fontisan 0.4.43 → 0.4.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e765f39b4bf4e07536caf5c50ef0b97de1194d29623836a90aef0a8aaba21a6
-  data.tar.gz: 4f83b4c02796fb6158f73d387e903f2aacab84d465a2704b525e07fbb506218c
+  metadata.gz: 7d195924806ae6e5a9ca3f0796493ec611303a30f39aeed2293829a6d3317a06
+  data.tar.gz: 96183528b1693ff11796622f2df05541a371606cfaddd8bc8ae5fccacf42b488
 SHA512:
-  metadata.gz: 2b06582ee5b83fe73009fcafe496864619075fe4f240bb5b8a336ec67e6caa22d26de432147f690661751af40db4dbb2750fe2392dbf0c32752ae3b231983ea4
-  data.tar.gz: cb4678080eb0a69c0e4c5ab698b0cdb012dcbc8e7929e57005f2dcc5df21b53708d549d3e099095cac51f44e11586965d8de2c99083e4e3dfba777b28ffac0d7
+  metadata.gz: 0c991caf6890e43dd5d95c47fe187421f536b4dc14c70f1a2c035ab254212356a4f85886e118832e3586721726fc69411b71739654fcf017ecaa9d09e5a2aa7a
+  data.tar.gz: dd7c245e25cc82d4024a49404938c624462a0b8d1593764c5c2c5bdb0555da052ce7bb436079d6959eaf17359f601034bf0c4c46b064b8be6cb419abc941829a

data/TODO.bug-fixes/12-type1-generators-duck-typing.md

@@ -0,0 +1,80 @@
+# 12 — Type 1 generators duck-typing cleanup
+
+## Priority
+P0
+
+## Problem
+50+ `respond_to?` calls in `lib/fontisan/type1/` check for methods that
+don't exist on the BinData Name/OS/2/Post tables. Every check returns
+false and the generators silently fall through to empty/unknown values.
+
+## Sites (by file)
+
+### `pfm_generator.rb` (10)
+- :506 `respond_to?(:copyright)` — Name table has no `#copyright`
+- :521 `respond_to?(:full_font_name)` — Name table has no `#full_font_name`
+- :523 `respond_to?(:font_family)` — Name table has no `#font_family`
+- :525 `respond_to?(:postscript_name)` — Name table has no `#postscript_name`
+- :541/:543 `respond_to?(:us_weight_class)` / `respond_to?(:weight_class)` — OS/2 has neither
+- :372/:374 `respond_to?(:cap_height)` / `respond_to?(:s_typo_ascender)` — same
+- :382 `respond_to?(:x_height)` — OS/2 has no `#x_height`
+- :567 `respond_to?(:is_fixed_pitch)` — Post has no `#is_fixed_pitch`
+- :148 `respond_to?(:unicode_mappings)` — Cmap DOES have this; check unnecessary
+
+### `pfa_generator.rb` (6)
+- :137/:142 `respond_to?(:version_string)` / `:copyright` on Name
+- :164 `respond_to?(:typo_ascender)` on OS/2
+- :181/:189 `respond_to?(:weight_class)` on OS/2
+- :307 `respond_to?(:points)` on glyph — same broken pattern as #20
+
+### `pfb_generator.rb` (3)
+- :162/:170 `respond_to?(:weight_class)` on OS/2
+- :276 `respond_to?(:points)` on glyph
+
+### `afm_generator.rb` (16)
+- :170/:173 `respond_to?(:underline_position)` / `:underline_thickness` on Post
+- :255/:257 `respond_to?(:us_weight_class)` / `:weight_class`
+- :283 `respond_to?(:italic_angle)`
+- :297 `respond_to?(:is_fixed_pitch)`
+- :311/:323 `respond_to?(:version_string)` / `:copyright` on Name
+- :339/:341/:343 `respond_to?(:unicode_mappings)` / `:unicode_bmp_mapping` / `:subtables` on Cmap
+- :346/:348/:352 subtable field probes
+- :368/:370/:371 `respond_to?(:font_bounding_box)` / `:x_min` / `:y_min` on Head
+- :393 `respond_to?(:parse_with_context)` on Loca
+- :401 `respond_to?(:glyph_for)` on Glyf
+- :405/:407/:408 `respond_to?(:bounding_box)` / `:x_min` etc. on glyph
+
+### `inf_generator.rb` (10)
+- :187/:202/:217/:269/:281/:293/:305 Name/Post field probes
+- :229/:231 OS/2 weight class probes
+- :257 `respond_to?(:italic_angle)`
+
+### `generator.rb` (1)
+- :203 `respond_to?(:postscript_name)` on Name
+
+### `decryptor.rb` (1)
+- :115 `respond_to?(:b)` on String — always true for Ruby strings
+
+## Approach
+1. Add a `NameIds` constants module if not present (NAME_COPYRIGHT=0,
+   NAME_FONT_FAMILY=1, NAME_FULL_FONT_NAME=4, NAME_VERSION=5,
+   NAME_POSTSCRIPT_NAME=6, NAME_MANUFACTURER=8, NAME_LICENSE=13).
+2. Replace `name_table.respond_to?(:X) ? name_table.X(1) : ""` with
+   `name_table&.english_name(NAME_ID_X) || ""`.
+3. For OS/2 fields, declare the BinData field accessor (most already
+   exist) and access directly: `os2&.us_weight_class`.
+4. For Post fields, same: `post&.italic_angle`.
+5. For Cmap, `cmap.unicode_mappings` is the documented API — drop the
+   `respond_to?` and just call it (nil guard at the boundary).
+6. For Loca parse_with_context, Loca responds to it always — drop the
+   check.
+7. For glyph bounding boxes, use the typed SimpleGlyph/CompoundGlyph
+   `bounding_box` method (always present).
+8. For `glyph.respond_to?(:points)`, see TODO 15 — the underlying bug
+   is fixed there.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/type1/` (excluding `respond_to_missing?`)
+- All Type 1 generation specs pass with real Libertinus fixture
+- AFM/PFM/PFA/PFB/INF output now contains real Name table values
+  (previously was empty for most fields)

