Pulse Cannon and Energy Grab families preserve their source phase differences. Late Energy Grab interprets two single-pixel peripheral ring holes as filled detail; the main transparent loop remains open. Other equipment families remain uncovered. A 3×3 shoreline prototype preserves the broad coastline and demonstrates the terrain renderer, but remains unregistered: repeated canonical tiles, neighbors and destroyed states need individual artwork and seam review. Original AGX cinematics retain their original artwork.
+Generated drafts are not active coverage. Earlier player atlas attempts and shortened extreme-bank variants were rejected. The complete light family replaces the initial straight-frame proof; the dark family uses coherent lighting edits of those reviewed poses and the original dark palette. Its exact runtime logical-mask overlap is 87.3–91.4%, with centroid displacement below 0.68 pixels, bounds within one pixel and no clipped meaningful alpha. The newly added Ground Missile, Turret, Pulse Cannon and Energy Grab families preserve their source phase differences. Late Energy Grab interprets two single-pixel peripheral ring holes as filled detail; the main transparent loop remains open. The full forty-seven-frame equipment/pickup category is now registered; HUD picture glyphs remain a separate review target. A 3×3 shoreline prototype preserves the broad coastline and demonstrates the terrain renderer, but remains unregistered: repeated canonical tiles, neighbors and destroyed states need individual artwork and seam review. Original AGX cinematics retain their original artwork.

 The firing family preserves all seven original poses and their localized amber reflections. Its distinct straight-frame contour points were checked explicitly: `(19,8)` remains opaque, `(11,12)` and `(11,13)` remain transparent, and `(11,14)` stays opaque. The MiniGun's four rotation phases and the seven newly registered missile phases passed complete sequence inspection; each missile retains its original exhaust length and fin layout. Native scene captures remain a separate reachability check. The additional `SHIP11G1_PIC` boss interprets its dark perimeter: logical alpha overlap is 82.9%, with 373 removed original occupied pixels (252 very dark) and 23 added pixels. Its towers, side machinery, center weapon and lower pods remain readable at every scale, but its alpha contour is not identical to the source.

 The additional fifteen-frame bunker preserves its door apertures, gun and blink phases. Craft tread and hover-wake animations keep their distinct source poses and negative spaces. `SHIP13G1_PIC` has brighter detailed copper panels (mean occupied RGB about `64/47/42` becomes `82/58/52`); its original copper identity and asymmetric silhouette remain readable. `TARG10G1_PIC` uses a reviewed subdued soil correction; the superseded orange-speckled variants remain held.

-The two additional ground targets use subdued brown soil corrections; their machinery and original directions remain intact. The tiny gun sprites keep all four original gray/white patterns, and the mine keeps its pink then dark burgundy center with gold corners. These families have complete gallery review; it does not establish a placed gun or mine scene occurrence.
+The two additional ground targets use subdued brown soil corrections; their machinery and original directions remain intact. The tiny gun sprites keep all four original gray/white patterns, and the mine keeps its pink then dark burgundy center with gold corners. These families have complete gallery review; it does not establish a placed gun or mine scene occurrence. The short Death Ray and Forward Laser beams retain exact native top anchoring, three-row heights and phase widths. Forward Laser’s high-scale bottom antialias edge can end one presentation pixel inward (4× height eleven instead of twelve), while every logical footprint remains exact. The late Death Ray crops trim only weak alpha16–27 fringe and retain all alpha≥32 pixels.

 The first sixteen canonical terrain replacements passed independent review of every source/logical/4× frame, all 48 supplied mission contexts and all 755 declared cardinal neighbor pairs: 170 HD/HD and 585 HD/original. Actual native scene checks exercised all 32 cached scroll phases and content-hash/load-order invalidation. None of these sixteen IDs has a declared destroyed partner; the separate native destruction-cache proof therefore adds no HD debris coverage. The additional corrected terrain family preserves the treeless `0x20111`, and the thirty-two industrial tiles preserve source roof, wall and pipe geometry. Their final compositor review covers all 66 full pages and 1,706 cases: 1,379 neighbor pairs, 234 contexts and 93 state swaps. A texture-preserving edge/corner correction removes the earlier repeating grain ridges without moving source material boundaries. These forty-eight frames are now registered. Mixed HD/original detail contrast remains visible, and foreign destroyed partners still use original fallback; their appearances in state tests do not add HD debris coverage.

+The additional thirty-two terrain frames (`0x10390`–`0x103af`) preserve original grass/tree placement, cast-shadow polygons, pipe routes, rubble strips and destroyed structures. Complete independent review inspected all 61 context pages and 1,426 declared cases at scales 1–4, including the original `0x10395`/`0x10436` and `0x103ae`/`0x1045a`/`0x1045b` state relationships. The finer soil, leaves, rubble and metal texture is visibly denser than original fallback neighbors; no shifted pipe/coast, restored wreck, hole or new edge ridge was observed. Foreign partner artwork still uses original fallback.
+
+The new rotor and hatch-to-turret families retain every original phase; the jungle leaves stay inside the source material region. Energy pickup trajectories retain all original opaque dark backing. Death Ray equipment keeps identical housing across its four light states, with four shared peripheral alpha additions disclosed. Its duplicate pale-gold phases and the gold flash duplicate medium phases use byte-identical source/raw/runtime aliases.
+
 Four small pilot portraits (`0x10116`–`0x10119`) passed actual SDL main-menu SD/HD captures in the new 400×225 layout at logical position `(30,45)`. All eight captures and the comparison board were reviewed; their faces, equipment and slanted ID-card backgrounds stay recognizable, and every surrounding UI pixel was identical. The five large portraits and both title logos have complete gallery review but no verified active UI route. The Chinese logo legitimately uses 478 original fire-class pixels; its HD output preserves that class and adds no water or blink labels.

