Port steps 2-3: the data model and the player

Steps 2 and 3 land together because the model revisions in the middle changed
code from both, and splitting them now would invent intermediate states that
never built.

  domain/channel  value-at across framed/keyed/dense, plus a cursor
  domain/node     decomposed transform, composition order, time maps
  domain/scene    topological order, z paths, eval-frame and resolver
  clock           audio-clocked frame derivation, outside app-db
  db/events/subs  re-frame arrives; the playhead is document state
  ui/player       the rAF loop; reads, blits, dispatches (almost) nothing
  ui/shell        transport

133 tests, 1158 assertions. The scene plays at 30fps against audio, scrubs, and
runs at 1/4x through 4x; verified by driving a real browser over CDP rather than
by assertion.

Two evaluators, on purpose. `eval-frame` is the specification -- allocating,
order-free, obviously correct. `resolver` is what playback uses: cached topo
order and z paths, a cursor per channel, a preallocated point buffer per node.
Both run the same walk, parameterised only by how a channel is read and where
points are written, because two independent implementations of frame evaluation
would drift and the drift would read as a rendering bug rather than as two
functions disagreeing. scene-test asserts they agree frame for frame in forward,
backward and random order.

Deviations and decisions, each with a reason:

- raster/fill-poly! is now a thin wrapper over fill-poly-buf!, which takes a flat
  preallocated buffer. ONE scanline fill serves the analysis stages, which speak
  {:x :y}, and frame evaluation, which hands over a buffer it owns. The parity
  suite still passes pixel-for-pixel, which is what makes the rewrite safe.

- The state mask carries ABSENCE ONLY. An earlier draft gave it a hidden bit too,
  per architecture.md's "hidden flag + palette index", and that bit was a dense
  [:vis] wearing a different hat -- two mechanisms for one question, which is how
  a part ends up hidden by one and shown by the other.

- The palette is a parameter of evaluation, not a global. A node names a TONE;
  which ramp that tone is read in belongs to the timeline it sits in.

- :over layers and a symbol :rate THROW rather than being ignored. Neither is
  built and nothing can produce one, so this can only fire on data that has run
  ahead of the code. A silently dropped override is a hand correction the user
  made once, watched fail, and has no reason to trust again.

Three findings the model produced rather than received:

- Presence propagates asymmetrically. An absent transform drops the subtree; an
  absent [:geom :pts] drops only that node, because an absent mouth outline has
  nothing to draw but the head it hangs off has not moved. That asymmetry is the
  reason presence is tracked per channel and not per node.

- Z paths need lexicographic compare, not `compare`, which orders vectors by
  count first -- so a cel three levels under "a1" would jump in front of a bare
  "a2" and the layer order would mostly work.

- A node stencilled by something that drew nothing is dropped, not drawn
  unclipped: an iris floating over the cheek is worse than a missing iris.

docs/ revised alongside, and those revisions are the load-bearing part:

- A scene, a timeline and a symbol are one type. The doc had two structures with
  the same fields and never said so. Two axes of nesting are now separated --
  parent/child within a timeline is flat with parent pointers, instance nesting
  is by reference -- which is why "nestable" and "flat" only sounded
  contradictory.

- Palettes are named, live on the project, and are ENABLED on a timeline as a
  channel. Absent inherits; present travels with the timeline, so a symbol
  authored against :night stays night wherever it is placed. The output index
  space is the concatenation of the named ramps, which keeps one buffer and one
  flat table and incidentally stops two nodes in different palettes colliding on
  a stencil.

- Stabilisation is a channel, not a mode: {s, theta, tx, ty} IS [:xform :*], so
  the normalise on/off/per-plate toggle is which of the three channel shapes the
  :head node carries. Always measure and always store factored -- smoothing and
  velocity-minimum key selection both need the split to exist in storage.

- There is no camera node and none is needed. Placement is a node transform, the
  stage clips what hangs off it, and project dimensions are independent of the
  footage. `makeXform` is therefore not to be ported: it bakes a cropping
  decision into every stored vertex.

