Determinism and its limits

Guarantee: the same source bytes, the same edit log, the same output options and the same core version produce byte-identical output in Chromium, WebKit, Firefox, Node, Deno, Bun and native Rust. The repository's goldens prove it on every commit across all seven.

How: one Rust core compiled to WebAssembly; no threads, no relaxed SIMD; all pixel math through libm or integers; own resampler and bilinear sampler instead of SIMD libraries; fixed codec parameters; float_roundtrip JSON parsing so a float written by JavaScript is the same f64 in Rust.

Limit: when the browser edits a proxy and the server renders the original, the results are composition-identical (same normalised geometry, same relative lengths), not byte-identical, because the pixel counts differ. That is exactly the intent of the proxy flow. Byte identity holds whenever the same source bytes go through render().

Third-party JavaScript kernels are deterministic only if their authors follow the rules: integer math or fround-disciplined floats, no Math.random, no Date, no transcendental functions. WebAssembly kernels are deterministic by construction.