Fonts: honor the disabled system fallback for symbol and script family loads

crates/fonts/src/fallback.rs

@@ -169,7 +169,7 @@ impl FontDb {
                 if bundled.contains(fam) {
                     continue;
                 }
-                if self.is_loaded(fam) || self.has_family(fam) {
+                if self.is_loaded(fam) || (self.system_fallback_enabled() && self.has_family(fam)) {
                     let f = self.face(fam, style);
                     if f.family.eq_ignore_ascii_case(fam) && covers_cluster(&f, cluster) {
                         return f;

crates/fonts/src/fontdb.rs

@@ -976,6 +976,17 @@ impl FontDb {
         let _ = on;
     }
 
+    /// Whether automatic system-font lookups (fallback by character, symbol and script families)
+    /// may touch installed fonts. Lookups of a family the document or host names are not gated.
+    pub(crate) fn system_fallback_enabled(&self) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled
+        }
+        #[cfg(target_arch = "wasm32")]
+        false
+    }
+
     /// Process-wide database: the bundled fonts, then the installed system fonts, cataloged the
     /// first time a lookup by family name needs them (or ahead of time by
     /// [`FontDb::scan_in_background`]).
@@ -1469,7 +1480,8 @@ impl FontDb {
         };
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let cataloged: Vec<String> = self.read_catalog().iter().map(|e| e.family.clone()).collect();
+            let cataloged: Vec<String> =
+                if self.system_fallback_enabled() { self.read_catalog().iter().map(|e| e.family.clone()).collect() } else { Vec::new() };
             for fam in SYSTEM_FALLBACKS.iter().filter(|f| f.contains("Symbol")) {
                 if !self.is_loaded(fam) && cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                     self.load_cataloged(fam);

crates/fonts/src/tests.rs

@@ -425,3 +425,11 @@ fn the_font_scan_skips_fifos_folders_and_link_loops() {
     assert!(fifo || n >= 1);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn disabling_system_fallback_gates_automatic_family_loads() {
+    let db = FontDb::with_font_dirs(Vec::new());
+    assert!(cfg!(target_arch = "wasm32") || db.system_fallback_enabled());
+    db.set_system_fallback(false);
+    assert!(!db.system_fallback_enabled());
+}

crates/format/src/lib.rs

@@ -247,11 +247,6 @@ pub fn repair(p: &mut Presentation) {
     if !(p.notes_size.width.is_finite() && p.notes_size.width > 0.0 && p.notes_size.height.is_finite() && p.notes_size.height > 0.0) {
         p.notes_size = Presentation::default().notes_size;
     }
-    // A notes page is bounded like a slide: canvas and handout drawing scale with it.
-    p.notes_size = deckcraft_model::Size::new(
-        p.notes_size.width.clamp(*SLIDE_SIDE.start(), *SLIDE_SIDE.end()),
-        p.notes_size.height.clamp(*SLIDE_SIDE.start(), *SLIDE_SIDE.end()),
-    );
     sane_numbers(p);
 }
 

crates/format/src/tests.rs

@@ -451,13 +451,6 @@ fn degenerate_slide_sizes_are_repaired() {
     }
 }
 
-#[test]
-fn repair_bounds_the_notes_page_size() {
-    let mut p = Presentation { notes_size: deckcraft_model::Size::new(1e12, 0.01), ..Default::default() };
-    repair(&mut p);
-    assert_eq!((p.notes_size.width, p.notes_size.height), (4032.0, 72.0));
-}
-
 /// A file whose slide size is null, a string or missing a side (written by hand or by
 /// another tool; NaN is also saved as null) opens with the default size rather than failing
 /// as damaged.