mixdog 1.4.1 → 1.4.3

package/src/runtime/memory/lib/memory-process-lock.mjs

@@ -1,7 +1,11 @@
 // Process lock for the standalone memory MCP entry.
 // A direct entry (including the isolated daemon child) owns this lock.
 import fs from 'node:fs';
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
+import { killProcessTreesSync } from '../../agent/orchestrator/mcp/child-tree.mjs';
+
+// Windows: the tree kill's whole pass (a table read under load included).
+const PREVIOUS_SERVER_KILL_TIMEOUT_MS = 10_000;
 
 export function parsePositivePid(value) {
   const pid = Number(value);
@@ -18,42 +22,158 @@ export function isPidAliveLocal(pid) {
   }
 }
 
-function killPreviousServer(pid, log = () => {}) {
+const POSIX_ENV = () => ({ ...process.env, LC_ALL: 'C', LANG: 'C' });
+
+// When a process was created, as epoch-ms bounds { low, high } around the true
+// time, or null when it cannot be read. Linux: /proc/<pid>/stat starttime
+// (clock ticks since boot) against /proc/uptime, both read at `now`; the
+// margin covers one tick, uptime's centiseconds and the read skew.
+export function linuxCreatedBounds(statText, uptimeText, clockTicks, now) {
+  const ticks = linuxStartTicks(statText);
+  const startTicks = Number(ticks);
+  const uptime = Number(String(uptimeText || '').split(' ')[0]);
+  if (ticks === null || !Number.isFinite(uptime) || !(clockTicks > 0)) return null;
+  const created = now - (uptime - startTicks / clockTicks) * 1000;
+  const margin = 1000 / clockTicks + 20;
+  return { low: created - margin, high: created + margin };
+}
+
+// Elsewhere: `ps -o lstart=` under the C locale, whole seconds.
+export function lstartCreatedBounds(text) {
+  const started = Date.parse(String(text || '').trim());
+  return Number.isFinite(started) ? { low: started, high: started + 1000 } : null;
+}
+
+// /proc/<pid>/stat's starttime field (clock ticks since boot), as its digits.
+function linuxStartTicks(statText) {
+  const stat = String(statText || '');
+  if (!stat.includes(')')) return null;
+  const ticks = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+  return /^\d+$/.test(ticks || '') ? ticks : null;
+}
+
+/** A process's start token, as recorded in the lock and compared on
+ *  recovery, or null when it cannot be read: Linux `/proc/<pid>/stat`
+ *  starttime, elsewhere `ps -o lstart=` under the C locale. The two sources
+ *  never mix (each is prefixed), and both are read from the same host. */
+export function linuxStartToken(statText) {
+  const ticks = linuxStartTicks(statText);
+  return ticks ? `proc:${ticks}` : null;
+}
+export function lstartStartToken(text) {
+  const started = String(text || '').trim();
+  return Number.isFinite(Date.parse(started)) ? `lstart:${started}` : null;
+}
+
+function posixStartToken(pid) {
+  try {
+    if (process.platform === 'linux') return linuxStartToken(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: POSIX_ENV(),
+      timeout: 5000,
+    });
+    return lstartStartToken(r.stdout);
+  } catch {
+    return null;
+  }
+}
+
+function posixCreatedBounds(pid) {
+  const env = POSIX_ENV();
+  try {
+    if (process.platform === 'linux') {
+      const ticks = Number(spawnSync('getconf', ['CLK_TCK'], { encoding: 'utf8', env, timeout: 5000 }).stdout);
+      const now = Date.now();
+      return linuxCreatedBounds(
+        fs.readFileSync(`/proc/${pid}/stat`, 'utf8'),
+        fs.readFileSync('/proc/uptime', 'utf8'),
+        ticks,
+        now
+      );
+    }
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', env, timeout: 5000 });
+    return lstartCreatedBounds(r.stdout);
+  } catch {
+    return null;
+  }
+}
+
+/** Who holds a lock's pid, from the start token the writer recorded and the
+ *  pid's current one: 'writer' (the same token: the server that wrote the
+ *  lock), 'other' (a different one: the writer is gone and its pid reused) or
+ *  'unproven' (the current token cannot be read). */
+export function lockHolderTokenVerdict(recordedToken, currentToken) {
+  if (!currentToken) return 'unproven';
+  return currentToken === recordedToken ? 'writer' : 'other';
+}
+
+/** The legacy verdict, for a lock written without a start token: from the
+ *  holder's creation bounds, 'writer' (created before the lock was written),
+ *  'other' (created after) or 'unproven' (unreadable, or too close to the
+ *  write to tell). Only 'writer' may be signalled, and only 'other' or a dead
+ *  pid lets the lock be recovered. */
+export function lockHolderVerdict(bounds, lockWrittenAt) {
+  if (!bounds) return 'unproven';
+  if (bounds.high <= lockWrittenAt) return 'writer';
+  if (bounds.low > lockWrittenAt) return 'other';
+  return 'unproven';
+}
+
+/** The lock's text: the writer's pid, then (POSIX) its start token on the
+ *  next line. */
+export function formatLock(pid, token) {
+  return token ? `${pid}\n${token}` : String(pid);
+}
+export function parseLock(text) {
+  const [pidLine = '', token = ''] = String(text || '').split(/\r?\n/);
+  return { pid: Number(pidLine.trim()), token: token.trim() || null };
