# Architecture

`core/sfnt.ts` validates SFNT/WOFF headers and table boundaries before parsing.
`font.worker.ts` owns the opentype.js instance and the source bytes; the UI only
receives bounded serializable inspection records. Each load gets a new worker,
and an unresponsive operation is terminated after eight seconds. Subsetting is
a separate worker command that rebuilds a static outline font from requested
Unicode glyphs only after OS/2 restrictions are checked.

React keeps the last successful inspection after errors. Font rendering occurs
in a scriptless sandboxed iframe. Relative assets and a same-origin service
worker support nested offline deployment.