data/TODO.bug-fixes/13-hint-extractor-duck-typing.md

@@ -0,0 +1,30 @@
+# 13 — Hint extractor duck-typing cleanup
+
+## Priority
+P1
+
+## Problem
+15 `respond_to?` calls in `lib/fontisan/hints/postscript_hint_extractor.rb`
+probe PrivateDict fields that are always declared on the BinData record.
+Plus 2 sites in `postscript_hint_extractor.rb:60-62` that probe Charstring
+shape (`:data` vs `:bytes`).
+
+## Sites
+- :60/:62 `charstring.respond_to?(:data)` / `:bytes` — Charstring has one shape
+- :292/:296/:300/:304 `respond_to?(:blue_values)` / `:other_blues` / `:family_blues` / `:family_other_blues`
+- :308/:312/:316 `respond_to?(:blue_scale)` / `:blue_shift` / `:blue_fuzz`
+- :320/:324 `respond_to?(:std_hw)` / `:std_vw`
+- :328/:332 `respond_to?(:stem_snap_h)` / `:stem_snap_v`
+- :336/:340 `respond_to?(:force_bold)` / `:language_group`
+
+## Approach
+1. Verify which fields are declared on `Tables::Cff::PrivateDict`.
+2. For declared fields, drop the `respond_to?` and read directly with
+   nil-coalescence: `private_dict.blue_values`.
+3. For undeclared fields (rare BinData optional), either declare them
+   with a default `nil` or remove the dead branch.
+4. For Charstring, standardize on one accessor (probably `#data`).
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/hints/`
+- All hint extraction specs pass

