Pre-push review: T-1827 / T-1828 web typography

diff --git a/prism/Services/WebRendering/WebTypography.swift b/prism/Services/WebRendering/WebTypography.swiftnew file mode 100644index 0000000..57ce73a--- /dev/null+++ b/prism/Services/WebRendering/WebTypography.swift@@ -0,0 +1,131 @@+//+//  WebTypography.swift+//  prism+//+//  The native side of the rendered document's typography variables (Req 1.4 /+//  10.3): the body font family the user picked in Settings (T-1827) and the+//  Dynamic Type base size (T-1828).+//+//  Pure and nonisolated by design. `WebDocumentControllerFactory.typographyVariables`+//  composes these into the single `applyTypography` variables dict, which is the ONLY+//  place typography state is assembled — see the note there on why a split push would+//  lose state rather than merely race.+//++import SwiftUI++/// Native → CSS typography mapping for the web-rendered document.+///+/// The values here mirror `document.css`'s `:root` fallbacks, which apply for the+/// frames before the first `applyTypography` lands (and if the bridge never comes+/// up at all). `DocumentCSSTypographyRulesTests` pins the two representations+/// together, the way `DocumentCSSContrastRulesTests` pins the contrast palette.+enum WebTypography {++    // MARK: - Body font family (T-1827)++    /// The fallback family stack, mirroring `document.css`'s `--prism-font-family`.+    ///+    /// Always emitted, even when the user has no font selected: `applyVariables` in+    /// prism-theme.js only ever *sets* custom properties, so omitting the variable+    /// after a family had been pushed would leave the previous inline value in place+    /// and "System" would never come back without a reload.+    static let systemFontStack =+        "-apple-system, BlinkMacSystemFont, \"SF Pro Text\", \"Helvetica Neue\", sans-serif"++    /// The `--prism-font-family` value for a user-selected family, falling back to+    /// the system stack when there is no selection (or the name is unusable).+    ///+    /// The user family is always FIRST and the system stack always follows, so a font+    /// that resolves on the picker's device but not in WebKit still renders readable+    /// text rather than the browser default serif.+    ///+    /// Only the proportional stack is affected — `--prism-font-mono` is untouched, so+    /// code blocks and inline code stay monospace (Req 1.4).+    static func fontFamilyValue(userFamily: String?) -> String {+        guard let userFamily, let quoted = cssQuotedFamily(userFamily) else {+            return systemFontStack+        }+        return "\(quoted), \(systemFontStack)"+    }++    /// Quotes a font family name as a CSS `<string>` token, or nil when the name+    /// cannot be represented safely.+    ///+    /// The family name is untrusted: `AppSettings.bodyFontFamily` is backed by a+    /// `UserDefaults` string that a user (or a restored/synced preference) can set to+    /// anything, so it is escaped rather than interpolated. Quoting is the boundary —+    /// inside a CSS string `;`, `{`, `}`, `:` and `<` are ordinary characters and+    /// cannot terminate the declaration or open a new rule. Backslash and the quote+    /// character itself are the only two that can, and both are escaped.+    ///+    /// Control characters (including newlines, which are outright illegal inside a CSS+    /// string) are rejected instead of escaped: they can only arrive from a tampered+    /// preference and no real family name contains one.+    static func cssQuotedFamily(_ family: String) -> String? {+        let trimmed = family.trimmingCharacters(in: .whitespacesAndNewlines)+        guard !trimmed.isEmpty else { return nil }+        guard !trimmed.unicodeScalars.contains(where: {+            CharacterSet.controlCharacters.contains($0)+        }) else { return nil }++        var escaped = String.UnicodeScalarView()+        for scalar in trimmed.unicodeScalars {+            if scalar == "\\" || scalar == "\"" {+                escaped.append("\\")+            }+            escaped.append(scalar)+        }+        return "\"\(String(escaped))\""+    }++    // MARK: - Dynamic Type (T-1828)++    /// The document body's base font size in CSS pixels, mirroring `document.css`'s+    /// `--prism-font-size`. This is the iOS Dynamic Type "Large" body size, and is+    /// deliberately used on macOS too — it is the size the web renderer has always+    /// used there, and changing it is not this fix's business.+    static let baseFontSizePx: Double = 17++    /// Apple's body point size for each Dynamic Type size (the values+    /// `UIFontMetrics(forTextStyle: .body)` resolves to). `.large` is the 17pt+    /// default, so its multiplier is exactly 1 and the pre-fix rendering is+    /// unchanged for users who never touched Larger Text.+    ///+    /// A table rather than a live `UIFontMetrics` call so the mapping is pure,+    /// testable off-device, and available on macOS — where SwiftUI still reports a+    /// `dynamicTypeSize` but UIKit's metrics do not exist. `WebTypographyBridgeTests`+    /// pins the table against `UIFontMetrics` on iOS, so it cannot drift from the OS.+    static func bodyPointSize(for size: DynamicTypeSize) -> Double {+        switch size {+        case .xSmall: return 14+        case .small: return 15+        case .medium: return 16+        case .large: return 17+        case .xLarge: return 19+        case .xxLarge: return 21+        case .xxxLarge: return 23+        case .accessibility1: return 28+        case .accessibility2: return 33+        case .accessibility3: return 40+        case .accessibility4: return 47+        case .accessibility5: return 53+        @unknown default: return baseFontSizePx+        }+    }++    /// The Dynamic Type multiplier relative to the default body size.+    static func dynamicTypeMultiplier(for size: DynamicTypeSize) -> Double {+        bodyPointSize(for: size) / baseFontSizePx+    }++    /// The `--prism-font-size` value: the base size resolved for the current Dynamic+    /// Type size. The app's own text-scale slider stays a separate multiplier+    /// (`--prism-scale`), so the stylesheet's+    /// `calc(var(--prism-font-size) * var(--prism-scale))` combines the two — system+    /// accessibility scaling and the in-app setting compound rather than override+    /// each other (Req 10.3).+    static func fontSizeValue(dynamicTypeSize: DynamicTypeSize) -> String {+        String(format: "%.2fpx", bodyPointSize(for: dynamicTypeSize))+    }+}

diff --git a/prism/ViewModels/WebDocumentControllerFactory.swift b/prism/ViewModels/WebDocumentControllerFactory.swiftindex e84f4b2..c1457e8 100644--- a/prism/ViewModels/WebDocumentControllerFactory.swift+++ b/prism/ViewModels/WebDocumentControllerFactory.swift@@ -16,6 +16,7 @@  import Foundation import OSLog+import SwiftUI import WebKit  @MainActor@@ -239,14 +240,16 @@ enum WebDocumentControllerFactory {     /// `data-prism-contrast` (T-1829) — so only the theme key, the contrast state, and     /// the typography scale variables are pushed, not every colour.     ///-    /// `contrast` carries no default on purpose. A silently-`.standard` default is the-    /// exact shape of the T-1829 regression — a push path that keeps compiling while-    /// dropping the contrast state — so every caller has to state its intent.+    /// `contrast` and `dynamicTypeSize` carry no default on purpose. A silently-+    /// `.standard`/`.large` default is the exact shape of the T-1829 and T-1828+    /// regressions — a push path that keeps compiling while dropping a system+    /// accessibility state — so every caller has to state its intent.     