@cabane/companion 0.6.144 → 0.6.146

package/dist/cli.js

@@ -110,18 +110,15 @@ var init_prepare_hook = __esm({
       // default is generous; a hook that hangs past this is killed and the turn
       // fails with a clear timeout message rather than pinning the companion.
       timeoutMs: z.number().int().positive().optional(),
-      // CT943: re-invoke the hook on turns where a prepared result already exists,
-      // in VALIDATE mode — the cached result is handed back as `prepared` and the
-      // hook's stdout is ignored, so the cwd provably cannot move. Its only power
-      // is to exit non-zero and fail the turn.
+      // Re-invoke the hook when a prepared result already exists, in VALIDATE
+      // mode: the cached result is handed back as `prepared` and stdout is
+      // ignored, so the cwd cannot move. Its only power is to exit non-zero and
+      // fail the turn. The hook resolves once per (conversation, agent), so a
+      // later message asking for a different environment is otherwise silently
+      // ignored; this lets a hook refuse it out loud.
       //
-      // Why it exists: the hook runs exactly once per (conversation, agent), so a
-      // later message asking for a different environment can't be honoured. Without
-      // this, it is silently ignored — the host knows and says nothing, which is
-      // the worst available outcome. An opt-in hook can now refuse it out loud.
-      //
-      // Default OFF, and deliberately: an operator hook that provisions
-      // unconditionally must not start running on every turn because it upgraded.
+      // Default OFF: a hook that provisions unconditionally must not start
+      // running on every turn because the companion upgraded.
       validateCached: z.boolean().optional(),
       // Independent operator-owned reporter. Receives sanitized failure metadata
       // on stdin; never re-enters this hook and cannot change the turn outcome.
@@ -160,16 +157,15 @@ var init_prepare_hook = __esm({
               CABANE_AGENT_USERNAME: input.agentUsername,
               CABANE_RUNTIME: input.runtime ?? "",
               CABANE_HOST_ACCESS: input.hostAccess ? "1" : "0",
-              // CT319: the conversation anchor is gone. These are kept as DEPRECATED
-              // back-compat constants so an old user prepare script that still reads
-              // them doesn't crash; a hook should key off CABANE_TRIGGER_ENTRY_PATHS.
+              // DEPRECATED constants, kept so an old prepare script that reads them
+              // doesn't crash; a hook should key off CABANE_TRIGGER_ENTRY_PATHS.
               CABANE_ANCHOR_KIND: "workspace",
               CABANE_ANCHOR_PATH: "",
-              // CT317: newline-joined — workspace paths never contain a newline, so a
+              // Newline-joined — workspace paths never contain a newline, so a
               // hook splits on `\n` unambiguously. Empty string when none.
               CABANE_TRIGGER_ENTRY_PATHS: input.triggerEntryPaths.join("\n"),
               CABANE_CONVERSATION_TITLE: input.title ?? "",
-              // CT943: the dispatching message's text, and — in validate mode only —
+              // The dispatching message's text, and — in validate mode only —
               // the prepared result the hook is being asked to check this dispatch
               // against. Both empty/absent on an ordinary first run.
               CABANE_TRIGGER_MESSAGE: input.messageBody ?? "",
@@ -458,18 +454,17 @@ var init_config = __esm({
     localAgentConfigSchema = z2.object({
       cwd: z2.string().optional(),
       prepareHook: prepareHookSchema.optional(),
-      // CT289: the Claude Code auto-memory escape hatch. Auto-memory is forced OFF
-      // by default on every companion (memory belongs in the Cabane workspace, and a
-      // shared companion would otherwise pool one cwd-keyed memory dir across users).
-      // On a companion you run yourself, set `claudeCode: { autoMemory: true }` to hand
-      // auto-memory back to your own `~/.claude/settings.json` — Cabane then stops
+      // The Claude Code auto-memory escape hatch. Auto-memory is forced OFF by
+      // default (memory belongs in the Cabane workspace, and a shared companion
+      // would pool one cwd-keyed memory dir across users). On a companion you run
+      // yourself, `claudeCode: { autoMemory: true }` hands auto-memory back to your
+      // own `~/.claude/settings.json` — Cabane then stops
       // injecting the off switch and your normal Claude Code memory workflow applies
       // (in coding mode, where the checkout's project settings are read).
       claudeCode: z2.object({ autoMemory: z2.boolean().optional() }).strict().optional(),
-      // CT1693: this agent's exception to `runners.sandbox` — an ops agent that
-      // runs with the machine on a sandboxed device, or one sandboxed agent on a
-      // device that isn't. Absent is "inherit"; see `runnerSandboxFor`. Only on a
-      // row keyed by the agent's id (`agentsConfigSchema`).
+      // This agent's exception to `runners.sandbox`: an ops agent that runs with
+      // the machine on a sandboxed device, or one sandboxed agent on a device that
+      // isn't. Absent is "inherit". Only on a row keyed by the agent's id.
       sandbox: z2.enum(["os", "none"]).optional()
     }).strict();
     AGENT_ID_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -485,9 +480,8 @@ var init_config = __esm({
       }
     });
     companionConfigSchema = z2.object({
-      // The cabane instance this device is paired with. SJ515: https-enforced
-      // (loopback exempt) so a hand-edited config can't smuggle a plaintext-http
-      // base URL onto the MITM-able channel the device token + prompt ride.
+      // https-enforced (loopback exempt), so a hand-edited config can't put the
+      // device token and prompt on a plaintext channel.
       baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
         message: "baseUrl must be https (loopback http is allowed for local dev only)"
       }),
@@ -505,91 +499,59 @@ var init_config = __esm({
       // agentId / username / `slug/username`. Hand-added by the operator; the companion
       // never writes this (it only persists credentials + the device, elsewhere).
       agents: agentsConfigSchema.optional(),
-      // CT1095: the DEVICE-LEVEL prepare hook — one entry that applies to every agent
-      // assigned to this device, unless that agent's own `agents` row names a hook of
-      // its own.
-      //
-      // Until now `prepareHook` existed only under `agents[<id>]`, which made the
-      // config a second silent roster: a device whose provisioning is genuinely
-      // per-device (ours resolves a directory from the conversation and agent ids the
-      // companion already hands the hook) still had to list every agent by id, and an
-      // agent nobody remembered to add got no hook at all — no error, no log, just a
-      // turn that started in the operator's `$HOME`. That is how @dale woke in
-      // `/home/joshed` on 2026-08-17 with a perfectly correct dispatch.
-      //
-      // Absent → nothing changes for anyone, which is why this can land inert: a
-      // device with no device-level entry behaves exactly as it did before. A hook
-      // that fails still fails the dispatch loudly, as now.
+      // The DEVICE-LEVEL prepare hook, for every agent assigned here unless its own
+      // `agents` row names one. Per-agent hooks alone make the config a second
+      // silent roster: an agent nobody listed gets no hook and no error, and starts
+      // in the operator's `$HOME` (an agent woke in `/home/joshed` this way on
+      // 2026-08-17).
       prepareHook: prepareHookSchema.optional(),
-      // CT1085 §9: `dashboardPort` and `autoOpen` are READ AND IGNORED by the CLI —
-      // it binds no port and opens no browser. They stay in the schema (rather than
-      // becoming a strict-mode parse error on an existing config file) and still mean
-      // what they say to the Electron shell, the one front-end that renders a
-      // dashboard. `logLevel` is unaffected: pino level, live-editable.
+      // `dashboardPort` and `autoOpen` are IGNORED by the CLI (no port, no browser)
+      // but stay in the schema so an existing file still parses; the Electron shell
+      // reads them. `logLevel` is pino's level, live-editable.
       dashboardPort: z2.number().int().min(1).max(65535).optional(),
       autoOpen: z2.boolean().optional(),
       logLevel: z2.enum(["warn", "info", "debug"]).optional(),
       logFormat: z2.enum(["human", "json"]).optional(),
-      // CT270: the opencode runtime, when the operator runs one on this machine. The
-      // operator installs opencode, starts `opencode serve` (auth via opencode's own
-      // `/connect` — Cabane never sees provider keys), and points the companion at it
-      // here. Setting this makes the device advertise the `opencode` runtime on its
-      // heartbeat manifest (so the server offers DeepSeek/opencode models here and
-      // routes those turns to this device) AND registers the opencode adapter in the
-      // dispatcher. Absent → the device is claude-code-only, exactly as before.
+      // An `opencode serve` the operator runs here (auth via opencode's own
+      // `/connect`; Cabane never sees provider keys). Set, the device advertises the
+      // `opencode` runtime and registers its adapter.
       opencode: z2.object({
         serverUrl: z2.string().url()
       }).strict().optional(),
-      // CT1082: the Claude Code runtime, when the user connected it on this machine.
-      // The change this task exists for: Claude Code used to be the one harness a
-      // device exposed with no configuration — a `claude --version` exit-0 was taken as
-      // consent — and it is now the third config-driven harness, opted into exactly
-      // like codex. CT1379: the binary that must be there is the Agent SDK's own
-      // bundled executable — the file a turn actually launches — not the user's
-      // `claude` on PATH, which the SDK never runs. The manifest advertises
-      // claude-code only when this block says so AND that binary resolves.
+      // Whether the user connected Claude Code on this machine: consent, opted into
+      // like codex. The manifest advertises claude-code only when this says so AND
+      // the Agent SDK's bundled executable resolves (not `claude` on PATH, which the
+      // SDK never runs).
       //
-      // The block's PRESENCE is also the migration marker (see `migrateConnectedHarnesses`).
-      // Absent means the config predates this task — a device whose user was never
-      // asked — and the migration grandfathers it on first start. So every config
-      // written from here on carries the block explicitly, including a freshly-paired
-      // one, which starts at `enabled: false`: a new device is connected to nothing
-      // until its user says otherwise.
+      // The block's PRESENCE is also the migration marker
+      // (`migrateConnectedHarnesses`): absent means a config whose user was never
+      // asked. So every config written carries it, a fresh pair at `enabled: false`.
       //
-      // Not to be confused with the per-agent `agents.<key>.claudeCode.autoMemory`
-      // above — that's one agent's memory switch, this is the device's connected set.
+      // Not the per-agent `agents.<key>.claudeCode.autoMemory`, one agent's memory
+      // switch.
       claudeCode: z2.object({
         enabled: z2.boolean().optional()
       }).strict().optional(),
-      // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
-      // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
-      // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
-      // not a server address. The operator installs Codex + logs in (`codex login`, or
-      // `CODEX_API_KEY` — Cabane never sees the key) and sets `{ "codex": { "enabled":
-      // true } }`. Presence of the block enables it (an explicit `enabled: false`
-      // keeps the block but turns it off). Absent → the device doesn't offer codex.
-      // CT1379: enabling is now half the answer, not all of it — the manifest and the
-      // adapter registry additionally require the SDK's vendored `codex` binary to
-      // resolve, because the enable flag alone advertised a runtime a device with a
-      // half-installed platform package could not start.
+      // Codex is a local CLI the SDK spawns per turn, so this is an opt-in flag, not
+      // an address. The operator logs in (`codex login` or `CODEX_API_KEY`; Cabane
+      // never sees the key). The block's presence enables it; `enabled: false` turns
+      // it off. Half the answer: advertising also requires the SDK's vendored
+      // `codex` binary to resolve.
       codex: z2.object({
         enabled: z2.boolean().optional()
       }).strict().optional(),
-      // CT1679: run each turn in a child runner process instead of in this one.
-      // Absent, or `enabled: false`, is the in-process path, untouched. `sandbox`
-      // wraps the runner in an OS sandbox where the host supports one; `'none'`
-      // (the default) runs it as a plain child beside this process, a supported
-      // configuration in its own right rather than a degraded one.
-      // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
-      // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
-      // bad policy refuses the turns it governs, with the field named, instead of
-      // keeping the companion from starting at all.
+      // Run each turn in a child runner process. Absent or `enabled: false` is the
+      // in-process path. `sandbox: 'os'` wraps the runner in an OS sandbox where the
+      // host supports one; `'none'` (the default) is a plain child, supported in its
+      // own right. `policy` is what the sandbox lets a turn reach, read and hold,
+      // validated in `runner/sandbox-policy.ts` so a bad policy refuses the turns it
+      // governs, field named, instead of stopping the companion starting.
       runners: z2.object({
         enabled: z2.boolean().optional(),
         provider: z2.enum(["local-process", "docker"]).optional(),
         sandbox: z2.enum(["os", "none"]).optional(),
-        // CT1681: the `docker` provider — a container per conversation and agent,
-        // from one image, on a network whose only way out is an allow-listed proxy.
+        // A container per conversation and agent, from one image, on a network
+        // whose only way out is an allow-listed proxy.
         docker: z2.object({
           // The base image a container runs. Default: the one this companion
           // builds from its own Dockerfile on first use. One named here must
@@ -1133,7 +1095,7 @@ var init_api_error_shape = __esm({
       "dispatch_not_admitted",
       "turn_already_ended",
       "turn_belongs_elsewhere",
-      // Rooms: the context this start was composed from named an attempt the
+      // The context this start was composed from named an attempt the
       // lease no longer picks (midnight rolled it, a degrade retired it). Nothing
       // was granted; the turn recomposes its context and starts again, once.
       "dispatch_context_stale"
@@ -1207,10 +1169,8 @@ var init_api = __esm({
         this.opts = opts;
       }
       opts;
-      // CT25: re-entrancy guard for `drainOutbox`. The supervisor kicks a drain
-      // from several places (startup, SSE reconnect, the backoff timer); without
-      // this guard two overlapping drains could each pick up the same queued entry
-      // and double-send it (the server dedupes, but the wasted POSTs aren't free).
+      // Re-entrancy guard for `drainOutbox`: drains are kicked from several places,
+      // and two overlapping ones would double-send the same entry.
       draining = false;
       lastDeliveryWarning = 0;
       get base() {
@@ -1272,19 +1232,13 @@ var init_api = __esm({
           }
         }
       }
-      // CT25: send-or-enqueue for a turn-row commit. Tries the immediate
-      // (retry-budgeted) send first so the happy path keeps its current latency,
-      // then on a *retryable* failure persists the row to the on-disk outbox
-      // instead of dropping it. Classification is deliberate:
-      //   - success → done.
-      //   - no outbox configured (one-shot CLI / tests) → rethrow, exactly the
-      //     pre-CT25 behaviour.
-      //   - cancel (the turn was stopped; `signal` aborted or an AbortError) →
-      //     rethrow without queuing: the user asked us to stop, and the held text
-      //     was already dropped — we must not resurrect it from the queue.
-      //   - terminal 4xx (a deterministic rejection a replay can't fix) → rethrow,
-      //     so the caller's error path runs as it does today (e.g. the committer
-      //     re-arms its empty-final fallback).
+      // Send-or-enqueue for a turn-row commit: the immediate (retry-budgeted) send
+      // first, then on a *retryable* failure persist to the outbox.
+      //   - no outbox configured (one-shot CLI / tests) → rethrow.
+      //   - cancel (`signal` aborted or an AbortError) → rethrow without queuing:
+      //     the user asked us to stop, and the text must not resurrect from the queue.
+      //   - terminal 4xx (a replay can't fix it) → rethrow, so the caller's error
+      //     path runs.
       //   - retryable (transport / 5xx — commit outcome may be unknown) → queue
       //     and return. This acknowledges local delivery responsibility, not server
       //     persistence. Replays retain the endpoint's identity: messages/thinking/
@@ -1309,13 +1263,10 @@ var init_api = __esm({
           );
         }
       }
-      // CT25: flush the outbox FIFO. Removes an entry once the server acknowledges
-      // it (2xx) or rejects it terminally (any 4xx — a deleted conversation 404, a
-      // forbidden, etc. — which a replay can never satisfy, so we discard with a
-      // log rather than spin forever). A retryable failure (transport / 5xx) means
-      // the API is still down: stop the cycle and leave that entry and the rest
-      // queued for the next drain. Returns a summary the supervisor's backoff
-      // scheduler reads. Re-entrancy-guarded so overlapping kicks don't double-send.
+      // Flush the outbox FIFO. An entry goes once the server acknowledges it (2xx)
+      // or rejects it terminally (any 4xx, which a replay can never satisfy: discard
+      // with a log rather than spin). A retryable failure means the API is still
+      // down: stop and leave that entry and the rest for the next drain.
       async drainOutbox() {
         const outbox = this.opts.outbox;
         if (!outbox) return { remaining: 0, progressed: false };
@@ -1363,40 +1314,24 @@ var init_api = __esm({
         }
         return { remaining: outbox.size(), progressed };
       }
-      // CT25: how many commits are currently queued for this workspace — the
-      // supervisor's drain scheduler reads it to decide whether to keep polling.
+      // How many commits are queued; the drain scheduler reads it to decide whether
+      // to keep polling.
       outboxSize() {
         return this.opts.outbox?.size() ?? 0;
       }
-      // CT262: the ONE turn-context fetch. Collapses the companion's old four-fetch
-      // choreography (getConversation + getMessage + getAgentSelf + getParticipantAgent)
-      // into a single call: the server composes the whole server portion of the
-      // `TurnRequest` — systemPrompt, per-turn prompt + vision content, effective
-      // run-config, `HostPolicy`, prior session, the user MCP definitions to resolve
-      // locally, plus the anchor/title + trigger-message summary the host needs.
-      // Agent-PAT authed; the workspace is implied by the PAT.
-      // CT714: `turnId` is the host-minted id for THIS turn, passed so the server can
-      // bind the minted turn token to it — the turn-control surface then rejects a
-      // token whose turn has ended. The dispatcher mints it before this call and
-      // reuses the same value on its active-run PATCH, so the token's turn id and the
-      // pair's `active_turn_id` agree.
-      // CT1380: `resumed` says this dispatch is a REPLAY of an interrupted turn, so
-      // the server should hand back `turnSeqFloor` — the turn's committed seq
-      // high-water mark. Only the supervisor knows (it minted the id or recovered
-      // it), so it is passed down rather than inferred here. It gates the COST of
-      // the aggregate, never the tenancy scoping, which the route applies
-      // unconditionally.
-      // `fresh` asks for the context a session that holds NOTHING needs: the read
-      // from the start of the conversation, the agent's own words included, and
-      // the first-turn material — what the adapter runs on when it refused to
-      // resume the stored session and is starting a fresh one.
-      // CT1543: `episode` is the dispatch event's own, echoed back so the server can
-      // tell this frame from a later wake on the same message. Omitted when the
-      // event didn't carry one, which is the only thing an older event can mean.
-      // CT1657: `signal` is the turn's own abort. It matters here more than on any
-      // other read, because this call now waits up to ~8s across five attempts: a
-      // Stop landing in that window used to leave the whole schedule running, and
-      // the person watched a turn they had already stopped keep trying.
+      // The ONE turn-context fetch: the server composes the whole server portion of
+      // the `TurnRequest`. Agent-PAT authed; the workspace is implied by the PAT.
+      //   - `turnId`: the host-minted id the server binds the turn token to, so the
+      //     turn-control surface rejects a token whose turn has ended.
+      //   - `resumed`: a REPLAY of an interrupted turn, so the server returns
+      //     `turnSeqFloor`. Only the supervisor knows. It gates the cost of the
+      //     aggregate, never the tenancy scoping.
+      //   - `fresh`: the context a session holding NOTHING needs (the whole read,
+      //     own words included, plus first-turn material), for an adapter that
+      //     refused to resume the stored session.
+      //   - `episode`: the dispatch event's own, so the server can tell this frame
+      //     from a later wake on the same message. Omitted by an older event.
+      //   - `signal`: the turn's abort, so a Stop cuts the ~8s retry schedule short.
       getTurnContext(conversationId, messageId2, turnId, resumed, fresh, episode, signal) {
         const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "") + (fresh ? "&fresh=1" : "") + (episode !== void 0 ? `&episode=${encodeURIComponent(String(episode))}` : "");
         return this.request("GET", `/api/agent/turn-context?${q}`, void 0, {
@@ -1404,9 +1339,8 @@ var init_api = __esm({
           ...signal ? { signal } : {}
         });
       }
-      // CT1380: the local half of a resumed turn's seq floor (see
-      // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
-      // test has no durable queue, so nothing can be hiding in it.
