Fix good-first-issue batch (#5-#12)

[DatMoshu]

Closes #5, #6, #7, #8, #9, #10, #11, #12.

Checks: pytest (worktree code) passes, outfit-lab unittest 15/15, agents --check clean. Not run: Blender-side checks (none touched).

Note: #9 raises FileNotFoundError when the latest version was never archived and the file was edited (nothing to restore from).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T04:29:54.534750Z	01e33c0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01e33c0772

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve permissions when replacing JSON files

On POSIX systems, NamedTemporaryFile creates the temporary file with mode 0600, and os.replace transfers that mode to the destination. Consequently, every call now changes an existing group/world-readable JSON file (typically 0644 under the prior implementation) to owner-only, which can prevent another account or service from reading shared manifests and annotations. Apply the existing file's mode, or a mode derived from the process umask, to the temporary file before replacing the destination.

Useful? React with 👍 / 👎.

[DatMoshu]

Director review (spritemotion-director). The PR is good apart from one regression that blocks merging.

Blocking: the pose editor no longer uses the project's Blender 5.2 runtime. pose_editor_server.py used to run tools/blender-runtime/blender-5.2.2-windows-x64/blender.exe. That is a repo-relative path to the project's own third-party runtime folder (gitignored, per the tools convention), not a machine path. The new find_blender() checks SPRITEMOTION_BLENDER, then PATH, then Program Files, and never looks at that folder. UO_Female_Idle_Walk_Run.blend was saved by Blender 5.2 (its header is BLENDER17-01v0502), which Blender 4.x cannot open. On a machine with no env var and only Blender 4.2 in Program Files (the owner's machine today), Bake would fail.
Fix: in find_blender(), after SPRITEMOTION_BLENDER, prefer the newest ROOT/tools/blender-runtime/*/blender(.exe), then PATH, then Program Files. Add a test that the bundled runtime wins over Program Files when the env var is unset.

Non-blocking:

• find_blender() picks the last result of a plain string sort, which puts "Blender 4.10" before "Blender 4.9". Sort by the parsed version instead, or keep the existing reverse=True + [0] pattern from pipeline.blender_path() and accept the same limitation in both places.
• jsonio.write_json now writes through tempfile.NamedTemporaryFile, which creates files with mode 0600 on POSIX. Rewritten JSON then loses the umask permissions the old write_text gave it. Consider os.chmod(temp, 0o666 & ~umask) or copying the mode from the existing target.
• The versions restore: verify hash before saying "already current" #9 behaviour change (raising when the latest version was never archived and the file drifted) is the right call, and the PR body documents it.

Checked by reading: VD range checks and boundary tests, clipped VD reads, vdtool usage errors, the studio status recovery, the silhouette-fit narrowed exception, and the font fallback all look correct. I did not run the suite on this branch.

[DatMoshu]

spritemotion-director re-review of d409971: the blocker is fixed, and I recommend merging.

• Blender lookup: find_blender() now checks SPRITEMOTION_BLENDER, then the newest tools/blender-runtime/*, then PATH, then Program Files, all sorted by version number. On this machine, with no env var set, it picks tools\blender-runtime\blender-5.2.2-windows-x64\blender.exe, which the female 5.2 blend needs.
• Private files: the edit files are now written with write_private (0600 where the OS honours it). jsonio uses unique temp files and copies the backup, so the target file never goes missing.
• Tests: all 34 pass in the touched test files (test_pose_editor, test_jsonio, test_versions, test_portability, test_robust_startup, test_vd_robustness).

Note for whoever runs the checks: the shared venv imports spritemotion from the main checkout's common/ (editable install). Running pytest from a worktree therefore tests main's jsonio/versions, not this PR's, and 3 of the new tests fail. Load the PR's own common/ as spritemotion (or install the worktree), and they pass. That's a setup trap, not a defect in this PR.

Not covered by this re-review: a real headless Bake run through the pose editor.