data/TODO.bug-fixes/14-font-interface-type-checks.md

@@ -0,0 +1,82 @@
+# 14 — Font interface type checks
+
+## Priority
+P1
+
+## Problem
+~30 `respond_to?` calls probe whether an object is font-like by
+checking for `:table`, `:tables`, `:table_data`, `:has_table?`,
+`:header`, `:cff?`. The codebase has a typed font hierarchy
+(`SfntFont`, `TrueTypeFont`, `OpenTypeFont`, `WoffFont`, `Woff2Font`,
+`Type1Font`) — these should be checked with `is_a?`.
+
+## Sites (by category)
+
+### Collection builders
+- `collection/builder.rb:61` `respond_to?(:table_data)`
+- `collection/dfont_builder.rb:47` `respond_to?(:table_data)`
+
+### Subset
+- `subset/builder.rb:115` `respond_to?(:table)`
+- `subset/table_strategy/cff2.rb` — already cleaned
+
+### Converters
+- `converters/woff2_encoder.rb:221` `respond_to?(:table_names)`
+- `converters/woff2_encoder.rb:250` `respond_to?(:has_table?)`
+- `converters/woff2_encoder.rb:313/:315/:317` font shape probes
+- `converters/outline_converter.rb:278/:282` `respond_to?(:tables)` / `:table`
+- `converters/table_copier.rb:33/:37/:76/:80` font shape probes
+- `converters/woff_writer.rb:116/:305` font shape / `:cff?`
+- `converters/type1_converter.rb:115/:160/:222/:723-749` font shape + font_info probes
+- `converters/format_converter.rb:415` `respond_to?(:table)`
+
+### Stitcher
+- `stitcher/source.rb:83` `respond_to?(:has_table?)`
+- `stitcher/source.rb:193/:220/:228` table parse probes
+- `stitcher/source.rb:287/:289/:375/:377` glyph type probes (see TODO 15)
+
+### Variable
+- `variable/delta_aplicator.rb:263` `respond_to?(:table_data)`
+- `variable/static_font_builder.rb:80` `respond_to?(:tables)`
+- `variation/variation_preserver.rb:151/:152` `respond_to?(:has_table?)` / `:table_data`
+
+### Commands
+- `commands/validate_command.rb:216` `respond_to?(:table)`
+- `commands/pack_command.rb:177/:188` `respond_to?(:header)`
+
+### Validation
+- `validation/collection_validator.rb:249/:259` `respond_to?(:has_table?)`
+
+### Woff2 table transformer
+- `woff2/table_transformer.rb:153` `respond_to?(:table_data)`
+
+### Other
+- `commands/unpack_command.rb:210` `respond_to?(:table)`
+
+## Approach
+1. Define `SfntFont` as the type for any TrueType/OpenType/WOFF/WOFF2
+   font (already the base class).
+2. Define `Type1Font` similarly (already exists).
+3. Replace `respond_to?(:table)` / `:tables` / `:table_data` / `:has_table?`
+   with `is_a?(SfntFont)` (or `is_a?(Type1Font)` where applicable).
+4. Where the input legitimately can be either SfntFont or Type1Font,
+   accept a union: `font.is_a?(SfntFont) || font.is_a?(Type1Font)`.
+5. For `respond_to?(:header)` in pack_command, the SfntFont exposes
+   `sfnt_version` directly (already used elsewhere).
+6. For converters/type1_converter.rb font_info probes, the `font_info`
+   is always a `Type1::FontInfo` record — replace with `is_a?`.
+
+## Affected specs
+- spec/fontisan/collection/builder_spec.rb (uses doubles)
+- spec/fontisan/subset/builder_spec.rb (uses doubles)
+- spec/fontisan/converters/* (most use real fonts; check each)
+- spec/fontisan/stitcher/* (check)
+
+The collection/builder_spec and subset/builder_spec were identified in
+PR #135 as using doubles that block the is_a?(SfntFont) migration.
+Migrate them to real SfntFont instances or SimpleDelegator-based fakes.
+
+## Acceptance criteria
+- 0 `respond_to?(:table)` / `:tables` / `:table_data` / `:has_table?` /
+  `:header` / `:cff?` in `lib/fontisan/`
+- All affected specs pass with real fonts or SimpleDelegator-based fakes

