fix: apply a second review pass over this branch

Seven things a read-through of the branch turned up. Each is reverse-verified:
with the fix removed, the case named for it goes red.

- The circular buttons in @ranuts/chat-ui were round only because the SITE
  zeroes button padding. The rules ship in the package; a host without that
  reset renders the same 60x50 ellipse this repo already shipped once. They now
  declare their own box.
- @ranuts/converter's loadScript replaced every cause with "Failed to load X2T
  WASM script". A host classifies open failures on the message text, and that
  wording matches none of its environment cases -- so a CDN 500 or a refused
  heap on the buffered path was reported as a possibly-corrupt document, and
  never retried. The cause is kept in the message, as the vendor loader does.
- probeX2tMemory committed x2t's whole 283 MB on a browser that had just
  refused it, twice per failure (the guard's asc_onError, then the vendor's own
  -82 for the same failure). Once refused, the answer is reused; a
  user-initiated open asks again, since the reader may have freed memory.
- The landing page refused to promote a waiting worker while ANY second window
  was open, including another landing tab -- so a reader who keeps two tabs of
  the site open never got an update. The worker now reports how many windows
  are on the editor route, which is the only kind an activation can disturb.
- wouldDiscardVendorAssets is evaluated during install, and activate deletes
  the mismatched caches right after. In between, a page of the outgoing build
  can write its first vendor entries into its own cache. The delete asks again.
- Unrelated locale churn, one line of it wrong: Korean particles do not take a
  space ("API가"), and the new Korean string had picked up the same habit.
- VENDOR_VERSION hashed `$DIST_DIR/sdkjs/...`, and shasum prints the path next
  to the digest -- so the same vendor tree built into dist-e2e-4174/ named a
  different runtime cache than one built into dist/. Hashed from inside now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: chaxus

bin/build.sh

@@ -126,14 +126,20 @@ if [ -f "$SW_PATH" ]; then
         HASH_CMD="sha256sum"
     fi
     VENDOR_DIRS=""
-    for dir in "$DIST_DIR/sdkjs" "$DIST_DIR/web-apps" "$DIST_DIR/fonts"; do
-        if [ -d "$dir" ]; then
+    for dir in sdkjs web-apps fonts; do
+        if [ -d "$DIST_DIR/$dir" ]; then
             VENDOR_DIRS="$VENDOR_DIRS $dir"
         fi
     done
     if [ -n "$VENDOR_DIRS" ]; then
+        # Hashed from inside $DIST_DIR, with RELATIVE paths: `shasum` prints the
+        # path next to each digest, so hashing "$DIST_DIR/sdkjs/..." would fold
+        # the output directory's own name into the stamp -- the same vendor tree
+        # built into `dist-e2e-4174/` would name a different runtime cache than
+        # the one built into `dist/`. What this stamp claims to be, and what
+        # sw.js relies on, is the content of the tree.
         # shellcheck disable=SC2086 # deliberate word splitting: a list of dirs
-        VENDOR_VERSION=$(find $VENDOR_DIRS -type f -exec $HASH_CMD {} + | LC_ALL=C sort | $HASH_CMD | cut -c1-12)
+        VENDOR_VERSION=$(cd "$DIST_DIR" && find $VENDOR_DIRS -type f -exec $HASH_CMD {} + | LC_ALL=C sort | $HASH_CMD | cut -c1-12)
     else
         echo "[build] Warning: no vendor tree found; sw.js keeps its dev vendor stamp." >&2
         VENDOR_VERSION="novendor"