+}
+
+// The lock names its writer only while that writer lives. A POSIX writer
+// recorded its start token; the pid's holder is the writer exactly when its
+// token is still the same. Accepted: lstart has whole seconds, so a writer
+// that died within its first second, its pid reused in that same second,
+// would pass as the writer; sequential pid allocation makes that impractical,
+// and treating same-second tokens as unproven would block every restart.
+// Windows compares the holder's creation time against
+// the lock's write time inside the shared tree kill: its creation times are
+// sub-millisecond, and a pid is only reused after the writer died, after the
+// write. A lock without a token (an older writer) keeps the creation-bounds
+// verdict. A pid taken over since is never signalled; one whose identity
+// cannot be proven is neither signalled nor evicted (fail closed).
+function killPreviousServer(pid, recordedToken, lockWrittenAt, log = () => {}) {
   if (pid <= 0 || pid === process.pid) return false;
   if (process.platform === 'win32') {
-    try {
-      execFileSync('taskkill', ['/F', '/T', '/PID', String(pid)], {
-        encoding: 'utf8',
-        timeout: 5000,
-        windowsHide: true,
-      });
+    const status = killProcessTreesSync([pid], {
+      aliveAt: lockWrittenAt,
+      timeoutMs: PREVIOUS_SERVER_KILL_TIMEOUT_MS,
+    });
+    if (status === 0) {
       log(`[memory-service] Killed previous server PID ${pid}\n`);
       return true;
-    } catch (e) {
-      // Exit code 128 = process not found; treat stale lock as already-dead = success.
-      // Status 128 reliably means "process not found" regardless of locale; no text match needed.
-      // Status 1 with English text match handles edge cases on some Windows versions.
-      const notFoundText =
-        /not found|no running instance/i.test(e.stdout || '') ||
-        /not found|no running instance/i.test(e.stderr || '') ||
-        /not found|no running instance/i.test(e.message || '');
-      const alreadyDead = e.status === 128 || (e.status === 1 && notFoundText);
-      if (alreadyDead) {
-        log(`[memory-service] PID ${pid} already dead (stale lock), proceeding\n`);
-        return true;
-      }
-      log(`[memory-service] taskkill failed for PID ${pid}: ${e.message}\n`);
-      return false;
     }
+    if (status === 128) {
+      log(`[memory-service] PID ${pid} is not the lock's writer any more (stale lock), proceeding\n`);
+      return true;
+    }
+    log(`[memory-service] Killing previous server PID ${pid} failed (status ${status})\n`);
+    return false;
   } else {
-    // Pre-flight: if the process is already gone, treat stale lock as success.
-    try {
-      process.kill(pid, 0);
-    } catch (e) {
-      if (e.code === 'ESRCH') {
-        log(`[memory-service] PID ${pid} already dead (stale lock), proceeding\n`);
-        return true;
-      }
+    const verdict = !isPidAliveLocal(pid)
+      ? 'gone'
+      : recordedToken
+        ? lockHolderTokenVerdict(recordedToken, posixStartToken(pid))
+        : lockHolderVerdict(posixCreatedBounds(pid), lockWrittenAt);
+    if (verdict === 'gone' || verdict === 'other' || (verdict === 'unproven' && !isPidAliveLocal(pid))) {
+      log(`[memory-service] PID ${pid} is not the lock's writer any more (stale lock), proceeding\n`);
+      return true;
+    }
+    if (verdict === 'unproven') {
+      log(
+        `[memory-service] PID ${pid} may still be the lock's writer and cannot be proven otherwise; leaving it running\n`
+      );
+      return false;
     }
     try {
       process.kill(pid, 'SIGTERM');
@@ -86,9 +206,10 @@ export function acquireLock(lockFile, log = () => {}) {
   if (process.env.MIXDOG_MULTI_INSTANCE === '1') return;
   try {
     if (fs.existsSync(lockFile)) {
-      const lockedPid = Number(fs.readFileSync(lockFile, 'utf8').trim());
+      const lockWrittenAt = fs.statSync(lockFile).mtimeMs;
+      const { pid: lockedPid, token } = parseLock(fs.readFileSync(lockFile, 'utf8'));
       if (lockedPid > 0 && lockedPid !== process.pid) {
-        const killed = killPreviousServer(lockedPid, log);
+        const killed = killPreviousServer(lockedPid, token, lockWrittenAt, log);
         if (!killed) {
           log(`[memory-service] Could not kill previous server PID ${lockedPid}, aborting\n`);
           process.exit(1);
@@ -98,9 +219,12 @@ export function acquireLock(lockFile, log = () => {}) {
         } catch {}
       }
     }
+    // Read before the lock exists: an unreadable token leaves a pid-only lock,
+    // which a successor judges by the legacy verdict.
+    const token = process.platform === 'win32' ? null : posixStartToken(process.pid);
     const fd = fs.openSync(lockFile, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
     try {
-      fs.writeSync(fd, String(process.pid));
+      fs.writeSync(fd, formatLock(process.pid, token));
     } finally {
       fs.closeSync(fd);
     }
@@ -116,7 +240,6 @@ export function acquireLock(lockFile, log = () => {}) {
 