static func pushInitialState(         to controller: WebDocumentController,         settings: AppSettings,         themeKey: String,-        contrast: WebContrastMode+        contrast: WebContrastMode,+        dynamicTypeSize: DynamicTypeSize     ) {         controller.applyTheme(             theme: themeKey,@@ -254,7 +257,9 @@ enum WebDocumentControllerFactory {             variables: [:],             mermaidConfig: mermaidThemeConfigJSON(for: themeKey)         )-        controller.applyTypography(variables: typographyVariables(settings: settings))+        controller.applyTypography(variables: typographyVariables(+            settings: settings, dynamicTypeSize: dynamicTypeSize+        ))         controller.setCommentVisibility(settings.showHTMLComments)     } @@ -351,13 +356,35 @@ enum WebDocumentControllerFactory {         )     } -    /// The CSS typography variables for the current text-scale setting (Req 1.4).-    /// Mirrors the SwiftUI text-scale path; iOS Dynamic Type changes re-push these-    /// (Req 10.3).-    static func typographyVariables(settings: AppSettings) -> [String: String] {+    /// The CSS typography variables for the current typography state (Req 1.4/10.3):+    /// the in-app text-scale setting, the Dynamic Type resolved base size (T-1828),+    /// and the selected body font family (T-1827).+    ///+    /// This is the ONLY place the typography variables are assembled, and that is a+    /// correctness requirement rather than tidiness. `applyTypography` carries one+    /// dict that WHOLLY REPLACES `WebDocumentStateSnapshot.typography`, so two+    /// pushers — say the settings-observing synchronizer and a view feeding Dynamic+    /// Type — would not race, they would silently drop each other's variables from+    /// the recovery replay. Every input is composed here and pushed once.+    ///+    /// `dynamicTypeSize` carries no default, for the reason `contrast` carries none+    /// on `pushInitialState`: a defaulted `.large` is invisible at the call site and+    /// is exactly the T-1828 bug — a push path that keeps compiling while dropping+    /// the system accessibility state.+    static func typographyVariables(+        settings: AppSettings,+        dynamicTypeSize: DynamicTypeSize+    ) -> [String: String] {         let resolver = TypographyResolver(from: settings)         return [             "--prism-scale": String(format: "%.3f", resolver.scaleFactor),+            "--prism-font-size": WebTypography.fontSizeValue(dynamicTypeSize: dynamicTypeSize),+            // `resolver.bodyFontFamily` is nil both for "System" and for a stored+            // family that no longer exists on this device (AppSettings filters through+            // FontUtilities), so an unavailable font falls back to the system stack.+            "--prism-font-family": WebTypography.fontFamilyValue(+                userFamily: resolver.bodyFontFamily+            ),         ]     } 

diff --git a/prism/ViewModels/WebDocumentStateSynchronizer.swift b/prism/ViewModels/WebDocumentStateSynchronizer.swiftindex 9944aaf..f02dddf 100644--- a/prism/ViewModels/WebDocumentStateSynchronizer.swift+++ b/prism/ViewModels/WebDocumentStateSynchronizer.swift@@ -23,6 +23,10 @@ //    - Theme: pushed through `applyTheme(themeKey:contrast:)`, fed by the hosting //      view (the effective theme depends on the view-world colorScheme, and the //      Increase Contrast state is a view-world environment value).+//    - Dynamic Type: `dynamicTypeSize` is also a view-world environment value, but+//      unlike theme it does NOT get its own push — it is stored here and folded into+//      the typography domain above, because `applyTypography` carries one variables+//      dict that wholly replaces the snapshot's typography (T-1828). // //  Change reaction runs through the Observation framework, NOT SwiftUI //  `.onChange`, so the wiring exists independent of any view being mounted —@@ -39,6 +43,7 @@  import Foundation import Observation+import SwiftUI  @MainActor final class WebDocumentStateSynchronizer {@@ -49,9 +54,18 @@ final class WebDocumentStateSynchronizer {     private let settings: AppSettings     private let notesManager: NotesManager -    /// Guards `start()` against arming a second observation pass.+    /// Guards `start(dynamicTypeSize:)` against arming a second observation pass.     private var isStarted = false +    /// The system Dynamic Type size the document is rendering at (T-1828). Seeded by+    /// `start(dynamicTypeSize:)` and updated by `applyDynamicTypeSize`, both fed by the+    /// hosting view — it is a view-world environment value, like `colorScheme`.+    ///+    /// Plain stored state, deliberately NOT a separate push: the typography domain+    /// below composes it with the settings-derived scale and family into the single+    /// `applyTypography` dict.+    private var dynamicTypeSize: DynamicTypeSize = .large+     // MARK: - Last-pushed values (the dirty flags)     //     // Each domain re-pushes only when its freshly computed value differs from@@ -101,9 +115,17 @@ final class WebDocumentStateSynchronizer {     /// intentionally NOT part of the pass: T-1680 owns the highlight pipeline     /// and adds its domain at this seam. Search NAVIGATION (scroll-to-match)     /// is wired below.-    func start() {+    ///+    /// `dynamicTypeSize` is a required parameter rather than a stored default the+    /// caller may or may not overwrite afterwards (T-1828): the first pass pushes+    /// typography, so a mount that forgot to feed Dynamic Type would render the+    /// document at the unscaled base size — the bug this fixes — while still+    /// compiling. Passing it here makes the first push already correct, so there is+    /// no default-then-correct flicker either.+    func start(dynamicTypeSize: DynamicTypeSize) {         guard !isStarted else { return }         isStarted = true+        self.dynamicTypeSize = dynamicTypeSize         synchronize()     } @@ -127,6 +149,23 @@ final class WebDocumentStateSynchronizer {         )     } +    /// Updates the Dynamic Type size and re-pushes typography if that changed the+    /// variables (T-1828). Called by the hosting view when the system Larger Text+    /// setting changes, so the rendered document rescales live — no reload, so the+    /// reading position is kept.+    ///+    /// This deliberately does NOT re-arm the observation pass: it re-composes the+    /// same typography dict `computePass` would, through the same dirty-diffed push+    /// helper, so a Dynamic Type change costs one push and cannot desynchronise from+    /// the settings-derived half.+    func applyDynamicTypeSize(_ size: DynamicTypeSize) {+        guard size != dynamicTypeSize else { return }+        dynamicTypeSize = size+        pushTypography(WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: size+        ))+    }+     // MARK: - The coalescing observation pass      /// Everything one tracked read computed: the desired value of each state@@ -190,7 +229,9 @@ final class WebDocumentStateSynchronizer {             mapped: mapped         )         return SyncPass(-            typography: WebDocumentControllerFactory.typographyVariables(settings: settings),+            typography: WebDocumentControllerFactory.typographyVariables(+                settings: settings, dynamicTypeSize: dynamicTypeSize+            ),             commentVisibility: settings.showHTMLComments,             noteIndicatorsJSON: notePayloads.indicatorsJSON,             inlineNotesJSON: notePayloads.inlineNotesJSON,@@ -225,10 +266,7 @@ final class WebDocumentStateSynchronizer {     /// the last push, then consumes the navigation targets. Runs outside the     /// tracked read, so pushes never register spurious dependencies.     private func dispatch(_ pass: SyncPass) {-        if pass.typography != lastTypography {-            lastTypography = pass.typography-            controller.applyTypography(variables: pass.typography)-        }+        pushTypography(pass.typography)         if pass.commentVisibility != lastCommentVisibility {             lastCommentVisibility = pass.commentVisibility             controller.setCommentVisibility(pass.commentVisibility)@@ -283,6 +321,17 @@ final class WebDocumentStateSynchronizer {         }     } +    /// The typography domain's single push site: dirty-diffed against the last+    /// pushed dict, so an unchanged recomposition costs nothing. Shared by the+    /// observation pass (settings-derived scale and body font) and+    /// `applyDynamicTypeSize` (the view-fed half), which is what keeps the two+    /// halves in one dict — see `typographyVariables` on why that matters (T-1828).+    private func pushTypography(_ variables: [String: String]) {+        guard variables != lastTypography else { return }+        lastTypography = variables+        controller.applyTypography(variables: variables)+    }+     // MARK: - Domain computations      /// Table display modes keyed by DOM id (Req 1.5): native keys are either

