cursedbelt-core 2.13.1 → 2.13.3

package/dist/core/wire/marshalWorker.js

@@ -1,5 +1,5 @@
 /**
- * The marshalling Worker (05 §B1, second half) — `validate` + `transform` for a
+ * The marshaling Worker (05 §B1, second half) — `validate` + `transform` for a
  * large inbound payload, off the thread that has to answer requests.
  *
  * `marshalling.ts` has always had the SIZE BOUNDARY and the injection seam; what
@@ -8,19 +8,19 @@
  * the missing half: a real, long-lived worker with a request/response protocol,
  * on both runtimes cursedbelt ships to.
  *
- * ## Why the marshaller names its own worker entry
+ * ## Why the marshaler names its own worker entry
  *
- * A marshaller is mostly FUNCTIONS (`validate`, `transform`, a Zod schema), and
+ * A marshaler is mostly FUNCTIONS (`validate`, `transform`, a Zod schema), and
  * functions do not survive structured clone — a worker cannot be handed one, it
  * has to `import` it. The obvious design (one shared worker that resolves any
- * marshaller by id from a registry module) needs the host to declare, register
- * and keep in sync a second module listing every marshaller, and it gives that
+ * marshaler by id from a registry module) needs the host to declare, register
+ * and keep in sync a second module listing every marshaler, and it gives that
  * one worker the authority to run all of them.
  *
- * Instead each marshaller declares `workerEntry`: the module that constructs
- * exactly that marshaller and calls {@link serveMarshalWorker}. The worker can
- * therefore only ever run the one marshaller it was built for, the host wires
- * nothing, and — the part that matters for the gate — "can this marshaller
+ * Instead each marshaler declares `workerEntry`: the module that constructs
+ * exactly that marshaler and calls {@link serveMarshalWorker}. The worker can
+ * therefore only ever run the one marshaler it was built for, the host wires
+ * nothing, and — the part that matters for the gate — "can this marshaler
  * offload?" stops being a boolean somebody remembered to set and becomes a
  * question about an artifact that either exists or does not. V3 checks it
  * statically (`marshaller-worker-offload-missing`), so the 503 path below is
@@ -94,7 +94,7 @@ export async function serveMarshalWorker(marshaller) {
                     id: request.id,
                     ok: false,
                     code: MARSHALLER_VALIDATION_FAILED,
-                    message: `Inbound payload rejected by marshaller '${marshaller.id}'.`,
+                    message: `Inbound payload rejected by marshaler '${marshaller.id}'.`,
                 });
                 return;
             }
@@ -185,7 +185,7 @@ function spawnHostWorker(entry) {
     };
 }
 /**
- * A long-lived worker for ONE marshaller, multiplexing concurrent payloads.
+ * A long-lived worker for ONE marshaler, multiplexing concurrent payloads.
  *
  * Long-lived rather than one-worker-per-payload deliberately: thread startup
  * plus module load is tens of milliseconds, which on a burst of imports would
@@ -229,7 +229,7 @@ export function createMarshalWorkerClient(options) {
     worker.onError((error) => {
         const message = error instanceof Error ? error.message : String(error);
         for (const id of [...pending.keys()])
-            settle(id, (p) => p.reject(new AppError(`Marshalling worker failed: ${message}`, {
+            settle(id, (p) => p.reject(new AppError(`Marshaling worker failed: ${message}`, {
                 code: MARSHALLER_WORKER_FAILED,
                 status: 500,
                 context: { worker: String(options.entry) },
@@ -238,7 +238,7 @@ export function createMarshalWorkerClient(options) {
     return {
         run(_marshallerId, payload) {
             if (disposed)
-                return Promise.reject(new AppError('Marshalling worker has been disposed.', {
+                return Promise.reject(new AppError('Marshaling worker has been disposed.', {
                     code: MARSHALLER_WORKER_FAILED,
                     status: 500,
                     context: { worker: String(options.entry) },
@@ -247,7 +247,7 @@ export function createMarshalWorkerClient(options) {
             return new Promise((resolve, reject) => {
                 const timer = setTimeout(() => {
                     pending.delete(id);
-                    reject(new AppError(`Marshalling worker did not answer within ${timeoutMs}ms.`, {
+                    reject(new AppError(`Marshaling worker did not answer within ${timeoutMs}ms.`, {
                         code: MARSHALLER_WORKER_TIMEOUT,
                         status: 504,
                         context: { worker: String(options.entry), timeoutMs },
@@ -260,7 +260,7 @@ export function createMarshalWorkerClient(options) {
         async dispose() {
             disposed = true;
             for (const id of [...pending.keys()])
-                settle(id, (p) => p.reject(new AppError('Marshalling worker was disposed while a payload was in flight.', {
+                settle(id, (p) => p.reject(new AppError('Marshaling worker was disposed while a payload was in flight.', {
                     code: MARSHALLER_WORKER_FAILED,
                     status: 503,
                     context: { worker: String(options.entry) },