 export function releaseLock(lockFile) {
   try {
-    const content = fs.readFileSync(lockFile, 'utf8').trim();
-    if (Number(content) === process.pid) fs.unlinkSync(lockFile);
+    if (parseLock(fs.readFileSync(lockFile, 'utf8')).pid === process.pid) fs.unlinkSync(lockFile);
   } catch {}
 }

package/src/runtime/memory/lib/memory-text-utils.mjs

@@ -130,7 +130,12 @@ export function mergeRecallConceptTokens(text, conceptTokens, limit = 24) {
   const entityConcepts = concepts.filter(isEntityConcept);
   const rankingEntityConcepts = entityConcepts.filter((token) => !isStructuralTimeToken(token));
   const useEntityConcepts = rankingEntityConcepts.some(isIdentifierToken) || rankingEntityConcepts.length > 2;
-  const rankingConcepts = useEntityConcepts ? entityConcepts : concepts;
+  // Entity-heavy queries rank their entities first, but the Korean content
+  // words stay: dropping them left a mixed query ("웹 검색 원인 Claude Codex
+  // Hermes 비교") matching only on product names that half the history shares.
+  const rankingConcepts = useEntityConcepts
+    ? [...entityConcepts, ...concepts.filter((token) => !isEntityConcept(token))]
+    : concepts;
   const source =
     concepts.length > 0
       ? [...raw.filter((token) => isIdentifierToken(token) || isConceptCompound(token, concepts)), ...rankingConcepts]

package/src/runtime/memory/lib/memory.mjs

@@ -309,6 +309,22 @@ async function removeReviewAndPromotionCycleState(db) {
   }
 }
 