 The newly reviewed effect families retain their complete phase ordering. Lightning branches are thinner and slightly cooler blue; the late AirBlast rim is thinner; PickupGlow uses a rounded interpreted contour rather than identical alpha. Actual `Canvas::shade` checks over original terrain confirm that pickup-mask holes preserve the background and mask RGB never paints foreground pixels. Other effects remain held where generation filled transparent holes, removed final fragments or made subdued smoke/embers too bright. A successfully decoded draft does not establish artistic approval.
@@ -150,13 +170,13 @@ The original picture header's two fields before width/height are `opt1` and `opt

 The streaming runtime source-checks the complete manifest and validates each original generator-sized PNG/crop when used. It stores no more than the original logical canvas at 4× resolution, the highest supported presentation scale. Raw generated PNGs and provenance remain intact on disk. Three 32 MiB LRU caches hold decoded atlases, derived RGBA frames and palette-bound indexed sprites; eviction never removes a registered frame. A separate derived disk cache is capped at 512 MiB. The full catalog is no longer subject to a 128 MiB artwork admission limit. See [hd-streaming.md](hd-streaming.md) for validation ceilings, cache identities and corruption handling.

-Original source locations also constrain palette classes: ordinary art uses indices 0–239, water stays in 240–244, fire in 245–249, and original blink/flash labels 250–255 remain exact. New HD coverage over an originally transparent location stays ordinary. Compact source-label metadata has a separate 32 MiB ceiling and is omitted for wholly ordinary sources. This prevents static metal or equipment highlights from acquiring fire cycles or blinking merely because a generated RGB value matches an animated palette entry. The accepted frames passed all-scale checks of these reserved-index counts. Static cinematic cards use a separate palette mode with all 256 colors; source references bind Apogee, Cygnus and Taiwan cards to their authentic palettes. These cards still await authored HD artwork and are not counted as remasters.
+Original source locations also constrain palette classes: ordinary art uses indices 0–239, water stays in 240–244, fire in 245–249, and original blink/flash labels 250–255 remain exact. New HD coverage over an originally transparent location stays ordinary. Compact source-label metadata has a separate 32 MiB ceiling and is omitted for wholly ordinary sources. This prevents static metal or equipment highlights from acquiring fire cycles or blinking merely because a generated RGB value matches an animated palette entry. The accepted frames passed all-scale checks of these reserved-index counts. Static cinematic cards use a separate palette mode with all 256 colors; source references bind Apogee, Cygnus and Taiwan cards to their authentic palettes. The three complete source-bound HD still cards are now registered. Their original titles, tagline, Traditional Chinese glyphs and line breaks were compared at all four scales; stronger nebula, star and metal highlights are disclosed. The Taiwan card has no active opening cue, so its coverage is gallery-only. These standalone pictures are distinct from preserved AGX playback.

 HD frames are resampled directly to the selected presentation canvas and quantized to the game palette. They bypass ScaleNx filtering, preserve transparent pixels and use the normal layer order. Indexed output allows palette effects to apply consistently; subtle RGB shades and alpha edges are reduced by the original palette and binary sprite transparency. The validated [terrain renderer](hd-terrain.md) overlays canonical, full-opaque HD tiles on the joined original layer. It shares HD edges and corners where source material classes agree, transitions HD/original boundaries over two logical pixels, and preserves water/fire/flash palette classes. Intact and destroyed IDs are independent targets. The renderer adds no remaster coverage by itself; each terrain family needs the same contextual review before registration.

 The metadata-only [completion ledger](hd-completion.json) tracks every one of the 5,753 original picture IDs, including unused enemies, damaged variants, HUD graphics and unnamed terrain. It separates missing, in-progress, candidate, reviewed, registered and render-reachable stages. `tools/hd_job_queue.py` creates 674 disjoint picture jobs, plus 13 classic cinematic and four bitmap-font verification jobs. Original AGX artwork and sharp native glyphs have explicit preservation policies; they are never reported as AI remasters. The external `../data/hd/jobs/queues/` files assign continuous enemy, boss, equipment/UI, effect/projectile and terrain work with exact source hashes, complete animation families and neighbor/state references. Exact-payload aliases may share reviewed artwork while retaining each ID's source binding.