docs/explorations/2026-08-20-review-round-two-followups.md

@@ -0,0 +1,98 @@
+# Review 第二轮：#144 那批改动的七条追补（2026-08-20）
+
+第一轮追补见
+[2026-08-20-review-followups.md](2026-08-20-review-followups.md)；那之后又对整个
+分支通读了一遍，记下这七条。CDN 抖动那条单独成文
+（[2026-08-20-x2t-wasm-fetch-transient-retry.md](2026-08-20-x2t-wasm-fetch-transient-retry.md)），
+这里是其余六条 + 一条纯文案回退。
+
+## 1. 圆形按钮靠宿主页的 reset 撑着，包自己不自足
+
+拆掉 Tailwind 后补的 `button { padding: 0; box-sizing: border-box }` 修好了
+`.agent-launcher` 的 60×50 椭圆。但同样形状的 `.cui-send` /
+`.cui-scroll-bottom` 住在 `@ranuts/chat-ui` 里——它们「定宽高 32px +
+border-radius: 50%」，圆不圆取决于**宿主页**有没有那条 reset。生态里另一个站点
+引这个包、没有同样的 reset，就会原样复现同一个椭圆，而且没有任何东西会提醒它。
+
+修法：把 `box-sizing: border-box; padding: 0` 写进这两条规则自身。本仓的全局
+reset 保留，作为页面级兜底（`.agent-launcher` 等本仓元素仍然靠它）。
+
+## 2. `@ranuts/converter` 的 `loadScript` 把失败原因吞了
+
+```ts
+} catch (error) {
+  const errorMsg = 'Failed to load X2T WASM script';
+  console.error(errorMsg, error);
+  throw new Error(errorMsg);   // ← 原因没了
+}
+```
+
+这次改动刚刚立下的契约是「失败消息要带得动原因，宿主的
+`classifyOpenFailure` 按消息文本分类」。而 `Failed to load X2T WASM script`
+一个关键词都不匹配，落到默认分支 `document`——于是 buffered 兜底路径上的
+CDN 500 或者内存拒绝，会被当成「文件可能已损坏」报给用户，还不重试。
+vendor 那份 helper 是原样重抛的，两份实现说好语义一致，这里破了。
+
+修法：`throw new Error(\`Failed to load X2T WASM script: ${cause}\`, { cause: error })`。
+
+## 3. 内存诊断探测自己要 283 MB，而且一次失败会探两遍
+
+`probeX2tMemory` 的 commit 半段是真向浏览器提交 x2t 的整个堆——跑在一台刚刚
+拒绝过这笔分配的机器上。`skipCommit` 只挡住「重开在飞」那条路，而一次失败的
+打开**会两次走到 toast**（守卫把 rejection 送进 `asc_onError` 一次，vendor 自己
+再为同一个失败报一次 -82），所以最终报错那一刻会连着要两次 283 MB。
+
+修法：浏览器一旦拒绝过 commit，本 session 内不再问（`commitRefused`），直接复用
+那个结论；`registerOpenAttempt` 在用户发起新的一次打开时清掉它——那是新情况，
+用户可能刚照提示关了几个标签页，值得重新问。
+
+## 4. 「只要还有第二个窗口就不提升 worker」太粗
+
+落地页提升等待中的 worker 前会问 active worker「你控制着几个窗口」，只有回答
+1 才提升。可它拒绝的其实是**任何**第二个窗口，包括另一个落地页标签——而落地页
+没有任何会被激活毁掉的会话。习惯常开两个本站标签页的人，因此永远拿不到新版本。
+
+worker 侧本来就拿得到 `client.url`。现在回答里多带一个 `editors`（路径匹配
+`/editor` 或 `/editor.html` 的窗口数），落地页只在 `editors === 0` 时提升；
+是否开着文档仍然不可知，所以任何编辑器窗口都算拦。旧 worker 的回答里没有这个
+字段，那种情况回落到原来的「我是不是唯一窗口」。
+
+## 5. install 的判据与 activate 之间有一道缝
+
+`wouldDiscardVendorAssets` 在 **install** 求值，`activate` 紧接着就删掉名字不
+匹配的 runtime cache。这中间旧构建的页面完全可能刚把第一批 vendor 条目写进
+它自己的 cache——install 那一刻看到的是空的，于是放行；到 activate 就把它删了，
+正是这条判据要防的混版。
+
+修法：删之前再问一次（`holdsVendorAssetsForOpenWindow`）。代价是每个陈旧
+cache 一次 `keys()`，把窗口缩到「这次读」和「这次删」之间。没有窗口打开时照删
+不误——那时没人会被伤到。
+
+## 6. i18n 里混进了与本次改动无关的润色，韩语那条还改错了
+
+`API가` 被改成 `API 가`（韩语助词不空格），新加的韩语文案也带同样的
+「括号后加空格」习惯。日语几处 `: `→`：` 无害但同样无关。全部回退/修正，
+新韩语文案改成 `메모리(약 {mb} MB)를` / `64비트`。
+
+## 7. `VENDOR_VERSION` 其实是「路径 + 内容」哈希
+
+`shasum` 会把路径打印在摘要旁边，而 `find "$DIST_DIR/sdkjs" ...` 传的是带
+`$DIST_DIR` 前缀的路径——于是同一棵 vendor 树，构建到 `dist/` 和构建到
+`dist-e2e-4174/` 会得到两个不同的 runtime cache 名。生产只有一个 DIST_DIR，
+所以不影响线上，但注释和 CLAUDE.md 都写的是「内容哈希」。改成
+`cd "$DIST_DIR" && find sdkjs web-apps fonts ...`，名副其实。
+
+## 用例与反向验证
+
+| 修复 | 用例                                                                                    | 去掉修复后    |
+| ---- | --------------------------------------------------------------------------------------- | ------------- |
+| 1    | `styles-contract`：包内两条规则各自声明 border-box + padding 0                          | 2 red         |
+| 2    | `converter-wasm-loading`：buffered 路径 404，`loadScript` 的消息要带原文                | 1 red         |
+| 3    | `onlyoffice-wasm-memory`：拒绝过就不再问；`resetMemoryProbe` 后再问                     | 1 red         |
+| 4    | `sw-register`：editors>0 拦、第二个落地页照提升、旧回答回落；sw.js 源钉 + `sw-warm` E2E | 1 red（源钉） |
+| 5    | `sw-update`：陈旧 cache 有 vendor 条目且有窗口时不删；没窗口照删；core cache 照删       | 1 red         |
+| 7    | `sw-update`：`VENDOR_VERSION=$(cd "$DIST_DIR" && find …)`                               | 1 red         |
+
+第 4 条的页面侧行为（第二个落地页照提升）用假 controller 测，去掉 sw.js 那半不会
+让它变红——变红的是钉 sw.js 源的那条，加上 `sw-warm` 里对真实 worker 回答
+`{count, editors}` 的断言。第 6 条是纯文案回退，没有用例。

