The gate counted 72 families enumerating and passed while ten collection faces
silently fell back to another family, so a real rendering regression shipped
with the gate green. It now renders a CJK probe per collection face and compares
the metrics against the fallback, with the family list calibrated on a build
known to load them.
Also: test_constants derives the expected archive name from the basename
constant instead of hardcoding the version, since a hardcoded one turns every
upstream bump into a mechanical test edit, which is how a stale expectation gets
corrected without anyone checking the asset exists. And INVPW_TRUE_HEADLESS=1
opts into real headless for long unattended runs on Windows, where the default
cloak path intermittently hangs on launch with a persistent profile. The default
is unchanged and the fingerprint prefs are identical either way.
Companion to ci_drive_gate.py, run by release.yml's gate job on each leg's
native runner. Launches the built binary headless, enumerates the visible font
families with the width probe web detectors use, and asserts: the detected set
equals the canonical Windows family set (identical on every OS), no known host
family (macOS Helvetica Neue/Menlo, Linux DejaVu/Ubuntu, ...) is visible, and
the CSS generics resolve to Windows fonts (serif=Times New Roman, mono=Consolas,
system-ui=Segoe UI). This is how the macOS build gets font-validated - there is
no local Mac. No proxy, no secrets.