+      // The local half of a resumed turn's seq floor (`Outbox.maxSeqForTurn`). 0
+      // with no outbox: nothing can be hiding in a queue that doesn't exist.
       outboxMaxSeqForTurn(turnId) {
         return this.opts.outbox?.maxSeqForTurn(turnId) ?? 0;
       }
@@ -1422,13 +1356,11 @@ var init_api = __esm({
           (e) => e.turnId === turnId && e.kind === "message" && e.body?.kind !== "runtime_notice"
         );
       }
-      // CT1677: ADOPT the issuance a turn context carried as the execution source of
-      // the work about to run on it. Made once per context, before preparation emits
-      // or queues anything, so every row that work commits can name a source the
-      // server has durably recorded and will never reap. Retried like any write: the
-      // server's adoption is idempotent. A 409 `execution_source_unavailable` is a
-      // refusal — nothing to adopt, the reaper got there first — and the caller
-      // fetches a fresh context rather than working on this one.
+      // ADOPT a turn context's issuance as the execution source of its work, once,
+      // before preparation emits or queues anything, so every row can name a source
+      // the server durably recorded and will never reap. Adoption is idempotent, so
+      // retried. A 409 `execution_source_unavailable` means the reaper got there
+      // first; the caller fetches a fresh context.
       adoptExecutionSource(issuanceId, body, signal) {
         return this.request(
           "POST",
@@ -1437,10 +1369,10 @@ var init_api = __esm({
           signal ? { retry: true, signal } : { retry: true }
         );
       }
-      // CT1680: the launcher mints the runner credential for one dispatch, on its
-      // PAT and from its device, and hands it to the runner in place of both. A
-      // retry is safe: the server returns the same runner id and retires the
-      // credential the lost response carried.
+      // The launcher mints the runner credential for one dispatch, on its PAT and
+      // from its device, and hands it to the runner in place of both. A retry is
+      // safe: the server returns the same runner id and retires the credential the
+      // lost response carried.
       mintRunnerCredential(body) {
         return this.request("POST", "/api/agent/runner-credentials", body, { retry: true });
       }
@@ -1460,7 +1392,7 @@ var init_api = __esm({
       // invocation. The server records the effect and receipt in one transaction;
       // an ok:false response is a recorded refusal for the tool to report.
       // Retries retain the caller's callId and recover the same receipt, even
-      // when the turn settled between attempts (CT1447): the route consults the
+      // when the turn settled between attempts: the route consults the
       // receipt before it refuses an ended turn, so a 4xx proves no attempt wrote.
       // The caller's signal bounds how long the model waits for the tool result.
       turnAct(workspaceId, turnId, act, signal) {
@@ -1471,36 +1403,23 @@ var init_api = __esm({
           signal ? { retry: true, signal } : { retry: true }
         );
       }
-      // CT1292: RENEW THE TURN'S LEASE — ask the server whether this turn is still
-      // running. The dispatcher calls this on a cadence for the life of the SDK loop,
-      // and out of cadence the moment a commit is refused, so a loop whose turn was
-      // terminalized underneath it stops instead of running to the six-hour cap.
+      // RENEW THE TURN'S LEASE: is this turn still running? Called on a cadence for
+      // the life of the SDK loop and the moment a commit is refused, so a loop whose
+      // turn was terminalized underneath it stops.
       //
-      // Single-shot and NEVER retried, on purpose. A renewal is a question about
-      // right now, not a durable write: a failed one has no answer worth replaying,
-      // and the next tick asks again in a few seconds anyway. Retrying would only
-      // stretch one tick over the next one's slot.
+      // Single-shot, NEVER retried: a failed renewal has no answer worth replaying
+      // and the next tick asks again; retrying stretches one tick over the next.
       //
-      // ALL FAILURE IS `unknown`, and this is the safety property the whole feature
-      // rests on. The only thing that may stop a running loop is the server SAYING
-      // the turn is over; a 500, a dropped connection, an expired token or a body we
-      // cannot parse says nothing about the turn, and reading any of them as death
-      // would kill healthy turns every time the API hiccups — strictly worse than the
-      // gap this closes. So the failure direction is fixed here, at the boundary,
-      // rather than left to each caller to remember.
+      // ALL FAILURE IS `unknown`. Only the server SAYING the turn is over may stop a
+      // running loop; a 500, a dropped connection, an expired token or an
+      // unparseable body says nothing about the turn, and reading it as death would
+      // kill healthy turns on every API hiccup. Fixed here, at the boundary, so no
+      // caller has to remember.
       //
-      // AND IT IS DEADLINED (Codo's blocking finding #1). `fetch` has no default
-      // timeout, so a request that neither resolves nor rejects — a black-holed
-      // connection, a half-open socket surviving a network change — would hang this
-      // promise forever. That is not merely a slow probe: the caller single-flights
-      // on it, so one stalled request latches the check permanently, every later
-      // cadence tick returns immediately, and the loop this exists to stop runs to
-      // the six-hour cap even after connectivity comes back — the exact defect the
-      // task is about, reintroduced through the mechanism meant to close it.
-      //
-      // The deadline turns that into an ordinary `unknown`: the request rejects, the
-      // in-flight latch clears, and the NEXT tick asks again. Well under the renewal
-      // cadence so a stalled probe is finished with before its successor is due.
+      // DEADLINED, because `fetch` has no default timeout: a black-holed request
+      // would hang forever, and the caller single-flights on it, so one stall would
+      // latch the check and let the loop run to the cap. The deadline makes it an
+      // ordinary `unknown` and the next tick asks again.
       async checkTurnLease(workspaceId, conversationId, agentId, turnId) {
         const q = `turnId=${encodeURIComponent(turnId)}`;
         try {
@@ -1509,11 +1428,7 @@ var init_api = __esm({
             `/api/workspaces/${workspaceId}/conversations/${conversationId}/participants/agents/${agentId}/turn-lease?${q}`,
             void 0,
             {
-              // CT1657: the one GET that opts OUT of the default retry. The reasoning
-              // is right above — a failed probe has no answer worth replaying and the
-              // next tick asks again in seconds, so retrying inside this one would
-              // stretch a tick over its successor's slot, which is what the deadline
-              // exists to prevent.
+              // The one GET that opts OUT of the default retry; see above.
               retry: false,
               signal: AbortSignal.timeout(this.opts.leaseCheckTimeoutMs ?? LEASE_CHECK_TIMEOUT_MS)
             }
@@ -1547,9 +1462,8 @@ var init_api = __esm({
         }
         return this.request("PATCH", path, body);
       }
-      // CT93: send-or-enqueue for an active-run flag write, with last-writer-wins
-      // across the (conversation, agent) pair. Mirrors `durableCommit`, with two
-      // deliberate differences:
+      // Send-or-enqueue for an active-run flag write, last-writer-wins per
+      // (conversation, agent) pair. Like `durableCommit`, except:
       //   - No abort signal is threaded. The clear is the turn's teardown and must
       //     land even when the turn was *cancelled* (the abort signal is set) — a
       //     cancelled turn still has to drop its "working" indicator.
@@ -1603,9 +1517,6 @@ var init_api = __esm({
           );
         }
       }
-      // CT29: per-device liveness moved off the per-workspace agent PAT and onto the
-      // device token — see `DeviceApi.heartbeat`. There is no agent-PAT heartbeat
-      // anymore.
       // Commit the agent's first/last words (message) or a runtime_notice through
       // the public messages endpoint. Intermediate working text uses reportText.
       // Attribution comes from the agent credential; a new speech row can offer
@@ -1689,36 +1600,26 @@ var init_host_policy = __esm({
   "packages/agent-runtime/src/host-policy.ts"() {
     "use strict";
     hostPolicySchema = z5.object({
-      // Host filesystem + shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the
-      // notebook read/write pair, git-worktree tools, and the `REPL` host code-exec
-      // tool. Off under the locked assistant surface (today's `DISALLOWED_TOOLS`);
-      // on under `coding` mode.
+      // Host filesystem and shell: `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`, the notebook pair,
+      // git-worktree tools and `REPL`. Off on the locked assistant surface; on in the coding posture.
       hostFs: z5.boolean(),
-      // Public web (today's `WebSearch` / `WebFetch`, the `DEFAULT_WEB_TOOLS`). Public
-      // web, not host reach — granted by default today, but expressible as a grant.
+      // Public web (`WebSearch` / `WebFetch`). Not host reach; a grant like the rest.
       web: z5.boolean(),
-      // Browser automation (the Playwright MCP surface). Varies by host: a companion has
-      // it, the house executor does not (CT230).
+      // Browser automation (the Playwright MCP surface). Varies by host.
       browser: z5.boolean(),
-      // User-configured MCP servers permitted. False for the house executor
-      // (CT227: Cabane agents run no user MCP servers), true for a personal companion.
+      // User-configured MCP servers permitted.
       userMcp: z5.boolean(),
-      // Subagent / sub-dispatch (`Task` / `Agent`). A per-host GRANT (see the CT261
-      // amendment above): `false` on the locked assistant/house surface (banned via
-      // `DISALLOWED_TOOLS`), `true` under coding / custom where the fan-out is left to
-      // the coding allow-hook (which reaches sub-agent tool calls, CT680) or the user
-      // allowlist. The subagent completes within the turn, so
-      // it's not the turn-model invariant `scheduling` is.
+      // Subagent dispatch (`Task` / `Agent`) — a grant: `false` on the locked surface, `true` in the
+      // coding posture, where the coding allow-hook reaches sub-agent tool calls. A subagent completes
+      // within the turn, so it's not an invariant like `scheduling`.
       subagents: z5.boolean(),
       // ── Hard platform invariants — always denied, never granted ────────────────
-      // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*`
-      // families, `Monitor`, `Workflow`, …). A turn is one query that resolves when
-      // `result` fires; a scheduled callback fires after the reply window has closed
-      // and strands the agent (the CT155/CT156 rule).
+      // Deferred re-invocation / scheduling (`ScheduleWakeup`, the `Cron*` / `Task*` families,
+      // `Monitor`, `Workflow`, …). A turn is one query that resolves on `result`; a scheduled callback
+      // fires after the reply window has closed and strands the agent.
       scheduling: z5.literal("never"),
-      // Human-facing UI prompts (`AskUserQuestion`). A Cabane conversation has no
-      // handler to answer a structured prompt, so the call hangs the turn
-      // (`UNSUPPORTED_TOOLS`). The agent asks in its reply instead.
+      // Human-facing UI prompts (`AskUserQuestion`). Nothing in a Cabane conversation can answer a
+      // structured prompt, so the call hangs the turn. The agent asks in its reply instead.
       uiPrompts: z5.literal("never")
     });
   }
@@ -1731,59 +1632,40 @@ var init_turn_event = __esm({
   "packages/agent-runtime/src/turn-event.ts"() {
     "use strict";
     turnEventSchema = z6.discriminatedUnion("type", [
-      // The runtime's opaque session state, emitted when the adapter learns it (e.g.
-      // the SDK `system/init` frame). The platform stores `state` verbatim per
-      // (conversation, agent) and hands it back on the next turn; only the adapter
-      // knows what it means. Today's companion captures the raw SDK session id here; a
-      // future adapter may encode more (e.g. `{sdkSessionId, cwd}`) — still one
-      // opaque string to the platform.
+      // The runtime's opaque session state, emitted when the adapter learns it (e.g. the SDK
+      // `system/init` frame). The platform stores `state` verbatim per (conversation, agent) and
+      // hands it back next turn; only the adapter knows what it means.
       //
-      // CT315: `degraded: true` means the adapter started this FRESH session despite
-      // a stored one it was handed — a cwd/directory mismatch (the SJ527 guard) or
-      // legacy/foreign state it refused to resume. It is NOT set for a genuine
-      // first turn (`no_session`). The signal matters because the server built this
-      // turn's catch-up manifest assuming the prior session carried everything up to
-      // the high-water mark (CT298's two-channel invariant); a degrade breaks that,
-      // so the mark now over-reaches an empty session. The host relays `degraded`
-      // on settle and the server rewinds the mark, so the NEXT turn rebuilds a full
-      // catch-up (this failing turn is unavoidably lossy — the degrade is only known
-      // on the companion, after the server committed the manifest). Runtime-neutral: a
-      // plain boolean, not a runtime-specific reason string (that stays in the
-      // adapter's `onWarn` log). Additive + optional — an old receiver ignores it.
+      // `degraded: true`: the adapter started this fresh session despite a stored one (a cwd
+      // mismatch, or legacy/foreign state it refused to resume) — never for a genuine first turn.
+      // The server built this turn's catch-up manifest assuming the prior session held everything up
+      // to the high-water mark; a degrade breaks that. The host relays `degraded` on settle and the
+      // server rewinds the mark, so the next turn rebuilds a full catch-up (this turn is unavoidably
+      // lossy — the degrade is known only after the manifest was committed). A plain boolean; the
+      // runtime-specific reason stays in the adapter's `onWarn` log. Optional.
       z6.object({
         type: z6.literal("session"),
         state: z6.string(),
         degraded: z6.boolean().optional()
       }),
-      // One readable thinking summary. Maps `onThinking({ text })`. Transient —
-      // surfaced live, never persisted as durable content.
+      // One readable thinking summary. Transient — surfaced live, never persisted as content.
       z6.object({ type: z6.literal("thinking"), text: z6.string() }),
-      // Assistant text. Maps `onAssistantText({ text, final })` — `text`→`body`,
-      // `final`→`terminal`. `terminal: false` is interim narration (commits as a
-      // `progress` row); `terminal: true` is the turn's closing reply (commits as
-      // the `final` row).
+      // Assistant text. `terminal: false` is interim narration (commits as `progress`);
+      // `terminal: true` is the turn's closing reply (commits as `final`).
       z6.object({ type: z6.literal("text"), body: z6.string(), terminal: z6.boolean() }),
-      // Runtime/provider-authored prose about the turn — a failure's explanation, or
-      // a line the harness wrote on a turn it recovered (CT1750). Unlike
-      // `text`, this is not the agent's narration or reply: the pump persists it as
-      // `runtime_notice`, and the transcript renders it in the shared SystemNote
-      // voice. Adapters emit it only from positive runtime evidence; the web never
-      // classifies English strings.
+      // Runtime/provider-authored prose about the turn — a failure's explanation, or a line the
+      // harness wrote on a turn it recovered. Not the agent's words: the pump persists it as
+      // `runtime_notice`, drawn in the SystemNote voice. Adapters emit it only from positive runtime
+      // evidence; the web never classifies English strings.
       z6.object({ type: z6.literal("runtime_notice"), body: z6.string() }),
-      // A tool-activity transition. Maps `onToolActivity` — `toolUseId`→`id`,
-      // `toolName`→`name` (already prefix-stripped: `cabane_read`, not
-      // `mcp__cabane__cabane_read`), `summary` is the short card label. `phase`
-      // pairs `start` with a later `done`/`error` on the same `id`.
+      // A tool-activity transition. `name` is prefix-stripped (`cabane_read`, not
+      // `mcp__cabane__cabane_read`); `summary` is the short card label; `phase` pairs `start` with a
+      // later `done`/`error` on the same `id`.
       //
-      // `input`/`result` are typed `unknown` (the raw tool payloads), widening
-      // today's already-truncated `input: string` / `result: string` — see
-      // docs/turn-protocol.md: rendering/truncation for the tool log is a
-      // pump/consumer concern applied to the value, not baked into the event type.
-      // CT496: `mcpServer` is the MCP server the call came from (`cabane`,
-      // `playwright`, …), derived off the raw `mcp__<server>__` name before `name`
-      // dropped the prefix; null for a host / built-in tool. The client tags Cabane
-      // MCP calls (`=== 'cabane'`) with a subtle glyph. Nullable + optional so a
-      // pre-CT496 producer that never sets it is unaffected (treated as null).
+      // `input`/`result` are `unknown` (the raw tool payloads): rendering and truncation for the tool
+      // log are a consumer concern (docs/turn-protocol.md). `mcpServer` is the MCP server the call
+      // came from (`cabane`, `playwright`, …), derived before `name` dropped the prefix; null for a
+      // host tool. Optional, read as null when absent.
       z6.object({
         type: z6.literal("tool"),
         id: z6.string(),
@@ -1794,45 +1676,25 @@ var init_turn_event = __esm({
         result: z6.unknown().optional(),
         mcpServer: z6.string().nullable().optional()
       }),
-      // The turn's terminal outcome. Maps the `{ ok, reason }` both loops return
-      // inline. `ok:false` carries a machine reason (`no_session`, an error code);
-      // the host's clear-PATCH surfaces it as `errorReason`.
-      //
-      // CT277: an optional `usage` — the SDK result's token counts, which were
-      // dropped on the floor before. `inputTokens` is the full context the model saw
-      // (uncached + cache-read + cache-creation input), so it doubles as the
-      // context-window cost; `outputTokens` the generated tokens. Optional ⇒
-      // backward-compatible: an old companion / adapter that never sets it, and a
-      // receiver that never reads it, are unaffected (the turn's token columns stay
-      // null → the UI shows `—`).
+      // The turn's terminal outcome. `ok:false` carries a machine reason (`no_session`, an error
+      // code), surfaced by the host's clear-PATCH as `errorReason`.
       //
-      // CT597: two optional cache-token counts — the slice of `inputTokens` that was
-      // a cache read vs. a cache creation, when the runtime breaks it out (claude-code
-      // does). Additive + optional: a runtime that doesn't report them omits them, and
-      // the server just leaves the cache columns null. Captured now because honest
-      // costing later prices a cache-read token far below a fresh input token.
+      // `usage`: the SDK result's token counts. `inputTokens` is the full context the model saw
+      // (uncached + cache-read + cache-creation). The cache counts, when the runtime breaks them out,
+      // are a subset of it, kept because a cache-read token costs far less. All optional; absent
+      // leaves the columns null and the UI shows `—`.
       //
-      // CT699: `inputTokens` (and the cache slice) is a BILLING quantity — for
-      // claude-code/codex it's the runtime's CUMULATIVE total summed across every model
-      // request in the agentic turn, so it grows with the tool-call count and is NOT
-      // "how full is the window." `contextTokens` is the distinct CONTEXT-OCCUPANCY
-      // read and `contextWindow` the window it is measured against, both as the
-      // harness reported them (claude-code's `getContextUsage`, or its final
-      // request's input and `modelUsage` window when that call gives nothing). A
-      // runtime that can't source them (codex's cumulative-only usage) omits both,
-      // and no surface shows a reading for that turn.
+      // `inputTokens` is a billing quantity — for claude-code/codex the cumulative total across every
+      // model request in the turn, growing with tool calls, not "how full is the window".
+      // `contextTokens` is the occupancy read and `contextWindow` its window, as the harness reported
+      // them (claude-code's `getContextUsage`, else its final request's input and `modelUsage`
+      // window). A runtime that can't source them (codex) omits both.
       //
-      // CT601: two more optional carry-homes on the terminal result, alongside
-      // `usage`. `resolvedModel` is the CONCRETE model the runtime actually ran —
-      // claude-code learns it from the `system/init` frame mid-run (even for a
-      // subscription-default token, where the configured model is null), codex records
-      // the model the thread was started with. `resolvedConfig` is the resolved
-      // per-runtime knobs the harness reported (`{ reasoningEffort }` for codex; none
-      // for claude-code today). Both only known after the run streams — so they ride
-      // the terminal event home, the host relays them on settle, and the server writes
-      // `message_turn_metadata.resolved_model` / `resolved_config`. Optional ⇒
-      // backward-compatible: an old adapter/companion omits them, a cancel has no result
-      // event at all, and the columns stay null → the UI shows `—`.
+      // `resolvedModel` is the concrete model the runtime ran (claude-code learns it from
+      // `system/init` mid-run, even for a subscription default; codex records the model the thread
+      // started with); `resolvedConfig` the knobs the harness reported (`{ reasoningEffort }` for
+      // codex). Known only after the run streams, so they ride this event home and the host relays
+      // them on settle. A cancel has no result event at all.
       z6.object({
         type: z6.literal("result"),
         ok: z6.boolean(),
@@ -1844,9 +1706,8 @@ var init_turn_event = __esm({
           cacheCreationTokens: z6.number().optional(),
           contextTokens: z6.number().optional(),
           contextWindow: z6.number().optional(),
-          // CT1751: the rest of the harness's own context reading, when it gave
-          // one: where it will compact, its `/context` breakdown, and every
-          // compaction it reported during the turn. Claude Code only.