lib/onlyoffice/open-failure.ts

@@ -1,7 +1,7 @@
 import { t } from '@ranuts/shared/i18n';
 import { getDocumentOpenError, isDocumentContentReady, markDocumentOpenFailed, noteFrameError } from './open-state';
 import { failPendingSaveConversion } from './save-stream';
-import { isWasmAllocationFailure } from './wasm-memory';
+import { isWasmAllocationFailure, resetMemoryProbe } from './wasm-memory';
 
 /**
  * Everything about an open that did not survive: which document was being
@@ -257,6 +257,9 @@ export function registerOpenAttempt(config: {
   if (config.isRetry) return;
   // A user-initiated open supersedes whatever the last attempt was doing.
   openRetryInFlight = false;
+  // And it is worth asking the browser about memory again: the reader may have
+  // closed the tabs the last failure told them to close (see resetMemoryProbe).
+  resetMemoryProbe();
   currentOpenAttempt = {
     fileName: config.fileName,
     fileType: config.fileType,

lib/onlyoffice/wasm-memory.ts

@@ -93,6 +93,27 @@ export enum WasmMemoryVerdict {
   Unavailable = 'unavailable',
 }
 
+/**
+ * Whether this browser has already refused to commit x2t's heap.
+ *
+ * A single failed open reaches the toast more than once -- the guard routes
+ * the rejection into `asc_onError` and the vendor raises its own -82 for the
+ * same failure -- and each pass would otherwise ask the browser for another
+ * 283 MB it has just said it does not have. Once refused, the answer is
+ * reused: it is the same answer, and asking again costs exactly the memory
+ * that is missing.
+ *
+ * Reset by `registerOpenAttempt` for a user-initiated open (open-failure.ts),
+ * which is a new situation and worth asking about again -- the reader may have
+ * closed the tabs the last toast told them to close.
+ */
+let commitRefused = false;
+
+/** See `commitRefused`: a user-initiated open asks the browser afresh. */
+export function resetMemoryProbe(): void {
+  commitRefused = false;
+}
+
 /**
  * `skipCommit` leaves the commit half unasked and answers `Deferred`.
  *
@@ -119,6 +140,7 @@ export function probeX2tMemory(options?: { skipCommit?: boolean }): WasmMemoryVe
   // it is the half GitHub #144 points at; the commit half is worth 283 MB only
   // when nothing else needs them.
   if (options?.skipCommit) return WasmMemoryVerdict.Deferred;
+  if (commitRefused) return WasmMemoryVerdict.Commit;
   try {
     // x2t's descriptor verbatim, `maximum` included. Dropping it would make
     // this a question the engine is never actually asked: the two halves can
@@ -128,6 +150,7 @@ export function probeX2tMemory(options?: { skipCommit?: boolean }): WasmMemoryVe
     // failure that repeats every time. Costs the same 283 MB either way.
     void new Memory({ initial: X2T_INITIAL_PAGES, maximum: X2T_MAXIMUM_PAGES });
   } catch {
+    commitRefused = true;
     return WasmMemoryVerdict.Commit;
   }
   return WasmMemoryVerdict.Ok;

