v1.52.2.0 fix(make-pdf): render emoji instead of tofu (▯) on Linux (#1787)

* fix(make-pdf): emoji font fallback in print CSS

Emoji code points rendered as .notdef tofu (▯) because the body and
@top-center font stacks had no emoji family for Chromium to fall back to.
Add SANS_STACK / CJK_STACK / EMOJI_FAMILIES constants (one source of truth
per family list) and append the emoji families before the generic
sans-serif in the two stacks that can hold emoji. The @bottom-* boxes hold
counters / a fixed CONFIDENTIAL string, so they share SANS_STACK without
emoji. Non-emoji output is byte-identical.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(setup): auto-install color-emoji font on Linux

macOS and Windows ship a color-emoji font; most Linux distros/containers
ship none, so make-pdf emits tofu there. ensure_emoji_font() best-effort
installs fonts-noto-color-emoji (apt, with dnf/pacman/apk fallbacks) and
refreshes the fontconfig cache. Hardened: Linux-only guard, GSTACK_SKIP_FONTS
escape hatch, fc-match color=True detection (the broad fc-list query
false-matched LastResort), sudo -n so a password prompt fails fast instead
of hanging, DEBIAN_FRONTEND=noninteractive, timeout 30 on apt update, and
fc-cache under sudo. Warns instead of failing. After a fresh install,
refresh_browse_daemon_for_fonts() runs 'browse stop' so the next render
spawns a Chromium that sees the new font (font fallback is process-cached).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(make-pdf): emoji render gate (pdffonts + pixel proof)

pdftotext is a false oracle for emoji: Skia preserves the Unicode in the
text cluster even when the glyph drew as .notdef tofu, so extraction passes
on a broken render. The gate instead asserts (1) pdffonts shows an emoji
family embedded and (2) pdftoppm rasterizes the page to color (measured
~1650 saturated pixels vs ~0 for tofu). pdfimages is not used: macOS embeds
color emoji as Type 3 fonts, so it lists nothing even on a correct render.
Adds resolvePopplerTool() (DRY resolver, returns null for clean skips) and
a fixture exercising FE0F variation-selector emoji. Skips cleanly when
poppler tools or a color-emoji font are unavailable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(make-pdf): install emoji font + run emoji gate on Ubuntu

Install fonts-noto-color-emoji before Chromium launches on the Ubuntu leg
(macOS already ships Apple Color Emoji), refresh fontconfig, and log the
fc-match result. Run the whole make-pdf/test/e2e/ dir so the emoji gate runs
alongside the combined-features copy-paste gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* harden(make-pdf): emoji gate + font install per adversarial review

Codex adversarial pass on the implementation diff flagged five robustness
gaps, all fixed here:
- emoji-gate skipped green in CI when poppler/font prerequisites were absent,
  which could let the tofu regression ship behind a green build. Missing
  prerequisites are now a HARD FAILURE when process.env.CI is set; local dev
  still skips cleanly.
- execFileSync children (make-pdf, pdffonts, pdftoppm, fc-match) had no
  timeout; a wedged binary or hostile GSTACK_*_BIN override could hang the
  job past Bun's test timeout. Each child now has a 25s ceiling.
- PPM parser trusted header tokens blindly; malformed/variant output gave a
  silently-wrong count. Now validates magic/dimensions/maxval and pixel-buffer
  length, handles header comments, throws a hard diagnostic on mismatch.
- predictable /tmp paths were collision/symlink-prone; now mkdtempSync under
  /tmp (kept under /tmp for browse's validateOutputPath allowlist).
- only apt-get update was timeout-wrapped; dnf/pacman/apk installs and apt
  install can hang on locks/mirrors. All package installs now timeout-bound.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: bump version and changelog (v1.52.2.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(make-pdf): document color-emoji font requirement + GSTACK_SKIP_FONTS

Extend the Linux font note to cover the color-emoji font that make-pdf
emoji rendering needs: setup auto-installs fonts-noto-color-emoji, the
print CSS falls back through Apple/Segoe/Noto emoji families, and
GSTACK_SKIP_FONTS=1 opts out. Edit the .tmpl and regenerate SKILL.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

make-pdf/SKILL.md

@@ -542,6 +542,13 @@ On Linux, install `fonts-liberation` for correct rendering — Helvetica and Ari
 aren't present by default, and Liberation Sans is the standard metric-compatible
 fallback. CI and Docker builds install it automatically via Dockerfile.ci.
 