+          // The rest of the harness's context reading, when it gave one: where it will compact, its
+          // `/context` breakdown, and every compaction it reported. Claude Code only.
           contextCompactAt: z6.number().optional(),
           contextCategories: z6.array(
             z6.object({
@@ -1869,10 +1730,9 @@ var init_turn_event = __esm({
           thinking: z6.string().optional(),
           reasoningEffort: z6.string().optional()
         }).optional(),
-        // CT1275: the harness-reported MCP inventory from this turn's init frame.
-        // This is deliberately diagnostic-only: names, statuses and a count, never
-        // server definitions, credentials or session ids. `initReceived:false`
-        // distinguishes a missing init frame from a real empty inventory.
+        // The harness-reported MCP inventory from this turn's init frame. Diagnostic only: names,
+        // statuses and a count — never server definitions, credentials or session ids.
+        // `initReceived:false` tells a missing init frame from a real empty inventory.
         mcpInventory: z6.object({
           initReceived: z6.boolean(),
           servers: z6.array(z6.object({ name: z6.string(), status: z6.string() })),
@@ -1989,9 +1849,8 @@ function isContentBearingEvent(event) {
       return normalizeCommitText(event.text) !== "";
     case "tool":
       return true;
-    // CT1750: a runtime notice is shown, but it is the harness speaking about
-    // the turn, not the turn's output — a success whose only output is a CLI
-    // line still produced nothing.
+    // A runtime notice is shown, but it is the harness speaking about the turn, not its output — a
+    // success whose only output is a CLI line still produced nothing.
     case "runtime_notice":
     case "session":
     case "result":
@@ -2073,11 +1932,10 @@ var init_turn_request = __esm({
         mcpUrl: z8.string(),
         bearer: z8.string(),
         activeConversationId: z8.string(),
-        // Scoped turn-control MCP URL. Codex/opencode mount it as cabane_companion
-        // with the bearer and active-conversation header. It supplies ask,
-        // withdraw_ask, wake_me, cancel_wake and skip_turn. Claude Code mounts the
-        // companion's in-process instance instead. Optional for compatibility;
-        // the companion populates it in build-options.ts.
+        // Scoped turn-control MCP URL. Codex and opencode mount it as `cabane_companion` with the bearer
+        // and active-conversation header, for ask, withdraw_ask, wake_me, cancel_wake and skip_turn.
+        // Claude Code mounts the companion's in-process instance instead. Optional; the companion
+        // populates it.
         turnControlUrl: z8.string().optional(),
         // Workspace coordinate retained for envelope compatibility. Current
         // adapters use MCP, whose workspace operations take workspaceId explicitly.
@@ -2090,19 +1948,17 @@ var init_turn_request = __esm({
         cwd: z8.string().optional(),
         env: z8.record(z8.string(), z8.string()).optional(),
         mcpServers: resolvedMcpServersSchema.optional(),
-        // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
-        // complete header value). The adapter merges them into the harness
-        // process's environment and nowhere else; the host never merges them into
-        // its own. Absent when no server references one.
+        // The values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` → complete header value). The
+        // adapter merges them into the harness process's environment and nowhere else; the host never
+        // merges them into its own. Absent when no server references one.
         secretEnv: z8.record(z8.string(), z8.string()).optional(),
-        // CT289: machine-local claude-code adapter knobs the operator sets on a
-        // companion they run themselves — the auto-memory escape hatch. `autoMemory:
-        // true` opts back into Claude Code's auto-memory (governed by the operator's
-        // own `.claude/settings.json`); absent/false leaves the adapter's force-off
-        // default in place (see `buildClaudeCodeOptions`).
+        // Machine-local claude-code knobs for an operator running their own companion — the auto-memory
+        // escape hatch. `autoMemory: true` opts back into Claude Code's auto-memory (governed by the
+        // operator's `.claude/settings.json`); absent/false keeps the adapter's force-off default
+        // (`buildClaudeCodeOptions`).
         claudeCode: z8.object({ autoMemory: z8.boolean().optional() }).optional()
       }),
-      // Host-owned injected servers (host-filled) — e.g. the send server.
+      // Host-owned injected servers (host-filled).
       extra: z8.object({
         mcpServers: hostInjectedServersSchema
       })
@@ -2190,8 +2046,8 @@ async function emitToolResults(msg, emit, pending, onError) {
         // result payload off the block.
         input: started?.input,
         result: block.content,
-        // CT496: carry the server captured at `start` (the pretty name here has
-        // already lost its prefix). Null when the start wasn't seen.
+        // The server captured at `start` (the pretty name here has lost its prefix). Null when the
+        // start wasn't seen.
         mcpServer: started?.mcpServer ?? null
       },
       onError
@@ -2259,24 +2115,18 @@ function summarizeToolInput(input) {
   }
   return "";
 }
-function summarizeToolIo(input) {
+function renderToolIo(input) {
   if (input === void 0 || input === null) return "";
-  if (typeof input === "string") {
-    const trimmed = input.trim();
-    return trimmed.length > 0 ? truncate(trimmed, TOOL_IO_MAX_CHARS) : "";
-  }
+  if (typeof input === "string") return input.trim();
   try {
-    return truncate(JSON.stringify(input), TOOL_IO_MAX_CHARS);
+    return JSON.stringify(input) ?? "";
   } catch {
     return "";
   }
 }
-function summarizeToolResult(content) {
+function renderToolResult(content) {
   if (content === void 0 || content === null) return "";
-  if (typeof content === "string") {
-    const trimmed = content.trim();
-    return trimmed.length > 0 ? truncate(trimmed, TOOL_IO_MAX_CHARS) : "";
-  }
+  if (typeof content === "string") return content.trim();
   if (Array.isArray(content)) {
     const parts = [];
     let sawContentEntry = false;
@@ -2291,12 +2141,12 @@ function summarizeToolResult(content) {
       }
     }
     const joined = parts.join("\n").trim();
-    if (joined.length > 0) return truncate(joined, TOOL_IO_MAX_CHARS);
+    if (joined.length > 0) return joined;
     if (sawContentEntry || content.length === 0) return "";
   }
   if (typeof content !== "object") return "";
   if (!Array.isArray(content) && Object.keys(content).length === 0) return "";
-  return summarizeToolIo(content);
+  return renderToolIo(content);
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -2320,15 +2170,19 @@ function sinkEmitter(sink, _onError) {
         return;
       case "tool":
         if (sink.onToolActivity) {
+          const input = renderToolIo(event.input);
+          const result = event.result === void 0 ? null : renderToolResult(event.result);
           await sink.onToolActivity({
             toolUseId: event.id,
             toolName: event.name,
             summary: event.summary,
-            // SJ529: render the raw payloads for the tool log here — the single
-            // truncation site (CT255 consumer concern).
-            input: summarizeToolIo(event.input),
-            result: event.result === void 0 ? "" : summarizeToolResult(event.result),
-            // CT496: carry the originating MCP server (null when absent / a host tool).
+            input: truncate(input, TOOL_IO_MAX_CHARS),
+            result: result === null ? "" : truncate(result, TOOL_IO_MAX_CHARS),
+            // Only when the event carried an input: a completion whose start this process never saw has
+            // none, and a zero would overwrite the size its start recorded.
+            ...event.input === void 0 ? {} : { inputChars: input.length },
+            ...result === null ? {} : { resultChars: result.length },
+            // The originating MCP server (null when absent / a host tool).
             mcpServer: event.mcpServer ?? null,
             phase: event.phase
           });
@@ -2400,6 +2254,8 @@ var init_pump = __esm({
               summary: evt.summary,
               input: evt.input,
               result: evt.result,
+              ...evt.inputChars !== void 0 ? { inputChars: evt.inputChars } : {},
+              ...evt.resultChars !== void 0 ? { resultChars: evt.resultChars } : {},
               mcpServer: evt.mcpServer,
               phase: evt.phase,
               seq
@@ -2432,22 +2288,18 @@ var init_pump = __esm({
       // The turn's final reply text, captured for the dashboard feed / logging.
       finalReplyBody = null;
       emittedFinalSource = "none";
-      // CT1383: provider tool id → the persisted identity of its CURRENT call. The
-      // provider's id is only a lookup key: it is unique within one adapter
-      // invocation at best (Codex restarts at `item_0` on every invocation, and a
-      // resumed turn keeps its turn id), so the row and the outbox entry are keyed
-      // on what the pump mints — a host id for the host's `(turn_id, tool_use_id)`
-      // upsert, and a seq for the outbox's `(turnId, seq)` file. Both are minted
-      // together; minting only the id would let two calls overwrite each other's
-      // queued body.
+      // Provider tool id → the persisted identity of its current call. The provider's id is only a
+      // lookup key, unique within one adapter invocation at best (Codex restarts at `item_0` every
+      // invocation, and a resumed turn keeps its turn id), so the row and the outbox entry are keyed on
+      // what the pump mints: a host id for the host's `(turn_id, tool_use_id)` upsert, and a seq for the
+      // outbox's `(turnId, seq)` file. Minted together; minting only the id would let two calls
+      // overwrite each other's queued body.
       //
-      // In memory on purpose: it dies with the process, and so does the runtime.
-      // After a crash no in-flight `done` awaits a pre-crash `start` — the resumed
-      // invocation starts its calls afresh — so there is nothing to recover.
+      // In memory on purpose: it dies with the process, and so does the runtime. After a crash no
+      // in-flight `done` awaits a pre-crash `start` — the resumed invocation starts its calls afresh.
       toolCallByProviderId = /* @__PURE__ */ new Map();
-      // The callback consumer the classification (via `sinkEmitter`) — and the
-      // frozen committer test — drive. Each callback applies the choreography and
-      // commits through the injected sink.
+      // The callback consumer the classification (via `sinkEmitter`) and the committer test drive.
+      // Each callback applies the choreography and commits through the injected sink.
       sink;
       // Whether a message has landed under this span — first words, at least. A
       // span that spoke settles; one that never did is a pass.
@@ -2540,7 +2392,7 @@ var init_descriptions = __esm({
       wake_me: {
         afterSeconds: "Relative delay in seconds from NOW \u2014 this call (e.g. 300 = five minutes). Provide EITHER this or `at`, not both. Floor 60s, horizon 14 days \u2014 enforced server-side.",
         at: "Absolute ISO-8601 timestamp WITH a zone (`Z` or `\xB1HH:MM`), e.g. `2026-07-16T09:00:00-07:00`. YOU compute it from a natural-language phrase using the current datetime in your turn context. Provide EITHER this or `afterSeconds`, not both.",
-        note: `A note to your future self \u2014 becomes the body of the wake message that re-dispatches you, up to ${MAX_WAKE_NOTE_BYTES} characters. Write the condition to re-check ("check whether the PR merged").`
+        note: `A note to your future self \u2014 becomes the body of the wake message that re-dispatches you, up to ${MAX_WAKE_NOTE_BYTES} characters. Write the condition to re-check in a sentence or two ("check whether the PR merged"), not a plan. You never need to name yourself: the wake reaches you on its own.`
       },
       withdraw_ask: {
         askId: "The open ask to withdraw. Ask ids ride the conversation's message rows (`ask: { id, status, items }`), and your turn context lists the ones you have open.",
@@ -2564,7 +2416,7 @@ var init_prompt_guidance = __esm({
       ask: "put a structured question to a person",
       cancel_wake: "cancel your own armed wake in this conversation",
       skip_turn: "end without posting a reply",
-      wake_me: "schedule your own return",
+      wake_me: "schedule your own return; when it fires, say first what you came back to check",
       withdraw_ask: "withdraw an open ask in this conversation with a reason"
     };
   }
@@ -2810,52 +2662,41 @@ function buildClaudeCodeOptions(req, augment) {
     // pinned `model` arrives as a bare SDK id — the host already resolved the
     // namespaced catalog id to it.
     ...model ? { model } : {},
-    // SJ530: surface thinking summaries — default adaptive+summarized, and fill in
-    // `display:'summarized'` on a configured adaptive/enabled block that omits one.
-    // Read from the adapter's own dialect slice (`runtimeOptions['claude-code']`).
+    // Surface thinking summaries: default adaptive+summarized, and fill in `display:'summarized'`
+    // on a configured adaptive/enabled block that omits one. Read from the adapter's dialect slice
+    // (`runtimeOptions['claude-code']`).
     thinking: withThinkingSummaries(readThinking(config.runtimeOptions)),
     ...config.effort ? { effort: config.effort } : {},
     // Never merge arbitrary user `~/.claude` config; without `strictMcpConfig` the
     // user's existing `cabane` MCP registration could shadow ours.
     settingSources: [],
     strictMcpConfig: true,
-    // CT289: force auto-memory off unless the operator opted back in (see above).
+    // Auto-memory off unless the operator opted back in (see above).
     ...devControlsAutoMemory ? {} : { settings: { autoMemoryEnabled: false } },
     mcpServers,
     ...cwd ? { cwd } : {},
-    // Extra env (a companion prepare hook's tokens/ports; the in-app's debug flags)
-    // merged OVER the inherited environment.
+    // Extra env (a companion prepare hook's tokens/ports) merged over the inherited environment.
     //
-    // CT1503: and the background-tasks kill switch LAST, so nothing in
-    // `process.env` or `req.local.env` can turn it back on. Claude Code converts
-    // a foreground command that hits its Bash ceiling (600 000 ms) into a
-    // background task instead of erroring; the agent then reads a phantom task
-    // id inside a live turn. A later turn that resumed such a session was then
-    // seen getting every tool call aborted with kind `background` — which the CLI
-    // renders as "The user doesn't want to take this action right now", a
-    // cancellation wearing a refusal's words. The automatic conversion is
-    // REPRODUCED and is what this flag fixes; that the stopped task is what
-    // poisoned the resumed session is an INFERENCE from one incident, consistent
-    // with the transcript but never reproduced, and this change does not rest on
-    // it. `Dl()` reads this variable on the Bash tool's own call
-    // path and sets `canAutoBackground: false` and `turnAbortBackgrounds: false`
-    // together, so a timed-out command comes back as a readable error instead.
+    // The background-tasks kill switch goes last, so nothing in `process.env` or `req.local.env`
+    // turns it back on. Claude Code converts a foreground command that hits its Bash ceiling
+    // (600 000 ms) into a background task instead of erroring, and the agent then holds a phantom
+    // task id inside a live turn; a resumed session was seen with every tool call aborted as
+    // `background` ("The user doesn't want to take this action right now"). The conversion is
+    // reproduced and fixed by this flag; that it poisoned the resumed session is an inference
+    // from one incident, and this change doesn't rest on it. `Dl()` reads the variable on the
+    // Bash tool's call path and sets `canAutoBackground: false` and `turnAbortBackgrounds: false`,
+    // so a timed-out command returns a readable error.
     //
-    // The cost is acknowledged and deliberate: it ALSO removes deliberate
-    // `run_in_background` (the parameter leaves the tool schema). That is the
-    // only switch this harness offers, and there is no operator opt-out here on
-    // purpose — an escape hatch would contradict the guarantee. It is a targeted
-    // mitigation for the automatic conversion, NOT a cleanup mechanism: step 0
-    // measured that this flag changes no process-survival outcome on any turn-end
-    // path. Cleanup is its own change.
+    // The cost is deliberate: it also removes `run_in_background` (the parameter leaves the tool
+    // schema). It is the only switch, and there is no opt-out — an escape hatch would contradict
+    // the guarantee. It changes no process-survival outcome on any turn-end path (measured);
+    // cleanup is a separate concern.
     //
-    // Note `env` REPLACES the subprocess environment rather than merging (the
-    // SDK's own doc on `Options.env`), which is why `process.env` is spread here
-    // and why this key is now always present — previously it appeared only when
-    // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    // `env` replaces the subprocess environment rather than merging (`Options.env`), which is why
+    // `process.env` is spread here and the key is always present.
     //
-    // CT1698: `secretEnv` joins here, and only here — the values the MCP
-    // headers above reference. It is this child's environment, not the host's.
+    // `secretEnv` — the values the MCP headers above reference — joins here and only here: it is
+    // this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
@@ -3377,8 +3218,7 @@ function makeRequest(overrides2 = {}) {
     systemPrompt: "system",
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
-    // CT302: model is required — the adapter rejects a null model, so the
-    // conformance fixture carries a real bare SDK id.
+    // The adapter rejects a null model, so the fixture carries a real bare SDK id.
     config: { model: "claude-opus-4-8" },
     policy: CABANE_POLICY,
     session: null,
@@ -3513,7 +3353,7 @@ var init_conformance2 = __esm({
             phase: "start",
             summary: "sleep.md",
             input: { path: "sleep.md" },
-            // CT496: derived off the raw `mcp__cabane__` name.
+            // Derived from the raw `mcp__cabane__` name.
             mcpServer: "cabane"
           },
           {
@@ -3531,9 +3371,9 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result;
-        // the adapter stops before the closing reply — no final text, no `result`
-        // event. CT1295: the server writes the `kind:'stopped'` marker.
+        // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops
+        // before the closing reply — no final text, no `result` event (the server writes the stopped
+        // marker).
         name: "cancel mid-stream",
         request: makeRequest(),
         nativeStream: [
@@ -3585,12 +3425,9 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT1144: the empty-runtime anomaly's exact captured trace — `system/init`
-        // then a successful `result`, with nothing in between. Distinct from
-        // `empty-final` below: THAT turn did work (a tool ran) and just didn't speak;
-        // this one produced nothing at all. The adapter's job is unchanged either way
-        // — report faithfully what the runtime said — so it must still emit
-        // `result{ok:true}` here; the host is what decides that a success with no
+        // The empty-runtime anomaly's captured trace: `system/init` then a successful `result`, nothing
+        // in between. Distinct from `empty-final` (a tool ran, no speech); this produced nothing. The
+        // adapter reports faithfully — `result{ok:true}` — and the host decides that a success with no
         // content-bearing event is a failed turn.
         name: "zero-content success (empty runtime result)",
         request: makeRequest(),
@@ -3598,9 +3435,9 @@ var init_conformance2 = __esm({
         expected: [sessionEvent("s1"), { type: "result", ok: true }]
       },
       {
-        // CT1220: on resume, a completed background task can emit a notification and
-        // its own zero-token result before the prompt's frames. That result is not the
-        // turn boundary; decoding continues through the prompt's reply and real usage.
+        // On resume, a completed background task can emit a notification and its own zero-token result
+        // before the prompt's frames. That result is not the turn boundary; decoding continues through
+        // the reply and real usage.
         name: "task-notification result does not end a resumed turn",
         request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
         nativeStream: [
@@ -3676,8 +3513,8 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT1220: the filter is deliberately narrow. An origin-less zero-token result
-        // keeps today's break-on-first-result behavior, even if more frames follow.
+        // The filter is deliberately narrow: an origin-less zero-token result still ends the turn, even
+        // if more frames follow.
         name: "origin-less result still ends a resumed turn",
         request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
         nativeStream: [
@@ -3748,11 +3585,10 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT558/CT592/CT731: a subscription cap. The SDK emits a rejected
-        // `rate_limit_event` with a named subscription window; the terminal error result
-        // then classifies as the structured `usage_capped` reason. The held provider
-        // line independently classifies to the same kind, so it lands as a runtime
-        // notice rather than agent-authored progress.
+        // A subscription cap. The SDK emits a rejected `rate_limit_event` with a named subscription
+        // window; the terminal error result classifies as `usage_capped`. The held provider line
+        // independently classifies to the same kind, so it lands as a runtime notice, not agent
+        // progress.
         name: "subscription cap \u2192 usage_capped",
         request: makeRequest(),
         nativeStream: [
@@ -3771,9 +3607,8 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT1336: a failed turn can still contain the agent's own partial narration.
-        // No text classification means no authorship rewrite, even though the
-        // structured result is the same usage cap.
+        // A failed turn can still contain the agent's own partial narration. No text classification
+        // means no authorship rewrite, even though the structured result is the same usage cap.
         name: "partial narration before subscription cap stays progress",
         request: makeRequest(),
         nativeStream: [
@@ -3789,8 +3624,8 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT1336: even recognized runtime prose stays authored when its kind
-        // disagrees with the structured terminal failure.
+        // Recognized runtime prose stays authored when its kind disagrees with the structured terminal
+        // failure.
         name: "cap notice before server failure stays progress",
         request: makeRequest(),
         nativeStream: [
@@ -3812,10 +3647,9 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT1336 review: `classifyErrorText` intentionally searches arbitrary error
-        // blobs for status tokens. Assistant narration needs the stricter whole-
-        // notice classifier, or an incidental count is de-authored when the turn
-        // later fails with the matching provider kind.
