test(ui-react): separate narrow callout geometry and capture

[schlessera]

Closes #2386

What changed

The authored narrow 1,024-note diagram scenarios now check full geometry and capture the raster in separate cases for light, dark and print. Each capture still mounts the complete 320px source and checks all note indices, one-column layout and overflow before writing the same artifact identifier. Full geometry and source-text assertions remain in the geometry cases, and whole-case teardown ownership is unchanged.

Why this shape

The original WebKit case combined two substantial operations under one 15-second budget. Hosted evidence records a 15,745-ms failed case with an 8,496-ms capture that eventually completed. A bounded local resource control reproduces cumulative deadline exhaustion with completed geometry and capture, rather than a universal rendering defect. Separate obligations follow the neighboring literal/grouped cases delivered under #2351. No timeout, default scheduling, production renderer or offline guard changes.

Proof

• Original hosted failure: run 39079593313, attempt 1, browser (2) job 117533893225; actual checkout e700f7c2f46ed5996005be8c30e07a9eefc3ec38, base 63fde3c8fe76e754aa4524f95b23f9786f4447fe, head 8ad081da7c29f809c74c12638fb54a8bd14e2a72, tree 048556cdbf4e7ce2e7d42fb721fec9833c21916d. Its failed aggregate remains failed evidence.
• Bounded failing-first: the unchanged authored narrow body with temporary stage logging, pinned offline image, both Chromium/WebKit, one CPU and 16 GiB: WebKit light/dark fail the existing 15,000-ms case deadline; four other selected cases pass. Light finishes mounting/geometry at 10,534 ms, then its capture takes 12,704 ms and the owned body eventually completes at 23,306 ms. Dark finishes geometry at 9,497 ms, capture takes 8,750 ms and body completes at 18,253 ms. Whole-case teardown drains before the next body. Filtered diagnostics explicitly skip unrelated cases; these are not complete-suite receipts.
• The control uses frozen dependencies, Vitest 4.1.11, local Bun 1.4.3, the pinned Playwright manifest and twelve checksum-verified font/notice inputs. Its resource limit demonstrates sensitivity; it does not reproduce the entire hosted scheduler.
• One-CPU restored control: 11 selected cases pass, but the WebKit light capture still fails the 15-second deadline; its capture alone takes 16,581 ms. This failed arm is retained and does not establish passing correction proof at that resource limit. The original six cases all pass at 1.5 CPUs (WebKit light 13,597 ms), confirming that resource sensitivity is bounded rather than universal. The intermediate 1.25-CPU original arm reproduces the WebKit light deadline: geometry completes at 7,192 ms, capture takes 9,485 ms and the body drains at 16,681 ms (one failure / five passes). At the identical 1.25-CPU limit the restored split passes all 12 selected cases (44 unrelated cases explicitly filtered); all six PNGs remain byte-identical. All six PNGs also match byte-for-byte across that intermediate pair. The normal coordinated runner passes the complete module: 56/56 Chromium/WebKit cases, no filters, 36 PNG artifacts. The six narrow PNGs remain byte-identical in this normal run as well. An initial normal-wrapper bootstrap failed with EDQUOT before any cases; the same runner now uses separate task-owned scratch storage with the same pinned inputs.
• All six narrow PNGs are byte-identical across the original and corrected one-CPU arms, each 320 × 18,987 pixels; capture completion after a timeout is artifact evidence only.
• Final bun run check:pr --base origin/main passed lint/leakage/environment/changeset gates, 956 fast invariant tests / 6,328 assertions and 170 import-graph tests / 1,512 assertions. The earlier test-file-only preflight had 54 invariant tests and no import-graph matches; the final result includes the reviewed pin update.
• Reviewed document binding: the corrected caller with its stale pin fails REVIEWED_DIAGRAM_DOCUMENT_BINDS as expected. After re-auditing all eight direct call sites, unchanged capture arguments, sink and producer closure, the exact caller hash is updated; all 13 binding tests / 69 assertions pass, including drift and unreviewed-caller refusal controls.
• Refreshed candidate: 8e89864ec56e4818027b06dc78e6d3fa180e167f, parent 68e12f27eb249c9fe7262a498a0397c04bbda8f4, tree 6333172bcc6a8dd16bd2e239d6bcf9adc4d6b420. The two changed files are byte-identical across the rebase; refreshed local preflight passed 956 invariants / 6,328 assertions and 170 affected import-graph tests / 1,512 assertions. Complete selected hosted confirmation on this base remains required.
• Prior full confirmation: run 39082286976, attempt 1, passed all 14 selected product jobs and 56 callout cases on head 7ca8cd68517e38f29bf617133c27305810f2ecde. Metadata, every selected job and aggregate checkout logs agree on 3ccc6b4534fb7ccfea388c038974bc7b8fc07c1d, parents base 775eb17aab740fa759c2182f306c38fc17acbcbe and that head, tree 57d10cf4ef552ed8082d6afd900053126add393f. Proof job 117545272735 correctly failed live-base freshness after test(ui-sdk): exercise literal /tmp regardless of runner TMPDIR #2389 changed private-tmp native placement proof. This failed aggregate is preserved and does not authorize merging or relabel old jobs as new executions.
• No shipped source or machine contract changes; no changeset is required for test-only granularity and its reviewed CI caller pin. Nothing on the provider turn path changes.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only: nothing on a turn's path changed.