+// Root vectors now cover the chunk's first message as well as its summary
+// (memory-embed.mjs rootEmbedText). Vectors written under the older text stay
+// in place and are replaced by a paced background sweep (sweepRootEmbedText)
+// that walks roots below this starting cursor, newest first. One statement, so
+// the start is atomic; ON CONFLICT keeps an existing sweep's progress.
+export const ROOT_EMBED_SWEEP_META_KEY = 'embedding.root_text_v2';
+export async function startRootEmbedSweep(db) {
+  await db.query(
+    `INSERT INTO meta(key, value)
+     SELECT $1, jsonb_build_object('cursor', COALESCE(MAX(id), 0) + 1, 'done', false)
+     FROM entries WHERE is_root = 1
+     ON CONFLICT (key) DO NOTHING`,
+    [ROOT_EMBED_SWEEP_META_KEY]
+  );
+}
+
 export async function ensureCurrentSchemaExtensions(db, dims, embeddingIdentity = null) {
   await removeAttachmentPlaceholderRows(db);
   await removeRuntimeNotificationRowsOnce(db);
@@ -413,6 +429,7 @@ export async function openDatabase(dataDir, dims, embeddingIdentity = null) {
     }
     await ensureCurrentSchemaExtensions(db, Number(dims), embeddingIdentity);
     await validateEmbeddingDims(db, Number(dims));
+    await withSchemaBootstrapLock(pool, () => startRootEmbedSweep(db));
 
     dbs.set(key, db);
     return db;

package/src/runtime/memory/lib/pg/process.mjs

@@ -400,7 +400,7 @@ async function startAndWaitReady({ pgctl, startArgs, env, pgdataDir, port }) {
   // so the postmaster is already reparented OUT of the Node process tree —
   // detached only isolated the short-lived pg_ctl. Shutdown/reuse target
   // pgdata/postmaster.pid (pg_ctl stop -D, tryReusePgInstance), not a
-  // Node-tree taskkill, so `windowsHide` alone is correct on all platforms.
+  // Node-tree kill, so `windowsHide` alone is correct on all platforms.
   const child = spawn(pgctl, startArgs, { env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
   child.unref?.();
   const run = { stdout: '', stderr: '', closed: false, exitCode: null };

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -20,7 +20,7 @@ import { __mixdogMemoryLog } from '../memory-log.mjs';
  */
 
 import { createServer } from 'node:net';
-import { existsSync, unlinkSync, readFileSync, writeFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
+import { existsSync, unlinkSync, readFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import {
   discoveryPath as _pgDiscoveryPath,
@@ -28,6 +28,7 @@ import {
   writeServiceAdvert as _writePgServiceAdvert,
 } from '../../../shared/service-discovery.mjs';
 import { withFileLockSync } from '../../../shared/atomic-file.mjs';
+import { withFileLock } from '../../../shared/file-lock.mjs';
 import { isPidAlive } from '../../../shared/pid-liveness.mjs';
 import { envFlag } from '../../../shared/env.mjs';
 import { createSharedAbortable } from '../../../shared/abort-race.mjs';
@@ -64,92 +65,11 @@ let _ownedExitStopInstalled = false;
 const PG_PORT_MIN = 55432;
 const PG_PORT_MAX = 55632;
 const PG_LOG_MAX_BYTES = 10 * 1024 * 1024; // 10 MB
-const SPAWN_LOCK_NAME = 'pg-spawn.lock';
-const LOCK_WAIT_MS = 30_000;
-const LOCK_POLL_MS = 100;
-const LOCK_WARN_MS = 5_000;
-const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
 
 function attachOnlyMode() {
   return envFlag('MIXDOG_PG_ATTACH_ONLY') || envFlag('MIXDOG_MEMORY_SECONDARY');
 }
 