diff --git a/prism/Views/DocumentScrollContent.swift b/prism/Views/DocumentScrollContent.swiftindex 92c01c6..007864b 100644--- a/prism/Views/DocumentScrollContent.swift+++ b/prism/Views/DocumentScrollContent.swift@@ -55,6 +55,12 @@ struct DocumentScrollContent: View {     /// `colorScheme` — the two together form the palette the document renders in.     @Environment(\.colorSchemeContrast) private var colorSchemeContrast +    /// The system Dynamic Type size (T-1828). Another view-world environment value the+    /// rendered document needs, fed into the synchronizer's typography domain rather+    /// than pushed from here — `applyTypography` carries one variables dict, so the+    /// Dynamic Type half and the settings-derived half must be composed in one place.+    @Environment(\.dynamicTypeSize) private var dynamicTypeSize+     /// Image services, for the iOS sibling-image folder-access grant flow (Req 3.x).     @Environment(\.imageServices) private var imageServices @@ -114,7 +120,9 @@ struct DocumentScrollContent: View {                 selectionAffordance: selectionAffordance             )             webRouter = made.router-            made.synchronizer.start()+            // Dynamic Type is seeded into `start` rather than pushed after it, so the+            // very first typography push already carries the system size (T-1828).+            made.synchronizer.start(dynamicTypeSize: dynamicTypeSize)             // The theme stays view-fed: the effective key depends on colorScheme, and             // the Increase Contrast state alongside it is a view-world environment value.             made.synchronizer.applyTheme(@@ -153,6 +161,14 @@ struct DocumentScrollContent: View {         .onChange(of: paletteFeed) { _, feed in             synchronizer?.applyTheme(themeKey: feed.themeKey, contrast: feed.contrast)         }+        // Live Dynamic Type rescaling without a reload, so the reading position+        // survives an OS Larger Text change (Req 10.3, T-1828). Not folded into+        // `paletteFeed`: that feed exists so theme and contrast reach the page in ONE+        // applyTheme, and Dynamic Type is not part of the palette — it belongs to the+        // typography dict the synchronizer composes.+        .onChange(of: dynamicTypeSize) { _, size in+            synchronizer?.applyDynamicTypeSize(size)+        }         // Search highlights (Req 6.1/6.2/6.3/7.2, T-1680): re-push whenever the         // coordinator's debounced query, per-block counts (recomputed on block or         // comment-visibility changes), or current-match selection change. Both layouts

diff --git a/prism/Resources/WebRenderer/document.css b/prism/Resources/WebRenderer/document.cssindex 2a75fdd..4598e01 100644--- a/prism/Resources/WebRenderer/document.css+++ b/prism/Resources/WebRenderer/document.css@@ -13,12 +13,28 @@  * and inert under the document CSP (Req 8.6).  */ -/* ---- Typography scale (overridden per document via applyTypography) ---- */+/* ---- Typography scale (overridden per document via applyTypography) ----+ *+ * These three are FALLBACKS, not the effective values: applyTypography overwrites+ * --prism-font-family, --prism-font-size and --prism-scale as inline custom properties+ * on <html> on every push, so what is declared here only paints the frames before the+ * bridge's first push (and if the bridge never comes up).+ *+ * --prism-font-family carries the user's Body Font choice ahead of this stack (T-1827),+ * safely quoted natively; --prism-font-size carries the Dynamic Type resolved base size+ * (T-1828). Both mirror WebTypography's Swift constants, pinned by+ * DocumentCSSTypographyRulesTests. --prism-font-mono is NOT pushed: code stays monospace+ * whatever body font is chosen.+ */ :root {     --prism-font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", "Helvetica Neue", sans-serif;     --prism-font-mono: "SF Mono", ui-monospace, Menlo, Monaco, "Courier New", monospace; -    /* Base size scaled by the user's text-size setting / Dynamic Type (Req 1.4/10.3). */+    /*+     * Base size scaled by the user's text-size setting / Dynamic Type (Req 1.4/10.3).+     * Dynamic Type resolves --prism-font-size; the in-app slider is --prism-scale, and+     * the body rule multiplies them so the two compound.+     */     --prism-font-size: 17px;     --prism-line-height: 1.6;     --prism-scale: 1;

diff --git a/prism/Resources/WebRenderer/prism-theme.js b/prism/Resources/WebRenderer/prism-theme.jsindex 6e8c5ce..d2b5e1b 100644--- a/prism/Resources/WebRenderer/prism-theme.js+++ b/prism/Resources/WebRenderer/prism-theme.js@@ -44,6 +44,12 @@     });      // ---- Typography (Req 1.4 / Dynamic Type Req 10.3) --------------------+    // Native composes the WHOLE variables dict — the in-app text scale, the Dynamic+    // Type resolved base size (T-1828), and the user's Body Font family already+    // quoted as a CSS string (T-1827) — and pushes it in one command, so this only+    // applies it. The family is never assembled here: escaping an untrusted family+    // name is native's job (WebTypography), and splitting the dict across pushes+    // would drop variables from the coalesced recovery replay.     bridge.registerCommand("applyTypography", function (payload) {         if (!payload) { return null; }         applyVariables(payload.variables);

diff --git a/prismTests/WebRendering/WebTypographyBridgeTests.swift b/prismTests/WebRendering/WebTypographyBridgeTests.swiftnew file mode 100644index 0000000..3a5a7ab--- /dev/null+++ b/prismTests/WebRendering/WebTypographyBridgeTests.swift@@ -0,0 +1,464 @@+//+//  WebTypographyBridgeTests.swift+//  prismTests+//+//  Regression tests for T-1827 (the Body Font setting was ignored by web-rendered+//  documents) and T-1828 (iOS Dynamic Type did not scale them).+//+//  Both were T-1542 cutover gaps of the same shape: the spec stated the mapping+//  (webview-rendering Req 1.4 / 10.3, design "content-size-category changes trigger+//  applyTypography"), but `typographyVariables` only ever emitted `--prism-scale`.+//  The document kept the stylesheet's fixed system stack and its fixed 17px base, so+//  the Settings picker moved only the native preview and OS Larger Text moved only+//  the app chrome.+//+//  The fix composes ALL typography inputs — in-app scale, Dynamic Type resolved base+//  size, user body family — into the single `applyTypography` variables dict. That+//  single-composition-site property is itself load-bearing: the command's dict wholly+//  replaces `WebDocumentStateSnapshot.typography`, so two pushers would drop each+//  other's variables from the recovery replay rather than merely race. The tests+//  below cover the escaping boundary, the Dynamic Type mapping, the composed push,+//  live changes through the production assembly, recovery replay, and the live page.+//++import SwiftUI+import Testing+import WebKit+@testable import prism++@Suite("Typography reaches the rendered document (T-1827/T-1828)")+@MainActor+struct WebTypographyBridgeTests {++    /// A font family that genuinely exists on the running platform, so+    /// `AppSettings.bodyFontFamily`'s `FontUtilities` existence filter passes.+    private static func installedFamily() throws -> String {+        try #require(FontUtilities.allFamilies.first, "the test host must have fonts")+    }++    /// Whether the interior of a quoted CSS string contains a quote that is not+    /// escaped — i.e. whether the string terminates before its closing delimiter.