Release 0.24.0

[albedosehen]

Prepares the 0.24.0 release: the CHANGELOG section for #292 to #301, the version bumps, and refreshed docs (README, STABILITY, ROADMAP, PERFORMANCE). Nothing is tagged, released or published.

This branch is origin/main (355a76a) plus two commits: chore(release): prepare 0.24.0 (CHANGELOG, manifests, README, STABILITY, RELEASING) and a docs commit (ROADMAP, PERFORMANCE).

Versions

Per docs/RELEASING.md and the 0.23.0 precedent (14ba727): the core moves to 0.24.0, every companion crate that exposes sigilbuzz types in its API takes a minor bump, and sigilbuzz-woff, which exposes none, takes a patch bump so its published version requires sigilbuzz 0.24. Every internal version = requirement moves with them.

Crate	Old	New	Why
sigilbuzz	0.23.1	0.24.0	#292 to #301. Breaking: Font::coords (borrows the font, no longer const), the default cluster level, MultiVarStore::resolve_deltas semantics, GeneralCategoryClass (#[non_exhaustive], Symbol), first unsafe and the CAS atomics requirement. The [workspace.dependencies] pin moves with it.
sigilbuzz-subset	0.13.1	0.14.0	#294 (hinted CFF2 subsets, stems across subroutines, instancer metrics and rounding, instance_user) and #300 (unparsable VARC left out). Takes &Face.
sigilbuzz-render	0.10.1	0.11.0	#293: progressive JPEG fixes, AC refinement, decode_jpeg limits. Takes &Face and exposes paint types.
sigilbuzz-paint	0.3.0	0.4.0	#293: deltas at F2DOT14 coords. Takes &Face.
sigilbuzz-capi	0.4.0	0.5.0	No code change. Moves with the core minor, as in 0.23.0; depends on subset 0.14 and paint 0.4.
sigilbuzz-cli	0.2.0	0.3.0	No code change, but sigilbuzz shape prints cluster= at the new default level. Moves with the core minor, as in 0.23.0.
sigilbuzz-gpu	0.2.0	0.3.0	No code change. encode_glyph takes &Face.
sigilbuzz-hyphen	0.2.0	0.3.0	No code change. Its text-layout-integration API exposes sigilbuzz-text-layout types, which move to 0.3.0.
sigilbuzz-pdf	0.3.0	0.4.0	No code change. emit_type3_font takes &Face.
sigilbuzz-svg	0.3.0	0.4.0	No code change. glyph_to_svg takes &Face.
sigilbuzz-text-layout	0.2.0	0.3.0	No code change. wrap_lines takes &[sigilbuzz::Glyph].
sigilbuzz-woff	0.3.2	0.3.3	No code change and no sigilbuzz types in its API: a patch release so the published crate requires sigilbuzz 0.24, as 0.3.2 did for 0.23.0.

"No code change" means git diff v0.23.1..origin/main touches nothing under the crate's directory.

Doc version mentions: README "The current release is 0.24.0" and sigilbuzz = "0.24"; STABILITY "For 0.24.0 that means sigilbuzz = "0.24" with, for example, sigilbuzz-render = "0.11" and sigilbuzz-paint = "0.4""; the RELEASING.md path-plus-version example. STABILITY also gains the Tier 1 entry for instance_user, UserInstanceInput and AxisLimit (Added in 0.14.0), per its "Adding a public item" rule; drop it if those should stay out of the 1.0 surface for now.

Semver checks

cargo-semver-checks 0.51.0 against the crates.io baseline, run as --release-type minor so every break is listed, with default features and with --all-features (same results both ways):

Crate	Baseline	Result
sigilbuzz	0.23.1	201 pass, 1 fail, 58 skip: inherent_method_const_removed for Font::coords. In the CHANGELOG (Changed, Font::coords).
sigilbuzz-subset	0.13.1	202 pass, 58 skip; no semver update required
sigilbuzz-render	0.10.1	202 pass, 58 skip; no semver update required
sigilbuzz-paint	0.3.0	202 pass, 58 skip; no semver update required
sigilbuzz-capi	0.4.0	202 pass, 58 skip; no semver update required
sigilbuzz-gpu	0.2.0	202 pass, 58 skip; no semver update required
sigilbuzz-hyphen	0.2.0	202 pass, 58 skip; no semver update required
sigilbuzz-pdf	0.3.0	202 pass, 58 skip; no semver update required
sigilbuzz-svg	0.3.0	202 pass, 58 skip; no semver update required
sigilbuzz-text-layout	0.2.0	202 pass, 58 skip; no semver update required
sigilbuzz-woff	0.3.2	202 pass, 58 skip; no semver update required (also as the inferred patch release)

sigilbuzz-cli has no library target, so there is nothing to check.

