The pre-render width estimate and the Formatter's own fallback margin must agree on whether the FIRST system reserves extra width for the time signature

A time signature is only drawn once, on the first system — its width must be reserved on that system specifically, not spread flatly across every system.

Two DIFFERENT pieces of Gradus's own code disagree about this. `fixedExtras = FIXED_EXTRAS_BASE + keySigExtra + barlineCount*12` (line 797) is a FLAT constant applied identically to every system regardless of `isFirst`/timeSignature presence, feeding into `staveW` (line 830), which is THE SAME value for every system in the block. But the Formatter's own fallback margin (line 1143) explicitly does distinguish: `Math.max(staveW - (timeSignature && sysIdx === 0 ? 100 : 80), 100)` — a 20-VF-unit difference between first and non-first systems that the upstream width-selection math never knew about. Only the later, fallback-only path varies by system.

Universal engraving convention (Gould, Read, Ross all agree the time signature appears once, at the start).

This rule can be decided from pitches, durations and voices — no layout required. A validator can check it before anything is drawn.