data/TODO.bug-fixes/15-glyph-type-checks-and-simple-glyph-points-bug.md

@@ -0,0 +1,49 @@
+# 15 — Glyph type checks + SimpleGlyph#points bug
+
+## Priority
+P0
+
+## Problem
+~15 `respond_to?` calls probe glyph shape (`:simple?`, `:compound?`,
+`:points`, `:bounding_box`). Plus the latent bug discovered in PR #135:
+`Type1::TTFToType1Converter#extract_points` calls `glyph.points.each`
+but `Tables::SimpleGlyph` has no `points` method. The `respond_to?`
+check silently masked this for years.
+
+## Sites
+- `type1/ttf_to_type1_converter.rb:140` `respond_to?(:points)` — masks bug
+- `type1/pfa_generator.rb:307` `respond_to?(:points)` — same bug
+- `type1/pfb_generator.rb:276` `respond_to?(:points)` — same bug
+- `ufo/convert/from_bin_data.rb:192/:312/:323/:325` `respond_to?(:simple?)` / `:compound?`
+- `ufo/convert/from_bin_data.rb:361` `respond_to?(:glyph_name)`
+- `stitcher/source.rb:287/:289/:375/:377` `respond_to?(:simple?)` / `:compound?`
+- `hints/truetype_hint_extractor.rb:66` `respond_to?(:instructions)`
+- `tables/glyf.rb:243` already fixed in PR #135
+
+## SimpleGlyph API surface (current)
+- `num_contours`, `num_points`
+- `points_for_contour(index)` → Array<Hash{x,y,on_curve}>
+- `point_at(index)`, `on_curve?(index)`
+- `bounding_box` → [x_min, y_min, x_max, y_max]
+- `simple?`, `compound?`, `empty?`
+
+## Approach
+1. Add `Tables::SimpleGlyph#points` — returns a flat Array<Hash> across
+   all contours. Single source of truth, lazy-built.
+2. Add `Tables::CompoundGlyph#points` — returns the union of component
+   points (or empty if no components).
+3. Replace all `respond_to?(:points)` with `is_a?(Tables::SimpleGlyph)`.
+4. Replace `respond_to?(:simple?)` / `:compound?` with `is_a?` against
+   `Tables::SimpleGlyph`, `Tables::CompoundGlyph`, `Tables::Cff::CFFGlyph`.
+5. For `:bounding_box`, the typed glyph classes all have it — drop the
+   check.
+6. For `:glyph_name` on Post glyph records, declare it as a method (or
+   always-present BinData field).
+7. For `:instructions` on SimpleGlyph, declare it.
+
+## Acceptance criteria
+- 0 `respond_to?(:simple?)` / `:compound?` / `:points` / `:bounding_box` /
+  `:glyph_name` / `:instructions` in `lib/fontisan/`
+- Type 1 conversion now produces non-empty CharString data for simple
+  glyphs (the previously-broken `extract_points` path)
+- All Type 1 specs pass

data/TODO.bug-fixes/16-variation-table-checks.md

@@ -0,0 +1,31 @@
+# 16 — Variation table checks
+
+## Priority
+P2
+
+## Problem
+~15 `respond_to?` calls in `lib/fontisan/variation/` probe variation
+table shape (`:item_variation_store`, `:region_list`, `:num_axes`,
+`:advance_height_delta_set`, etc.). All variation tables are typed
+BinData records — these checks should be `is_a?` or direct calls.
+
+## Sites
+- `variation/validator.rb:106/:136/:142/:144/:199/:211/:275/:278/:281/:286`
+- `variation/metrics_adjuster.rb:230/:233/:310`
+- `variable/metric_delta_processor.rb:224/:229/:234`
+- `variable/delta_applicator.rb:296`
+
+## Approach
+1. For each variation table (Fvar, Hvar, Vvar, Mvar, Cff2, ItemVariationStore),
+   verify the BinData-declared fields and methods.
+2. Replace `respond_to?(:item_variation_store)` with `is_a?(Tables::Hvar)`
+   or `is_a?(Tables::Vvar)` etc., then call `.item_variation_store`
+   directly.
+3. For optional fields (rare in variation tables), declare them with
+   defaults on the BinData record.
+4. For `metrics_adjuster.rb:310` `respond_to?(:number_of_h_metrics=)`,
+   Hhea is a BinData record with a declared writer — drop the check.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/variation/` and `lib/fontisan/variable/`
+- All variation specs pass

