chore(fonts): upgrade subset-font 2.5.0 to 2.9.0

[jasonhnd]

Closes #643

Part of #635 (order 7). Base preview. Blocked-by order 6 is 3a12fd77 (PR #655).

Edits mapped to やること

1. Branch chore/subset-font-2.9.0 from origin/preview 3a12fd77 (order 6 merged). Bun 1.4.2 (1.4.2+744846f84) installed privately at /tmp/bun-1.4.2 and prepended to PATH. Global Bun was not upgraded (bun upgrade was not run; ~/.bun was not written). Node v24.20.0. No PUBLIC_GA4_MEASUREMENT_ID / PUBLIC_X_PIXEL_ID / PUBLIC_META_PIXEL_ID.
2. package.json devDependencies["subset-font"]: ^2.5.0 → ^2.9.0. scripts/subset-fonts.ts was not edited. No other package range changed. Commit 7ff75ef4.
3. bun install (Bun 1.4.2). Resolved subset-font@2.9.0 and harfbuzzjs@1.6.2. Exactly one harfbuzzjs package entry. lockfileVersion stayed 1. See Lockfile greps.
4. Font oracle: no [subset-fonts] log diff. 4/4 files byte-identical, same content hashes as the 2026-09-24 dry run. Fallback (a)–(c) and the visual compare were not required. See Font oracle.
5. Standard chain below, run after commit 7ff75ef4 so git diff --exit-code is the generated-file check. All exit 0. Results match the dry-run table (typecheck / test / build / REQUIRE_BUILT_ARTIFACTS / verify:gates OK; Playwright 356 passed, 26 skipped, 0 failed; bun audit no vulnerabilities).
6. Docs:
   • CHANGELOG.md ### Changed: - **subset-font 2.5.0 → 2.9.0 (harfbuzzjs 1.6)** — font subsets byte-identical. Commit 7ff75ef4. The Issue's | changed (sizes …) alternative does not apply.
   • docs/TOOLCHAIN.md §11 order 7: — done (#656). Follow-up commit 4e93af49. subset-font has no §2 row; none added.

Lockfile diff

git diff --numstat 3a12fd77 for the bump (commit 7ff75ef4, includes the one-line changelog):

1	0	CHANGELOG.md
4	4	bun.lock
1	1	package.json

bun install wrote bun.lock; it was not hand-edited. The hunks are:

1. Embedded workspace range "subset-font": "^2.5.0" → "^2.9.0".
2. Package entry harfbuzzjs@0.10.3 → harfbuzzjs@1.6.2.
3. Removal of lodash@4.18.1. subset-font 2.9.0 no longer depends on lodash (2.5.0 declared lodash: ^4.17.21). No other package entry referenced that key. lodash.defaults / lodash.difference and the other lodash.* packages stay.
4. Package entry subset-font@2.5.0 → subset-font@2.9.0 (harfbuzzjs: ^1.6.1, no lodash).

The dry-run table does not give a bun.lock numstat. The grep checks in やること step 3 match the table.

Lockfile greps

grep -n '"subset-font": \["subset-font@' bun.lock
815:    "subset-font": ["subset-font@2.9.0", "", { "dependencies": { "fontverter": "^2.0.0", "harfbuzzjs": "^1.6.1", "p-limit": "^3.1.0" } }, "sha512-WJulQeFwbewrXIGcLJbSZFWI44fHW8gNRuPzLywfDL8w38IPRbN1JFxwG76aoohw9kcFdvjVIn2QmID1iy119A=="],

grep -n '"harfbuzzjs": \["harfbuzzjs@' bun.lock
549:    "harfbuzzjs": ["harfbuzzjs@1.6.2", "", {}, "sha512-95c1vWuzoHjM19d5fQgPbz1wcv1pTa0UM9dZrdPgSMUEVuSwuzeVPkq6UhHHw3jLOkE9AYzzTP8XQkRBpPYpEg=="],

grep -c '"harfbuzzjs": \["harfbuzzjs@' bun.lock
1

grep -n 'lockfileVersion' bun.lock
2:  "lockfileVersion": 1,

bun install log (Bun 1.4.2, after the range bump):

bun install v1.4.2 (744846f84)
Resolving dependencies
Resolved, downloaded and extracted [4]
Saved lockfile

+ subset-font@2.9.0

2 packages installed [378.00ms]

Installed packages: subset-font 2.9.0, harfbuzzjs 1.6.2.

Font oracle

unset PUBLIC_GA4_MEASUREMENT_ID PUBLIC_X_PIXEL_ID PUBLIC_META_PIXEL_ID. git stash + bun install built on subset-font 2.5.0 (+ subset-font@2.5.0); git stash pop + bun install built on subset-font 2.9.0 (+ subset-font@2.9.0). Both bun run build runs exited 0.

diff of [subset-fonts] lines: empty (no log diff).

font-faces.2e3e84f2eacd.css identical
manifest.8456563c2695.json identical
noto-serif-jp-600.8669d2e68dca.woff2 identical
plus-jakarta-sans-var.f8af52cab999.woff2 identical

Both sides:

[subset-fonts] 2 font files, serif=1102 sans=2399 unique codepoints, 302 KiB total
[subset-fonts] /fonts/font-faces.2e3e84f2eacd.css 1 KiB stylesheet
[subset-fonts] /fonts/noto-serif-jp-600.8669d2e68dca.woff2 276 KiB weights=400,500,600,700 preload; serif baseline=1054cp/268 KiB -> 1102cp/276 KiB (+48cp, +9 KiB)
[subset-fonts] /fonts/plus-jakarta-sans-var.f8af52cab999.woff2 25 KiB weights=400 700

These are the same four filenames as the dry-run table. cmp reported identical for each. Step 4's fallback (codepoint counts already match, ±5 % sizes, Playwright, and the 1440 / 768 / 375 visual compare) was not run because the files did not differ.