+Emoji need a color-emoji font. macOS (Apple Color Emoji) and Windows (Segoe UI
+Emoji) ship one; most Linux distros and containers ship none, so emoji render as
+empty boxes (▯). `./setup` auto-installs `fonts-noto-color-emoji` on Linux
+(apt/dnf/pacman/apk, best-effort) and the print CSS falls back through Apple /
+Segoe / Noto emoji families. Set `GSTACK_SKIP_FONTS=1` to skip the install (CI
+without sudo, managed or offline machines).
+
 ## Core patterns
 
 ### 80% case — memo/letter

make-pdf/SKILL.md.tmpl

@@ -41,6 +41,13 @@ On Linux, install `fonts-liberation` for correct rendering — Helvetica and Ari
 aren't present by default, and Liberation Sans is the standard metric-compatible
 fallback. CI and Docker builds install it automatically via Dockerfile.ci.
 
+Emoji need a color-emoji font. macOS (Apple Color Emoji) and Windows (Segoe UI
+Emoji) ship one; most Linux distros and containers ship none, so emoji render as
+empty boxes (▯). `./setup` auto-installs `fonts-noto-color-emoji` on Linux
+(apt/dnf/pacman/apk, best-effort) and the print CSS falls back through Apple /
+Segoe / Noto emoji families. Set `GSTACK_SKIP_FONTS=1` to skip the install (CI
+without sudo, managed or offline machines).
+
 ## Core patterns
 
 ### 80% case — memo/letter

make-pdf/src/pdftotext.ts

@@ -114,6 +114,34 @@ export function resolvePdftotext(env: NodeJS.ProcessEnv = process.env): Pdftotex
   ].join("\n"));
 }
 
+/**
+ * Locate a poppler companion tool (pdffonts, pdfimages, pdftoppm) used by the
+ * emoji render gate. Mirrors resolvePdftotext's resolution order:
+ *   1. $GSTACK_<TOOL>_BIN env override (e.g. GSTACK_PDFFONTS_BIN)
+ *   2. PATH via Bun.which
+ *   3. standard POSIX locations (Homebrew + distro)
+ *
+ * Returns null (does NOT throw) when the tool is missing — the emoji gate skips
+ * cleanly rather than failing on a box without full poppler-utils.
+ */
+export function resolvePopplerTool(
+  tool: "pdffonts" | "pdfimages" | "pdftoppm",
+  env: NodeJS.ProcessEnv = process.env,
+): string | null {
+  const override = resolveOverride(env[`GSTACK_${tool.toUpperCase()}_BIN`], env);
+  if (override) return override;
+
+  const PATH = env.PATH ?? env.Path ?? "";
+  const onPath = Bun.which(tool, { PATH });
+  if (onPath) return onPath;
+
+  for (const dir of ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin"]) {
+    const candidate = findExecutable(path.join(dir, tool));
+    if (candidate) return candidate;
+  }
+  return null;
+}
+
 function isExecutable(p: string): boolean {
   try {
     fs.accessSync(p, fs.constants.X_OK);

make-pdf/src/print-css.ts

@@ -20,8 +20,26 @@
  *   - No <link>, no external CSS/fonts — everything inlined.
  *   - CJK fallback: Helvetica, Liberation Sans, Arial, Hiragino Kaku Gothic
  *     ProN, Noto Sans CJK JP, Microsoft YaHei, sans-serif.
+ *   - Emoji fallback: the body and @top-center running-header stacks end in an
+ *     emoji family group ("Apple Color Emoji", "Segoe UI Emoji", "Noto Color
+ *     Emoji"), placed BEFORE the generic `sans-serif` so Chromium has a glyph
+ *     source for emoji code points instead of emitting .notdef tofu (▯). The
+ *     @bottom-* margin boxes hold only counters / a fixed "CONFIDENTIAL"
+ *     string, so they get no emoji families. On Linux this requires an
+ *     installed color-emoji font — `setup` installs fonts-noto-color-emoji.
+ *
+ * Font stacks are composed from the constants below so each family list has a
+ * single source of truth (DRY) and every stack stays in sync.
  */
 