+        // `classifyErrorText` deliberately searches arbitrary error blobs for status tokens. Assistant
+        // narration needs the stricter whole-notice classifier, or an incidental count would be
+        // de-authored when the turn later fails with the matching provider kind.
         name: "incidental 5xx-shaped narration before server failure stays progress",
         request: makeRequest(),
         nativeStream: [
@@ -3837,9 +3671,8 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // CT558/CT592: a cap signalled only by the result's
-        // `terminal_reason:'blocking_limit'` (no discrete rate-limit event) still
-        // classifies as the cap (`usage_capped`).
+        // A cap signalled only by the result's `terminal_reason:'blocking_limit'` (no rate-limit event)
+        // still classifies as `usage_capped`.
         name: "blocking_limit terminal reason \u2192 usage_capped",
         request: makeRequest(),
         nativeStream: [
@@ -3853,8 +3686,8 @@ var init_conformance2 = __esm({
         expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "usage_capped" }]
       },
       {
-        // CT558: an expired login surfaces as an `auth_status` error frame; the failing
-        // result classifies as `auth_expired`.
+        // An expired login surfaces as an `auth_status` error frame; the failing result classifies as
+        // `auth_expired`.
         name: "expired login \u2192 auth_expired",
         request: makeRequest(),
         nativeStream: [
@@ -3868,10 +3701,9 @@ var init_conformance2 = __esm({
         expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "auth_expired" }]
       },
       {
-        // CT592: a transient provider outage surfaced in the terminal result text (no
-        // structured event/enum) — a 529 overload — classifies as `server_error` via
-        // the text fallback. It must NOT read as the cap and must not stamp the
-        // connector `limited` (the whole point of the honest taxonomy).
+        // A transient provider outage in the terminal result text (no structured event or enum) — a 529
+        // overload — classifies as `server_error` via the text fallback. It must not read as the cap or
+        // stamp the connector `limited`.
         name: "provider overload text \u2192 server_error",
         request: makeRequest(),
         nativeStream: [
@@ -3884,11 +3716,9 @@ var init_conformance2 = __esm({
         expected: [sessionEvent("s1"), { type: "result", ok: false, reason: "server_error" }]
       },
       {
-        // CT601: the resolved model is captured off `system/init.model` and attached
-        // to the terminal `result` — even on a plain resume (this fixture resumes, so
-        // no `session` event fires, proving the model doesn't ride the session event).
-        // The configured request model is irrelevant here; what's asserted is that the
-        // concrete id the HARNESS reported comes home.
+        // The resolved model is captured off `system/init.model` and attached to the terminal `result`
+        // even on a plain resume (this fixture resumes, so no `session` event fires). What's asserted is
+        // that the concrete id the harness reported comes home.
         name: "resolved model captured from system/init",
         request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
         nativeStream: [init("s1", "claude-opus-4-8"), assistantText("Done."), resultSuccess("s1")],
@@ -3898,9 +3728,8 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // Session resume echo: the stored state matches the current cwd, so we resume
-        // its SDK id; `system/init` echoes that same id, so NO session event fires
-        // (the id didn't change).
+        // Session resume echo: the stored state matches the cwd, so its SDK id is resumed and
+        // `system/init` echoes the same id — no session event fires.
         name: "session resume (no re-emit on echo)",
         request: makeRequest({ session: encodeSession({ sdkSessionId: "s1", cwd: CWD }) }),
         nativeStream: [init("s1"), assistantText("Back again."), resultSuccess("s1")],
@@ -3910,16 +3739,14 @@ var init_conformance2 = __esm({
         ]
       },
       {
-        // SJ527 cwd-mismatch degrade: the stored state was created under a DIFFERENT
-        // cwd, so the adapter refuses to resume and starts fresh — `system/init`
-        // reports a new id, and the emitted session event records the CURRENT cwd.
+        // Cwd-mismatch degrade: the stored state was created under another cwd, so the adapter starts
+        // fresh — `system/init` reports a new id, and the session event records the current cwd.
         name: "session cwd-mismatch degrades to fresh",
         request: makeRequest({ session: encodeSession({ sdkSessionId: "old", cwd: "/env/gone" }) }),
         nativeStream: [init("fresh1"), assistantText("Fresh start."), resultSuccess("fresh1")],
         expected: [
-          // CT315: the degrade is flagged on the session event so the host relays it
-          // on settle and the server rewinds the catch-up mark (recovering the
-          // pre-mark context the discarded session no longer carries).
+          // The degrade is flagged on the session event so the host relays it on settle and the server
+          // rewinds the catch-up mark (recovering context the discarded session no longer carries).
           sessionEvent("fresh1", CWD, true),
           { type: "text", body: "Fresh start.", terminal: true },
           { type: "result", ok: true }
@@ -4622,8 +4449,6 @@ function createOpencodeAdapter(deps = {}) {
   const transport = deps.transport ?? (deps.serverUrl ? createHttpOpencodeTransport({ baseUrl: deps.serverUrl }) : null);
   return {
     name: "opencode",
-    // CT829: one surface, so one addendum and no parameter — CT614's `codeMode`
-    // argument went with the named tool surface it selected against.
     promptAddendum: () => OPENCODE_ADDENDUM,
     dialectSchema: opencodeDialectSchema,
     async *runTurn(request, signal, hooks) {
@@ -4812,15 +4637,12 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT301: a STREAMING provider's tool input arrives late. opencode re-emits the
-        // tool part as a full snapshot as the args parse: DeepSeek sends `input: {}` on
-        // the early `pending`/`running` frame and the full args only on a later snapshot
-        // (live-captured against opencode 1.17: `pending {}` → `running {full}` →
-        // `completed {full}`). The `start` event fires immediately off the first (empty)
-        // frame — that's the live card — but the `done` event (and the DB row it
-        // upserts) must carry the LATEST non-empty input + its summary, not the
-        // first-seen `{}`. This is the case the pre-CT301 suite structurally couldn't
-        // catch: every other tool fixture bakes the full input into the first snapshot.
+        // A streaming provider's tool input arrives late. opencode re-emits the tool part as a full
+        // snapshot as the args parse: DeepSeek sends `input: {}` on the early `pending`/`running` frame
+        // and the full args on a later one (captured on opencode 1.17: `pending {}` → `running {full}` →
+        // `completed {full}`). `start` fires off the first (empty) frame — the live card — but `done`
+        // (and the row it upserts) must carry the latest non-empty input and its summary. Every other
+        // tool fixture bakes the full input into the first snapshot, so only this one catches it.
         name: "streaming tool input \u2014 late args refresh the done event (CT301)",
         request: makeRequest2(),
         nativeStream: [
@@ -4858,9 +4680,8 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
-        // adapter stops before the closing reply — no final text, no `result` event.
-        // CT1295: the server writes the `kind:'stopped'` marker.
+        // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops before
+        // the closing reply — no final text, no `result` event (the server writes the stopped marker).
         name: "cancel mid-stream",
         request: makeRequest2(),
         nativeStream: [
@@ -4900,10 +4721,9 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT558/CT592: a provider 429 throttle. The wrapped `RateLimitError` is
-        // unwrapped by `readSessionError` then text-classified — a bare "rate limit
-        // (429)" with no cap noun is the throttle (`rate_limited`), distinct from the
-        // account cap. opencode is text-only so it inherits the CT592 split for free.
+        // A provider 429 throttle. The wrapped `RateLimitError` is unwrapped by `readSessionError` and
+        // text-classified: a bare "rate limit (429)" with no cap noun is the throttle (`rate_limited`),
+        // not the account cap.
         name: "provider 429 \u2192 rate_limited (throttle, no reset)",
         request: makeRequest2(),
         nativeStream: [
@@ -4919,9 +4739,8 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT592: a subscription cap surfaced as text ("usage limit reached") → the cap
-        // (`usage_capped`). opencode carries no reset hint, so it's reset-less (the
-        // server renders "try again later").
+        // A subscription cap surfaced as text ("usage limit reached") → `usage_capped`. opencode carries
+        // no reset hint, so it's reset-less (the server says "try again later").
         name: "usage cap text \u2192 usage_capped (no reset)",
         request: makeRequest2(),
         nativeStream: [
@@ -4937,9 +4756,7 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT592: a transient provider outage (5xx / overload) surfaced as text → the
-        // honest `server_error`, never the cap. This is the outage class that used to
-        // fall through to an opaque `unknown`.
+        // A transient provider outage (5xx / overload) surfaced as text → `server_error`, never the cap.
         name: "provider overload text \u2192 server_error",
         request: makeRequest2(),
         nativeStream: [
@@ -4957,7 +4774,7 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT558: an expired/invalid credential classifies as `auth_expired`.
+        // An expired or invalid credential classifies as `auth_expired`.
         name: "auth failure \u2192 auth_expired",
         request: makeRequest2(),
         nativeStream: [
@@ -4973,8 +4790,8 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT1351: an unclassified failure remains as informative as a classified one:
-        // its provider text is visible while the raw machine reason stays unchanged.
+        // An unclassified failure stays informative: its provider text is visible, and the raw machine
+        // reason is unchanged.
         name: "unclassified failure keeps a runtime notice and raw reason",
         request: makeRequest2(),
         nativeStream: [errored("something local broke")],
@@ -4995,8 +4812,8 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT1351: empty, whitespace-only, and bare status-token failures still set
-        // the machine reason but do not add an empty/unhelpful transcript notice.
+        // Empty, whitespace-only and bare status-token failures still set the machine reason but add no
+        // empty or unhelpful transcript notice.
         name: "empty failure text emits no runtime notice",
         request: makeRequest2(),
         nativeStream: [errored("")],
@@ -5028,12 +4845,10 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT1144: the same zero-content success the claude-code suite pins, in
-        // opencode's vocabulary — the session goes idle having emitted no part at
-        // all. No opencode sample of the anomaly has been seen in the wild; the
-        // fixture exists because the host's classification is runtime-neutral, so a
-        // runtime that CAN produce this envelope must be shown producing it in the
-        // shape the classifier reads.
+        // The zero-content success the claude-code suite pins, in opencode's vocabulary — the session
+        // goes idle having emitted no part. No opencode sample has been seen; the fixture exists because
+        // the host's classification is runtime-neutral, so a runtime that can produce this envelope must
+        // be shown producing it in the shape the classifier reads.
         name: "zero-content success (empty runtime result)",
         request: makeRequest2(),
         nativeStream: [idle()],
@@ -5090,10 +4905,9 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT298: the stored state matches the current directory, so the adapter resumes
-        // its id and the transport reports `created:false` on the same id — NO session
-        // event fires (the id didn't change). This is the resume-echo case CT294
-        // removed; restoring it is the crux of restoring cross-turn memory.
+        // The stored state matches the directory, so the adapter resumes its id and the transport reports
+        // `created:false` on the same id — no session event fires. Resume is what carries cross-turn
+        // memory.
         name: "session resume (no re-emit on echo)",
         request: makeRequest2({ session: encodeSession2({ sessionId: "s1", directory: DIR }) }),
         nativeStream: [textPart("p1", "Back again."), idle()],
@@ -5103,12 +4917,10 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // CT298: on a resumed turn the transport mints NO client message id (supplying
-        // one no-ops the turn), so the decoder can't be handed a `skipMessageId` up
-        // front. It learns the user-message id from the stream — the `message.updated`
-        // user frame precedes that message's echoed part — and drops the echo, so the
-        // injected per-turn context still can't leak into Steps. Only the assistant
-        // reply surfaces. No session event (resume echo on the same id).
+        // On a resumed turn the transport mints no client message id (doing so no-ops the turn), so the
+        // decoder gets no `skipMessageId`. It learns the user-message id from the stream — the
+        // `message.updated` user frame precedes the echoed part — and drops the echo, so the injected
+        // per-turn context can't leak into Steps. Only the reply surfaces; no session event.
         name: "session resume \u2014 prompt echo filtered via stream-derived user id",
         request: makeRequest2({ session: encodeSession2({ sessionId: "s1", directory: DIR }) }),
         nativeStream: [
@@ -5124,17 +4936,15 @@ var init_conformance3 = __esm({
         ]
       },
       {
-        // Directory-mismatch degrade (the SJ527 analogue): the stored state was
-        // created under a DIFFERENT directory, so the adapter refuses to resume and
-        // starts fresh — the transport creates a new session, and the emitted session
-        // event records the CURRENT directory.
+        // Directory-mismatch degrade: the stored state was created under another directory, so the
+        // adapter starts fresh — the transport creates a new session, and the session event records the
+        // current directory.
         name: "session directory-mismatch degrades to fresh",
         request: makeRequest2({ session: encodeSession2({ sessionId: "old", directory: "/env/gone" }) }),
         nativeStream: [textPart("p1", "Fresh start."), idle()],
         expected: [
-          // CT315: the degrade is flagged on the session event (parity with
-          // claude-code) so the host relays it on settle and the server rewinds the
-          // catch-up mark, recovering the context the discarded session dropped.
+          // The degrade is flagged on the session event so the host relays it on settle and the server
+          // rewinds the catch-up mark, recovering context the discarded session dropped.
           sessionEvent2(NEW_SESSION_ID, DIR, true),
           { type: "text", body: "Fresh start.", terminal: true },
           { type: "result", ok: true }
@@ -5159,11 +4969,9 @@ var init_addendum3 = __esm({
       "absent without attempting discovery and invocation, and if a call fails, report the recorded",
       "error.",
       turnControlPromptGuidance("mcp__cabane_companion__"),
-      // CT1552: every ancillary tool is written the way Codex's own tool list shows
-      // it — qualified. The bare `read_binary` / `upload` / … this list used to mix
-      // in sat two lines under the instruction to invoke the exact qualified names,
-      // so the sentence contradicted itself. The bare `query` / `mutate` below stay:
-      // that sentence is about operation names, after the qualified forms are given.
+      // Every ancillary tool is written as Codex's own tool list shows it — qualified — so the sentence
+      // instructing exact qualified names doesn't contradict itself. The bare `query` / `mutate` below
+      // stay: that sentence is about operation names, after the qualified forms are given.
       "The ancillary tools are `mcp__cabane__read_binary`, `mcp__cabane__upload`,",
       "`mcp__cabane__begin_upload`, `mcp__cabane__finalize_upload` and",
       "`mcp__cabane__mint_render_token` \u2014 all possibly deferred too.",
@@ -5419,10 +5227,9 @@ async function* decodeCodexStream(events, ctx) {
           threadId,
           cwd: ctx.cwd ?? "",
           promptFingerprint: ctx.promptFingerprint ?? null,
-          // CT1645: the baseline this turn INHERITED, carried through unchanged.
-          // This early write exists so a turn that dies mid-stream still leaves
-          // the thread id recorded; it cannot yet know what this turn will spend.
-          // The closing write below records the new baseline.
+          // The baseline this turn inherited, carried through unchanged. This early write records the
+          // thread id even if the turn dies mid-stream; it can't yet know what the turn will spend. The
+          // closing write records the new baseline.
           usageBaseline: ctx.usageBaseline ?? null
         });
         if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
@@ -5716,9 +5523,8 @@ function buildConfig(req, baseInstructionsFile) {
   return {
     mcp_servers,
     experimental_use_rmcp_client: true,
-    // CT871: the no-host-access prompt replacement — Cabane's composed prompt
-    // becomes Codex's base instructions, and Codex's own environment preamble goes
-    // with the harness prompt it belonged to.
+    // The no-host-access prompt replacement — Cabane's composed prompt becomes Codex's base
+    // instructions, and Codex's environment preamble goes with the harness prompt it belonged to.
     ...baseInstructionsFile ? { model_instructions_file: baseInstructionsFile, include_environment_context: false } : {},
     ...Object.keys(shellEnv).length ? { shell_environment_policy: { set: shellEnv } } : {}
   };
@@ -5839,16 +5645,11 @@ function createSdkCodexTransport(opts = {}) {
       const codexOptions = {
         ...opts.apiKey ? { apiKey: opts.apiKey } : {},
         ...opts.codexPathOverride ? { codexPathOverride: opts.codexPathOverride } : {},
-        // The `--config` overrides (MCP servers + rmcp flag). CT1501: rendered to
-        // finished `--config` strings by US and passed through `configOverrides`,
-        // the SDK's raw passthrough — NOT through `config`, which would flatten
-        // them itself. A user MCP server named `my.server` cannot go in an
-        // override's dotted path at all (the CLI splits the path on `.` and
-        // ignores TOML quoting), so it has to ride inside an inline-table value,
-        // and the SDK's flattener cannot be steered into producing one. This is
-        // also what makes the PUBLISHED companion correct, where the vendored
-        // patch never reached — and why that patch is gone. See
-        // `config-overrides.ts`.
+        // The `--config` overrides (MCP servers + rmcp flag), rendered to finished `--config` strings
+        // here and passed through `configOverrides`, the SDK's raw passthrough — not `config`, which
+        // flattens them itself. A user MCP server named `my.server` can't go in an override's dotted
+        // path (the CLI splits on `.` and ignores TOML quoting), so it must ride inside an inline-table
+        // value, which the SDK's flattener can't produce. See `config-overrides.ts`.
         configOverrides: buildConfigOverrides(spec.config),
         ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
@@ -5872,8 +5673,6 @@ function createCodexAdapter(deps = {}) {
   const transport = deps.transport ?? (deps.enabled ? createSdkCodexTransport({ ...deps.apiKey ? { apiKey: deps.apiKey } : {} }) : null);
   return {
     name: "codex",
-    // CT829: one surface, so one addendum and no parameter — CT614's `codeMode`
-    // argument went with the named tool surface it selected against.
     promptAddendum: () => CODEX_ADDENDUM,
     dialectSchema: codexDialectSchema,
     async *runTurn(request, signal, hooks) {
@@ -5965,17 +5764,14 @@ function createCodexAdapter(deps = {}) {
           cwd: req.local.cwd,
           resumedThreadId: resumeThreadId,
           degraded,
-          // CT1075: which prompt the thread carries once this turn lands. If we sent
-          // one, it's that one — a later copy is what the model reads, so a changed
-          // prompt supersedes the older copy still sitting above it. If we withheld
-          // it, the thread still carries whatever it did before. Read off the spec
-          // rather than recomputed, so the recorded fact can't disagree with what
-          // was actually sent.
+          // Which prompt the thread carries once this turn lands. If we sent one, it's that one — the
+          // later copy is what the model reads. If we withheld it, the thread carries what it did. Read
+          // off the spec, so the record can't disagree with what was sent.
           promptFingerprint: spec.promptRidesInput ? spec.promptFingerprint : threadPromptFingerprint,
           storedState: req.session,
           usageBaseline: threadUsageBaseline,
-          // CT601: Codex reports no model in-stream, so record what the thread was
-          // started with (null on the default token). Same for the reasoning effort.
+          // Codex reports no model in-stream, so record what the thread was started with (null on the
+          // default token). Same for the reasoning effort.
           resolvedModel: spec.model,
           resolvedReasoningEffort: spec.modelReasoningEffort ?? null
         });
@@ -6030,11 +5826,9 @@ function makeRequest3(overrides2 = {}) {
     systemPrompt: PROMPT,
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
-    // CT601: the resolved model + reasoning effort ride the terminal `result` off
-    // the run spec's model. The behavioral fixtures below don't assert them, so the
-    // default is the model-less ("let Codex choose") token → no `resolvedModel`
-    // emitted → their expected results stay unchanged; a dedicated capture fixture
-    // sets a real model + effort.
+    // The resolved model and reasoning effort ride the terminal `result` off the run spec's model.
+    // Behavioural fixtures use the model-less token (no `resolvedModel` emitted); a dedicated capture
+    // fixture sets a real model and effort.
     config: { model: null },
     policy: COMPANION_POLICY2,
     session: null,
@@ -6106,13 +5900,12 @@ var init_conformance4 = __esm({
     });
     CODEX_CONFORMANCE_FIXTURES = [
       {
-        // A plain text reply: the held agent message seals as the terminal final at
-        // `turn.completed`; the usage counters ride the `result`.
+        // A plain text reply: the held agent message seals as the terminal final at `turn.completed`;
+        // usage rides the `result`.
         //
-        // CT1283: the counters NEST — `cached_input_tokens` is a slice of
-        // `input_tokens`, `reasoning_output_tokens` a slice of `output_tokens` — so
-        // input is 100 (not 120) and output is 50 (not 60), with the cache read broken
-        // out beside them. This fixture pinned the double-count before CT1283.