package/dist/core/wire/marshalling.d.ts

@@ -1,8 +1,8 @@
 /**
- * Port marshalling + the 512KB worker gate (02 §7.1).
+ * Port marshaling + the 512KB worker gate (02 §7.1).
  *
  * External payloads — webhooks, third-party feeds, spreadsheet imports — never
- * touch component code. A marshaller registered on the token is the only entry,
+ * touch component code. A marshaler registered on the token is the only entry,
  * and its `transform` output is checked against the token's canonical Zod schema
  * (V3 asserts this statically; here it is enforced at runtime too, because a
  * provider can change its shape without anyone recompiling).
@@ -18,7 +18,7 @@ import type { z } from 'zod';
 /** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
 export declare const MARSHALLER_WORKER_OFFLOAD_BYTES: number;
 /**
- * The ONE marshaller contract (05 §B1, unified 2026-07-26).
+ * The ONE marshaler contract (05 §B1, unified 2026-07-26).
  *
  * There were TWO interfaces of this name in this package: this one, and a
  * divergent copy in `core/tokens/registry.ts` that additionally required
@@ -32,24 +32,24 @@ export declare const MARSHALLER_WORKER_OFFLOAD_BYTES: number;
  */
 export interface CCWireMarshaller<Inbound = unknown, Out = unknown> {
     id: string;
-    /** The wire token this marshaller feeds — V3 resolves it against the registry. */
+    /** The wire token this marshaler feeds — V3 resolves it against the registry. */
     tokenId: string;
     /** REQUIRED — V3 `marshaller-payload-unbounded` when absent or non-positive. */
     maxPayloadBytes: number;
     /**
-     * The module that runs this marshaller's `validate`+`transform` off the main
+     * The module that runs this marshaler's `validate`+`transform` off the main
      * thread — an entry calling `serveMarshalWorker` (`core/wire/marshalWorker.ts`).
      *
      * **This replaced a `workerOffload: boolean` in the Worker commit (05 §B1).**
      * That flag was authored by hand and asserted a capability the codebase did
-     * not have: every marshaller in the repo set it `true` while no worker
+     * not have: every marshaler in the repo set it `true` while no worker
      * existed anywhere, so the V3 gate it fed was checking that someone had
-     * remembered to type `true`. Whether a marshaller can offload is now a
+     * remembered to type `true`. Whether a marshaler can offload is now a
      * question about an ARTIFACT — this entry either exists or it does not — and
      * whether it NEEDS to is {@link requiresWorkerOffload}, derived from
      * `maxPayloadBytes`. Neither is a promise anyone can make by hand.
      *
-     * Optional because a marshaller whose `maxPayloadBytes` sits under the
+     * Optional because a marshaler whose `maxPayloadBytes` sits under the
      * main-thread limit can never reach the offload path; V3 requires it of
      * exactly those that can.
      */
@@ -60,9 +60,9 @@ export interface CCWireMarshaller<Inbound = unknown, Out = unknown> {
     targetZodSchema: z.ZodType<Out>;
 }
 /**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
+ * Can this marshaler ever reach the offload path? A DERIVED fact (05 §B1).
  *
- * A marshaller that refuses anything over 256KB can never produce a payload
+ * A marshaler that refuses anything over 256KB can never produce a payload
  * above the 512KB main-thread limit, so it needs no worker and demanding one
  * would be noise. One whose ceiling is 2MB certainly can, and without a
  * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
@@ -87,13 +87,13 @@ export interface MarshalWorker {
 }
 export interface MarshalOptions {
     /**
-     * Use THIS worker instead of the one the marshaller's `workerEntry` names.
+     * Use THIS worker instead of the one the marshaler's `workerEntry` names.
      * Left unset in production: offload is the default path, resolved from the
-     * marshaller itself, so an ingress route needs no worker wiring of its own.
+     * marshaler itself, so an ingress route needs no worker wiring of its own.
      */
     worker?: MarshalWorker;
     /**
-     * Resolves a worker for a marshaller that declares a `workerEntry`. The host
+     * Resolves a worker for a marshaler that declares a `workerEntry`. The host
      * supplies this once (`createMarshalWorkerClient`, cached per entry) — it is a
      * parameter rather than a module-level singleton because a worker is a live
      * OS thread, and something has to own disposing of it.
@@ -103,14 +103,14 @@ export interface MarshalOptions {
     offloadThresholdBytes?: number;
 }
 /**
- * Run a payload through its marshaller, offloading past the size gate.
+ * Run a payload through its marshaler, offloading past the size gate.
  *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
+ * Order matters: the marshaler's OWN `maxPayloadBytes` is checked first, so an
  * oversized payload is refused with a typed diagnostic before any work — worker
  * or otherwise — is scheduled for it.
  */
 export declare function marshalInbound<Inbound, Out>(marshaller: CCWireMarshaller<Inbound, Out>, payload: Inbound, options?: MarshalOptions): Promise<Out>;
-/** The registry of marshallers, keyed by token id (02 §7.1: registered ON the token). */
+/** The registry of marshalers, keyed by token id (02 §7.1: registered ON the token). */
 export interface MarshallerRegistry {
     register(tokenId: string, marshaller: CCWireMarshaller): void;
     forToken(tokenId: string): CCWireMarshaller | undefined;

