test(D06): isolated real MiKTeX XeLaTeX CI + six TikZ primitives and strict error proofs

.github/workflows/qa-miktex-windows.yml

@@ -0,0 +1,118 @@
+name: D06 distinct MiKTeX Windows Server XeLaTeX proof
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/workflows/qa-miktex-windows.yml
+      - scripts/tools/qa_miktex_vertical.py
+      - scripts/tools/test_qa_miktex_vertical.py
+      - scripts/tools/qa_setup_miktex.ps1
+      - scripts/tools/qa_miktex_config.ps1
+      - scripts/tools/test_qa_miktex_config.ps1
+      - scripts/tools/qa_miktex_inventory.ps1
+      - scripts/tools/test_qa_miktex_inventory.ps1
+      - fixtures/qa/d06-native-primitives/**
+      - scripts/tools/qa_smoke.py
+      - crates/tikzarium-core/**
+      - crates/tikzarium-cli/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  miktex-windows-hosted:
+    name: MiKTeX 25.12 XeLaTeX / hosted Windows Server 2022 x64 only
+    runs-on: windows-2022
+    timeout-minutes: 60
+    env:
+      TIKZARIUM_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec
+        with:
+          toolchain: '1.91.0'
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.13'
+      - name: Verify hosted Windows x64 (not Windows 10 acceptance)
+        shell: pwsh
+        run: |
+          if ($env:RUNNER_OS -ne 'Windows' -or $env:RUNNER_ARCH -ne 'X64') { throw 'Wrong runner' }
+          Write-Host "OS=$([System.Environment]::OSVersion.VersionString); architecture=$env:RUNNER_ARCH"
+      - name: D06 stdlib negative contract tests
+        run: python -m unittest discover -s scripts/tools -p test_qa_miktex_vertical.py -v
+      - name: D06 MiKTeX configuration readback parser regression
+        shell: pwsh
+        run: ./scripts/tools/test_qa_miktex_config.ps1
+      - name: D06 MiKTeX package inventory stdout/stderr parser regression
+        shell: pwsh
+        run: ./scripts/tools/test_qa_miktex_inventory.ps1
+      - name: Isolated private MiKTeX installation with pinned installer and declared packages
+        shell: pwsh
+        run: ./scripts/tools/qa_setup_miktex.ps1
+      - name: Poppler PDF auditors (independent from MiKTeX)
+        run: choco install poppler --version=26.9.0 --yes --no-progress
+      - name: Verify independent Poppler shim installation for required PDF auditors
+        shell: pwsh
+        run: |
+          if (-not $env:ChocolateyInstall) { throw 'ChocolateyInstall root is unknown' }
+          $popplerBin = Join-Path $env:ChocolateyInstall 'bin'
+          foreach ($tool in @('pdfinfo','pdftotext','pdffonts')) {
+            $path = Join-Path $popplerBin "$tool.exe"
+            if (-not (Test-Path -LiteralPath $path)) { throw "Chocolatey Poppler $tool shim missing: $path" }
+          }
+          "TIKZARIUM_POPPLER_BIN=$popplerBin" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+      - name: Verify selected engine and required installed files (no tlmgr)
+        shell: pwsh
+        run: |
+          & $env:TIKZARIUM_XELATEX --version
+          # MiKTeX 25.12 --help may exit nonzero / omit the switch. Its official
+          # XeTeX manual documents the switch; probe the REAL binary with it.