+// Metric-compatible sans stack: Helvetica (macOS), Liberation Sans (Linux,
+// ships via fonts-liberation), Arial (Windows). Shared by every text surface.
+const SANS_STACK = `Helvetica, "Liberation Sans", Arial`;
+// CJK fallback families, appended to the body stack only.
+const CJK_STACK = `"Hiragino Kaku Gothic ProN", "Noto Sans CJK JP", "Microsoft YaHei"`;
+// Color-emoji families: Apple (macOS), Segoe (Windows), Noto (Linux).
+const EMOJI_FAMILIES = `"Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji"`;
+
 export interface PrintCssOptions {
   // Document structure
   cover?: boolean;
@@ -84,13 +102,13 @@ function pageRules(size: string, margin: string, opts: PrintCssOptions): string
     `  size: ${size};`,
     `  margin: ${margin};`,
     runningHeader
-      ? `  @top-center { content: "${runningHeader}"; font-family: Helvetica, "Liberation Sans", Arial, sans-serif; font-size: 9pt; color: #666; }`
+      ? `  @top-center { content: "${runningHeader}"; font-family: ${SANS_STACK}, ${EMOJI_FAMILIES}, sans-serif; font-size: 9pt; color: #666; }`
       : ``,
     showPageNumbers
-      ? `  @bottom-center { content: counter(page) " of " counter(pages); font-family: Helvetica, "Liberation Sans", Arial, sans-serif; font-size: 9pt; color: #666; }`
+      ? `  @bottom-center { content: counter(page) " of " counter(pages); font-family: ${SANS_STACK}, sans-serif; font-size: 9pt; color: #666; }`
       : ``,
     showConfidential
-      ? `  @bottom-right { content: "CONFIDENTIAL"; font-family: Helvetica, "Liberation Sans", Arial, sans-serif; font-size: 8pt; color: #aaa; letter-spacing: 0.05em; }`
+      ? `  @bottom-right { content: "CONFIDENTIAL"; font-family: ${SANS_STACK}, sans-serif; font-size: 8pt; color: #aaa; letter-spacing: 0.05em; }`
       : ``,
     `}`,
     ``,
@@ -107,7 +125,7 @@ function rootTypography(): string {
   return [
     `html { lang: en; }`,
     `body {`,
-    `  font-family: Helvetica, "Liberation Sans", Arial, "Hiragino Kaku Gothic ProN", "Noto Sans CJK JP", "Microsoft YaHei", sans-serif;`,
+    `  font-family: ${SANS_STACK}, ${CJK_STACK}, ${EMOJI_FAMILIES}, sans-serif;`,
     `  font-size: 11pt;`,
     `  line-height: 1.5;`,
     `  color: #111;`,