-Workers can validate an isolated proposal with `python3 tools/hd_candidate_review.py --candidate ../data/hd/jobs/JOB_ID/candidate.json`. The helper hard-links raw artwork into a temporary pack, links against the newest built Rust game library, and exports all scales 1–4 plus source/logical/4× contact sheets. It records raw artwork hashes and the library identity, warns when asset-loader source is newer than the build, and pages large reviews in groups of sixteen frames to avoid an unbounded giant image. Every page listed in `runtime-contact-sheets.json` requires inspection. It never edits the active pack or generated pixels. A successful gallery still needs coordinator visual approval and separate scene/context evidence.
+Workers can validate an isolated proposal with `python3 tools/hd_candidate_review.py --candidate ../data/hd/jobs/JOB_ID/candidate.json`. The helper hard-links raw artwork into a temporary pack, captures an immutable copy of the newest built Rust game library, and exports all scales 1–4 plus source/logical/4× contact sheets. The copy retains the exact original build timestamp and SHA-256; a concurrent Cargo rebuild cannot replace the tested artifact or make old code appear fresh. It records raw artwork hashes, library identity and build origin, rejects a changed snapshot, warns when asset-loader source is newer than the build, and pages large reviews in groups of sixteen frames to avoid an unbounded giant image. Admission rechecks the snapshot hash and source age. Every page listed in `runtime-contact-sheets.json` requires inspection. It never edits the active pack or generated pixels. A successful gallery still needs coordinator visual approval and separate scene/context evidence.

 After explicit artistic and independent approval, the coordinator can run `python3 tools/hd_register_reviewed.py --job JOB_ID --dry-run`, then omit `--dry-run` to register the reviewed family. The command checks every original target, complete sequences, the exact approved frame bindings, all four runtime scales, the reviewed library and unchanged PNG hashes. Held artwork, stale evidence and duplicate registered IDs are rejected. It writes the complete manifest atomically and preserves provenance; registration does not claim a native scene occurrence or finish the catalog backlog.

@@ -1,17 +1,17 @@
 # Original artwork HD backlog

-The checked catalog contains **5,753 standalone picture frames**. The active local HD pack supplies **215**; **5,538** have no registered HD replacement. These counts include unnamed graphics outside `sprites/`. Scale2x/3x/4x filtering is crisp scaling, not a newly authored HD replacement. Authored mod SD/HD art is separate from this original-catalog audit.
+The checked catalog contains **5,753 standalone picture frames**. The active local HD pack supplies **441**; **5,312** have no registered HD replacement. These counts include unnamed graphics outside `sprites/`. Scale2x/3x/4x filtering is crisp scaling, not a newly authored HD replacement. Authored mod SD/HD art is separate from this original-catalog audit.

 | Category | Picture frames | Registered HD | Missing HD | Declared sequences / terrain sets |
 | --- | ---: | ---: | ---: | ---: |
 | Player banking | 21 | 21 | 0 | 3 |
-| Bosses | 249 | 4 | 245 | 79 |
-| Enemies and ground objects | 419 | 46 | 373 | 183 |
-| Player and enemy projectiles | 51 | 17 | 34 | 18 |
-| Explosions and effects | 281 | 69 | 212 | 25 |
-| Equipment and pickups | 47 | 31 | 16 | 23 |
-| Terrain | 4,535 | 16 | 4,519 | 4 |
-| Menus, portraits, HUD and other pictures | 150 | 11 | 139 | mixed static / animated |
+| Bosses | 249 | 33 | 216 | 79 |
+| Enemies and ground objects | 419 | 105 | 314 | 183 |
+| Player and enemy projectiles | 51 | 34 | 17 | 18 |
+| Explosions and effects | 281 | 91 | 190 | 25 |
+| Equipment and pickups | 47 | 47 | 0 | 23 |
+| Terrain | 4,535 | 96 | 4,439 | 4 |
+| Menus, portraits, HUD and other pictures | 150 | 14 | 136 | mixed static / animated |

