jasperdew · Oct 1, 2026
@@ -22,7 +22,7 @@
 #
 # The `if:` below lives in this file, and `gh workflow run --ref <branch>` runs
 # THIS FILE FROM THAT BRANCH. A branch that deletes the guard is not stopped by
-# it. Codex made that point on #1538 and it is right: this is not a boundary
+# it. Review made that point on #1538 and it is right: this is not a boundary
 # against a hostile branch.
 #
 # What it does stop is the accident -- dispatching a feature branch out of habit

@@ -266,7 +266,7 @@ jobs:
           # deliberately did not gate. Under `set -e` that would fail the job
           # exactly like a real failure, which would keep every pull request red
           # until somebody commits a Linux floor: the outage the exit-3 branch
-          # exists to avoid, reintroduced by the caller. (codex, #1617)
+          # exists to avoid, reintroduced by the caller. (review, #1617)
           #
           # 0 and 3 pass; anything else fails. When "linux" joins BLOKKEERT this
           # stays correct, because a gated platform never returns 3.
@@ -297,7 +297,7 @@ jobs:
           # Not plain `rustup target add`: that lands on the default toolchain,
           # which is `stable` here, while rust-toolchain.toml pins 1.94.0 and
           # that is what cargo will use. Same trap as #1539 -- a target on the
-          # wrong toolchain gives "can't find crate for `core`". Codex, #1547.
+          # wrong toolchain gives "can't find crate for `core`". review, #1547.
           rustup target add wasm32-unknown-unknown \
             --toolchain "$(rustup show active-toolchain | cut -d" " -f1)"
           cargo check --target wasm32-unknown-unknown -p pdfluent --tests
@@ -470,7 +470,7 @@ jobs:
           # to the manifest and forget to commit its generated .rs, and the
           # extractor creates that file as untracked -- which `git diff` does
           # not see, so the guard reports no drift for precisely the
-          # manifest-expansion it is meant to catch. (codex, #1610)
+          # manifest-expansion it is meant to catch. (review, #1610)
           nieuw=$(git status --porcelain -- crates/pdfluent/tests/web_examples/ \
                   | awk '$1 == "??" { print $2 }')
           if ! git diff --exit-code --stat -- crates/pdfluent/tests/web_examples/ || [ -n "$nieuw" ]; then
@@ -498,7 +498,7 @@ jobs:
           # Not plain `rustup target add`: that lands on the default toolchain,
           # which is `stable` here, while rust-toolchain.toml pins 1.94.0 and
           # that is what cargo will use. Same trap as #1539 -- a target on the
-          # wrong toolchain gives "can't find crate for `core`". Codex, #1547.
+          # wrong toolchain gives "can't find crate for `core`". review, #1547.
           rustup target add wasm32-unknown-unknown \
             --toolchain "$(rustup show active-toolchain | cut -d" " -f1)"
           curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

