fonts: remove bundled binary payloads

LICENSES/README.md

@@ -6,9 +6,8 @@
 - `GPL-2.0-or-later.txt` contains GNU GPL version 2.  The header of
   `map/kanji.dict` grants the option to use GPL version 2 or any later
   version.
-- Font license texts are stored in `font/` and associated with exact files
-  by `font/PROVENANCE`.
-- `stb_truetype.h` includes its complete dual MIT/Public Domain terms.
+- License texts and provenance for the historically bundled fonts are retained
+  in `font/`; no font binary remains in the source tree.
 - Generated Wayland files include their MIT-style notices in each file.
 
 No repository-wide license has been declared for original strans source.

README.md

@@ -179,7 +179,9 @@ disables itself cleanly on other visuals.
 
 Data and third-party provenance is recorded in
 [`docs/PROVENANCE.md`](docs/PROVENANCE.md), with font-specific details in
-[`font/PROVENANCE`](font/PROVENANCE).  The historical SKK-derived Kanji
+[`font/PROVENANCE`](font/PROVENANCE).  No font binaries are bundled; that file
+retains the provenance of the faces formerly kept in the repository.  The
+historical SKK-derived Kanji
 dictionary is distributed under GPL version 2 or later; its license text is
 in [`LICENSES/GPL-2.0-or-later.txt`](LICENSES/GPL-2.0-or-later.txt).
 The single-character Hanja data derived from libhangul is distributed under
@@ -187,6 +189,6 @@ the BSD 3-Clause license in
 [`LICENSES/BSD-3-Clause-libhangul-hanja.txt`](LICENSES/BSD-3-Clause-libhangul-hanja.txt).
 
 The repository does not currently declare a license for the strans project
-source as a whole.  The licenses of bundled data, fonts, generated protocol
-code, and third-party components do not by themselves license the original
-strans source.
+source as a whole.  The licenses of bundled data, historical font assets,
+generated protocol code, and third-party components do not by themselves
+license the original strans source.

docs/PROVENANCE.md

@@ -46,25 +46,31 @@ new SKK revision.
 
 ## Fonts
 
-The popup bundles Noto Sans, Japanese-region Noto Sans Mono CJK, and Noto
-Emoji.  Exact checksums, versions or source revisions, download locations
-where known, fallback order, and license-file names are recorded in
-`font/PROVENANCE`.  The corresponding OFL 1.1 and Apache 2.0 texts are kept
-beside the fonts.
+No font binaries are bundled.  The daemon receives one to four font file paths
+on its command line and tries them in that order; it does not discover fonts by
+family name or directory contents.  `font/PROVENANCE` retains the exact
+checksums, source revisions, and license records for the three Noto faces that
+were formerly stored in the repository.
 
-## stb_truetype
+The Docker renderer tests obtain their fonts from signed Arch packages rather
+than the source checkout.  On August 13, 2026 the tested package contract was:
 
-`stb_truetype.h` is Sean Barrett's stb_truetype version 1.26, dated
-August 28, 2021 in its header.  Its exact repository checksum is:
+- `ttf-dejavu` `2.37+18+g9b5d1b2f-8`, providing
+  `/usr/share/fonts/TTF/DejaVuSans.ttf` (SHA-256
+  `6038a160b491e121c1f12c7bccb4a9c8730296e3adc1086a059404ed84b7451c`);
+- `ttf-jigmo` `20250912-1`, providing
+  `/usr/share/fonts/TTF/Jigmo.ttf` (SHA-256
+  `c8f295b9bd8f9f117a76b3a454aaaa1bb5b4babc18e254978c6deb88464e40cf`)
+  and `/usr/share/fonts/TTF/Jigmo2.ttf` (SHA-256
+  `5da3582efe77e22073b86b3b86b556d7111148a76b957cfb53318a91da2efff0`).
 
-```text
-ecd30b05e0dd4fea3a13c26810dd9e1992dc379049482c393d5a19e6b5090aab
-```
-
-The file was present in the repository's first commit,
-`dcd1147638f908eca7e4b7616815e215022cc99d`.  No upstream commit or download
-URL was recorded.  Its complete dual MIT/Public Domain terms are retained at
-the end of the header.
+Pacman validates the package checksums and repository signatures.  DejaVu Sans
+supplies ASCII and the monochrome U+1F600 outline in the tests; Jigmo supplies
+Hangul and BMP CJK, and Jigmo2 supplies U+2000B.  Their installed license files
+are `/usr/share/licenses/ttf-dejavu/LICENSE` and
+`/usr/share/licenses/ttf-jigmo/LICENSE.txt`; the packages identify their terms
+as the DejaVu custom license and CC0 1.0, respectively.  These packages are
+test fixtures, not names or paths hard-coded into the daemon.
 