 ## Registered pack and generation jobs

@@ -101,6 +101,103 @@ Only registered frames passing canvas, source-hash, PNG and alpha checks count a
 | TARGT9G1_PIC | `0x10160` | 1 / 1 |
 | Forward Guns / Mini Gun | `0x101c3` | 4 / 4 |
 | Enemy beam v1 | `0x101d1` | 2 / 2 |
+| Forward Laser | `0x102c8` | 4 / 4 |
+| Pulse Cannon v1 | `0x10223` | 2 / 2 |
+| SHIP16G1_PIC faithful HD candidate | `0x1030e` | 1 / 1 |
+| SHIP22G1_PIC | `0x10319` | 6 / 6 |
+| SHIP10G2_PIC | `0x200a1` | 1 / 1 |
+| SHIP16G2_PIC | `0x200a8` | 4 / 4 |
+| SHIP17G2_PIC | `0x200ac` | 1 / 1 |
+| SHIP18G2_PIC | `0x200ad` | 1 / 1 |
+| SHIP21G2_PIC | `0x200ce` | 6 / 6 |
+| SHIP34G2_PIC | `0x200eb` | 1 / 1 |
+| DUOBOSS_PIC | `0x20104` | 8 / 8 |
+| Terrain 2010d | `0x2010d` | 1 / 1 |
+| Terrain 2010e | `0x2010e` | 1 / 1 |
+| Terrain 2010f | `0x2010f` | 1 / 1 |
+| Terrain 20110 | `0x20110` | 1 / 1 |
+| Terrain 20111 | `0x20111` | 1 / 1 |
+| Terrain 20112 | `0x20112` | 1 / 1 |
+| Terrain 20113 | `0x20113` | 1 / 1 |
+| Terrain 20114 | `0x20114` | 1 / 1 |
+| Terrain 20115 | `0x20115` | 1 / 1 |
+| Terrain 20116 | `0x20116` | 1 / 1 |
+| Terrain 20117 | `0x20117` | 1 / 1 |
+| Terrain 20118 | `0x20118` | 1 / 1 |
+| Terrain 20119 | `0x20119` | 1 / 1 |
+| Terrain 2011a | `0x2011a` | 1 / 1 |
+| Terrain 2011b | `0x2011b` | 1 / 1 |
+| Terrain 2011c | `0x2011c` | 1 / 1 |
+| Terrain set3 intact industrial roof shard1 | `0x300ed` | 16 / 16 |
+| Terrain set 3 shard 2 | `0x300fd` | 16 / 16 |
+| SHIP21G1_PIC | `0x10317` | 2 / 2 |
+| SHIP23G1_PIC | `0x1031f` | 8 / 8 |
+| SHIP29G1_PIC | `0x10332` | 1 / 1 |
+| SHIP32G1_PIC | `0x10335` | 1 / 1 |
+| SHIP39G1_PIC | `0x10344` | 1 / 1 |
+| SHIP33G1_PIC | `0x10336` | 4 / 4 |
+| SHIP34G1_PIC | `0x1033a` | 2 / 2 |
+| SHIP30G1_PIC | `0x10333` | 1 / 1 |
+| Muzzle flash and casings replacement v4 | `0x101c7` | 4 / 4 |
+| Small air explosion replacement v2 | `0x101fc` | 14 / 14 |
+| Enemy coconut v1 | `0x1024d` | 4 / 4 |
+| SHIP19G1_PIC | `0x10311` | 4 / 4 |
+| SHIP31G1_PIC | `0x10334` | 1 / 1 |
+| SHIP36G1_PIC | `0x1033d` | 1 / 1 |
+| SHIP38G1_PIC | `0x10340` | 4 / 4 |
+| TARG1G2_PIC | `0x20053` | 1 / 1 |
+| TARG4G2_PIC | `0x20056` | 1 / 1 |
+| TARG9G2_PIC | `0x2006f` | 13 / 13 |
+| TARG11G2_PIC | `0x20080` | 8 / 8 |
+| TARG2G2_PIC | `0x20054` | 1 / 1 |
+| TARG5G2_PIC | `0x20057` | 1 / 1 |
+| TARG14G2_PIC | `0x2008d` | 1 / 1 |
+| TARG17G2_PIC | `0x20090` | 1 / 1 |
+| TARG20G2_PIC | `0x20093` | 1 / 1 |
+| TARG23G2_PIC | `0x20096` | 1 / 1 |
+| Energy | `0x102d1` | 4 / 4 |
+| Enemy laser power companion padded v3 | `0x10245` | 4 / 4 |
+| Bomb v2 | `0x101d3` | 1 / 1 |
+| Enemy missile v2 | `0x101d4` | 2 / 2 |
+| Itembuy6 | `0x102db` | 4 / 4 |
+| APOGEE_PIC | `0x1002b` | 1 / 1 |
+| CYGNUS_PIC | `0x1002d` | 1 / 1 |
+| TAIWARN_PIC | `0x1002f` | 1 / 1 |
+| Terrain 10390 | `0x10390` | 1 / 1 |
+| Terrain 10391 | `0x10391` | 1 / 1 |
+| Terrain 10392 | `0x10392` | 1 / 1 |
+| Terrain 10393 | `0x10393` | 1 / 1 |
+| Terrain 10394 | `0x10394` | 1 / 1 |
+| Terrain 10395 | `0x10395` | 1 / 1 |
+| Terrain 10396 | `0x10396` | 1 / 1 |
+| Terrain 10397 | `0x10397` | 1 / 1 |
+| Terrain 10398 | `0x10398` | 1 / 1 |
+| Terrain 10399 | `0x10399` | 1 / 1 |
+| Terrain 1039a | `0x1039a` | 1 / 1 |
+| Terrain 1039b | `0x1039b` | 1 / 1 |
+| Terrain 1039c | `0x1039c` | 1 / 1 |
+| Terrain 1039d | `0x1039d` | 1 / 1 |
+| Terrain 1039e | `0x1039e` | 1 / 1 |
+| Terrain 1039f | `0x1039f` | 1 / 1 |
+| Terrain 103a0 | `0x103a0` | 1 / 1 |
+| Terrain 103a1 | `0x103a1` | 1 / 1 |
+| Terrain 103a2 | `0x103a2` | 1 / 1 |
+| Terrain 103a3 | `0x103a3` | 1 / 1 |
+| Terrain 103a4 | `0x103a4` | 1 / 1 |
+| Terrain 103a5 | `0x103a5` | 1 / 1 |
+| Terrain 103a6 | `0x103a6` | 1 / 1 |
+| Terrain 103a7 | `0x103a7` | 1 / 1 |
+| Terrain 103a8 | `0x103a8` | 1 / 1 |
+| Terrain 103a9 | `0x103a9` | 1 / 1 |
+| Terrain 103aa | `0x103aa` | 1 / 1 |
+| Terrain 103ab | `0x103ab` | 1 / 1 |
+| Terrain 103ac | `0x103ac` | 1 / 1 |
+| Terrain 103ad | `0x103ad` | 1 / 1 |
+| Terrain 103ae | `0x103ae` | 1 / 1 |
+| Terrain 103af | `0x103af` | 1 / 1 |
+| Death Ray | `0x102cc` | 4 / 4 |
+| Death Ray padded v3 | `0x10231` | 4 / 4 |
+| Forward Laser padded v3 | `0x10235` | 4 / 4 |

