A render can clear a font download failure based only on file size #2021

Follow-up to #2008, and only applies once that PR is in. A render can clear a recorded font download failure on the evidence of the file's size alone, so a persistent failure may never reach give-up and the failed fonts notice may never show.

What happens

1. Another font's file sits at a core font's name and has the same size as a known build of that font.
2. The background sync calls download( $file, true ), hashes the file, finds it isn't a known build and tries to save the real font under its hashed name. The download fails, so record_failure() records the first failure.
3. The next render calls download( $file ) without verifying. is_conflict() only compares sizes, the size is a known one, so the file counts as the font's own. download() takes its early return, which calls clear_failure().
4. The next sync finds the conflict again and a failed download is treated as a first failure, so gave_up is never set.

Impact

• The site keeps rendering with the wrong font while the real font can't be downloaded.
• The admin is never told, because the failed fonts notice only lists files that gave up.
• The retry count restarts after each render instead of ending in a give-up.

It needs a same-size file from another font and a download that keeps failing, so it should be rare. A file of a different size isn't affected, as the render finds that conflict too.

To decide

#2008 clears failures on render on purpose, so a font copied in by hand or saved by another request removes a stale failure and notice. The fix has to keep that working. Options:

• Only clear on a verified result, and let the sync or a retry clear failures. This is the simplest, but a font copied in by hand keeps its notice until the next sync, and Don't record a font failure when another request already saved the font #2008's "Try it" steps would change.
• On a render, clear only if the file changed after the failure was recorded, comparing its mtime with a stored failure time. It's a stat call, but a copied file that keeps an old mtime wouldn't clear.
• Hash the file on a render only when a failure is on record for it. It's exact and rare, but it adds hashing to the render path, which the font code otherwise avoids.