data/TODO.bug-fixes/17-ufo-and-stitcher-cleanup.md

@@ -0,0 +1,32 @@
+# 17 — UFO convert and Stitcher cleanup
+
+## Priority
+P2
+
+## Problem
+~10 `respond_to?` calls in `ufo/convert/from_bin_data.rb` probe BinData
+table shape. Plus 1 site in `ufo/compile/fvar.rb`.
+
+## Sites
+- `ufo/convert/from_bin_data.rb:64/:82` Name records access
+- `ufo/convert/from_bin_data.rb:103/:105` Post italic_angle
+- `ufo/convert/from_bin_data.rb:131` Cmap unicode_mappings
+- `ufo/convert/from_bin_data.rb:149/:155` Hmtx parse/metric
+- `ufo/convert/from_bin_data.rb:172` Loca parse
+- `ufo/convert/from_bin_data.rb:192/:312/:323/:325` Glyph type (see TODO 15)
+- `ufo/convert/from_bin_data.rb:361` Post glyph_name
+- `ufo/compile/fvar.rb:23/:24` Info axes/named_instances
+- `stitcher/source.rb:83/:193/:220/:228/:287/:289/:375/:377` (see TODO 14/15)
+
+## Approach
+1. Replace `name_table.respond_to?(:name_records)` with `is_a?(Tables::Name)`.
+2. Replace `post.respond_to?(:italic_angle)` with `is_a?(Tables::Post)`.
+3. Replace `cmap_table.respond_to?(:unicode_mappings)` with `is_a?(Tables::Cmap)`.
+4. Replace `hmtx.respond_to?(:parse_with_context)` with `is_a?(Tables::Hmtx)`.
+5. Replace `loca.respond_to?(:parse_with_context)` with `is_a?(Tables::Loca)`.
+6. For `ufo/compile/fvar.rb`, the `font.info` is always a `Ufo::Info`.
+   Check `Ufo::Info#axes` exists; if not, add it.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/ufo/convert/` and `lib/fontisan/ufo/compile/`
+- 0 stitcher/source.rb respond_to? (split across TODO 14/15)

data/TODO.bug-fixes/18-generic-value-and-io-checks.md

@@ -0,0 +1,56 @@
+# 18 — Generic value and IO checks
+
+## Priority
+P3
+
+## Problem
+~20 `respond_to?` calls probe generic value shape (`:to_i`, `:bytesize`,
+`:to_binary_s`, `:empty?`, `:b`) or IO capabilities (`:seek`, `:rewind`).
+Some are valid duck-typing at system boundaries; others are dead
+defensive code.
+
+## Sites
+### Generic value conversion
+- `export/ttx_generator.rb:67/:474` `respond_to?(:to_i)`
+- `export/transformers/name_transformer.rb:47`
+- `export/transformers/post_transformer.rb:36`
+- `export/transformers/head_transformer.rb:45`
+- `export/transformers/maxp_transformer.rb:48`
+- `export/transformers/os2_transformer.rb:104`
+- `export/transformers/hhea_transformer.rb:44`
+- `export/transformers/font_to_ttx.rb:106`
+- `export/exporter.rb:184/:204/:209` `respond_to?(:to_binary_s)` / `:checksum`
+- `export/ttx_generator.rb:296/:435`
+
+### String/bytes shape
+- `utilities/padding.rb:30/:55` `respond_to?(:bytesize)`
+- `utilities/brotli_wrapper.rb:136` `respond_to?(:bytesize)`
+- `type1/decryptor.rb:115` `respond_to?(:b)` — String always has `.b`
+
+### IO capability
+- `binary/base_record.rb:27/:37` `respond_to?(:empty?)` / `:rewind`
+- `tables/cff/index.rb:61` `respond_to?(:seek)`
+
+### Charstring shape
+- `hints/postscript_hint_extractor.rb:60/:62` (see TODO 13)
+
+### Pattern matching
+- `optimizers/charstring_rewriter.rb:130` `respond_to?(:positions)`
+
+## Approach
+1. For `respond_to?(:to_i)`, replace with `Integer(value) rescue value`
+   — accepts Integer-coercible values, falls back to original.
+2. For `respond_to?(:bytesize)`, narrow the type at the boundary: accept
+   `String` only, call `.bytesize` directly.
+3. For `respond_to?(:to_binary_s)`, all BinData records respond to it.
+   Drop the check; if a non-BinData object is passed, fix the caller.
+4. For `respond_to?(:b)` on String, just call `.b` (String always has it).
+5. For IO `respond_to?(:seek)` / `:rewind`, accept `IO` / `StringIO`
+   only. Convert String inputs to StringIO at the boundary.
+6. For `respond_to?(:empty?)`, the BinData array always responds — drop.
+
+## Acceptance criteria
+- 0 unnecessary `respond_to?` in `lib/fontisan/export/`, `lib/fontisan/utilities/`,
+  `lib/fontisan/binary/`
+- Where duck-typing is genuinely needed at a system boundary, document
+  it with a comment