 | Generation job | Status |
 | --- | --- |
@@ -123,7 +220,7 @@ The catalog also contains **303 AGX cinematic delta frames in 13 sequences** and
 2. Ground defenses, airborne enemies and complete boss animation sequences; share palettes and the original logical canvases, rather than treating each enemy frame as an unrelated illustration.
 3. Original projectiles and pickup/equipment animations. Tiny projectiles need careful readability checks; per-asset nearest fallback remains temporary until a clean remaster passes review.
 4. Explosions, flame/spark sequences and other effects. Check full animation timing, transparency and palette cycling, not only a still image.
-5. All four terrain sets, including unnamed catalog tiles. Generate with neighboring context and verify joined seams before changing runtime coverage.
+5. All four terrain sets, including unnamed catalog tiles. Generate from exact canonical source tiles or a literal native object assembly; use neighboring context for review rather than importing foreign scenery into artwork. Verify joined seams and destroyed-state pairs before changing runtime coverage.
 6. Every original menu background, portrait, HUD and retained unused picture. Gameplay UI text and button labels must remain readable and match their actions. Verify the preserved native cinematic/font paths separately.

 ## Reproduce the audit
@@ -134,7 +231,7 @@ python3 tools/hd_art_audit.py --data ../data \
 python3 tools/hd_job_queue.py --data ../data
 ```

-The JSON gives every picture's asset ID, path, logical dimensions, original header options, source hash and HD status, plus each declared animation/set. The [completion ledger](hd-completion.json) records every required picture and native-art verification target, including complete families, ownership and candidate/review/registration stages. Both contain metadata only. Original and original-derived artwork remains outside Git.
+The JSON gives every picture's asset ID, path, logical dimensions, original header options, source hash and HD status, plus each declared animation/set. The [completion ledger](hd-completion.json) records every required picture and native-art verification target, including complete families, ownership and candidate/review/registration stages. Both contain metadata only. Working originals, source references and generation/review drafts under `../data` remain outside this repository. The bundled original catalog and approved HD runtime snapshot under `data/` are tracked in Git; the snapshot is refreshed from reviewed development artwork when packaging.

 Folder totals: `sprites/`: 985, `tiles/`: 232, `misc/`: 4,536. These folders are not semantic categories; terrain and other pictures also live in `misc/`.

@@ -0,0 +1,51 @@
+# HD coordinator checkpoint — 11 October 2026
+
+The reviewed development pack is **441 original picture frames in 179 complete sequences**. The tracked playable snapshot at commit `26ed9cc` contains **340**; only the root assembler refreshes `data/`, `bin/`, `lib/` and `runtime-manifest.json`. Working artwork, prompts and review jobs remain in external `../data/hd/`. These two snapshots are intentional and must not be confused.
+
+## Verified development coverage
+
+| Category | Registered / original pictures |
+| --- | ---: |
+| Player banking and firing | 21 / 21 |
+| Bosses | 33 / 249 |
+| Enemies and ground objects | 105 / 419 |
+| Projectiles | 34 / 51 |
+| Effects | 91 / 281 |
+| Equipment and pickups | 47 / 47 |
+| Terrain | 96 / 4,535 |
+| Menus, portraits, HUD and other pictures | 14 / 150 |
+| Total | 441 / 5,753 |
+
+The complete ledger includes all unused and damaged picture IDs. No picture is excluded because it lacks a current runtime occurrence. The 303 AGX delta frames and four bitmap fonts have explicit classic-art preservation policies; they are not counted as generated HD replacements.
+
+The current audit has no source/hash/canvas/ID errors. The ledger records 421 registered, 20 render-reachable, 1,266 candidate, 1,213 in-progress and 2,833 missing pictures. Candidate status establishes neither artistic acceptance nor native scene coverage. The resulting 5,312-picture HD backlog remains active.
+
+## Exact runtime evidence
+
+`../data/hd/registered-class-review/runtime-441-current/combined-review.json` verifies all **1,764 actual scale outputs** and **2,205 original/scaled PPMs** against independently accepted images byte for byte. All complete new families had separate coordinator original/1×/4× inspection and independent native 2×/3× review before admission. Loader diagnostics are empty, and both source-age guards passed.
+
+The tested immutable library is `target/hd-review-libraries/bc54cb791cb6c17ae65e651491af51831ee9fef33d78000df9904a98c8279876/libraptor_replica-79676ac8bb9ed60d.rlib`, original build timestamp `1791697513165136322`. Its filename, bytes, SHA and original build age are preserved across concurrent Cargo rebuilds. Registration rechecks the exact snapshot and asset/HD source age.
+
+There are 420 ordinary sources with zero newly introduced palette indices 240–255, 18 sources with legitimate gameplay cycling/flash labels, and three standalone cinematic cards using their authentic static 256-color palettes. Static card indices are not gameplay animation classes. Apogee/Cygnus/Taiwan titles, text and line breaks passed source review; Taiwan remains retained gallery-only art with no active opening cue. Four small pilot portraits have current 400×225 SDL menu proof; surrounding UI pixels are identical.
