Follow-up to the atomic-write work on fix/file-io-safety.
The atomic UFO writer moves the existing target aside during the swap and then deletes it on success. That's correct as a bugfix, but it means every successful save destroys the previous version of the user's file.
Type designers culturally expect versioned backups (Glyphs and RoboFont both keep them). Proposal:
- On successful save (UFO and
.shift), rotate the displaced previous version into a retained location instead of deleting it — e.g. MyFont.ufo.backups/2026-07-02T14-31-05/ or a per-document backups dir — keeping the last N (configurable, default ~5).
- Backups should be pruned oldest-first and excluded from format detection / open dialogs.
- Surface in UX eventually ("restore previous version"), but the retention mechanism alone is the trust win.
This is policy, not correctness, hence split from the atomic-write PR. The mechanism is nearly free: the previous version already exists intact at swap time — the change is "move it" instead of "drop it".
Follow-up to the atomic-write work on
fix/file-io-safety.The atomic UFO writer moves the existing target aside during the swap and then deletes it on success. That's correct as a bugfix, but it means every successful save destroys the previous version of the user's file.
Type designers culturally expect versioned backups (Glyphs and RoboFont both keep them). Proposal:
.shift), rotate the displaced previous version into a retained location instead of deleting it — e.g.MyFont.ufo.backups/2026-07-02T14-31-05/or a per-document backups dir — keeping the last N (configurable, default ~5).This is policy, not correctness, hence split from the atomic-write PR. The mechanism is nearly free: the previous version already exists intact at swap time — the change is "move it" instead of "drop it".