package/dist/core/wire/marshalling.js

@@ -2,9 +2,9 @@ import { AppError } from '../../shared/errors.js';
 /** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
 export const MARSHALLER_WORKER_OFFLOAD_BYTES = 512 * 1024;
 /**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
+ * Can this marshaler ever reach the offload path? A DERIVED fact (05 §B1).
  *
- * A marshaller that refuses anything over 256KB can never produce a payload
+ * A marshaler that refuses anything over 256KB can never produce a payload
  * above the 512KB main-thread limit, so it needs no worker and demanding one
  * would be noise. One whose ceiling is 2MB certainly can, and without a
  * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
@@ -41,16 +41,16 @@ export function payloadBytes(payload) {
     }
 }
 /**
- * Run a payload through its marshaller, offloading past the size gate.
+ * Run a payload through its marshaler, offloading past the size gate.
  *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
+ * Order matters: the marshaler's OWN `maxPayloadBytes` is checked first, so an
  * oversized payload is refused with a typed diagnostic before any work — worker
  * or otherwise — is scheduled for it.
  */
 export async function marshalInbound(marshaller, payload, options = {}) {
     const bytes = payloadBytes(payload);
     if (bytes > marshaller.maxPayloadBytes)
-        throw new AppError(`Payload of ${bytes} bytes exceeds marshaller '${marshaller.id}' limit of ${marshaller.maxPayloadBytes}.`, {
+        throw new AppError(`Payload of ${bytes} bytes exceeds marshaler '${marshaller.id}' limit of ${marshaller.maxPayloadBytes}.`, {
             code: MARSHALLER_PAYLOAD_TOO_LARGE,
             status: 413,
             context: { marshaller: marshaller.id, bytes, maxPayloadBytes: marshaller.maxPayloadBytes },
@@ -58,13 +58,13 @@ export async function marshalInbound(marshaller, payload, options = {}) {
     const threshold = options.offloadThresholdBytes ?? MARSHALLER_WORKER_OFFLOAD_BYTES;
     if (bytes > threshold) {
         // Offload is the DEFAULT path (05 §B1): an explicitly injected worker wins,
-        // otherwise the marshaller's own `workerEntry` is resolved through the host's
-        // resolver. Neither present means this marshaller has no offload path at all
+        // otherwise the marshaler's own `workerEntry` is resolved through the host's
+        // resolver. Neither present means this marshaler has no offload path at all
         // — which V3 refuses to verify, so a verified app never reaches this throw.
         const worker = options.worker ??
             (marshaller.workerEntry ? options.resolveWorker?.(marshaller) : undefined);
         if (!worker)
-            throw new AppError(`Payload of ${bytes} bytes exceeds the ${threshold}-byte main-thread limit and marshaller '${marshaller.id}' has no marshalling worker.`, {
+            throw new AppError(`Payload of ${bytes} bytes exceeds the ${threshold}-byte main-thread limit and marshaler '${marshaller.id}' has no marshaling worker.`, {
                 code: MARSHALLER_PAYLOAD_TOO_LARGE,
                 status: 503,
                 context: {
@@ -73,8 +73,8 @@ export async function marshalInbound(marshaller, payload, options = {}) {
                     threshold,
                     workerEntry: marshaller.workerEntry ?? null,
                     hint: marshaller.workerEntry
-                        ? 'The marshaller declares a workerEntry but no resolveWorker was supplied — pass createMarshalWorkerClient through MarshalOptions.resolveWorker.'
-                        : 'Give the marshaller a workerEntry (a module calling serveMarshalWorker), or lower maxPayloadBytes below the main-thread limit.',
