feat: add focal-aware rendering safeguards

.codex/skills/create-codex-theme/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: create-codex-theme
-description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明确披露的非官方 Fan Art。适用于把一句视觉想法变成双语 theme brief、用 OpenAI image job 生成安全留白的源图、写入 themes/catalog.json 与 source-art/jobs.json、导出明暗模式并运行 ACT Registry 校验。Use when a user asks to create, adapt, package, validate, or contribute a Codex theme in this repository.
+description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明确披露的非官方 Fan Art。适用于把一句视觉想法变成双语 theme brief、用 OpenAI image job 生成带焦点构图与安全区的 16:9 源图、写入 themes/catalog.json 与 source-art/jobs.json、导出明暗模式并运行 ACT Registry 校验。Use when a user asks to create, adapt, package, validate, or contribute a Codex theme in this repository.
 ---
 
 # 创建 Codex 主题
@@ -31,7 +31,7 @@ description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明
 - 中文主名称与英文辅助名称
 - 一句话场景 brief
 - `original` 或 `fan-art` 权利轨道与相应声明
-- 左侧或右侧安全留白
+- 左侧、右侧、中部或无安全区，以及与主体对应的焦点位置
 - 明暗模式 token
 
 中文文案先写，英文随后补齐。描述具体画面，不使用“震撼”“极致”“重新定义”等宣传套话。
@@ -57,6 +57,8 @@ node .codex/skills/create-codex-theme/scripts/scaffold-theme.mjs \
 