-// ── File lock (O_EXCL pattern from dispatch-persist.mjs / run-mcp.mjs) ───────
-
-/**
- * Acquire `${dataDir}/pg-spawn.lock`.
- * Returns the lock-file path on success, or null on timeout (caller proceeds
- * best-effort — worst case: two supervisors race initdb on the same pgdata,
- * but the second will fail pg_ctl start gracefully and healthcheck will
- * converge on the first's port).
- */
-async function acquireSpawnLock(dataDir, blockedProbe = null) {
-  const lp = join(dataDir, SPAWN_LOCK_NAME);
-  const deadline = Date.now() + LOCK_WAIT_MS;
-  const body = JSON.stringify({ pid: process.pid, startedAt: Date.now() });
-  let warned = false;
-  for (;;) {
-    try {
-      // 'wx' = O_CREAT | O_EXCL — atomic, fails with EEXIST if held.
-      writeFileSync(lp, body, { flag: 'wx' });
-      return { lockPath: lp, reuse: null };
-    } catch (err) {
-      if (!LOCK_WAIT_CODES.has(err?.code)) {
-        __mixdogMemoryLog(`[supervisor-pg] spawn lock error: ${err?.code || err?.message}\n`);
-        return { lockPath: null, reuse: null };
-      }
-      if (blockedProbe) {
-        try {
-          const reuse = await blockedProbe();
-          if (reuse) return { lockPath: null, reuse };
-        } catch {}
-      }
-      // Dead-holder detection: same as run-mcp.mjs acquireLock().
-      try {
-        const holder = JSON.parse(readFileSync(lp, 'utf8'));
-        if (holder?.pid) {
-          try {
-            process.kill(holder.pid, 0);
-          } catch (ke) {
-            if (ke.code === 'ESRCH') {
-              try {
-                unlinkSync(lp);
-              } catch {}
-              continue; // retry immediately after removing stale lock
-            }
-          }
-        }
-        const ageMs = Date.now() - Number(holder?.startedAt || 0);
-        if (!warned && ageMs >= LOCK_WARN_MS) {
-          warned = true;
-          __mixdogMemoryLog(
-            `[supervisor-pg] waiting for spawn lock holder pid=${holder?.pid || 'unknown'} ageMs=${ageMs}\n`
-          );
-        }
-      } catch {
-        /* unreadable — fall through and wait */
-      }
-      if (Date.now() >= deadline) {
-        if (blockedProbe) {
-          try {
-            const reuse = await blockedProbe();
-            if (reuse) return { lockPath: null, reuse };
-          } catch {}
-        }
-        throw new Error(`[supervisor-pg] spawn-lock acquire timeout (concurrent supervisor risk)`);
-      }
-      await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-    }
-  }
-}
-
-function releaseSpawnLock(lp) {
-  if (!lp) return;
-  try {
-    unlinkSync(lp);
-  } catch {}
-}
-
 // ── Port allocation ──────────────────────────────────────────────────────────
 
 function _probePort(port) {
@@ -602,18 +522,10 @@ async function _doEnsure(dataDir, signal) {
     throw new Error('secondary memory runtime requires an existing PG instance');
   }
 
