[i-shutov]

D08 · terminal setup provenance on the existing real MiKTeX/N1 pipeline

#40 and #52 are already merged; this follow-up is restricted to D QA scripts/tests/plans/insights. Source base 6d15d86344ab1281391d3ea1b458dc18ae443985, branch exact HEAD a039b2cd63ad859589a04230c9c8032af9859fe2. Do not edit A/B/C production files or install anything on user machines.

Independently audited merged-main reference

Actual Windows Server 2022 MiKTeX run 41203529698 SUCCESS on exact push-main 6d15d86344ab1281391d3ea1b458dc18ae443985, artifact 13044230534 ZIP SHA-256 0c6f7a1af3871ab7078d104272c6a1fe221f1bb095747f5468abd58776430eb1, 44 files. Re-extracted six real PDFs, independently checked Cyrillic/Greek via pdftotext, font embedding via pdffonts, 1 page each, source/PDF hashes, two strict negative log errors with no PDF, unchanged 9130/9130 MiKTeX packages, actual N1 app Session-generated sources and CLI/direct XeLaTeX. Real MiKTeX 25.12, external xelatex, private roots and AutoInstall=0. This is not Windows 10/M1/M4 physical acceptance.

New fail-closed gap fixed

Previously setup-stage.json was still INCOMPLETE after successful setup.json. Now the setup script publishes a distinct terminal SETUP_COMPLETE after setup.json, verifies all nine declared package installation flags after provisioning, and the existing real QA runner must verify stage/schema/installer hash/XeLaTeX identity/AutoInstall readback before rendering any PDFs. Adds negative Python regressions; all original PDF/font/source/negative/unchanged-inventory gates retained. D-specific plan and insight include raw artifact provenance and caveats.

Exact D08 HEAD CI and archived proof: PENDING. Draft until the real hosted MiKTeX job and its new artifact actually pass. Physical Windows 10/macOS M1/M4 and egui pointer/help/theme acceptance remain NOT_RUN; no TeX Live substitution.

D08 live exact-head MiKTeX proof (2026-10-31)

Real hosted Windows Server 2022 MiKTeX workflow 41206302540 SUCCESS on D08 branch HEAD a039b2cd63ad859589a04230c9c8032af9859fe2. I downloaded/unpacked artifact 13044349689 (44 files, ZIP SHA-256 4d4218af19933e53935bb6098141846ae02166c857ad8eba0a8d1db541c6126f). Report source_head_sha=a039b2cd63ad859589a04230c9c8032af9859fe2; separate commit_sha=0aaf2cc90680a518fbb2603586351656faa8cba1 is GitHub's PR synthetic merge checkout, not another source revision. Verified actual terminal setup-stage.json: stage=setup-complete, status=SETUP_COMPLETE, installer hash, engine path, and AutoInstall=0 match setup.json. All nine official package IDs now have post-provision isInstalled=true; compile-time inventory 9130/9130 byte-identical. All four real cases PASS, including merged N1 app Session-generated source compiled via Rust CLI and direct MiKTeX XeLaTeX; strict library/Lua-only negative failures and no PDFs. Independently checked all six one-page PDFs with pdfinfo/pdftotext -enc UTF-8/pdffonts: correct Cyrillic/Unicode mathematical italic Greek, embedded DejaVuSerif/LatinModernMath, all six PDF SHA and both N1 source SHA match actual files. No physical Win10/M1/M4, mouse, help or GUI theme claims.

Remaining at this edit: Rust CI 41206302596 and D QA matrix 41206302734 have queued/in-progress jobs; font workflow 41206302582 SUCCESS. Keep this PR Draft until the complete exact-SHA matrix is final; do not inherit checks from baseline main.