[schlessera]

Refs #2228

Behavior and contract

Fit canvases now enclose computed groups, painted borders and headings without moving authored nodes or dropping groups. The origin-group example retains its authored node at (0, 0) and gets a complete negative-origin viewBox. Fixed and authored narrow frames return named findings when required group or heading extents cannot fit. Client, static and flattened output, annotations, legends and native export sizing honor the same origin.

This preserves the scope and compatibility assessment recorded on #2228. Previously accepted clipped fixed/narrow inputs now fail validation, so this is an explicit pre-1.0 breaking validation/origin change shipping in a minor. The original CONTRACT: commit 42c83eb2a2d6ba77dc5fc6fe74909a7e822420f9, integration-contract component, API report and minor changeset remain intact. No schema version, new extension seam, automatic placement or provider-turn behavior changes.

The final contribution is 23 files. Its original fifteen product/contract/test files remain byte-identical to the original implementation. The remaining scope reconciles exact document declarations and adds current native origin-export proof: six declared browser callers, the literal origin fixture and flattening dependency, conservative reviewed-source refusal, closed CLI export boundaries, all-or-nothing release/origin publication, and corresponding guards. The existing release export sequence, font/pixel assertions, four private-volume roles and captured runtime remain intact. No native retention, qualification or browser-audit pin is refreshed to accept this candidate.

Delivered candidate and proof

Locally evaluated candidate: d9ede5dd8dc242b5d37152f7fb73363029d7635c, tree 3a6abc0f58e0c3b2508132b37f9dcb511b0ef411, integrated base 468618cf106c3e793cbb030f8fc90bf8d018913f. Delivered as squash af0547c2d4d197ed3766f2817cf56eb5f0486ab4, sole parent 468618cf106c3e793cbb030f8fc90bf8d018913f, with the same tree. The local receipts below retain their original identities; complete candidate and automatic merged-main proof are separately verified green as recorded below.

• Strict root bun run typecheck passes after the literal-filename correction.
• Unreduced bun run check:pr --base origin/main passes: 970 fast invariants across 48 files / 6,438 assertions and all selected local gates. Its separate automatic import-graph feedback passes 440 tests across 34 files / 406,807 assertions and one snapshot. Feedback is not a complete affected-unit or hosted-proof claim. The actual plan retains all six required proof categories; complete selected candidate and automatic-main confirmation both passed separately.
• Fresh pinned offline Chromium/WebKit baseline passes all 10 whole project/file pairs and 188 cases, including renderer, axis, callouts, scene bounds and export. Each engine has 94 cases. The real CLI produces SVG, PNG and PDF for both the existing release fixture and origin group in each preparation: 12 actual export files total. Origin SVG viewBox is -20 -24 192 120, PNG is 640×240, and PDF has exactly one page. Original release font/pixel assertions pass. The archive contains 164 artifacts, including 148 fresh captures and both producer receipts.
• Native export uses the captured Chromium executable for both preparations; Chromium/WebKit name the downstream consumers. Producer containers retain kernel network isolation, readonly private source/modules/runtime volumes and source-absence assertions. Consumer proof uses the existing scoped zero-request, WebSocket, Worker and font harness; those are distinct offline boundaries. All 13 allocating operations completed and owned cleanup verified with no problems.
• Current geometry mutation: forcing only the computed fit viewBox origin to zero makes the whole scene-bounds file fail the intended ALL_SCENE_LEFT assertion (-16.5 outside a frame starting at zero), including the exact accepted origin-group case. Actual red result: 3 passed / 4 failed / 16 assertions. Exact source bytes and mode were restored; the same whole file then passes 7 tests / 526 assertions. The other red failures are the same mutant's connector-coordinate and scope-border consequences. All tracked source is restored; no guard, assertion or case population was weakened.

The fresh native baseline deliberately starts from a separately reviewed installation inventory that excludes exactly 232 already absent generated-temp entries, while sealing every retained dependency byte and allowing only three closed generated-cache data files. The old exact temp root must remain absent before and after the run. Production source/installation/runtime identities were actually recomputed and matched. This is a new starting state, not a claim of equivalence to the earlier failed baseline or proof of which process removed that temp directory.