+                        ? 'The marshaler declares a workerEntry but no resolveWorker was supplied — pass createMarshalWorkerClient through MarshalOptions.resolveWorker.'
+                        : 'Give the marshaler a workerEntry (a module calling serveMarshalWorker), or lower maxPayloadBytes below the main-thread limit.',
                 },
             });
         // The worker validates AND transforms; the result still gets schema-checked
@@ -83,7 +83,7 @@ export async function marshalInbound(marshaller, payload, options = {}) {
         return assertSchema(marshaller, result);
     }
     if (!marshaller.validate(payload))
-        throw new AppError(`Inbound payload rejected by marshaller '${marshaller.id}'.`, {
+        throw new AppError(`Inbound payload rejected by marshaler '${marshaller.id}'.`, {
             code: MARSHALLER_VALIDATION_FAILED,
             status: 400,
             context: { marshaller: marshaller.id },
@@ -98,7 +98,7 @@ export async function marshalInbound(marshaller, payload, options = {}) {
 function assertSchema(marshaller, value) {
     const parsed = marshaller.targetZodSchema.safeParse(value);
     if (!parsed.success)
-        throw new AppError(`Marshaller '${marshaller.id}' produced output that violates its token's schema.`, {
+        throw new AppError(`Marshaler '${marshaller.id}' produced output that violates its token's schema.`, {
             code: MARSHALLER_SCHEMA_VIOLATION,
             status: 502,
             context: {
@@ -113,7 +113,7 @@ export function createMarshallerRegistry() {
     return {
         register(tokenId, marshaller) {
             if (marshaller.maxPayloadBytes === undefined || marshaller.maxPayloadBytes <= 0)
-                throw new AppError(`Marshaller '${marshaller.id}' must declare a positive maxPayloadBytes.`, {
+                throw new AppError(`Marshaler '${marshaller.id}' must declare a positive maxPayloadBytes.`, {
                     code: 'marshaller-payload-unbounded',
                     status: 500,
                     context: { marshaller: marshaller.id, tokenId },

package/dist/ctgrClient/convertRequest.js

@@ -33,7 +33,7 @@ export async function convertIfOnlyGETRequests(url, init = { method: 'GET' }, fo
     if (!METHOD_TO_ABBREV[upper]) {
         throw new Error(`ctgr: "${method}" is not a tunnelable method`);
     }
-    const body = form ? await formDataToBody(form) : bodyFromInit(init.body);
+    const body = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
     const getInit = toGetInit(init);
     const { chunks } = await encodeRequest(upper, url, body);
     return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -62,10 +62,26 @@ async function formDataToBody(formData) {
     }
     return { __files: files, ...fields };
 }
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body) {
-    if (typeof body !== 'string')
-        return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialized as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body, method, url) {
+    if (body === null || body === undefined)
+        return undefined;
+    if (typeof body !== 'string') {
+        // A plain object or array a caller cast to `BodyInit` serializes as itself — carried as before.
+        const proto = Object.getPrototypeOf(body);
+        if (Array.isArray(body) || proto === Object.prototype || proto === null)
+            return body;
+        const shape = Object.prototype.toString.call(body).slice(8, -1);
+        throw new Error(`ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`);
+    }
     try {
         return JSON.parse(body);
     }

