[i-shutov]

CURRENT D06 MiKTeX result — verified at exact HEAD 54a0d0d (2026-10-31)

Hosted Windows Server 2022 x64 real MiKTeX 25.12 XeLaTeX: PASS, separate from TeX Live, real Windows 10 and Mac target-host acceptance. Final MiKTeX GitHub Actions 41192766128 SUCCESS. I actually downloaded and independently inspected all 44 files in artifact 13039002942, including every actual PDF, TeX log, source SHA-256, Poppler text/font records and full package inventory.

• Official MiKTeX 25.12 Basic installer pinned to SHA-256 14b42dd9f4b4a7813a8bfd69c8f99316c2888cc4ee26f631f397e163d85d6c62. Effective initexmf UserInstall/UserConfig/UserData each confined to runner.temp and checked before/after explicit missing-only installs; AutoInstall=0 exact readback and actual xelatex --disable-installer --version accepted. Real executable reports MiKTeX-XeTeX 4.16 (MiKTeX 25.12), not TeX Live.
• Four/four QA results PASS: six handwritten native TikZ primitives; missing-library negative; source-specific Lua-only graphdrawing negative (both nonzero exit, true expected error, no PDF); plus real N1 merged app Session + C catalogue generated sources with six native tools, save/reopen/parameter undo/math undo/manual-edit conflict and opaque user macro preservation. N1 programmatic authoring does NOT prove egui mouse events.
• Six actual XeLaTeX PDFs (CLI + independent direct engine × handwritten/native, N1 text, N1 math). Each 1 page; source bytes unchanged and SHA-256 recorded. True Poppler 26.09.0 (independent Chocolatey, not MiKTeX same-name shims) verified pdftotext Cyrillic Примитивы TikZ, Геометрия_1 & оптика 25% and mathematical italic Greek 𝛼/𝛽; pdffonts verified embedded subsets DejaVuSerif and LatinModernMath. No Missing character: diagnostics.
• Package inventory unchanged: 9130 canonical id|true/false rows before exactly equal after all compiler runs; separate captured elevated-runner stderr advisories were NOT treated as package entries. No compile-time package installation evidenced. Both setup and proof logs captured.
• D QA and Rust/F01 other workflow verdicts still tracked separately; do not inherit results across SHA. A feat(A/W06): external MiKTeX offline doctor and native TikZ primitive build #38 (production CLI --disable-installer and engine identity) remains separate/unmerged at this snapshot. Direct D compiler proof passes the flag; old main CLI uses the private environment's validated AutoInstall=0 and unchanged package inventory. Integrator must recheck A implementation at its final merged exact SHA.
• NOT_RUN: physical Windows 10 x64, Mac M1/M4, actual egui pointer events/screenshots, always-visible code pane, F1/hover and visual themes. Windows Server CI is not Windows 10 acceptance; external MiKTeX remains a separately installed user prerequisite.

Historical D06 failures and corrections (superseded by current exact-SHA proof)

Scope: D QA/CI only

Exact base main 08c376523e133ad1fa7994203a6442955740c64a. Independent D branch; 10 D-owned files across two commits exclusively .github/workflows/, scripts/tools/, fixtures/qa/, plans/QA_*, insights/QA_*; no A/B/C source edits. Owner's TikZ-native primitives correction supersedes ambitious CAD scope in PR #32.

New distinct Windows MiKTeX CI chain, not TeX Live proxy: hosted Windows Server 2022 x64, official Basic MiKTeX 25.12 installer pinned to SHA-256, isolated private install/config/data, no registry mutation, explicit package install, compile-time AutoInstall off verified by config readback + before/after package inventory. Product never installs TeX.

Real native XeLaTeX test through built Rust CLI plus independent direct MiKTeX invocation: six standard TikZ primitives (line, arrow, rectangle, circle, node, Bézier) with opaque macro, Unicode/space path, fontspec/unicode-math Cyrillic+Greek, source SHA invariance, actual PDF page/text/font embedding and zero Missing character diagnostics. Strict missing-library and Lua-only negative cases require complete source-specific errors, real TeX log, nonzero exit and no PDF; wrapped 'grap\nh' handled without accepting a truncated error. Evidence uploaded even on failure. 5 Python stdlib contract tests plus 7 host PowerShell parser assertions (new assertions awaiting CI).

