The recovery stage is now created, opened and, when opening fails, removed through
the retained recovery directory handle. A failed open no longer leaves an empty
stage under .removing, and the removal is not recursive. A rollback failure now
names the recovery stage ID next to the pack's last known path.
Index::assemble searched every earlier position listed under a PostScript
name before adding the next, so an index that gives one name to many files
took time quadratic in their number. Files are visited in order, so a file
that lists a name twice can only be the last position pushed: comparing
with the end is enough.
find_postscript compared each hit's family name with every name collected
so far; it now keeps the lowercased names in a set.
- read_installed copies an unreadable record to .bad and writes the rebuilt one atomically over it; a missing record with pack folders is rebuilt too; install reads the record before moving the pack in.
- Stage::new uses create_dir and takes the next name on AlreadyExists (PID namespaces in Flatpak/containers); stale folders are left to sweep_staging.
- At most 4096 zstd frames per archive, empty ones included.
- IndexError and the sha256 mismatch say "the index", not "the font index".
- licence, release, version and class lose control and Cf characters like name.
- PackEntry.source: Option<String>, an https URL or the index is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8LsYYE8fsj4byBm2
- Every zstd frame is decoded; anything but tar padding after the archive is refused.
- pack.toml must name the index entry's locale; the files the index promises (spelling, hyphenation) must be in the archive.
- Allow-list: pack.toml, spelling.aff, spelling.dic, hyphenation.pat at the root, LICENCES/<[A-Za-z0-9._-]> without a leading or trailing dot; Windows device names (con, prn, aux, nul, com1-9, lpt1-9, any extension) refused in names and locales.
- Pack names lose control and bidi/format (Cf) characters before they are stored or listed.
- An unreadable language-packs.json is kept as .bad and rebuilt from the pack folders (each pack.toml); no pack drops out.
- A bad hand-made entry is Error::Index(IndexError::Invalid), not BadUrl; index parse errors are Index errors too.
- Dead file:// handling removed.
- language_pack_index_overridden() exposes the developer override; README says it bypasses the pin and works in release builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8LsYYE8fsj4byBm2
Additive: new src/language_packs.rs (+ tests); store.rs only widens a few helpers to pub(crate).
Developer override CRAFT_LANGUAGE_PACK_INDEX for local end-to-end testing (no index pin; archives
still verified).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FypgCX8LsYYE8fsj4byBm2
- FontStore::remove_files only touches names the family's manifest entry
lists and that are safe file names.
- A user source's folder carries a hash of its full ID, so sources whose
IDs slug alike don't share a folder.
- The download dialog and the sidebar note name the family's own source,
and the server for a source the user added.
- The face cache takes out only faces the last frame didn't draw.
- The catalog test lists missing translations instead of failing.
- ATTRIBUTION lists the three bundled craft-font-index files.
dotCooCoo