package/dist/testing/bytes.d.ts

@@ -28,5 +28,5 @@
 export declare const asBody: (bytes: Uint8Array) => Uint8Array<ArrayBuffer>;
 /** `new Response(bytes)` with the assertion applied — the common case. */
 export declare const bytesResponse: (bytes: Uint8Array, init?: ResponseInit) => Response;
-/** A readable stream of `bytes` — what the media catalogue's ingest paths take. */
+/** A readable stream of `bytes` — what the media catalog's ingest paths take. */
 export declare const bytesStream: (bytes: Uint8Array | string) => ReadableStream<Uint8Array>;

package/dist/testing/bytes.js

@@ -28,6 +28,6 @@
 export const asBody = (bytes) => bytes;
 /** `new Response(bytes)` with the assertion applied — the common case. */
 export const bytesResponse = (bytes, init) => new Response(asBody(bytes), init);
-/** A readable stream of `bytes` — what the media catalogue's ingest paths take. */
+/** A readable stream of `bytes` — what the media catalog's ingest paths take. */
 export const bytesStream = (bytes) => new Response(typeof bytes === 'string' ? asBody(new TextEncoder().encode(bytes)) : asBody(bytes))
     .body;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.13.1",
+	"version": "2.13.3",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",

package/src/core/analytics/range.spec.ts

@@ -18,7 +18,7 @@ import {
   unitForSpan,
 } from './range.js';
 
-/** 2026-08-13 14:30 LOCAL — the tests are about local calendar behaviour. */
+/** 2026-08-13 14:30 LOCAL — the tests are about local calendar behavior. */
 const NOW = new Date(2026, 7, 13, 14, 30, 0).getTime();
 
 describe('the presets', () => {

package/src/core/analytics/range.ts

@@ -158,8 +158,8 @@ export const startOfBucket = (t: number, unit: BucketUnit): number =>
  * duplicated or missing bar exactly once every spring and autumn — the kind of
  * bug nobody reproduces.
  *
- * The time-of-day is carried through rather than normalised to midnight: every
- * caller here passes an already-aligned value, so normalising would be
+ * The time-of-day is carried through rather than normalized to midnight: every
+ * caller here passes an already-aligned value, so normalizing would be
  * invisible in this file and a trap for the first caller that does not.
  */
 export const addDays = (t: number, n: number): number => {

package/src/core/analytics/schedule.spec.ts

@@ -25,7 +25,7 @@ describe('simulateSchedule', () => {
     expect(simulateSchedule(items, { workers: 1 }).makespanMs).toBe(40 * MIN);
     expect(simulateSchedule(items, { workers: 2 }).makespanMs).toBe(20 * MIN);
     expect(simulateSchedule(items, { workers: 4 }).makespanMs).toBe(10 * MIN);
-    // Nothing left to parallelise — the fifth worker is inert.
+    // Nothing left to parallelize — the fifth worker is inert.
     expect(simulateSchedule(items, { workers: 5 }).makespanMs).toBe(10 * MIN);
   });
 
@@ -50,12 +50,12 @@ describe('simulateSchedule', () => {
     expect(simulateSchedule(items, { workers: 2 }).makespanMs).toBe(10 * MIN);
   });
 
-  it('serialises a named group without needing a shared resource', () => {
+  it('serializes a named group without needing a shared resource', () => {
     const items = [item('a', 5, { group: 'gpu' }), item('b', 5, { group: 'gpu' })];
     expect(simulateSchedule(items, { workers: 4 }).makespanMs).toBe(10 * MIN);
   });
 
-  it('honours dependencies', () => {
+  it('honors dependencies', () => {
     const items = [item('second', 10, { dependsOn: ['first'] }), item('first', 10)];
     const r = simulateSchedule(items, { workers: 4 });
     expect(r.makespanMs).toBe(20 * MIN);

package/src/core/analytics/schedule.ts

@@ -11,7 +11,7 @@
  * Three separate claims hide in that, and a `remaining / rate` division answers
  * none of them:
  *
- * 1. **Work does not parallelise freely.** Two tasks that write the same files
+ * 1. **Work does not parallelize freely.** Two tasks that write the same files
  *    may not run together whatever the fleet size — that is the orchestrator's
  *    own scope rule, and it is why a queue of ten tasks all scoped to one app
  *    drains at exactly the same speed with eight workers as with one.
@@ -312,10 +312,10 @@ function blocks(candidate: ScheduleItem, other: ScheduleItem): boolean {
 /**
  * A best-effort reason an item started late — for the table behind the chart.
  *
- * Deliberately approximate and labelled as such: the precise answer would need
+ * Deliberately approximate and labeled as such: the precise answer would need
  * the admission loop to record every refusal at every event, which is a lot of
  * bookkeeping for a column. "Was it waiting on a dependency, on a conflicting
- * neighbour, or simply for a free worker" is the distinction a reader acts on,
+ * neighbor, or simply for a free worker" is the distinction a reader acts on,
  * and that is decidable from the item alone.
  */
 function whyWaited(

