From the adversarial review of #130. validate_loaded_font (called from FontWorkspace::open_package and ::resume) hard-fails on an invalid fontinfo remainder. Pre-#130 the same corruption meant open-fine/save-fails; now a working draft store holding unsaved edits becomes permanently inaccessible — there is no degrade path.
No non-tampering trigger exists today, but norad version skew across shift builds (a key's value shape changing between norad releases) is a plausible future trigger with no migration story. Also inconsistent: import_font skips validate_loaded_font entirely.
Decision needed: on invalid remainder at open/resume, drop the remainder with a visible warning (preserves access to the user's edits, loses only passthrough data) vs. keep the hard error. Recommendation: degrade with warning at resume (unsaved work must never be held hostage by passthrough bytes); hard error is defensible at open_package only.
🤖 Generated with Claude Code
From the adversarial review of #130.
validate_loaded_font(called fromFontWorkspace::open_packageand::resume) hard-fails on an invalid fontinfo remainder. Pre-#130 the same corruption meant open-fine/save-fails; now a working draft store holding unsaved edits becomes permanently inaccessible — there is no degrade path.No non-tampering trigger exists today, but norad version skew across shift builds (a key's value shape changing between norad releases) is a plausible future trigger with no migration story. Also inconsistent:
import_fontskipsvalidate_loaded_fontentirely.Decision needed: on invalid remainder at open/resume, drop the remainder with a visible warning (preserves access to the user's edits, loses only passthrough data) vs. keep the hard error. Recommendation: degrade with warning at resume (unsaved work must never be held hostage by passthrough bytes); hard error is defensible at open_package only.
🤖 Generated with Claude Code