+        // The counters nest — `cached_input_tokens` is a slice of `input_tokens`,
+        // `reasoning_output_tokens` a slice of `output_tokens` — so input is 100 (not 120) and output 50
+        // (not 60), with the cache read broken out beside them.
         name: "clean turn",
         request: makeRequest3(),
         nativeStream: [
@@ -6129,10 +5922,8 @@ var init_conformance4 = __esm({
         expected: [
           sessionEvent3(NEW_THREAD_ID),
           { type: "text", body: "Hello there.", terminal: true },
-          // CT1645: the closing session write — the thread's ending totals, recorded
-          // as the baseline the NEXT turn subtracts. This is a fresh thread, so the
-          // `result` usage below is the frame verbatim (nothing to subtract yet);
-          // what makes it per-turn is this figure being carried into turn two.
+          // The closing session write — the thread's ending totals, recorded as the baseline the next turn
+          // subtracts. A fresh thread, so the `result` usage below is the frame verbatim.
           sessionEvent3(NEW_THREAD_ID, DIR2, false, fingerprintPrompt(PROMPT), {
             inputTokens: 100,
             outputTokens: 50,
@@ -6204,8 +5995,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1211: recorded MCP success shape. Codex exposes the text compatibility
-        // copy and the native object together; normalization must keep the object.
+        // The recorded MCP success shape: Codex exposes the text copy and the native object together;
+        // normalization must keep the object.
         name: "MCP success prefers native structured content",
         request: makeRequest3(),
         nativeStream: [
@@ -6255,8 +6046,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1211 incident shape: MCP `isError` keeps the failed phase, while the raw
-        // camel-case structured payload survives instead of the generic `error` token.
+        // MCP `isError` keeps the failed phase, while the raw camel-case structured payload survives
+        // instead of the generic `error` token.
         name: "failed MCP call preserves structured receipt while remaining error phase",
         request: makeRequest3(),
         nativeStream: [
@@ -6308,8 +6099,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // A transport/tool failure has no MCP result payload and still uses the real
-        // adapter error message. CT1211 must not replace this fallback with `undefined`.
+        // A transport/tool failure with no MCP result payload still uses the real adapter error message,
+        // never `undefined`.
         name: "failed MCP call without result keeps error message fallback",
         request: makeRequest3(),
         nativeStream: [
@@ -6349,8 +6140,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1147 stays intact when a connector includes structured metadata beside an
-        // image-only MCP response: no image/base64 payload enters activity receipts.
+        // A connector's structured metadata beside an image-only MCP response: no image/base64 payload
+        // enters activity receipts.
         name: "image-only MCP result remains empty despite structured metadata",
         request: makeRequest3(),
         nativeStream: [
@@ -6443,12 +6234,10 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT715: web_search LIFECYCLE. Unlike the other three tool kinds, a `web_search`
-        // item carries NO `status` field — completion is signaled by the frame TYPE
-        // (`item.started` → `item.completed`). The `start` fires off the first frame
-        // (empty query, no output card); the `done` must resolve off `item.completed`
-        // and carry the populated query the completed frame filled in. Before CT715 the
-        // card was pinned at "running" forever (status derived from a missing field).
+        // web_search lifecycle. A `web_search` item carries no `status` — completion is signalled by the
+        // frame type (`item.started` → `item.completed`). The `start` fires off the first frame (empty
+        // query); the `done` must resolve off `item.completed` with the populated query, not stay
+        // "running".
         name: "web_search lifecycle \u2014 completes off frame type, populated query on done",
         request: makeRequest3(),
         nativeStream: [
@@ -6479,9 +6268,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT715: a non-text web action (`action.type: "other"`) legitimately completes
-        // with an EMPTY query — that's Codex's own data, not our bug. It must still
-        // resolve to `done` (empty query acceptable; stuck-running is not).
+        // A non-text web action (`action.type: "other"`) legitimately completes with an empty query —
+        // Codex's own data. It must still resolve to `done`.
         name: "web_search lifecycle \u2014 empty-query completion still resolves to done",
         request: makeRequest3(),
         nativeStream: [
@@ -6512,9 +6300,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // HIGHEST-RISK: cancel mid-stream. The abort lands after the tool result; the
-        // adapter stops before the closing reply — no final text, no `result` event.
-        // CT1295: the server writes the `kind:'stopped'` marker.
+        // Highest risk: cancel mid-stream. The abort lands after the tool result; the adapter stops before
+        // the closing reply — no final text, no `result` event (the server writes the stopped marker).
         name: "cancel mid-stream",
         request: makeRequest3(),
         nativeStream: [
@@ -6595,11 +6382,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT592: Codex used to classify NOTHING — every `turn.failed` became a raw
-        // `error:<text>` `unknown`. It now routes the failure text through the shared
-        // classifier (Codex is text-only), so a provider 429 / outage / auth / cap
-        // failure splits into the honest taxonomy instead of all reading `unknown`.
-        // This is a real behavior change, not a refactor. One fixture per kind:
+        // The failure text goes through the shared classifier (Codex is text-only), so a provider 429 /
+        // outage / auth / cap failure splits into the honest taxonomy. One fixture per kind:
         name: "turn.failed 429 \u2192 rate_limited (throttle)",
         request: makeRequest3(),
         nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("429 Too Many Requests")],
@@ -6646,8 +6430,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT592: a Codex failure text the classifier can't place still keeps today's
-        // raw `error:<text>` reason (the `unknown` fallback) — nothing regresses.
+        // A failure text the classifier can't place keeps the raw `error:<text>` reason (the `unknown`
+        // fallback).
         name: "turn.failed unclassified \u2192 raw error reason (unchanged)",
         request: makeRequest3(),
         nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("something local broke")],
@@ -6671,8 +6455,8 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1351: empty, whitespace-only, and bare status-token failures still set
-        // the machine reason but do not add an empty/unhelpful transcript notice.
+        // Empty, whitespace-only and bare status-token failures still set the machine reason but add no
+        // empty or unhelpful transcript notice.
         name: "empty failure text emits no runtime notice",
         request: makeRequest3(),
         nativeStream: [threadStarted(NEW_THREAD_ID), turnFailed("")],
@@ -6701,11 +6485,9 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT481: fail LOUD on unknown model metadata. An unknown `--model` makes Codex
-        // emit an `error` item ("… Defaulting to fallback metadata …") and then go
-        // haywire (the spurious tool call scripted after it MUST never be emitted). The
-        // adapter ends the turn the moment the signal lands, with a machine reason — so
-        // a future Codex id-drop errors clean instead of degrading mid-tool-turn.
+        // Fail loud on unknown model metadata. An unknown `--model` makes Codex emit an `error` item
+        // ("… Defaulting to fallback metadata …") and misbehave (the spurious tool call scripted after it
+        // must never be emitted). The adapter ends the turn when the signal lands, with a machine reason.
         name: "unknown model metadata \u2192 fail loud (guard)",
         request: makeRequest3(),
         nativeStream: [
@@ -6751,12 +6533,10 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1144: the same zero-content success the claude-code suite pins, in
-        // Codex's vocabulary — the thread starts, the turn completes, and nothing is
-        // emitted in between. No Codex sample of the anomaly has been seen in the
-        // wild; the fixture exists because the host's classification is runtime-
-        // neutral, so a runtime that CAN produce this envelope must be shown
-        // producing it in the shape the classifier reads.
+        // The zero-content success the claude-code suite pins, in Codex's vocabulary — the thread
+        // starts, the turn completes, nothing in between. No Codex sample has been seen; the fixture
+        // exists because the host's classification is runtime-neutral, so a runtime that can produce
+        // this envelope must be shown producing it in the shape the classifier reads.
         name: "zero-content success (empty runtime result)",
         request: makeRequest3(),
         nativeStream: [threadStarted(NEW_THREAD_ID), turnCompleted()],
@@ -6825,11 +6605,10 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT601: Codex reports no model in-stream, so the resolved model + reasoning
-        // effort come from what the thread was STARTED with (the run spec) and ride the
-        // terminal `result`. A real model + a `runtimeOptions.codex.modelReasoningEffort`
-        // are asserted through to `resolvedModel` (bare, `openai/`-stripped) and
-        // `resolvedConfig.reasoningEffort`.
+        // Codex reports no model in-stream, so the resolved model and reasoning effort come from what the
+        // thread was started with (the run spec) and ride the terminal `result`: a real model and a
+        // `runtimeOptions.codex.modelReasoningEffort` are asserted through to `resolvedModel` (bare,
+        // `openai/`-stripped) and `resolvedConfig.reasoningEffort`.
         name: "resolved model + reasoning effort captured from run spec",
         request: makeRequest3({
           config: {
@@ -6850,15 +6629,12 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // Session resume: the stored state matches the current directory, so the adapter
-        // resumes its thread id and `thread.started` echoes the SAME id — NO session
-        // event fires (the id didn't change AND the state is unchanged). This is what
-        // carries cross-turn memory.
+        // Session resume: the stored state matches the directory, so the thread id is resumed and
+        // `thread.started` echoes it — no session event fires. This is what carries cross-turn memory.
         //
-        // CT1075: the stored state also says the thread already holds the composed
-        // prompt, so this turn withholds the preamble and the state it would write is
-        // byte-identical to the stored one. The silence is now proof of BOTH: an id that
-        // didn't change and a prompt that didn't need re-sending.
+        // The stored state also says the thread already holds the composed prompt, so this turn
+        // withholds the preamble and the state it would write is byte-identical: the silence proves both
+        // an unchanged id and a prompt that needed no re-send.
         name: "session resume (no re-emit on echo)",
         request: makeRequest3({
           session: encodeSession3({
@@ -6875,16 +6651,12 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1075: a resumed thread the platform's state does NOT vouch for — a state
-        // written before CT1075 existed, so it carries no `promptFingerprint` field. The
-        // adapter reads the absence as "we can't say which prompt this thread holds",
-        // sends the full prompt exactly as it did pre-CT1075, and re-emits the state with
-        // the fingerprint recorded — on the SAME thread id, which pre-CT1075 emitted
-        // nothing at all. That re-emit is the upgrade path: without it a long-lived
-        // thread would re-send the whole prompt forever.
+        // A resumed thread whose stored state carries no `promptFingerprint` field. The adapter reads the
+        // absence as "can't say which prompt this thread holds", sends the full prompt, and re-emits the
+        // state with the fingerprint — on the same thread id. That re-emit is the upgrade path: without
+        // it a long-lived thread would re-send the whole prompt forever.
         //
-        // This is the fixture that fails if the static half is withheld on a thread we
-        // have no evidence about.
+        // This fixture fails if the standing half is withheld on a thread we have no evidence about.
         name: "session resume with a pre-CT1075 state re-emits with the prompt fingerprint",
         request: makeRequest3({
           session: JSON.stringify({ threadId: "th1", cwd: DIR2 })
@@ -6897,14 +6669,12 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // CT1075 (review finding): the thread carries a DIFFERENT prompt than the one
-        // this turn composed — a charter edit, a renamed agent, a redeployed prompt
-        // body. The stored fingerprint doesn't match, so the new prompt is sent exactly
-        // as on a fresh thread and the state is re-recorded against it.
+        // The thread carries a different prompt than this turn composed — a charter edit, a renamed
+        // agent, a redeployed prompt body. The fingerprint doesn't match, so the new prompt is sent as on
+        // a fresh thread and the state re-recorded.
         //
-        // This is the fixture that fails if a stale prompt is treated as good enough. A
-        // boolean flag would have passed the resume fixture above and silently withheld
-        // every future charter edit from this thread.
+        // This fixture fails if a stale prompt is treated as good enough; a boolean flag would pass the
+        // resume fixture above and withhold every future charter edit.
         name: "session resume with a stale prompt fingerprint re-sends the prompt",
         request: makeRequest3({
           session: encodeSession3({
@@ -6922,15 +6692,12 @@ var init_conformance4 = __esm({
         ]
       },
       {
-        // Directory-mismatch degrade (the SJ527 analogue): the stored state was created
-        // under a DIFFERENT directory, so the adapter refuses to resume and starts
-        // fresh — `thread.started` reports a NEW id, and the emitted session event
-        // records the CURRENT directory with `degraded: true` so the host rewinds the
-        // catch-up mark.
+        // Directory-mismatch degrade: the stored state was created under another directory, so the
+        // adapter starts fresh — `thread.started` reports a new id, and the session event records the
+        // current directory with `degraded: true` so the host rewinds the catch-up mark.
         //
-        // CT1075: the refused resume means the new thread is EMPTY, so the full prompt
-        // goes in even though the stored state vouched for a copy — of a thread we're
-        // no longer in. The emitted state records the fresh thread's own answer.
+        // The refused resume means the new thread is empty, so the full prompt goes in even though the
+        // stored state vouched for a copy in a thread we're no longer in.
         name: "session directory-mismatch degrades to fresh",
         request: makeRequest3({
           session: encodeSession3({
@@ -7319,8 +7086,7 @@ function createTurnContainment(turnId, deps = {}) {
       `--unit=${unit}`,
       `--property=TimeoutStopSec=${CONTAINMENT_STOP_GRACE_SEC}s`,
       // Bind the scope's life to the companion's own unit, so stopping or
-      // restarting the companion still takes its in-flight turns with it —
-      // which is what happens today, and what the scope would otherwise undo.
+      // restarting the companion still takes its in-flight turns with it.
       // Omitted outside a unit, where there is nothing to bind to.
       ...ownUnit ? [`--property=PartOf=${ownUnit}`] : [],
       "--"
@@ -7671,7 +7437,7 @@ var init_run_config = __esm({
       type: z15.literal("http"),
       url: z15.string().url(),
       headers: z15.record(z15.string(), z15.string()).optional(),
-      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // Header → the name of a `secretEnv` entry holding its value. Set by
       // the server on a room connection's entry, and by `resolveMcpSecrets` on a
       // header whose `${VAR}` it resolved.
       headersFromEnv: z15.record(z15.string(), z15.string()).optional()
@@ -7680,7 +7446,7 @@ var init_run_config = __esm({
       type: z15.literal("sse"),
       url: z15.string().url(),
       headers: z15.record(z15.string(), z15.string()).optional(),
-      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // Header → the name of a `secretEnv` entry holding its value. Set by
       // the server on a room connection's entry, and by `resolveMcpSecrets` on a
       // header whose `${VAR}` it resolved.
       headersFromEnv: z15.record(z15.string(), z15.string()).optional()
@@ -7693,9 +7459,8 @@ var init_run_config = __esm({
     ]);
     effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
     runConfigSchema = z15.object({
-      // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
-      // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
-      // is the locked surface. Kept in lockstep with `@cabane/shared`'s
+      // `true` grants the host filesystem/shell; absent is the locked surface. Kept
+      // in lockstep with `@cabane/shared`'s
       // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
       // stripped, so an older companion riding a newer server never rejects the config).
       hostAccess: z15.boolean().optional(),
@@ -7786,7 +7551,7 @@ var init_protocol = __esm({
       dispatch: "CABANE_DISPATCH",
       // The turn id the launcher resolved, and whether this is a replay of a turn
       // an earlier process started. The seq floor for a replay is derived inside
-      // the turn from the outbox and the server, as it always was.
+      // the turn from the outbox and the server.
       turnId: "CABANE_TURN_ID",
       resumed: "CABANE_RESUMED",
       // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
@@ -7822,10 +7587,10 @@ var init_protocol = __esm({
       // Whether the harness starts under the OS sandbox. The launcher sends 'os'
       // only when this host can make one.
       sandbox: z16.enum(["os", "none"]),
-      // CT1684: the device's sandbox policy, validated by the launcher. Absent
+      // The device's sandbox policy, validated by the launcher. Absent
       // when the sandbox is off.
       sandboxPolicy: sandboxPolicySchema.optional(),
-      // CT1691: every companion store the launcher's latest walk found, denied
+      // Every companion store the launcher's latest walk found, denied
       // to the harness. Absent when the sandbox is off.
       companionStores: z16.array(z16.string()).optional(),
       logLevel: z16.string(),
@@ -7834,15 +7599,15 @@ var init_protocol = __esm({
       // True when this (conversation, agent) pair was already told its session
       // could not be saved: the notice is once per pair, not once per process.
       sessionWriteNoticeClaimed: z16.boolean(),
-      // CT1680: the runner's identity, minted with its credential. The start
+      // The runner's identity, minted with its credential. The start
       // PATCH carries it so the lease knows which runner holds the span.
       runnerId: z16.string(),
-      // CT1681: the launcher keeps the runtime's session files beside the attempt
+      // The launcher keeps the runtime's session files beside the attempt
       // and restores them into this runner's home, so the runner names the attempt
       // each context was composed for and waits for the launcher to say it's in
       // place. Absent: nothing to wait for (a runner on the launcher's own disk).
       attemptState: z16.boolean().optional(),
-      // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
+      // MCP `${NAME}` secrets come from the launcher, by name, instead of
       // this machine's secrets.json. Absent: the runner reads the device's file.
       secretsFromLauncher: z16.boolean().optional()
     });
@@ -8431,7 +8196,7 @@ function createTurnControlMcpServer(acts, skipState) {
           return performAct(acts, {
             kind: "ask",
             callId: randomUUID2(),
-            // CT1350: the swap rides the ask, so the server commits both halves
+            // The swap rides the ask, so the server commits both halves
             // in one transaction — the person never sees neither or both.
             ...args.replaces ? { replaces: args.replaces } : {},
             ask: hasArray ? {
@@ -8482,7 +8247,7 @@ function createTurnControlMcpServer(acts, skipState) {
         },
         { annotations: ACT_TOOL, alwaysLoad: true }
       ),
-      // CT1350: the standalone withdrawal. Not annotated destructive — an ask
+      // The standalone withdrawal. Not annotated destructive — an ask
       // is a question, not data, and a harness that gated this on a live
       // operator would hang a turn nobody is watching (the `cancel_wake`
       // reasoning). Not idempotent either: a second call with the same id is
@@ -8501,7 +8266,7 @@ function createTurnControlMcpServer(acts, skipState) {
         }),
         { annotations: ACT_TOOL, alwaysLoad: true }
       ),
-      // CT990: the inverse. No arguments — it can only ever stand down the
+      // The inverse. No arguments — it can only ever stand down the
       // caller's own wake in the conversation it's holding a turn in.
       tool(
         CANCEL_WAKE_TOOL,
@@ -8566,7 +8331,7 @@ function buildCompanionTurnRequest(params) {
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
       ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
-      // CT289: the auto-memory escape hatch, when the operator set it.
+      // The auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
     // Host-injected turn-control tools, under their own namespace.
@@ -8889,7 +8654,7 @@ var init_transcript_writer = __esm({
         }
         this.line({ type: "_meta", ...meta });
       }
-      // Append a raw SDK message verbatim.
+      // Append one event verbatim.
       write(msg) {
         this.line(msg);
       }
@@ -8897,7 +8662,7 @@ var init_transcript_writer = __esm({
       close(outcome) {
         this.line({ type: "_outcome", ...outcome });
       }
-      // CT1145: keep an independent copy of an empty successful envelope after the
+      // Keep an independent copy of an empty successful envelope after the
       // footer has landed. The ordinary 200-file FIFO keeps rotating as before;
       // this bucket retains the newest 50 anomalies regardless of ordinary traffic.
       // Best-effort like every other transcript operation: observability can never
@@ -8973,6 +8738,8 @@ var init_turn_committer = __esm({
             summary,
             input,
             result,
+            inputChars,
+            resultChars,
             mcpServer,
             phase,
             seq
@@ -8988,6 +8755,8 @@ var init_turn_committer = __esm({
                 summary,
                 input,
                 result,
+                ...inputChars !== void 0 ? { inputChars } : {},
+                ...resultChars !== void 0 ? { resultChars } : {},
                 mcpServer,
                 phase,
                 seq,
@@ -9029,12 +8798,9 @@ var init_turn_committer = __esm({
       // Renders each `TurnEvent` onto the pump's callback sink (tool-log truncation),
       // routing a throwing commit to `onError`.
       emit;
-      // CT261: route one `TurnEvent` from the adapter. `text` / `tool` / `thinking`
-      // flow through the pump (rendered + committed); `session` / `result` are the
-      // dispatcher's concern and ignored here. A throwing commit (a flaky/4xx HTTP
-      // POST) is routed to the error hook and swallowed — a failed commit is
-      // warn-only and must never fail the turn (the role the classification's
-      // `safeEmit` used to play before the adapter owned the decode).
