From 4e69ca14d3734887b82e32d7a4aa725f77637d58 Mon Sep 17 00:00:00 2001 From: Nick Nyssen <314538108+amoisttowe1@users.noreply.github.com> Date: Tue, 20 Oct 2026 01:01:27 -0700 Subject: [PATCH] M14: name the last resort and keep the pins honest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to review of this branch, no production change. The oracle now asserts the list still ends at Arial Unicode before checking it. Without that, deriving the path from list.first() instead of last() stayed green on this machine and printed "not installed" — the check disappeared because /System/Library/Fonts/DevanagariMT.ttc is absent here. Deriving the path from the list is still better than repeating a literal, but only if something verifies it points where the test thinks. The three retune tripwires (MAX_BYTES, DEVANAGARI_PROBE, MAX_FACES) move into their own test, so the layout test stays about Apple's directory layout and these are labelled for what they are: constants nothing else pins, each confirmed to be the only guard by deleting it and seeing the matching regression go green again. Comments corrected accordingly, including not claiming Apple moved a target when a user could equally have removed it. Verified on macOS 26.6 (Apple M5 Max): fmt --all clean; clippy -D warnings all-targets quiet; system_fonts 13 passed with and without PDFCRAFT_SYSTEM_FONTS=0; whole crate 1341 passed / 0 failed / 5 ignored; xtask layers (37 crates) and assets (272/6/22). Mutations re-run at this commit: folder-major expansion, folder-order swap, typo restore, loader reversal, cap raised to 512 MiB, probe swapped to Arabic alef and MAX_FACES cut to 1 are all red; deleting the PDFCRAFT_SYSTEM_FONTS=0 early return leaves all 1341 green, which is stated rather than hidden. --- crates/ui-egui/src/system_fonts.rs | 34 ++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/crates/ui-egui/src/system_fonts.rs b/crates/ui-egui/src/system_fonts.rs index 08615ef4af..944f424a2c 100644 --- a/crates/ui-egui/src/system_fonts.rs +++ b/crates/ui-egui/src/system_fonts.rs @@ -492,6 +492,21 @@ mod tests { } } + /// Retune tripwires, deliberately separate from the layout test above: these assert that three + /// constants still hold the values this module's contract depends on. They cannot fail on their + /// own — they exist so that editing one is a decision someone has to make twice. Each was + /// checked by deleting the pin and watching the matching regression go green again: raising + /// `MAX_BYTES` above Arial Unicode's ~23 MB, swapping the Devanagari probe for Arabic `U+0627` + /// (which that face also covers, so every other test stays green), and cutting `MAX_FACES` to 1. + /// The oracle in the macOS test below also depends on all three, and it is conditional on + /// installation — so on CI these are the only guard. + #[test] + fn the_load_constants_are_the_documented_contract() { + assert_eq!(MAX_BYTES, 32 << 20, "the non-Han installed-face size cap is this module's contract (Arial Unicode is ~23 MB)"); + assert_eq!(DEVANAGARI_PROBE, '\u{0915}', "Devanagari ka is what the Hindi candidates are probed for, not another script's letter"); + assert_eq!(MAX_FACES, 16, "how deep into a .ttc collection the loader looks; the macOS oracle trusts this depth"); + } + /// The macOS Devanagari list, exactly: families best first, each tried in the system folder /// before `Supplemental/`. This pins the spellings Apple uses on disk and the order that /// decides which face wins. A missing space (`DevanagariSangamMN.ttc`), swapping the two @@ -511,13 +526,6 @@ mod tests { PathBuf::from("/Library/Fonts/Arial Unicode.ttf"), ] ); - // These two constants decide what the loader accepts, and one of them is what makes a Hindi - // check a Hindi check. Pin them here so neither can be retuned out from under this test — or - // from under the macOS oracle, whose Arial assertion is now conditional on installation. - assert_eq!(MAX_BYTES, 32 << 20, "the non-Han installed-face size cap is part of this module's contract (Arial Unicode is 23,278,008 B)"); - assert_eq!(DEVANAGARI_PROBE, '\u{0915}', "Devanagari ka is what the Hindi candidates are probed for, not another script's letter"); - assert_eq!(MAX_FACES, 16, "how deep into a .ttc collection the loader looks; the macOS oracle trusts this depth"); - // Pin what the application actually consults, not just the helper that builds it. #[cfg(target_os = "macos")] assert_eq!(devanagari_candidates(), macos_devanagari_candidates(), "the app must consult the list this test pins"); @@ -579,10 +587,18 @@ mod tests { // moved reads as "no file", which is exactly the dead-path defect this change exists to // catch. So gate on the entry existing (lstat), then require that it resolves, then check // size cap and coverage. `MAX_BYTES` is what the loader applies to non-Han scripts; the path - // comes from the list itself rather than being written out again, so it cannot drift. + // comes from the list itself rather than being written out again, so this oracle cannot + // drift from what production offers. let last_resort = list.last().expect("the macOS Devanagari list always ends at the Unicode face").clone(); + assert!( + last_resort.to_string_lossy().ends_with("Arial Unicode.ttf"), + "this block checks the Unicode last resort, so the list must still end at it: {last_resort:?}" + ); if std::fs::symlink_metadata(&last_resort).is_ok() { - assert!(last_resort.is_file(), "{last_resort:?} exists but does not resolve — Apple moved the target and this path has gone dead"); + assert!( + last_resort.is_file(), + "{last_resort:?} exists but does not resolve — its target was moved or removed, so this path has gone dead" + ); assert!( read(&last_resort, DEVANAGARI_PROBE, MAX_BYTES).is_some(), "the last-resort Unicode face is installed here but did not resolve and load under MAX_BYTES"