+    /// Walks the scalars the way a CSS tokenizer does: a backslash consumes the+    /// scalar after it.+    private static func hasUnescapedQuote(inside quoted: String) -> Bool {+        let interior = Array(quoted.unicodeScalars.dropFirst().dropLast())+        var index = 0+        while index < interior.count {+            if interior[index] == "\\" {+                index += 2+                continue+            }+            if interior[index] == "\"" { return true }+            index += 1+        }+        return false+    }++    private func sampleBlocks() -> [MarkdownBlock] {+        [+            .heading(level: 1, text: "Doc"),+            .paragraph(markdown: "Body text."),+            .codeBlock(language: "swift", code: "let x = 1"),+        ]+    }++    // MARK: - CSS escaping boundary (T-1827 security note)++    @Test("A family name is emitted as a quoted CSS string")+    func familyIsQuoted() {+        #expect(WebTypography.cssQuotedFamily("Helvetica Neue") == "\"Helvetica Neue\"")+    }++    @Test("A family name cannot break out of the declaration")+    func familyCannotBreakOut() throws {+        // Each of these is a breakout attempt through the value: end the declaration,+        // close the rule and open a new one, or smuggle a second property. Inside a+        // quoted CSS string every one of them is an ordinary character, so the whole+        // hostile name must survive INSIDE the quotes and nothing may leak outside.+        let attempts = [+            "Evil; color: red",+            "Evil} body { display: none } .x {",+            // The one a naive `"\(family)"` interpolation lets through: the value's own+            // double quote closes the string early and everything after it becomes live+            // CSS. `liveTypographyVariablesApply` proves WebKit agrees.+            "Evil\"; } body { display: none } .x { color: red",+            "Evil'; background: url(http://evil.example)",+            "Evil:hover",+            "Evil</style><script>alert(1)</script>",+        ]+        for attempt in attempts {+            let quoted = try #require(WebTypography.cssQuotedFamily(attempt))+            #expect(quoted.hasPrefix("\""))+            #expect(quoted.hasSuffix("\""))+            // No UNESCAPED quote inside the delimiters: one would close the string+            // early and everything after it would be live CSS. Counting quotes is not+            // enough — an escaped \" is still a quote character — so the interior is+            // walked the way a CSS tokenizer would.+            #expect(!Self.hasUnescapedQuote(inside: quoted), "unescaped quote in \(quoted)")++            let value = WebTypography.fontFamilyValue(userFamily: attempt)+            // The system fallback stack is appended after the closing quote, and it is+            // the ONLY thing after it — the hostile text stays inside the string.+            #expect(value == "\(quoted), \(WebTypography.systemFontStack)")+        }+    }++    @Test("Embedded quotes and backslashes are escaped, not dropped")+    func quotesAndBackslashesEscaped() throws {+        // A literal double quote must become \" or it would terminate the string.+        let quoted = try #require(WebTypography.cssQuotedFamily("My \"Font\""))+        #expect(quoted == "\"My \\\"Font\\\"\"")++        // A trailing backslash is the classic escape-the-escape trick: unescaped, it+        // would consume the closing quote and let everything after it become CSS.+        let trailing = try #require(WebTypography.cssQuotedFamily("Font\\"))+        #expect(trailing == "\"Font\\\\\"")+    }++    @Test("Unusable family names fall back to the system stack")+    func unusableNamesFallBack() {+        // Control characters (a newline is outright illegal inside a CSS string) are+        // rejected rather than escaped — they can only come from a tampered+        // preference, never from the font picker.+        #expect(WebTypography.cssQuotedFamily("Evil\nBody { }") == nil)+        #expect(WebTypography.cssQuotedFamily("Evil\u{0}") == nil)+        #expect(WebTypography.cssQuotedFamily("") == nil)+        #expect(WebTypography.cssQuotedFamily("   ") == nil)++        #expect(WebTypography.fontFamilyValue(userFamily: nil) == WebTypography.systemFontStack)+        #expect(+            WebTypography.fontFamilyValue(userFamily: "Evil\nBody { }")+                == WebTypography.systemFontStack+        )+    }++    @Test("The user's family is first and the system stack still follows it")+    func userFamilyLeadsTheStack() {+        let value = WebTypography.fontFamilyValue(userFamily: "Palatino")+        #expect(value.hasPrefix("\"Palatino\", "))+        // The fallbacks must survive: a family the picker resolved but WebKit cannot+        // must still render as readable sans-serif, not the browser default serif.+        #expect(value.hasSuffix(WebTypography.systemFontStack))+    }++    // MARK: - Dynamic Type mapping (T-1828)++    @Test("The default Dynamic Type size leaves the base size unchanged")+    func defaultSizeIsNeutral() {+        #expect(WebTypography.dynamicTypeMultiplier(for: .large) == 1.0)+        #expect(WebTypography.bodyPointSize(for: .large) == WebTypography.baseFontSizePx)+    }++    @Test("The Dynamic Type multiplier increases monotonically across every size")+    func multiplierIsMonotonic() {+        var previous = 0.0+        for size in DynamicTypeSize.allCases {+            let multiplier = WebTypography.dynamicTypeMultiplier(for: size)+            #expect(multiplier > previous, "\(size) must scale above the previous size")+            previous = multiplier+        }+        // The accessibility range must actually be large, not a rounding nudge —+        // this is the setting the ticket's reproduction uses.+        #expect(WebTypography.dynamicTypeMultiplier(for: .accessibility5) > 3.0)+        #expect(WebTypography.dynamicTypeMultiplier(for: .xSmall) < 1.0)+    }++    #if os(iOS)+    @Test("The Dynamic Type table matches UIKit's own body metrics (device pin)")+    func tableMatchesUIFontMetrics() {+        // Anti-drift against the OS rather than against a second copy of our own+        // numbers: the table exists so the mapping is pure and works on macOS, but it+        // is only correct while it agrees with what UIKit resolves on device.+        for size in DynamicTypeSize.allCases {+            let traits = UITraitCollection { mutable in+                mutable.preferredContentSizeCategory = UIContentSizeCategory(size)+            }+            let resolved = UIFontMetrics(forTextStyle: .body).scaledValue(+                for: WebTypography.baseFontSizePx, compatibleWith: traits+            )+            #expect(+                abs(resolved - WebTypography.bodyPointSize(for: size)) < 0.51,+                "\(size): UIKit resolves \(resolved)"+            )+        }+    }+    #endif++    // MARK: - The composed push++    @Test("The typography push carries the selected body font family (T-1827)")+    func typographyCarriesBodyFont() throws {+        let family = try Self.installedFamily()+        let settings = AppSettings.makeForTesting(bodyFontFamily: family)+        let variables = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )+        let value = try #require(variables["--prism-font-family"])+        #expect(value == "\"\(family)\", \(WebTypography.systemFontStack)")+    }++    @Test("A body font choice never changes the monospace stack (code stays code)")+    func codeStaysMonospace() throws {+        let family = try Self.installedFamily()+        let settings = AppSettings.makeForTesting(bodyFontFamily: family)+        let variables = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )+        // --prism-font-mono is never pushed, so the stylesheet's monospace stack keeps+        // applying to code blocks and inline code (Req 1.4).