-  // ── Acquire spawn lock to serialize initdb races ─────────────────────────
-  const acquired = await acquireSpawnLock(dataDir, () =>
-    tryReusePgInstance({
-      pgdata,
-      runtimeDir,
-      healthcheckPg,
-      source: 'lock-wait',
-    })
-  );
-  if (acquired?.reuse) return acquired.reuse;
-  const lp = acquired?.lockPath ?? null;
-  try {
+  // ── Spawn lock serializes initdb races (see withFileLock below) ──────────
+  let lockEntered = false;
+  const spawnUnderLock = async () => {
+    lockEntered = true;
     // ── Reuse path: another supervisor already started PG ─────────────────
     const lockedReuse = await tryReusePgInstance({
       pgdata,
@@ -701,8 +613,16 @@ async function _doEnsure(dataDir, signal) {
     // ── Allocate a fresh port and spawn ───────────────────────────────────
     const port = await allocatePort();
     return await _startFresh(dataDir, pgdata, port, runtimeDir);
-  } finally {
-    releaseSpawnLock(lp);
+  };
+  try {
+    return await withFileLock(join(dataDir, 'pg-spawn.lock'), spawnUnderLock, { timeoutMs: 30_000 });
+  } catch (err) {
+    // Only an acquisition timeout (spawnUnderLock never ran) falls back to
+    // reuse; failures from inside the locked region propagate untouched.
+    if (lockEntered || err?.code !== 'ELOCKTIMEOUT') throw err;
+    const reuse = await tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source: 'lock-wait' });
+    if (reuse) return reuse;
+    throw new Error('[supervisor-pg] spawn-lock acquire timeout (concurrent supervisor risk)', { cause: err });
   }
 }
 

package/src/runtime/memory/lib/recall-hybrid/hybrid-sql.mjs

@@ -119,6 +119,11 @@ exact AS (
   WHERE false
 ),`;
   }
+  // Each row is lowercased once (OFFSET 0 keeps the subquery from being
+  // inlined into the per-term condition) and every term is a literal strpos
+  // on that text. Per-term ILIKE re-lowercased the whole content for every
+  // term, so a natural-language query's 10+ terms multiplied the scan cost.
+  // Terms arrive lowercased from buildExactTerms.
   return `
 exact_matches AS (
   SELECT ee.id,
@@ -126,10 +131,14 @@ exact_matches AS (
          q.term,
          COUNT(*) OVER (PARTITION BY q.term)::float8 AS term_df
   FROM entries ee
+  CROSS JOIN LATERAL (
+    SELECT lower(ee.content) AS content, lower(ee.element) AS element, lower(ee.summary) AS summary
+    OFFSET 0
+  ) lc
   JOIN LATERAL unnest($${exactTermsParam}::text[]) AS q(term) ON (
-       ee.content ILIKE '%' || q.term || '%'
-       OR ${recallSubstringPredicate('ee.element', 'q.term')}
-       OR ${recallSubstringPredicate('ee.summary', 'q.term')}
+       strpos(lc.content, q.term) > 0
+       OR strpos(lc.element, q.term) > 0
+       OR strpos(lc.summary, q.term) > 0
   )
   WHERE true
     ${filters.exactFilterClause}

package/src/runtime/office/authoring/docx-html-runner.mjs

@@ -17,7 +17,7 @@ import { renderPdfPages } from '../pdf/pdf-render.mjs';
 const PX_TO_PT = 0.75;
 
 /** Artifacts kept beside the document: its HTML and the browser's print of it. */
-export function docxHtmlArtifacts(target) {
+function docxHtmlArtifacts(target) {
   return {
     source: `${target}.mixdog-source.html`,
     print: `${target}.mixdog-html.pdf`,

package/src/runtime/office/authoring/pptx-author-action.mjs

@@ -34,7 +34,7 @@ const PPTX_AUTHOR_NEEDS_SOURCE =
   'author requires script: HTML slides or a pptxgenjs script (without one it re-authors from <deck>.pptx.mixdog-source.html, and none is there). Load the `pptx` Skill first (Skill name:"pptx"): it carries the authoring workflow, the HTML contract, the composition grammar, and the device kit, then call author again with path and script.';
 
