test(diagrams): measure real viewer text font floors

[schlessera]

Closes #2241

What changed

The constrained-container proof selects the viewer’s actual svg.bk-diagram, verifies the fixture node labels are present, and then measures displayed text sizes. Both renderer and axis font-floor helpers require a nonempty text population. The same broad first-SVG query in the axis viewer proof is corrected; existing offscreen linked-target coverage is preserved.

Why this shape

This follows #2241’s test-only scope and the minimum displayed font size in the module-renderers decision. The audit found only the axis viewer occurrence; positional coverage already selects the actual diagram, and linked-target coverage reaches its diagram through the node. No product geometry or rendering behavior changes.

Proof

Original local candidate: f881869c43a98bdeef9fa1a27aad49d56d86a688, based on 0d780605fe1ea9a281cce947b1f0074f3f3e7acc. Fetched main matched that base after local validation; no additional base commits required reconciliation.

• Real mutation: set every text in the actual constrained viewer diagram to 1px immediately before fontFloor. Both pinned Chromium and WebKit failed the named actual constrained containers select authored layout or semantic fallback, never shrink below9 test on ACTUAL_DISPLAYED_TEXT_FLOOR: expected 1 to be greater than or equal to 9; the other 30 cases passed.
• Equivalent axis mutation: set actual axis viewer text to 1px before inspect. Both engines failed sequence uses readable derived phone layout and unsafe content opens the full viewer on AXIS_NORMAL_TEXT_FLOOR: expected 1 to be greater than or equal to 9; the other 18 cases passed.
• Restored both mutations, then ran node scripts/visual.mjs --project=diagrams-chromium --project=diagrams-webkit --filter=diagrams-renderer.layout --filter=diagrams-axis.layout: 52 tests passed across four project/file executions, with existing baselines and offline/font/native-artifact guards intact. No baseline changes.
• bun run check:pr --base origin/main: passed lint/leakage, metadata and 54 affected fast tests /181 assertions. Import-graph feedback reported no affected Bun test files; the actual browser proof is recorded above.
• Earlier setup failure: the first fresh attempt exhausted the host temporary-storage quota before test execution. The task used separate disk-backed temporary storage for subsequent runs. This setup failure and the prior cancelled worker’s unfinished/wrong-assertion attempts are not passing receipts.

Hosted failure and scoped correction (2026-10-18)

Run 39074059629 / attempt 1 remains failed. Unit 3 job 117517645493 tested checkout 81d0a75e795b44a522c18d4f52cf61711272fa32, tree 9e136b8f079978d14909f6740e8a11486ef69fd1, parents 0d780605fe1ea9a281cce947b1f0074f3f3e7acc / f881869c43a98bdeef9fa1a27aad49d56d86a688. Its four binding failures reproduced locally: 9 pass / 4 fail, including all three qualified-positive assertions and STALE_PIN_NAMED reporting the renderer before the intended mutated callout producer. The aggregate also refused the stale candidate after main advanced.

Correction 61c2299dc129c3fbce2c97393a14af85ce648435 updates only the two reviewed caller hashes and an audit comment. The exact renderer/axis diff strengthens viewer selectors and assertions; it changes no capture arguments, counts, imports, HTML or style producers. Reviewed the drawing.html/drawing.styles sink, configuration-only command-owner import, all five callers (2 renderer/8 callout/3 axis/1 positional/2 node-link sites), closed SVG producers, literal fixtures, generated consumer CSS, checksum-verified inline fonts and the zero-request guard. All 130 owner/caller/producer pins match; no other pin changed. Exact-source, call-count, importer and unknown-caller refusals remain enabled.

• Binding correction: 13 pass / 0 fail, 69 assertions, including qualified positives, unchecked HTML-sink mutation, caller/producer/fixture/font/guard drift, additional/escaped callers and producer-import closure. The original source pins provide the failing-first receipt; no test or guard was weakened.
• Full relevant runtime: 166 tests / 10 project-file executions passed across renderer, axis, callouts, positional and node-link in pinned Chromium/WebKit, with existing baselines and native/font/zero-request guards. Execution used the original head plus the recorded two-pin patch, committed unchanged as correction tree b9ed76ed0c85e2d22eb8a76b28a053d3031544b5. The original actual 1px renderer/axis mutation receipts above retain their identities.
• Base assessment: main advanced to 498270fbdc4ef2788fdd3babb259b647d77f6c77 via CONTRACT: fix(ui-sdk): qualify separate-UID native maintenance inputs #2361. Its native-maintenance/server changes leave diagram/browser/font/binding inputs unchanged. Merged that base without conflicts to refresh GitHub candidate metadata. Then-current head b7a2100d1bf68d01fd96a927a25ae70c6df28b76, tree 016597e9a95d37768b4394916a513dec994446c5. This does not relabel the earlier browser run as full combined-tree hosted proof.
• Preflight for that candidate: bun run check:pr --base origin/main passed at the current head/base: lint/leakage/metadata, 956 fast tests / 6,328 assertions and 170 import-graph tests / 1,512 assertions. All focused binding and runtime receipts remain as attributed above.