+          $flagProbe = (& $env:TIKZARIUM_XELATEX --disable-installer --version 2>&1 | Out-String)
+          $probeExit = $LASTEXITCODE
+          $flagProbe | Set-Content .qa-artifacts/miktex-windows-server/disable-installer-version.log -Encoding utf8
+          if ($probeExit -ne 0 -or $flagProbe -notmatch 'MiKTeX-XeTeX\s+[0-9]') {
+            throw 'Real MiKTeX XeLaTeX rejected --disable-installer version probe'
+          }
+          foreach ($name in @('standalone.cls','tikz.sty','fontspec.sty','unicode-math.sty','DejaVuSerif.ttf','latinmodern-math.otf')) {
+            $found = & kpsewhich $name
+            if ($LASTEXITCODE -ne 0 -or -not $found) { throw "Missing declared MiKTeX dependency $name" }
+            Write-Host "$name => $found"
+          }
+      - name: Record clean package inventory before actual compilation
+        shell: pwsh
+        run: |
+          . ./scripts/tools/qa_miktex_inventory.ps1
+          $record = '.qa-artifacts/miktex-windows-server'
+          Save-MiKTeXInventory -Executable $env:TIKZARIUM_MIKTEX_EXE -Snapshot "$record/packages-before.txt" -StderrLog "$record/packages-before-stderr.log"
+      - name: Build native Rust CLI (uses explicitly selected MiKTeX executable)
+        run: cargo build -p tikzarium-cli
+      - name: Build merged N1 app Session authoring-source producer (not GUI event QA)
+        run: cargo build -p tikzarium-app --bin n1-authoring-proof
+      - name: Actual N1 Session-generated TikZ + hand-authored baseline + strict negatives
+        shell: pwsh
+        run: python scripts/tools/qa_miktex_vertical.py --cli target/debug/tikzarium-cli.exe --n1-proof target/debug/n1-authoring-proof.exe --xelatex "$env:TIKZARIUM_XELATEX" --poppler-dir "$env:TIKZARIUM_POPPLER_BIN" --miktex-prefix "$env:TIKZARIUM_MIKTEX_PREFIX" --setup-record .qa-artifacts/miktex-windows-server/setup.json --output .qa-artifacts/miktex-windows-server
+      - name: Require zero implicit MiKTeX package installs during compilation, even after failures
+        if: always()
+        shell: pwsh
+        run: |
+          $baseline = '.qa-artifacts/miktex-windows-server/packages-before.txt'
+          if (-not (Test-Path -LiteralPath $baseline)) {
+            Write-Host 'NOT_RUN: package baseline was not obtained (earlier setup failed)'
+          } else {
+            if (-not $env:TIKZARIUM_MIKTEX_EXE) { throw 'Missing MiKTeX executable for postcompile inventory' }
+            . ./scripts/tools/qa_miktex_inventory.ps1
+            Save-MiKTeXInventory -Executable $env:TIKZARIUM_MIKTEX_EXE -Snapshot '.qa-artifacts/miktex-windows-server/packages-after.txt' -StderrLog '.qa-artifacts/miktex-windows-server/packages-after-stderr.log'
+            $diff = Compare-Object (Get-Content $baseline) (Get-Content .qa-artifacts/miktex-windows-server/packages-after.txt)
+            if ($diff) { throw 'MiKTeX package inventory changed during supposedly offline compiler run' }
+          }
+      - name: Upload evidence also on failure; CI_ONLY is not physical Win10 PASS
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: qa-miktex-windows-server
+          path: .qa-artifacts/miktex-windows-server/
+          if-no-files-found: warn
+          retention-days: 14

fixtures/qa/d06-native-primitives/main.tex

@@ -0,0 +1,20 @@
+% D06 independent authored TikZ baseline; NOT produced by mouse drawing.
+% Preserve these unknown/comment regions and spelling verbatim.
+\documentclass[border=9pt]{standalone}
+\usepackage{fontspec}
+\usepackage{unicode-math}
+\usepackage{tikz}
+\setmainfont{DejaVuSerif.ttf}
+\setmathfont{latinmodern-math.otf}
+\newcommand{\TikzariumOpaqueNote}[1]{#1}
+\begin{document}
+\begin{tikzpicture}[>=stealth]
+  \draw (0,0) -- (2,0);
+  \draw[->] (0,0.4) -- (2,0.4);
+  \draw (2.5,0) rectangle (4.5,1);
+  \draw (5.3,0.5) circle[radius=0.5cm];
+  \node[draw] at (1,1.4) {Примитивы TikZ};
+  \draw[thick] (2.5,1) .. controls (3,1.5) and (4,1.5) .. (4.5,1);
+  \node at (3.8,-0.4) {\TikzariumOpaqueNote{Кривая Безье αβγ} $\alpha+\beta$};
+\end{tikzpicture}
+\end{document}

fixtures/qa/d06-native-primitives/missing-library.tex

@@ -0,0 +1,7 @@
+% Strict negative: no MiKTeX package auto-install and no PDF is acceptable.
