Epic: SVG text rendering on the engine of record

[softmarshmallow]

This issue is the durable epic tracker for SVG text on the engine of record (websem → textlayout → glyph outlines → rframe → n0). It answers where the text arc stands. Detailed execution notes live in a gitignored local plan and are deliberately not linked here.

The governing records are the text-oracle method, the taken-low text join, the admitted CLI slice, the dedicated text fixture suite, and the Web checklist.

Current position — 2026-08-31

The foundation is complete:

• text-0 — gate method: deterministic Ahem pixel gate, real-font geometry rung named, admitted numeric domain, hermetic font environment, and corpus-growth law (#68).
• text-1a — Web text oracle v0: one printable-ASCII, horizontal LTR style run in one exact declared outline face; no fallback or synthesis (#70).
• text-1b — SVG <text> proving slice: x, y, direct text-anchor, cascaded font-family/font-size, SVG whitespace collapse, outline lowering, stable refusals, and six byte-exact Chromium Ahem cells (#71).
• text-1c — host font environment: repeatable --font FAMILY=PATH@sha256:HEX, with the exact bytes verified before a frame exists (#72).
• text-2 — consolidation decision: shaped text joins low. Each engine keeps its private artifact, registry, and glyph replay policy; no font or glyph resource enters rframe (#73).

The project currently has 1,051 primitive Chromium cells plus 16 sampled frames, a separate six-cell text suite, and 197 named refusal rows. The existing text slice is real but narrow. The <text> row and the broad SVG/CSS font, text, baseline, writing-mode, spacing, decoration, <tspan>, <textPath>, and textLength rows remain open.

Basic font resolution is not the immediate blocker: a host can already provide exact font bytes and the Web producer can shape one declared face. What is missing is browser-grade policy and evidence—family matching, fallback, real-font geometry grading, multiple runs, broader shaping, bidi, positioning, and advanced paint.

Epic ladder

• T1 — safety fence (selected): audit every authored font-size basis before shaping (#82), then verify that the deterministic Ahem numeric domain is enforced after transforms, viewBox, and <use>, not only in local coordinates.
• T2 — real-font geometry oracle: exercise the ratified rung B with one hash-pinned real outline face and one LTR run. Grade glyph geometry, advances, extents, anchor placement, and source mapping through Chromium measurement APIs. Make no Chromium pixel-fidelity claim.
• T3 — single-run shaping breadth: add honestly graded glyph offsets, clusters, kerning/ligatures, combining marks, and selected non-ASCII repertoire, advancing the oracle version whenever geometry meaning changes.
• T4 — <tspan> and multi-run text: one resolution across styled source ranges, inherited values, whitespace continuity, text chunks, and paint ownership. Do not reshape each child independently.
• T5 — declared face selection and fallback: ordered family requests, exact face/style/variation selection, explicit generic mappings, and cluster-safe fallback over host-declared resources only. No ambient system fallback.
• T6 — positioning and flow axes: measured splits for x/y/dx/dy/rotate lists, anchor chunks, spacing, baselines, bidi, direction, and writing mode.
• T7 — text paint and decoration: glyph stroke, paint servers, context paint, opacity/effect ordering, and layout-owned decorations.
• T8 — textLength / lengthAdjust: spacing or glyph scaling inside the one resolved artifact, never a post-layout width patch.
• T9 — <textPath>: path-distance placement, startOffset, method/spacing, path metrics, transforms, references, and path animation.
• T10 — dynamics and external resources: exact-time changes only after static meaning; external fonts and resources only through the shared future resource-I/O contract.

The order is dependency-first. A milestone may split into several PRs, and a safety/evidence PR may close zero checklist rows.

Selected next: T1

The first pass is #82. Probe presentation attributes, inline style, stylesheets, and inherited ancestors across exact px controls, viewport/container/font-metric units, em/rem, percentages, CSS math, var(), escapes, comments, CSS-wide values, shorthand interaction, and malformed fallback. Every candidate renders through Chromium and both n0 admissions with discriminating glyph metrics.

In the same checkpoint, measure the final-device numeric-domain promise under integer/fractional translation, scale, rotation/skew, root viewBox, nested transforms, and <use>. This is an audit, not a presumed defect.