Candidate freshness correction (2026-10-18)

Run 39076106490 / attempt 1 completed with all 15 selected jobs successful: changeset, pack, verify, units 1–4, browsers 1–2, layouts 1–2, captures, endurance, runtime and runtime_host. Independently read every selected job checkout log and matching check-run receipt. All checked out 4ddb50304731334a39843cb4494763f74a80fba3, tree 016597e9a95d37768b4394916a513dec994446c5, parents 498270fbdc4ef2788fdd3babb259b647d77f6c77 / b7a2100d1bf68d01fd96a927a25ae70c6df28b76; immutable GitHub and fetched Git identities agree. Aggregate job 117527007992 alone failed: Candidate became stale: the live PR head, readiness or base changed; request confirmation again. This workflow remains failed; its successful executions do not prove a newer combined tree.

Live main advanced to 82a64a13a08c44f2daef425d1a9df2c10840ea8e through #2371. Read the complete five-file diff: it moves native containment/egress fixture listeners below worker ephemeral ports and asserts that premise. No diagram source, browser caller, binding producer, font, dependency or workflow changed. Native/Git-dependent and unknown proof remains fresh. The old failed workflow is ineligible for browser/layout retention under the existing whole-workflow-success validator; no source receipts are relabelled or manually admitted.

Converted this PR to draft and merged the verified live main without conflicts. New head 113fb0f6ebdf25b3e7ee3016d3140d00c6231b67, tree 6d1115e1ed52c89b35c30dadb083eb90ebd841d8; merge commit parents are old head b7a2100d1bf68d01fd96a927a25ae70c6df28b76 and live main 82a64a13a08c44f2daef425d1a9df2c10840ea8e. The PR retains exactly the original two test files and reviewed two-caller binding correction. No additional producer pins, native qualification or product behavior were changed.

Fresh bun run check:pr --base origin/main passed on that exact head/base: lint/leakage/metadata, 956 fast tests / 6,328 assertions, and 170 import-graph tests / 1,512 assertions. Original 1px behavioral mutations, restored 52-case proof, 13 binding controls and 166-case caller runtime proof remain attributed above; they are not renamed as executions on this new candidate.

Before marking ready, independently queried live main and REST base.sha both equalled 82a64a13a08c44f2daef425d1a9df2c10840ea8e; REST head equalled 113fb0f6ebdf25b3e7ee3016d3140d00c6231b67. Fetched synthetic merge f7fb8918849d4e4575bd2b42da9e8e52f95bd936 and the immutable GitHub commit API agreed on exactly those base/head parents and tree 6d1115e1ed52c89b35c30dadb083eb90ebd841d8.

Run 39077819979 / attempt 1 completed with all 15 selected execution jobs successful on the recorded candidate. Aggregate 117532265496 failed candidate freshness when main advanced; the workflow remains failed. Planning job 117528538186 recorded the exact requested base/head, synthetic checkout/tree/parents and empty retention ledger. The completed outcome and next refresh are recorded below.

Second stale aggregate and scoped refresh (2026-10-18)

Run 39077819979 / attempt 1 passed all 15 selected execution jobs on synthetic checkout f7fb8918849d4e4575bd2b42da9e8e52f95bd936, tree 6d1115e1ed52c89b35c30dadb083eb90ebd841d8, parents 82a64a13a08c44f2daef425d1a9df2c10840ea8e / 113fb0f6ebdf25b3e7ee3016d3140d00c6231b67. Aggregate job 117532265496 alone failed the actual validateCandidate freshness assertion after main advanced. This workflow remains failed, alongside run 39076106490 / aggregate 117527007992; neither proves the refreshed combined tree. The previous pending description is superseded by these completed results.

