ADR-0137 The faces load from beside the package

#Context

ADR-0135's helm display is an outdoor instrument panel, and the target is Chromium on embedded Linux. A kiosk there commonly opens the application from disk. family.css loads every face from /fonts/…, because the apps copy the faces into their own public/fonts and serve them from the site root. A page opened from disk resolves that path against the filesystem root, finds nothing, and draws in whatever fonts the device carries. In the field themes that loses Atkinson Hyperlegible, the face those themes choose for legibility.

Measured, not assumed: a page opened over file:// in Chromium with family.css reports both Atkinson faces as error, and with the stylesheet below reports both loaded.

#Decision

The generator writes a second family stylesheet, family-local.css, that loads the faces relative to itself from ../assets/fonts/upstream/, where the package already keeps them with their licences. Below the @font-face rules it is identical to family.css. A surface served from a site root keeps family.css; a surface opened from disk, or bundled by a tool that resolves relative URLs, imports family-local.css. The two locations are one table in src/family.js.

tokens:verify checks that every face family-local.css names is a file beside the package, and refuses a root path there.

#Rejected options

Make family.css relative and delete the apps' copies. One stylesheet instead of two. It lost because the docs site, the proof app and Storybook each serve /fonts/ today, and changing how three apps resolve their fonts is a larger change than a panel needs.

A custom property for the font location. It would be one file and a setting. It lost because CSS does not substitute a custom property inside url(), so there is no stylesheet that could read it.

Leave it to the panel's build to rewrite the path. It works for a team that knows to do it. It lost because the failure is silent: the panel still draws text, in the wrong face, and nothing reports it.

#Consequences

A panel imports family-local.css and ships the package folder intact. The faces add about 260 KB and are under the SIL Open Font License, which permits embedding.

family.css is unchanged apart from its header comment, so no app, fixture or baseline moves.

Adds one check to tokens:verify.