make-pdf/test/e2e/emoji-gate.test.ts

@@ -0,0 +1,197 @@
+/**
+ * Emoji render gate — proves emoji code points render as real color glyphs in
+ * the output PDF instead of .notdef tofu boxes (▯). This is the regression gate
+ * for fix/make-pdf-emoji-tofu.
+ *
+ * Why not just check pdftotext? Because text extraction is a FALSE oracle for
+ * emoji: Skia preserves the Unicode in the text cluster even when the displayed
+ * glyph is .notdef, so pdftotext can report the emoji survived on a render that
+ * actually drew tofu. Verified empirically on macOS — pdftotext extracts 😀
+ * regardless of whether a color font was available.
+ *
+ * Two assertions that DO distinguish a real render from tofu:
+ *   1. pdffonts shows an emoji family embedded in the PDF (the cascade selected
+ *      a real emoji font — AppleColorEmoji as Type 3 on macOS, NotoColorEmoji
+ *      on Linux). Missing-fallback => no emoji font embedded.
+ *   2. pdftoppm rasterizes the page and we count saturated (colored) pixels.
+ *      A color-emoji render has hundreds (measured: ~1650 at 100dpi); a tofu
+ *      render is a monochrome black outline on white (~0 saturated). Tolerant
+ *      threshold, not an exact-pixel fixture diff, to dodge cross-platform AA
+ *      and font-version variance.
+ *
+ * Note: pdfimages -list is intentionally NOT used — macOS embeds color emoji as
+ * Type 3 fonts, so pdfimages lists nothing even on a correct render.
+ *
+ * Gating: runs only when the compiled binary + browse + pdffonts + pdftoppm are
+ * available AND a color-emoji font is installed for Chromium to fall back to.
+ * In CI (process.env.CI set) missing prerequisites are a HARD FAILURE, not a
+ * skip — CI is expected to install poppler-utils + fonts-noto-color-emoji, so a
+ * silent skip there would let the tofu regression ship behind a green build.
+ * Local dev without those tools skips cleanly.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import { resolvePopplerTool } from "../../src/pdftotext";
+
+const FIXTURE = path.resolve(__dirname, "../fixtures/emoji-gate.md");
+const ROOT = path.resolve(__dirname, "../../..");
+const PDF_BIN = path.join(ROOT, "make-pdf/dist/pdf");
+const BROWSE_BIN = path.join(ROOT, "browse/dist/browse");
+
+// Saturated-pixel floor. Measured ~1650 at 100dpi for the fixture's color
+// emoji; a tofu render yields ~0. 200 sits well clear of both.
+const SATURATED_PIXEL_FLOOR = 200;
+// A pixel is "colored" when its max-min channel spread exceeds this. Black text,
+// gray rules, and white background all stay near 0; color emoji spike high.
+const SATURATION_DELTA = 40;
+// Per-child wall-clock bound. Bun's test timeout doesn't reliably interrupt a
+// synchronous execFileSync, so each child gets its own ceiling — a wedged
+// browser/poppler binary (or a hostile GSTACK_*_BIN override) fails instead of
+// hanging the whole job.
+const CHILD_TIMEOUT_MS = 25_000;
+
+/** Is a color-emoji font available for Chromium to fall back to? */
+function emojiFontAvailable(): boolean {
+  if (process.platform === "darwin") {
+    return fs.existsSync("/System/Library/Fonts/Apple Color Emoji.ttc");
+  }
+  if (process.platform === "linux") {
+    const fcMatch = Bun.which("fc-match");
+    if (!fcMatch) return false;
+    try {
+      const out = execFileSync(
+        fcMatch,
+        ["-f", "%{color}\n", ":lang=und-zsye:charset=1F600"],
+        { encoding: "utf8", timeout: CHILD_TIMEOUT_MS },
+      );
+      return /true/i.test(out);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+
+function prerequisitesAvailable(): { ok: true } | { ok: false; reason: string } {
+  if (!fs.existsSync(PDF_BIN)) return { ok: false, reason: `make-pdf binary missing (${PDF_BIN}). Run bun run build.` };
+  if (!fs.existsSync(BROWSE_BIN)) return { ok: false, reason: `browse binary missing (${BROWSE_BIN}).` };
+  if (!fs.existsSync(FIXTURE)) return { ok: false, reason: `fixture missing (${FIXTURE}).` };
+  if (!resolvePopplerTool("pdffonts")) return { ok: false, reason: "pdffonts not found (install poppler-utils)." };
+  if (!resolvePopplerTool("pdftoppm")) return { ok: false, reason: "pdftoppm not found (install poppler-utils)." };
+  if (!emojiFontAvailable()) return { ok: false, reason: "no color-emoji font installed; run ./setup (Linux) or install one." };
+  return { ok: true };
+}
+
+/**
+ * Count pixels in a P6 (binary) PPM whose RGB channel spread exceeds delta.
+ * Validates the header and buffer length so malformed/variant output is a hard