data/TODO.bug-fixes/19-serialization-migration.md

@@ -0,0 +1,52 @@
+# 19 — Hand-rolled serialization migration to lutaml-model
+
+## Priority
+P2
+
+## Problem
+5 sites hand-roll `to_h` / `to_hash` on model classes, bypassing
+lutaml-model's declarative serialization. Violates the absolute rule:
+"NEVER write `def to_h`, `def to_hash`, `def from_h`, `def from_hash` on
+a model class."
+
+## Sites
+- `lib/fontisan/tables/hmtx.rb:54` `def to_h` — manual hash from instance vars
+- `lib/fontisan/tables/cff/dict.rb:112` `def to_h` — manual hash
+- `lib/fontisan/type1/generator.rb:167` `def to_hash` — manual result hash
+- `lib/fontisan/type1/conversion_options.rb:105` `def to_hash` — manual hash
+- `lib/fontisan/ufo/point.rb:32` `def to_h` — manual hash for GLIF output
+
+## Approach
+For each model class:
+
+1. Make it inherit from `Lutaml::Model::Serializable`.
+2. Replace instance variables with `attribute :name, :type` declarations.
+3. Replace `to_h` / `to_hash` with a `key_value do ... end` mapping block.
+4. Callers use `model.to_hash` (framework-provided) instead of
+   hand-rolled `to_h`.
+
+### Special considerations
+
+- **`Ufo::Point#to_h`**: produces a Hash for GLIF XML output. The
+  lutaml-model `key_value` mapping with `:x`, `:y`, `:type`, `:smooth`
+  fields handles this. The `smooth: true` only-if-set behavior is
+  modeled via lutaml-model's optional attribute pattern.
+
+- **`Type1::Generator#to_hash`**: this is a *result* hash, not a model
+  serialization. Rename to `#to_result_hash` (or expose individual
+  accessors) to clarify it's not lutaml-model-shaped. OR convert the
+  result to a `Models::Type1GenerationResult` model.
+
+- **`Type1::ConversionOptions#to_hash`**: this is a value object
+  representing conversion options. Migrate to lutaml-model with
+  `attribute` declarations for each option.
+
+- **`Tables::Hmtx#to_h`**: BinData records already provide `snapshot`.
+  Remove the hand-rolled `to_h` and let callers use `snapshot`.
+
+- **`Tables::Cff::Dict#to_h`**: same — use `snapshot`.
+
+## Acceptance criteria
+- 0 `def to_h` / `def to_hash` in `lib/fontisan/` (excluding lutaml-model
+  framework methods)
+- All serialization goes through `lutaml-model`

data/TODO.bug-fixes/20-variation-validator-type-checks.md

@@ -0,0 +1,29 @@
+# 20 — Variation validator type checks
+
+## Priority
+P2
+
+## Problem
+11 `respond_to?` calls in `lib/fontisan/variation/validator.rb` probe
+typed BinData records (Cff2, Hvar, ItemVariationStore, RegionList).
+The checks were left in place in PR #136 because `validator_spec.rb`
+uses minimal doubles without all the methods stubbed.
+
+## Sites
+- :106 `cff2.respond_to?(:num_axes)` — Cff2 always declares num_axes
+- :136 `table.respond_to?(:item_variation_store)` — Hvar/Vvar/Mvar all do
+- :142 `store.respond_to?(:region_list)` — ItemVariationStore has it
+- :144 `region_list.respond_to?(:axis_count)` — RegionList has it
+- :199 `hvar.respond_to?(:item_variation_store)` — Hvar has it
+- :211 `store.respond_to?(:item_variation_data)` — ItemVariationStore has it
+- :275/:278/:281/:286 region/region_list/region_axes checks
+
+## Approach
+1. Replace `respond_to?` with direct method calls.
+2. Wrap in begin/rescue NoMethodError OR pre-validate with is_a?.
+3. Update `validator_spec.rb` doubles to provide all methods the
+   validator now calls directly. Use Struct-based fakes if helpful.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/variation/validator.rb`
+- All variation specs pass