packages/chat-ui/src/styles.ts

@@ -154,6 +154,13 @@ export const CHAT_UI_CSS = `
   transform: translateX(-50%);
   width: 32px;
   height: 32px;
+  /* A round button is round only if its 32px includes the UA's own 1px 6px
+     button padding and this 1px border. Declared here rather than left to a
+     host reset: this file ships in @ranuts/chat-ui, and a host without one
+     renders these as ellipses (which is exactly what happened to the site's
+     own launcher when its CSS framework went away). */
+  box-sizing: border-box;
+  padding: 0;
   display: flex;
   align-items: center;
   justify-content: center;
@@ -218,6 +225,9 @@ export const CHAT_UI_CSS = `
   flex: 0 0 auto;
   width: 32px;
   height: 32px;
+  /* Same reason as .cui-scroll-bottom: the 32px circle owns its own box. */
+  box-sizing: border-box;
+  padding: 0;
   display: flex;
   align-items: center;
   justify-content: center;

packages/converter/src/document-converter.ts

@@ -291,9 +291,18 @@ export class X2TConverter {
       this.hasScriptLoaded = true;
       console.log('X2T WASM script loaded successfully');
     } catch (error) {
-      const errorMsg = 'Failed to load X2T WASM script';
-      console.error(errorMsg, error);
-      throw new Error(errorMsg);
+      // Keep the cause in the message, not just in `cause`. What reads this is
+      // a host's open-failure handling (lib/onlyoffice/open-failure.ts
+      // classifies on the message text), and a bare "Failed to load X2T WASM
+      // script" matches none of its environment wordings -- so a CDN 500 or a
+      // refused wasm heap on the buffered path, neither of which is a verdict
+      // on the document, was reported to the user as "the file may be
+      // corrupted" and never retried. The vendor-side loader
+      // (public/sdkjs/common/wasm/x2t/x2t_helper.js) rethrows its cause
+      // untouched; this is the same contract.
+      const cause = error instanceof Error ? error.message : String(error);
+      console.error('Failed to load X2T WASM script', error);
+      throw new Error(`Failed to load X2T WASM script: ${cause}`, { cause: error });
     }
   }
 