+\documentclass{standalone}
+\usepackage{tikz}
+\usetikzlibrary{tikzarium_qa_nonexistent_8f7d41}
+\begin{document}
+\begin{tikzpicture}\draw (0,0) -- (1,1);\end{tikzpicture}
+\end{document}

insights/QA_2026-10-31_D06_MIKTEX_BASELINE.md

@@ -0,0 +1,45 @@
+# D06 — independent QA, exact SHA and MiKTeX provenance
+
+Date 2026-10-31. Starting main c5c8c1576b6288e1d125d558d0d4872b321efb86; checked main again before work, branched from 08c376523e133ad1fa7994203a6442955740c64a after merged B05 #25. Read AGENTS.md, plans, insights, CI/target-host documents and open PRs (#27/#28/#31/#32/#33/#34/#36/#37). Changes exclusively D-owned paths.
+
+## Verified previous D05 — NOT evidence for D06
+
+D05 #31 exact head e6a3e3db93c97667be8b8dffdec0625bd2760a1f had Rust CI https://github.com/i-shutov/tikzarium/actions/runs/41185834712 3/3, D QA https://github.com/i-shutov/tikzarium/actions/runs/41185834802 7/7, and F01 https://github.com/i-shutov/tikzarium/actions/runs/41185834709 1/1. Actually downloaded and reviewed crosshost artifact 13036784027; its accepted=true verifies six fixtures, five extension cases, PDF text/font checks on Linux, Windows Server and hosted macOS ARM. Also downloaded actual host QA ZIPs: Linux 13036627532, Windows Server 13036878252, macOS ARM 13037095015; checked reports and five extension observation artifacts per host. Windows XeLaTeX executable was C:\Users\runneradmin/texlive/bin/windows\xelatex.EXE, therefore **TeX Live**, not MiKTeX. Cannot transfer these PASS results to MiKTeX or physical Win10/M1/M4.
+
+## D06 executed local results — NOT MiKTeX
+
+D06 stdlib negative tests: 5/5 PASS. Local engine XeTeX 3.141592653-2.6-0.999996, TeX Live 2025/dev/Debian, compiled the authored native-primitive source into real one-page PDF. Poppler pdftotext extracted Cyrillic and Greek; pdffonts recorded embedded DejaVuSerif and LatinModernMath; no Missing character warnings. Source SHA-256 bca344c361a0e62f0191a0d62ad20c5bf1145c40e83177f3c14c0c3841314e67.
+
+**Separate D06 hosted Windows MiKTeX test is NOT_RUN/PENDING until new exact SHA CI plus artifacts are reviewed.** Installer is private and SHA-pinned, automatic package installation explicitly disabled and verified. TeX is independently installed on user Windows 10, never shipped or installed by TikZarium.
+
+Physical Win10, native Mac M1/M4 GUI screenshots, mouse authoring six primitives, permanent code pane and shared help, Save/Reopen/Undo, GUI theme source/PDF invariance remain NOT_RUN. Hand-written fixture does not prove mouse authoring. R4 corpus source-only and no unverified licenses/assets imported; O027/O028/O030/O047 open.
