Native Linux Rich Font Fallback

The unchanged versioned V1 JSON operation accepts fallbackFontFamilies: true for named-family rich fills and FDF/XFDF rich imports; the default remains False

{
  "schemaVersion": 1,
  "type": "forms.fill",
  "fontFamilies": ["Primary", "Fallback"],
  "fallbackFontFamilies": true,
  "fields": [{
    "name": "Input",
    "richTextRuns": [{"text": "AΩB", "fontFamily": "Primary"}]
  }]
}

An edit-level boolean overrides the operation-level flag for fills; rich imports use the operation-level flag; True requires an explicit nonempty fontFamilies configuration, and non-boolean values produce a typed invalid-argument error

The binding resolves each authored style for every configured candidate family through the existing Fontconfig provider; imports also retain the first regular program for scalar fields; every requested program must be available and valid before appearance preparation

These provider allocations share the aggregate appearance font limit and one quarter of limits.memoryBytes; the canvas retains the aggregate allowance while the binding independently checks the remaining bytes for each program, avoiding repeated subtraction of already charged fonts

The native resolver then chooses complete Unicode graphemes across authored styles and run seams, with actual candidate font bytes, contextual shaping, bidirectional ordering and original typed size and color precision; fallback changes appearance preparation only and preserves the authored V and RV values

These operations retain prepared output, fragmented callbacks, original AES R5/R6 security, graph commit after successful output and result callbacks, cancellation and byte-exact committed form-import no-ops

The formData.richFontFamilyFallback capability advertises the implemented option; public V1 record layouts and exported symbol versions remain unchanged

Both native Linux compilers pass 250 actual callback checks and 1062 independent checks over 28 fallback PDFs, 36 C client checks and 171 additional checks of actual C glyph output and a valid aggregate font allocation below 8 MiB

Fontconfig family resolution follows the existing Linux binding provider contract; bounded inline CSS font-list ordering and typed JSON fontFamilyCandidates are available with the opt-in fallback flag; Windows jobs and versioned callbacks provide supplied-family rich fallback, while external style sheets, broader CSS layout and the older loaded-job handle/font callback extension remain separate work

Native fallback behavior · Named-family bindings · Linux C ABI