+
+The previous 340-frame full-pack proof remains historical. Admission cohorts are journaled in `../data/hd/registered-class-review/batch-{390,397,429,433,441}-*.json`, with per-job `coordinator-review.json` bound to exact frame maps, raw hashes, independent evidence and current runtime output. Generated pixels were not edited.
+
+The 32 additional set-1 terrain frames passed all 61 independent context pages and 1,426 declared cases at scales 1–4, including original intact/destroyed partners. The other 48 admitted terrain frames retain their earlier 1,706-case grain-fix proof. Foreign state-partner artwork stays original fallback and adds no HD debris coverage. Fine texture contrast against original neighbors is disclosed.
+
+## Resume ownership and pending acceptance
+
+The coordinator alone edits development `../data/hd/hd.json`, provenance, the audit and ledger. Artists own their original disjoint job IDs. Queue refreshes omit registered jobs and can shift numeric positions; continue from durable job IDs rather than reassigning shifted indices. Job bookkeeping can change status metadata while exact candidate/raw/source/render bindings remain frozen; record both metadata hashes honestly.
+
+- `iron_coast_3` independently approved 74 boss03 frames in 22 complete families; `200a2` remains held for a two-logical-pixel shortened nozzle. Exact decisions are in external `.reference/iron-coast-3-hd/boss03-cross-review/`. These approvals still need coordinator primary/current admission.
+- `iron_coast_5` independently approved 50 boss02 frames in 17 complete families. `30045` remains held for occupied wing/backing/strut losses. Full evidence is `.reference/hd-boss2-independent-review/independent-bosses02-review.json`. Component galleries do not prove complete assembled boss seams.
+- `iron_coast_4` independently reviews the other artist's remaining boss01 queue (24 families/81 IDs). Its own Mole and `30045` artwork remain frozen; it never approves its own art.
+- `hd_terrain_render` approved short beam eight, now registered. Separate Mole v4 review accepts repaired later eight phases but keeps the family held: original `10352` index253 indicator disappears at native 1×. Preserve the held main candidate and separate v4. Await root's alpha-edge policy decision before duplicating generation.
+- `hd_full_review` retains terrain `103b0–103bf` / `103c0–103cf` (32) current source/context/material review. HUD eleven is held for `1000c` N7's missing original bright stroke at `(3,6)`; ten other bindings stay unchanged during author correction.
+- `iron_coast_2` authors separate DINO/SHIP35/SHIP40 corrections from source loss maps. Frozen original candidates/queues remain untouched. SHIP40 v3 has independent acceptance with ten small near-black contour losses disclosed; this separate proposal still needs controlled coordinator promotion and admission. SHIP35 v3 and DINO single-source family remain pending/held.
+- `campaign_integration` continues effect/projectile corrections. EnergyGrab6 v3, Plasma1 v2 and EnemyLaser4 v4 are pending independent review. Flare, person fragments and other known source-color/contour holds remain isolated.
+- `hd_dark_player` completed the registered equipment category and prepares only the held N7 correction. `hd_enemies_01` continues its original ungenerated queue; later flying families, damaged variants and tank phases need independent acceptance. APE output-stage refusal is recorded separately from transient connection failures and is not automatically retried.
+- Terrain artists retain source/state/material holds: set1 bridge rows `103d5/6`; set2 fine-grain islands and selected pipe/support geometry; set3 subdued gray remnants/overemphasized debris/foreign beams; set4 source-only crack corrections and mixed original/HD soil density. Successful decode or opacity overlap never resolves these artistic holds.
+
+All generation uses the shared four-slot gate: prepare/view/save prompt before acquire, then acquire → successful start → built-in imagegen → classify and report/release in one execution before returning. Started/unknown calls are recovered rather than silently expired or regenerated. No coordinator generation request is in flight.
+
+Continue acceptance from exact independent records, run current immutable loader proofs, inspect every family row, compare source/scaled output hashes, dry-run complete-family registration, then admit only unchanged approved bindings. Refresh audit and ledger sequentially after admission. Keep tracked runtime untouched until the root assembler explicitly refreshes it. Source/menu/engine changes remain root-owned; Git commands run from this `RustRaptor` repository and checkpoints stage only owned metadata/tools.
@@ -276,7 +276,7 @@ def markdown(report):
        lines.extend(["","| Generation job | Status |","| --- | --- |"])
        for job in report["jobs"]:
            lines.append(f"| {job['name']} | {job['status']} |")
