macdoc follows ooxml-swift's main branch instead of the version it declares

[kiki830621]

Problem

macdoc does not actually version-pin ooxml-swift, despite its own manifest saying from: "3.0.0". The root Package.resolved records a branch pin:

"ooxml-swift": { "branch": "main", "revision": "…" }

For comparison, mcp/che-word-mcp/Package.resolved records "version": "3.0.1" for the identical dependency. Only the macdoc side is affected.

Root Cause

MacDocCLI reaches ooxml-swift transitively:

MacDocCLI → DocxWorkflowLib (path) → word-builder-swift → ooxml-swift (branch: "main")

word-builder-swift declares the dependency as branch: "main", and a transitive branch requirement overrides the root's own version range. Verified reproducible: deleting the root Package.resolved and running a clean resolve produces the identical branch-pinned result.

That branch declaration carries its own written rationale in packages/word-builder-swift/Package.swift ("Branch dependency preserves deploy-via-download semantics (no local path)"), so changing it is a decision to be made deliberately, not tidying.

Type

bug

Expected

macdoc resolves ooxml-swift by version, matching what its manifest declares and what the sibling consumer already does — so a push to ooxml-swift main cannot move the CLI without an explicit version bump.

Actual

Every resolve follows the branch tip. Today the tip happens to equal the released tag, so nothing looks wrong. A future untagged push to main would silently move the CLI ahead of che-word-mcp.

Impact

This is not merely theoretical fragility — it makes a shipped claim false. The script-pipeline-failure-contract change asserted that pinning both consumers meant "the two faces cannot diverge by dependency drift." That assertion has been corrected in the task text, but the underlying condition stands.

The fix is not one line. Seven reachable packages still declare pre-1.0 ooxml-swift ranges, numerically incompatible with 3.x:

• packages/html-to-word-swift — from: "0.5.3"
• packages/marker-swift — from: "0.5.1"
• packages/marker-word-converter-swift — from: "0.5.1"
• packages/md-to-word-swift — from: "0.5.1"
• packages/pdf-to-docx-swift — from: "0.5.3"
• packages/tex-to-docx-swift — from: "0.5.3"
• packages/word-to-html-swift — from: "0.5.3"

They resolve today only because the branch pin bypasses version unification entirely — SPM never validates their stated ranges against 3.x. So restoring version unification would immediately break resolution across all seven. The two problems are one problem and have to be fixed together, across eight repositories.

(packages/pptx-swift also carries a stale range but is confirmed NOT in this consumer's graph — it belongs to che-pptx-mcp. Out of scope.)

Source: 5-lens verification round on PsychQuant/che-word-mcp #180 / #181 — reported by the regression lens as CRITICAL + MEDIUM, independently reproduced.