Update — 22 September 2026: CSSOM fix merged; exact app retest pending

WebScene PR #907 merged at 220aa082 after its related contracts, native builds, portable V8, and package .NET gates passed. The earlier signed Code OSS diagnostic app was removed during artifact cleanup; no exact installed-SDK/CLI app containing #907 has been built or visually accepted yet. Keep this issue open until unchanged Code OSS paints Markdown Preview and passes iframe lifecycle, Chromium comparison, and idle-CPU gates. The macOS 12 NuGet osx-arm64 failure is a pre-existing floating charconv availability problem tracked separately in #908 / PR #909.

Current status — packaged CSSOM regression reproduced (22 September 2026)

The exact signed installed-SDK/CLI Code OSS Release now pins WebScene 406bc88a (#906) and AppScene 36d7a82e. Native computer-use still opens a blank Markdown Preview. The real editor anchors measure [348,61,792,857] and [744,96,396,822], but the clipping root, overlay, and iframe remain 0×0. A fixed-size CSSOM control measures [17,19,53,37] and a stylesheet-defined anchor control measures [27,29,43,47]; CSSOM-created probes using style.top = "anchor(top)" and style.width = "anchor-size(width)" remain 0×0. This isolates the runtime-created CSSOM path missed by #906's initial stylesheet fixture.

Focused PR #907 (4e29ae2c) retains anchor functions in six JavaScript style named setters and through detached-element attachment/recascade. Chrome passes 9/9 assertions; native V8 Release moves from 2/9 to 9/9; existing anchor geometry remains 9/9. Both contracts enforce 64 panel moves within 500 ms. Keep this issue open until #907's related CI passes, it merges, and an exact rebuilt SDK/CLI Code OSS app paints Markdown and passes visual, lifecycle, and idle-CPU gates. Source and focused evidence: docs/validation/css-anchor-cssom-903-20260922.md.

Previous checkpoint — focused engine fix merged

WebScene PR #906 merged at 406bc88a after native/Chrome geometry, paint, panel-churn, existing positioned-height, and related Linux/portable V8 CI gates passed. The unchanged Code OSS integration pins this commit locally. The preceding signed .app below predates #906, so the real Markdown preview remains unverified. Keep #903 open until a new installed-SDK/CLI Release paints Markdown and passes Code OSS visual, lifecycle, and idle-CPU gates. AppScene #402 owns the package retest.

Markdown preview layout diagnostic — 21 September 2026

Exact package and result

The signed installed-SDK/CLI Release at
dist/appscene-release-36d7a82-5b4739c8-preview-diagnostic/Code OSS AppScene.app
uses unchanged Code OSS 645f29cc, merged WebScene 5b4739c8, and merged
AppScene 36d7a82e. With the three opt-in navigation, workspace-bootstrap,
and Markdown-preview diagnostic environment flags, native computer input
opened the real remote beta/README.md. The unchanged built-in
markdown.showPreviewToSide command resolved and created a visible
Preview README.md tab, but the preview content remained white. The remote
workspace/file-lifecycle acceptance state passed on this run.

Evidence: build/appscene-webview-398/native-preview-36d7a82-final-diagnostic.log,
build/appscene-webview-398/preview-36d7a82-final.png. The log redacts URL
query values and document text in the bounded frame snapshots.

Measured geometry and source boundary

The main document measured 1440×940. The outer webview iframe and its parent
.webview-overlay-content measured 0×0. The latter computed as position: fixed; width: 0px; height: 0px. Its containing absolute root was also 0×0;
the preview tab was present. The nested fake.html iframe was created inside
the virtual HTTPS prelude and also measured 0×0. These measurements explain
the blank pane independently of later Markdown content, worker, or message
delivery failures; they do not prove those later stages correct.

Unchanged Code OSS src/vs/base/browser/overlayLayoutElement.ts assigns
anchor-name to the editor anchor, position-anchor to the overlay, and
anchor(top), anchor(left), anchor-size(width), and
anchor-size(height) to its fixed-position content. It may also use a
clipping anchor on the absolute root. The checked WebScene native code has no
matches for CSS Anchor Positioning identifiers. A focused browser/native
contract must first distinguish unsupported anchor functions from an
independent absolute-inset stretch failure. Any implementation belongs in
WebScene, not a VS Code source rewrite or demo-specific layout override.

The nested iframe's authored ./fake.html?id=... is owned by the virtual
HTTPS prelude document, but reading its src property from the diagnostic
main realm returned http://127.0.0.1:<port>/fake.html?.... The getter in
webscene_v8_runtime_dom_properties.inc::get_element_url chooses
current_base_address(), while navigation itself uses the owning document
base. The property observation is a URL-reflection defect candidate; it is
not proof that the actual nested request went to the loopback origin.

Gates and next work

1. Add a product-neutral Chrome/native contract for a named anchor, fixed
   overlay, dynamic resize/move, clipping container, absolute inset root,
   and nested iframe geometry; record exact per-stage rectangles and pixels.
2. Implement the missing WebScene CSS/runtime behavior with bounded anchor
   dependency invalidation, resize/panel-churn performance, and release RID
   gates. Retest unchanged Code OSS Markdown and a second webview consumer.
3. Add a separate owner-document-base URL-reflection contract for nested
   relative src/href, including <base> mutation, iframe navigation,
   cross-origin access, and detached nodes; correct the getter if reproduced.
4. Require actual painted Markdown, Chrome-matched layout, security and
   lifecycle, zero-browser proof, memory/idle CPU, and full release gates
   before closing AppScene Preserve iframe WindowProxy through document navigation #402/Implement CSS layer statement rule mutation #398 or WebScene [Epic] Qualify unchanged Code OSS webviews and nested document contexts #264/Enforce secure nested-document lifecycle for Code OSS webviews #267.

Two of the three native frame-probe attempts exceeded the existing 2000 ms
Explorer first-child paint bound (2198.78 and 2318.83 ms); the final
diagnostic run passed. Keep the intermittent cold-start concern open under
WebScene #252/#243. No performance acceptance follows from one passing run.