- Export is removed. The .take writer was for an Animator Pro render script; the
  target is encoding video in the browser, and step 9 now says not to port the
  old one.

demo/swarm is 120 shapes on six orbits, entirely dense blocks behind store
handles -- the shape freeze produces at step 5, and the first thing to exercise
that path under load. It plays at 30fps, and bench-test keeps a deliberately
loose floor under it because a performance regression here does not announce
itself: the picture stays correct and merely arrives late.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PDfHGdV39zu6rvgbBTfDaT

frontend/README.md

@@ -32,6 +32,13 @@ node out/node-tests.js
 Run them separately if a compile error is in the way. The oracle JSON is
 generated, not committed.
 
+**Run them through `mise`**, or make sure `mise`'s node is first on PATH. The
+oracle imports `js/*.js` directly, and those are ES modules in a directory with
+no `package.json`, so node needs the module detection that became default in
+20.19. On an older node 20 — an nvm install shadowing the pinned one is the easy
+way to get there — every import fails with "Named export not found ... is a
+CommonJS module", which reads like the oracle being broken and is not.
+
 ## The app
 
 ```sh
@@ -42,9 +49,18 @@ Then open **<http://localhost:8778/index.html>** — with the `/index.html`, not
 bare `/`. This shadow-cljs does no directory-index resolution, so `/` is a 404
 whatever the roots are.
 
-Through step 1 the page is a placeholder on purpose: there is nothing to render
-until the data model exists, and a shell built before the model is a shell built
-around a guess. Something moves on screen at step 2.
+The page is the hand-written scene from step 2, scrubbed by hand. There is
+deliberately no clock: the audio clock, the rAF loop, the `::resolver`
+subscription and the transport are step 3, and the question this step answers is
+whether the data model evaluates correctly, not whether it evaluates at 30fps.
+A scrubber answers the first and nothing else, which is what makes a failure
+here unambiguous.
+
+The scene itself is `src/arthur/demo/scene.edn`, and it is not a face. It is the
+smallest scene that exercises every mechanism the model claims to have —
+inherited exposure, a sparse held `[:xform :pos]`, composition through a group,
+rotation about an anchor, a stencil chain, a keyed `[:vis]`, a `:span`, and
+fractional z among siblings — chosen so that each one is visible when it breaks.
 
 Port 8778 is deliberately not 8777. `python3 serve.py` from the repo root still
 runs the old JS tool on 8777, and the two are meant to run side by side — that is
@@ -69,8 +85,32 @@ the prototype's mistakes into the rewrite and make them permanent.
 ## Layout
 
 ```
-src/arthur/domain/    pure. No re-frame, no DOM, no flow/.
+src/arthur/domain/      pure. No re-frame, no DOM, no flow/.
+src/arthur/demo.cljs    the hand-written scene, read from demo/scene.edn
+src/arthur/ui/canvas.cljs  the one imperative sink — the only DOM canvas call
 test/arthur/synth.cljs  the synthetic track — test infrastructure, not src
 test/parity/            the JS oracle harness. Deletable at step 5.
 public/index.html       dev host page. Django replaces it at step 9.
 ```
+
+## Two evaluators, on purpose
+
+`domain/scene` has both `eval-frame` and `resolver`, and they are not
+alternatives:
+
+- **`(eval-frame scene f store)`** is the specification. Allocating, order-free,
+  obviously correct. Tests and one-off renders use it.
+- **`(resolver scene store)` -> `(fn [f] ops)`** is what playback uses. It caches
+  the topological order and the z paths, holds a cursor per channel and reuses
+  one point buffer per node, so a frame allocates the op maps and nothing else.
+
+Both run the same walk, parameterised by how a channel is read and where its
+points are written — two independent implementations of frame evaluation would
+drift, and the drift would look like a rendering bug rather than like two
+functions disagreeing. What differs between them is exactly the part that can be
+wrong, and `scene-test` asserts they agree frame for frame in forward, backward
+and random order.
+
+Because the resolver reuses its buffers, **ops must be rasterised before the
+next frame is asked for.** That is the contract the rAF loop wants anyway: it
+reads, blits, and dispatches nothing.