+      // `text` / `tool` / `thinking` flow through the pump; `session` / `result` are
+      // the dispatcher's and ignored here. A throwing commit is routed to the error
+      // hook and swallowed: a failed commit must never fail the turn.
       async ingestEvent(event) {
         if (event.type === "session" || event.type === "result") return;
         try {
@@ -9261,18 +9027,15 @@ var init_turn_execution = __esm({
       turnLog;
       abortController = new AbortController();
       outcome = initialOutcome();
-      // CT1503: this turn's shell containment, once the claude-code adapter is built.
-      // Null before that and on a turn that never reached adapter construction — a
-      // startup failure has nothing to reap, and reaping is a no-op rather than a
-      // special case.
+      // This turn's shell containment, once the claude-code adapter is built. Null
+      // before that, so a startup failure's reap is a no-op.
       containment = null;
       seqCounter = 0;
-      // CT11: per-turn monotonic counter mirroring the in-process dispatcher's.
-      //
-      // CT1380: 0 for a NEW turn only — a resume is seeded in `fetchContext` first.
+      // Per-turn monotonic seq. Starts at 0 for a NEW turn only; a resume is seeded
+      // in `fetchContext` first.
       nextSeq = () => ++this.seqCounter;
-      // CT1380: a REPLAY, told to us by the supervisor — not derivable here, since
-      // `turnId` is set on every dispatch. `resumedFromSeq` is what it seeded from.
+      // A REPLAY, told to us by the supervisor — not derivable here, since `turnId`
+      // is set on every dispatch. `resumedFromSeq` is what it seeded from.
       resumed;
       resumedFromSeq;
       // Whether the span this resumed run continues already has first words —
@@ -9280,8 +9043,8 @@ var init_turn_execution = __esm({
       resumedSpoke = false;
       turnContext;
       resolvedMcpServers;
-      // CT1698: the harness's secret environment for this turn. Only ever handed
-      // to the adapter; never logged, never merged into `process.env`.
+      // The harness's secret environment for this turn. Only ever handed to the
+      // adapter; never logged, never merged into `process.env`.
       secretEnv = {};
       effectiveCwd;
       hookEnv;
@@ -9295,19 +9058,15 @@ var init_turn_execution = __esm({
       turnControlIntentFetched = false;
       applyRecordedTurnControlIntent = async () => {
       };
-      // CT1292: the committer is built before the lease watchdog arms, so the
-      // failed-commit hint reaches it through this slot. Safe as a no-op until the
-      // watchdog replaces it — the committer only fires it from inside the adapter
-      // loop, which runs after.
+      // The committer is built before the lease watchdog arms, so the failed-commit
+      // hint reaches it through this slot. A no-op until then is safe: the committer
+      // only fires it from inside the adapter loop, which runs after.
       noteCommitFailed = () => {
       };
       disarmWatchdogs = () => {
       };
-      // CT1503: reap this turn's shell containment. Idempotent (the containment drops
-      // what it has already stopped) and total — a reap that fails is reported and
-      // swallowed, because a turn that produced a good answer must not be recorded as
-      // failed on account of a leftover process, and the failure is visible in the log
-      // either way.
+      // Idempotent, and a failed reap is logged and swallowed: a turn that produced a
+      // good answer must not be recorded as failed on account of a leftover process.
       async reapContainment() {
         const containment = this.containment;
         if (!containment) return;
@@ -9333,20 +9092,18 @@ var init_turn_execution = __esm({
           );
         }
       }
-      // Codo's stack review, blocking finding #2: set the moment `acquireLease`'s
-      // PATCH returns — the lease is granted and this is the pair's running span,
-      // so every exit after this point must settle THE SPAN, not just clear the
+      // Set the moment `acquireLease`'s PATCH returns: this is the pair's running
+      // span, so every exit after this must settle THE SPAN, not just clear the
       // participant flag.
       admitted = false;
-      // Rooms: one recompose per turn when the lease refuses a stale context.
+      // One recompose per turn when the lease refuses a stale context.
       recomposedForLease = false;
-      // CT1677: the execution source the CURRENT context was adopted as. Reassigned
-      // when a `dispatch_context_stale` recompose adopts a replacement, so a piece of
-      // work — preparation, the committer, a notice — captures it when that work
-      // begins and never reads it again: earlier work keeps its source. Undefined
-      // only before the first adoption; no work runs until it is set.
+      // The execution source the CURRENT context was adopted as. A
+      // `dispatch_context_stale` recompose reassigns it, so each piece of work
+      // (preparation, the committer, a notice) captures it when it begins and keeps
+      // that source. No work runs before it is set.
       executionSourceId;
-      // CT1677: one fresh fetch per turn when adoption is refused.
+      // One fresh fetch per turn when adoption is refused.
       refetchedForAdoption = false;
       concluded(reason, errorReason) {
         return new TurnConcluded(reason, errorReason);
@@ -9414,21 +9171,18 @@ var init_turn_execution = __esm({
         this.supervisor.notifyEnd({ id: payload.messageId, ok: false, durationMs, reason });
         return { ok: false, durationMs, reason, runtime: this.turnContext?.runtime };
       }
-      // The post-admission analogue of `concludeBeforeRun` (Codo's stack review,
-      // blocking finding #2): this turn WAS admitted — it holds the conversation's
-      // lease — so the clear must NAME the turn and DECLARE its terminal outcome.
-      // A bare pre-run clear here would reset the participant flag while the span
-      // stayed running until the lost sweep. `outcome` follows the settle wire's
-      // rule: a failure names its reason; without one the turn settled — the
-      // runtime-unavailable exit posts its user-facing `final` before concluding,
-      // so the turn genuinely produced its terminal output.
+      // The admitted turn holds the conversation's lease, so the clear must NAME the
+      // turn and DECLARE its outcome; a bare clear resets the participant flag and
+      // leaves the span running until the lost sweep. A failure names its reason;
+      // without one the turn settled (the runtime-unavailable exit has already posted
+      // its `final`).
       async concludeAdmittedRun(reason, errorReason) {
         const { payload, turnLog, startedAt, turnId } = this;
         const body = {
           activeRunStartedAt: null,
           turnId,
-          // CT1379: `runtimeIncomplete` is a real failure that deliberately carries
-          // no `errorReason`, so the inference alone would read it as settled.
+          // `runtimeIncomplete` is a real failure that deliberately carries no
+          // `errorReason`, so the inference alone would read it as settled.
           outcome: errorReason || this.outcome.runtimeIncomplete ? "failed" : "settled"
         };
         if (errorReason) body.errorReason = errorReason.slice(0, 200);
@@ -9522,11 +9276,10 @@ var init_turn_execution = __esm({
           throw this.concluded(reason, reason);
         }
       }
-      // CT1677: register this context's issuance as the execution source of the
-      // work about to run on it. A context with no issuance has nothing to adopt,
-      // and that ends the turn exactly as a failed adoption does: this companion
-      // never commits a row whose provenance it cannot name. Only a refusal —
-      // nothing to adopt any more — earns a fresh fetch.
+      // Register this context's issuance as the execution source of the work about to
+      // run on it. No issuance ends the turn as a failed adoption does: this companion
+      // never commits a row whose provenance it cannot name. Only a refusal earns a
+      // fresh fetch.
       async adoptSource(context) {
         const { payload, turnId, turnLog } = this;
         if (!context.issuanceId) {
@@ -9575,9 +9328,8 @@ var init_turn_execution = __esm({
           secretEnv,
           missing
         } = resolveMcpSecrets(
-          // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-          // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
-          // the room connections' entries, whose values arrive in `secretEnv`.
+          // User MCP definitions in placeholder form, plus the room connections'
+          // entries, whose values arrive in `secretEnv`.
           this.turnContext.mcpServers ?? {},
           secretStore,
           this.turnContext.secretEnv
@@ -9690,15 +9442,12 @@ var init_turn_execution = __esm({
                   agentUsername: this.opts.agentUsername,
                   runtime: this.turnContext.runtime,
                   hostAccess: this.turnContext.policy.hostFs,
-                  // CT317/CT319: the trigger message's referenced-entry paths — what the
-                  // tasker prepare hook keys its per-task env off. Defaults to `[]` for
-                  // an older API. The conversation anchor is gone (CT319).
+                  // The trigger message's referenced-entry paths, which a prepare hook
+                  // may key its per-task env off. `[]` from an older API.
                   triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
                   title: this.turnContext.conversation.title,
-                  // CT943: the dispatching message's text — where an `env:` directive
-                  // rides. The server has always sent the trigger body on the turn
-                  // context (for the live feed); this is the first thing to read it as
-                  // an INPUT, so a dispatch can ask for its environment in words.
+                  // Where an `env:` directive rides, so a dispatch can ask for its
+                  // environment in words.
                   messageBody: this.turnContext.message.body
                 },
                 { turnId, deviceId: this.opts.deviceId },
@@ -9744,37 +9493,30 @@ var init_turn_execution = __esm({
             payload.agentId,
             {
               activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              // CT1679: a runner leases under its launcher's boot id — the one the
-              // device heartbeats — or the lost-run sweep reads it as a restart.
+              // A runner leases under its launcher's boot id, the one the device
+              // heartbeats, or the lost-run sweep reads it as a restart.
               bootId: this.opts.inRunner?.bootId ?? bootId,
-              // CT1680: the runner holding the span, beside the device's boot id.
               ...this.opts.inRunner ? { runnerId: this.opts.inRunner.runnerId } : {},
-              // CT1380: the durable record that this turn resumed, and from where.
+              // The durable record that this turn resumed, and from where.
               ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
-              // CT1454: the issuance the context THIS attempt runs on came from. Read
-              // off `this.turnContext`, which is the fetch that composed this request —
-              // so a retransmitted start echoes the same id and reuses the same record,
-              // and a resumed attempt echoes its own, newer one. The post-admission
-              // fresh-session recompose (`freshRequest`) deliberately does not touch it:
-              // it adopts only the prompt, never the run-config, so its issuance must
-              // not become this attempt's evidence.
+              // The issuance of the fetch that composed this request, so a
+              // retransmitted start reuses the same record and a resumed attempt
+              // echoes its own. `freshRequest` deliberately leaves it alone: it adopts
+              // only the prompt, never the run-config.
               ...this.turnContext.issuanceId ? { issuanceId: this.turnContext.issuanceId } : {},
-              // CT33: hand the server this turn's id so the new-run chokepoint's
-              // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
-              // already emitted a "preparing" activity row for this turn above (it
-              // runs before this flip), which would otherwise make the sweep mistake
-              // this live turn for an abandoned one and close it with a `stopped`.
+              // So `closeAbandonedTurns` excludes this turn: a "preparing" row emitted
+              // before this flip would otherwise read as abandoned and be stopped.
               turnId,
               // The newest message this turn's read covered: the lease records it,
               // and settle moves the cursor to it. Omitted when the server sent
               // none (an older API), so the cursor stays where it was.
               ...this.turnContext.readThrough !== void 0 ? { readThrough: this.turnContext.readThrough } : {},
               ...this.turnContext.readRevision !== void 0 ? { readRevision: this.turnContext.readRevision } : {},
-              // Rooms: the attempt this request's session belongs to (null = fresh).
+              // The attempt this request's session belongs to (null = fresh).
               ...this.turnContext.attemptId !== void 0 ? { attemptId: this.turnContext.attemptId } : {},
-              // CT1543: the frame this start acts on. The turn-context fetch already
-              // checked it, but that was before an assembly this turn awaited — the
-              // lease checks it again where the stamp is actually taken.
+              // The frame this start acts on. The context fetch checked it before an
+              // assembly this turn awaited; the lease re-checks where the stamp is
+              // taken.
               ...payload.episode !== void 0 ? { dispatchMessageId: payload.messageId, dispatchEpisode: payload.episode } : {}
             }
           );
@@ -9814,21 +9556,18 @@ var init_turn_execution = __esm({
         this.request = buildCompanionTurnRequest({
           turnContext: this.turnContext,
           baseUrl: this.opts.baseUrl,
-          // ACC8: always present; `fetchTurnContext` refused a context without one.
+          // Always present: `fetchContext` refuses a context without one.
           turnToken: this.turnContext.turnToken,
-          // SJ524: the hook-resolved cwd overrides the static local cwd.
           ...this.effectiveCwd ? { cwd: this.effectiveCwd } : {},
-          // CT1103: the prepare-hook env plus the authoritative host-access token.
           env: this.turnEnv,
           mcpServers: this.resolvedMcpServers,
           secretEnv: this.secretEnv,
           turnControlServer,
-          // CT238: this turn's conversation, forwarded as the active-conversation
-          // header so a cross-thread post/spawn stamps its origin.
+          // Sent as the active-conversation header so a cross-conversation post
+          // stamps its origin.
           activeConversationId: payload.conversationId,
-          // Workspace coordinate retained in the compatible TurnRequest envelope.
           workspaceId,
-          // CT289: the operator's auto-memory escape hatch (machine-local), when set.
+          // The operator's machine-local auto-memory escape hatch, when set.
           ...this.opts.local.claudeCode ? { claudeCode: this.opts.local.claudeCode } : {}
         });
       }
@@ -9865,8 +9604,8 @@ var init_turn_execution = __esm({
         if (this.opts.claudeCodeAvailable?.() ?? true) {
           this.containment = createTurnContainment(this.turnId, {
             log: (msg, meta) => turnLog.debug(meta ?? {}, msg),
-            // CT1679: a group outside the runner's own is reported, so a launcher
-            // can stop it if the runner dies without reaping it.
+            // A group outside the runner's own is reported, so a launcher can stop
+            // it if the runner dies without reaping it.
             ...this.opts.inRunner?.onProcessGroup ? { onProcessGroup: this.opts.inRunner.onProcessGroup } : {}
           });
           const containment = this.containment;
@@ -9887,8 +9626,8 @@ var init_turn_execution = __esm({
           const serverUrl = this.opts.opencodeServerUrl;
           adapters.push(
             createOpencodeAdapter(
-              // CT1679: the transport's per-server turn mutex is per process; in a
-              // runner the turn also holds the device-wide lock every runner shares.
+              // The transport's per-server turn mutex is per process; in a runner the
+              // turn also holds the device-wide lock every runner shares.
               this.opts.inRunner ? {
                 transport: this.opts.inRunner.opencodeTransport(serverUrl),
                 onWarn
@@ -9935,7 +9674,7 @@ var init_turn_execution = __esm({
               kind: "runtime_notice",
               turnId,
               parentMessageId: payload.messageId,
-              // CT1677: the notice is written by this attempt's source, like its speech.
+              // Written by this attempt's source, like its speech.
               ...this.executionSourceId !== void 0 ? { executionSourceId: this.executionSourceId } : {}
             });
           } catch (postErr) {
@@ -9949,16 +9688,13 @@ var init_turn_execution = __esm({
           throw this.concluded(`runtime_unavailable:${err.runtime}`);
         }
       }
-      // The adapter refused to resume this pair's stored session and is starting a
-      // fresh one. The request it holds was composed for a session that had the
-      // conversation so far — the read is what landed since the cursor, the
-      // agent's own words left out because the session held them. A fresh session
-      // holds none of it, so fetch the context again as a first turn on an empty
-      // session (the whole conversation, own words included, the first-turn
-      // material) and hand the adapter that to run on — before it speaks or acts.
-      // The lease already granted stands; the read reaches at least its mark. A
-      // fetch that fails returns null and the adapter falls back to the request
-      // it has, flagged degraded, so the server rewinds the cursor at settle.
+      // The adapter refused to resume the stored session and is starting fresh. The
+      // request it holds assumed the session had the conversation so far (only what
+      // landed since the cursor, the agent's own words left out); a fresh session
+      // has none of it. So refetch as a first turn on an empty session and hand the
+      // adapter that, before it speaks or acts. The granted lease stands. A failed
+      // fetch returns null: the adapter runs the request it has, flagged degraded,
+      // and the server rewinds the cursor at settle.
       async freshRequest(reason) {
         const { payload, turnId, turnLog } = this;
         try {
@@ -9969,9 +9705,8 @@ var init_turn_execution = __esm({
             false,
             true,
             void 0,
-            // CT1657: the turn's abort. This recompose happens mid-run with the
-            // adapter waiting on it, so a Stop here must end the wait rather than
-            // hold the turn open for the rest of the retry schedule.
+            // The adapter is waiting on this, so a Stop must end the wait rather
+            // than hold the turn open for the rest of the retry schedule.
             this.abortController.signal
           );
           turnLog.debug(
@@ -10023,19 +9758,17 @@ var init_turn_execution = __esm({
           conversationId: payload.conversationId,
           agentId: payload.agentId,
           turnId,
-          // CT113: the message this turn answers — passed back on every commit so
-          // the reply records the Q→A edge the in-process dispatcher stamps directly.
+          // The message this turn answers, on every commit so the reply records the
+          // Q→A edge.
           parentMessageId: payload.messageId,
           signal: abortController.signal,
           log: turnLog,
           nextSeq: this.nextSeq,
           spoke: this.resumedSpoke,
-          // CT1677: admitted by now, so this is the source the model's work runs on.
+          // Admitted by now, so this is the source the model's work runs on.
           ...this.executionSourceId !== void 0 ? { executionSourceId: this.executionSourceId } : {},
-          // CT1292: a commit that didn't land may mean this turn's lease is gone.
-          // `noteCommitFailed` is a field slot the lease watchdog fills when it
-          // arms (it starts as a no-op) — the committer only fires it from inside
-          // the adapter loop, which runs after the watchdog has replaced it.
+          // A commit that didn't land may mean the lease is gone; see
+          // `noteCommitFailed`.
           onCommitFailed: (err) => this.noteCommitFailed(err)
         });
         const usesHttpTurnControl = turnRuntime === "codex" || turnRuntime === "opencode";
@@ -10139,9 +9872,9 @@ var init_turn_execution = __esm({
                     workspaceId,
                     payload.conversationId,
                     payload.agentId,
-                    // CT1680: named for its turn, which a runner credential
-                    // requires once its start is admitted; the server then binds
-                    // the capture to that turn's attempt rather than the pair's.
+                    // Named for its turn, which a runner credential requires once
+                    // admitted; the server binds the capture to that turn's attempt
+                    // rather than the pair's.
                     { agentSessionId: event.state, turnId }
                   );
                 } catch (err) {
@@ -10246,9 +9979,7 @@ var init_turn_execution = __esm({
           }
           const body = {
             activeRunStartedAt: null,
-            // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
-            // off this turn id, so the settle PATCH must carry it — the start PATCH
-            // isn't enough. Always sent (every settle closes a real turn).
+            // The server keys the turn-end metadata (ended_at, tokens) off this id.
             turnId
           };
           if (o.turnUsage) {
@@ -10417,11 +10148,11 @@ var init_dispatcher = __esm({
         this.aborts = opts.aborts ?? /* @__PURE__ */ new Map();
       }
       opts;
-      // CT1288: keyed (conversation|agent) → per-TURN controllers. Stop is
-      // pair-scoped and must reach every live loop for the pair.
+      // (conversation|agent) → per-TURN controllers. Stop is pair-scoped and must
+      // reach every live loop for the pair.
       aborts;
-      // CT1109: pairs already told "your session couldn't be saved" — the notice is
-      // once per (conversation, agent), while the rejection repeats every turn.
+      // Pairs already told their session couldn't be saved: the notice is once per
+      // pair, while the rejection repeats every turn.
       sessionWriteNotified = /* @__PURE__ */ new Set();
       notifyStart(info) {
         try {
@@ -10438,11 +10169,6 @@ var init_dispatcher = __esm({
       // The supervisor supplies a stable turnId on both fresh and resumed dispatch.
       // resumed is separate: only replay seeds sequence/speech recovery from the
       // prior span. A direct caller omitting turnId gets a fresh id.
-      //
-      // CT1261: a short `handle` creates a `TurnExecution` and runs it. The
-      // supervisor seam hands the execution exactly the three cross-turn duties —
-      // the abort registry, the session-write notice latch, the observer — and
-      // nothing else.
       async handle(payload, opts = {}) {
         const key = runKey(payload.conversationId, payload.agentId);
         const supervisor = {
@@ -10488,8 +10214,8 @@ var init_dispatcher = __esm({
         }
         return new TurnExecution(this.opts, supervisor, payload, opts).run();
       }
-      // SJ383: cancel a specific (conversation, agent) run if one is in flight in
-      // THIS companion process. Returns true if an in-flight run was aborted.