@@ -194,7 +194,7 @@ jobs:
           # a rustup shim with no toolchain installed -- the substitution fails,
           # `echo` still returns 0, `set -e` sees nothing, and the step reports
           # success with an empty version. The one case this check exists for
-          # would pass it. (codex, #1659)
+          # would pass it. (review, #1659)
           cargo --version || {
             echo "::error::cargo is on PATH but does not run. A rustup shim without an installed toolchain does this: `command -v cargo` succeeds and every build fails." >&2
             exit 1
@@ -247,15 +247,15 @@ jobs:
           # three has moved -- the check would report moved=false and sleep
           # through exactly the change that breaks it. Manifests and the lock
           # file are here for the same reason: a version bump changes the
-          # writer. (codex, #1649)
+          # writer. (review, #1649)
           # `--quiet` and its exit code, NOT a pipe into grep. Under `pipefail`,
           # `git diff --name-only ... | grep -q .` fails the whole pipeline with
           # 141 as soon as grep stops reading and git takes SIGPIPE -- which is
           # what happens when there are MANY matches, e.g. a bulk edit under
           # crates/lopdf/. The `else` branch then wrote moved=false and skipped
           # the fixture check precisely when the input it guards had changed
           # most. A detector whose failure mode is "too much evidence" is not a
-          # detector. (codex, #1649)
+          # detector. (review, #1649)
           #
           # `git diff --quiet` exits 0 for no change, 1 for a change and 2 on
           # error, so anything that is not a clean "nothing moved" runs the
@@ -765,7 +765,7 @@ jobs:
       # reads exactly like a guard that reads neither file.
       #
       # This file is t2's and is on loan for these two steps (#220); the loan and
-      # its expiry are written in .claude/territories.toml.
+      # its expiry are written in the territory map.
       - name: The order-form guard goes red where it must
         if: ${{ !cancelled() }}
         run: python3 scripts/ci/test_the_order_form_agrees_with_the_licence.py
@@ -779,7 +779,7 @@ jobs:
       # comparing them. Test first, same reason as every pair on this list.
       #
       # These two steps are on the same loan of this file as the two above
-      # (#220); the loan and its expiry are written in .claude/territories.toml.
+      # (#220); the loan and its expiry are written in the territory map.
       - name: The one-offer guard goes red where it must
         if: ${{ !cancelled() }}
         run: python3 scripts/ci/test_one_offer_in_every_document.py
@@ -1172,7 +1172,7 @@ jobs:
       # base ref the guard printed SKIPPED and exited 0 while a change to a
       # `niet_mergen` entry passed underneath it. It is fatal now, so this fetch
       # is what makes it able to answer rather than what hides it.
-      # (codex, #1639)
+      # (review, #1639)
       # actions/checkout is depth-1, and HEAD itself is in .git/shallow. A
       # TARGETED fetch of the base brings the object in and does not connect it
       # to HEAD's history, so `git merge-base HEAD origin/master` still fails --
@@ -1182,7 +1182,7 @@ jobs:
       # My first fix made that fatal instead of silent, which turned a guard
       # that always passed into one that always failed. Both are the same
       # defect: the check never ran. This is the half that makes it able to run.
-      # (codex, #1639)
+      # (review, #1639)
       - name: Give the fork guards a history to compare against
         if: ${{ !cancelled() }}
         env:

@@ -4,7 +4,7 @@
 # `paths-ignore: '**.md'`, so a pull request that ONLY removes Markdown never
 # starts it -- and a Markdown removal is exactly what this guard exists to
 # notice. The guard lived in ci.yml's commit-identity-guard job and could not run
-# for the case its own tests cover. (codex, #1635)
+# for the case its own tests cover. (review, #1635)
 #
 # Nothing is filtered here. It is two Python scripts and a checkout; running it
 # on every event costs less than the class of change it would otherwise miss.
@@ -40,7 +40,7 @@ concurrency:
   # quick succession used to share one: A carries an undeclared deletion, B is
   # innocent, A's run is cancelled, and B compares A..B where the file is already
   # absent on both sides -- green, with A never judged. A cancelled run is not a
-  # passing run, and here it silently became one. (codex, #1635)
+  # passing run, and here it silently became one. (review, #1635)
   group: deletions-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
@@ -58,7 +58,7 @@ jobs:
     #
     # Push events keep xfa-fast: a spending limit disables hosted runners, and a
     # check that stops running exactly when the bill does is not a check.
-    # (codex, #1635)
+    # (review, #1635)
     # The desktop runner, plainly. The per-event expression that used to stand
     # here chose a hosted runner for a pull request; with no pull_request
     # trigger left (#333) its condition can only be true, so the expression
@@ -83,7 +83,7 @@ jobs:
           python-version: '3.12'
       # ubuntu-latest has no PyYAML, and pr_code_stays_off_the_desktop.py reads
       # workflow files. Without this every pull request went red on an import.
-      # (codex, #1635)
+      # (review, #1635)
       - name: Install PyYAML
         if: ${{ !cancelled() }}
         run: pip install --quiet pyyaml
@@ -122,7 +122,7 @@ jobs:
             # A push reports where the branch actually WAS. Resolving a merge
             # base from it loses anything added between the common ancestor and
             # that tip, so a force-push could drop a file and report nothing.
-            # (codex, #1635)
+            # (review, #1635)
             EXACT="--exact-base"
           fi
           # A brand-new branch has no "before"; git reports all-zeros for it.