Verification (Bun 1.4.2+744846f84, Node v24.20.0)

Chain ran on commit 7ff75ef4. Each command exit 0.

bun run typecheck

$ node node_modules/@typescript/native/bin/tsc --noEmit

bun run test

bun run test runs build:data then bun test. ETL completed (556 occupations).

bun test v1.4.2 (744846f84)

 1725 pass
 0 fail
Ran 1725 tests across 168 files. [5.35s]

sector.test.ts prints two [og] sectors projection schema mismatch lines. Same pre-existing negative fixtures noted on #655; the run is 1725 pass / 0 fail.

bun run build

[check-lockfile-sync] OK — 14 deps match between package.json and bun.lock.
[check-analytics-config] OK — 6 script-src origins ok, 11 connect-src origins ok, 0 frame-src origins ok, 5 PUBLIC_* env vars documented.
[check-nested-html-comments] OK — scanned 71 files, no nested HTML comments.
00:08:40 [build] ✓ Completed in 6.95s.
00:08:40 [build] 844 page(s) built in 7.12s
00:08:40 [build] Complete!
[subset-fonts] 2 font files, serif=1102 sans=2399 unique codepoints, 302 KiB total
[check-geo-freshness] OK - GPT 6 SOL 2026-09-23, 556 occupations, mean=4.55
[check-rendered-leaks] OK — scanned 844 pages, no leaked tokens.
[compute-csp-hashes] OK — script-src/style-src already up to date (24 inline-script + 36 inline-style hash(es), 844 HTML files scanned).

The 844 route lines are omitted. CSP hashes unchanged.

REQUIRE_BUILT_ARTIFACTS=1 bun test scripts/home-css-loading.test.ts src/site/models-built.test.ts

bun test v1.4.2 (744846f84)
 10 pass
 0 fail
Ran 10 tests across 2 files. [104.00ms]

bun run verify:gates

[OK] projections pass L3 consistency checks
[check-geo-freshness] OK - GPT 6 SOL 2026-09-23, 556 occupations, mean=4.55
[check-model-redirects] OK - 12 bare model slug(s) redirect to their latest run
[check-analytics-spec] OK — 36 events / 46 params match analytics/spec.yaml (5 dynamic emit sites declared).
[check-architecture] no Edge entries — plane C is nodejs/Bun (TOOLCHAIN §9)
[check-architecture] ✓ all enforced layer boundaries respected
[check-doc-links] OK — 58 tracked Markdown files, 99 local link/image target(s)
[verify-occupation-routes] 556 occupations own 556 unique, indexable routes
✅ Internal-link integrity passed — every NEW href resolves; 0 pre-known broken targets remain (TODO).
✅ JSON-LD validation passed — all 843/844 pages structurally valid.
[diff-seo-baseline] capturing current dist-astro/ …
✓ URL set (urls.txt) — 844 URLs
✓ data file paths (data-files.txt) — 616 files
✓ sitemap.xml — 5002 lines
✓ image-sitemap.xml — 3897 lines
✓ SEO metadata (seo-metadata.jsonl) — 844 URLs compared
✓ OG / Twitter meta (og-meta.jsonl) — 844 URLs compared
✓ JSON-LD (json-ld.jsonl) — 844 URLs compared
✓ internal links + anchors (internal-links.jsonl) — 844 URLs compared
✅ SEO baseline clean — no drift.
[check-page-class] ✓ Page Class System invariants respected
[check-design-sync] OK — Design.md §21.2 and design-tokens.ts agree
[check-type-scale] OK — every font-size on a conformant surface is a scale token (0 warning(s))
[check-heading-rules] OK — no conformant surface sets heading type (0 warning(s))
[check-surface-coverage] OK — every file carrying design declarations belongs to a surface
[check-contrast] OK — 33 role × background combinations satisfy §2.2
[check-role-color] OK — every checked role uses its §4.7 colour token
[check-color-tokens] OK — no palette tint written raw
[compute-csp-hashes] OK — script-src has 24 inline-script hash(es) and matches dist-astro/.

bun x playwright test --reporter=line

Running 382 tests using 12 workers
  26 skipped
  356 passed (22.0s)

bun audit

bun audit v1.4.2 (744846f84)

No vulnerabilities found (checked 438 packages) [220.00ms]

438 is one fewer than the order-6 run (439) because lodash@4.18.1 left the lockfile with subset-font. The dry-run table says "No vulnerabilities found" and does not pin a package count.

git diff --exit-code

(empty)
exit=0

Issue #643 does not list vercel inspect or a preview curl. Those checks are not in this PR.

CI

gh pr checks 656 on head 4e93af49:

quality	pass	4m6s	https://github.com/jasonhnd/jobs/actions/runs/36018365558/job/107697172610
Vercel	pass	0	https://vercel.com/zkscio/jobs/DchGnyq2cMWczHEijDRYZB1JxmqL	Canceled by Ignored Build Step
Vercel Preview Comments	pass	0	https://vercel.com/github

The head commit is docs-only (docs/TOOLCHAIN.md), so scripts/vercel-ignore-build.sh skipped that build (exit 0 → skip). The code commit 7ff75ef4 deployed: Vercel status Deployment has completed at https://vercel.com/zkscio/jobs/Cw9nj2CxJfPXAzmT9scGqo2gXGjo. Preview: https://jobs-git-chore-subset-font-290-zkscio.vercel.app. quality on 7ff75ef4 was cancelled by the follow-up push (concurrency.cancel-in-progress, run 36018334775); the run that passed is the head run above.

Issue #643 does not list vercel inspect or a preview curl. Those commands were not run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobs	Ready	Preview	Sep 24, 2026 3:12pm UTC