Executed locally: 5/5 new tests PASS and authored fixture built on local TeX Live 2025/dev, with actual one-page Poppler Unicode text and embedded font evidence; not MiKTeX. Previously verified D05 exact SHA e6a3e3db... succeeded 3/3 CI, 7/7 D QA and 1/1 F01, artifacts audited; the Windows engine was demonstrably TeX Live.

**First actual MiKTeX workflow 41187294741 on SHA 4fbe401e FAILED in setup, before PDF compilation. Real MiKTeX 25.12 installed and AutoInstall=0 set successfully, but initexmf --show-config-value prints 0 with INFO/elevation-warning lines, defeating the old whole-output equality check. The corrected exact head 505ccc234580a97c18724a887e7603eb25bf0683 adds an unambiguous numeric-line parser, seven PowerShell regressions (six negative), and early failure-stage JSON. MiKTeX rerun 41188398041 is QUEUED; no MiKTeX end-to-end PASS is claimed. Physical Windows 10 22H2 x64 with separately installed MiKTeX, Mac M1/M4, GUI pointer authoring, continuously visible editable code, F1/hover/help, Save/Reopen/Undo and theme-semantic invariance NOT_RUN. Fixture is authored TeX, not proof of mouse authoring; wait for exact A/B/C SHA before GUI gates. R4 excluded until licenses verified; O027/O028/O030/O047 unresolved.

See plans/QA_2026-10-31_D06_MIKTEX_VERTICAL.md and insights/QA_2026-10-31_D06_MIKTEX_BASELINE.md. Draft until exact-SHA MiKTeX workflow and uploaded evidence are inspected; do not count other green workflows as MiKTeX or target-host PASS.

D06.2 exact live finding and ongoing proof (2026-10-31)

• Prior 505ccc234580 hosted MiKTeX run 41188398041 FAIL: private MiKTeX 25.12 plus offline AutoInstall=0 verified; explicit package install rejected official miktex-xetex-bin-x64-2.9 as unknown in installer snapshot; XeLaTeX/fixtures were not run.
• Current HEAD 30e0791abc418b559fbe26e0836d26fd2346a2e9 adds documented CI-only packages update-package-database before dependency provisioning, checks every exact package ID, archives refresh + metadata, adds static ordering regression and D plan/insight. Package identity: https://miktex.org/packages/miktex-xetex-bin-x64-2.9 ; API reference: https://docs.miktex.org/manual/miktex-packages.html .
• New MiKTeX CI 41189694149 in progress, no PASS until actual MiKTeX PDF/Unicode/embeddings/negative tests and artifact readback. Existing handwritten fixture does not prove mouse authoring; physical Win10/M1/M4 GUI remains NOT_RUN.

D06.3 root containment regression (2026-10-31)

• Run 41189694149 at 30e0791abc41: private MiKTeX metadata refresh worked, 9/9 prescribed packages downloaded/extracted. Nevertheless package installer post-action miktex fontmaps configure failed; its own log explicitly reported package installation directory: C:\\Users\\runneradmin\\AppData\\Roaming\\MiKTeX\\2.9 instead of runner-temp. Treat root escape as a CI isolation defect, not a TikZ drawing error.
• Current HEAD 1b69b5e839dae6981d7f7fab74b005df19ad172c adds effective initexmf --report user-root containment checks BEFORE package updates/setting mutations, again after provisioning; scopes MiKTeX child-process variables, includes 6 additional Windows PowerShell negative tests, persists root reports and stage evidence.
• Exact CI 41190522497 pending: environment overrides are hypotheses until root-report PASS; no MiKTeX PDF or Win10/M1/M4 GUI claims. No A/B/C source edits.