@@ -139,7 +139,7 @@ jobs:
           echo "## Every target/ on this filesystem, not only in this checkout"
           # Same rule for find: exit 1 means some path could not be read, which
           # is expected when walking / as the runner user; 2+ is a real error and
-          # must not be hidden behind `|| true`. (codex, #1662)
+          # must not be hidden behind `|| true`. (review, #1662)
           find / -xdev -type d -name target -prune > "$RUNNER_TEMP/targets.txt" 2>/dev/null && rc=0 || rc=$?
           [ "$rc" -le 1 ] || { echo "::error::find failed with $rc"; exit "$rc"; }
           [ "$rc" -eq 0 ] || echo "(find could not read every directory; partial)"

@@ -59,7 +59,7 @@ jobs:
       # A tag name is free text, and `github.ref_name` hands over whatever is
       # left after the prefix is stripped. A tag called `v1.2.$(id)` is a legal
       # ref, matches this workflow's tag trigger, and reaches the shell as a
-      # command. Through `env:` it arrives as data. (Codex, #1540)
+      # command. Through `env:` it arrives as data. (review, #1540)
       - name: Inspect image
         env:
           REF_NAME: ${{ github.ref_name }}

@@ -31,7 +31,7 @@ jobs:
           # Status-checked, not `echo $(…)`: if cargo resolves but cannot run --
           # a rustup shim with no toolchain installed -- the substitution fails,
           # `echo` still returns 0, `set -e` sees nothing, and the step reports
-          # success with an empty version. (codex, #1659)
+          # success with an empty version. (review, #1659)
           cargo --version || {
             echo "::error::cargo is on PATH but does not run. A rustup shim without an installed toolchain does this: command -v cargo succeeds and every build fails." >&2
             exit 1

@@ -96,7 +96,7 @@ jobs:
         # `if:` at all -- reading it there does not come out false, it makes the
         # whole file invalid, which is what stopped this workflow for nine days.
         # Hoisting the token to the job's `env:` would fix that but hand a
-        # registry-write credential to every step in the job, which Codex
+        # registry-write credential to every step in the job, which the review
         # pointed out on #1544 and is right about. So the condition asks only
         # what it needs to, and the token stays on this one step. A missing
         # token now fails the publish loudly instead of skipping it in silence,

@@ -16,8 +16,8 @@ Before starting a release, confirm:
 - [ ] No open PRs are tagged `1.0-blocker` in milestone #52.
 - [ ] No public method panics on its happy path (see
       [STABILITY.md §3.3](STABILITY.md#33-deferred-truth-gaps-in-10)).
-- [ ] The Codex end-audit has been run and its result is
-      `Codex audit complete, milestone safe to close`.
+- [ ] The end-audit has been run and its result is
+      `Audit complete, milestone safe to close`.
 - [ ] `CHANGELOG.md` has a `[Unreleased]` section with all
       user-visible changes since the previous tag.
 

@@ -33,7 +33,7 @@ def parse_args() -> argparse.Namespace:
     )
     parser.add_argument(
         "--target-dir",
-        default=os.environ.get("CARGO_TARGET_DIR", "/tmp/codex-cloud-ocr-target"),
+        default=os.environ.get("CARGO_TARGET_DIR", "/tmp/pdfluent-cloud-ocr-target"),
         help="Cargo target directory to use.",
     )
     parser.add_argument(

@@ -2192,7 +2192,7 @@ mod tests {
     #[test]
     fn ocr_google_from_env_prefers_api_key() {
         let _env = env_lock().lock().expect("env lock");
-        let temp_path = std::env::temp_dir().join("codex-google-creds.json");
+        let temp_path = std::env::temp_dir().join("pdfluent-google-creds.json");
         let temp_path_string = temp_path.to_string_lossy().into_owned();
         std::fs::write(
             &temp_path,

@@ -1439,7 +1439,7 @@ mod bcmap_tests {
         assert_eq!(cmap.lookup_cid_code(0xFFFF, 2), Some(0xFFFF));
     }
 
-    // Note: Some tests AI-generated, haven't double-checked them.
+    // Note: Some tests automatically generated, haven't double-checked them.
 