package/src/core/duplicates/index.ts

@@ -17,7 +17,7 @@
  *
  * ── What is NOT here, deliberately ──────────────────────────────────────────────────────
  * Anything that needs a database, a filesystem, a fetch or a picture decoder. This module is
- * pure so both consumers can prove their behaviour with `bun test` instead of against a live
+ * pure so both consumers can prove their behavior with `bun test` instead of against a live
  * store, and so a browser bundle may import it (music renders the pair side by side).
  */
 
@@ -158,7 +158,7 @@ export function durationsClose(
 /** One file, reduced to what this module can reason about. Units are the caller's — pass
  *  both durations in the same unit or not at all. */
 export interface NamedFileFacts {
-	/** The name a person would recognise: a display title, else the last path segment. */
+	/** The name a person would recognize: a display title, else the last path segment. */
 	name: string | null | undefined;
 	sizeBytes: number;
 	/** Playing time, in whatever unit the caller uses consistently. Null = never measured. */

package/src/core/file-tree/fileTreeModel.ts

@@ -24,7 +24,7 @@
 export type FileTreeNodeKind = 'folder' | 'file';
 
 /**
- * How visible a node is, generalised from collections' private/locked folders.
+ * How visible a node is, generalized from collections' private/locked folders.
  *
  * 🔴 It is a LABEL, never an enforcement. The server decides what a session may see, and a
  * tree that hides a row the server sent (or shows one it did not) is a second, weaker
@@ -117,7 +117,7 @@ export interface FileTreeNode {
    *
    * For a consumer that narrows the tree itself (by content, not only by name) and keeps
    * the folders on the way to each hit: the hits are what the eye is scanning for, and the
-   * folders kept around them are context. Omit it and nothing is emphasised.
+   * folders kept around them are context. Omit it and nothing is emphasized.
    */
   matched?: boolean;
   /**
@@ -230,7 +230,7 @@ export function flattenFileTree(
        * "A row that claims to open onto nothing is its own small lie" was the old reasoning
        * and it is answered by what VS Code does: the chevron says *folder*, not *occupied*,
        * and opening an empty one onto nothing is the honest answer, not a broken promise.
-       * `node.expandable === false` is still honoured for a row that can never hold anything.
+       * `node.expandable === false` is still honored for a row that can never hold anything.
        */
       const expandable = node.kind === 'folder' && (node.expandable ?? true);
       const expanded = expandable && !shut.has(node.id);
@@ -447,7 +447,7 @@ export interface KeyboardMoveOptions {
  * without asking which of several folders was meant — and **← promotes out to the folder its
  * own folder is in**, which is `root` at depth 1.
  *
- * 🔴 Every refusal the DRAG honours is honoured here, from the same fields: `acceptsDrop`,
+ * 🔴 Every refusal the DRAG honors is honored here, from the same fields: `acceptsDrop`,
  * the consumer's `canDrop`, and the descendant rule. A keyboard route that can reach a
  * destination the pointer refuses is a second, weaker opinion about what is legal — and it
  * is the one nobody looks at, because the pointer is what gets tested by hand.

package/src/core/folder-tree/actions.ts

@@ -25,7 +25,7 @@
  * applies, with nothing destroyed. Deleting the CONTENTS destroys items, and this module
  * has never seen an item; it only ever sees the paths they carry. So `purge` is a mode the
  * menu offers and the CONSUMER implements against its own store, which is also the only
- * place that can count what is about to be lost or refuse the operation. Modelling it here
+ * place that can count what is about to be lost or refuse the operation. Modeling it here
  * would mean inventing an item, and an item this model cannot see is one it cannot protect.
  */
 