 ### 4. 生成并审查源图
 
+新主题的 source art 必须为 2560×1440 或更高的 16:9 图像。`themes/source-art/jobs.json` 中现有 1536×1024 的具名历史例外只覆盖已列出的 ID，不能复制给新主题。
+
 使用仓库的 image job 流程：
 
 ```bash
@@ -69,10 +71,17 @@ npm run art:generate -- --ids=<theme-id>
 - 画面没有文字、签名、水印、Logo 或 UI
 - 原创轨道的人物和物件不像现成 IP；Fan Art 只出现 brief 已声明的角色
 - Fan Art 没有复制官方截图、海报、镜头、Logo 或宣传素材
-- 16:9 中心裁切不会截断主体
+- 焦点裁切在 16:9 输出中不会截断主体
 - 图片达到主题 Gallery 的完成度
 
-任何一项不合格，就改 job prompt 后重跑 `--force`。具体命令和检查顺序见 [references/image-job-playbook.md](references/image-job-playbook.md)。
+任何一项不合格，就改 job prompt 后重跑 `--force`。通过源图检查后运行：
+
+```bash
+npm run art:review:write
+npm run art:review
+```
+
+打开联系表和安全区夹具，确认焦点输出与 `left`、`right`、`center`、`none` 四种阅读区都符合 brief。具体命令和检查顺序见 [references/image-job-playbook.md](references/image-job-playbook.md)。
 
 ### 5. 生成主题包
 

.codex/skills/create-codex-theme/references/image-job-playbook.md

@@ -12,6 +12,8 @@
 
 ## 生成一张
 
+新主题的 job 输出必须为 2560×1440 或更高的 16:9 图像。`themes/source-art/jobs.json` 中的 1536×1024 历史例外只适用于列出的现有主题，不能复制给新 ID。
+
 ```bash
 npm run art:generate -- --ids=qinglan-odyssey
 ```
@@ -38,15 +40,17 @@ npm run art:generate -- --ids=theme-a,theme-b --concurrency=2
 - 城市或幻想世界靠什么气质被识别
 - 哪些具体元素不要出现
 
+同时写明主体对应的 `focusX`、`focusY` 与阅读安全区。新源图已是 16:9，不能依赖后续中心裁切来修正构图。
+
 不要重复 common prompt，也不要写具体画师或工作室。原创 job 不写作品名；Fan Art job 只写 brief 已声明的作品、角色、道具和新构图。
 
 ## 失败处理
 
-- 构图挤占安全区：明确把主体推到右侧三分之一，并让左侧保持雾、天空或水面。
+- 构图挤占安全区：根据 `left`、`right`、`center` 或 `none` 选择阅读区。把主体放到对应的非阅读区，并让阅读区保持雾、天空或水面。
 - 出现文字或 Logo：在场景 brief 中点名移除，再用 `--force` 重做。
 - 原创角色像现成 IP：更改轮廓、服装结构、配色和道具，不能只换颜色。
 - Fan Art 出现未声明角色或复制镜头：移除多余角色，改换机位、动作、景别和环境叙事后重做。
 - 画面像概念草图：要求完成的动画背景、可信材质和环境细节。
-- 3:2 好看但 16:9 被截：把重要内容收进垂直中间 82%。
+- 16:9 焦点裁切仍会截断主体：调整 `focusX`、`focusY` 或重做画面，把重要内容收进垂直中间 82%。
 
-源图通过后运行 `npm run check`。生成器会完成裁切、明暗分级、哈希、包和预览。
+源图通过后运行 `npm run art:review:write`，人工检查联系表和安全区夹具，再运行 `npm run art:review` 与 `npm run check`。生成器会完成焦点裁切、明暗分级、哈希、包和预览。

.codex/skills/create-codex-theme/references/theme-authoring.md

@@ -10,7 +10,7 @@
 - `cinematic`、`chibi`、`cityscape` 或 `scene` variant
 - 左右焦点、安全区和任务模式
 - 符合对比度门槛的明暗 token
-- 一张 1536×1024 已审查源图及 provenance
+- 一张 2560×1440 或更高的 16:9 已审查源图及 provenance
 
 `cinematic-chibi` collection 要求同一 `pair` 同时有原画版和 Q 版。新增此类主题时准备两份 brief，并在运行完整校验前把两个 variant 都加入 catalog。`standalone` collection 可以一次加入一套。
 
@@ -32,11 +32,12 @@
 
 ## 工作区构图
 
-源图不是实机截图，但会生成 Full Skin 使用的 2560×1440 背景。Codex Native 回退仍然只改变配色。安全区要同时照顾左侧导航、主标题、建议卡片和底部 composer，不能只为了 Gallery 卡片好看。
+源图不是实机截图，但会生成 Full Skin 使用的 2560×1440 背景。新主题必须使用 16:9、2560×1440 或更高的源图。当前 1536×1024 源图只能通过 `themes/source-art/jobs.json` 的具名历史例外保留给现有 ID，不能复制到新 job。Codex Native 回退仍然只改变配色。安全区要同时照顾左侧导航、主标题、建议卡片和底部 composer，不能只为了 Gallery 卡片好看。
 
-- `safeArea: left` 时，左侧约 46% 保持低对比、低细节。
-- 主体放在右侧三分之一，不能贴边。
-- 重要内容放在垂直中间 82%，以适应 3:2 到 16:9 的裁切。
+- `focusX` 和 `focusY` 是归一化焦点。生成器在源图可移动时以该点为中心生成 16:9 焦点裁切，并在边缘夹紧。
+- `safeArea: left` 时，左侧约 46% 保持低对比、低细节；`right` 反转该阅读区；`center` 保留中部阅读区；`none` 不追加阅读区叠色。
+- 主体放在与安全区相反的区域，不能贴边。`center` 安全区需要把主体分布到两侧，或使用 `none`。
+- 重要内容留在垂直中间 82%，即使源图已经是 16:9，也要为不同预览尺寸留余量。
 - 避免满屏人脸、强烈放射光、碎片和密集文字形状。
 - Q 版角色要有完整剪影和可信材质，不能像随机贴纸。
 
@@ -60,12 +61,12 @@
 
 校验器要求：
 
-- text/surface ≥ 4.5
-- muted/surface ≥ 4.5
-- accent/background ≥ 3.0
+- text/surface 和 text/surfaceAlt 都 ≥ 4.5
+- muted/surface 和 muted/surfaceAlt 都 ≥ 4.5
+- accent/background、accent/surface 和 accent/surfaceAlt 都 ≥ 3.0
 - accentContrast/accent ≥ 4.5
 
-不要只看色卡。把预览放进 Gallery 和安装弹窗后再判断。
+`border` 只作装饰，不能作为键盘焦点或可点击状态的唯一边界。不要只看色卡。把预览放进 Gallery 和安装弹窗后再判断。
 
 ## 来源与授权
 

.codex/skills/create-codex-theme/scripts/scaffold-theme.mjs

@@ -91,7 +91,10 @@ function validateBrief(brief, catalog) {
     requireValue(brief.fanArt?.commercialUse === false, "fan art must prohibit commercial use");
     requireValue(brief.fanArt?.officialAssetsUsed === false, "fan art must disclose that no official assets were used");
   }
-  requireValue(brief.art?.safeArea === "left", "v1 Gallery themes must use a left safe area");
+  requireValue(Number.isFinite(brief.art?.focusX) && brief.art.focusX >= 0 && brief.art.focusX <= 1, "art.focusX must be a number from 0 to 1");
+  requireValue(Number.isFinite(brief.art?.focusY) && brief.art.focusY >= 0 && brief.art.focusY <= 1, "art.focusY must be a number from 0 to 1");
+  requireValue(["left", "right", "center", "none"].includes(brief.art?.safeArea), "unsupported art.safeArea");
+  requireValue(["ambient", "banner", "off"].includes(brief.art?.taskMode), "unsupported art.taskMode");
   validateTokens("light", brief.light?.tokens);
   validateTokens("dark", brief.dark?.tokens);
 }

README.md

@@ -163,7 +163,7 @@ Use $create-codex-theme to add an original "Suzhou Canal Mist" theme.
 Keep the left work area quiet, provide light and dark modes, and run every check.
 ```
 