     #[test]
     fn embedded_adobe_gb1_ucs2() {

@@ -290,7 +290,7 @@ fn _parse_char_string(
                             && wv.len() > 1
                         {
                             // Note: Following code (as well as any code related to
-                            // MM fonts) was AI-generated based on FreeType code,
+                            // MM fonts) was automatically generated based on FreeType code,
                             // haven't double-checked.
 
                             // MultipleMaster interpolation (base + delta form).

@@ -582,7 +582,7 @@ impl<'a> Stream<'a> {
         None
     }
 
-    // Note: AI generated, haven't double-checked.
+    // Note: Automatically generated, haven't double-checked.
     fn read_float_array(&mut self) -> Option<Vec<f32>> {
         let mut entries = Vec::new();
 

@@ -763,7 +763,7 @@ mod tests {
 
     #[test]
     fn flatten_preserves_non_js_entries_on_targeted_widget_with_shared_indirect_aa() {
-        // Codex P2 regression-guard (PR #1373 follow-up): when /AA is an
+        // review P2 regression-guard (PR #1373 follow-up): when /AA is an
         // indirect dict shared between widgets and contains a mix of JS and
         // non-JS entries, flattening the targeted widget must:
         //   - drop the JS entry (/E) from that widget's effective /AA

@@ -140,7 +140,7 @@ pub fn embed_font(
     // would be embedded under a key that promises glyf outlines, which viewers
     // cannot reliably load -- a document that opens and renders nothing, from a
     // call that returned Ok. CFF belongs in /FontFile3 with a matching subtype,
-    // which this path does not write. (Codex, #1614.)
+    // which this path does not write. (review, #1614.)
     if face.tables().cff.is_some() || face.tables().cff2.is_some() {
         return Err(EmbedFontError::CffOutlinesNotSupported);
     }
@@ -200,7 +200,7 @@ fn widths_for_winansi(face: &ttf_parser::Face<'_>, units_per_em: u16) -> Vec<i64
 /// 0x92)` looks up U+0092, a control character no font has a glyph for, so the
 /// width came out zero while the font does carry a right single quote at
 /// U+2019. Text using any of these sixteen was then laid out with the wrong
-/// spacing. (Codex, #1614.)
+/// spacing. (review, #1614.)
 ///
 /// The two `None`s are the two codes WinAnsiEncoding leaves undefined.
 fn winansi_to_char(code: u8) -> char {
@@ -333,7 +333,7 @@ fn register_on_every_page(
             // own reference limit fires first and get_object returns
             // ReferenceLimit, so the loop ends there. This bound covers the case
             // where a chain is long but under that limit, and costs a Vec of at
-            // most 32 ids. Raised by Codex on #1614; the hang it described is
+            // most 32 ids. Raised in review on #1614; the hang it described is
             // not reachable through this call today, and the guard is cheap
             // enough to keep for when the layer below changes.
             let mut seen = vec![fonts_id];
@@ -379,7 +379,7 @@ struct ResourcesHolder {
 /// ancestor that is destructive: `/Resources` inheritance picks the nearest
 /// dictionary rather than merging, so a new empty one hides every inherited
 /// font, XObject, colour space and graphics state, and content that used them
-/// stops rendering. (Codex, #1614.)
+/// stops rendering. (review, #1614.)
 fn resources_holder(doc: &Document, page_id: ObjectId) -> Result<ResourcesHolder, EmbedFontError> {
     let (own, inherited_ids) = doc
         .get_page_resources(page_id)

@@ -316,7 +316,7 @@ fn data_that_is_not_a_font_is_refused_rather_than_embedded() {
 }
 
 // ---------------------------------------------------------------------------
-// Findings from the Codex review on #1614. Each of these passed against the
+// Findings from the review on #1614. Each of these passed against the
 // first version of embed_font, which is why they are here.
 //
 // NOT covered, and stated so rather than left to be assumed from the count of