Any silent divergence is repaired or converted to a stable text-specific refusal before T2 or <tspan> work begins. T1 is expected to improve safety, not tick the broad font-size or <text> rows.

Laws for every text rung

• Exact font identity is an input; a family or file name alone is not identity.
• No system-font discovery, silent fallback, tofu, ignored shaping, or guessed width.
• Text resolves once. Geometry-sensitive consumers project from that result.
• The Web text join remains low; reopening D-M is a registered owner decision, not an implementation convenience.
• Ahem cells grade exact pixels. Real-font rung B grades geometry and makes no pixel claim. Thresholded raster remains parked with FLIP.
• Unsupported behavior refuses by a stable name in strict and best-effort before nearby behavior ships.
• Attribute and CSS property spellings remain separate checklist rows.
• External I/O belongs to one host resource contract; text grows no private loader.
• Every cell or geometry witness must discriminate the branch it claims, and gate sensitivity must be proved by deliberate perturbation.
• No conformance score is produced or inspected; FLIP remains untouched.

Deliberate boundaries

The native n0 SkParagraph path and the Web SVG producer remain separate by the taken-low join. The Phase-5 production-oracle choice D-H is still open and is not pulled forward by this epic. HTML paragraph/page layout, editor text editing, external resource loading, and perceptual raster scoring are separate programs.

Every merged text PR updates this epic and posts the resulting consolidation position on #43.

[softmarshmallow]

text-0 position update: the text-1 crux is retired ahead of ratification. A scratch spike (per the growth law — never committed) shaped three Ahem runs with rustybuzz 0.20.1, lowered them as outline path facts, and rendered through n0::glyphless on the reftest gate's posture: byte-identical to the Chromium round-2 captures in all three cases (em-box, space advance, middle anchor), deterministic across double renders. The engine-side half of the coincidence argument is now measured, recorded in the brief on #68 (51519fd8). The integration map for text-1 is done (websem admission point, cell-gate wiring, glyphless path route, shaping recipe, workspace/lock mechanics — all grounded to file:line); with the crux held, everything left in text-1 is execution once #68 ratifies.

[softmarshmallow]

text-0 is ratified and merged (#68, rebased onto main as da15b93c..e4f8b3bd). The gate ladder, admitted numeric domain, bake posture, hermetic font environment, corpus-growth law, outlines-first lowering, and the resolver crate now bind the arc's rungs.

text-1 is underway and split, because the resolver is a reviewable unit on its own:

• text-1a — the resolver (#70, open): crates/textlayout at oracle v0. The second real text producer exists in the tree, artifact and all — which is what D-M has been gated on. Adversarially verified; the must-fixes it surfaced (the profile being enforced by Ahem's coverage rather than by the resolver; dropped vertical/negative advances; color faces resolving to placeholder outlines; unprovenanced outline queries) are folded in.
• text-1b — the websem <text> arm (next): consumes the artifact, lowers outlines to path facts, bakes Ahem cells in fixtures/web-first/text/, graduates svg-text from the refusal corpus.

One design item to settle in 1b, surfaced by the integration map: text-anchor and font-family are SVG presentation attributes, and csscascade's admitted hint set stops at fill/stroke/font-size/display/visibility/opacity. So 1b must either extend the presentation-hint admission (the Chromium-correct path, since author CSS can target both) or read them as raw attributes with an explicit refusal when CSS also targets the element. Doing neither makes them silently invisible — the exact failure the first law exists to prevent.

[softmarshmallow]

T1 — the SVG text safety fence — landed in #120 at 534ac3cb.

It closes authored font-size provenance, final-device mapping, inherited text-anchor, and unconsumed text-CSS leaks before the text profile grows. The gate now has 1,051 primitive cells plus 16 sampled frames, a separate nine-cell exact Ahem suite, and 206 named refusal rows. No broad text/font checklist row moved.

The next active rung is T2: one exact declared real outline font, one LTR run, and Chromium-graded artifact geometry before outline rasterization. It does not depend on ambient font discovery, does not claim Chromium-identical real-font pixels, and does not add text facts to rframe.

[softmarshmallow]

T2 position (2026-09-01 KST): #121 merged as 37ab4f3f.