 ## Generated Wayland protocol code
 

font/PROVENANCE

@@ -1,7 +1,9 @@
-Bundled popup fonts
-===================
+Historical popup fonts
+======================
 
-The renderer tries these files in this fixed order:
+These binaries are no longer stored in the strans source tree.  Before font
+selection became an ordered list of command-line file paths, the renderer used
+these repository files in this fixed order:
 
 1. NotoSans-Regular.ttf
 2. NotoSansMonoCJKjp-Regular.otf
@@ -13,25 +15,35 @@ NotoSans-Regular.ttf
 SHA-256: 9cb49a54e520423033f9727be2e53e4805a60656deb09c219740d8e5f3e033ac
 Internal family/version: Noto Sans Regular, version 2.005
 License: SIL Open Font License 1.1 (OFL-NotoSans.txt)
+Source revision: 7697007fcb3563290d73f41f56a70d5d559d828c
+Source: https://raw.githubusercontent.com/notofonts/noto-fonts/7697007fcb3563290d73f41f56a70d5d559d828c/hinted/ttf/NotoSans/NotoSans-Regular.ttf
 
-This file entered the strans repository in commit 874b941.  That commit did
-not record its download URL, and the current upstream build is not
-byte-identical.  The checksum above identifies the bundled file; no claim is
-made that the current upstream URL regenerates it.
+This file entered the strans repository in commit 874b941.  Its source URL was
+not recorded then; the immutable revision above was recovered later and is
+byte-identical to the historical file.
 
 NotoSansMonoCJKjp-Regular.otf
 --------------------------------
 
 SHA-256: 4d01725be822d144cf9a56ade981e6fb920cd7a610b8fc24cc601a920beea5b9
 Release: Noto Sans CJK 2.004, tag Sans2.004
-Source: https://raw.githubusercontent.com/notofonts/noto-cjk/Sans2.004/Sans/Mono/NotoSansMonoCJKjp-Regular.otf
+Source revision: 523d033d6cb47f4a80c58a35753646f5c3608a78
+Source: https://raw.githubusercontent.com/notofonts/noto-cjk/523d033d6cb47f4a80c58a35753646f5c3608a78/Sans/Mono/NotoSansMonoCJKjp-Regular.otf
 License: SIL Open Font License 1.1 (OFL-NotoSansCJK.txt)
-License source: https://raw.githubusercontent.com/notofonts/noto-cjk/Sans2.004/LICENSE
+License source: https://raw.githubusercontent.com/notofonts/noto-cjk/523d033d6cb47f4a80c58a35753646f5c3608a78/LICENSE
 
 NotoEmoji-Regular.ttf
 ---------------------
 
 SHA-256: 415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5
+Internal family/version: Noto Emoji Regular, version 1.05
+Source revision: 2f1ffdd6fbbd05d6f382138a3d3adcd89c5ce800
 Source: https://raw.githubusercontent.com/googlei18n/noto-emoji/2f1ffdd6fbbd05d6f382138a3d3adcd89c5ce800/fonts/NotoEmoji-Regular.ttf
-License: Apache License 2.0 (Apache-2.0-NotoEmoji.txt)
-License source: https://raw.githubusercontent.com/googlei18n/noto-emoji/2f1ffdd6fbbd05d6f382138a3d3adcd89c5ce800/LICENSE
+Font license: SIL Open Font License 1.1
+Font license source: https://raw.githubusercontent.com/googlei18n/noto-emoji/2f1ffdd6fbbd05d6f382138a3d3adcd89c5ce800/fonts/LICENSE
+Font license SHA-256: 6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2
+
+The font-specific license is byte-identical to `OFL-NotoSansCJK.txt`.  The
+previously recorded `Apache-2.0-NotoEmoji.txt` is retained as the license of
+the upstream project at that revision; it is not the license declared by this
+font binary.