+ * diagnostic (thrown), never a silently-wrong count.
+ */
+function countSaturatedPixels(ppmPath: string, delta: number): number {
+  const b = fs.readFileSync(ppmPath);
+  let i = 0;
+  const skipWhitespaceAndComments = () => {
+    for (;;) {
+      while (i < b.length && (b[i] === 0x20 || b[i] === 0x0a || b[i] === 0x09 || b[i] === 0x0d)) i++;
+      if (b[i] === 0x23) { // '#': comment runs to end of line
+        while (i < b.length && b[i] !== 0x0a) i++;
+        continue;
+      }
+      break;
+    }
+  };
+  const token = (): string => {
+    skipWhitespaceAndComments();
+    const s = i;
+    while (i < b.length && b[i] !== 0x20 && b[i] !== 0x0a && b[i] !== 0x09 && b[i] !== 0x0d) i++;
+    return b.slice(s, i).toString("ascii");
+  };
+  const magic = token();
+  if (magic !== "P6") throw new Error(`expected P6 PPM, got "${magic}"`);
+  const w = Number(token());
+  const h = Number(token());
+  const maxval = Number(token());
+  if (!Number.isInteger(w) || w <= 0 || !Number.isInteger(h) || h <= 0) {
+    throw new Error(`invalid PPM dimensions: ${w}x${h}`);
+  }
+  if (maxval !== 255) {
+    // pdftoppm emits 8-bit P6 (maxval 255). 16-bit would be 2 bytes/channel and
+    // would break the byte math below — fail loudly rather than miscount.
+    throw new Error(`unexpected PPM maxval ${maxval} (expected 255)`);
+  }
+  i++; // single whitespace byte after maxval precedes the pixel block
+  const total = w * h;
+  if (b.length - i < total * 3) {
+    throw new Error(`PPM pixel buffer too short: have ${b.length - i}, need ${total * 3}`);
+  }
+  let sat = 0;
+  for (let p = 0; p < total; p++) {
+    const o = i + p * 3;
+    const r = b[o], g = b[o + 1], bl = b[o + 2];
+    if (Math.max(r, g, bl) - Math.min(r, g, bl) > delta) sat++;
+  }
+  return sat;
+}
+
+describe("emoji render gate", () => {
+  const avail = prerequisitesAvailable();
+
+  test.skipIf(!avail.ok)("emoji render as color glyphs, not tofu", () => {
+    if (!avail.ok) return; // type narrowing
+    // Private temp dir under /tmp: browse's validateOutputPath only allows
+    // /tmp and /private/tmp (not os.tmpdir()'s /var/folders), and mkdtemp
+    // dodges the predictable-path symlink/collision risk.
+    const workDir = fs.mkdtempSync("/tmp/make-pdf-emoji-gate-");
+    const outputPdf = path.join(workDir, "out.pdf");
+    const ppmPrefix = path.join(workDir, "page");
+    const ppmPath = `${ppmPrefix}.ppm`;
+    try {
+      execFileSync(PDF_BIN, ["generate", FIXTURE, outputPdf, "--quiet"], {
+        encoding: "utf8",
+        env: { ...process.env, BROWSE_BIN },
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: CHILD_TIMEOUT_MS,
+      });
+      expect(fs.existsSync(outputPdf)).toBe(true);
+
+      // 1. An emoji family must be embedded — the cascade found a real emoji
+      //    font instead of falling through to .notdef.
+      const pdffonts = resolvePopplerTool("pdffonts")!;
+      const fontList = execFileSync(pdffonts, [outputPdf], { encoding: "utf8", timeout: CHILD_TIMEOUT_MS });
+      if (!/emoji/i.test(fontList)) {
+        process.stderr.write(`\n--- pdffonts ---\n${fontList}\n--- END ---\n`);
+      }
+      expect(/emoji/i.test(fontList)).toBe(true);
+
+      // 2. The page must actually rasterize to color, not a monochrome tofu box.
+      const pdftoppm = resolvePopplerTool("pdftoppm")!;
+      execFileSync(pdftoppm, ["-r", "100", "-singlefile", outputPdf, ppmPrefix], {
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: CHILD_TIMEOUT_MS,
+      });
+      expect(fs.existsSync(ppmPath)).toBe(true);
+      const saturated = countSaturatedPixels(ppmPath, SATURATION_DELTA);
+      if (saturated < SATURATED_PIXEL_FLOOR) {
+        process.stderr.write(`\n[emoji-gate] saturated pixels: ${saturated} (floor ${SATURATED_PIXEL_FLOOR})\n`);
+      }
+      expect(saturated).toBeGreaterThanOrEqual(SATURATED_PIXEL_FLOOR);
+    } finally {
+      try { fs.rmSync(workDir, { recursive: true, force: true }); } catch { /* ignore */ }
+    }
+  }, 60000);
+
+  if (!avail.ok) {
+    // In CI, missing prerequisites are a hard failure — a silent skip would let
+    // the Linux tofu regression ship behind a green build. Locally, just warn.
+    test("emoji gate prerequisites are present (hard-required in CI)", () => {
+      if (process.env.CI) {
+        throw new Error(`emoji gate prerequisites missing in CI: ${avail.reason}`);
+      }
+      console.warn(`[skip] ${avail.reason}`);
+    });
+  }
+});