+        #expect(variables["--prism-font-mono"] == nil)+    }++    @Test("A stored font family that no longer exists falls back to the system stack")+    func unavailableFontFallsBack() {+        // The reproduction is a preference synced from a device that had the font.+        // AppSettings filters through FontUtilities, so the resolver sees nil.+        let settings = AppSettings.makeForTesting(bodyFontFamily: "Definitely Not Installed 9Z")+        let variables = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )+        #expect(variables["--prism-font-family"] == WebTypography.systemFontStack)+    }++    @Test("Clearing the font back to System re-pushes the plain system stack")+    func clearingFontRestoresSystemStack() throws {+        // The variable is emitted unconditionally on purpose: prism-theme.js only+        // ever SETS custom properties, so omitting it when the user picks "System"+        // would leave the previous family as an inline style forever.+        let family = try Self.installedFamily()+        let settings = AppSettings.makeForTesting(bodyFontFamily: family)+        #expect(WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )["--prism-font-family"] != WebTypography.systemFontStack)++        settings.bodyFontFamily = nil+        #expect(WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )["--prism-font-family"] == WebTypography.systemFontStack)+    }++    @Test("The typography push carries a Dynamic Type resolved base size (T-1828)")+    func typographyCarriesDynamicType() {+        let settings = AppSettings.makeForTesting()+        let atDefault = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .large+        )+        #expect(atDefault["--prism-font-size"] == "17.00px")++        let enlarged = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .accessibility3+        )+        #expect(enlarged["--prism-font-size"] == "40.00px")+    }++    @Test("Dynamic Type and the in-app text scale compound, not override")+    func dynamicTypeAndAppScaleCompound() {+        // Req 10.3: "rendered content combines Dynamic Type with the app scale". They+        // ride separate variables and the stylesheet multiplies them, so raising one+        // must not flatten the other.+        let settings = AppSettings.makeForTesting(textSizeScale: 150)+        let variables = WebDocumentControllerFactory.typographyVariables(+            settings: settings, dynamicTypeSize: .accessibility1+        )+        #expect(variables["--prism-scale"] == "1.500")+        #expect(variables["--prism-font-size"] == "28.00px")+    }++    // MARK: - Recovery replay (Req 9.6)++    @Test("The coalesced snapshot replays the composed typography after a recovery")+    func snapshotReplaysTypography() {+        var snapshot = WebDocumentStateSnapshot()+        let variables = [+            "--prism-scale": "1.200",+            "--prism-font-size": "28.00px",+            "--prism-font-family": "\"Palatino\", \(WebTypography.systemFontStack)",+        ]+        snapshot.apply(.applyTypography(variables: variables))+        #expect(snapshot.typography == variables)+        #expect(snapshot.coalescedCommands().contains(.applyTypography(variables: variables)))+    }++    @Test("A font-only and a Dynamic Type-only change are each a distinct snapshot")+    func typographyChangesSnapshotIdentity() {+        func snapshot(_ variables: [String: String]) -> WebDocumentStateSnapshot {+            var snapshot = WebDocumentStateSnapshot()+            snapshot.apply(.applyTypography(variables: variables))+            return snapshot+        }+        let base = ["--prism-scale": "1.000", "--prism-font-size": "17.00px", "--prism-font-family": "a"]+        var fontChanged = base+        fontChanged["--prism-font-family"] = "b"+        var sizeChanged = base+        sizeChanged["--prism-font-size"] = "23.00px"++        // Both must be distinct values, or the synchronizer's dirty-diff would swallow+        // the push and the change would never reach the page.+        #expect(snapshot(base) != snapshot(fontChanged))+        #expect(snapshot(base) != snapshot(sizeChanged))+    }++    // MARK: - Production assembly (the seam the tickets faulted)++    private func makeAssembly(settings: AppSettings) async -> (+        controller: WebDocumentController,+        synchronizer: WebDocumentStateSynchronizer+    ) {+        let session = DocumentSession(+            url: URL(fileURLWithPath: "/tmp/t1827-typography-fixture.md"),+            content: "# Doc\n\nBody text.\n"+        )+        await session.parseContent()+        let made = WebDocumentStateSynchronizer.makeAssembly(+            session: session,+            settings: settings,+            coordinator: DocumentLayoutCoordinator(),+            notesManager: NotesManager()+        )+        return (made.controller, made.synchronizer)+    }++    /// Polls a condition, since the synchronizer's observation pass is scheduled.+    private func waitUntil(_ condition: () -> Bool) async -> Bool {+        for _ in 0..<40 {+            if condition() { return true }+            await Task.yield()+            try? await Task.sleep(for: .milliseconds(25))+        }+        return condition()+    }++    @Test("start seeds Dynamic Type into the very first typography push")+    func startSeedsDynamicType() async {+        let assembly = await makeAssembly(settings: AppSettings.makeForTesting())+        assembly.synchronizer.start(dynamicTypeSize: .accessibility2)+        let pushed = await waitUntil {+            assembly.controller.latestSnapshot.typography?["--prism-font-size"] == "33.00px"+        }+        // Seeded rather than corrected afterwards: the first push a fresh page (or a+        // post-recovery replay) sees must already be the system's size.+        #expect(pushed, "the first typography push must already carry the system Dynamic Type size")+    }++    @Test("A Dynamic Type change re-pushes typography without losing the settings half")+    func dynamicTypeChangeKeepsSettingsHalf() async throws {+        let family = try Self.installedFamily()+        let settings = AppSettings.makeForTesting(textSizeScale: 130, bodyFontFamily: family)+        let assembly = await makeAssembly(settings: settings)+        assembly.synchronizer.start(dynamicTypeSize: .large)+        _ = await waitUntil { assembly.controller.latestSnapshot.typography != nil }++        assembly.synchronizer.applyDynamicTypeSize(.accessibility1)+        let pushed = await waitUntil {+            assembly.controller.latestSnapshot.typography?["--prism-font-size"] == "28.00px"+        }+        #expect(pushed, "an OS Larger Text change must reach the page live")++        // The regression this guards: a separate Dynamic Type push would REPLACE the+        // snapshot's typography dict, silently dropping the scale and family from the+        // recovery replay.+        let typography = try #require(assembly.controller.latestSnapshot.typography)+        #expect(typography["--prism-scale"] == "1.300")+        #expect(typography["--prism-font-family"] == "\"\(family)\", \(WebTypography.systemFontStack)")+    }++    @Test("A Body Font change re-pushes typography without losing the Dynamic Type half")+    func fontChangeKeepsDynamicTypeHalf() async throws {+        let family = try Self.installedFamily()+        let settings = AppSettings.makeForTesting()+        let assembly = await makeAssembly(settings: settings)+        assembly.synchronizer.start(dynamicTypeSize: .accessibility1)+        _ = await waitUntil { assembly.controller.latestSnapshot.typography != nil }++        // The T-1827 reproduction: change the picker and return to the document.+        settings.bodyFontFamily = family+        let pushed = await waitUntil {+            assembly.controller.latestSnapshot.typography?