+
+## D06 first live failure and repair (2026-10-31)
+
+Fresh main 0aa78ae22df0ae84705ba461f017fce256325875, open PR #37/#38/#39/#40 reviewed; AGENTS, plans and insights reread. Actual hosted MiKTeX run https://github.com/i-shutov/tikzarium/actions/runs/41187294741 SHA 4fbe401e4dfdbf9531b620ffa2effd5ad285e60e FAIL, job 124496695332: setup installed MiKTeX 25.12 in runner temp; `initexmf --set-config-value=[MPM]AutoInstall=0` exited 0. The subsequent readback emitted standalone numeric `0` plus MiKTeX 25.12 INFO and elevation-warning lines; setup compared the **entire** output string to `0`, thus falsely rejected a successful readback. No package provisioning/PDF/glyph proof executed and the uploaded artifact path did not exist, so **MiKTeX end-to-end remains NOT_RUN**. F01 and basic Rust CI passed at that original SHA; do not transfer those verdicts to MiKTeX.
+
+Repair is in D-only PowerShell helper plus live parser tests, persisted preflight stage record and this plan/insight update. Exact-head CI for revised D06 must prove actual MiKTeX provisioning, compiler identity/flags, PDF and negative TeX behavior. Physical Win10/M1/M4 and GUI mouse Save/Reopen/Undo remain NOT_RUN. Source: exact job logs fetched via GitHub API, not inferred from a green summary.
+
+## D06.2 observed MiKTeX package metadata drift (2026-10-31)
+
+Full logs from GitHub Actions [41188398041](https://github.com/i-shutov/tikzarium/actions/runs/41188398041), job 124499916389, show Windows Server build 20348, real private MiKTeX 25.12, verified isolated AutoInstall readback 0, then `The requested package is unknown` with `name="miktex-xetex-bin-x64-2.9"`. The official package exists (XeTeX x64 executable, packaged 2026-05-14): https://miktex.org/packages/miktex-xetex-bin-x64-2.9 . The initial 25.12 index was inadequate for that 2026 package; use the documented `update-package-database` subcommand, but don't claim resolution without the new live run. New D setup records refresh and metadata failures in archived artifacts; the user-installed MiKTeX is untouched. Engine run, Unicode, fonts, PDF and source/GUI scenarios remain NOT_RUN in MiKTeX.
+
+## D06.3 — package repair succeeded, but package writes escaped CI temp
+
+At [41189694149](https://github.com/i-shutov/tikzarium/actions/runs/41189694149) the stale-package problem from D06.2 is **resolved experimentally**: refreshed MiKTeX 25.12 metadata recognized all 9 packages; the `miktex-xetex-bin-x64-2.9` binary package was actually downloaded/extracted. New failure is `miktex fontmaps configure` exit 1 during explicit provisioning. More importantly, setup's private `--user-*` paths did not carry through to package operations: printed user package root was `C:\Users\runneradmin\AppData\Roaming\MiKTeX\2.9`, not runner temp. Treat as isolation breach in the CI process (ephemeral runner), and reject before further mutation. `initexmf --report` exposes user TEXMF roots; new preflight and postflight checks enforce exact root ownership. Do not interpret environment variable presence as verification: the effective root report at the next exact SHA decides. The application itself does not install packages. MiKTeX PDF/Unicode/glyph and negatives still NOT_RUN; physical target hosts NOT_RUN.
+
+## D06.4 — package install is not install-if-missing
+
+Live [41190522497](https://github.com/i-shutov/tikzarium/actions/runs/41190522497), HEAD `1b69b5e839dae6981d7f7fab74b005df19ad172c`, closed the root-escape preflight blocker: effective TEXMF root report accepted before packages, 6 additional PowerShell negative tests passed, and MiKTeX package metadata was obtainable. The next explicit `packages install @packages` failed with `miktex-xetex-bin-x64-2.9: package is already installed`: the Basic installer supplies at least this dependency. A blanket installation of all nine was logically wrong. Correct operation is exact `packages info` per ID then install only missing entries, fail closed for unknown or malformed `isInstalled`. No loosening of XeLaTeX/PDF/glyph checks; those are still NOT_RUN, as are physical Windows 10/M1/M4.