Breaks the tool cannot see, each called out under Changed in the CHANGELOG:

• Font::coords now borrows the font (the lifetime change; the tool reports only the lost const).
• ClusterLevel::default() is MonotoneGraphemes, so default clusters change, and with them sigilbuzz shape's cluster= output.
• MultiVarStore::resolve_deltas keeps its signature but reads delta sets region by region and reads short sets as HarfBuzz does.
• GeneralCategoryClass gained Symbol and is #[non_exhaustive]; it lives under the #[doc(hidden)] unicode:: path, which the tool skips.
• The core crate's first unsafe (OnceBox) and its need for cfg(target_has_atomic = "ptr").
• decode_jpeg rejects a second SOF, frames past 2^22 pixels and frames with too little scan data.
• CFF2 instances round blended values, and their side bearings, head box and hhea extremes are recomputed from the outlines.
• Some hostile fonts now fail on work budgets: CFF subsetting (10-deep nesting, recursion, 513 operands, the token budget) and full CFF2 instancing (seven crafted fonts that 0.23.1 instanced).
• A VARC table that does not parse, such as the post-14.5.0 MultiItemVariationStore layout, counts as absent in the core and is left out of subsets (Read the new VARC MultiItemVariationStore format #299 tracks reading it).

Gate

On this branch (355a76a plus the release commit; the docs commit touches only Markdown), all pass:

• cargo fmt --all -- --check
• cargo +1.99.0 clippy --workspace --all-targets --all-features -- -D warnings
• cargo +1.99.0 clippy --workspace --all-targets --no-default-features -- -D warnings
• cargo +1.99.0 clippy -p sigilbuzz --no-default-features -- -D warnings
• cargo test --workspace --all-features: 203 test runs (doctests included), 3,838 passed, 0 failed, 9 ignored
• cargo build --no-default-features
• cargo publish --workspace --dry-run: all 12 crates package, verify, and stop before upload. Every crate has a new version, so nothing is excluded. sigilbuzz packs to 3.5 MiB compressed.
• MSRV: CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS=fallback cargo +stable generate-lockfile, then cargo +1.81 check --workspace --lib --no-default-features and cargo +1.81 check --workspace --lib --bins --all-features

Docs

• ROADMAP.md: "Next" rewritten from what is next: consumer adoption of 0.24.0 (one Font per font and instance, Face::glyph_outlines in oneiric, hb_font_set_variations through Font::with_variations, SVG <text> through sigilbuzz to drop rustybuzz, the 554-case differential in CI), per-glyph cost of long runs, A Devanagari fuzz input that GSUB grows to 3,079 glyphs takes about 24 s #302, feature semantics (automatic fractions and rand, feature ranges and calt=2, required-feature stages), syllabic shapers on a glyph buffer (the stage 0 skip), the variation core (shared-tuple scalars, avar 2, an OS/2 metrics API), and Read the new VARC MultiItemVariationStore format #299. "Known gaps" gains the deferred items from the 0.24.0 PRs' Not done lists and keeps the renderer and text-layout items. Removed as done: crates.io publishing, JPEG AC refinement, the stch symbols and older UnicodeScript bucket gaps, the CFF/CFF2 subset layout gap (stale), and the 0.22.0 Known bugs section (fixed by Fix the known JPEG, COLRv1, VARC and morx bugs #293 and Subset hinted CFF2 fonts, and finish the instancer's metrics #294). "How work gets picked" now says that no consumer runs a HarfBuzz backend, that parity is measured against HarfBuzz 14.5.0 directly, and that the consumers' fonts and strings feed the differential. Ground rules unchanged: none of them claimed the core has no unsafe.
• PERFORMANCE.md: the 0.6.0 numbers are replaced with 0.24.0 numbers from Cut per-call shaping cost with per-Font accelerators, plans and metric caches #295 and Bound the shaping caches' work and memory on hostile fonts #301 (method, warm repeated calls on one Font with HarfBuzz alongside, first calls, hostile tables, GlyphOutlines), and the Criterion tables are rerun for this release (see the file for how).

After merge

Tag v0.24.0 on the merge commit, create the GitHub release with this version's CHANGELOG section plus the crates.io links for all 12 crates, and approve the publish job (docs/RELEASING.md steps 5 to 8). The publish order in RELEASING.md applies; every crate is published this time.