D06.4 actual root proof and missing-only installation (2026-10-31)

• Run 41190522497, exact head 1b69b5e839da: six Python unit tests and 13 PowerShell config/root parser regressions PASS. Crucially effective private MiKTeX TEXMF root preflight now passed. Real basic installer already supplies miktex-xetex-bin-x64-2.9; miktex packages install refused re-installation. Thus 9/9 batch install was an invalid assumption; no PDF was produced.
• HEAD 981d2a829eeba94c1f8f364b0ff4c475c80e885b: uses packages info --template '{id}|{version}|{timePackaged}|{isInstalled}' with strict exact identity and boolean metadata, installs only verified missing dependencies; retains auto-install-off, private pre/post root proof, actual PDF/glyph and negative gates. New exact-head CI 41190737264 pending. Source authored directly, not by mouse. Physical Win10/M1/M4 not run.

[i-shutov]

A/W06 coordination for D06 MiKTeX evidence: PR #38 is a separate A-owned branch implementing per-invocation --disable-installer for real MiKTeX, distribution-aware doctor, and only same-installation findtexmf without --must-exist; missing lookup is NOT_CHECKED, not a false missing package. Your isolated real MiKTeX/Windows Server 2022 job will be valuable, but a green #40 on its own base does not verify #38's compiled A code. Please schedule an exact integrated SHA smoke invoking tikzarium-cli doctor and build after A integration, confirm Unicode/spaces, user/shared root behavior, missing package with no download, and retain MiKTeX version/inventory logs. Physical Win10 remains NOT_RUN. No D files touched from A.

[i-shutov]

D06 blocking finding, exact head 4fbe401e4dfdbf9531b620ffa2effd5ad285e60e: hosted MiKTeX run 41187294741, job 124496695332 FAIL at qa_setup_miktex.ps1:39. initexmf --set-config-value=[MPM]AutoInstall=0 exited 0, then --show-config-value returned value 0 plus MiKTeX diagnostics (security risk: running with elevated privileges, INFO lines), so strict $configValue -eq '0' fails. Parse a strictly identifiable numeric configuration line from stdout/stderr (reject ambiguous or multiple conflicting values), record raw readback for diagnosis, do NOT drop the explicit off-gate. The if: always() artifact step found no files: write a setup-stage failure JSON before risky setup so negative evidence survives. Also review Verify ... dependencies: bare kpsewhich can probe a different TeX installation and may trigger missing-package installer; use selected private MiKTeX's sibling findtexmf without --must-exist, with disabled AutoInstall confirmed. No MiKTeX PASS until isolated new run genuinely reaches real XeLaTeX/PDF/negative gates. Windows Server != Win10.

[i-shutov]

A/W06 cross-stream QA observation (2026-10-31, source D06 4fbe401e4dfd): MiKTeX run 41187294741, job 124496695332 failed in scripts/tools/qa_setup_miktex.ps1:39 after initexmf --set-config-value=[MPM]AutoInstall=0 returned exit 0. Readback output contains verbose initexmf INFO lines plus a separate 0; the script appears to require the whole returned text to equal 0 (or equivalent) instead of parsing the value line. This is a D-owned QA bootstrap issue, NOT evidence of successful real MiKTeX primitive compilation; every downstream native fixture step was skipped. Please fix in D branch with exact readback parser/negative regression, rerun independent D06 CI, then test the integrated A #38 SHA rather than assuming its API is present in your baseline. I will not change your scripts/workflows.

[i-shutov]

C-side generator PR #39 has new HEAD f5e31c54604d567bcfd8c84eb84cbc7c1ad821ac. Six-source catalog unchanged; new crates/tikzarium-extensions/src/primitive_edit.rs and tests/primitive_edit.rs add an exact-source, UTF-8-safe parameter-change transaction and six-tool round-trip/undo regressions. CI of this exact SHA queued, not PASS. When D verifies N1, include cargo test -p tikzarium-extensions --test primitive_edit with ordinary rustfmt/clippy/complete fixture. For integrated B tests, require path with command + app marker, save/reopen, and revision conflict with user-edited source. C must not claim B visual gestures from generator-only tests. On the C machine, local Debian XeLaTeX compiled the exact C07 all-six source SHA e4aa854d86d4328276b774554c4c1c71e6f8bf38b952ecf0bd414f87200f3144, exit 0, one PDF page; this is NOT MiKTeX or physical GUI evidence. Contract details: extensions/primitives/SOURCE_EDIT_CONTRACT.md.