+      // Cancel a (conversation, agent) run in flight in THIS process. True if one
+      // was aborted.
       cancel(conversationId, agentId) {
         const key = runKey(conversationId, agentId);
         const pair2 = this.aborts.get(key);
@@ -11212,7 +10938,7 @@ var init_outbox = __esm({
       }
       workspaceId;
       log;
-      // Resolved lazily (per call, like cursor.ts) so tests that swap HOME between
+      // Resolved lazily (per call) so tests that swap HOME between
       // cases route writes at the right tmpdir.
       dir() {
         return join20(runnerStateDir(), "outbox", encodeURIComponent(this.workspaceId));
@@ -11278,7 +11004,7 @@ var init_outbox = __esm({
         );
         return entries;
       }
-      // CT1380: the highest `seq` this turn has queued but not yet delivered — the
+      // The highest `seq` this turn has queued but not yet delivered — the
       // half of a resumed turn's seq floor the SERVER CANNOT SEE. A commit that
       // failed transiently before the crash is sitting in this directory with its
       // seq already spent, and the restart's drain is fire-and-forget
@@ -12091,9 +11817,8 @@ function parseHarnessRuntime(raw) {
 function deriveHarnessSnapshot(signals) {
   const advertised = new Set(
     buildCompanionManifest({
-      // CT1082 + CT1379: connected AND the bundled binary the SDK launches is
-      // there — the manifest's own rule, restated here through the same function
-      // rather than re-decided. PATH is deliberately absent from both gates now.
+      // Connected AND the bundled binary present: the manifest's own rule. PATH
+      // is deliberately in neither gate.
       claudeCode: signals.claudeCodeConnected && signals.claudeBundled === "present",
       opencode: signals.opencodeConfigured,
       codex: signals.codexEnabled && signals.codexBundled === "present"
@@ -12131,10 +11856,8 @@ function deriveClaudeCode(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.claudeVersion,
-      // CT1379: connecting records INTENT; it is not the same as becoming
-      // runnable. With the bundled binary missing, a connect succeeds and the
-      // device still advertises nothing — so this says so up front rather than
-      // promising routing it can't deliver.
+      // Connecting records INTENT, not runnability: with the bundled binary
+      // missing a connect succeeds and nothing is advertised, so say so.
       detail: signals.claudeBundled === "present" ? "Claude Code is installed here but not connected yet. Connect it to offer Claude Code from this device." : `Claude Code is installed here but not connected yet \u2014 and @cabane/companion's bundled Claude Code ${missingNoun(signals.claudeBundled)} is missing, so connecting alone won't make it runnable. ${repairAction()}`,
       enable: "claude-code"
     };
@@ -12172,8 +11895,7 @@ function deriveCodex(signals, manifestHas) {
       ...base,
       state: "detected_not_exposed",
       version: signals.codexVersion,
-      // CT1379: same distinction as Claude Code — enabling is intent, not
-      // launchability.
+      // As for Claude Code: enabling is intent, not launchability.
       detail: signals.codexBundled === "present" ? "Codex is installed but not enabled yet. Turn it on to offer Codex from this device." : `Codex is installed but not enabled yet \u2014 and @cabane/companion's bundled Codex ${missingNoun(signals.codexBundled)} is missing, so enabling alone won't make it runnable. ${repairAction()}`,
       enable: "codex"
     };
@@ -12254,12 +11976,10 @@ async function probeHarnessSignals(cfg, deps = {}) {
   return {
     claudeOnPath: claudePresence.status === "present",
     claudeVersion,
-    // CT1082: the user's opt-in. Presence alone exposes nothing now, so this is
-    // the manifest gate and the probe above is only a suggestion.
+    // The user's opt-in, the manifest gate; the probe above only suggests.
     claudeCodeConnected: isClaudeCodeConnected(cfg),
-    // CT1379: the executable a Claude turn actually launches. Resolved every time
-    // the signals are, so a binary that disappears between beats is caught on the
-    // next one rather than at turn time.
+    // The executable a Claude turn launches, resolved with every probe so a
+    // binary that disappears is caught on the next beat, not at turn time.
     claudeBundled: resolveBundled("claude-code").status,
     codexBundled: resolveBundled("codex").status,
     // A parseable `codex --version` is our presence signal (presence alone never
@@ -12268,7 +11988,7 @@ async function probeHarnessSignals(cfg, deps = {}) {
     codexVersion,
     codexEnabled: isCodexEnabled(cfg),
     opencodeConfigured: !!configuredServerUrl,
-    // A version came back ⟺ the serve answered its health endpoint (CT584).
+    // A version came back ⟺ the serve answered its health endpoint.
     opencodeReachable: opencodeVersion !== null,
     opencodeVersion,
     opencodeDetectedUrl: opencodeVersion !== null ? opencodeProbeUrl : null
@@ -12837,13 +12557,11 @@ function resolvePairBaseUrl(server) {
 function writePairedConfig(paired) {
   const { local, note, hadPriorConfig } = loadConfigTolerant();
   const config = {
-    // CT1082: a device pairs connected to NOTHING — `claudeCode: { enabled: false }`
-    // written explicitly, not left absent, because absence is exactly what marks a
-    // pre-CT1082 config for the grandfathering migration. Omit it and a brand-new
-    // device gets auto-connected on its first start by the behaviour this task
-    // removes; stamp it on a RE-pair and an upgrading user's working device gets
-    // disconnected instead. So it's written only when there was no config here
-    // before. `local` spreads after, so a re-pair keeps the answer already given.
+    // A device pairs connected to NOTHING: `claudeCode: { enabled: false }`
+    // written explicitly, since absence is what the harness migration reads.
+    // Omitted, a new device is auto-connected on first start; stamped on a
+    // RE-pair, an upgrading user's working device is disconnected. So only when
+    // there was no config before; `local` spreads after, keeping a prior answer.
     ...hadPriorConfig ? {} : { claudeCode: { enabled: false } },
     ...local,
     baseUrl: paired.baseUrl,
@@ -13151,7 +12869,7 @@ var CompanionStateHub = class {
   deviceId = null;
   deviceLabel = null;
   deviceError = null;
-  // CT586: the latest harness snapshot the supervisor probed, or null before the
+  // The latest harness snapshot the supervisor probed, or null before the
   // first probe (see CompanionStatusJson.harnesses).
   harnesses = null;
   // ---- subscription (SSE) ----
@@ -13178,7 +12896,7 @@ var CompanionStateHub = class {
     this.deviceError = null;
     this.emitStatus();
   }
-  // ---- harnesses (CT586) ----
+  // ---- harnesses ----
   // Replace the harness snapshot and push a status change (so the SSE feed flips
   // the Companion's Harnesses surface live). The supervisor calls this on each
   // heartbeat-cadence probe and on an on-demand recheck.
@@ -13796,7 +13514,7 @@ var DeviceApi = class {
       AbortSignal.timeout(5e3)
     );
   }
-  // CT1146: report that a dispatch addressed to THIS device can't be run, because
+  // Report that a dispatch addressed to THIS device can't be run, because
   // the agent isn't one this device runs (and still wasn't after a forced
   // assignments refresh). The server clears the Working flag, retires the dispatch
   // and posts an explanatory system message.
@@ -13810,7 +13528,7 @@ var DeviceApi = class {
     return this.request("POST", "/api/companion/dispatch-drop", body);
   }
   // Per-device liveness ping. Reports the companion build version and the env-var
-  // names the operator's secret store exposes (never values), so CT30's UI can
+  // names the operator's secret store exposes (never values), so the UI can
   // warn pre-emptively about an agent that needs a secret this device lacks.
   heartbeat(body) {
     return this.request("POST", "/api/companion/heartbeat", body ?? {});
@@ -13993,7 +13711,7 @@ var ConnectorHealthStore = class {
       lastError: outcome.errorReason ?? null
     });
   }
-  // CT639: the store's current opinion for one runtime, or undefined when it has
+  // The store's current opinion for one runtime, or undefined when it has
   // no observation. Read by the dispatcher at idle-timeout fire: an idle reap
   // while this runtime is definitively `limited` (a present, future `limitedUntil`
   // recorded by a sibling/earlier turn's classified cap settle) is the account cap
@@ -15574,24 +15292,20 @@ var CompanionSupervisor = class {
   config;
   log;
   hub;
-  // CT1379: the bundled-executable resolver — the execution-presence half of both
-  // routing gates. Synchronous and cheap (a module resolve plus a stat), so unlike
-  // the CLI probes it needs no boot-frozen fallback: a caller that asks before the
-  // first harness refresh simply resolves now.
+  // The execution-presence half of both routing gates. Synchronous and cheap (a
+  // module resolve plus a stat), so a caller before the first harness refresh
+  // simply resolves now.
   resolveBundled;
-  // CT1379: the last bundled status LOGGED per harness, so a missing binary is
-  // reported at startup and on each healthy↔missing transition rather than on
-  // every 30s beat (the CT484 latch pattern, per runtime).
+  // The last bundled status LOGGED per harness, so a missing binary is reported
+  // at startup and on each healthy↔missing transition, not every beat.
   loggedBundledStatus = /* @__PURE__ */ new Map();
-  // CT571: the probed per-harness versions, reported on each heartbeat manifest.
-  // CT586: no longer boot-frozen — the per-heartbeat harness re-probe refreshes
-  // it, so a harness updated mid-run reports its new version without a restart.
+  // Refreshed by the per-heartbeat re-probe, so a harness updated mid-run
+  // reports its new version without a restart.
   harnessVersions;
-  // CT586: the latest harness detection signals (presence + reachability), probed
-  // on the heartbeat cadence + on demand. Feeds BOTH the heartbeat manifest's
-  // live presence and the Companion's Harnesses surface off ONE source, so the UI
-  // can never disagree with what the manifest advertises. Null until the first
-  // probe (the heartbeat then falls back to the boot `claudeCode`).
+  // The latest harness signals (presence, reachability), probed on the heartbeat
+  // cadence and on demand. ONE source for both the manifest and the Harnesses
+  // surface, so the UI never disagrees with what is advertised. Null until the
+  // first probe.
   harnessSignals = null;
   // Fresh per attempt, never the cached heartbeat signal: installing a harness
   // between attempts must be observed immediately.
@@ -15604,8 +15318,8 @@ var CompanionSupervisor = class {
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
-  // ACC8: whether the device stream is open, which is what every workspace's
-  // link on the dashboard reports.
+  // Whether the device stream is open, which is what every workspace's link on
+  // the dashboard reports.
   deviceConnected = false;
   recoveryChecked = false;
   recovering = false;
@@ -15617,8 +15331,7 @@ var CompanionSupervisor = class {
   pollTimer = null;
   refreshing = false;
   stopped = false;
-  // CT484: latch so the companion/server version-skew warning is logged once, not
-  // on every 30s heartbeat.
+  // The version-skew warning is logged once, not every heartbeat.
   versionSkewWarned = false;
   // This device's id, captured from the heartbeat / assignments response. The SSE
   // router uses it to tell a dispatch addressed to THIS device (a freshly-assigned
@@ -15628,12 +15341,12 @@ var CompanionSupervisor = class {
   // The in-flight assignments pull, exposed so a caller that needs fresh data
   // (pull-on-miss) can `await` the running pull rather than racing past it.
   inFlightRefresh = null;
-  // CT566: device-global connector-health memory — every dispatcher records its
-  // turn's classified outcome here (per runtime); the heartbeat echoes it so the
-  // server's per-connector quota state survives a restart/race.
+  // Device-global connector-health memory: every dispatcher records its turn's
+  // classified outcome per runtime; the heartbeat echoes it so the server's
+  // quota state survives a restart or race.
   connectorHealth = new ConnectorHealthStore();
-  // ACC10: which dispatches this process is running, so the copy of a frame that
-  // arrives on the other stream doesn't run the turn a second time.
+  // Which dispatches this process is running, so a redelivered frame doesn't
+  // run the turn a second time.
   claims = new DispatchClaims();
   constructor(opts) {
     this.config = opts.config;
@@ -15654,10 +15367,10 @@ var CompanionSupervisor = class {
     }
     this.latchBootBundledState();
   }
-  // CT1681: what a runner container said it can run, probed once at start;
-  // null until then, and when no container could be started.
+  // What a runner container said it can run, probed once at start; null until
+  // then, and when no container could be started.
   runnerImage = null;
-  // CT1681: the companion every container mounts — this one's own install.
+  // The companion every container mounts: this one's own install.
   runnerCompanion() {
     return companionSource({
       configured: this.config.runners?.docker?.companionDir,
@@ -15769,10 +15482,7 @@ var CompanionSupervisor = class {
     this.pollTimer = setInterval(() => void this.refreshAssignments(), ASSIGNMENTS_POLL_MS);
     this.pollTimer.unref?.();
   }
-  // The set of SSE subscriber `finished` promises — start.ts awaits these to
-  // keep the foreground process alive. With the poll loop running there's always
-  // at least the loops keeping the event loop alive; the SSE promises let a
-  // clean teardown resolve.
+  // start.ts awaits these; they resolve on a clean teardown.
   finishedPromises() {
     return [...this.deviceSub ? [this.deviceSub.finished] : []];
   }
@@ -15800,39 +15510,26 @@ var CompanionSupervisor = class {
         bootId,
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
-        // Report each runtime only when this device can actually run it:
-        // CT1379 claude-code and codex when the SDK's own bundled binary is there
-        // and the user asked for the harness, CT270 opencode when the operator
-        // configured an `opencode serve`.
+        // Each runtime only when this device can actually run it.
         manifest: buildCompanionManifest({
-          // CT1082/CT1379: connected AND launchable. Execution presence is the
-          // live bundled-binary resolution (refreshed on this beat), consent is
-          // the user's `claudeCode.enabled`. Claude Code rides neither alone.
+          // Consented (`claudeCode.enabled`) AND launchable (the live bundled
+          // binary). Neither alone.
           claudeCode: this.claudeCodeOffered(),
           opencode: !!this.config.opencode?.serverUrl,
-          // CT481/CT1379: advertise codex when the operator enabled it AND its
-          // vendored binary is there. The enable flag alone used to be enough,
-          // which is how a device with a half-installed 331 MB platform package
-          // advertised a runtime that could not start.
+          // Enabled AND its vendored binary present: a half-installed 331 MB
+          // platform package otherwise advertises a runtime that cannot start.
           codex: this.codexOffered(),
-          // CT1379: and say WHY when an asked-for harness is absent from the list
-          // above. Diagnostic only — the server never routes on it — and always
+          // WHY an asked-for harness is absent above. Diagnostic only, and always
           // sent, so an empty array clears a previously reported issue.
           runtimeIssues: this.runtimeIssues(),
-          // CT571/CT586: each runtime's `version` from the latest harness probe
-          // (fail-soft to null). Informational only — the server matches on name.
+          // Informational only; the server matches on name.
           versions: this.harnessVersions,
-          // CT1681: shown on the device page.
+          // Shown on the device page.
           ...runnersEnabled(this.config) ? { runner: this.runnerManifest() } : {}
         }),
-        // CT566: echo the last classified credential state per runtime, when the
-        // companion has seen any. Omitted (undefined) until the first observed
-        // failure/heal, so a fresh companion's beat is unchanged and the server's
-        // manifest synthesis (status-less rows) still runs.
+        // Omitted until the first observed failure or heal, so the server's
+        // status-less manifest synthesis still runs for a fresh companion.
         ...connectorReports.length > 0 ? { connectors: connectorReports } : {},
-        // CT584: include enumerated models only when the probe SUCCEEDED (non-null).
-        // A null (probe failed / no opencode) omits the field, and the server then
-        // leaves this device's stored availability untouched.
         ...opencodeModels !== null ? { models: opencodeModels } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
@@ -15847,11 +15544,8 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // CT484: belt-and-suspenders beside shipping the companion in lockstep inside the
-  // artifact — if the server reports a build version that differs from this
-  // companion's, warn loudly (once). This is exactly the skew that bit the M1 walk:
-  // an npm-pinned companion lagging a from-develop server. The elimination (bundled
-  // companion) makes it match by construction; this catches a companion run out of band.
+  // Warn once when the server's build version differs from this companion's: an
+  // npm-pinned companion lagging the server is the usual cause of odd failures.
   checkVersionSkew(serverVersion) {
     if (this.versionSkewWarned) return;
     if (!serverVersion || serverVersion === COMPANION_VERSION) return;
@@ -16048,10 +15742,9 @@ var CompanionSupervisor = class {
       `Stopped running ${runner.displayName} (unassigned)`
     );
   }
-  // CT1379: can this machine LAUNCH the harness — is the SDK's own bundled
-  // executable there? Live (the per-beat re-resolve), falling back to resolving
-  // right now before the first refresh lands. Execution presence ONLY; consent is
-  // the caller's half.
+  // Can this machine LAUNCH the harness — is the SDK's bundled executable there?
+  // The per-beat result, or resolved now before the first refresh. Execution
+  // presence ONLY; consent is the caller's half.
   bundledStatus(runtime) {
     const cached2 = runtime === "codex" ? this.harnessSignals?.codexBundled : this.harnessSignals?.claudeBundled;
     return cached2 ?? this.resolveBundled(runtime).status;
@@ -16062,23 +15755,19 @@ var CompanionSupervisor = class {
   bundledResolution(runtime) {
     return this.resolveBundled(runtime);
   }
-  // CT1082/CT1379: does this device OFFER claude-code — connected by its user, and
-  // able to start the binary a turn runs? The ONE signal both the heartbeat
-  // manifest and the dispatcher's adapter registry read, so what the device
-  // advertises and what it can select can't disagree (the CT833 invariant, with
-  // consent in front of it and the real executable underneath it).
+  // Does this device OFFER claude-code — connected by its user, and able to start
+  // the binary a turn runs? The ONE signal both the heartbeat manifest and the
+  // adapter registry read, so what the device advertises and what it can select
+  // can't disagree.
   claudeCodeOffered() {
     return isClaudeCodeConnected(this.config) && this.bundledStatus("claude-code") === "present";
   }
-  // CT1379: and the same question for codex, which until now was the enable flag
-  // alone — so an enabled device with no vendored binary advertised a runtime it
-  // could not start. Same shape as Claude Code, same predicate on both sides.
+  // The same question for codex: enabled AND its vendored binary present.
   codexOffered() {
     return isCodexEnabled(this.config) && this.bundledStatus("codex") === "present";
   }
-  // CT1379: the manifest's diagnostic half, derived from the same two facts as the
-  // two predicates above so an issue and an advertisement can never both be made
-  // for one harness.
+  // Derived from the same two facts as the predicates above, so an issue and an
+  // advertisement are never both made for one harness.
   runtimeIssues() {
     return runtimeIssuesFor({
       claudeCode: {
@@ -16088,26 +15777,16 @@ var CompanionSupervisor = class {
       codex: { intended: isCodexEnabled(this.config), bundled: this.bundledStatus("codex") }
     });
   }
-  // CT1379: a missing binary is reported ONCE, and again only when the answer
-  // CHANGES — with the runtime, the platform/architecture and the resolution
-  // result, which is enough to find the occurrence in `companion.log` without a
-  // repro and carries nothing that could be a credential or a vendor's output.
-  //
-  // Two things this deliberately does NOT do (Codo's review, blocking finding #2):
+  // A missing binary is reported ONCE, and again only when the answer CHANGES,
+  // with runtime, platform/arch and status: enough to find it in `companion.log`
+  // without a repro, and nothing that could be a credential or vendor output.
   //
-  //   - It does not re-announce the state the device booted in. `warnAboutHarnessReadiness`
-  //     already said that on stderr at startup, in the specified words, at the one
-  //     moment a person is watching a terminal — and the `--daemon` launcher runs
-  //     that preflight in the FOREGROUND for exactly that reason, because the
-  //     child's output goes to a file. The boot state is latched in the
-  //     constructor, so the first refresh reports nothing new; it lands here as a
-  //     debug record instead, present for diagnosis without competing for
-  //     attention with the warning the operator already read.
-  //   - It does not report a transition in generic prose. A binary that goes
-  //     missing at 3am is the case the operator will actually meet, and a line
-  //     that says only "binary is missing" leaves them with no repair and no
-  //     restart instruction. Transitions carry the specified copy verbatim — the
-  //     same sentence the startup path prints.