-    lines.extend(["",f"The catalog also contains **{report['cinematics']['frames']} AGX cinematic delta frames in {len(report['cinematics']['sequences'])} sequences** and **{len(report['fonts'])} bitmap fonts**. These have explicit native-art preservation policies: keep the classic cinematics and sharp original glyphs, validate complete playback/alignment, and never count them as generated HD replacements. The AGX frames are separate from standalone pictures.","","## Sequence priorities","","1. Keep all light/dark-player banking poses and firing-flash poses coherent as complete families. Preserve the exact firing-flash source mask, which differs from the light/dark mask for the straight pose.","2. Ground defenses, airborne enemies and complete boss animation sequences; share palettes and the original logical canvases, rather than treating each enemy frame as an unrelated illustration.","3. Original projectiles and pickup/equipment animations. Tiny projectiles need careful readability checks; per-asset nearest fallback remains temporary until a clean remaster passes review.","4. Explosions, flame/spark sequences and other effects. Check full animation timing, transparency and palette cycling, not only a still image.","5. All four terrain sets, including unnamed catalog tiles. Generate with neighboring context and verify joined seams before changing runtime coverage.","6. Every original menu background, portrait, HUD and retained unused picture. Gameplay UI text and button labels must remain readable and match their actions. Verify the preserved native cinematic/font paths separately.","","## Reproduce the audit","","```sh","python3 tools/hd_art_audit.py --data ../data \\","  --json ../data/hd/coverage-audit.json --markdown docs/hd-backlog.md","python3 tools/hd_job_queue.py --data ../data","```","","The JSON gives every picture's asset ID, path, logical dimensions, original header options, source hash and HD status, plus each declared animation/set. The [completion ledger](hd-completion.json) records every required picture and native-art verification target, including complete families, ownership and candidate/review/registration stages. Both contain metadata only. Original and original-derived artwork remains outside Git.","","Folder totals: " + ", ".join(f"`{name}/`: {count:,}" for name,count in report["by_folder"].items()) + ". These folders are not semantic categories; terrain and other pictures also live in `misc/`.",""])
+    lines.extend(["",f"The catalog also contains **{report['cinematics']['frames']} AGX cinematic delta frames in {len(report['cinematics']['sequences'])} sequences** and **{len(report['fonts'])} bitmap fonts**. These have explicit native-art preservation policies: keep the classic cinematics and sharp original glyphs, validate complete playback/alignment, and never count them as generated HD replacements. The AGX frames are separate from standalone pictures.","","## Sequence priorities","","1. Keep all light/dark-player banking poses and firing-flash poses coherent as complete families. Preserve the exact firing-flash source mask, which differs from the light/dark mask for the straight pose.","2. Ground defenses, airborne enemies and complete boss animation sequences; share palettes and the original logical canvases, rather than treating each enemy frame as an unrelated illustration.","3. Original projectiles and pickup/equipment animations. Tiny projectiles need careful readability checks; per-asset nearest fallback remains temporary until a clean remaster passes review.","4. Explosions, flame/spark sequences and other effects. Check full animation timing, transparency and palette cycling, not only a still image.","5. All four terrain sets, including unnamed catalog tiles. Generate from exact canonical source tiles or a literal native object assembly; use neighboring context for review rather than importing foreign scenery into artwork. Verify joined seams and destroyed-state pairs before changing runtime coverage.","6. Every original menu background, portrait, HUD and retained unused picture. Gameplay UI text and button labels must remain readable and match their actions. Verify the preserved native cinematic/font paths separately.","","## Reproduce the audit","","```sh","python3 tools/hd_art_audit.py --data ../data \\","  --json ../data/hd/coverage-audit.json --markdown docs/hd-backlog.md","python3 tools/hd_job_queue.py --data ../data","```","","The JSON gives every picture's asset ID, path, logical dimensions, original header options, source hash and HD status, plus each declared animation/set. The [completion ledger](hd-completion.json) records every required picture and native-art verification target, including complete families, ownership and candidate/review/registration stages. Both contain metadata only. Working originals, source references and generation/review drafts under `../data` remain outside this repository. The bundled original catalog and approved HD runtime snapshot under `data/` are tracked in Git; the snapshot is refreshed from reviewed development artwork when packaging.","","Folder totals: " + ", ".join(f"`{name}/`: {count:,}" for name,count in report["by_folder"].items()) + ". These folders are not semantic categories; terrain and other pictures also live in `misc/`.",""])
    effects=next(row for row in report["by_category"] if row["category"]==CATEGORIES[4])
    effect_ranges=effects["declared_sequences_or_sets"]