["--prism-font-family"]+                == "\"\(family)\", \(WebTypography.systemFontStack)"+        }+        #expect(pushed, "a Body Font change must reach the page without a reload or reopen")++        let typography = try #require(assembly.controller.latestSnapshot.typography)+        #expect(typography["--prism-font-size"] == "28.00px", "the view-fed half must survive")+    }++    @Test("An unchanged Dynamic Type size does not re-push")+    func unchangedDynamicTypeDoesNotPush() async {+        let assembly = await makeAssembly(settings: AppSettings.makeForTesting())+        assembly.synchronizer.start(dynamicTypeSize: .large)+        _ = await waitUntil { assembly.controller.latestSnapshot.typography != nil }+        let before = assembly.controller.pendingCommands.count++        assembly.synchronizer.applyDynamicTypeSize(.large)+        #expect(assembly.controller.pendingCommands.count == before)+    }++    // MARK: - Live page++    @Test("applyTypography sets the font variables live, without a reload")+    func liveTypographyVariablesApply() async throws {+        let harness = try await WebDocumentLiveHarness.make(blocks: sampleBlocks())+        let urlBefore = harness.page.url++        let hostile = "Evil\"; } body { display: none } .x {"+        let family = WebTypography.fontFamilyValue(userFamily: hostile)+        try await harness.send(.applyTypography(variables: [+            "--prism-scale": "1.200",+            "--prism-font-size": "28.00px",+            "--prism-font-family": family,+        ]))+        try await Task.sleep(for: .milliseconds(100))++        let size = try await harness.evalString(+            "return document.documentElement.style.getPropertyValue('--prism-font-size');"+        )+        #expect(size?.trimmingCharacters(in: .whitespaces) == "28.00px")++        // The CSSOM accepted the family as ONE value; the hostile fragment did not+        // become a rule of its own. If the quoting had failed, either the property+        // would be empty (rejected as invalid) or `body` would now be display:none.+        let pushed = try await harness.evalString(+            "return document.documentElement.style.getPropertyValue('--prism-font-family');"+        )+        let pushedValue = try #require(pushed).trimmingCharacters(in: .whitespaces)+        #expect(pushedValue.contains("Evil"), "the family must survive as a string, not be dropped")+        #expect(pushedValue.hasSuffix("sans-serif"), "the fallback stack must still be there")+        let bodyHidden = try await harness.evalBool(+            "return getComputedStyle(document.body).display === 'none';"+        )+        #expect(!bodyHidden, "a family name must not be able to inject a rule")++        // Only the three pushed custom properties exist inline — no fourth+        // declaration was smuggled in through the value.+        let declarations = try await harness.evalString(+            "return String(document.documentElement.style.length);"+        )+        #expect(declarations == "3")++        #expect(harness.page.url == urlBefore, "typography changes must not reload the document")+    }+}++#if os(iOS)+private extension UIContentSizeCategory {+    /// Maps a SwiftUI `DynamicTypeSize` onto the UIKit category, for the device pin+    /// above. Test-only: production reads the pure table in `WebTypography`.+    init(_ size: DynamicTypeSize) {+        switch size {+        case .xSmall: self = .extraSmall+        case .small: self = .small+        case .medium: self = .medium+        case .large: self = .large+        case .xLarge: self = .extraLarge+        case .xxLarge: self = .extraExtraLarge+        case .xxxLarge: self = .extraExtraExtraLarge+        case .accessibility1: self = .accessibilityMedium+        case .accessibility2: self = .accessibilityLarge+        case .accessibility3: self = .accessibilityExtraLarge+        case .accessibility4: self = .accessibilityExtraExtraLarge+        case .accessibility5: self = .accessibilityExtraExtraExtraLarge+        @unknown default: self = .large+        }+    }+}+#endif

diff --git a/prismTests/WebRendering/DocumentCSSTypographyRulesTests.swift b/prismTests/WebRendering/DocumentCSSTypographyRulesTests.swiftnew file mode 100644index 0000000..326816f--- /dev/null+++ b/prismTests/WebRendering/DocumentCSSTypographyRulesTests.swift@@ -0,0 +1,161 @@+//+//  DocumentCSSTypographyRulesTests.swift+//  prismTests+//+//  Stylesheet guard for the typography regressions T-1827 (Body Font ignored) and+//  T-1828 (Dynamic Type ignored).+//+//  Native now pushes `--prism-font-family` and `--prism-font-size` on every+//  `applyTypography`, and `WebTypography` holds the Swift-side constants those pushes+//  are built from. `document.css` holds the same two values as the pre-bridge+//  fallbacks — the frames before the first push, and the state if the bridge never+//  comes up. Two representations of one value drift, so these tests pin them+//  together, the way `DocumentCSSContrastRulesTests` pins the contrast palette+//  against `HighContrastThemeColors`.+//+//  They also pin the CONSUMERS, which is the other half of each bug: the fix is only+//  effective while the body rule actually multiplies the two variables and the code+//  rules keep using the untouched monospace stack.+//+//  Rule-pin, not a rendered-typography proof: the live WebPage harness never applies+//  the emitted stylesheet (specs/readable-tables-restoration/decision_log.md+//  Decision 2), so computed font sizes cannot be asserted here. The bridge half is+//  covered by WebTypographyBridgeTests; visual verification is manual.+//++import Foundation+import SwiftUI+import Testing+@testable import prism++@Suite("document.css typography variables (T-1827/T-1828)")+@MainActor+struct DocumentCSSTypographyRulesTests {++    /// Loads the bundled `document.css` from the same `Bundle.main` location the+    /// scheme handler serves it from.+    private static func loadDocumentCSS() throws -> String {+        let url = try #require(+            Bundle.main.url(forResource: "document", withExtension: "css"),+            "bundled document.css must be present in the test host"+        )+        return try String(contentsOf: url, encoding: .utf8)+    }++    private static func normalized(_ css: String) -> String {+        css.replacingOccurrences(of: "\\s+", with: " ", options: .regularExpression)+    }++    /// Strips `/* … */` comments.+    ///+    /// The sibling guards do not need this because their selector fragments+    /// (`[data-prism-contrast=…]`) never appear in prose. "body" does — the typography+    /// section comment explains what the body rule does — and a fragment matched inside+    /// a comment that precedes a rule passes the `}`-between check, silently returning+    /// the WRONG rule's body. Removing comments first is the fix; it also makes the+    /// declaration splitting below safe.+    private static func withoutComments(_ css: String) -> String {+        css.replacingOccurrences(of: "(?s)/\\*.*?\\*/", with: " ", options: .regularExpression)+    }++    /// The declaration body of the first *rule* whose selector text contains+    /// `selectorFragment`, or nil when no such rule exists.+    ///+    /// Same implementation as the sibling `document.css` guards+    /// (`DocumentCSSContrastRulesTests`, `DocumentCSSTableRulesTests`): a hit only+    /// counts as a selector if no `}` sits between it and the next `{`, so a fragment+    /// appearing inside a previous rule body is skipped rather than silently yielding+    /// the wrong body.+    private static func ruleBody(containing selectorFragment: String, in css: String) -> String? {+        let flat = normalized(withoutComments(css))+        var searchStart = flat.startIndex+        while let selectorRange = flat.range(of: selectorFragment, range: searchStart..<flat.endIndex) {+            guard let openBrace = flat.range(of: "{", range: selectorRange.upperBound..<flat.endIndex) else {+                return nil+            }+            let priorClose = flat.range(of: "}", range: selectorRange.upperBound..<openBrace.lowerBound)+            if priorClose == nil,+               let closeBrace = flat.range(of: "}", range: openBrace.upperBound..