Verdict: EXERCISED; no checklist row closed. The real-font Rung B gate now carries one immutable exact-number Chromium geometry witness for Allerta Hxi at 5120px. Before outline lowering, websem admits only integral ascent/descent and 1/64-grid glyph starts/ends; other artifacts refuse by stable Chromium SVG text query name in strict and best-effort paths. Independent Allerta and Bungee negative legs guard the vertical and horizontal rules. This makes no real-font Chromium pixel-fidelity claim.

Current estate: 1,051 Chromium-baked primitive cells plus 16 sampled frames; 9 byte-exact Ahem text cells; 1 exact Allerta geometry witness; 207 named refusals. All CI and review threads were green/resolved before merge.

Next: T3, single-run shaping breadth. First make cluster cardinality and source mapping explicit; only then select discriminating ligature, kerning, mark-offset, and repertoire witnesses. The sampled Allerta fi/AV controls did not establish a second divergence class and do not pre-admit that breadth.

[softmarshmallow]

Text T3a landed in #122 with an ADMIT / SPLIT verdict.

• Admitted: oracle v1 now carries explicit UTF-8, UTF-16, and glyph ranges for direct one-source-scalar / one-glyph clusters. The Allerta ff witness admits the browser's default pair positioning at exact advances 2330 + 2355 = 4685.
• Split: merged or decomposed clusters remain outside the admitted profile and refuse by stable UnsupportedClusterMapping name. The committed PT Serif fi witness proves that boundary: strict refuses; best effort skips the text node and records a degradation.
• Evidence ownership is explicit: Chromium supplies source-character geometry, the pinned font supplies cmap/glyph/outline facts, and the resolved artifact supplies cluster ranges.
• Sensitivity was demonstrated before trust: disabling default kerning broke the exact geometry gate (4710 vs 4685), and bypassing the cluster guards made the focused refusal contract fail.

Current corpus: 1,051 Chromium-baked primitive cells + 16 sampled frames, 9 byte-exact Ahem text cells, 2 exact Allerta geometry witnesses, and 208 named refusals.

No checklist row closed. This makes no real-font Chromium pixel claim, adds no rframe text fact, and leaves the low D-M join intact.

Next T3 split: a bounded precomposed Latin-extension repertoire in one declared face. Its witness must make UTF-8 byte ranges and UTF-16 indices numerically differ while preserving a direct one-scalar / one-glyph mapping. Combining sequences, nonzero offsets, ligature caret ownership, broader scripts, and bidi stay separate.

[softmarshmallow]

T3b landed in #123 (4b8a9baa): the oracle advances to textlayout-v2 and admits the exact 53 targeted precomposed Latin-1 letters.

The rung also fixed the latent UTF-8-byte/scalar confusion at the websem geometry seam, guarded it with a Chromium-baked 55-scalar Allerta witness, and kept decomposed combining sequences behind the existing stable refusal boundary. Text evidence is now 9 Ahem cases + 3 Allerta geometry cases; the named refusal register is 209 rows.

No checklist row closed. Next: T3c, combining marks and non-zero cluster offsets.

[softmarshmallow]

Text epic position after #124 (b4a85873): T3c landed on oracle v3. One-face SVG text now carries U+0301/U+030B as a single bounded mark after an ASCII Latin base, without source normalization, while preserving scalar ranges and nonzero glyph offsets. Malformed, missing-glyph, and unlisted-mark branches still refuse by stable name.

The rung adds three exact geometry witnesses (suite 3 -> 6) and moves the refusal register 209 -> 211. It also repaired a systemic bounds defect: stored font boxes can include off-curve controls, so artifact ink bounds now solve the extrema of the same quadratic/cubic outline stream consumers paint. Primitive and Ahem corpora remain unchanged at 1,051 + 16 frames and 9 exact cells.

T3 is still a split ladder; wider ligatures, scripts, fallback, and bidi remain separate. The selected next high-ROI checkpoint is T4a: one same-face, paint-only, no-position-reset <tspan> multi-run artifact. No broad text/checklist row ticked, and rframe, FLIP, and scoring remain untouched.

[softmarshmallow]

T4a landed in #125 (2b3d559a).