 // HTML opens with markup (a doctype, a comment, an element); a pptxgenjs script never does.
-export function isHtmlSource(source) {
+function isHtmlSource(source) {
   return /^\s*</.test(String(source || ''));
 }
 

package/src/runtime/office/authoring/xlsx-html-build.mjs

@@ -140,7 +140,7 @@ function resolveRange(text, cells, notes) {
 }
 
 /** The operations that write one measured workbook; formulas and charts come after every sheet's values. */
-export function xlsxOperationsFromSheets(sheets, { captures = new Map(), notes = [] } = {}) {
+function xlsxOperationsFromSheets(sheets, { captures = new Map(), notes = [] } = {}) {
   const first = [];
   const later = [];
   const chartData = [];

package/src/runtime/office/authoring/xlsx-html-runner.mjs

@@ -49,7 +49,7 @@ function fillRangeCharts() {
 }
 
 /** Artifacts kept beside the workbook: its HTML and the browser's picture of each sheet. */
-export function xlsxHtmlArtifacts(target) {
+function xlsxHtmlArtifacts(target) {
   return {
     source: `${target}.mixdog-source.html`,
     shot: (sheet) => `${target}.mixdog-html-sheet-${sheet}.png`,

package/src/runtime/office/capabilities.mjs

@@ -430,7 +430,7 @@ function docxStyleDefinitionFault(format, name, operation, index) {
 
 // A Word table has two alignments that read alike: `alignment` places the
 // table on the page and `columnAlignments` sets the text of each column.
-// A list written into the first used to be serialized verbatim into the
+// A list written into the first would be serialized verbatim into the
 // table's justification and refused by Word's schema at finalize.
 function docxTableAlignmentFaults(format, name, operation, index) {
   const properties = operation.properties;

package/src/runtime/office/core/office-core.mjs

@@ -118,7 +118,7 @@ export async function ensureOfficeSessionDesign(
   session.designRequest = mergeOfficeDesignRequest(session.designRequest, args.design);
   // A native document stays native: the `design` a later call carries is the
   // page review (reviewed, reviewToken, critique) or content, not a request
-  // for a preset. Resolving it as one used to hand a Word or Excel file the
+  // for a preset. Resolving it as one would hand a Word or Excel file the
   // default profile's palette and art direction it never asked for, and put
   // the preset review's gates in front of finalize.
   session.design =

package/src/runtime/office/design/content-model.mjs

@@ -108,9 +108,9 @@ export function normalizeOfficeContentModel(value) {
     const id = safeId(claim.id, 'claim id', `claim ${index + 1}${claim?.text ? `: ${claim.text}` : ''}`);
     if (claimIds.has(id)) throw new Error(`Office content model has duplicate claim id ${id}`);
     claimIds.add(id);
-    // The references are the point of a claim: naming them "facts" instead of
-    // factIds used to bind the claim to nothing at all, and the deck then
-    // reported the figure it carried as unsourced.
+    // The references are the point of a claim, so `facts` is accepted as an
+    // alias of `factIds`: a claim written with either name stays bound to its
+    // sources instead of reporting the figure it carried as unsourced.
     let references = [];
     if (Array.isArray(claim.factIds)) references = claim.factIds;
     else if (Array.isArray(claim.facts)) references = claim.facts;

package/src/runtime/office/design/docx/design-docx/section.mjs

@@ -39,10 +39,10 @@ function writeSectionHeading(w, section) {
 function writeSectionList(w, section, sectionKind, blockFollows = false) {
   const { append, colors, type, bodySize, spacing } = w;
   const sectionBullets = strings(section.bullets);
-  // A section that names steps draws them. They used to reach the page only
-  // when the section also declared kind:'roadmap', so a plan section landed as
-  // a heading with nothing under it - and the audit reported the orphan heading
-  // the composer had just written.
+  // A section that names steps draws them. Reaching the page only with
+  // kind:'roadmap' would land a plan section as a heading with nothing under
+  // it - and the audit would report the orphan heading the composer had just
+  // written.
   const sectionSteps = Array.isArray(section.steps) ? section.steps : [];
   const stepSource = sectionSteps.length ? sectionSteps : sectionBullets;
   const drewSteps =
@@ -76,8 +76,8 @@ function writeSectionList(w, section, sectionKind, blockFollows = false) {
   });
 }
 
