test(make-pdf)+feat(diagram): review-wave test pins + skill transport hardening

Tests: indented-fence byte-for-byte replay + no-extraction-in-lists,
drive-letter local-path routing, $-pattern slot immunity, base64 source
round-trip ('A --> B' exact), existing-style merge preservation, DOCX
rasterize-failure surfaces source, srcSha256 + font-stack drift guards,
landscape veto asserted as some-portrait/no-landscape (layout-order-proof),
judge rubric cap lowered to 5 so it actually fails, vacuous error-shape test
removed honestly, tmpdir cleanup.

/diagram skill: base64 transport (template literals corrupted backticks/${
in sources), content-addressed staging with hash verification, and --tab-id
pinned on every browse call so a concurrent /qa session can't be clobbered.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/diagram-render-drift.test.ts

@@ -36,6 +36,33 @@ describe("diagram-render bundle drift", () => {
     expect(info.deps).toEqual(pkg.dependencies);
   });
 
+  test("BUILD_INFO srcSha256 matches src on disk (edited-src-forgot-rebuild guard)", async () => {
+    // The deep rebuild check below needs node_modules, which CI doesn't
+    // install for this nested package — this tier-1.5 fingerprint catches a
+    // src edit committed without a rebuild using nothing but file hashes.
+    const info = await Bun.file(BUILD_INFO).json();
+    const srcSha = createHash("sha256")
+      .update(await Bun.file(path.join(ROOT, "src", "entry.ts")).text())
+      .update(await Bun.file(path.join(ROOT, "scripts", "build.ts")).text())
+      .digest("hex");
+    expect(srcSha).toBe(info.srcSha256);
+  });
+
+  test("bundle font stack matches print-css (text-measurement drift guard)", async () => {
+    const entrySrc = await Bun.file(path.join(ROOT, "src", "entry.ts")).text();
+    // Every family print-css composes into the body stack must appear in the
+    // bundle's PRINT_SANS literal — mermaid measures text with these fonts and
+    // the print document lays it out with print-css's; drift = overflowing
+    // labels (eng-review D3).
+    for (const family of [
+      "Helvetica", "Liberation Sans", "Arial",
+      "Hiragino Kaku Gothic ProN", "Noto Sans CJK JP", "Microsoft YaHei",
+      "Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji",
+    ]) {
+      expect(entrySrc).toContain(family);
+    }
+  });
+
   test("page invariants: module script, base href, escaped terminators, error trap", async () => {
     const html = await Bun.file(DIST_HTML).text();
     expect(html).toContain('<script type="module">');

test/skill-e2e-diagram.test.ts

@@ -138,7 +138,8 @@ ${mmd}
 Score 1-10 on: faithfulness to the ask (are the named stages present and
 correctly ordered?), label quality (short node labels, detail on edges),
 and readable size (5-15 nodes, not a wall). A diagram that misses the
-failure/diagnostic path entirely caps at 6.
+failure/diagnostic path entirely caps at 5 — that path is an explicitly
+named requirement, so omitting it must fail the run.
 
 Respond with JSON: {"score": N, "reasoning": "..."}`,
       );