    lines.extend(["## Secondary effect coverage", "", f"Native animation registrations, pickup masks and beam impact/power companion arrays contribute {effects['pictures']:,} distinct effect frames. The {effect_ranges} declared ranges include one five-frame descending-smoke subset of the nine-frame smoke family, leaving {effect_ranges-1} complete families. This includes muzzle flashes/casings, laser impacts, smoke trails, lightning, sparks and the super-shield glow as well as explosions. Pickup glow uses indexed light-table mask semantics and needs a different HD treatment from an ordinary color sprite. These assets are not UI artwork merely because they are absent from the content registries. Renderer event reachability needs its own check before claiming complete gameplay effect coverage.", ""])
@@ -67,6 +67,49 @@ def binding_digest(rows):
    return hashlib.sha256(json.dumps(rows, sort_keys=True, separators=(",", ":")).encode()).hexdigest()


+def freeze_library(project, library):
+    """Keep exact tested bytes and the original build time across Cargo rebuilds."""
+    before = library.stat()
+    payload = library.read_bytes()
+    after = library.stat()
+    identity = lambda value: (value.st_ino, value.st_size, value.st_mtime_ns)
+    if identity(before) != identity(after):
+        raise ValueError("Rust library changed while taking review snapshot; retry")
+    digest = hashlib.sha256(payload).hexdigest()
+    directory = project / "target/hd-review-libraries" / digest
+    directory.mkdir(parents=True, exist_ok=True)
+    frozen = directory / library.name
+    if frozen.exists():
+        if hashlib.sha256(frozen.read_bytes()).hexdigest() != digest:
+            raise ValueError("review library snapshot is corrupt")
+        if frozen.stat().st_mtime_ns != before.st_mtime_ns:
+            # Identical bytes rebuilt later must not make an old snapshot look
+            # fresh. Separate build times retain an honest source-age check.
+            frozen = directory / (library.stem + "-build-" + str(before.st_mtime_ns) + library.suffix)
+    if not frozen.exists():
+        descriptor, temporary = tempfile.mkstemp(prefix="library-", dir=directory)
+        try:
+            with os.fdopen(descriptor, "wb") as output:
+                output.write(payload)
+                output.flush()
+                os.fsync(output.fileno())
+            os.utime(temporary, ns=(before.st_atime_ns, before.st_mtime_ns))
+            os.chmod(temporary, 0o444)
+            try:
+                # Publish without replacing an identical snapshot another
+                # reviewer may already be using. Concurrent first readers
+                # must retain one stable inode as well as identical bytes.
+                os.link(temporary, frozen)
+            except FileExistsError:
+                pass
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
+    if hashlib.sha256(frozen.read_bytes()).hexdigest() != digest or frozen.stat().st_mtime_ns != before.st_mtime_ns:
+        raise ValueError("review library snapshot identity differs")
+    return frozen, digest, before
+
+
 def main():
    project = Path(__file__).resolve().parents[1]
    parser = argparse.ArgumentParser(description=__doc__)
@@ -95,9 +138,10 @@ def main():
    libraries = [library for profile in profiles for library in (project / "target" / profile / "deps").glob("libraptor_replica-*.rlib")]
    if not libraries:
        raise ValueError("build the Rust game library before candidate review")
-    library = max(libraries, key=lambda path: path.stat().st_mtime_ns)
+    built_library = max(libraries, key=lambda path: path.stat().st_mtime_ns)
+    dependency_directory = built_library.parent
+    library, library_sha256, built_library_at_start = freeze_library(project, built_library)
    library_at_start = library.stat()
-    dependency_directory = library.parent
    serde = max(dependency_directory.glob("libserde_json-*.rlib"), key=lambda path: path.stat().st_mtime_ns)
    output = (args.output or args.candidate.parent / "runtime-review").resolve()
    output.mkdir(parents=True, exist_ok=True)
@@ -140,6 +184,9 @@ def main():
        raise ValueError("candidate renderer bindings changed during runtime review")
    qa["library"] = str(library.relative_to(project))
    qa["library_modified_ns"] = library_at_start.st_mtime_ns
+    qa["library_sha256"] = library_sha256
+    qa["library_build_origin"] = str(built_library.relative_to(project))
+    qa["library_build_origin_modified_ns"] = built_library_at_start.st_mtime_ns
    qa["candidate_sha256"] = hashlib.sha256(candidate_at_finish).hexdigest()
    qa["candidate_sha256_at_start"] = hashlib.sha256(candidate_at_start).hexdigest()
    qa["candidate_notes_changed_during_review"] = candidate_at_start != candidate_at_finish
@@ -55,6 +55,8 @@ def approved_job(root, identity, project):
    library = (project / qa["library"]).resolve()
    if not library.is_relative_to(project / "target") or library.stat().st_mtime_ns != qa["library_modified_ns"]:
        raise ValueError(f"runtime library was replaced after review: {identity}")
+    if qa.get("library_sha256") and hashlib.sha256(library.read_bytes()).hexdigest() != qa["library_sha256"]:
+        raise ValueError(f"runtime library bytes changed after review: {identity}")
    for name in ["assets.rs", "hd.rs"]:
        if (project / "src" / name).stat().st_mtime_ns > qa["library_modified_ns"]:
            raise ValueError(f"asset/HD code changed after review: {identity}")