<flat.endIndex) {+                return String(flat[openBrace.upperBound..<closeBrace.lowerBound])+            }+            searchStart = selectorRange.upperBound+        }+        return nil+    }++    /// The value of `property` inside a declaration body, trimmed.+    private static func value(of property: String, in body: String) -> String? {+        for declaration in body.split(separator: ";") {+            let parts = declaration.split(separator: ":", maxSplits: 1)+            guard parts.count == 2 else { continue }+            if parts[0].trimmingCharacters(in: .whitespaces) == property {+                return parts[1].trimmingCharacters(in: .whitespaces)+            }+        }+        return nil+    }++    /// The `:root` typography block — the first `:root` rule, which is the one the+    /// typography fallbacks live in (the theme palettes follow it).+    private static func rootBody() throws -> String {+        let css = try loadDocumentCSS()+        return try #require(ruleBody(containing: ":root", in: css), "document.css must have a :root block")+    }++    // MARK: - Swift ↔ CSS anti-drift++    @Test("The CSS font-family fallback matches WebTypography.systemFontStack (T-1827)")+    func fontStackMatchesSwift() throws {+        let declared = try #require(Self.value(of: "--prism-font-family", in: try Self.rootBody()))+        // Native appends this exact stack after the user's family, so a divergence+        // means a document with a custom font falls back differently from one without.+        #expect(+            Self.normalized(declared) == Self.normalized(WebTypography.systemFontStack),+            "document.css declares \(declared)"+        )+    }++    @Test("The CSS base font size matches WebTypography.baseFontSizePx (T-1828)")+    func baseSizeMatchesSwift() throws {+        let declared = try #require(Self.value(of: "--prism-font-size", in: try Self.rootBody()))+        // The Swift constant is the Dynamic Type "Large" neutral point: if the CSS+        // fallback drifted from it, the document would visibly resize the moment the+        // first typography push landed, at the default text size.+        #expect(declared == "\(Int(WebTypography.baseFontSizePx))px", "document.css declares \(declared)")+    }++    // MARK: - The consumers++    @Test("The body rule combines the Dynamic Type base size with the app scale")+    func bodyRuleCombinesBothScales() throws {+        let css = try Self.loadDocumentCSS()+        let body = try #require(Self.ruleBody(containing: "body", in: css))+        let fontSize = try #require(Self.value(of: "font-size", in: body))+        // Both variables, multiplied: Dynamic Type and the in-app slider have to+        // compound (Req 10.3). Dropping either factor is one of the two bugs.+        #expect(fontSize.contains("var(--prism-font-size)"))+        #expect(fontSize.contains("var(--prism-scale)"))+        #expect(fontSize.hasPrefix("calc("))++        #expect(Self.value(of: "font-family", in: body) == "var(--prism-font-family)")+    }++    @Test("Code keeps the monospace stack, which is never pushed")+    func codeKeepsMonospaceStack() throws {+        let css = try Self.loadDocumentCSS()+        // Req 1.4: the body font applies to body/headings/lists/tables, never to code.+        // `--prism-font-mono` is deliberately absent from the typography push, so code+        // stays monospace whatever family the user picks — that only holds while the+        // code rules key off the mono variable rather than the body one.+        #expect(css.contains("var(--prism-font-mono)"))+        #expect(+            Self.value(of: "--prism-font-mono", in: try Self.rootBody()) != nil,+            "--prism-font-mono must stay declared in :root"+        )+        let variables = WebDocumentControllerFactory.typographyVariables(+            settings: AppSettings.makeForTesting(),+            dynamicTypeSize: .large+        )+        #expect(variables["--prism-font-mono"] == nil, "the mono stack must not be pushed")+    }+}

diff --git a/prismTests/WebRendering/WebStateSynchronizerAssemblyTests.swift b/prismTests/WebRendering/WebStateSynchronizerAssemblyTests.swiftindex f1cbc2d..d9197d0 100644--- a/prismTests/WebRendering/WebStateSynchronizerAssemblyTests.swift+++ b/prismTests/WebRendering/WebStateSynchronizerAssemblyTests.swift@@ -20,6 +20,7 @@ //  import Foundation+import SwiftUI import Testing @testable import prism @@ -88,7 +89,7 @@ struct WebStateSynchronizerAssemblyTests {             coordinator: coordinator,             notesManager: notesManager         )-        made.synchronizer.start()+        made.synchronizer.start(dynamicTypeSize: .large)         return Assembly(             session: session,             coordinator: coordinator,@@ -143,7 +144,8 @@ struct WebStateSynchronizerAssemblyTests {     func initialStatePushedOnStart() async throws {         let assembly = await makeAssembly()         let expectedTypography = WebDocumentControllerFactory.typographyVariables(-            settings: assembly.settings+            settings: assembly.settings,+            dynamicTypeSize: .large         )         let pushed = await waitUntil {             assembly.controller.latestSnapshot.typography == expectedTypography@@ -151,6 +153,14 @@ struct WebStateSynchronizerAssemblyTests {                 && assembly.controller.latestSnapshot.noteIndicatorsJSON != nil         }         #expect(pushed, "start() must push initial typography/comment/note state so recovery replay has native truth")++        // Not just "equal to whatever the factory returns" — that comparison holds for+        // any content and passed throughout T-1827/T-1828, when the dict was missing+        // two of its three variables. Name every variable the stylesheet consumes.+        let typography = try #require(assembly.controller.latestSnapshot.typography)+        #expect(typography["--prism-scale"] != nil)+        #expect(typography["--prism-font-size"] != nil)+        #expect(typography["--prism-font-family"] != nil)     }      @Test("applyTheme pushes the theme through the synchronizer")@@ -175,12 +185,18 @@ struct WebStateSynchronizerAssemblyTests {          assembly.settings.textSizeScale = originalScale == 120 ? 140 : 120         let expectedTypography = WebDocumentControllerFactory.typographyVariables(-            settings: assembly.settings+            settings: assembly.settings,+            dynamicTypeSize: .large         )         let typographyPushed = await waitUntil {             assembly.controller.latestSnapshot.typography == expectedTypography         }         #expect(typographyPushed, "text-size change must reach the web controller without a view remount")+        // Literal, for the reason above: the scale the setting was just moved to.+        #expect(+            assembly.controller.latestSnapshot.typography?["--prism-scale"]+                == (assembly.settings.textSizeScale == 140 ? "1.400" : "1.200")+        )          assembly.settings.showHTMLComments = !originalComments         let commentsPushed = await waitUntil {

diff --git a/prismTests/WebRendering/HTMLCommentVisibilityLiveTests.swift b/prismTests/WebRendering/HTMLCommentVisibilityLiveTests.swiftindex 37b8124..c1a14ff 100644--- a/prismTests/WebRendering/HTMLCommentVisibilityLiveTests.swift+++ b/prismTests/WebRendering/HTMLCommentVisibilityLiveTests.swift@@ -13,6 +13,7 @@ //  import Foundation+import SwiftUI import Testing import WebKit @testable import prism@@ -140,7 +141,8 @@ struct HTMLCommentVisibilityLiveTests {             to: controller,             settings: settings,             themeKey: PrismTheme.prismLight.rawValue,-            contrast: .standard+            contrast: .standard,+            dynamicTypeSize: .large         )         let url = WebDocumentControllerFactory.documentURL(             session: session, parseRevision: session.parseRevision