The existing 5,021 workspace build outputs remain hash-identical to build candidate 267d125b34f1a23ea872ce61cfae8c31f0a588d2. A source audit found no changed emitted production/build inputs for the later fixture and guard edits, so no additional build was required for this scoped proof. That receipt is still attributed to 267d125b, not relabeled as a current-head rebuild or complete build qualification.

Review corrections and retained failures

R1 source/pin preservation review found no issues. R2 design review accepted the minimal existing native-origin acceptance extension. R3 found that the existing fake producer still emitted only release files and the old result shape; its fix now supplies all six files, checks all origin hashes and proves missing-origin PDF refuses publication/browser entry and drains owned resources. R4 source review found no further issue; the subsequent strict-types run exposed widened filename literals. The two-item array now uses as const without changing runtime scenarios. R5 independently reviewed the complete final source and literal correction with no findings. The same-class source audits and all original product/pin owners were preserved.

Earlier failed receipts stay failed. Hosted run 39074479367 failed document-binding controls and the independently owned native self-test; cancelled jobs do not supply complete proof. Older SIGKILL, storage/setup, assertion and diagnostic failures retain their original identities. The first launcher qualification stopped at installation admission. An earlier native baseline passed 188 browser cases but failed its post-run installation seal, so it is not an overall qualified positive; the unobserved cache-remover/input-history gap is not waived. The fresh baseline above is distinct. Original geometry/painter/document mutation receipts at earlier candidates, including 6e721192b against 7f22bb6ac, remain historical proof rather than current-head reruns.

Dependency and verified delivery

#2365 is delivered by merged #2374, squash 90a95123cfceb169bd2ecf7c213544db742eaed7, already an ancestor of this integrated base. Its frozen native positive owner remains unchanged. The old text claiming that prerequisite is still open is superseded by this delivery; no native fingerprint waiver is involved. Delivered viewer/callout/raw-Git fixture work remains preserved.

This PR is merged with Refs #2228. Candidate 39447316605, attempt 1 passed all 17 jobs at actual checkout 479c4cfc6454f038d80c05a6babeb63e90483994, parents [468618cf106c3e793cbb030f8fc90bf8d018913f, d9ede5dd8dc242b5d37152f7fb73363029d7635c], tree 3a6abc0f58e0c3b2508132b37f9dcb511b0ef411. Separate automatic-main 39450879405, attempt 1 passed all 17 jobs and aggregate 118735338742 at merged squash af0547c2d4d197ed3766f2817cf56eb5f0486ab4, sole parent 468618cf106c3e793cbb030f8fc90bf8d018913f, same tree. Both audits verify all 17 job checkouts, 13 resource-artifact pairs and 14 artifact digests. Each has 1,132 unit files, 14,941 passes and 28 justified skips; main also verifies 14 complementary real-vector passes, 252 diagram cases, 444 overlay cases and selected native/identity controls. These do not relabel local feedback, old failures or the earlier pending snapshots.

On 2026-10-20 the coordinator accepted all five original #2228 criteria against the current behavioral/mutation/native evidence and complete candidate/main proof. PR and issue milestones read back as 0.44.0. Tracker completion is recorded on #2228; no closing keyword is added here. #1903 remains open for missing hosted native-origin SVG/PNG/PDF and producer receipts and its other remaining retention classes. The four actual retained hosted origin-layout PNGs, passing product cases and local native archive are distinct evidence; no complete hosted-artifact claim or added #2228 byte-retention criterion is made.

• Contract component, API report and minor changeset included.
• Source reviews, strict types, ordinary local preflight and current scoped native/browser proof recorded with their actual identities.
• Named geometry mutation failed as intended and exact restoration passed.
• Provider-facing history is unchanged.
• Published the reviewed candidate and obtained complete selected hosted confirmation.
• Verified the merged squash, automatic-main proof, milestone readbacks and all five acceptance criteria; tracker completion is recorded on modules: fit diagram canvases exclude group bounds at the origin #2228.