make-pdf/test/fixtures/emoji-gate.md

@@ -0,0 +1,12 @@
+# Emoji rendering gate 😀
+
+This fixture exists to prove that emoji code points render as real color
+glyphs in the output PDF, not as `.notdef` tofu boxes (▯).
+
+Color emoji on one line: 😀 ❤️ 🚀 ✅ 💡
+
+A variation-selector sequence (FE0F) renders color: ❤️ — the bare code point
+❤ is text-style. Both must come from a font in the cascade, never tofu.
+
+Non-emoji Unicode (unchanged, regression guard): em dash —, times ×, arrow →,
+bullet •, ellipsis …

make-pdf/test/render.test.ts

@@ -343,6 +343,46 @@ describe("printCss", () => {
     const occurrences = (css.match(/"Liberation Sans"/g) ?? []).length;
     expect(occurrences).toBeGreaterThanOrEqual(4);
   });
+
+  // ─── emoji fallback (fix/make-pdf-emoji-tofu) ────────────────
+  // Body + @top-center running header get the color-emoji families so
+  // Chromium has a glyph source for emoji code points instead of tofu (▯).
+  // The @bottom-* boxes hold counters / "CONFIDENTIAL" only — no emoji.
+
+  test("body stack includes all three emoji families before sans-serif", () => {
+    const css = printCss();
+    expect(css).toContain(`"Apple Color Emoji"`);
+    expect(css).toContain(`"Segoe UI Emoji"`);
+    expect(css).toContain(`"Noto Color Emoji"`);
+    // Emoji families must precede the generic family so per-character fallback
+    // reaches them before terminating at sans-serif.
+    expect(css).toMatch(/"Noto Color Emoji",\s*sans-serif/);
+  });
+
+  test("@top-center running header includes emoji families", () => {
+    const css = printCss({ runningHeader: "Q3 Report 🚀" });
+    const topCenter = css.match(/@top-center\s*\{[^}]*\}/)?.[0] ?? "";
+    expect(topCenter).toContain(`"Apple Color Emoji"`);
+    expect(topCenter).toContain(`"Noto Color Emoji"`);
+  });
+
+  test("@bottom-center and @bottom-right do NOT include emoji families", () => {
+    const css = printCss({ confidential: true });
+    const bottomCenter = css.match(/@bottom-center\s*\{[^}]*\}/)?.[0] ?? "";
+    const bottomRight = css.match(/@bottom-right\s*\{[^}]*\}/)?.[0] ?? "";
+    expect(bottomCenter).not.toContain("Emoji");
+    expect(bottomRight).not.toContain("Emoji");
+    // ...but they still share the sans stack via the SANS_STACK constant.
+    expect(bottomCenter).toContain(`"Liberation Sans"`);
+    expect(bottomRight).toContain(`"Liberation Sans"`);
+  });
+
+  test("emoji families appear in exactly the two emoji-bearing stacks", () => {
+    const css = printCss({ runningHeader: "Title", confidential: true });
+    // body (1) + @top-center (1) = 2 occurrences of the emoji group.
+    const occurrences = (css.match(/"Apple Color Emoji"/g) ?? []).length;
+    expect(occurrences).toBe(2);
+  });
 });
 
 // ─── render() — pageNumbers / footerTemplate data flow ───────────────