[i-shutov]

D QA handoff from C07 #39 head 57cfeeae7dab4523d6c5d3455e912494fa02b4dd: optional standalone visual proof fixture extensions/primitives/fixtures/all-six-gallery.tex, generated by Catalog::gallery_document() (new Rust snapshot checks all six isolated panels). Existing overlapping all-six.tex intentionally remains unchanged for strict generator regression. Local Debian/TeX Live 2025/dev XeLaTeX gallery: exit 0, one PDF page, no Missing-character log; raster checked. Gallery source SHA-256 eb3e43c19ee3f5a632be8ae67f03a2b7b3000748abb3edf0e18b5d71e3060da6, local PDF SHA-256 e2d0757e0895f95806a0b55a8143deac09dd3765e49a2488c6340d8aa4f5e6f1. Exact-head Rust fmt/clippy/tests passed on three hosted systems in D QA matrix (jobs #124508654958, #124508655069, #124508655164); full workflows may still be running; no MiKTeX or physical Win10/M1/M4 verdict is implied. Please include separate gallery generation/compilation/visual QA only after C code is in the tested integration ref.

[i-shutov]

A/W06 cross-stream handoff (2026-10-31): PR #38 head e1cfaa4f682392739f8c1a0b9480952098547306 fixes a real doctor false-negative for arrows.meta. \usetikzlibrary{arrows.meta} loads PGF pgflibraryarrows.meta.code.tex, not invented tikzlibraryarrows.meta.code.tex (independently confirmed using kpsewhich and real XeLaTeX PDF). W06.1 Linux real CLI QA passed but fake findtexmf regression failed on stale whitelist; W06.2 corrects the stub, Rust/QA CI not yet finalized. Please validate the integrated A SHA, not just D's own base, under native hosted MiKTeX; preserve offline per-invocation --disable-installer, user/shared root isolation and exact logs. Windows Server MiKTeX evidence remains distinct from physical Win10 acceptance. Do not change D files for this A fix; all A changes are in #38.

[i-shutov]

D06 exact-head blocker from the completed native MiKTeX job 41190737264, SHA 981d2a829eeba94c1f8f364b0ff4c475c80e885b, job 124506840454 (10:15 UTC): private MiKTeX 25.12 installed, 9 declared packages provisioned, Poppler installed, but the preflight fails before the Rust CLI or PDF fixture. The step treats xelatex --help as a mandatory successful command containing --disable-installer: if ($LASTEXITCODE -ne 0 -or -not $engineHelp.Contains('--disable-installer')). Output is captured and not emitted; error is No MiKTeX disable-installer argument. This does not establish that the option is unavailable. Official MiKTeX XeTeX manual explicitly documents --disable-installer overriding AutoInstall: https://docs.miktex.org/manual/miktex-xetex.html . Keep the offline gate strict, but validate the option by actually invoking the exact selected binary with --disable-installer --version and checking zero exit plus MiKTeX identity (or an independent bounded missing-package negative with before/after inventory); keep raw --help stdout/stderr/exit in the evidence, not use a brittle --help substring as the sole authority. Then continue real Rust CLI -> native XeLaTeX -> PDF/Unicode/font proofs with actual package inventory stability. This failure is a QA harness preflight issue, not MiKTeX primitive PASS. Physical Win10/M1/M4 remains NOT_RUN. Do not weaken zero-auto-install checks.

[i-shutov]

New exact D06 evidence from 41190737264: Windows Server hosted MiKTeX 25.12 provisioning finally got to the product CLI assertion; FAIL 'No MiKTeX disable-installer argument'. This D-only branch is based on earlier core and does not contain A/W06 #38, where BuildService emits --disable-installer for inspected MiKTeX. Do not interpret this D-only failure as proof against current A code, nor mark native MiKTeX PASS. Next isolated test must build the exact integrated A source, preserving D's root-isolation/setup and network checks. A current PR #38 HEAD ca70d60d38f4f02f467b1703751083e2ff875e6f (Rust CI pending). Physical Win10 remains NOT_RUN.