+  //   - The boot state is not re-announced: `warnAboutHarnessReadiness` said it
+  //     on stderr at startup, when a person is watching (the `--daemon` launcher
+  //     runs that preflight in the FOREGROUND because the child logs to a file).
+  //     It is latched in the constructor and recorded at debug.
+  //   - A transition carries the same repair copy the startup path prints, not
+  //     generic prose: a binary missing at 3am needs the repair and the restart.
   logBundledTransitions() {
     for (const runtime of ["claude-code", "codex"]) {
       const intended = runtime === "codex" ? isCodexEnabled(this.config) : isClaudeCodeConnected(this.config);
@@ -16130,9 +15809,8 @@ var CompanionSupervisor = class {
         this.log.debug(meta, "companion: bundled harness binary is missing (harness not in use)");
     }
   }
-  // CT1379: the boot state, latched so the first refresh reports no news, and
-  // recorded once as evidence. Runs in the constructor — the resolve is a module
-  // lookup plus a stat, so it costs nothing and needs no await.
+  // The boot state, latched so the first refresh reports no news, and recorded
+  // once as evidence. Synchronous: a module lookup plus a stat.
   latchBootBundledState() {
     for (const runtime of ["claude-code", "codex"]) {
       const resolution = this.resolveBundled(runtime);
@@ -16150,35 +15828,34 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // CT1679: the locks every runner on this device shares, held here.
+  // The locks every runner on this device shares.
   runnerLocks = new DeviceLocks();
-  // CT1679: `runners.sandbox`, checked against this host once. A host that
-  // can't make the sandbox says so once and runs its turns unwrapped.
+  // `runners.sandbox`, checked against this host once. A host that can't make
+  // the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
   sandboxHost = {
     osSandboxUsable: () => this.sandboxUsable ??= osSandboxUsable(this.log)
   };
-  // CT1684: `runners.policy`, parsed once. An invalid one is kept as the
-  // error, which every sandboxed turn is refused with.
+  // `runners.policy`, parsed once. An invalid one is kept as the error, which
+  // every sandboxed turn is refused with.
   parsedSandboxPolicy;
   sandboxPolicy() {
     this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
     return this.parsedSandboxPolicy;
   }
-  // CT1691: the walk for other companions' stores, run off the turn path.
+  // The walk for other companions' stores, run off the turn path.
   storeWatch;
   companionStores() {
     this.storeWatch ??= companionStoreWatch(this.log);
     return this.storeWatch;
   }
-  // CT1693: the sandbox one agent's turns run under — its `agents` row, then
-  // the device's. Resolved from the current config every time it's asked, so
-  // a reload changes it; only the host probe is kept.
+  // The sandbox one agent's turns run under: its `agents` row, then the
+  // device's. Resolved from the current config on every ask, so a reload
+  // changes it; only the host probe is kept.
   runnerSandboxFor(row) {
     return runnerSandboxFor(this.config, row, this.sandboxHost);
   }
-  // CT1693: what the heartbeat says about this device's runners, resolved
-  // against the agents it runs right now.
+  // Resolved against the agents this device runs right now.
   runnerManifest() {
     const agents = [...this.workspaces.values()].flatMap(
       (wr) => [...wr.agents.values()].map((agent) => ({
@@ -16192,7 +15869,7 @@ var CompanionSupervisor = class {
       ...runnerSandboxReport(this.config, agents, this.sandboxHost)
     };
   }
-  // CT1679: one provider for the device, built on first use.
+  // One provider for the device, built on first use.
   runnerProvider() {
     this.providerForRunners ??= this.dockerRunners() ? this.createDockerRunners() : createLocalProcessProvider();
     return this.providerForRunners;
@@ -16234,8 +15911,7 @@ var CompanionSupervisor = class {
       log: this.log
     });
   }
-  // CT1681: the runner command for this device's provider: the image's own
-  // companion in a container, this process's otherwise.
+  // The image's own companion in a container, this process's otherwise.
   runnerCommandFor() {
     if (this.runnerCommand) return this.runnerCommand;
     return this.dockerRunners() ? ["cabane-companion", "run-turn"] : selfRunnerCommand();
@@ -16267,36 +15943,20 @@ var CompanionSupervisor = class {
       aborts: ctx.aborts,
       runConfig: ctx.runConfig,
       log: this.log.child({ agentName: ctx.agentDisplayName ?? ctx.agentUsername }),
-      // CT833: register the claude-code adapter only when this device actually
-      // offers claude-code — read per turn (not captured here), so a harness
-      // installed or connected after boot works on the next turn exactly as it
-      // appears on the next beat. CT1082: "offers" means connected as well as
-      // runnable, so a disconnected harness can't be selected either.
-      // CT1379: and the same for the bundled binary — the predicate is shared with
-      // the heartbeat above, so a runtime advertised by one and refused by the
-      // other is not expressible.
+      // Read PER TURN off the heartbeat's own predicates, so a harness installed
+      // or connected after boot works on the next turn exactly as it appears on
+      // the next beat, and a runtime advertised by one and refused by the other
+      // is not expressible.
       claudeCodeAvailable: () => this.claudeCodeOffered(),
-      // CT270: the opencode server URL (operator-configured), when this device
-      // offers the opencode runtime. Threaded so an opencode turn selects the
-      // opencode adapter; unset leaves the device claude-code-only.
       ...this.config.opencode?.serverUrl ? { opencodeServerUrl: this.config.opencode.serverUrl } : {},
-      // CT481: register the codex adapter when this device offers codex; a miss
-      // leaves an `openai/…` turn to fail loudly (no silent claude-code fallback).
-      // CT1379: read PER TURN, like claude-code above, and off the same predicate
-      // the heartbeat uses — it was captured here at dispatcher-construction time
-      // from the enable flag alone, so a device could register an adapter for a
-      // binary it did not have and keep it registered after the binary came back.
       codexAvailable: () => this.codexOffered(),
-      // CT556: per-turn timeout watchdog windows, from the companion's own env
-      // (`AGENT_IDLE_TIMEOUT_MS` / `AGENT_TOTAL_TIMEOUT_MS`). Unset → the
-      // dispatcher's baked-in defaults (CT1503: 15 min idle / 6h total). An
-      // override set here still wins, and is deliberately not validated against
-      // the tool ceilings it may reorder — see DEFAULT_AGENT_IDLE_TIMEOUT_MS.
+      // Unset uses the dispatcher's defaults. An override is deliberately not
+      // validated against the tool ceilings it may reorder; see
+      // DEFAULT_AGENT_IDLE_TIMEOUT_MS.
       ...positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") !== void 0 ? { idleTimeoutMs: positiveIntEnv("AGENT_IDLE_TIMEOUT_MS") } : {},
       ...positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") !== void 0 ? { totalTimeoutMs: positiveIntEnv("AGENT_TOTAL_TIMEOUT_MS") } : {},
       observer: this.hub.observerFor(ctx.workspaceId, ctx.agentId, ctx.workspaceSlug),
       transcriptDir: transcriptsDir(),
-      // CT566: the shared connector-health memory the turn records into on settle.
       connectorHealth: this.connectorHealth,
       ...runnersEnabled(this.config) ? {
         runner: {
@@ -16320,11 +15980,10 @@ var CompanionSupervisor = class {
     this.workspaces.delete(workspaceId);
     this.hub.removeWorkspace(workspaceId);
   }
-  // ---- SSE event routing (per workspace, BY agentId) ----
-  // ACC10: the device stream's frames — dispatch and cancel, addressed to this
-  // device and authenticated as it. ACC8: the only stream this companion opens.
-  // It keeps no cursor: it replays what is still offered on every connect
-  // instead of resuming from a `Last-Event-ID`.
+  // ---- SSE event routing (BY agentId) ----
+  // Dispatch and cancel, addressed to this device. The stream keeps no cursor:
+  // it replays what is still offered on every connect instead of resuming from
+  // a `Last-Event-ID`.
   async handleDeviceMessage(ev) {
     const wire = this.parseFrame(ev);
     if (!wire) return;
@@ -16360,9 +16019,9 @@ var CompanionSupervisor = class {
       return null;
     }
   }
-  // ACC10: the dedupe gate. A reconnect replays every dispatch still offered,
-  // including one whose turn is already running here; the first copy runs the
-  // turn and a later one waits for it and then does nothing.
+  // A reconnect replays every dispatch still offered, including one whose turn
+  // is already running here; the first copy runs it and a later one waits for
+  // it and then does nothing.
   //
   // A cancel needs no gate: `dispatcher.cancel` on an already-aborted run is a
   // no-op that reports `false`, so a second copy is inert.
@@ -16378,8 +16037,6 @@ var CompanionSupervisor = class {
       if (claim) this.claims.release(wire.id);
     }
   }
-  // Everything below here is the routing as it was: it takes a frame and knows
-  // nothing about which stream carried it.
   async routeFrame(wr, wire) {
     if (wire.type === "device:cancel_requested") {
       const payload2 = {
@@ -16445,17 +16102,12 @@ var CompanionSupervisor = class {
     await tail;
     if (wr.chains.get(chainKey) === tail) wr.chains.delete(chainKey);
   }
-  // CT1146: tell the server this device cannot run a dispatch it was addressed to.
-  //
+  // Tell the server this device cannot run a dispatch it was addressed to.
   // Returns whether the report LANDED. The server checks the recorded dispatch
-  // destination even if the agent's assignment has moved. Reporting promptly
-  // explains the roster miss; the thirty-minute unanswered-offer deadline is
-  // only the backstop when no report lands.
+  // destination even if the assignment has moved.
   //
-  // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
-  // dropped socket) and one more attempt a second later usually lands. Bounded
-  // hard — this runs inline on the event loop, and an unbounded wait here would
-  // wedge the workspace's whole stream.
+  // Retried, because the common failure is transient (a 503 mid-deploy), and
+  // bounded hard: this runs inline, and an unbounded wait would wedge the stream.
   async reportUnrunnableDispatch(workspaceId, payload) {
     if (!this.deviceApi) return false;
     let lastErr;
@@ -16495,9 +16147,8 @@ var CompanionSupervisor = class {
     );
     return false;
   }
-  // CT1680: a runner is gone without having settled its turn. Same bounded
-  // retry as the unrunnable report above, on the device credential, which is
-  // the one the launcher still holds whatever became of the runner.
+  // A runner is gone without having settled its turn. Same bounded retry, on the
+  // device credential, which the launcher holds whatever became of the runner.
   async reportRunnerGone(report) {
     if (!this.deviceApi) return;
     let lastErr;
@@ -16522,12 +16173,9 @@ var CompanionSupervisor = class {
       "Couldn't tell Cabane a turn's runner stopped; its credential expires on its own."
     );
   }
-  // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
-  // we don't yet run. If it's addressed to THIS device, the assignment just
-  // changed under us (the poll hasn't caught it) — force a fresh assignments pull
-  // and return the now-live runner. Returns undefined when the dispatch isn't for
-  // this device, or the agent still isn't ours after pulling (a genuine
-  // not-ours dispatch) — the caller then settles and ignores it as before.
+  // Pull-on-miss: a dispatch addressed to THIS device for an agent we don't run
+  // yet means the assignment changed under us. Undefined when it isn't for this
+  // device, or the agent still isn't ours after the pull.
   async recoverRacedAgent(wr, payload) {
     if (!this.deviceId || payload.deviceId !== this.deviceId) return void 0;
     if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -16568,9 +16216,8 @@ var CompanionSupervisor = class {
         };
         const tail = this.runDispatch(
           wr,
-          // No frame delivered this one — it came off `/runs` — so there is no
-          // dispatch id to dedupe on. The `recoveredTurns` set above is this
-          // path's own guard.
+          // Off `/runs`, not a frame, so no dispatch id to dedupe on;
+          // `recoveredTurns` is this path's guard.
           "",
           payload,
           agent,
@@ -16592,9 +16239,7 @@ var CompanionSupervisor = class {
       this.recovering = false;
     }
   }
-  // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
-  // the console summary. Mirrors the old per-workspace `handleEvent`, now
-  // scoped to one agent.
+  // One turn: the skip-vs-resume dedupe, the dispatch, then the console summary.
   async runDispatch(wr, dispatchId, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
     if (dispatchId && hasDispatched(workspaceId, dispatchId)) {
@@ -16679,7 +16324,7 @@ var CompanionSupervisor = class {
       );
     }
   }
-  // ---- per-agent outbox drain scheduler (CT25) ----
+  // ---- per-agent outbox drain scheduler ----
   makeDrain(api, agentId) {
     let drainTimer;
     let drainDelay = DRAIN_BASE_MS;
@@ -16748,19 +16393,16 @@ var CompanionSupervisor = class {
     saveConfig(next);
     configureLogger(this.log, next);
   }
-  // ---- harnesses (CT586) ----
-  // Probe all three harnesses, cache the signals + versions, and push the derived
-  // per-harness snapshot to the hub (which flips the Companion's Harnesses surface
-  // over SSE). Fail-soft by construction — `probeHarnessSignals` never throws — but
-  // wrapped anyway so a harness refresh can never take a heartbeat down. Called on
-  // the heartbeat cadence (fresh presence for the manifest + UI) and on demand.
+  // ---- harnesses ----
+  // Probe all three harnesses, cache signals and versions, and push the snapshot
+  // to the hub. `probeHarnessSignals` never throws, but this is wrapped anyway so
+  // a refresh can never take a heartbeat down.
   async refreshHarnessStatuses(presence = {}) {
     try {
       const signals = await probeHarnessSignals(this.config, {
         probePresence: this.probePresence,
         presence,
-        // CT1379: the bundled executables are resolved on the same cadence as the
-        // CLI probes, through the supervisor's seam so a test pins the host fact.
+        // Through the supervisor's seam, so a test pins the host fact.
         resolveBundled: this.resolveBundled
       });
       this.harnessSignals = signals;
@@ -16783,11 +16425,10 @@ var CompanionSupervisor = class {
   async recheckHarnesses() {
     await this.refreshHarnessStatuses();
   }
-  // CT1085 §1 step 3: beat NOW and wait for it to land. `start` calls this
-  // between bringing the runtime up and asking the person anything, so the
-  // browser's connect step is already showing what this machine has ("your
-  // terminal is asking") rather than sitting blank while the terminal blocks on
-  // an answer. Coalesces with an in-flight beat rather than stacking a second.
+  // Beat NOW and wait for it to land. `start` calls this before asking the
+  // person anything, so the browser's connect step already shows what this
+  // machine has rather than sitting blank while the terminal waits on an answer.
+  // Coalesces with an in-flight beat.
   async heartbeatNow() {
     if (this.inFlightHeartbeat) {
       await this.inFlightHeartbeat;
@@ -16796,35 +16437,25 @@ var CompanionSupervisor = class {
     this.kickHeartbeat();
     if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
   }
-  // CT1085: the config as it stands right now — after any `enableHarness` write.
-  // The control socket's connect handler needs it to run the shake-out check
-  // against the URL/flag that was just persisted, not the one this process booted
-  // with.
+  // The config as it stands now, after any `enableHarness` write: the control
+  // socket's shake-out check needs what was just persisted, not the boot config.
   currentConfig() {
     return this.config;
   }
-  // Friendly enable for the config-driven harnesses — flip the flag the app owns in
-  // `~/.cabane/config.json`, no hand-edited JSON. It never installs a binary and
-  // never drives a login (BYO — Decided).
+  // Enable a config-driven harness by flipping the flag the app owns in
+  // `~/.cabane/config.json`. Never installs a binary or drives a login (BYO).
   //
-  // CT1379: this records INTENT; it does not by itself expose anything. A harness
-  // is advertised only when the user asked for it AND the SDK's own bundled binary
-  // resolves, so a successful enable on a companion whose optional dependency
-  // never installed leaves the device advertising nothing — correctly, and with
-  // the Harnesses surface saying why. Read every "expose" below as "record the
-  // half of the answer the user owns".
-  //   - claude-code (CT1082): set `claudeCode.enabled`, after checking `claude` is
-  //     on PATH. This is the callable the terminal offer ("We found Claude Code.
-  //     Connect it? [Y/n]") and the web pairing flow both wire to.
-  //   - codex: set `codex.enabled` after checking `codex` is on PATH (the CLI +
-  //     `codex login` remain the user's).
-  //   - opencode: set `opencode.serverUrl` — but ONLY after health-probing the URL,
-  //     so we never advertise a serve that isn't there. An unreachable URL is a
-  //     typed failure the UI shows in place, not a silent bad write.
-  // On success, persist, re-probe, and beat immediately, so a runtime that IS
-  // launchable starts taking turns at once rather than on the next tick — and one
-  // that isn't reports its issue just as promptly. Returns a typed outcome (never
-  // throws for a reachable/valid input).
+  // This records INTENT, the user's half: a harness is advertised only when also
+  // its bundled binary resolves, so an enable on a companion whose optional
+  // dependency never installed advertises nothing, and the Harnesses surface
+  // says why.
+  //   - claude-code: `claudeCode.enabled`, after a presence check. The terminal
+  //     offer and the web pairing flow both call this.
+  //   - codex: `codex.enabled`, after a presence check (login stays the user's).
+  //   - opencode: `opencode.serverUrl`, ONLY after health-probing the URL; an
+  //     unreachable one is a typed failure shown in place.
+  // On success: persist, re-probe and beat at once, so the answer is true in
+  // Cabane promptly either way. Never throws for a valid input.
   async enableHarness(input) {
     let next;
     let checkedPresence = null;
@@ -16875,9 +16506,8 @@ var CompanionSupervisor = class {
     return { ok: true };
   }
   // Re-create every running agent's Dispatcher from the CURRENT config, keeping
-  // the runner (its api/outbox/chains/SSE) intact. Used after a runtime-enabling
-  // config change so constructor-captured options — per-agent cwd/prepareHook and
-  // the adapter registry — pick up their new values without an app restart.
+  // the runner (its api, outbox, chains) intact, so constructor-captured options
+  // pick up a config change without a restart.
   rebuildDispatchers() {
     for (const wr of this.workspaces.values()) {
       for (const runner of wr.agents.values()) {
@@ -17045,8 +16675,7 @@ async function createCompanionRuntime(opts = {}) {
     }));
     await warnAboutHarnessReadiness(cfg, {
       probeClaude: async () => claudeCode,
-      // CT1085: the CLI's onboarding script owns the terminal and says this in
-      // its own words (the `!` block, or the per-harness offer), so it hands us a
+      // The CLI's onboarding script says this in its own words, so it hands a
       // sink that logs instead. Every other caller keeps the stderr line.
       ...opts.onReadinessWarning ? { warn: opts.onReadinessWarning } : {}
     });
@@ -17083,11 +16712,10 @@ async function createCompanionRuntime(opts = {}) {
   const clearRuntimeOnExit = () => clearRuntimeStateIfOurs(instanceId);
   process.on("exit", clearRuntimeOnExit);
   const hub = new CompanionStateHub({
-    // CT29: one device, one base URL — the cabane instance this device is paired
-    // with. The dashboard's connection line shows it.
+    // The dashboard's connection line shows it.
     baseUrl: cfg.baseUrl,
     companionVersion: COMPANION_VERSION,
-    // SJ516 F4: surfaced on `/api/status` so `stop`/`status` can confirm the
+    // Surfaced on `/api/status` so `stop`/`status` can confirm the
     // process behind the marker pid is this companion (not a recycled pid).
     instanceId
   });
@@ -17140,7 +16768,7 @@ async function createCompanionRuntime(opts = {}) {
       socket: control.path,
       ...dashboard ? { url: dashboard.url, port: dashboard.port } : {},
       startedAt,
-      // SJ495: the daemon launcher sets this env on the detached child, so the
+      // The daemon launcher sets this env on the detached child, so the
       // marker records whether this companion is backgrounded (foreground start
       // leaves it unset → false).
       daemon: process.env.CABANE_COMPANION_DAEMON === "1",
@@ -17244,7 +16872,7 @@ async function startDaemon(opts = {}, deps = {}) {
   });
   await ensureRuntime(cfg, {
     probeClaude: async () => claudeOnPath2,
-    // CT1085: the onboarding script already said what's connectable, in its own
+    // The onboarding script already said what's connectable, in its own
     // words. Saying it again here, on stderr, in the middle of the closing block
     // would be the same news twice.
     ...quiet ? { warn: () => {