Read the complete new main commit 63fde3c8fe76e754aa4524f95b23f9786f4447fe (#2379): only scripts/browser-shard-costs.json changes. It refreshes measured timing provenance and 309 weights (306 old entries, 365 new entries); existing layout weights are unchanged. Diagram source, caller/producer/font closure, native hashes, guards, dependencies and workflows are unchanged. The cost table is nevertheless an explicit immutable harness input to both reusable domains and drives their partitions, so existing input-equivalence policy requires fresh browser/layout proof. No additional local renderer mutation/runtime repeat is justified by this weight-only base change; original behavioral and binding receipts above retain their identities.

Retention was inspected against the actual findRetained / validateSource policy and immutable source logs. Both full workflows are excluded because the source workflow conclusion must be success. The source lookup before this refresh returned two successful workflows on this branch (39077488104 and 39075445660) contain cheap gates and skipped browser/layout jobs, so they cannot supply complete two-shard execution receipts. The four successful browser/layout source jobs in run 39077819979 independently confirm their old checkout and resource receipts, but cannot override the whole-workflow-success or changed-harness requirements. No manual retention or proof waiver is applied; native/Git-dependent and unknown domains also stay fresh.

Coordination #2111 was inspected: its controller remains in unmerged draft #2197, and no reservation controller exists on this main. No reservation, lease or shared coordination authority is claimed or acquired. Existing exact-candidate requirements remain intact.

Kept #2368 draft while merging the verified live base without conflicts. New head 05c2893d921daf1bef93ba39c9bf1cf78197b23d, tree 31459df336a94f582ff11692d0d04bd1690e99f6; its parents are old head 113fb0f6ebdf25b3e7ee3016d3140d00c6231b67 and base 63fde3c8fe76e754aa4524f95b23f9786f4447fe. The complete three-file issue patch is byte-identical before/after integration. No product, CI or guard edit is added by this refresh.

Required bun run check:pr --base origin/main passed on the new head/base: lint/leakage/metadata, 956 fast tests / 6,328 assertions and 170 import-graph tests / 1,512 assertions. No separate repeat of unchanged behavioral mutations or renderer runtime proof is claimed.

Before ready, REST base.sha and independently queried live main both equal 63fde3c8fe76e754aa4524f95b23f9786f4447fe; REST head equals 05c2893d921daf1bef93ba39c9bf1cf78197b23d. Fetched synthetic merge 29771589a228b95b07f14a480b00a25ab509de3c and immutable GitHub commit API agree on those exact base/head parents and tree 31459df336a94f582ff11692d0d04bd1690e99f6.

New ready-candidate confirmation 39079718669 / attempt 1 was requested by the explicit draft-to-ready transition. Its immutable run metadata records the verified new head and base. Planning job 117534015264 is in progress at handoff; its actual checkout, requested BASE_SHA, cadence and emitted retention ledger remain to be inspected by the parent. Source-policy assessment admits no retained domains; an empty ledger is expected, not yet claimed as an observed output. Draft runs 39079354076 and 39079492858 are cheap feedback, not full candidate proof. Complete hosted selected proof and its independent freshness aggregate remain required; no current hosted-green or merge claim is made. Both issue and PR retain milestone 0.44.0. Parent campaign retains watches and final merge; no acceptance scope is deferred.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Local acceptance behavior is proven; hosted confirmation remains below.
• Issue release milestone is 0.44.0; the PR uses the same upcoming release, after live registry 0.43.1 and milestone inspection.
• No changeset: browser tests and their reviewed proof bindings only; no package output, dependency, version or API report changes.
• No personal data in the diff or public text; leakage screening passed.
• No integration contract or machine surface change.
• No documented product behavior or code citation ranges moved.
• Nothing on a provider turn’s path changed.

Anything left open

Complete selected hosted proof, inspect exact candidate identities, then perform matching-head squash and main/issue/milestone reconciliation. No acceptance scope is deferred.

Final candidate qualification — 2026-10-18

Ready confirmation 39079718669, attempt 1, passed all 15 selected execution jobs and the proof aggregate. All 16 job logs identify checkout 29771589a228b95b07f14a480b00a25ab509de3c, tree 31459df336a94f582ff11692d0d04bd1690e99f6, parents live main 63fde3c8fe76e754aa4524f95b23f9786f4447fe and head 05c2893d921daf1bef93ba39c9bf1cf78197b23d. Immutable Git metadata, local Git and every emitted resource receipt agree. Execution includes packaging, strict types, four unit shards, both browser and layout shards, captures, endurance and both runtime categories; no retained execution or missing selected category is claimed. Earlier failed/stale/cancelled workflows retain their conclusions. Final live head/base, ready state, reviews and both 0.44.0 milestones were read back before matching-head squash. No implementation or acceptance criterion remains deferred.