+
+## D06.5 — exact source inspection after setup completes; not a TeX failure
+
+Job [41190737264](https://github.com/i-shutov/tikzarium/actions/runs/41190737264) at `981d2a829eeba94c1f8f364b0ff4c475c80e885b`: setup and 3 explicit missing package installations **succeeded** under effective private roots; Poppler installed. Failure was next stage `No MiKTeX disable-installer argument` from inspecting the `--help` text/exit instead of an actual `--disable-installer` invocation. GitHub job 124506840454 and downloaded [artifact 13038629910](https://github.com/i-shutov/tikzarium/actions/runs/41190737264/artifacts/13038629910), 7 files, substantiate: `setup.json` engine `MiKTeX-XeTeX 4.16 (MiKTeX 25.12)`, SHA-256 installer `14b42dd9f4b4a7813a8bfd69c8f99316c2888cc4ee26f631f397e163d85d6c62`, `AutoInstall=0`, root pre/post private, `unicode-math/lm-math/dejavu` installed from exact metadata. There is **no PDF** in this artifact and no TeX compile; do not misstate the verdict.
+
+Next D change checks actual `xelatex --disable-installer --version` acceptance, records flag probe, and connects merged N1 `n1-authoring-proof` Session output to actual MiKTeX-backed CLI/direct compilation in the same job. N1 validation is extra executable evidence; it is neither hand-written replacement nor physical pointer authoring. Full compiler/provenance+PDF gates remain mandatory, and package inventory compare runs even when later compilation fails. A #38 offline production contract HEAD `e1cfaa4f682392739f8c1a0b9480952098547306` communicated on PR. New exact-head CI verdict pending. Official option reference: https://docs.miktex.org/manual/miktex-xetex.html .
+
+## D06.6 — real XeLaTeX PDFs exist, two independently isolated QA path/inventory errors
+
+[Run 41192192094](https://github.com/i-shutov/tikzarium/actions/runs/41192192094) (D SHA `b91240852038ee02a0ae5211f12cd8e753f5821d`) exited FAIL after successfully provisioning real isolated MiKTeX and producing 6 valid PDFs (3 sources × CLI/direct). I downloaded/extracted [artifact 13038964316](https://github.com/i-shutov/tikzarium/actions/runs/41192192094/artifacts/13038964316) and independently ran real local `pdfinfo/pdftotext/pdffonts` on each: one page, Cyrillic `Примитивы TikZ`, `Геометрия_1 & оптика 25%`, handwritten `Кривая Безье αβγ`; N1 math text `𝐸 = ℏ𝜔, 𝛼+𝛽 =𝛾`; embedded subset DejaVuSerif and LatinModernMath; no XeTeX Missing character. Strict missing-library and Lua-only negative cases both returned true PASS without output PDF; generated N1 authoring-state JSON confirms 6 app Session commands, source integrity/undo/save/reopen. Crucially automatic inventory did **NOT** change: old `packages-before.txt` 9130 package rows, post 9131 rows due solely to additional stderr advisory leaked by `2>&1`; diff `+security risk: running with elevated privileges` and no changes to any `|true/false` package entry.
+
+The actual QA script had inadvertently picked MiKTeX's own `pdfinfo.exe/pdftotext.exe/pdffonts.exe` before the installed Chocolatey Poppler (same basenames). They reported pages=null, empty text and font records despite valid PDFs; fail-closed behavior correctly refused PASS. Fix pins resolved audit executables to verified independent Chocolatey Poppler shim directory, checks version and hash, prepends that path only within QA subprocess environment; captures canonically valid package stdout and separate MiKTeX stderr in both before/after snapshots, rejects duplicate/invalid package lines. Unicode math expectation becomes correct `𝛼`/`𝛽` (actual U+1D6FC/U+1D6FD), not ordinary text Greek. No TeX engine changes, no suppression of real errors or relaxation of checks. Exact new SHA CI must still prove full acceptance; physical Win10/M1/M4 and egui pointer events NOT_RUN.