• Flat direct <tspan> children may now partition one SVG text source into opaque-solid paint runs. Whitespace collapse, shaping, and text-anchor remain one continuum; merged clusters take the paint tag of their first source scalar.
• The committed evidence includes one exact Ahem paint cell and a seventh real-font geometry witness. Allerta ff remains one shaped pair across the paint boundary: 2330/2355, total 4685; independently shaping the runs would total 4710.
• Position resets/lists, shaping-style changes, wider paint/effects, and nested text content remain focused strict/best-effort refusals. The <text> and <tspan> checklist rows remain open, and rframe remains glyphless.
• Estate: 1,051 primitive Chromium cells plus 16 sampled frames; 10 exact Ahem text cells; 7 Allerta/Bungee geometry witnesses; 214 named refusal rows.

Next is T4b: same-face horizontal positioned chunks, beginning with <tspan> x/y resets and dx/dy lists. It must preserve one resolved artifact and measured shaping continuity while assigning the correct chunk-level anchor scopes.

[softmarshmallow]

T4b landed in #126 (af67ab20). T4 is now split with T4a paint-only source runs and T4b bounded positioned chunks landed. The v4 oracle independently shapes absolute x/y chunks; websem applies x/y/dx/dy, per-chunk anchoring, and combining-scalar carry. Evidence is one exact Ahem pixel cell plus one exact-number Allerta geometry witness; three focused refusals retain wider value/index/combining boundaries. Current text estate: 11 Ahem cells, 8 real-font geometry witnesses, 217 total named refusals. Broad <text>/<tspan> and positioning rows remain open. Next: T5a exact declared-family-list selection among host-provided font identities, before fallback, synthesis, or external resources.

[softmarshmallow]

T5a landed in #127 at 73083a4.

textlayout-v5 and websem now carry ordered declared font-family lists end to end. Request order beats environment order; unavailable named families fall through; named generic spellings remain distinct from generic policy; matching follows the measured BMP simple-fold boundary. Ambiguous same-name faces, reached generics, and missing-glyph non-fallback are typed, registered refusals.

Added 1 exact Chromium text cell and 3 refusal rows. Text evidence is now 12 exact pixel cells + 8 exact geometry cells; the global refusal register is 220. This was an ADMIT/SPLIT rung with no checklist ticks.

Next: T5b exact face-descriptor selection for font-weight, font-style, and font-stretch, without adding ambient font discovery.

[softmarshmallow]

T5b landed in #128 at 10f94f4c: exact static SVG text face descriptors, ADMIT/SPLIT, no checklist rows ticked.

• Oracle v6 carries a complete typed (weight, stretch, style) request/resource tuple and selects exactly one equal face inside the first reached named family; a miss or tie is typed and terminal.
• Presentation attributes, inline CSS, author rules, inheritance, aliases, and relative weight go through one Stylo cascade. No descriptor fact enters rframe.
• The new sixteen-branch Chromium cell is exact through the actual strict CLI. Deliberately mapping italic to normal made the full gate fail at that cell before restoration.
• Four stable rows retain fractional weight, oblique angle, Blink/Stylo stretch source precision, and no-exact-face behavior. The register is now 224; text is 13 exact pixel cells plus 8 exact geometry witnesses.

Next preferred rung: T5c, treating nearest static matching and synthetic weight/posture as one coupled policy. Start from the measured stretch → style → weight order and explicit synthesis controls; keep variable axes, generic mapping, glyph fallback, ambient discovery, and external resource I/O out.

[softmarshmallow]

T6 landed in #130 (6031a9c6): cluster-safe missing-glyph fallback across the ordered declared-family list.

textlayout-v8 keeps the first available face for vertical metrics, chooses outlines per complete shaping cluster, repeats static nearest-face matching in each reached named family, and records exact face runs without widening rframe. One new exact Chromium cell graduates the declared-family fallback refusal; exhaustion, reached generic, required synthesis, and real-font query-grid boundaries remain named. Current estate: 15 exact text cells, 8 text-geometry witnesses, 223 refusal rows; no checklist row closed.

All hosted CI and review gates passed. Per the execution plan, the text lane pauses after T6 while the overall SVG rendering estate is reviewed. T7 explicit host-supplied generic-family mapping remains the parked text re-entry checkpoint, not the selected next project task. T5d synthesis remains separate and refused.