-The Skill prepares an art brief and image job, checks original or fan-art disclosure, configures safe areas and contrast, updates the Registry, and guides the real-app capture step.
+The Skill prepares an art brief and image job, checks original or fan-art disclosure, configures focal composition, safe areas, and contrast, updates the Registry, and guides the real-app capture step. New source art must be 16:9 at 2560x1440 or larger. The current 1536x1024 catalog material has a named legacy exception and is not a template for new themes. Run `npm run art:review:write` to create the composition contact sheets, inspect them, then keep `npm run art:review` green before the exact-app capture.
 
 ## Join the community
 

README.zh-CN.md

@@ -163,7 +163,7 @@ Beta 包，并且只连接 `app://` 页面目标。
 左侧保留安静的工作区，提供明暗模式，并运行全部检查。
 ```
 
-Skill 会准备美术 brief 和 image job，检查原创或 Fan Art 披露，配置安全区与对比度，更新 Registry，并引导完成真实应用截图。
+Skill 会准备美术 brief 和 image job，检查原创或 Fan Art 披露，配置焦点构图、安全区与对比度，更新 Registry，并引导完成真实应用截图。新源图必须是 2560×1440 或更高的 16:9 图像。现有目录里的 1536×1024 素材只有具名历史例外，不是新主题模板。先运行 `npm run art:review:write` 生成并检查构图联系表，再用 `npm run art:review` 固定审批结果，之后才进入准确应用版本的实机截图。
 
 ## 加入社区
 

apps/theme-manager/package.json

@@ -10,7 +10,7 @@
     "start": "npm run prepare:assets && tauri dev",
     "pretest": "npm run prepare:assets",
     "test": "cargo test --manifest-path src-tauri/Cargo.toml",
-    "check": "cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo test --manifest-path src-tauri/Cargo.toml",
+    "check": "node ../../scripts/prepare-desktop.mjs && cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo test --manifest-path src-tauri/Cargo.toml",
     "build": "npm run prepare:assets && tauri build",
     "build:win": "npm run prepare:assets && tauri build --bundles nsis",
     "build:mac": "npm run prepare:assets && tauri build --bundles dmg",

apps/theme-manager/src-tauri/src/catalog.rs

@@ -666,7 +666,7 @@ mod tests {
     #[test]
     fn bundled_registry_has_sixty_eight_valid_dual_mode_themes() {
         let registry = validate_registry(REGISTRY).expect("registry should validate");
-        assert_eq!(registry["catalogRevision"].as_u64(), Some(2026072201));
+        assert_eq!(registry["catalogRevision"].as_u64(), Some(2026072701));
         assert_eq!(registry["themes"].as_array().map(Vec::len), Some(68));
     }
 

context/tools/README.md

@@ -4,14 +4,14 @@
 
 | Tool | Role | Writes | Verification |
 | --- | --- | --- | --- |
-| scripts/run-image-jobs.mjs | Generate reviewed 1536 x 1024 source art through the shared OpenAI image-job runner | themes/source-art/*.png and compact provenance | visual review plus source hashes |
-| scripts/generate-themes.mjs | Decode source art and generate 53 deterministic dual-mode packs, Full Skin backgrounds, Native fallbacks, and Registry | themes/<theme-id>/, packages/, themes/registry.json | npm run generate:check |
+| scripts/run-image-jobs.mjs | Generate source art to the 2560 x 1440 16:9 baseline through the shared OpenAI image-job runner; named reviewed 1536 x 1024 exceptions remain legacy-only | themes/source-art/*.png and compact provenance | visual review plus source hashes |
+| scripts/generate-themes.mjs | Decode source art and generate 68 deterministic dual-mode packs, Full Skin backgrounds, Native fallbacks, and Registry | themes/<theme-id>/, packages/, themes/registry.json | npm run generate:check |
 | scripts/validate.mjs | Validate ids, paths, dimensions, hashes, allowlists, contrast, rights rules, Full Skin records, Native fallbacks, and capture evidence | none | npm run validate |
 | scripts/build-installer.mjs | Build the no-admin Windows companion installer with a bundled Registry snapshot | dist/downloads/*.zip and installer manifest | npm run installer:validate |
 | scripts/capture-full-skin-screenshots.mjs | Apply the fixed runtime to the pinned Beta test bench, clear project context, capture all 136 Full Skin modes with the verified available `5.6 Sol Max` label, restore the prior model choice, and prove cleanup | screenshots/codex-beta-26.715.3651.0/*.png and manifest | npm run screenshots:probe plus `npm run screenshots:capture` with explicit authorization |