data/TODO.bug-fixes/21-xml-builder-send.md

@@ -0,0 +1,24 @@
+# 21 — XML builder send() → tag!
+
+## Priority
+P2
+
+## Problem
+3 `xml.send(tag.to_sym)` calls in export/ use `.send` to create XML
+elements with dynamic tag names. This violates the "no private send"
+rule even though it's a common Ruby XML builder pattern.
+
+## Sites
+- `lib/fontisan/models/ttx/tables/binary_table.rb:21` `xml.send(tag.to_sym)`
+- `lib/fontisan/export/ttx_generator.rb:297` `xml.send(tag.to_sym)`
+- `lib/fontisan/export/ttx_generator.rb:313` `xml.send(clean_tag.to_sym)`
+
+## Approach
+Replace `xml.send(tag.to_sym) { ... }` with `xml.tag!(tag) { ... }`
+(or the Builder-native equivalent public method). Builder::XmlMarkup
+and Nokogiri::XML::Builder both expose `tag!` as the public dynamic
+element creator.
+
+## Acceptance criteria
+- 0 `send(` in `lib/fontisan/export/` and `lib/fontisan/models/ttx/`
+- All export/ttx specs pass

data/TODO.bug-fixes/22-type1-converter-font-info.md

@@ -0,0 +1,25 @@
+# 22 — Type1Converter font_info fields
+
+## Priority
+P2
+
+## Problem
+6 `respond_to?` calls in `lib/fontisan/converters/type1_converter.rb`
+probe `font_info` for typed fields (family_name, full_name, version,
+copyright, weight, notice). The font_info is always a `Type1::FontInfo`
+model — these fields are declared.
+
+## Sites
+- :723/:728/:733/:738/:744/:749 font_info field probes
+
+Plus 1 site at :160: `font.font_dictionary.respond_to?(:reload)` —
+FontDictionary is a typed class.
+
+## Approach
+1. Verify `Type1::FontInfo` declares all the probed fields.
+2. Replace `font_info.respond_to?(:family_name)` with direct call.
+3. For `font_dictionary.respond_to?(:reload)`, use `is_a?(Type1Font::FontDictionary)`.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/converters/type1_converter.rb`
+- All Type1 converter specs pass

data/TODO.bug-fixes/23-boundary-type-checks.md

@@ -0,0 +1,31 @@
+# 23 — Boundary type checks (padding, base_record)
+
+## Priority
+P3
+
+## Problem
+4 `respond_to?` calls in `utilities/padding.rb` and `binary/base_record.rb`
+are at String/IO system boundaries. They're the last remaining
+"legitimate" duck-typing sites, but the rule is absolute: no
+respond_to?.
+
+## Sites
+- `padding.rb:30/:55` `size.respond_to?(:bytesize) ? size.bytesize : size`
+  — accepts both String (uses bytesize) and Integer (uses self)
+- `base_record.rb:27` `io.respond_to?(:empty?) && io.empty?` — String check
+- `base_record.rb:37` `io.respond_to?(:rewind)` — IO check (String has no rewind)
+
+## Approach
+
+### padding.rb
+- Change the signature: accept Integer only. Callers that have a
+  String compute `.bytesize` before calling.
+
+### base_record.rb
+- Convert String input to StringIO at the boundary (in `self.read`).
+  After conversion, `io` is always a StringIO/IO and responds to
+  `rewind`/`empty?` natively. Drop the respond_to? guards.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/utilities/` and `lib/fontisan/binary/`
+- All padding and base_record specs pass

