[i-shutov]

C04 — isolated lane C static catalogue gate

Exact base main: e3a78ae5646ef24994161c8ebe7bfaaf7a7d2ab6 (C03 #21 merged).
Exact head: 672e8dd6d50094dcc169927f86848fa2978b0bbc.
One commit, 5 new files only within extensions/qa/, plans/, insights/. PR #24 owns docs/EXTENSIONS.md and extensions/qa/run_smoke.py; neither is modified. No A/B/D/GUI/core/workflow files are changed.

Actual code

• extensions/qa/verify_catalog.py: Python 3.11+ stdlib-only audit of 5 declarative TOML manifests against 14 package-matrix rows, 5 explicit IDs and 5 fixed C02 fixture bindings. Rejects duplicate/unrepresented/dangling IDs, engine mismatch, unsupported/unsafe manifest data, missing or symlinked fixture files, extra CSV fields and optimistic metadata capabilities. Lua-only graphdrawing remains explicitly INCOMPATIBLE_ENGINE with native XeLaTeX.
• 14 tamper-oriented unit tests, usage runbook, C04 plan and QA insights.
• No TeX process, plugin code, network call, package lookup or runtime capability promotion is executed by this gate.

Executed QA (scope-limited)

• Local Python 3.13.5: python3 -m unittest discover -s extensions/qa -p test_verify_catalog.py -v — 14/14 PASS.
• Static audit — accepted=true, manifests=5, matrix rows=14, bound rows=5, fixture bindings=5, errors=[].
• Local test harness used byte-identical GitHub manifests and matrix, but placeholder TeX fixture contents; it tested only fixture presence. The exact GitHub checkout still needs CI execution. Local cargo/rustc, XeLaTeX and GUI checks were NOT_RUN.
• PR-head GitHub Actions: NOT_YET_VERIFIED at PR creation; check run status for this exact commit before any CI PASS.

Explicit boundaries

This is a static metadata-consistency PASS, not a XeLaTeX compile PASS, package-version certification, visual TikZ editing, native Windows 10 x64 test, physical Apple Silicon Mac smoke or trusted provenance. Hosted Windows Server/macOS CI cannot replace physical target smoke. Lua-only features cannot be advertised as XeLaTeX-native.

Integration handoff

Lane D: schedule verify_catalog.py + test_verify_catalog.py on the hosted matrix and retain failure output. After integration PR #24 changes run_smoke.py, revalidate C04's dependency on SOURCES / NEGATIVE without overwriting that file. Keep draft until exact-head checks are reviewed.

[i-shutov]

Integrator handoff (2026-10-31): main advanced from your PR base e3a78ae5646ef24994161c8ebe7bfaaf7a7d2ab6 to 8764a732b9a846a6ba1f111c9b656781195a6412 by I05 #24, which includes source-safe Windows XeLaTeX argv, merged F02 font diagnostics and C03 cross-host audit. I05 exact-head tests were Rust 3/3, D QA 6/6 and font 1/1 PASS; 15 C03 artifact records independently checked. Do not merge an old-base PASS as combined-main evidence. Refresh your isolated branch against this SHA without clobbering I05's modified .github/workflows, core/CLI, app UI or extension runner, then rerun the full exact-head CI/QA (source-preservation, font, cross-host package audit). Keep physical Win10 x64/M1/M4 NOT_RUN. The main merge tree and I05 head tree are byte-identical; post-merge main Actions are tracked separately.

[i-shutov]

Lane C refresh on 2026-10-31: I merged integrated main 8764a732b9a846a6ba1f111c9b656781195a6412 into the same isolated C04 branch (non-force, parents 672e8dd6... + 8764a732...). New exact HEAD: 2a8b079d3d1d2d94bc87d4bbb50cdb46a6ad19ed. main...HEAD comparison confirms exactly the original five new C04 files, no changes to I05 runner, CLI, GUI or workflows; PR is mergeable. This resolves the old-base integration blocker.

Fresh exact-head workflows: CI 41184678167 and D QA 41184678185 still in progress as of this comment; font integrity 41184678171 completed success. Do not call overall CI PASS until exact-head jobs are finished.

Lane D handoff: the existing workflows run C02/C03 tests but do not invoke C04's python -m unittest discover -s extensions/qa -p 'test_verify_catalog.py' -v or python extensions/qa/verify_catalog.py. Please integrate these in a D-owned workflow PR. Do not interpret successful TeX fixture rendering, hosted Windows Server or hosted macOS CI as visual-editing or physical Win10/M1/M4 acceptance. The new standalone C05 PR #30 is independent of C04 and does not modify these files.

[i-shutov]

Integration review, exact source head 2a8b079d3d1d2d94bc87d4bbb50cdb46a6ad19ed: 13 hosted checks PASS, but .github/workflows/ci.yml and qa-matrix.yml only invoke test_run_smoke.py and test_verify_smoke.py, not the new test_verify_catalog.py or verify_catalog.py. Thus green hosted jobs do not exercise this new static consistency gate. Please wire both new commands into at least one required workflow (prefer all D QA hosts and Linux fixture job) with --report JSON uploaded even on failure; include exact-head tested output, retain Lua-only incompatibility and physical NOT_RUN. I am withholding merge until the new gate really executes in CI. Changes can be in a follow-up tightly-scoped D integration PR if cross-lane ownership prohibits editing workflow here.

[i-shutov]

Integration handoff update: opened PR #34 (head c03801e4f3f426c1b8e5777fc0a77e669c2d3a47) stacked on this exact #26 head. It keeps all C04 code and makes verify_catalog.py plus its 14 tamper tests mandatory in Linux real XeLaTeX CI and all 3 hosted D QA Rust jobs, with per-host qa-catalog-metadata-* JSON artifacts. D QA 41186709166 is 6/6 PASS with accepted=true (5 manifests, 14 matrix rows, 5 bindings); figure font CI PASS; standard CI pending. If #34 exact combined CI completes green and is merged with a head lease, close this #26 as superseded, do not merge same catalogue files twice. Physical Win10/M1/M4 remains NOT_RUN; Lua-only engine remains incompatible.

[i-shutov]

Superseded by accepted integration #57, merged into main at c7afeb0a17a639e3a578ed916ecd0cd0a7cf5beb from exact verified HEAD 98ec7f8037f294c7d7117e25bab086f3e2530a29. The original static catalogue verifier, its 14 tamper tests, C04 README, plan and insight were compared against new main by Git blob SHA: byte-identical. I11 kept modern CI workflows, added actual 3-host + Linux invocations, preserved JSON artifacts (accepted=true, 5 manifests/14 rows/5 bindings), with real workflow/test/log evidence. This old branch was not merged and must not be force-merged again. Post-merge main Actions are separately tracked. Physical Win10/M1/M4 acceptance remains NOT_RUN.