 | scripts/smoke-theme-manager.mjs | Drive the real Tauri UI, apply one Full Skin, discover the dynamic Beta endpoint, read back markers, capture the manager, restore, and verify cleanup | docs/assets/theme-manager-windows.png | explicit `--apply`, an OS-selected Manager port, exact process ownership, and final marker readback |
 | scripts/build.mjs | Assemble the static Pages artifact | dist/ | npm run build |
-| scripts/prepare-desktop.mjs | Generate the deterministic desktop icon and confirm the Registry is ready for packaging | apps/theme-manager/build/icon.png | npm run desktop:prepare |
+| scripts/prepare-desktop.mjs | Generate the deterministic desktop icon and compact verified-capture thumbnails for packaging | apps/theme-manager/build/icon.png and apps/theme-manager/build/catalog/screenshots/ | npm run desktop:prepare |
 | scripts/serve.mjs | Serve dist/ on localhost | none | browser smoke |
 | .codex/skills/create-codex-theme/scripts/scaffold-theme.mjs | Dry-run or append a validated theme brief to the catalog and image-job queue | themes/catalog.json, themes/source-art/jobs.json with --apply | dry run, then npm run check |
 The image-job runner writes only inside `themes/source-art/`. The Full Skin

docs/CHANGELOG.md

@@ -2,9 +2,13 @@
 
 ## Unreleased
 
+- Replaced centered source-art cropping with a versioned focal-cover renderer, added directional safe-area grading, raised the new-source baseline to 2560x1440 16:9, and committed reproducible contact-sheet review evidence for the existing catalog.
 - Reworked theme generation into a bounded, incremental pipeline with
   source-art provenance checks, complete render fingerprints, atomic per-theme
   writes, cache-aware progress, and reproducible benchmark commands.
+- Made the desktop check prepare its required capture catalog without relying
+  on the Tauri CLI, and bound its bundled-registry assertion to the current
+  catalog revision.
 - Changed the Gallery community section to clearly state that public community
   submissions are not open and removed its hosted-community link. Added a
   direct Theme Manager download action to the Gallery hero.

docs/README.md

@@ -30,6 +30,7 @@ locations are reserved for execution evidence or closed history when needed.
 - fan-art-policy.md: public rights boundary, non-commercial terms, and takedown path
 - gallery-design.md: redesign evidence and the independent Gallery visual system
 - standard.md: version 1 canonical manifest and package contract
+- assets/source-art-review/ and ../themes/source-art/reviews/: deterministic focal-crop contact sheets, safe-area fixtures, and approval records
 - adapters.md: ACT Full Skin contract, Native fallback, and unsupported
   capabilities
 - desktop-manager.md: Tauri architecture, catalog refresh, signed app updates,

docs/architecture.md

@@ -23,7 +23,7 @@ generator -> manifest / .act-theme / Registry / Native fallback
 
 ## Theme data
 
-`themes/catalog.json` and source-art provenance are the maintained inputs. The generator creates:
+`themes/catalog.json`, source-art policy, and source-art provenance are the maintained inputs. The generator creates:
 
 - `themes/<id>/manifest.json`;
 - light and dark 2560×1440 PNGs;
@@ -34,6 +34,8 @@ generator -> manifest / .act-theme / Registry / Native fallback
 
 The Registry is the public index. Every path is repository-relative and paired with SHA-256 and byte count. A mode also contains Full Skin composition data and tokens.
 
+New source art is 16:9 at 2560x1440 or larger. The named legacy exception in `themes/source-art/jobs.json` records the current catalog's lower-resolution source material and does not apply to new IDs. A shared focal-cover calculation derives every output crop from declared focus coordinates, while directional safe-area shading remains separate. `scripts/review-source-art.mjs` writes deterministic before-and-after contact sheets, safe-area fixtures, and the reviewed manifest that bind an approval to the renderer version.
+
 Canonical theme archives contain only:
 