data/TODO.bug-fixes/24-validator-dynamic-field-key.md

@@ -0,0 +1,25 @@
+# 24 — Validator dynamic field_key
+
+## Priority
+P3
+
+## Problem
+`lib/fontisan/validators/validator.rb:294` uses `table.respond_to?(field_key)`
+to dynamically check whether a table has a named field. This is a
+meta-programming pattern for running field-by-field validation rules.
+
+## Site
+- :294 `value = if table.respond_to?(field_key)`
+
+## Approach
+Replace the dynamic field lookup with BinData's `snapshot` hash.
+BinData records expose all declared fields via `snapshot`, which
+returns a hash of field name → value. Use `snapshot.key?(field_key)`
+instead of `respond_to?`.
+
+Alternatively, declare a typed `FieldValueAccessor` on each table
+model that exposes declared fields as a hash.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/validators/validator.rb`
+- All validator specs pass

data/TODO.bug-fixes/25-serialization-migration.md

@@ -0,0 +1,49 @@
+# 25 — Serialization migration to lutaml-model
+
+## Priority
+P2
+
+## Problem
+6 sites hand-roll `to_h` / `to_hash` / `to_json` on model classes,
+violating the absolute rule against hand-rolled serialization.
+
+## Sites
+- `lib/fontisan/tables/hmtx.rb:54` `MetricRecord#to_h` — BinData inner record
+- `lib/fontisan/tables/cff/dict.rb:112` `Dict#to_h` — internal hash accessor
+- `lib/fontisan/type1/generator.rb:167` `Generator#to_hash` — option snapshot
+- `lib/fontisan/type1/conversion_options.rb:105` `ConversionOptions#to_hash` — option snapshot
+- `lib/fontisan/ufo/point.rb:32` `Point#to_h` — GLIF XML output
+- `lib/fontisan/export/exporter.rb:65` `Result#to_json` — export payload
+
+## Approach (per site)
+
+### Hmtx::MetricRecord#to_h
+BinData records expose `snapshot` returning a hash. Remove `to_h`,
+update callers (in stitcher/, type1/) to use `metric.snapshot` or
+extract `[:advance_width]` / `[:lsb]` directly.
+
+### Cff::Dict#to_h
+`Dict` wraps an internal `@dict` hash. `to_h` returns `@dict.dup`.
+Rename to `#raw_hash` (or `#pairs`) to make clear it's an accessor,
+not serialization. Update callers in `cff/table_builder.rb`,
+`cff/private_dict_writer.rb`.
+
+### Type1::Generator#to_hash and Type1::ConversionOptions#to_hash
+These are option snapshots, not wire serialization. Rename to
+`#to_options_hash` to clarify intent. Migrate `ConversionOptions`
+to a `Lutaml::Model::Serializable` for declarative attribute
+management.
+
+### Ufo::Point#to_h
+Used for GLIF XML output. Migrate `Ufo::Point` to inherit from
+`Lutaml::Model::Serializable` with `:x`, `:y`, `:type`, `:smooth`
+attributes and a `key_value` mapping.
+
+### Export::Result#to_json
+Used for export payload. Migrate to a `Models::ExportResult`
+lutaml-model with JSON mapping.
+
+## Acceptance criteria
+- 0 `def to_h` / `def to_hash` / `def to_json` in `lib/fontisan/`
+- All serialization goes through lutaml-model or BinData snapshot
+- All affected specs pass

data/TODO.bug-fixes/26-variation-preserver-spec-migration.md

@@ -0,0 +1,25 @@
+# 26 — Variation preserver spec migration
+
+## Priority
+P3
+
+## Problem
+`lib/fontisan/variation/variation_preserver.rb:153` still uses
+`respond_to?(:has_table?) && respond_to?(:table_data)` because the
+spec uses `instance_double(TrueTypeFont)` with extensive per-test
+stubs. Replacing with `is_a?(SfntSource)` requires migrating the
+spec to use `SpecHelpers::FakeFont`.
+
+## Site
+- `variation_preserver.rb:151-154` (with TODO comment)
+- `spec/fontisan/variation/variation_preserver_spec.rb` (entire file)
+
+## Approach
+1. Update spec to use `SpecHelpers::FakeFont` instead of `instance_double`.
+2. For per-test variations, mutate `font.tables_hash` instead of
+   stubbing `has_table?`/`table_data`.
+3. Replace `respond_to?` check in production with `is_a?(SfntSource)`.
+
+## Acceptance criteria
+- 0 `respond_to?` in `lib/fontisan/variation/variation_preserver.rb`
+- All variation_preserver specs pass