packages/shared/src/i18n.ts

@@ -351,12 +351,12 @@ const partialMessages: Record<Exclude<Language, LanguageCode.ZH | LanguageCode.E
     themeSystem: 'システム',
     themeLight: 'ライト',
     themeDark: 'ダーク',
-    fileSavedSuccess: 'ファイルを保存しました：',
-    documentLoaded: 'ドキュメントを読み込みました：',
+    fileSavedSuccess: 'ファイルを保存しました: ',
+    documentLoaded: 'ドキュメントを読み込みました: ',
     failedToLoadEditor: 'エディターを読み込めませんでした。OnlyOffice API が正しく配置されているか確認してください。',
-    unsupportedFileType: 'サポートされていないファイル形式：',
+    unsupportedFileType: 'サポートされていないファイル形式: ',
     invalidFileObject: '無効なファイルです',
-    documentOperationFailed: 'ドキュメントの操作に失敗しました：',
+    documentOperationFailed: 'ドキュメントの操作に失敗しました: ',
     editorErrorToast: 'ドキュメントエラー',
     editorErrorFormatMismatch: 'ファイルの内容が拡張子と一致しません。形式を確認してからもう一度お試しください',
     editorErrorOpenFailed:
@@ -376,7 +376,7 @@ const partialMessages: Record<Exclude<Language, LanguageCode.ZH | LanguageCode.E
     themeDark: '다크',
     fileSavedSuccess: '파일을 저장했습니다: ',
     documentLoaded: '문서를 불러왔습니다: ',
-    failedToLoadEditor: '편집기를 불러오지 못했습니다. OnlyOffice API 가 올바르게 설치되어 있는지 확인하세요.',
+    failedToLoadEditor: '편집기를 불러오지 못했습니다. OnlyOffice API가 올바르게 설치되어 있는지 확인하세요.',
     unsupportedFileType: '지원하지 않는 파일 형식: ',
     invalidFileObject: '잘못된 파일입니다',
     documentOperationFailed: '문서 작업에 실패했습니다: ',
@@ -385,7 +385,7 @@ const partialMessages: Record<Exclude<Language, LanguageCode.ZH | LanguageCode.E
     editorErrorOpenFailed:
       '파일을 열 수 없습니다. 손상되었거나, 지원하지 않는 형식이거나, 확장자와 내용이 다를 수 있습니다',
     editorErrorOutOfMemory:
-      '이 브라우저에서 문서 변환 엔진에 필요한 메모리 (약 {mb} MB) 를 할당할 수 없습니다. 다른 탭이나 창을 닫고 다시 시도하세요. 계속 실패하면 64 비트 브라우저 (Edge 또는 64 비트 Chrome) 를 사용하세요.',
+      '이 브라우저에서 문서 변환 엔진에 필요한 메모리(약 {mb} MB)를 할당할 수 없습니다. 다른 탭이나 창을 닫고 다시 시도하세요. 계속 실패하면 64비트 브라우저(Edge 또는 64비트 Chrome)를 사용하세요.',
   },
   [LanguageCode.DE]: {
     webOffice: 'Web Office',

public/sw-register.js

@@ -20,8 +20,11 @@
  * This is the missing half, and the landing page is the right place for it:
  * it has no document, so promoting here cannot corrupt a session of its own.
  * The one case it must still refuse is another tab that does have a document
- * open, which the page cannot see -- so it asks the active worker how many
- * window clients it controls and only promotes when it is alone.
+ * open, which the page cannot see -- so it asks the active worker what it
+ * controls and only promotes when no window is on the editor route. Another
+ * landing tab is not a reason to refuse: it has nothing to lose, and treating
+ * every second window as a possible editor left a reader who keeps two tabs of
+ * the site open on an old build for good.
  *
  * Plain JS on purpose: the landing pages ship no bundle. `__createSwUpdater`
  * is exposed so test/unit/sw-register.test.ts drives this file rather than a
@@ -39,7 +42,7 @@
     var timeoutMs = (options && options.timeoutMs) || CLIENT_COUNT_TIMEOUT_MS;
 
     /**
-     * How many window clients the active worker controls. Resolves to null
+     * What the active worker controls: `{ count, editors }`. Resolves to null
      * when there is nobody to ask or the answer does not arrive -- callers
      * treat that as "unknown" and leave the worker waiting.
      */
@@ -59,7 +62,7 @@
         };
         channel.port1.onmessage = function (event) {
           var data = event.data;
-          done(data && typeof data.count === 'number' ? data.count : null);
+          done(data && typeof data.count === 'number' ? data : null);
         };
         global.setTimeout(function () {
           done(null);
@@ -73,15 +76,22 @@
     }
 
     /**
-     * Promote the waiting worker, but only while this tab is the only one:
-     * activation wipes the outgoing build's caches, and another tab could be
-     * an editor with a document open.
+     * Promote the waiting worker, but not while another tab is on the editor
+     * route: activation wipes the outgoing build's caches, and such a tab may
+     * have a document open and is deliberately not reloaded when the new
+     * worker takes control.
+     *
+     * `editors` is missing from the reply of a worker deployed before it
+     * existed; there the old, blunter reading applies -- promote only when
+     * this tab is the only window at all.
      */
     function maybePromote(registration) {
       var waiting = registration.waiting;
       if (!waiting) return Promise.resolve(false);
-      return countClients().then(function (count) {
-        if (count === null || count > 1) return false;
+      return countClients().then(function (answer) {
+        if (!answer) return false;
+        var blocked = typeof answer.editors === 'number' ? answer.editors > 0 : answer.count > 1;
+        if (blocked) return false;
         waiting.postMessage({ type: 'SKIP_WAITING' });
         return true;
       });