package/src/core/master-lock/kdf.ts

@@ -89,7 +89,7 @@ export async function deriveMasterLockVerifier(
 	}
 	const salt = unb64u(params.salt);
 	const kek = await pbkdf2(utf8(masterPassword), salt, params.iter);
-	// Same salt as the KEK, by design: it individualises the verifier without a second
+	// Same salt as the KEK, by design: it individualizes the verifier without a second
 	// stored value. One round, over KEK ‖ password.
 	const verifier = await pbkdf2(concat(kek, utf8(masterPassword)), salt, 1);
 	return b64u(verifier);

package/src/core/master-lock/presence.ts

@@ -23,7 +23,7 @@
  * ── 🔴 Why a decorative loop is NOT presence ────────────────────────────────
  * The failure mode that would make this a security hole is an ambient background clip
  * — muted, looping, autoplaying, running forever with nobody in the building. That is
- * a recognisable signature (`muted` AND `loop`) and it is refused. A film the owner is
+ * a recognizable signature (`muted` AND `loop`) and it is refused. A film the owner is
  * actually watching is not both at once; a muted film that loops is not something this
  * fleet renders. Where a component knows better than the heuristic, it says so:
  * `data-master-lock-presence="watch"` counts unconditionally, `"ignore"` never does.

package/src/core/master-lock/wire.ts

@@ -123,7 +123,7 @@ export const MASTER_LOCK_STATE_HEADER = "x-master-lock-state";
  *  nothing in the fleet constructs one. So adding a required field to it is
  *  additive, and without this annotation it is the residual false MAJOR that
  *  Phase −1's M-B measured and had no cheap fix for (F4). `release/surface.ts`
- *  records the annotation; `release/classify.ts` honours it. */
+ *  records the annotation; `release/classify.ts` honors it. */
 export interface MasterLockStatus {
 	/** Is a master password set at all? False only on an app that was never seeded,
 	 *  or — in per-person mode — for a person who has not chosen one yet. */

package/src/core/media/mediaItem.ts

@@ -1,5 +1,5 @@
 // Pure MediaItem helpers — kind predicates + dimension/aspect resolution. The React
-// catalogue maps items to layout photos through these, so the "what size is this
+// catalog maps items to layout photos through these, so the "what size is this
 // thumbnail" logic is tested here, not buried in a component.
 
 import type { MediaItem } from './types.js';

package/src/core/media/types.ts

@@ -66,11 +66,11 @@ export type VideoProgressEvent = {
   error?: string;
 };
 
-/** The three media kinds the catalogue + lightbox understand. */
+/** The three media kinds the catalog + lightbox understand. */
 export type MediaKind = 'image' | 'video' | 'audio';
 
 /**
- * A URL-only catalogue item — the unit the `<MediaCatalogueViewer>` renders. It
+ * A URL-only catalog item — the unit the `<MediaCatalogueViewer>` renders. It
  * holds NO storage identity (no FsNode, no binary id): the app maps its own records
  * to this and pre-resolves `url`/`thumbnailUrl` (signing private files as needed).
  */
@@ -92,7 +92,7 @@ export type MediaItem = {
 };
 
 /**
- * A gallery photo — a {@link MediaItem} specialized to images, plus the catalogue affordances a
+ * A gallery photo — a {@link MediaItem} specialized to images, plus the catalog affordances a
  * photo grid renders (tags for the filter strip, createdAt for ordering, favorite for the ♥).
  * Like every media-core unit it carries only resolved URLs — no storage identity.
  */
@@ -123,7 +123,7 @@ export type ProcessingStatus = 'pending' | 'processing' | 'ready' | 'failed';
 /**
  * A surface-agnostic description of a playable video with every URL already resolved —
  * the unit the `<VideoPlayer>` primitive consumes (distinct from {@link MediaItem}, which
- * is the lightbox catalogue unit). It carries NO storage identity: a source pre-resolves
+ * is the lightbox catalog unit). It carries NO storage identity: a source pre-resolves
  * the streaming URLs (signing/tokenising private ones), so the player couples to nothing.
  * Richer than `MediaItem`: an HLS master + scrub-preview track for a real player HUD.
  */