diff --git a/prismTests/WebRendering/WebSearchWiringTests.swift b/prismTests/WebRendering/WebSearchWiringTests.swiftindex 87be62b..db6ee6c 100644--- a/prismTests/WebRendering/WebSearchWiringTests.swift+++ b/prismTests/WebRendering/WebSearchWiringTests.swift@@ -67,7 +67,7 @@ struct WebSearchWiringTests {             notesManager: notesManager         )         let controller = made.controller-        made.synchronizer.start()+        made.synchronizer.start(dynamicTypeSize: .large)         made.synchronizer.applyTheme(             themeKey: settings.theme(for: .light).rawValue,             contrast: .standard

diff --git a/docs/agent-notes/typography-font-settings.md b/docs/agent-notes/typography-font-settings.mdindex 69ae851..ee15ce6 100644--- a/docs/agent-notes/typography-font-settings.md+++ b/docs/agent-notes/typography-font-settings.md@@ -21,7 +21,60 @@ - `prismTests/TypographyResolverTests.swift` - Tests for font computation logic. Uses 15pt baseline assertions. - `prismTests/AppSettingsTypographyTests.swift` - Tests for clamping, snapping, validation, reset. -### Rendering Pipeline+### Rendering Pipeline (web path — T-1827/T-1828)++The document body is WebKit-rendered (T-1542), so `TypographyResolver` no longer drives+it. The web path is:++`AppSettings` (`textSizeScale`, `bodyFontFamily`) + `@Environment(\.dynamicTypeSize)`+→ `WebDocumentControllerFactory.typographyVariables(settings:dynamicTypeSize:)`+→ `applyTypography` → `prism-theme.js` `applyVariables` → inline custom properties on+`<html>` → `document.css`'s `body` rule.++Three variables are pushed, and only these three:++| Variable | Source | Notes |+|----------|--------|-------|+| `--prism-scale` | `textSizeScale` / 100 | the in-app 80–200% slider |+| `--prism-font-size` | `WebTypography.bodyPointSize(for:)` | Dynamic Type resolved base size, px |+| `--prism-font-family` | `WebTypography.fontFamilyValue(userFamily:)` | quoted user family + system stack |++Gotchas that cost time here:++- **`--prism-font-mono` is deliberately NOT pushed.** That is what keeps code monospace+  under a custom body font. Pushing it is T-428's business, not the body font's.+- **All three must be composed in `typographyVariables` and pushed together.**+  `applyTypography` carries one dict that *wholly replaces*+  `WebDocumentStateSnapshot.typography`, so a second pusher does not race — it deletes+  the other's variables from the post-recovery replay. This is why Dynamic Type is fed+  *into* `WebDocumentStateSynchronizer` (`start(dynamicTypeSize:)` /+  `applyDynamicTypeSize`) rather than pushed from the view like the theme is.+- **`--prism-font-family` is emitted even when no family is selected.** `applyVariables`+  only ever *sets* properties, so omitting it would leave a previously-pushed family as+  an inline style and "System" would never come back without a reload.+- **The family name is untrusted** (`UserDefaults`-backed, reachable via `defaults write`+  or a synced preference). `WebTypography.cssQuotedFamily` quotes it as a CSS string and+  escapes `\` and `"`; control characters are rejected to the system stack.+- **`document.css`'s `:root` values are fallbacks, not the effective values**, and they+  mirror `WebTypography`'s Swift constants. `DocumentCSSTypographyRulesTests` pins the+  two so they cannot drift (same pattern as `DocumentCSSContrastRulesTests`).+- **`WebTypography.baseFontSizePx` is 17 on both platforms**, unlike+  `TypographyResolver`'s 15pt macOS body baseline. Deliberate: 17px is what the web+  renderer has always used on macOS and changing it would resize every macOS document.+- **The Dynamic Type mapping is a table, not a live `UIFontMetrics` call**, so it is pure,+  testable off-device, and works on macOS. An iOS-only test pins the table against+  `UIFontMetrics` so it cannot drift from the OS.+- The live `WebPage` test harness does **not** apply `document.css`+  (`specs/readable-tables-restoration/decision_log.md` Decision 2), so computed font+  sizes cannot be asserted in a test. Coverage is split: bridge/variable assertions plus+  CSS rule pins; the visual check is manual.++### Rendering Pipeline (native path — LARGELY RETIRED by T-1542)++The views below no longer render the document body; `TypographyResolver` now serves the+raw-source view, Settings' preview card, metadata, and chrome only. Treat this list as+history unless the file still exists.+ - `prism/Views/TypographyModifier.swift` - ViewModifier applying `resolver.scaledBodyFont` (always explicit Font, never nil) as environment fallback. - `prism/Views/HighlightedInlineText.swift` - Fonts applied directly via `.font()` on `InlineText`. `scaledFont` is `Font` (non-optional) from `TypographyResolver.scaledBodyFont`. No `.textual.fontScale()`. - `prism/Views/TextualBlockView.swift` - `headingFont(level:)` uses `TypographyResolver.scaledHeadingFont(level:)` which bakes scale into point size.

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex c740e3a..f62c623 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0  ### Fixed +- The **Body Font** you choose in Settings now applies to the document (T-1827), and iOS **Larger Text** (Dynamic Type) now scales it (T-1828). Since the WebKit rendering cutover the document was drawn at a fixed system font and a fixed base size: picking a body font moved only the preview in Settings, and raising Larger Text scaled the app's toolbars, sidebars, and panels while paragraphs, headings, lists, and tables stayed put. Body text, headings, lists, and tables now use the selected family — code blocks and inline code stay monospace — and the document's base size follows the system text size, combined with the in-app Text Size slider rather than replaced by it. Both follow changes live, without a reload and without losing your reading position, and both survive a WebKit process recovery. A font that is no longer installed falls back to the system font instead of failing, and a font name is applied as text only, so it cannot alter the document's styling. - The system **Increase Contrast** accessibility setting applies to the document again (T-1829). Since the WebKit rendering cutover, turning it on changed the app's own interface but left the document body untouched: search highlights and footnote badges stayed translucent and tertiary text stayed low-contrast. The rendered document now uses the same higher-contrast search, footnote, and tertiary colours as the rest of the app, on every theme, and the deliberately-faded "add note" button beside each block is shown at full strength. It follows the setting live — toggling it while a document is open updates immediately, without a reload and without losing your reading position, and the styling survives a WebKit process recovery. Footnote popovers keep the standard palette. - Adding a note to text selected after a footnote badge now quotes the text you actually selected (T-1876). In a paragraph like `before[^1] after`, selecting `after` quoted words from near the start of the paragraph instead, and saving stored a wrong source range, which the note then carried into relocation and inline-note export. The rendered document's text-to-source map now keeps its offsets in the block's own coordinates across any number of footnote badges. Footnotes inside list items and table cells are tracked separately. - The saved reading position is no longer corrupted by content the document does not show (T-1851). Hidden content measures as sitting exactly at the top of the window, which beat every genuinely visible block, so the document reported a block the reader could not see as the block being read. That happened with any heading collapsed, and — because the carrier holding a document's YAML frontmatter is hidden the same way — on every document that starts with frontmatter, collapsed or not. Reopening the document, returning from raw source, or recovering from a rendering-process restart then landed on the wrong block or did nothing at all. Content the document does not lay out is now skipped when working out the reading position.