[schlessera]

Closes #1599

What changed

verifyDesignFonts now forces layout of its freshly inserted probe host before the first designFontUsage CDP query. CSS.getPlatformFontsForNode reads existing layout and does not force it. Probes queried before Chromium laid them out reported zero painted glyphs, so the post-restore positive check in both design-font negative cases failed intermittently with nonempty DM Serif Text painted glyphs: expected 0 to be greater than 0.

Why this shape

The acceptance criteria ask for the observed readiness boundary, not a delay, retry or relaxed assertion. The 2026-10-17 same-node control showed that one rendering frame turns [[],[]] into the locked faces with 22–23 glyphs. A synchronous layout read (host.getBoundingClientRect()) is the smallest barrier that guarantees layout objects exist before the query. It changes no face, identity, glyph assertion or baseline.

Proof

Tested head 7602b85eea6623a31a040f7bbc633d32cac38659 on base 8b5b1fdc706fcaf4734b8a811acdc8e53f33d890. The proof runs below were made at 2eb68d242, the same change on base af0547c2d, before rebases over e2deae1f3, e1370575 (#2463) b7f6360a8 (#2467) and 8b5b1fdc7 (#2470), which touch no ui-kit, visual runner or lockfile input. Pinned mcr.microsoft.com/playwright:v1.63.0-noble (sha256:eff16c30…), one fresh container per invocation, serial, idle 32-CPU host.

Arm	Command	Runs	Failed
Unchanged source (468618cf1; font inputs byte-identical to this base)	node scripts/visual.mjs --project=visual --filter=design-fonts.visual	60 (+24 earlier)	8 (+2): original assertion every time
This change	same	60	0
This change, complete project	node scripts/visual.mjs --project=visual	20	design-fonts 20/20; one run failed elsewhere: #2461

Fisher's exact test for 8/60 against 0/60 gives p ≈ 0.003.

Mutation receipts, each restored and rerun green:

• Identity check removed (painted.every(...) predicate replaced with true in requirePaintedFont). The alias case fails with promise resolved … instead of rejecting, and so does the absent-CSS case. Restored: 3/3 pass.
• CSS disable skipped (style.media = "not all" commented out). The absent-CSS case fails with promise resolved … instead of rejecting. Restored: 3/3 pass.

bun run check:pr --base origin/main   # passed at 7602b85eea6623a31a040f7bbc633d32cac38659; previously a7954d0e6086860edf1f2531061c73ce5582bcbd; 235 pass / 0 fail

check:pr ran inside a user-namespace bwrap that binds every top-level directory except /mnt. This host carries leaked Docker Desktop bind mounts, and that environment brings its sandbox setup probe under the 250 ms guard (see testing.md's remediation and #2370).

Producer pin refresh (second commit). The first CI run failed unit (1) in tests/bound-browser-documents.test.ts (8 cases: REVIEWED_*_DOCUMENT_BINDS, STALE_PIN_NAMED). Three reviewed document declarations in scripts/bound-browser-documents.ts (ghostTrace, diagramCapture, diagramRasterComparison) pin design-font-checks.ts by SHA-256. Local check:pr's import-graph feedback missed this: the test reads the file from disk, a documented blind spot. The pins now record the new hash, with a #1599 re-audit note on each declaration: the only change is a synchronous layout read, with no sink, call, argument or producer change. bound-browser-documents.test.ts passes 15/0 locally.

Local bun run test ./tests on this branch: 1731 pass / 4 fail. The 4 failures are tests/native-diagram-inputs.test.ts (a frozen-source hash), and they fail identically on a control checkout without this change. They are local-environment-only and passed in hosted unit shards.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. (Local done; hosted proof pending.)
• Acceptance criteria from the issue are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed.

Anything left open

• One of the 20 complete-project runs (the first after a fresh build) failed 17 ghost-sweep.visual.tsx cases with Cannot read properties of null (reading 'useState'). Vite re-optimized the Storybook dependencies mid-run. That is unrelated to this change and filed as ui-kit: cold visual run re-optimizes Storybook dependencies mid-run and breaks ghost-sweep's React #2461. The design-font file passed in that run too.
• Hosted proof is pending.

🤖 Generated with Claude Code