 ```text

docs/art-direction.md

@@ -13,15 +13,15 @@
 
 ## 源图工作流
 
-每套主题只有一张经过审查的 1536×1024 源图。`themes/source-art/jobs.json` 保存场景 brief 与统一原创性约束，OpenAI image job 负责生成，人工审查以下内容：
+新主题使用一张经过审查的 2560×1440 或更高的 16:9 源图。`themes/source-art/jobs.json` 保存场景 brief、尺寸政策与统一原创性约束。现有系列的 1536×1024 源图只可通过具名的历史例外继续使用，不能作为新主题的尺寸模板。人工审查以下内容：
 
 - 左侧安全区是否低对比、低细节
 - 是否出现文字、签名、水印、Logo 或 UI
 - 角色、服装、武器与场景是否接近现成 IP
-- 3:2 源图裁成 16:9 后是否仍保留完整主体
+- `focusX` 和 `focusY` 对应的焦点裁切是否保留完整主体
 - 画面是否达到正式动画背景或主题 Key Art 的完成度
 
-通过审查后，生成器会从同一源图稳定导出明暗两套 2560×1440 背景和 960×540 预览。模式差异由 token、暗部压缩和安全区叠色共同完成，输出哈希可重复验证。
+通过审查后，生成器会从同一源图稳定导出明暗两套 2560×1440 背景和 960×540 预览。模式差异由 token、暗部压缩和方向安全区叠色共同完成，输出哈希可重复验证。运行 `npm run art:review:write` 生成联系表和安全区夹具，人工检查后由 `npm run art:review` 固定这份审批证据。
 
 ## 不做什么