-// What a section can carry. A field outside this list used to vanish: a plan written as `roadmap:[…]` reached the
-// page as a heading with nothing under it, and the composer reported success.
+// What a section can carry. A field outside this list would vanish: a plan written as `roadmap:[…]` would reach the
+// page as a heading with nothing under it, and the composer would report success.
 const SECTION_FIELDS = new Set([
   'heading',
   'title',

package/src/runtime/office/design/xlsx/design-xlsx-components.mjs

@@ -197,7 +197,7 @@ export function addXlsxDecisionPanel(
       cursor += 1;
     });
   }
-  // The actions follow the gates rather than stand in for them: given both, the actions used to be dropped.
+  // The actions follow the gates rather than stand in for them: given both, the actions would be dropped.
   if (gateRows.length && strings(actions).length) cursor += 1;
   for (const action of strings(actions).slice(0, 4)) {
     mergedBlock(output, {

package/src/runtime/office/design/xlsx/design-xlsx.mjs

@@ -417,7 +417,7 @@ function metricLabelStyle({ colors, type, dashboard }) {
 // metric is the one the strip paints as the headline, so the wider card reads
 // as emphasis rather than as a card that ran out of room.
 // More cards than columns wrap onto a second strip rather than pulling the
-// canvas past the table: a three-metric strip over a two-column table used to
+// canvas past the table: a three-metric strip over a two-column table would
 // make every band half again as wide as the table under it.
 // The text a card's value shows under its number format ("47.0%" for 0.47 under 0.0%, "12명" for 12 under 0"명").
 function metricDisplayText(metric) {

package/src/runtime/office/pdf/ocr-engine.mjs

@@ -9,7 +9,7 @@ import { workerExecArgv } from '../../shared/worker-exec-argv.mjs';
 const ENGINE_URL = new URL('./ocr-engine-worker.mjs', import.meta.url);
 
 /** The start includes the first-use download; without network it fails or hangs. */
-export const OCR_ENGINE_START_TIMEOUT_MS = 90_000;
+const OCR_ENGINE_START_TIMEOUT_MS = 90_000;
 
 const engines = new Map();
 

package/src/runtime/office/pdf/pdf-writer.mjs

@@ -13,10 +13,10 @@ const HEADING_SIZES = Object.freeze({ 1: 16, 2: 13, 3: 12 });
 
 const FLOW_FIELDS = ['before', 'after', 'x', 'width', 'color', 'align'];
 
-// What each block actually takes. A block the writer cannot read used to flow
-// as an empty paragraph: a table or a list written under the wrong key left no
-// mark on the page and no word in the result, so the report shipped without
-// the evidence it was asked for.
+// What each block actually takes. A block the writer cannot read would flow
+// as an empty paragraph: a table or a list written under the wrong key would
+// leave no mark on the page and no word in the result, so the report would ship
+// without the evidence it was asked for.
 const BLOCK_FIELDS = Object.freeze({
   paragraph: Object.freeze({ required: ['text'], optional: [...FLOW_FIELDS, 'size', 'lineHeight'] }),
   heading: Object.freeze({ required: ['text'], optional: [...FLOW_FIELDS, 'size', 'lineHeight', 'level'] }),

package/src/runtime/office/portable/portable-docx-operations.mjs

@@ -825,8 +825,8 @@ function styledDocxCell(cell, op) {
 }
 
 // A merged cell keeps what it carried (its shading, its borders, the bottom alignment a header row sits on, as Word
-// keeps them) and takes the spans; its width becomes the widths it joins. The whole tcPr used to be replaced, and a
-// two-level header's merged labels rose to the top of their cells on this backend only. Children stay in schema
+// keeps them) and takes the spans; its width becomes the widths it joins. Replacing the whole tcPr would make a
+// two-level header's merged labels rise to the top of their cells on this backend only. Children stay in schema
 // order: cnfStyle, tcW, gridSpan, vMerge, then the rest.
 function mergedCellXml(joined, spans) {
   const existing = /<w:tcPr(?:\s[^>]*)?>([\s\S]*?)<\/w:tcPr>/.exec(joined[0])?.[1] || '';