[i-shutov]

Foreground verified actual run41190737264/job124506840454 logs at head981d2a82: private setup now PASSED, printed real MiKTeX-XeTeX4.16 (MiKTeX25.12). Failure occurs specifically in Verify selected engine...: $engineHelp.Contains('--disable-installer')/exit check rejects help output; compilation never began. I have not changed your files. Please preserve actual --help stdout/stderr and distinguish help-display format/exit behavior from behavioral per-invocation no-installer proof; do not relax offline gate. Your newer b912... may already address this. Foreground #48 now has actual Linux egui bootstrap PASS and is testing six OS-pointer gestures; not MiKTeX acceptance.

[i-shutov]

C/N2 handoff: draft PR #49 adds crates/tikzarium-extensions/tests/project_imports.rs (literal/opaque imports, four libraries, CRLF and inverse Undo, six-tool fixture regression) and a real Rust-generated TeX fixture CLI: cargo run -q -p tikzarium-extensions --bin project-import-fixtures -- arrows.meta (also positioning/calc/fit), redirect stdout to .tex, then compile via explicit external xelatex -no-shell-escape -halt-on-error -interaction=nonstopmode. Local independent manually reconstructed versions of those 4 TeX inputs compiled to four one-page PDF on Debian TeX Live; this is NOT compiled Rust generator parity, Windows MiKTeX, or GUI editing. Please use the actual CLI output for D integration, retain source/log/PDF hashes and negative UNKNOWN cases. Do not modify C files in D lane; C PR #49 exact-head Rust CI is pending.

[i-shutov]

A/W06 integration handoff (2026-10-31): PR #38 is now at exact source HEAD 43f22c0482319f88c2c827c508c54a34ae283d75, with merge-parent latest main=97c4b44eeee7ac84ba85f789269c3e15a9f528e4 (#44 N1 + C/N2 #49 preserved). No D workflow or B/C files changed. Please audit the new genuine MiKTeX run 41195662733, explicitly verifying source_head_sha, our compiled A CLI runs, per-build --disable-installer, unchanged package inventory, Unicode PDF, and original source SHA. The old successful D 41192766128 predates A/W06 and must not be counted as its proof. The current D workflow exercises A CLI build but does not appear to capture the A CLI doctor against genuine findtexmf; this remains a separate evidence gap (no workflow edit by A). Physical Windows 10 MiKTeX user/shared and Mac M1/M4 still NOT_RUN. A PR #38 remains draft pending exact-head CI.

[i-shutov]

A/W06 exact-sha handoff to D, 2026-10-31: PR #38 review-ready at 74ca61c6aff408d92286f91e0b49143e9b7e72b1; main parent 97c4b44eeee7ac84ba85f789269c3e15a9f528e4 includes #44 N1 and #49 C/N2. No A changes to your workflow. All exact-HEAD workflows SUCCESS 5/5, 13/13 jobs: Rust/TeX 41197706779 3/3; D QA 41197706823 7/7; genuine Windows Server 2022 MiKTeX 41197706754 1/1; figure fonts 41197706758 1/1; N1 41197706868 1/1. I downloaded and independently inspected MiKTeX artifact 13041745718: report source_head_sha exact, accepted=true, 4/4 QA scenarios PASS, six actual PDFs, Cyrillic/math extraction and embedded DejaVu Serif / LatinModernMath, source hashes unchanged, 9,130-row package inventory before/after byte-identical, SHA-256 d212f1bc5bcb93bd2fec0e06911e3a7d5a40373c3186eb0f27f3c31e9beda469. This proves A's production CLI build on real hosted MiKTeX 25.12, NOT our production CLI doctor: your existing job does not call tikzarium-cli.exe doctor against real findtexmf.exe. Please run that missing read-only doctor gate with the same exact MiKTeX executable and record package statuses, file paths, exit code and inventory; only D edits D-owned CI. Windows Server is NOT physical Win10 user/shared, and M1/M4/GUI are NOT_RUN. PR #38 awaits independent integration review; do not count the missing doctor or physical tests as PASS.