Anything left open

Complete selected current-candidate hosted proof and matching-head merge remain required. #2356/#2359 stay blocked until this correction is delivered; their Gemini implementation is outside this PR. No original failed run is admitted as a passing baseline.

[schlessera]

Run 39082286976, attempt 1, passed all 14 selected product jobs on head 7ca8cd68517e38f29bf617133c27305810f2ecde, including all 56 callout cases across Chromium/WebKit. The aggregate 117545272735 correctly failed: Candidate became stale: the live PR head, readiness or base changed; request confirmation again.

Actual checkout logs for metadata and every selected product job agree on 3ccc6b4534fb7ccfea388c038974bc7b8fc07c1d; immutable API and local Git agree on parents base 775eb17aab740fa759c2182f306c38fc17acbcbe and head 7ca8cd68517e38f29bf617133c27305810f2ecde, tree 57d10cf4ef552ed8082d6afd900053126add393f. Main advanced through #2389 to 68e12f27eb249c9fe7262a498a0397c04bbda8f4, changing private-tmp native runtime placement proof. The failed aggregate remains failed evidence and does not authorize merging.

Returned to draft and refreshed the branch onto this delivered base. Local candidate 8e89864ec56e4818027b06dc78e6d3fa180e167f has byte-identical callout and reviewed-binding source. Fresh local preflight is running before push and confirmation. Earlier product passes retain their original head/base identity; no assertion, deadline or gate is weakened. #2356 remains blocked until delivery.

[schlessera]

Confirmation run 39084080316, attempt 1, passed all 14 selected product jobs and aggregate job 117550893618 at head 8e89864ec56e4818027b06dc78e6d3fa180e167f. All 56 callout cases passed. Metadata, all product jobs and aggregate logs checked out a566d7f4a45bce09d4e1e87f221e66a7e482bb1c; immutable parents are base 68e12f27eb249c9fe7262a498a0397c04bbda8f4 and that head, tree 6333172bcc6a8dd16bd2e239d6bcf9adc4d6b420. The retention ledger is empty: these are actual fresh executions. The original draft cancellation remains separate.

Before merging, the independent live-main read found 78cfba4ff443ca2ce380502f7875a4a4283525ee, advanced after the successful confirmation through #2388 audited generated-source fixture ownership and #2407 configured cancellation-fixture temporary storage. The cached PR base and merge ref still name the older tested candidate. Under the required live-base confirmation rule, no merge was attempted. The successful run remains valid for its recorded tree, not this newer combined tree.

Returned to draft and refreshed locally onto current main. Candidate ccf0f3f1d792a3cbd3d3a2401145b81bf24b9f72, parent 78cfba4ff443ca2ce380502f7875a4a4283525ee, tree 44cc90d6276957968094e5bb1b26bc52a72d03c3, has byte-identical callout and reviewed-binding files. Refreshed local preflight is running before push/new confirmation. Existing passing browser/layout receipts may be retained only if the current ledger independently validates complete equivalence under the existing policy; no older receipt will be relabeled a new execution. Claim issue-2386-t6v9 remains active.

[schlessera]

Custody handoff acknowledged to authorized claim takeover-2386-0a14, superseding my earlier statement that claim issue-2386-t6v9 continued through final qualification. The previous worker resumed on a status request before seeing the takeover note; the explicit old-head force-with-lease rejected its attempted publication after discovering the new head, so no remote update was overwritten. No further branch, readiness, label or shared-assignment mutation will be made by this worker. Preserve the new owner assignment.

Additional local receipt available to the takeover owner: candidate ccf0f3f1d792a3cbd3d3a2401145b81bf24b9f72, parent 78cfba4ff443ca2ce380502f7875a4a4283525ee, passed preflight: 956 invariants / 6,328 assertions and 171 affected import-graph tests / 1,523 assertions. Its tree 44cc90d6276957968094e5bb1b26bc52a72d03c3 equals the published takeover merge head ac94ce31f81a3274a8e65817e02e7b46e976641a; this equivalence is not a claim that the local command executed on the takeover commit. The earlier actual confirmation 39084080316 remains successful only for recorded base 68e12f27eb249c9fe7262a498a0397c04bbda8f4, head 8e89864ec56e4818027b06dc78e6d3fa180e167f and tree 6333172bcc6a8dd16bd2e239d6bcf9adc4d6b420.

The latest independent live-main read is ea4c76c15eee2e23701910b7c2395bdd479b99c6. Final current-candidate confirmation, matching-head merge and dependant reconciliation remain with the authorized takeover owner. This worker stops its duplicate PR watch; the implementation and original receipts stay preserved.