package/src/core/media/videoCuts.ts

@@ -74,7 +74,7 @@ export interface VideoCut {
  * The shortest span worth cutting, in seconds.
  *
  * 🔴 Not zero, and not "whatever the person dragged". Below roughly a frame the request is
- * indistinguishable from a mis-click, and it is a request ffmpeg cannot honour anyway — a
+ * indistinguishable from a mis-click, and it is a request ffmpeg cannot honor anyway — a
  * cut has to land on a frame boundary, so a 4 ms span asks the encoder to remove nothing and
  * charges a full re-encode of the file for it. 40 ms is one frame at 25fps, the slowest rate
  * anything in this library was shot at.
@@ -320,7 +320,7 @@ export function toggleSegment(plan: CutPlan, segment: VideoCut, duration: number
       splits: plan.splits,
       // Drop every removal this segment sits inside, then put back the parts of a WIDER
       // removal that are still meant to go — un-marking one piece of a span that was marked
-      // before it was split must not resurrect its neighbours.
+      // before it was split must not resurrect its neighbors.
       removed: plan.removed.flatMap((cut) => {
         if (!(cut.start <= current.start + 1e-6 && cut.end >= current.end - 1e-6)) return [cut];
         const rest: VideoCut[] = [];

package/src/core/navigation/index.ts

@@ -1,6 +1,6 @@
 // `cursedbelt-core/navigation` — the navigation contract + pure selectors. React-free and
 // routing-free: the single source of truth (the IA tree) plus every derivation off
-// it (side nav, hub tiles, breadcrumbs, search catalogue, coverage test, prefs
+// it (side nav, hub tiles, breadcrumbs, search catalog, coverage test, prefs
 // migration). The React components in `cursedbelt/react` consume exactly this.
 
 export {

package/src/core/navigation/navigation.spec.ts

@@ -245,7 +245,7 @@ describe('deriveBreadcrumbTrail', () => {
 describe('deriveSearchCatalogue + rankCatalogue', () => {
   const catalogue = deriveSearchCatalogue(model, allowAll);
 
-  test('every visible domain + item is catalogued; deepLinkOnly is excluded', () => {
+  test('every visible domain + item is cataloged; deepLinkOnly is excluded', () => {
     const ids = catalogue.map((e) => e.id);
     expect(ids).toContain('fractal');
     expect(ids).toContain('env-sets');
@@ -280,7 +280,7 @@ describe('deriveSearchCatalogue + rankCatalogue', () => {
     expect(userCat.map((e) => e.id)).not.toContain('admin-users');
   });
 
-  test("a DOMAIN's description + keywords reach the catalogue, so a leaf-shaped rail is findable by synonym", () => {
+  test("a DOMAIN's description + keywords reach the catalog, so a leaf-shaped rail is findable by synonym", () => {
     // The asymmetry this closes: an app whose places are leaf domains (no
     // sub-items) used to be searchable by exact label only, while an identical
     // rail expressed as items matched synonyms — a data-model gap, not a ranking one.
@@ -305,7 +305,7 @@ describe('deriveSearchCatalogue + rankCatalogue', () => {
     expect(rankCatalogue(leafRail, 'review')[0]?.id).toBe('changes');
   });
 
-  test('a domain without them still catalogues cleanly (both stay optional)', () => {
+  test('a domain without them still catalogs cleanly (both stay optional)', () => {
     const bare = deriveSearchCatalogue(
       { domains: [{ id: 'x', label: 'X', icon: 'a', path: '/x', groups: [] }] },
       allowAll,

package/src/core/navigation/navigationModel.ts

@@ -1,6 +1,6 @@
 // The single navigation source of truth — a declarative Information-Architecture
 // tree (Domain → Group → Item) every nav surface derives from: the side nav, hub
-// landing tiles, breadcrumbs, the universal-search catalogue, and the command
+// landing tiles, breadcrumbs, the universal-search catalog, and the command
 // palette. Authoring a feature into the model is the *only* way to surface it, so
 // the historical "four hand-maintained lists drift out of sync → features get
 // buried" bug is structurally impossible (the coverage test enforces it in CI).
@@ -135,7 +135,7 @@ export interface NavDomain {
    * again the same as on a {@link NavItem}.
    *
    * Both of these exist because a domain IS a destination: `deriveSearchCatalogue`
-   * emits one catalogue entry per domain, so a rail of leaf-shaped domains (an app
+   * emits one catalog entry per domain, so a rail of leaf-shaped domains (an app
    * whose places have no sub-items) had no way to be found by synonym while an
    * otherwise identical rail of items did. That asymmetry was in the data model,
    * not in the ranker.